41967b26b62d9d9286c7475c79d0dd4ee1c0bc32efce9beaa310158b703126cb

Analysis

max time kernel
92s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41967b26b62d9d9286c7475c79d0dd4ee1c0bc32efce9beaa310158b703126cb.exe
Size

108KB
MD5

e834efdde8daa324111ba82f4ca2c7ce
SHA1

a9ed127f101fa1949f344521813b410cd4e2f03a
SHA256

41967b26b62d9d9286c7475c79d0dd4ee1c0bc32efce9beaa310158b703126cb
SHA512

2e5898f30a3fc4a0270f0b23ab07852e9319c092f8d387c25856b54d4a192e14b98c544549f978ae7bbb06bdcf6bd8acd7a452a49405ab3578d133f09345c932
SSDEEP

3072:nhDLd5BdstEtvZGBUjmOiBn3w8BdTj2h3K:nhXjBdk6ZG+jVu3w8BdTj2VK

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eoocmoao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpijnqkp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofeilobp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aacckjaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekacmjgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbnafb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imdnklfp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcmabg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebbidj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onholckc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qecppkdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njnpppkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibagcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhfonc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gblngpbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeaikh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajkaii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Elccfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjhfnccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fhcpgmjf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icnpmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kboljk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlhbal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gameonno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmccchkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oboaabga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqpnombl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clnjjpod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkalchij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Miifeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfnnlffc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdemhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojgbfocc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifmcdblq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kilhgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfqlnm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ficgacna.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kknafn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chdkoa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eocenh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Flceckoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Medgncoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkfkfohj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lijdhiaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abbpem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gomakdcp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbjcolha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Medgncoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmfkoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpppnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ognpebpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ambgef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dobfld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkapp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehjdldfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebbidj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbgbpihg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njogjfoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbbgnpgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qeemej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bahmfj32.exe

Executes dropped EXE 64 IoCs

pid	Process
4184	Eoocmoao.exe
3084	Ebnoikqb.exe
4992	Efikji32.exe
2556	Ehhgfdho.exe
536	Elccfc32.exe
372	Ecmlcmhe.exe
4912	Ebploj32.exe
4880	Ehjdldfl.exe
2948	Eleplc32.exe
4904	Ecphimfb.exe
2536	Ebbidj32.exe
3004	Ejjqeg32.exe
928	Elhmablc.exe
2980	Eqciba32.exe
2692	Eofinnkf.exe
2592	Ecbenm32.exe
3648	Efpajh32.exe
4528	Ejlmkgkl.exe
1472	Emjjgbjp.exe
4436	Eqfeha32.exe
4968	Ecdbdl32.exe
3152	Fbgbpihg.exe
752	Fjnjqfij.exe
5064	Fmmfmbhn.exe
1688	Fcgoilpj.exe
4928	Ffekegon.exe
2280	Fjqgff32.exe
2924	Ficgacna.exe
5116	Fomonm32.exe
4236	Fbllkh32.exe
1580	Fjcclf32.exe
5088	Fqmlhpla.exe
3440	Fbnhphbp.exe
3460	Fjepaecb.exe
4620	Fqohnp32.exe
3136	Fcnejk32.exe
3576	Fflaff32.exe
808	Fjhmgeao.exe
4784	Fmficqpc.exe
4636	Fodeolof.exe
2472	Gfnnlffc.exe
2216	Gimjhafg.exe
2084	Gqdbiofi.exe
2864	Gbenqg32.exe
1080	Gjlfbd32.exe
3860	Gmkbnp32.exe
2812	Gcekkjcj.exe
4032	Gfcgge32.exe
452	Gjocgdkg.exe
3364	Gmmocpjk.exe
4800	Gcggpj32.exe
4248	Gfedle32.exe
2376	Gidphq32.exe
3420	Gqkhjn32.exe
3260	Gcidfi32.exe
1576	Gfhqbe32.exe
1560	Gifmnpnl.exe
3864	Gameonno.exe
544	Hclakimb.exe
2772	Hjfihc32.exe
1812	Hmdedo32.exe
3752	Hpbaqj32.exe
1428	Hcnnaikp.exe
444	Hjhfnccl.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Pdgdjjem.dll	Mkbchk32.exe
File opened for modification	C:\Windows\SysWOW64\Pkceffcd.exe	Pqnaim32.exe
File opened for modification	C:\Windows\SysWOW64\Lffhfh32.exe	Kdgljmcd.exe
File created	C:\Windows\SysWOW64\Ilaidmmo.dll	Gqdbiofi.exe
File created	C:\Windows\SysWOW64\Qgciaf32.exe	Qeemej32.exe
File created	C:\Windows\SysWOW64\Fllifblf.dll	Jfaedkdp.exe
File created	C:\Windows\SysWOW64\Gnbinq32.dll	Kipkhdeq.exe
File created	C:\Windows\SysWOW64\Nngokoej.exe	Nilcjp32.exe
File created	C:\Windows\SysWOW64\Gimjhafg.exe	Gfnnlffc.exe
File opened for modification	C:\Windows\SysWOW64\Jpijnqkp.exe	Jioaqfcc.exe
File created	C:\Windows\SysWOW64\Jphopllo.dll	Lpcfkm32.exe
File created	C:\Windows\SysWOW64\Olkhmi32.exe	Ojllan32.exe
File created	C:\Windows\SysWOW64\Nnhfee32.exe	Mgnnhk32.exe
File created	C:\Windows\SysWOW64\Jcfhgi32.dll	Pabkdmpi.exe
File created	C:\Windows\SysWOW64\Keoakjca.dll	Chpada32.exe
File opened for modification	C:\Windows\SysWOW64\Dmgbnq32.exe	Dkifae32.exe
File created	C:\Windows\SysWOW64\Kbbfkb32.dll	41967b26b62d9d9286c7475c79d0dd4ee1c0bc32efce9beaa310158b703126cb.exe
File created	C:\Windows\SysWOW64\Qcldhk32.dll	Mcnhmm32.exe
File created	C:\Windows\SysWOW64\Fckajehi.exe	Fkciihgg.exe
File opened for modification	C:\Windows\SysWOW64\Glebhjlg.exe	Fdnjgmle.exe
File opened for modification	C:\Windows\SysWOW64\Ibqpimpl.exe	Icnpmp32.exe
File opened for modification	C:\Windows\SysWOW64\Ipdqba32.exe	Ilidbbgl.exe
File created	C:\Windows\SysWOW64\Jbeidl32.exe	Jpgmha32.exe
File created	C:\Windows\SysWOW64\Agglboim.exe	Ambgef32.exe
File created	C:\Windows\SysWOW64\Lgpagm32.exe	Ldaeka32.exe
File created	C:\Windows\SysWOW64\Qajadlja.exe	Qjpiha32.exe
File opened for modification	C:\Windows\SysWOW64\Eaklidoi.exe	Ekacmjgl.exe
File created	C:\Windows\SysWOW64\Jpijnqkp.exe	Jioaqfcc.exe
File created	C:\Windows\SysWOW64\Jpnchp32.exe	Jmpgldhg.exe
File created	C:\Windows\SysWOW64\Qgcbgo32.exe	Qqijje32.exe
File created	C:\Windows\SysWOW64\Nqmhbpba.exe	Njcpee32.exe
File created	C:\Windows\SysWOW64\Dahode32.exe	Dceohhja.exe
File opened for modification	C:\Windows\SysWOW64\Nggjdc32.exe	Nlaegk32.exe
File opened for modification	C:\Windows\SysWOW64\Pbbgnpgl.exe	Pjkombfj.exe
File created	C:\Windows\SysWOW64\Glhonj32.exe	Gdqgmmjb.exe
File created	C:\Windows\SysWOW64\Nnenbk32.dll	Cdkldb32.exe
File created	C:\Windows\SysWOW64\Oqihnn32.exe	Onklabip.exe
File opened for modification	C:\Windows\SysWOW64\Ekacmjgl.exe	Dhbgqohi.exe
File created	C:\Windows\SysWOW64\Ophfae32.dll	Fckajehi.exe
File opened for modification	C:\Windows\SysWOW64\Lpcfkm32.exe	Llgjjnlj.exe
File created	C:\Windows\SysWOW64\Pnjpej32.dll	Ojhiqefo.exe
File opened for modification	C:\Windows\SysWOW64\Bdkcmdhp.exe	Behbag32.exe
File opened for modification	C:\Windows\SysWOW64\Kimnbd32.exe	Kfoafi32.exe
File created	C:\Windows\SysWOW64\Amhpcomb.dll	Llgjjnlj.exe
File opened for modification	C:\Windows\SysWOW64\Fjhmgeao.exe	Fflaff32.exe
File opened for modification	C:\Windows\SysWOW64\Aabmqd32.exe	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Acjclpcf.exe	Ampkof32.exe
File created	C:\Windows\SysWOW64\Jmbdbd32.exe	Jeklag32.exe
File created	C:\Windows\SysWOW64\Lffhfh32.exe	Kdgljmcd.exe
File created	C:\Windows\SysWOW64\Qknpkqim.dll	Jfhbppbc.exe
File created	C:\Windows\SysWOW64\Jccejahl.dll	Qgciaf32.exe
File created	C:\Windows\SysWOW64\Fdnjgmle.exe	Ffkjlp32.exe
File opened for modification	C:\Windows\SysWOW64\Hijooifk.exe	Heocnk32.exe
File created	C:\Windows\SysWOW64\Hddeok32.dll	Nloiakho.exe
File created	C:\Windows\SysWOW64\Pjdilcla.exe	Odgqdlnj.exe
File opened for modification	C:\Windows\SysWOW64\Clpgpp32.exe	Chdkoa32.exe
File opened for modification	C:\Windows\SysWOW64\Okjbpglo.exe	Oqdoboli.exe
File created	C:\Windows\SysWOW64\Ifmcdblq.exe	Ibagcc32.exe
File created	C:\Windows\SysWOW64\Gdqgmmjb.exe	Gododflk.exe
File opened for modification	C:\Windows\SysWOW64\Icgqggce.exe	Haidklda.exe
File created	C:\Windows\SysWOW64\Lgkhlnbn.exe	Ldmlpbbj.exe
File created	C:\Windows\SysWOW64\Djhgpa32.dll	Ecmeig32.exe
File created	C:\Windows\SysWOW64\Lcjnop32.dll	Imakkfdg.exe
File opened for modification	C:\Windows\SysWOW64\Nngokoej.exe	Nilcjp32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12836	12772	WerFault.exe	656

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogedoeae.dll"	Eqfeha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekiidlll.dll"	Lcbiao32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qbimoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcjkaiib.dll"	Abpcon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paihpaak.dll"	Ffgqqaip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jeklag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mplhql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jjpeepnb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lidmdfdo.dll"	Lpcmec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oapgek32.dll"	Conclk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nenqea32.dll"	Nngokoej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ecmlcmhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nacbfdao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ickchq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iclnemml.dll"	Qbimoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oehldcbk.dll"	Bblckl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bghhihab.dll"	Njcpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qecppkdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ehedfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qghlmgij.dll"	Gfbploob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Elhmablc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ecdbdl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jaljgidl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjegoo32.dll"	Hobkfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgllfp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Elccfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogaodjbe.dll"	Fjnjqfij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbmelbid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Olfobjbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjbndobo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekjfcipa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fckajehi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nloiakho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alcidkmm.dll"	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgdelcpg.dll"	Jcefno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnfmmb32.dll"	Gjlfbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eqciba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqffnmfa.dll"	Mdiklqhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqklmpdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pllfhkno.dll"	Bhdbhcck.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Clnjjpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ophfae32.dll"	Fckajehi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Foabofnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmbdbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onklabip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fljcmlfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ffgqqaip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gfgjgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipnjab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjlcankg.dll"	Jmkdlkph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnfipekh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnnaog32.dll"	Ojopad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgmbieme.dll"	Eoaihhlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aainof32.dll"	Ednaqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qgcbgo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agglboim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Imdnklfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qloebdig.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmfkoh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jbjcolha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ffpmlcim.dll"	Chagok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhgejlhj.dll"	Bhfonc32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 4184	3208	41967b26b62d9d9286c7475c79d0dd4ee1c0bc32efce9beaa310158b703126cb.exe	83
PID 3208 wrote to memory of 4184	3208	41967b26b62d9d9286c7475c79d0dd4ee1c0bc32efce9beaa310158b703126cb.exe	83
PID 3208 wrote to memory of 4184	3208	41967b26b62d9d9286c7475c79d0dd4ee1c0bc32efce9beaa310158b703126cb.exe	83
PID 4184 wrote to memory of 3084	4184	Eoocmoao.exe	84
PID 4184 wrote to memory of 3084	4184	Eoocmoao.exe	84
PID 4184 wrote to memory of 3084	4184	Eoocmoao.exe	84
PID 3084 wrote to memory of 4992	3084	Ebnoikqb.exe	85
PID 3084 wrote to memory of 4992	3084	Ebnoikqb.exe	85
PID 3084 wrote to memory of 4992	3084	Ebnoikqb.exe	85
PID 4992 wrote to memory of 2556	4992	Efikji32.exe	86
PID 4992 wrote to memory of 2556	4992	Efikji32.exe	86
PID 4992 wrote to memory of 2556	4992	Efikji32.exe	86
PID 2556 wrote to memory of 536	2556	Ehhgfdho.exe	87
PID 2556 wrote to memory of 536	2556	Ehhgfdho.exe	87
PID 2556 wrote to memory of 536	2556	Ehhgfdho.exe	87
PID 536 wrote to memory of 372	536	Elccfc32.exe	88
PID 536 wrote to memory of 372	536	Elccfc32.exe	88
PID 536 wrote to memory of 372	536	Elccfc32.exe	88
PID 372 wrote to memory of 4912	372	Ecmlcmhe.exe	89
PID 372 wrote to memory of 4912	372	Ecmlcmhe.exe	89
PID 372 wrote to memory of 4912	372	Ecmlcmhe.exe	89
PID 4912 wrote to memory of 4880	4912	Ebploj32.exe	90
PID 4912 wrote to memory of 4880	4912	Ebploj32.exe	90
PID 4912 wrote to memory of 4880	4912	Ebploj32.exe	90
PID 4880 wrote to memory of 2948	4880	Ehjdldfl.exe	92
PID 4880 wrote to memory of 2948	4880	Ehjdldfl.exe	92
PID 4880 wrote to memory of 2948	4880	Ehjdldfl.exe	92
PID 2948 wrote to memory of 4904	2948	Eleplc32.exe	93
PID 2948 wrote to memory of 4904	2948	Eleplc32.exe	93
PID 2948 wrote to memory of 4904	2948	Eleplc32.exe	93
PID 4904 wrote to memory of 2536	4904	Ecphimfb.exe	94
PID 4904 wrote to memory of 2536	4904	Ecphimfb.exe	94
PID 4904 wrote to memory of 2536	4904	Ecphimfb.exe	94
PID 2536 wrote to memory of 3004	2536	Ebbidj32.exe	96
PID 2536 wrote to memory of 3004	2536	Ebbidj32.exe	96
PID 2536 wrote to memory of 3004	2536	Ebbidj32.exe	96
PID 3004 wrote to memory of 928	3004	Ejjqeg32.exe	97
PID 3004 wrote to memory of 928	3004	Ejjqeg32.exe	97
PID 3004 wrote to memory of 928	3004	Ejjqeg32.exe	97
PID 928 wrote to memory of 2980	928	Elhmablc.exe	98
PID 928 wrote to memory of 2980	928	Elhmablc.exe	98
PID 928 wrote to memory of 2980	928	Elhmablc.exe	98
PID 2980 wrote to memory of 2692	2980	Eqciba32.exe	99
PID 2980 wrote to memory of 2692	2980	Eqciba32.exe	99
PID 2980 wrote to memory of 2692	2980	Eqciba32.exe	99
PID 2692 wrote to memory of 2592	2692	Eofinnkf.exe	100
PID 2692 wrote to memory of 2592	2692	Eofinnkf.exe	100
PID 2692 wrote to memory of 2592	2692	Eofinnkf.exe	100
PID 2592 wrote to memory of 3648	2592	Ecbenm32.exe	101
PID 2592 wrote to memory of 3648	2592	Ecbenm32.exe	101
PID 2592 wrote to memory of 3648	2592	Ecbenm32.exe	101
PID 3648 wrote to memory of 4528	3648	Efpajh32.exe	102
PID 3648 wrote to memory of 4528	3648	Efpajh32.exe	102
PID 3648 wrote to memory of 4528	3648	Efpajh32.exe	102
PID 4528 wrote to memory of 1472	4528	Ejlmkgkl.exe	103
PID 4528 wrote to memory of 1472	4528	Ejlmkgkl.exe	103
PID 4528 wrote to memory of 1472	4528	Ejlmkgkl.exe	103
PID 1472 wrote to memory of 4436	1472	Emjjgbjp.exe	104
PID 1472 wrote to memory of 4436	1472	Emjjgbjp.exe	104
PID 1472 wrote to memory of 4436	1472	Emjjgbjp.exe	104
PID 4436 wrote to memory of 4968	4436	Eqfeha32.exe	106
PID 4436 wrote to memory of 4968	4436	Eqfeha32.exe	106
PID 4436 wrote to memory of 4968	4436	Eqfeha32.exe	106
PID 4968 wrote to memory of 3152	4968	Ecdbdl32.exe	107

C:\Users\Admin\AppData\Local\Temp\41967b26b62d9d9286c7475c79d0dd4ee1c0bc32efce9beaa310158b703126cb.exe
"C:\Users\Admin\AppData\Local\Temp\41967b26b62d9d9286c7475c79d0dd4ee1c0bc32efce9beaa310158b703126cb.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Windows\SysWOW64\Eoocmoao.exe
  C:\Windows\system32\Eoocmoao.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\SysWOW64\Ebnoikqb.exe
    C:\Windows\system32\Ebnoikqb.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3084
  - - C:\Windows\SysWOW64\Efikji32.exe
      C:\Windows\system32\Efikji32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4992
    - - C:\Windows\SysWOW64\Ehhgfdho.exe
        
        C:\Windows\system32\Ehhgfdho.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2556
      - C:\Windows\SysWOW64\Elccfc32.exe
        
        C:\Windows\system32\Elccfc32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\SysWOW64\Ecmlcmhe.exe
        
        C:\Windows\system32\Ecmlcmhe.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:372
        
        C:\Windows\SysWOW64\Ebploj32.exe
        
        C:\Windows\system32\Ebploj32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4912
        
        C:\Windows\SysWOW64\Ehjdldfl.exe
        
        C:\Windows\system32\Ehjdldfl.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4880
        
        C:\Windows\SysWOW64\Eleplc32.exe
        
        C:\Windows\system32\Eleplc32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2948
        
        C:\Windows\SysWOW64\Ecphimfb.exe
        
        C:\Windows\system32\Ecphimfb.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\SysWOW64\Ebbidj32.exe
        
        C:\Windows\system32\Ebbidj32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2536
        
        C:\Windows\SysWOW64\Ejjqeg32.exe
        
        C:\Windows\system32\Ejjqeg32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3004
        
        C:\Windows\SysWOW64\Elhmablc.exe
        
        C:\Windows\system32\Elhmablc.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:928
        
        C:\Windows\SysWOW64\Eqciba32.exe
        
        C:\Windows\system32\Eqciba32.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2980
        
        C:\Windows\SysWOW64\Eofinnkf.exe
        
        C:\Windows\system32\Eofinnkf.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2692
        
        C:\Windows\SysWOW64\Ecbenm32.exe
        
        C:\Windows\system32\Ecbenm32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2592
        
        C:\Windows\SysWOW64\Efpajh32.exe
        
        C:\Windows\system32\Efpajh32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3648
        
        C:\Windows\SysWOW64\Ejlmkgkl.exe
        
        C:\Windows\system32\Ejlmkgkl.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4528
        
        C:\Windows\SysWOW64\Emjjgbjp.exe
        
        C:\Windows\system32\Emjjgbjp.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1472
        
        C:\Windows\SysWOW64\Eqfeha32.exe
        
        C:\Windows\system32\Eqfeha32.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4436
        
        C:\Windows\SysWOW64\Ecdbdl32.exe
        
        C:\Windows\system32\Ecdbdl32.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\SysWOW64\Fbgbpihg.exe
        
        C:\Windows\system32\Fbgbpihg.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3152
        
        C:\Windows\SysWOW64\Fjnjqfij.exe
        
        C:\Windows\system32\Fjnjqfij.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:752
        
        C:\Windows\SysWOW64\Fmmfmbhn.exe
        
        C:\Windows\system32\Fmmfmbhn.exe
        25⤵
        Executes dropped EXE
        
        PID:5064
        
        C:\Windows\SysWOW64\Fcgoilpj.exe
        
        C:\Windows\system32\Fcgoilpj.exe
        26⤵
        Executes dropped EXE
        
        PID:1688
        
        C:\Windows\SysWOW64\Ffekegon.exe
        
        C:\Windows\system32\Ffekegon.exe
        27⤵
        Executes dropped EXE
        
        PID:4928
        
        C:\Windows\SysWOW64\Fjqgff32.exe
        
        C:\Windows\system32\Fjqgff32.exe
        28⤵
        Executes dropped EXE
        
        PID:2280
        
        C:\Windows\SysWOW64\Ficgacna.exe
        
        C:\Windows\system32\Ficgacna.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2924
        
        C:\Windows\SysWOW64\Fomonm32.exe
        
        C:\Windows\system32\Fomonm32.exe
        30⤵
        Executes dropped EXE
        
        PID:5116
        
        C:\Windows\SysWOW64\Fbllkh32.exe
        
        C:\Windows\system32\Fbllkh32.exe
        31⤵
        Executes dropped EXE
        
        PID:4236
        
        C:\Windows\SysWOW64\Fjcclf32.exe
        
        C:\Windows\system32\Fjcclf32.exe
        32⤵
        Executes dropped EXE
        
        PID:1580
        
        C:\Windows\SysWOW64\Fqmlhpla.exe
        
        C:\Windows\system32\Fqmlhpla.exe
        33⤵
        Executes dropped EXE
        
        PID:5088
        
        C:\Windows\SysWOW64\Fbnhphbp.exe
        
        C:\Windows\system32\Fbnhphbp.exe
        34⤵
        Executes dropped EXE
        
        PID:3440
        
        C:\Windows\SysWOW64\Fjepaecb.exe
        
        C:\Windows\system32\Fjepaecb.exe
        35⤵
        Executes dropped EXE
        
        PID:3460
        
        C:\Windows\SysWOW64\Fqohnp32.exe
        
        C:\Windows\system32\Fqohnp32.exe
        36⤵
        Executes dropped EXE
        
        PID:4620
        
        C:\Windows\SysWOW64\Fcnejk32.exe
        
        C:\Windows\system32\Fcnejk32.exe
        37⤵
        Executes dropped EXE
        
        PID:3136
        
        C:\Windows\SysWOW64\Fflaff32.exe
        
        C:\Windows\system32\Fflaff32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3576
        
        C:\Windows\SysWOW64\Fjhmgeao.exe
        
        C:\Windows\system32\Fjhmgeao.exe
        39⤵
        Executes dropped EXE
        
        PID:808
        
        C:\Windows\SysWOW64\Fmficqpc.exe
        
        C:\Windows\system32\Fmficqpc.exe
        40⤵
        Executes dropped EXE
        
        PID:4784
        
        C:\Windows\SysWOW64\Fodeolof.exe
        
        C:\Windows\system32\Fodeolof.exe
        41⤵
        Executes dropped EXE
        
        PID:4636
        
        C:\Windows\SysWOW64\Gfnnlffc.exe
        
        C:\Windows\system32\Gfnnlffc.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2472
        
        C:\Windows\SysWOW64\Gimjhafg.exe
        
        C:\Windows\system32\Gimjhafg.exe
        43⤵
        Executes dropped EXE
        
        PID:2216
        
        C:\Windows\SysWOW64\Gqdbiofi.exe
        
        C:\Windows\system32\Gqdbiofi.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2084
        
        C:\Windows\SysWOW64\Gbenqg32.exe
        
        C:\Windows\system32\Gbenqg32.exe
        45⤵
        Executes dropped EXE
        
        PID:2864
        
        C:\Windows\SysWOW64\Gjlfbd32.exe
        
        C:\Windows\system32\Gjlfbd32.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1080
        
        C:\Windows\SysWOW64\Gmkbnp32.exe
        
        C:\Windows\system32\Gmkbnp32.exe
        47⤵
        Executes dropped EXE
        
        PID:3860
        
        C:\Windows\SysWOW64\Gcekkjcj.exe
        
        C:\Windows\system32\Gcekkjcj.exe
        48⤵
        Executes dropped EXE
        
        PID:2812
        
        C:\Windows\SysWOW64\Gfcgge32.exe
        
        C:\Windows\system32\Gfcgge32.exe
        49⤵
        Executes dropped EXE
        
        PID:4032
        
        C:\Windows\SysWOW64\Gjocgdkg.exe
        
        C:\Windows\system32\Gjocgdkg.exe
        50⤵
        Executes dropped EXE
        
        PID:452
        
        C:\Windows\SysWOW64\Gmmocpjk.exe
        
        C:\Windows\system32\Gmmocpjk.exe
        51⤵
        Executes dropped EXE
        
        PID:3364
        
        C:\Windows\SysWOW64\Gcggpj32.exe
        
        C:\Windows\system32\Gcggpj32.exe
        52⤵
        Executes dropped EXE
        
        PID:4800
        
        C:\Windows\SysWOW64\Gfedle32.exe
        
        C:\Windows\system32\Gfedle32.exe
        53⤵
        Executes dropped EXE
        
        PID:4248
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        54⤵
        Executes dropped EXE
        
        PID:2376
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        55⤵
        Executes dropped EXE
        
        PID:3420
        
        C:\Windows\SysWOW64\Gcidfi32.exe
        
        C:\Windows\system32\Gcidfi32.exe
        56⤵
        Executes dropped EXE
        
        PID:3260
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        57⤵
        Executes dropped EXE
        
        PID:1576
        
        C:\Windows\SysWOW64\Gifmnpnl.exe
        
        C:\Windows\system32\Gifmnpnl.exe
        58⤵
        Executes dropped EXE
        
        PID:1560
        
        C:\Windows\SysWOW64\Gameonno.exe
        
        C:\Windows\system32\Gameonno.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3864
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        60⤵
        Executes dropped EXE
        
        PID:544
        
        C:\Windows\SysWOW64\Hjfihc32.exe
        
        C:\Windows\system32\Hjfihc32.exe
        61⤵
        Executes dropped EXE
        
        PID:2772
        
        C:\Windows\SysWOW64\Hmdedo32.exe
        
        C:\Windows\system32\Hmdedo32.exe
        62⤵
        Executes dropped EXE
        
        PID:1812
        
        C:\Windows\SysWOW64\Hpbaqj32.exe
        
        C:\Windows\system32\Hpbaqj32.exe
        63⤵
        Executes dropped EXE
        
        PID:3752
        
        C:\Windows\SysWOW64\Hcnnaikp.exe
        
        C:\Windows\system32\Hcnnaikp.exe
        64⤵
        Executes dropped EXE
        
        PID:1428
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:444
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        66⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\Hpenfjad.exe
        
        C:\Windows\system32\Hpenfjad.exe
        67⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\Hfofbd32.exe
        
        C:\Windows\system32\Hfofbd32.exe
        68⤵
        
        PID:1976
        
        C:\Windows\SysWOW64\Hmioonpn.exe
        
        C:\Windows\system32\Hmioonpn.exe
        69⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Hpgkkioa.exe
        
        C:\Windows\system32\Hpgkkioa.exe
        70⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\Hbeghene.exe
        
        C:\Windows\system32\Hbeghene.exe
        71⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\Hjmoibog.exe
        
        C:\Windows\system32\Hjmoibog.exe
        72⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\Hmklen32.exe
        
        C:\Windows\system32\Hmklen32.exe
        73⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\Hpihai32.exe
        
        C:\Windows\system32\Hpihai32.exe
        74⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\Hfcpncdk.exe
        
        C:\Windows\system32\Hfcpncdk.exe
        75⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\Hibljoco.exe
        
        C:\Windows\system32\Hibljoco.exe
        76⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\Haidklda.exe
        
        C:\Windows\system32\Haidklda.exe
        77⤵
        Drops file in System32 directory
        
        PID:5008
        
        C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        78⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        79⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\Iakaql32.exe
        
        C:\Windows\system32\Iakaql32.exe
        80⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\Icjmmg32.exe
        
        C:\Windows\system32\Icjmmg32.exe
        81⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        82⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\Iannfk32.exe
        
        C:\Windows\system32\Iannfk32.exe
        83⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        84⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Ifjfnb32.exe
        
        C:\Windows\system32\Ifjfnb32.exe
        85⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        86⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\Imdnklfp.exe
        
        C:\Windows\system32\Imdnklfp.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5148
        
        C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        88⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5228
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5276
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        91⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Ipegmg32.exe
        
        C:\Windows\system32\Ipegmg32.exe
        92⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        93⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        94⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Imihfl32.exe
        
        C:\Windows\system32\Imihfl32.exe
        95⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        96⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Jdcpcf32.exe
        
        C:\Windows\system32\Jdcpcf32.exe
        97⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Jfaloa32.exe
        
        C:\Windows\system32\Jfaloa32.exe
        98⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Jjmhppqd.exe
        
        C:\Windows\system32\Jjmhppqd.exe
        99⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Jmkdlkph.exe
        
        C:\Windows\system32\Jmkdlkph.exe
        100⤵
        Modifies registry class
        
        PID:5736
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5780
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        102⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Jjpeepnb.exe
        
        C:\Windows\system32\Jjpeepnb.exe
        103⤵
        Modifies registry class
        
        PID:5864
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        104⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        105⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Jbkjjblm.exe
        
        C:\Windows\system32\Jbkjjblm.exe
        106⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        107⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Jaljgidl.exe
        
        C:\Windows\system32\Jaljgidl.exe
        108⤵
        Modifies registry class
        
        PID:6088
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        109⤵
        Drops file in System32 directory
        
        PID:6136
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        110⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        111⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        112⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5396
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        114⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        115⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Kilhgk32.exe
        
        C:\Windows\system32\Kilhgk32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5668
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        117⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        118⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        119⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        120⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        121⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        122⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5128
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        124⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        125⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        126⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        127⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        128⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        129⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        130⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        131⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        132⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        133⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        134⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5788
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        136⤵
        Drops file in System32 directory
        
        PID:6056
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        137⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5528
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        139⤵
        Modifies registry class
        
        PID:5836
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        140⤵
        Modifies registry class
        
        PID:5140
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        141⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        142⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        143⤵
        Drops file in System32 directory
        
        PID:5900
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        144⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        145⤵
        Modifies registry class
        
        PID:6184
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        146⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        147⤵
        Modifies registry class
        
        PID:6272
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        148⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        149⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        150⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        151⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        152⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        153⤵
        Modifies registry class
        
        PID:6532
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        154⤵
        Drops file in System32 directory
        
        PID:6572
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        155⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        156⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        157⤵
        Drops file in System32 directory
        
        PID:6696
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        158⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        159⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6820
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        161⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        162⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        163⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        164⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        165⤵
        Modifies registry class
        
        PID:7036
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        166⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        167⤵
        Drops file in System32 directory
        
        PID:7124
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        168⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        169⤵
        Modifies registry class
        
        PID:6168
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        170⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        171⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6380
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        173⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        174⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        175⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        176⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        177⤵
        Modifies registry class
        
        PID:6704
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        178⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        179⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        180⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6884
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        181⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        182⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        183⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        184⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        185⤵
        Modifies registry class
        
        PID:6240
        
        C:\Windows\SysWOW64\Ndkahnhh.exe
        
        C:\Windows\system32\Ndkahnhh.exe
        186⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        187⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        188⤵
        Drops file in System32 directory
        
        PID:6564
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6664
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        190⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Ogljjiei.exe
        
        C:\Windows\system32\Ogljjiei.exe
        191⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Ojjffddl.exe
        
        C:\Windows\system32\Ojjffddl.exe
        192⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        193⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        194⤵
        Drops file in System32 directory
        
        PID:6296
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        195⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6608
        
        C:\Windows\SysWOW64\Oqgkhnjf.exe
        
        C:\Windows\system32\Oqgkhnjf.exe
        197⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        198⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        199⤵
        Modifies registry class
        
        PID:7112
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        200⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6340
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        201⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        202⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        203⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        204⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        205⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        206⤵
        Drops file in System32 directory
        
        PID:6960
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        207⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        208⤵
        Drops file in System32 directory
        
        PID:7204
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        209⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        210⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7328
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        212⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        213⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        214⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        215⤵
        Drops file in System32 directory
        
        PID:7488
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        216⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        217⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        218⤵
        Drops file in System32 directory
        
        PID:7620
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7664
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        220⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        221⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        222⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        223⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7864
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        225⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        226⤵
        Drops file in System32 directory
        
        PID:7948
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        227⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8032
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        229⤵
        Drops file in System32 directory
        
        PID:8072
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        230⤵
        Modifies registry class
        
        PID:8116
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        231⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        232⤵
        Modifies registry class
        
        PID:6600
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        233⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        234⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        235⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        236⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        237⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        238⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        239⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        240⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        241⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        242⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        243⤵
        Modifies registry class
        
        PID:7892
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7956
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        245⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        246⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        247⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7196
        
        C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        249⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        250⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        251⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7604
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        253⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        254⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        255⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        256⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        257⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        258⤵
        Modifies registry class
        
        PID:8064
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        259⤵
        Modifies registry class
        
        PID:5476
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        260⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        261⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        262⤵
        Drops file in System32 directory
        
        PID:7472
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        263⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3972
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        265⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        266⤵
        Modifies registry class
        
        PID:8020
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        267⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        268⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        269⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        270⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        271⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        272⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        273⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        274⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        275⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        276⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        277⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        278⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        279⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        280⤵
        Drops file in System32 directory
        
        PID:8252
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        281⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        282⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        283⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        284⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8456
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        286⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        287⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        288⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8616
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        290⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        291⤵
        Modifies registry class
        
        PID:8712
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        292⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        293⤵
        Drops file in System32 directory
        
        PID:8804
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        294⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        295⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        296⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        297⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        298⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        299⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        300⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9148
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        302⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        303⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        304⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        305⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        306⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        307⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        308⤵
        Drops file in System32 directory
        
        PID:8532
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        309⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        310⤵
        Drops file in System32 directory
        
        PID:8692
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8748
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        312⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        313⤵
        Modifies registry class
        
        PID:8872
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        314⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        315⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        316⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        317⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        318⤵
        Modifies registry class
        
        PID:9196
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        319⤵
        Drops file in System32 directory
        
        PID:8244
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        320⤵
        Modifies registry class
        
        PID:8304
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8448
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        322⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        323⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        324⤵
        Modifies registry class
        
        PID:8796
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        325⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        326⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        327⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        328⤵
        Modifies registry class
        
        PID:7480
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        329⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        330⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        331⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        332⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        333⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8336
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8528
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        336⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        337⤵
        Modifies registry class
        
        PID:9096
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        338⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        339⤵
        Drops file in System32 directory
        
        PID:8920
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        340⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8312
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8608
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        342⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9260
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        344⤵
        Modifies registry class
        
        PID:9304
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        345⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        346⤵
        Drops file in System32 directory
        
        PID:9388
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        347⤵
        Drops file in System32 directory
        
        PID:9432
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        348⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        349⤵
        Drops file in System32 directory
        
        PID:9508
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        350⤵
        Drops file in System32 directory
        
        PID:9556
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        351⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        352⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        353⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        354⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        355⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        356⤵
        Modifies registry class
        
        PID:9808
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        357⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        358⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        359⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        360⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10012
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10060
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        363⤵
        Modifies registry class
        
        PID:10096
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        364⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        365⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        366⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        367⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        368⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        369⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        370⤵
        Modifies registry class
        
        PID:9476
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        371⤵
        Drops file in System32 directory
        
        PID:9504
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        372⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9672
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        374⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        375⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        376⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9920
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        378⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        379⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        380⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        381⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        382⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        383⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        384⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        385⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        386⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        387⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        388⤵
        Modifies registry class
        
        PID:9872
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        389⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        390⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        391⤵
        Drops file in System32 directory
        
        PID:10212
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        392⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        393⤵
        Modifies registry class
        
        PID:9488
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        394⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        395⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        396⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        397⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9076
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        398⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        399⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        400⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        401⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        402⤵
        Drops file in System32 directory
        
        PID:9840
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        403⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        404⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        405⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9960
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        406⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        407⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        408⤵
        Drops file in System32 directory
        
        PID:10332
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        409⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        410⤵
        Drops file in System32 directory
        
        PID:10424
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        411⤵
        Drops file in System32 directory
        
        PID:10468
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        412⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10512
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        413⤵
        Modifies registry class
        
        PID:10556
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        414⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        415⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        416⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        417⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        418⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10768
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        419⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        420⤵
        Drops file in System32 directory
        
        PID:10856
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        421⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        422⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        423⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        424⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11024
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        425⤵
        Modifies registry class
        
        PID:11064
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        426⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11104
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        427⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11140
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        428⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        429⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        430⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        431⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        432⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        433⤵
        Drops file in System32 directory
        
        PID:10416
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        434⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        435⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        436⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        437⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        438⤵
        Drops file in System32 directory
        
        PID:10748
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        439⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        440⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        441⤵
        Drops file in System32 directory
        
        PID:10968
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        442⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        443⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        444⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        445⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        446⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        447⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        448⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        449⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        450⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        451⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        452⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        453⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        454⤵
        Drops file in System32 directory
        
        PID:11164
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        455⤵
        Drops file in System32 directory
        
        PID:10284
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        456⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        457⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        458⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        459⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        460⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        461⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        462⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        463⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        464⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        465⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10564
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        466⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        467⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        468⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        469⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        470⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        471⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        472⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        473⤵
        Modifies registry class
        
        PID:11432
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        474⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        475⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        476⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11604
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        478⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        479⤵
        
        PID:11688
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        480⤵
        
        PID:11732
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        481⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11768
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        482⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11804
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        483⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        484⤵
        
        PID:11892
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        485⤵
        Drops file in System32 directory
        
        PID:11940
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        486⤵
        Modifies registry class
        
        PID:11980
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        487⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        488⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12056
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        489⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        490⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        491⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        492⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12220
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        493⤵
        
        PID:12264
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        494⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        495⤵
        Drops file in System32 directory
        
        PID:11344
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        496⤵
        
        PID:11404
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        497⤵
        
        PID:11464
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        498⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        499⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        500⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        501⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        502⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11800
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        503⤵
        Modifies registry class
        
        PID:11872
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        504⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        505⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        506⤵
        
        PID:12080
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        507⤵
        
        PID:12152
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        508⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        509⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        510⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11332
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        511⤵
        Drops file in System32 directory
        
        PID:11448
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        512⤵
        
        PID:11580
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        513⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        514⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        515⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        516⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11976
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        517⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        518⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        519⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        520⤵
        
        PID:11316
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        521⤵
        Modifies registry class
        
        PID:11508
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        522⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        523⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        524⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        525⤵
        Drops file in System32 directory
        
        PID:12172
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        526⤵
        Modifies registry class
        
        PID:11320
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        527⤵
        Drops file in System32 directory
        
        PID:11556
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        528⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        529⤵
        
        PID:12136
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        530⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11552
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        531⤵
        Modifies registry class
        
        PID:12088
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        532⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        533⤵
        Drops file in System32 directory
        
        PID:12252
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        534⤵
        
        PID:12304
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        535⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12340
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        536⤵
        
        PID:12376
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        537⤵
        
        PID:12412
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        538⤵
        
        PID:12452
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        539⤵
        
        PID:12488
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        540⤵
        
        PID:12524
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        541⤵
        
        PID:12560
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        542⤵
        
        PID:12596
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        543⤵
        
        PID:12632
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        544⤵
        
        PID:12668
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        545⤵
        
        PID:12704
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        546⤵
        
        PID:12740
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        547⤵
        
        PID:12780
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        548⤵
        
        PID:12816
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        549⤵
        
        PID:12852
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        550⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12888
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        551⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12924
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        552⤵
        
        PID:12960
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        553⤵
        
        PID:12996
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        554⤵
        Modifies registry class
        
        PID:13032
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        555⤵
        
        PID:13068
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        556⤵
        
        PID:13104
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        557⤵
        
        PID:13140
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        558⤵
        
        PID:13176
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        559⤵
        
        PID:13212
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        560⤵
        
        PID:13252
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        561⤵
        
        PID:13288
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        562⤵
        Modifies registry class
        
        PID:12312
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        563⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12364
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        564⤵
        
        PID:12440
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        565⤵
        Drops file in System32 directory
        
        PID:12512
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        566⤵
        
        PID:12568
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        567⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        568⤵
        
        PID:12688
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        569⤵
        
        PID:12772
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12772 -s 396
        570⤵
        Program crash
        
        PID:12836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 12772 -ip 12772
1⤵
PID:12812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aabmqd32.exe

Filesize
108KB

MD5
0bb677c911ae61dd3b28bf697b7fba7c

SHA1
a3fe224930e317faf81fcbcdb64ce713ecadab4c

SHA256
6a7565bb8da28971a7787e166c7988b44897e64937dd0a303730e6cd8696949a

SHA512
690ebd24ade2edf99284fca182544cbe55073bfcbffc093997049aa9aba960118783c3dd325574de5b467e1a6560b9bd8957a07edd6f7350b273736deb1c6ce3

Download Submit
C:\Windows\SysWOW64\Agglboim.exe

Filesize
108KB

MD5
7d7cfc544c730778a83301c12053ca73

SHA1
c04e4092139e68489e6bd4533092779b4ea4870e

SHA256
8ba39fcb07688a74678587ee60dbf076cba0bcff99b0c79064a5b9a7e2ef2f9d

SHA512
7ba61604409c46a1807c774a7dc7d481a37c7b76e147f0e7496bf33bc2939e105f18da81e5bd422daef9dd1076176ef6fdb709f085f9f2c1f227914937ceaf6e

Download Submit
C:\Windows\SysWOW64\Beeoaapl.exe

Filesize
108KB

MD5
5f16fcea404707acee311771ba26f213

SHA1
ead53750b4966a91f280b2fddc00ad5e7368e168

SHA256
ede9e5b78a29a445f91644c9f1b1262f769ce1e871d08caae44ab184d96301a1

SHA512
8c8db04a7d7e6589c195ce9cba7c14542c658d4cb3dbb6edbb3dc00948a2f62afeed69f8b3a954bdb7f40bd88f509802871c1abfb80fb4534e3e2b802c5c9b0c

Download Submit
C:\Windows\SysWOW64\Bfabnjjp.exe

Filesize
108KB

MD5
4e1ec1b70db50d1b64733599ea446cb0

SHA1
41031191494ee207f598b37b9ef1fba54c7abb01

SHA256
1d987265d869cf12d216c2adeba3110d32feaa339502ae8a448f709e6f92127b

SHA512
0e225330b81c6eb7116862aab4b19cd56146780ff85a97ee9ccb28d55dd686e6eff98dd49713c40275780d72609fe83ed6ee68086162944c86864118623cd85a

Download Submit
C:\Windows\SysWOW64\Cfmajipb.exe

Filesize
108KB

MD5
8aae96124a8d65170c0dbfea7472a8fe

SHA1
65ac34c0ead24cbf4b8d75b9a86f3f9bfa1120b6

SHA256
e12b3210210215ffd49cbd3022ab66ecbb2331faa2307ae9366990615ba205c8

SHA512
0e43da4e442581ede8df247f74bef565a26e95911fa5e7c94a5d16fbdbd75eaf0674d97e86b0dc6662ee3796f57c339d92028af59a78ad1d75b18d7c125d1c55

Download Submit
C:\Windows\SysWOW64\Chagok32.exe

Filesize
108KB

MD5
dcca98aa23ead00038a5b1100386aa05

SHA1
59ee17a7c5fd6da7b54311281308168f8714f0d9

SHA256
2895b5de59bfedec99bd362b89c5eb582e9886534bb937aa7fa808644c6129ae

SHA512
edbf64a93ed64aa10499ee469e5e5cd0d7f7151bfa89a7a1f8903dafc82d16fa0e08148bb8c31fb639e4fc97cc208a68955302552a45c29cded8c368eaea8ccb

Download Submit
C:\Windows\SysWOW64\Cjkjpgfi.exe

Filesize
108KB

MD5
152d94f7a1394631ab2d3333a96e80c2

SHA1
b32ae6b84a40a1699d1ec3b2a49ac017e8183cab

SHA256
e545738fdfe2f0d8d10f54c3d985196cd31da130be59719ada276eb5c5aab05b

SHA512
a9dc12043372364450e2c1e8b17d421e97b4e903c828654ffb6e1124d5a13200cdf9ac095a53c424693db1919e7e05304831e7d66b1555a87ceed543a95b46ec

Download Submit
C:\Windows\SysWOW64\Cjmgfgdf.exe

Filesize
108KB

MD5
e6521ba3a599277845d24692d1b6402a

SHA1
0bda0653224068691b3691a35a414dbb94180b95

SHA256
59b449781a57238843e26e0b71dc0183020730cd7537ee6a0bffda5ef95e71ec

SHA512
bd9f3325700ab565aa0f8382656a9db506595a6880d104bd38becd9006008c18d83ee6908aa9b75d171bfd7874d940fd8658e4e7ddffa72969ca7c6109296804

Download Submit
C:\Windows\SysWOW64\Dafbne32.exe

Filesize
108KB

MD5
0fc7b16f7e87381768b1acb7f39ab727

SHA1
54142cd8f13925707a0f271801d1e94ba87607ad

SHA256
eaf22940e5e0bdecbfaeb8bdd990bdf2fd46f680dde6f0705afc7559c9438863

SHA512
6c4789f289f6eac94477e11b1fa3cbd3d65f1981c6b3d15b9e47954e2222e9ef030e12d84ce16a00d41ba3baa69df3f2f42b7ec273768fdc8d5d219982e112f5

Download Submit
C:\Windows\SysWOW64\Dobfld32.exe

Filesize
108KB

MD5
d2f265de8071d7c1a7a6d29f5fb28cf6

SHA1
193a2146814c673dd1a6963524fb90e7a54f8ddc

SHA256
c62e65802f2c4f0bbcabe817355253fadc1210b73f44b246750cbe545b42151e

SHA512
91d1c16b9fdee2aceabea1e22ddf266c9b0da6244c4e36fffe085b141af111f8fccdd98d178df66ac32c7ed53afcd3ce08e8aea7be327dd2ce8e581bd3d14d49

Download Submit
C:\Windows\SysWOW64\Eaklidoi.exe

Filesize
108KB

MD5
eff4e0105750e5b771e15d3883fdf50a

SHA1
69c209ef721e528cfaa2e97cd6476be5ce50e471

SHA256
9c598b616545d56f092badea6ccbf9eb9386aea2410da578bdbe940e8b8b38d1

SHA512
e4f002f5b3c647b420d4426a9a721a03e803226a27c5736b93a91e087a357ee4b9a2891cc1e9610ca62836a32fb0152acd68ad25cb45fac3dc87c769448bd9cb

Download Submit
C:\Windows\SysWOW64\Ebbidj32.exe

Filesize
108KB

MD5
b05a7f3f05286360ef9d147962780230

SHA1
78af9b1b83f794845f49782b0e20d2c699aa8140

SHA256
2af542c5c91d6b0bf48ea45cf89aeb93eeefb12a325cb0680d970dfd82436d4f

SHA512
911b265c3b8540bc2ab79c8e8262234323513399aa6635a4803261ca0ce574b4aa7263ba5abd830899e78e3a222578fc789456aa625730e9b05b8f61edb8d873

Download Submit
C:\Windows\SysWOW64\Ebnoikqb.exe

Filesize
108KB

MD5
266adb9522e21c7a522b48f1511e9a1a

SHA1
5ec2ff91f817fa8cce4cb1a1f29798ff71a8988b

SHA256
513d3db4b8e20a1b0c327ad888e4583ae575a6b94195cf53dba6ba908bfb4d71

SHA512
68a3bcdd21e6feec54997d1d52a7fb022332dc0af374b51ff289ee9b172c42beb076de59d7b88438574aaa5784814d0c649abaa80fa0c7180965a1a2cecbf4fd

Download Submit
C:\Windows\SysWOW64\Ebploj32.exe

Filesize
108KB

MD5
b0de1f58609f3c5c884cba267051d6b7

SHA1
f3a002fafad0ee58267a0b0bcdfe76156bf6a0cb

SHA256
01950ebe3e97175d5b60d812dac8188c8acd876c882173ab88f9d4b7c56105d4

SHA512
4a3bc368369737c01aadf496c6307c46ad96493ac24e8f8b2fcb53b18a6ad682f3b7986c44994955dbe9f1955444957841206b995e65c454e4905284de0041a2

Download Submit
C:\Windows\SysWOW64\Ecbenm32.exe

Filesize
108KB

MD5
15b0268976546864e9d90ab73d53fc31

SHA1
0be8a45ecc289d0ad686ebe592cc35d8cb73a782

SHA256
04abf0f515cfa28a44555ea00ce7c52f411159a98a52d61995bfefb12abb0ae8

SHA512
90cd079eb8fcfdd9834b58f1437fe122436653a46730f620708f5c3ff11a29272554d2bd346d064234b64c5539e201dd93d5778c907fc0b629dda55f84c0cf78

Download Submit
C:\Windows\SysWOW64\Ecdbdl32.exe

Filesize
108KB

MD5
a7b2c67231569dcef131f67d8b848dfb

SHA1
afb9dc48a024a56d8554dce308dc14be6ef17a47

SHA256
3745d2fbeaf017249f246c483235844a1d6ab249456431e466ec74ccc4b307f6

SHA512
14d085f265804f7c5ecf85f9219a63d077ab1305210069da9131af2b4f79b35045e81ab37eeb4b14ad74db6abbc01ac342636eaf7ba5b7cd9da7b05808ba124d

Download Submit
C:\Windows\SysWOW64\Ecmlcmhe.exe

Filesize
108KB

MD5
ce1f40bdabe8db10a0e648e5cf6effd8

SHA1
0f720f5f0d1c51affcfa99798f7aa07ef4c584d6

SHA256
fa9e10473216c91fd880e465a3633dbb21bdb67b86b338e9f88b26e374c7c89a

SHA512
dba08c9552f29a7a05ca282294ea555902095ee5195f81fb6cbe8bb595483a3aa954d5c1b0929b7f2fe14e84a610d851136230e4517e80cb174e1d5d1fb26966

Download Submit
C:\Windows\SysWOW64\Ecphimfb.exe

Filesize
108KB

MD5
49ef868cec538aa10f0c342c84fb1998

SHA1
211804bad759a5c5e3c8001f507b5203b27d2903

SHA256
9715f66d15dca85ba33ad8f1e889fb54d947ef032f6e0a467005fcd4b2e40942

SHA512
107ec7946837f9db0842c40e0d331db3525fae383e333e501e4aab6b0725c5c8dff0522423d05c15ad89f053a2fbc69af32a58d892a255b87ced543a18bbe248

Download Submit
C:\Windows\SysWOW64\Efikji32.exe

Filesize
108KB

MD5
7cf29b447183729c00523559c4217500

SHA1
dce7c7db1598a092cfc62a5496756d1c203a20a2

SHA256
7681c028d6d8ae5cbf96fa6cbac0661235d1c4d026c161bbd427c66d8b299b11

SHA512
712737c88eb8db509c5083c0d7ea7ae8e6e89ecc18696e2b11bde876967a73edc32fed4a7d9c37880b3214cf1f186e9a614ccccd5ed8ec58eff7373bd08b0647

Download Submit
C:\Windows\SysWOW64\Efpajh32.exe

Filesize
108KB

MD5
4ba3ec2d4c84fb76f2707c19b9d208a6

SHA1
e70efabbbd74b1f693194c8cdf34d7e0d98f07a6

SHA256
0ca010d47d03f67b487aeea0827d38749e74ecf365ec4ea077889cd72243b72d

SHA512
bbdb35dff61759698c3ce22807f1b20c537693d3c38cec55edd1e144cfd6098d92935e462e152b5689b55753bff3ce2f4fc752bd53cc01534bf4eeb8ee6ccff1

Download Submit
C:\Windows\SysWOW64\Ehhgfdho.exe

Filesize
108KB

MD5
70f5069f27975fbae227704a651f6e9e

SHA1
cfd1b85454cb1719f4c1a9c8355053b27d17a7cd

SHA256
f934015ce6ff88e618211a88982bc735d099559712a00defed1e05646493ec83

SHA512
5f2f10dee9ff9bb191215729de5db782b97635e5ae20b3794d11540613d2d556664d4a6ec6ed85d361de76d71f036bb0a4e5347d68ee56b6fea451e56c5722e4

Download Submit
C:\Windows\SysWOW64\Ehjdldfl.exe

Filesize
108KB

MD5
8ac1c595f6119f49a60eecf2591cd56a

SHA1
f7074f293a2cdc8b9ac3501d8cd322160c125d29

SHA256
3952e45663de7aa79e0e61114ce08ac278d35a39e1e3699f8ad198e49e2a3220

SHA512
ad6981d688772cf14ab842912ea9ee929fdc61ffc9ba26b60d4a3cfcc04cbf4595e120c18ff1e93fd795f0f1c6a200f62ab3d3537c6f852264ab26abfd65d90e

Download Submit
C:\Windows\SysWOW64\Ejjqeg32.exe

Filesize
108KB

MD5
ad9fe30b0ce9a5f9e5cf235b54950bd0

SHA1
340eabdf89af77a817f281b3df209b390feb2e3e

SHA256
224bf07d0d30550ed12a2bc3fd1a7c1bd8dc32b347b288b172a2033f80be72ec

SHA512
6f7e9c8582998264812b84899fbd2e904684a385ba96d706a397c67cb37b622bbd4c259d55ba15f95ddff73f91bbbff227d67f8e3f4f72675ddc6065d108d23b

Download Submit
C:\Windows\SysWOW64\Ejlmkgkl.exe

Filesize
108KB

MD5
bc4758f2c167bc7f4a75536c61c027ff

SHA1
7a23d7ef39743d32db0fbdb509dac43d572312c4

SHA256
deb2fd89496102613e48fd622f2f822de577f2fbdecd126487246302290cfdb1

SHA512
238bf905903f77556f3c8949786177d483d8344b54b954b9b0e7d715bbc626be8d33237b80403c61beaa8fd16ab51db08772f76c91209fe575b5517806597283

Download Submit
C:\Windows\SysWOW64\Elccfc32.exe

Filesize
108KB

MD5
075732be7598571d4a3d8f21e898f52f

SHA1
acab52a3ed4e57c33867b192c20b902777d9f5ef

SHA256
13082a508eeb4bd106a03f91e5bb22cacceefe768564eb7266aa660ae33d13b8

SHA512
cb945949862eebf6583dad45480d45bdb223969e41a64dd7ecaabbca06b3db1cd6e9afd558e17b62e328ecc06b4cdbb7ff9c79e12ddb9c221722021f2336f9a2

Download Submit
C:\Windows\SysWOW64\Eleplc32.exe

Filesize
108KB

MD5
8b03606302d8bb3ee01151ead3c0c541

SHA1
f76ca9c6619331b9663fd073103249e3842481d8

SHA256
4adb177b68ea891642ce3ca9c4d80e332f5ae702be47db8f90d5984d3c10a95f

SHA512
5c96ba6323d880faa3480dfcbe5a4ee218b3cc775dcefb14d54b8e160a52f59d4c77c13035fd9e51ff740345e8f30699aad46291f9421c9cad08b63bfb7ca1d0

Download Submit
C:\Windows\SysWOW64\Elhmablc.exe

Filesize
108KB

MD5
851c1b5ed22ed4e071e98f7cc5247805

SHA1
a6b4d488f425c3e404e911e5d76e52efe850b242

SHA256
e9353276c90ba01d4f03cfcaa836147332da403dbd2b1369b568150a24067531

SHA512
45ea47d92e90b320cd83cc71c302089f0b323c0e824a335a4d427814b8e4acd2f8f74d3f226e6dc858a82c027ffd84c34b4fbf3dce6b4b7d952cad329e812694

Download Submit
C:\Windows\SysWOW64\Emjjgbjp.exe

Filesize
108KB

MD5
3b6d2aec1017c766fe9ad8ea68290abd

SHA1
62e0eabe4cc890a7770e8df3301e2e46cc9b1497

SHA256
80cfd5c0c1ac63d8f76fc56afe0d70a4b9002f3919f8e2d1ef0f7d8a36ca476c

SHA512
c07825a3bc6b394de10b95f839f4b8cc03286448aa99e171672ac9d139546c43d3519b172e15068390d5bfd9e429e3d6624d4c7a673520ff943b0dc18fbb8568

Download Submit
C:\Windows\SysWOW64\Eofinnkf.exe

Filesize
108KB

MD5
027a5f76943e809b54ea6a0c0762f0e9

SHA1
efbee39ef36832243610d3c9cd26e5ec3d1f410f

SHA256
b84b36636691b4d3deeeec2a4cb22d72fe741c53afb752a90bd13ffa6c9a7227

SHA512
170895faca9b1716ebb8f7ece980d7ba5b4f99d88c74ed773c666e543487c4762280d49454e87e775dcae5d010250effc1997e7ed159f539353f899e4451aeda

Download Submit
C:\Windows\SysWOW64\Eoocmoao.exe

Filesize
108KB

MD5
3799acd7375077e9420962846d185088

SHA1
e4640e67c5139150f50d0397e03ce462e54bbcc7

SHA256
96041f32660380e2a7a15e28af1476a6974e3504f323c2938e6d7a3109463932

SHA512
7b0bc296c5012975fe4b4431c24fbbad5bbe0cd32d76d5954fa643a8f5750f6e6d37c7f6f454448c654b2a62f3c7416e44b310becf72e046e7f9dbbe9b9a81b0

Download Submit
C:\Windows\SysWOW64\Eqciba32.exe

Filesize
108KB

MD5
06af58a3d0f9f7db8f761219d06fac7e

SHA1
68a3f5ebb59e7a3b62947234859915362cc72ec6

SHA256
7649bcdeab06e562d9834e5e4601c9545f8bf1ab57bb3b3e591e1079764dadb3

SHA512
d760c4e3f00af96dbbc9f5d6cef47bf7e752aa44d6850535c37ab54165bff04a422257eef252e31902b171331ca1dcaece5488d2610e3a476f64ce10947f5fe6

Download Submit
C:\Windows\SysWOW64\Eqfeha32.exe

Filesize
108KB

MD5
cf9b9c93575b83f3b9fe74764b66d6e2

SHA1
26458ff2405a6967164098492aa5f4de71baff9c

SHA256
22d177ce4a87a76838e35e27c365fa944993ec32875d8b1d53e5c47e1e39ee17

SHA512
c77c01df47cca6c6abb986c7915ce72a27d84b6631408f3c84ffb75782b72a2805fa101f1f38cf0494c1410e4b4e69849151d89d3947d095dab7089e37aa688b

Download Submit
C:\Windows\SysWOW64\Fbgbpihg.exe

Filesize
108KB

MD5
84c8d8fe5a0b1e69cfaa27696b6c949e

SHA1
098945b0b65de5483dbd3a5efe3a048611bd80f8

SHA256
69a71e7edd06a32cbe2343fadb07aff75c046b52ddfc5b115957c9acc15766d0

SHA512
678dbbc6b23a204fcb98a57f2fb5b78a5f3aee13a3eafa7692000c6dc2e4b9eb4454232e64369f077085b97ab099d11c133336c01b1e9fe97858f51e0898180a

Download Submit
C:\Windows\SysWOW64\Fbllkh32.exe

Filesize
108KB

MD5
90af60577f3ee697f291e987125b43f3

SHA1
1395351281f65c0cdb8517429c183af771a84ffe

SHA256
089f0a3ff9b0e9e1ce8d35a04dbb057fc56eb20e0a17e6739eba85ad1c962255

SHA512
1d81af93c372b7e6b788b34a2796c034af92bfce0885340e9b11d8f81455e5a0e86e7964f17482ab9a7ebaea454e1c132034e2ca2a5929375977b4b62aae53c3

Download Submit
C:\Windows\SysWOW64\Fcgoilpj.exe

Filesize
108KB

MD5
9630fb5c9b1d629e15cdf9f55df68575

SHA1
471a23bd02561f43c03e61583320efad25ad3b33

SHA256
d515e77e03d09ae39799185208810b1134b0db464c6c51f475a0edf8a056e01e

SHA512
d568e19ec849e48c1966caa679fee6a5faf0c8c2afe30d48f7f77f26051314bc2d0ce23019e116c531340120db440e27c9332d625cb42a30c9ecf1438a8d14c4

Download Submit
C:\Windows\SysWOW64\Ffekegon.exe

Filesize
108KB

MD5
62618b68e3248c7c4d0b33f6e87a1803

SHA1
96ead3abd3df1a584a408511d71885ab6f4262d1

SHA256
ba57233d2d0b614303cf26432bef5cd697a51a85b42cbb90583ddc26fed80f13

SHA512
9e9c270c66d4d32434d63d1cb6ca6d693b9d739a7e56109cdce1982715b465a3857143258c3c897cacd68bc4625e9d46a6951aab63ea8539f001a83387e7b12a

Download Submit
C:\Windows\SysWOW64\Ficgacna.exe

Filesize
108KB

MD5
bcc79b0e122fd5b19f5d9a07bba0aab6

SHA1
759e2a9639ffeef8cc72b7c0dbed595a583c029e

SHA256
d274c6013a9751494db5cf69abefd8e80c9fec39b56b88b301a50cc0d76dcbbe

SHA512
578e7904ee43806d414ea855b9a753479d9e2be0580b2cb82aefe78bbc903a285d7c2a1646304fbe9a6c19f9dfe527eb74d84092a8f808be29c3756b0f892114

Download Submit
C:\Windows\SysWOW64\Fjcclf32.exe

Filesize
108KB

MD5
59e6516aa996c36161271b32d8f7874d

SHA1
8ef1d85838877681da4d9ee71ae74905057b8806

SHA256
e2df2bf16d807fc8ee881c263caaa1ae94b0e749fb194f0e82ab26a5c53cb1e1

SHA512
8e318b3201f5534085d5c2e239db190e29161c525839e6a23db2e8aef4c3662e44cfbeeb5d42d837c23c2e969e84cd9a7cf622434983d695ae18735113d78121

Download Submit
C:\Windows\SysWOW64\Fjnjqfij.exe

Filesize
108KB

MD5
42defb3d9d6c9e7fab63cdbe7960c6e8

SHA1
316c62152e35ae076e6af88dd7f7a96b32f2a69a

SHA256
b268e6332eb9278619acb8881074c3186515319f358b8da9a9c154342309f70e

SHA512
6b0852b02d4cb91c0af4b012dd23127d32eac079bf7fc7e12fce3b1b34d1cfd9608920cfce062ff9b7257931a2dd0bdd1557b833943d7c802956dd6d31a3a997

Download Submit
C:\Windows\SysWOW64\Fjqgff32.exe

Filesize
108KB

MD5
14572f60559b16bee39b6beaf98a9194

SHA1
c827a8da043a51b340e7df750e00b8585ea2074e

SHA256
a79c2094ce51ba541b708b9e916483ee0dbc0fc8398eba0ce6ef188ae0167abc

SHA512
8a8fd98e0d63d5952953eba3379f3cb79c9daf37142e7978d073befd304b593d8133f3c586b47b81d7f9d8a3993790e0afbaac61e13a18c9c3dd5878131e16fb

Download Submit
C:\Windows\SysWOW64\Fmmfmbhn.exe

Filesize
108KB

MD5
900d2305165ecd686320b9ced6627c64

SHA1
682cb37451b8c83b3386b88afd20df777f4b5977

SHA256
845da2dfb54731841747c613173640437a0f51a6168be6f1239077a46b11626c

SHA512
54e3ad3b5946dc64c6b3f4f260f8d44a82084683af3fc4885ae27798fc21f2e8126d5ea4ed287cb1a8a167099cb6410d4d07eb7866405274579a27d911df2ec9

Download Submit
C:\Windows\SysWOW64\Fomonm32.exe

Filesize
108KB

MD5
52de05a467818f2419738d0f2f4c20c4

SHA1
a1af11921f332a2d9f71a8b2940118b0ab51799d

SHA256
cf940fe9a48155ad04fd3dcfb403ef8d47f33358a78d33790b41339d191cf7c4

SHA512
2aab7e836c16fca7a41df1ae6c6748334de684fa17945bb483bfb81fd049578b655062c0e4baf4dd2338893ac8f6654ccf0f6ef10a1d3d872a8eabcf2284685a

Download Submit
C:\Windows\SysWOW64\Fqmlhpla.exe

Filesize
108KB

MD5
de9da3eb5ee0e74e27fe3bc23c4e224f

SHA1
8f70481f05d70b06df17f2f4ed9a0d65f7219643

SHA256
ad218559f1ac53d98f9ddc313395096977914c3f17d53a92325fecb201c3c5c1

SHA512
7fe4b821bf3ea0aa0f7bfb240b4b83f014d31fa902ea6c153326927f75282c5cb1769cee59ecf0d5133e60582cf352ffbc4acf67b2d9e8d167881377d3b33698

Download Submit
C:\Windows\SysWOW64\Hbbdholl.exe

Filesize
108KB

MD5
069641a50d9f7ae57ec798b6b2580777

SHA1
42b6aac5c5800a57039d95bac7c04df7fb3799f3

SHA256
99f89296f9f8c02a60f4e0d815539f5450db9d201cf57568e933893857b00003

SHA512
a7128f1af7bd6a1201c3cd1ad19e8bc68efaaa3111b639a653ba87f0cbb6938e5d09bb879085e107124aad5ca581b1e03b503a17d91a29cb577e192a142098e2

Download Submit
C:\Windows\SysWOW64\Hioiji32.exe

Filesize
108KB

MD5
8edb03ea96a846f6c5708620d78d9ece

SHA1
6a1afe463a7f12b2bddd98c800e24bdae8fb43b7

SHA256
d97a97475f569e5585a384d1c0bdcef6cad79332819b934aa6bca9d2ab2caf45

SHA512
910403b7b475077dd3ad79fb6a04080d4a9c2988ccdce4129d129b8d10044a56839295d305846cb6f0401bd8e411bef46bdb207f655e2a81cdcad8daf7c3fd7e

Download Submit
C:\Windows\SysWOW64\Hobkfd32.exe

Filesize
108KB

MD5
30b6a38a00ee124031c9371f458c432a

SHA1
481e4d61838a531842794901c3702aa0b4dc9022

SHA256
b5612604f0c6dd196994fd1d56b7eda00a1bb8b74343094a3ddbb47791e5eadf

SHA512
ed5b80ad31482380ef72405112bb2f782640cc2546d3b5692046914d27a8cabe7c1ecd15dd97f902505e4639bbc9da7e640d7fd8447c9dec5a3cf4b2ec3af958

Download Submit
C:\Windows\SysWOW64\Iicbehnq.exe

Filesize
108KB

MD5
1b5982f35ab0ae4d81f99867c4af1d47

SHA1
4384e0f1d6fe811082f1a3d4546fb69ba4903b76

SHA256
3ae04a0fcacd533143b34a42e8ad19ea6cf79002473886af5e3a2811edc8d616

SHA512
835739f69e98c71b0e142a6403658da28777a3fcc3a8ab5da0350cf1ba8c7104558342180443929fad2ed58620652932a1d20c38f4678a035e70cdd8f225a02b

Download Submit
C:\Windows\SysWOW64\Iidipnal.exe

Filesize
108KB

MD5
4b84fbd1dd76a403c804d5b38e6f0432

SHA1
29018f67a042029863b7544403fc966e8587bfdd

SHA256
13601b6667a61a1565493c83372033e9fd13a1172aea3c1fa3a757be5492fa98

SHA512
b398f6ad5bbf3af7d20f13804aac82fde3ac7cc3f9aa678ef529d5781569d3937c6b63de28f22f8892e4ea2ba92976d55bea86529ff05da3ad53fd4a833f4f0b

Download Submit
C:\Windows\SysWOW64\Kefkme32.exe

Filesize
108KB

MD5
ab4d097b3b885a9c435cabdef7ae9d4f

SHA1
d2b75a6ea0e4694ad2fca6ee65e27343ebdfba88

SHA256
2d891ab5780d4db471fd33989670f129a09ad1f1b64d2d2baa20e3cace4f67a7

SHA512
ba66cdd8558e3ca6ad02f7af66aea82530e9378cda744270e48f4fa20aca5769711b7b178bbd43936a9c37a791492c4df909b8ebb4a0d20eeb6e0eef384342ec

Download Submit
C:\Windows\SysWOW64\Lebkhc32.exe

Filesize
108KB

MD5
583bcb0fd2852b57c6a3cc274585c06e

SHA1
ef48cbcf948f136ce4462a5be5894eaad84cd2ce

SHA256
ff6539fcb41e4b9eb47b4421018e9a647b18277b0dcdee2f982ddfaaae11f24d

SHA512
8676e07b243e63b1f46797d40e78b95258d303be700f1a31adedf8df4e6d71550ab36eaa4e3fd6115c5e01c5a471513761ee690acc6dd47ef0d4cd83bd8ebc8c

Download Submit
C:\Windows\SysWOW64\Lnhmng32.exe

Filesize
108KB

MD5
8d937c145a44960b081856ef84579710

SHA1
6a18bb5f6e03c800684648ef7d5460d9674fbf08

SHA256
28958089f1e97162ae6d5b8c9e26d6207c77233f1b72545cd0b5b89e0a00da28

SHA512
9cdaf6297b4fab23d1959acfcf29f6c353d0244edba7b2a73c613106987724d08977cb6cf21bd2800902acfcfe55ddcaa968e16111d24e23ca5ac0557621f39f

Download Submit
C:\Windows\SysWOW64\Neeqea32.exe

Filesize
108KB

MD5
6202147e8454260223525490d20d205f

SHA1
ad0511953fab810aa433c8be072651d470afaed1

SHA256
9207e90da6fa9f61ee7c248ba72d6b747798301856a5211e20c0b88bb8c706a5

SHA512
b580a240a1ec1b42aa06fc3e0cdbec3c296a88318ad313c51c9083fb683284b76a87e4465a286397913bde28c757a63de70f77e15e1a22ee6464340f8df19991

Download Submit
C:\Windows\SysWOW64\Oqhacgdh.exe

Filesize
108KB

MD5
d06e60b284bcc6120e7a4038beabfcf6

SHA1
483304bfbac267c9ba94f7359a24886813b13ed7

SHA256
ed8f3cf73bca10635bdf93bbfe1007bd1adffd59106823942658b4a9c09bffbe

SHA512
13aaca92015bea6fb7945c804e78169114fa943443836f4cd24265f39e37a971557dbd1d1270a1a62711f22b451887bd62546415b217ff1d232e186bda8b63ff

Download Submit
C:\Windows\SysWOW64\Pbbgnpgl.exe

Filesize
108KB

MD5
cce9ee57781dfcdc20962ff2274964b4

SHA1
949bea6a20f0be1868d715781dbd68b74887d65e

SHA256
79aa1953f01aaf19aff702301ee97332a33f4975274c1cc083fd442b3b73a438

SHA512
b5da41d43de27e5f2acad4a22734ed0539b0dd3a237b40616f86b8379c98e1208d1f104d08f55b7f87a99330587bd0f163fd833aebb5c9219c2733fa82186b2e

Download Submit
C:\Windows\SysWOW64\Pgllfp32.exe

Filesize
108KB

MD5
eac7309797ae9b1d369bde177e7a5d48

SHA1
62d7ff9c36152b706f9b4d1cf01450b09453fd55

SHA256
b52062dc12a48dbd800e1398159676b52a11275353fc7fc29910c7c2e74a795c

SHA512
e2eadc2b4244fd89136a50421eed198cf3c4879932ccac05c4e1a5465a3c1af5a916d493ac4460881490782cca7140c084fc43b88e1e591e5432b9eb0ee7e576

Download Submit
C:\Windows\SysWOW64\Pjeoglgc.exe

Filesize
64KB

MD5
690f72f2920e1bbb6aa1b453e249ec70

SHA1
8db508d1e1b282097680f997ae396e1a35235e62

SHA256
0795b0040340a046d87f684d0c29ff00dd96468910cb07c7db4d10ace31a735a

SHA512
162c8fc45a2b987c12b4e459ba970d732c29555c413b6214d56c5e50b0aa620189555089691241d65a4aab105ccef960f706d83df1eb91a17469a1862fd12150

Download Submit
C:\Windows\SysWOW64\Pnonbk32.exe

Filesize
108KB

MD5
6d23d0688e38db55c5a716cdc3fe94c7

SHA1
e5005f191321875a176ae0cb6572fdd9383e98f7

SHA256
f019d90fa52e064c5865a18b0038c446ea2a09f361e3b3f10be84123d09ec6a4

SHA512
934f4bd1e36e6db6f467d9fa535f2d91cd434dc8524277c9d25c5f7b174a3a1e784b84a38878ad74f983610ad4cfc5bef96d90a20a35ca8f3244de1a1c646a27

Download Submit
C:\Windows\SysWOW64\Qqijje32.exe

Filesize
108KB

MD5
f7179e24c38c3bddb611b5ef0600ed13

SHA1
9ab782dae679f170ec69380299243b8c339b85ea

SHA256
515b2cadb28a7c8841f16dccbfba346b52c7a5fad7198f85b51411801e7a241b

SHA512
94b1b093ae4bd61dcfda1a71907d8cd3feb6eed9e0320efdeaf55024f9dc5c0bf0a6fef60bd4462cc8ae1bce5593600e6f6fe61ac0aa6f9fc2f5aaf0864b83a4

Download Submit
memory/372-48-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/452-358-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/536-44-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/544-418-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/752-184-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/808-296-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/928-108-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1080-334-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1428-442-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1472-151-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1560-406-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1576-405-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1580-248-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1688-204-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1812-432-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2084-322-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2216-321-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2280-220-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2376-386-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2472-314-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2536-88-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2556-32-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2592-128-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2692-120-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2772-426-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2812-346-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2864-328-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2924-224-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2948-72-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2980-112-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3004-103-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3084-16-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3136-285-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3152-180-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3208-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3260-398-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3364-364-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3420-393-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3440-262-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3460-268-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3576-286-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3648-140-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3752-440-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3860-340-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3864-416-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4032-357-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4184-12-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4236-241-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4248-376-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4436-164-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4528-144-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4620-275-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4636-308-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4784-302-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4800-374-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4880-68-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4904-84-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4912-56-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4928-208-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4968-168-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4992-27-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5064-192-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5088-256-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5116-236-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads