b15be8ff48010f7fc7d683139b78cb7ff4fdc4200a4ba7fe1fc5b28f4b4afda0

Analysis

max time kernel
141s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b15be8ff48010f7fc7d683139b78cb7ff4fdc4200a4ba7fe1fc5b28f4b4afda0.exe
Size

512KB
MD5

1fb8f9eb3614bf5527e42a7f3afbad7b
SHA1

669c6450f965d13fae079a729d7c7b341c9d36ca
SHA256

b15be8ff48010f7fc7d683139b78cb7ff4fdc4200a4ba7fe1fc5b28f4b4afda0
SHA512

32f3786571fe1cae329b3cee4ae25d9a0bb60d74216ee0b6757dd34a0250213291f853b0ba5b9abb2486880d2369c190807d39e633c5a316790adeeed2bc55e6
SSDEEP

6144:D5cfVJJkrdQt383PQ///NR5fKr2n0MO3LPlkUCmVs5bPQ///NR5fjlt01PB93GxK:DAr/Ng1/Nblt01PBExK

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iakiia32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngjbaj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eoepebho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfojdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmeakf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pagbaglh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Keifdpif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngndaccj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfohgqlg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cocjiehd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dglkoeio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pecellgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omegjomb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knnhjcog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kabcopmg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmfeidbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnicid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgnlkfal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckjknfnh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Geoapenf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Koonge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnbklm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpmhdmea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcpnhl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qobhkjdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmbjcljl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lakfeodm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdbfab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mminhceb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdkoch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjaabq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnpfop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eehicoel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmdlmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jiglnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfiddm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbiockdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfipef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdigadjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahgcjddh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhclmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcbkml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjoppf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Indfca32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnkfmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Loacdc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njjmni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqfbpb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmeede32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlegnjbm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkdhjknm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgqfdnah.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olanmgig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfipef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbiockdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mplafeil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Palklf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kakmna32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahbjoe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnfiplog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkegpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdaaaeqg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oejbfmpg.exe

Executes dropped EXE 64 IoCs

pid	Process
752	Mplafeil.exe
4876	Ccchof32.exe
3132	Cippgm32.exe
3840	Gkdhjknm.exe
1336	Gmeakf32.exe
2132	Gilapgqb.exe
1020	Ginnfgop.exe
3296	Gphgbafl.exe
3408	Gpkchqdj.exe
1508	Hhdhon32.exe
3976	Ikndgg32.exe
1500	Iakiia32.exe
3044	Indfca32.exe
3356	Jglklggl.exe
4016	Jqdoem32.exe
784	Jnmijq32.exe
3228	Jnpfop32.exe
1544	Kqpoakco.exe
3672	Kndojobi.exe
4928	Kjkpoq32.exe
3240	Lnbklm32.exe
4048	Lacdmh32.exe
216	Mniallpq.exe
2616	Mhafeb32.exe
2320	Miaboe32.exe
4288	Mbighjdd.exe
2268	Naaqofgj.exe
4972	Nlfelogp.exe
4344	Nlkngo32.exe
3192	Neccpd32.exe
1536	Najceeoo.exe
4632	Okchnk32.exe
3468	Okgaijaj.exe
412	Ohkbbn32.exe
3748	Ohnohn32.exe
1952	Oeaoab32.exe
4724	Pkogiikb.exe
2840	Akhcfe32.exe
392	Bcahmb32.exe
1804	Bcfahbpo.exe
4956	Cofecami.exe
5016	Cbgnemjj.exe
452	Ccgjopal.exe
2232	Diccgfpd.exe
4280	Dpnkdq32.exe
5096	Dmalne32.exe
4668	Dmfeidbe.exe
1716	Djjebh32.exe
1208	Dlkbjqgm.exe
4108	Efccmidp.exe
4640	Eplgeokq.exe
2188	Eciplm32.exe
1696	Eleepoob.exe
2368	Fcniglmb.exe
3612	Fbcfhibj.exe
1616	Ffaong32.exe
620	Fmkgkapm.exe
684	Ffclcgfn.exe
1316	Fbjmhh32.exe
3396	Gpnmbl32.exe
3508	Gjdaodja.exe
2016	Gfkbde32.exe
3388	Gkhkjd32.exe
4752	Gdaociml.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ccchof32.exe	Mplafeil.exe
File created	C:\Windows\SysWOW64\Noomkkpc.dll	Ccgjopal.exe
File created	C:\Windows\SysWOW64\Fbpcnkaj.dll	Gmafajfi.exe
File created	C:\Windows\SysWOW64\Holfoqcm.exe	Hipmfjee.exe
File opened for modification	C:\Windows\SysWOW64\Nqfbpb32.exe	Niojoeel.exe
File opened for modification	C:\Windows\SysWOW64\Aehgnied.exe	Anaomkdb.exe
File opened for modification	C:\Windows\SysWOW64\Lqojclne.exe	Lckiihok.exe
File created	C:\Windows\SysWOW64\Onapdl32.exe	Opqofe32.exe
File created	C:\Windows\SysWOW64\Ekcgkb32.exe	Egcaod32.exe
File opened for modification	C:\Windows\SysWOW64\Ggfglb32.exe	Gegkpf32.exe
File opened for modification	C:\Windows\SysWOW64\Mfkkqmiq.exe	Loacdc32.exe
File opened for modification	C:\Windows\SysWOW64\Obqanjdb.exe	Oqoefand.exe
File created	C:\Windows\SysWOW64\Gkdhjknm.exe	Cippgm32.exe
File opened for modification	C:\Windows\SysWOW64\Jjlmclqa.exe	Jkgpbp32.exe
File opened for modification	C:\Windows\SysWOW64\Ohhnbhok.exe	Oejbfmpg.exe
File created	C:\Windows\SysWOW64\Dfoomidj.dll	Pkgcea32.exe
File created	C:\Windows\SysWOW64\Gmafajfi.exe	Gfhndpol.exe
File created	C:\Windows\SysWOW64\Blqhpg32.dll	Omnjojpo.exe
File created	C:\Windows\SysWOW64\Bgelgi32.exe	Bahdob32.exe
File opened for modification	C:\Windows\SysWOW64\Paihlpfi.exe	Pmmlla32.exe
File opened for modification	C:\Windows\SysWOW64\Gphgbafl.exe	Ginnfgop.exe
File opened for modification	C:\Windows\SysWOW64\Anclbkbp.exe	Akepfpcl.exe
File created	C:\Windows\SysWOW64\Qhjmdp32.exe	Qaqegecm.exe
File created	C:\Windows\SysWOW64\Mibime32.dll	Gphgbafl.exe
File created	C:\Windows\SysWOW64\Bnhpfjhc.dll	Ohnohn32.exe
File created	C:\Windows\SysWOW64\Mminhceb.exe	Lenicahg.exe
File created	C:\Windows\SysWOW64\Lpmbai32.dll	Aehgnied.exe
File opened for modification	C:\Windows\SysWOW64\Ffnknafg.exe	Fijkdmhn.exe
File created	C:\Windows\SysWOW64\Paeelgnj.exe	Pnfiplog.exe
File created	C:\Windows\SysWOW64\Hlpihhpj.dll	Hahokfag.exe
File created	C:\Windows\SysWOW64\Njgqhicg.exe	Ncmhko32.exe
File opened for modification	C:\Windows\SysWOW64\Bepmoh32.exe	Bnhenj32.exe
File created	C:\Windows\SysWOW64\Cikamapb.dll	Hifcgion.exe
File opened for modification	C:\Windows\SysWOW64\Hmdlmg32.exe	Hemdlj32.exe
File created	C:\Windows\SysWOW64\Kmkdjo32.dll	Nclbpf32.exe
File created	C:\Windows\SysWOW64\Eehmok32.dll	Qaqegecm.exe
File opened for modification	C:\Windows\SysWOW64\Eleepoob.exe	Eciplm32.exe
File created	C:\Windows\SysWOW64\Obqhpfck.dll	Mgeakekd.exe
File opened for modification	C:\Windows\SysWOW64\Onapdl32.exe	Opqofe32.exe
File opened for modification	C:\Windows\SysWOW64\Jihbip32.exe	Jaajhb32.exe
File opened for modification	C:\Windows\SysWOW64\Npgmpf32.exe	Nmipdk32.exe
File created	C:\Windows\SysWOW64\Gkdinefi.dll	Egohdegl.exe
File created	C:\Windows\SysWOW64\Fkaokcqj.dll	Mcoljagj.exe
File created	C:\Windows\SysWOW64\Ieoacg32.dll	Ahbjoe32.exe
File created	C:\Windows\SysWOW64\Fbjena32.exe	Fpkibf32.exe
File opened for modification	C:\Windows\SysWOW64\Dglkoeio.exe	Dpkmal32.exe
File opened for modification	C:\Windows\SysWOW64\Klggli32.exe	Kiikpnmj.exe
File created	C:\Windows\SysWOW64\Mobnnd32.dll	Ljobpiql.exe
File created	C:\Windows\SysWOW64\Baadiiif.exe	Akglloai.exe
File created	C:\Windows\SysWOW64\Ekmhejao.exe	Deqcbpld.exe
File opened for modification	C:\Windows\SysWOW64\Eifaim32.exe	Eblimcdf.exe
File opened for modification	C:\Windows\SysWOW64\Hlpfhe32.exe	Hibjli32.exe
File created	C:\Windows\SysWOW64\Jofalmmp.exe	Jmeede32.exe
File created	C:\Windows\SysWOW64\Jlolpq32.exe	Jokkgl32.exe
File created	C:\Windows\SysWOW64\Ggfglb32.exe	Gegkpf32.exe
File created	C:\Windows\SysWOW64\Knnele32.dll	Kiikpnmj.exe
File created	C:\Windows\SysWOW64\Akmcfjdp.dll	Nbnlaldg.exe
File opened for modification	C:\Windows\SysWOW64\Jkgpbp32.exe	Jpaleglc.exe
File created	C:\Windows\SysWOW64\Nhokljge.exe	Nenbjo32.exe
File created	C:\Windows\SysWOW64\Fmkqpkla.exe	Fechomko.exe
File created	C:\Windows\SysWOW64\Keiifian.dll	Qhhpop32.exe
File opened for modification	C:\Windows\SysWOW64\Laiipofp.exe	Lpgmhg32.exe
File created	C:\Windows\SysWOW64\Dkjfaikb.dll	Ocgkan32.exe
File created	C:\Windows\SysWOW64\Leifdf32.dll	Akqfkp32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3604	3748	WerFault.exe	544

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gidnkkpc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gfhndpol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cofecami.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jjafok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akepfpcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdpaeehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdickcpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oidalg32.dll"	Domdjj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlolpq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbfecjhc.dll"	Gbpedjnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mhafeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pkogiikb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olanmgig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eajbghaq.dll"	Hnlodjpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Laiipofp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klhhpb32.dll"	Oophlo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Addaif32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aefjii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jokkgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fgoakc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hemmac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gjdaodja.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibcjqgnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nodiqp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Okgaijaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgibpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omnjojpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iefphb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lakfeodm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eplgeokq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmemlfol.dll"	Hlegnjbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpchib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Palklf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qhjmdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aagkhd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpaagldf.dll"	Fijkdmhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idaiki32.dll"	Palklf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbnckkha.dll"	Egaejeej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Egaejeej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jglklggl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kdigadjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lqpamb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oejbfmpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmigpf32.dll"	Qhkdof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Domdjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plmell32.dll"	Ghojbq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lakfeodm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emkbpmep.dll"	Niojoeel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hblkjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jofalmmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Glhimp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eklikcef.dll"	Gihgfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmophg32.dll"	Ifmqfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hhaggp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknmplfo.dll"	Ojqcnhkl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qoelkp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bebjdgmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ekmhejao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkfefigf.dll"	Qobhkjdi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oonlfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcoljagj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofdljpcg.dll"	Cippgm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iakiia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Naaqofgj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3764 wrote to memory of 752	3764	b15be8ff48010f7fc7d683139b78cb7ff4fdc4200a4ba7fe1fc5b28f4b4afda0.exe	85
PID 3764 wrote to memory of 752	3764	b15be8ff48010f7fc7d683139b78cb7ff4fdc4200a4ba7fe1fc5b28f4b4afda0.exe	85
PID 3764 wrote to memory of 752	3764	b15be8ff48010f7fc7d683139b78cb7ff4fdc4200a4ba7fe1fc5b28f4b4afda0.exe	85
PID 752 wrote to memory of 4876	752	Mplafeil.exe	86
PID 752 wrote to memory of 4876	752	Mplafeil.exe	86
PID 752 wrote to memory of 4876	752	Mplafeil.exe	86
PID 4876 wrote to memory of 3132	4876	Ccchof32.exe	87
PID 4876 wrote to memory of 3132	4876	Ccchof32.exe	87
PID 4876 wrote to memory of 3132	4876	Ccchof32.exe	87
PID 3132 wrote to memory of 3840	3132	Cippgm32.exe	88
PID 3132 wrote to memory of 3840	3132	Cippgm32.exe	88
PID 3132 wrote to memory of 3840	3132	Cippgm32.exe	88
PID 3840 wrote to memory of 1336	3840	Gkdhjknm.exe	89
PID 3840 wrote to memory of 1336	3840	Gkdhjknm.exe	89
PID 3840 wrote to memory of 1336	3840	Gkdhjknm.exe	89
PID 1336 wrote to memory of 2132	1336	Gmeakf32.exe	90
PID 1336 wrote to memory of 2132	1336	Gmeakf32.exe	90
PID 1336 wrote to memory of 2132	1336	Gmeakf32.exe	90
PID 2132 wrote to memory of 1020	2132	Gilapgqb.exe	91
PID 2132 wrote to memory of 1020	2132	Gilapgqb.exe	91
PID 2132 wrote to memory of 1020	2132	Gilapgqb.exe	91
PID 1020 wrote to memory of 3296	1020	Ginnfgop.exe	92
PID 1020 wrote to memory of 3296	1020	Ginnfgop.exe	92
PID 1020 wrote to memory of 3296	1020	Ginnfgop.exe	92
PID 3296 wrote to memory of 3408	3296	Gphgbafl.exe	93
PID 3296 wrote to memory of 3408	3296	Gphgbafl.exe	93
PID 3296 wrote to memory of 3408	3296	Gphgbafl.exe	93
PID 3408 wrote to memory of 1508	3408	Gpkchqdj.exe	94
PID 3408 wrote to memory of 1508	3408	Gpkchqdj.exe	94
PID 3408 wrote to memory of 1508	3408	Gpkchqdj.exe	94
PID 1508 wrote to memory of 3976	1508	Hhdhon32.exe	95
PID 1508 wrote to memory of 3976	1508	Hhdhon32.exe	95
PID 1508 wrote to memory of 3976	1508	Hhdhon32.exe	95
PID 3976 wrote to memory of 1500	3976	Ikndgg32.exe	96
PID 3976 wrote to memory of 1500	3976	Ikndgg32.exe	96
PID 3976 wrote to memory of 1500	3976	Ikndgg32.exe	96
PID 1500 wrote to memory of 3044	1500	Iakiia32.exe	97
PID 1500 wrote to memory of 3044	1500	Iakiia32.exe	97
PID 1500 wrote to memory of 3044	1500	Iakiia32.exe	97
PID 3044 wrote to memory of 3356	3044	Indfca32.exe	98
PID 3044 wrote to memory of 3356	3044	Indfca32.exe	98
PID 3044 wrote to memory of 3356	3044	Indfca32.exe	98
PID 3356 wrote to memory of 4016	3356	Jglklggl.exe	99
PID 3356 wrote to memory of 4016	3356	Jglklggl.exe	99
PID 3356 wrote to memory of 4016	3356	Jglklggl.exe	99
PID 4016 wrote to memory of 784	4016	Jqdoem32.exe	100
PID 4016 wrote to memory of 784	4016	Jqdoem32.exe	100
PID 4016 wrote to memory of 784	4016	Jqdoem32.exe	100
PID 784 wrote to memory of 3228	784	Jnmijq32.exe	101
PID 784 wrote to memory of 3228	784	Jnmijq32.exe	101
PID 784 wrote to memory of 3228	784	Jnmijq32.exe	101
PID 3228 wrote to memory of 1544	3228	Jnpfop32.exe	102
PID 3228 wrote to memory of 1544	3228	Jnpfop32.exe	102
PID 3228 wrote to memory of 1544	3228	Jnpfop32.exe	102
PID 1544 wrote to memory of 3672	1544	Kqpoakco.exe	103
PID 1544 wrote to memory of 3672	1544	Kqpoakco.exe	103
PID 1544 wrote to memory of 3672	1544	Kqpoakco.exe	103
PID 3672 wrote to memory of 4928	3672	Kndojobi.exe	104
PID 3672 wrote to memory of 4928	3672	Kndojobi.exe	104
PID 3672 wrote to memory of 4928	3672	Kndojobi.exe	104
PID 4928 wrote to memory of 3240	4928	Kjkpoq32.exe	105
PID 4928 wrote to memory of 3240	4928	Kjkpoq32.exe	105
PID 4928 wrote to memory of 3240	4928	Kjkpoq32.exe	105
PID 3240 wrote to memory of 4048	3240	Lnbklm32.exe	106

C:\Users\Admin\AppData\Local\Temp\b15be8ff48010f7fc7d683139b78cb7ff4fdc4200a4ba7fe1fc5b28f4b4afda0.exe
"C:\Users\Admin\AppData\Local\Temp\b15be8ff48010f7fc7d683139b78cb7ff4fdc4200a4ba7fe1fc5b28f4b4afda0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\SysWOW64\Mplafeil.exe
  C:\Windows\system32\Mplafeil.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\SysWOW64\Ccchof32.exe
    C:\Windows\system32\Ccchof32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4876
  - - C:\Windows\SysWOW64\Cippgm32.exe
      C:\Windows\system32\Cippgm32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3132
    - - C:\Windows\SysWOW64\Gkdhjknm.exe
        
        C:\Windows\system32\Gkdhjknm.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3840
      - C:\Windows\SysWOW64\Gmeakf32.exe
        
        C:\Windows\system32\Gmeakf32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1336
        
        C:\Windows\SysWOW64\Gilapgqb.exe
        
        C:\Windows\system32\Gilapgqb.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2132
        
        C:\Windows\SysWOW64\Ginnfgop.exe
        
        C:\Windows\system32\Ginnfgop.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1020
        
        C:\Windows\SysWOW64\Gphgbafl.exe
        
        C:\Windows\system32\Gphgbafl.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Windows\SysWOW64\Gpkchqdj.exe
        
        C:\Windows\system32\Gpkchqdj.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3408
        
        C:\Windows\SysWOW64\Hhdhon32.exe
        
        C:\Windows\system32\Hhdhon32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1508
        
        C:\Windows\SysWOW64\Ikndgg32.exe
        
        C:\Windows\system32\Ikndgg32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3976
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1500
        
        C:\Windows\SysWOW64\Indfca32.exe
        
        C:\Windows\system32\Indfca32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3044
        
        C:\Windows\SysWOW64\Jglklggl.exe
        
        C:\Windows\system32\Jglklggl.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3356
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4016
        
        C:\Windows\SysWOW64\Jnmijq32.exe
        
        C:\Windows\system32\Jnmijq32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:784
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3228
        
        C:\Windows\SysWOW64\Kqpoakco.exe
        
        C:\Windows\system32\Kqpoakco.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Windows\SysWOW64\Kndojobi.exe
        
        C:\Windows\system32\Kndojobi.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3672
        
        C:\Windows\SysWOW64\Kjkpoq32.exe
        
        C:\Windows\system32\Kjkpoq32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Windows\SysWOW64\Lnbklm32.exe
        
        C:\Windows\system32\Lnbklm32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3240
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        23⤵
        Executes dropped EXE
        
        PID:4048
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        24⤵
        Executes dropped EXE
        
        PID:216
        
        C:\Windows\SysWOW64\Mhafeb32.exe
        
        C:\Windows\system32\Mhafeb32.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2616
        
        C:\Windows\SysWOW64\Miaboe32.exe
        
        C:\Windows\system32\Miaboe32.exe
        26⤵
        Executes dropped EXE
        
        PID:2320
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        27⤵
        Executes dropped EXE
        
        PID:4288
        
        C:\Windows\SysWOW64\Mhilfa32.exe
        
        C:\Windows\system32\Mhilfa32.exe
        28⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2268
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        30⤵
        Executes dropped EXE
        
        PID:4972
        
        C:\Windows\SysWOW64\Nlkngo32.exe
        
        C:\Windows\system32\Nlkngo32.exe
        31⤵
        Executes dropped EXE
        
        PID:4344
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        32⤵
        Executes dropped EXE
        
        PID:3192
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        33⤵
        Executes dropped EXE
        
        PID:1536
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        34⤵
        Executes dropped EXE
        
        PID:4632
        
        C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3468
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        36⤵
        Executes dropped EXE
        
        PID:412
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3748
        
        C:\Windows\SysWOW64\Oeaoab32.exe
        
        C:\Windows\system32\Oeaoab32.exe
        38⤵
        Executes dropped EXE
        
        PID:1952
        
        C:\Windows\SysWOW64\Pkogiikb.exe
        
        C:\Windows\system32\Pkogiikb.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4724
        
        C:\Windows\SysWOW64\Akhcfe32.exe
        
        C:\Windows\system32\Akhcfe32.exe
        40⤵
        Executes dropped EXE
        
        PID:2840
        
        C:\Windows\SysWOW64\Bcahmb32.exe
        
        C:\Windows\system32\Bcahmb32.exe
        41⤵
        Executes dropped EXE
        
        PID:392
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        42⤵
        Executes dropped EXE
        
        PID:1804
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4956
        
        C:\Windows\SysWOW64\Cbgnemjj.exe
        
        C:\Windows\system32\Cbgnemjj.exe
        44⤵
        Executes dropped EXE
        
        PID:5016
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:452
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        46⤵
        Executes dropped EXE
        
        PID:2232
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        47⤵
        Executes dropped EXE
        
        PID:4280
        
        C:\Windows\SysWOW64\Dmalne32.exe
        
        C:\Windows\system32\Dmalne32.exe
        48⤵
        Executes dropped EXE
        
        PID:5096
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4668
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        50⤵
        Executes dropped EXE
        
        PID:1716
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        51⤵
        Executes dropped EXE
        
        PID:1208
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        52⤵
        Executes dropped EXE
        
        PID:4108
        
        C:\Windows\SysWOW64\Eplgeokq.exe
        
        C:\Windows\system32\Eplgeokq.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4640
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2188
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        55⤵
        Executes dropped EXE
        
        PID:1696
        
        C:\Windows\SysWOW64\Fcniglmb.exe
        
        C:\Windows\system32\Fcniglmb.exe
        56⤵
        Executes dropped EXE
        
        PID:2368
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        57⤵
        Executes dropped EXE
        
        PID:3612
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        58⤵
        Executes dropped EXE
        
        PID:1616
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        59⤵
        Executes dropped EXE
        
        PID:620
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        60⤵
        Executes dropped EXE
        
        PID:684
        
        C:\Windows\SysWOW64\Fbjmhh32.exe
        
        C:\Windows\system32\Fbjmhh32.exe
        61⤵
        Executes dropped EXE
        
        PID:1316
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        62⤵
        Executes dropped EXE
        
        PID:3396
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3508
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        64⤵
        Executes dropped EXE
        
        PID:2016
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        65⤵
        Executes dropped EXE
        
        PID:3388
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        66⤵
        Executes dropped EXE
        
        PID:4752
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        67⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        68⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\Hgdejd32.exe
        
        C:\Windows\system32\Hgdejd32.exe
        69⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3368
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        71⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        72⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        73⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        74⤵
        
        PID:364
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        75⤵
        
        PID:1000
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        76⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        77⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        78⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        79⤵
        Drops file in System32 directory
        
        PID:5112
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        80⤵
        Drops file in System32 directory
        
        PID:432
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        81⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5100
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        83⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        84⤵
        
        PID:2720
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        85⤵
        Modifies registry class
        
        PID:3488
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        86⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4432
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        88⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        89⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        90⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        91⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4844
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        93⤵
        Drops file in System32 directory
        
        PID:936
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        94⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        95⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        96⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        97⤵
        
        PID:404
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        98⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        99⤵
        Modifies registry class
        
        PID:116
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        100⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        101⤵
        Drops file in System32 directory
        
        PID:3760
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4012
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        103⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        104⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        105⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Megljppl.exe
        
        C:\Windows\system32\Megljppl.exe
        106⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        107⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        108⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        109⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5420
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        111⤵
        Drops file in System32 directory
        
        PID:5464
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        112⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5556
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        114⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5640
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        116⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5724
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        118⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5812
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        120⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        121⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        122⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5988
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        124⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        125⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        126⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2528
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5172
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        129⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        130⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        131⤵
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        132⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        133⤵
        Modifies registry class
        
        PID:5536
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        134⤵
        Modifies registry class
        
        PID:5604
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        135⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        136⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        137⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        138⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        139⤵
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        140⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2104
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        142⤵
        Drops file in System32 directory
        
        PID:5220
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        143⤵
        Modifies registry class
        
        PID:5380
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        144⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        145⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        146⤵
        Drops file in System32 directory
        
        PID:5700
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        147⤵
        Drops file in System32 directory
        
        PID:5856
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6024
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        149⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4868
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        150⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        151⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        152⤵
        Drops file in System32 directory
        
        PID:5688
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        153⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        154⤵
        Modifies registry class
        
        PID:6124
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        155⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        156⤵
        Drops file in System32 directory
        
        PID:5732
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        157⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        158⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        159⤵
        Modifies registry class
        
        PID:6104
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        160⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        161⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        162⤵
        Modifies registry class
        
        PID:6204
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        163⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6288
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        165⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        166⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        167⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        168⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        169⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        170⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6584
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        172⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        173⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6716
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        175⤵
        Modifies registry class
        
        PID:6768
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        176⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        177⤵
        Drops file in System32 directory
        
        PID:6860
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        178⤵
        Modifies registry class
        
        PID:6900
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        179⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6988
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        181⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        182⤵
        Drops file in System32 directory
        
        PID:7076
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        183⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        184⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        185⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        186⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6268
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        187⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        188⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        189⤵
        Drops file in System32 directory
        
        PID:6484
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        190⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        191⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        192⤵
        Drops file in System32 directory
        
        PID:6688
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        193⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        194⤵
        Modifies registry class
        
        PID:6836
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        195⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        196⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6956
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        197⤵
        Drops file in System32 directory
        
        PID:7020
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        198⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        199⤵
        Modifies registry class
        
        PID:7160
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        200⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        201⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        202⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        203⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        204⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        205⤵
        Drops file in System32 directory
        
        PID:6816
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        206⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        207⤵
        Drops file in System32 directory
        
        PID:6976
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        208⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        209⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        210⤵
        Modifies registry class
        
        PID:6396
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        211⤵
        Drops file in System32 directory
        
        PID:6552
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        212⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        213⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        214⤵
        Drops file in System32 directory
        
        PID:6940
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7132
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        216⤵
        Modifies registry class
        
        PID:6420
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        217⤵
        Modifies registry class
        
        PID:6804
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        218⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        219⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        220⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        221⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        222⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        223⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        224⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6600
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6156
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        227⤵
        Modifies registry class
        
        PID:7204
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        228⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        229⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        230⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        231⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        232⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7416
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        233⤵
        Modifies registry class
        
        PID:7464
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7500
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        235⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        236⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        237⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        238⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        239⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        240⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        241⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        242⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        243⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        244⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        245⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        246⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        247⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        248⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        249⤵
        Drops file in System32 directory
        
        PID:8168
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        250⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        251⤵
        Modifies registry class
        
        PID:7232
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        252⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        253⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        254⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7516
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        256⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        257⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        258⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7792
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        260⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        261⤵
        Drops file in System32 directory
        
        PID:7952
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        262⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8084
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        264⤵
        Drops file in System32 directory
        
        PID:8160
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        265⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        266⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        267⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7496
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        269⤵
        Drops file in System32 directory
        
        PID:7620
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        270⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5192
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        272⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        273⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        274⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8136
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        275⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        276⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        277⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        278⤵
        Drops file in System32 directory
        
        PID:7716
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        279⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        280⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        281⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        282⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        283⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7968
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        285⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        286⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7640
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        287⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7776
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8144
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        289⤵
        Drops file in System32 directory
        
        PID:7668
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7340
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        291⤵
        Drops file in System32 directory
        
        PID:7912
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        292⤵
        Modifies registry class
        
        PID:8196
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        293⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        294⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        295⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        296⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        297⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        298⤵
        Modifies registry class
        
        PID:8452
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        299⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        300⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        301⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        302⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        303⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        304⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        305⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        306⤵
        Drops file in System32 directory
        
        PID:8796
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        307⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        308⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        309⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        310⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        311⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9040
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        313⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9128
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9180
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        316⤵
        Drops file in System32 directory
        
        PID:7480
        
        C:\Windows\SysWOW64\Dglkoeio.exe
        
        C:\Windows\system32\Dglkoeio.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8268
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        318⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        319⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        320⤵
        Drops file in System32 directory
        
        PID:8488
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8528
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        322⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        323⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        324⤵
        Modifies registry class
        
        PID:8744
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        325⤵
        Drops file in System32 directory
        
        PID:8820
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        326⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        327⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        328⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        329⤵
        Modifies registry class
        
        PID:9068
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9124
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        331⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        332⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        333⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        334⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7492
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        336⤵
        Drops file in System32 directory
        
        PID:8632
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        337⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        338⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        339⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        340⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        341⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        342⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        343⤵
        Modifies registry class
        
        PID:8356
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8480
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        345⤵
        Modifies registry class
        
        PID:8716
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        346⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        347⤵
        Modifies registry class
        
        PID:9052
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        348⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\Hahokfag.exe
        
        C:\Windows\system32\Hahokfag.exe
        349⤵
        Drops file in System32 directory
        
        PID:8308
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        350⤵
        Modifies registry class
        
        PID:1416
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        351⤵
        Modifies registry class
        
        PID:8588
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        352⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        353⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Hbihjifh.exe
        
        C:\Windows\system32\Hbihjifh.exe
        354⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        355⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3132
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        356⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        357⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        358⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        359⤵
        Modifies registry class
        
        PID:3512
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        360⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        361⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Ieojgc32.exe
        
        C:\Windows\system32\Ieojgc32.exe
        362⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        363⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        364⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        365⤵
        Modifies registry class
        
        PID:4332
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        366⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        367⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        368⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        369⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        370⤵
        Modifies registry class
        
        PID:9364
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        371⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        372⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        373⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        374⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        375⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        376⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        377⤵
        Drops file in System32 directory
        
        PID:9688
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        378⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        379⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        380⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        381⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        382⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        383⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        384⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        385⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        386⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        387⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10176
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        389⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10224
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        390⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9264
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        391⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        392⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        393⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        394⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9568
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        396⤵
        Drops file in System32 directory
        
        PID:9628
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        397⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        398⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        399⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        400⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        401⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        402⤵
        Drops file in System32 directory
        
        PID:9984
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        403⤵
        Modifies registry class
        
        PID:10032
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        404⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        405⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        406⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9240
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        408⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        409⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        410⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        411⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:784
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        412⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        413⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        414⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        415⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:312
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        416⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Mpclce32.exe
        
        C:\Windows\system32\Mpclce32.exe
        417⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        418⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        419⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        420⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        421⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        422⤵
        Drops file in System32 directory
        
        PID:9392
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        423⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        424⤵
        Drops file in System32 directory
        
        PID:9644
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        425⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        426⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        427⤵
        Modifies registry class
        
        PID:9888
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        428⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        429⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10072
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        430⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Nfqnbjfi.exe
        
        C:\Windows\system32\Nfqnbjfi.exe
        431⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        432⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9300
        
        C:\Windows\SysWOW64\Nqfbpb32.exe
        
        C:\Windows\system32\Nqfbpb32.exe
        433⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9428
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        434⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        435⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        436⤵
        Drops file in System32 directory
        
        PID:548
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        437⤵
        Modifies registry class
        
        PID:1548
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        438⤵
        Modifies registry class
        
        PID:1244
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        439⤵
        Modifies registry class
        
        PID:740
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        440⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        441⤵
        Drops file in System32 directory
        
        PID:2616
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        442⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        443⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        444⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        445⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10044
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        446⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10164
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        447⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3464
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        448⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        449⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        450⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        451⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        452⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:844
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        453⤵
        Drops file in System32 directory
        
        PID:9396
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        454⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        455⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        456⤵
        
        PID:4024
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        457⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        458⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        459⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3748 -s 408
        460⤵
        Program crash
        
        PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 3748 -ip 3748
1⤵
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Akhcfe32.exe

Filesize
512KB

MD5
1e8dae9838ea19221bd72d19c275f8fe

SHA1
9b370abd1edcdaa006cf2117aa8dcfcfe09f6c6d

SHA256
c404db833ea2b1a007b27e27acbfefa4bbccf39059a74457c0174e75b5465465

SHA512
9e1c3d56857767c8c0549597a6861e9f43506c8f7cd7cd7853b67249a49c1658eac4506f8abd18f50bad7ab444ad173e594b35f64aef95b3c4e2990d523df5d6

Download Submit
C:\Windows\SysWOW64\Bobabg32.exe

Filesize
512KB

MD5
115ad43f4c71e3da5f673c01931fb6db

SHA1
c85b7053eeda94cc22f3bc97aa1f50c61be55baf

SHA256
5c7843ef229f644e643000e9e8487234f87759fcb71898a965f375232a1014b2

SHA512
49d94072a5bf066c916a4ff64bfeff87eb23de1eb28c2c22f7f26955dc80e35f1a7439e559b4889d057cd51e035677a762698bde1021081fe8f34241a586899e

Download Submit
C:\Windows\SysWOW64\Cbgnemjj.exe

Filesize
256KB

MD5
97761cac6936a1a570df4d31e7c587b4

SHA1
bc4c4e25bb8bcc54ce362829f722a8e73cffd04b

SHA256
c5512bbcad3b9332ad823b4686ed1a69914c493cf7004515160bc9b1c463ac66

SHA512
6f12852067cf397059c01da699ce6c37331b0f3eb26ae36261c69d680c8e276af7aa6e8cd85499c96e65280062f23e199b03ab8e3b41554984a72fe2c578abd2

Download Submit
C:\Windows\SysWOW64\Ccchof32.exe

Filesize
512KB

MD5
6fdcf114603f317358a248f8e7110da3

SHA1
26b0123782ba315358e7e2260fb94190d89f383c

SHA256
51866bb04b52865408849711be9c229d2b34ceaced705dbafed9178582b8f5d7

SHA512
8f355fac27b819e213aba6d162035d7df97df4de364be9e58e345654a7e91dbde10b8ef0016ff283e435de5341b7ec1e1f74076335a0d97b5d03476319eb36e0

Download Submit
C:\Windows\SysWOW64\Chlflabp.exe

Filesize
512KB

MD5
0f6ee32f48fcd3a3dae07739cf519a63

SHA1
01dbf621bdede47ff8e7aebcd638ff4476aa65bf

SHA256
870bcda9f14192ee0d48310ec383401776da80046c66c4701df8f4b60707478c

SHA512
5a402b0240bfb15ce6c1752d04b052d0565fc30e0284d5d602f73ad5010b7bb62d1efa4e1bc32acbdd7131a51879744ccf3895ed0e9f97aa8e5f895c5bf31962

Download Submit
C:\Windows\SysWOW64\Cippgm32.exe

Filesize
512KB

MD5
e713f6fda8d7e3d7017dcf4a8e1c0012

SHA1
9ffa55d7523f067fbd86dbef7cb4091e6d9de1ed

SHA256
e36af602d3a162182adaacb9805eae0d73f9baf16d351423378b4ccce6084f2d

SHA512
4fded25fec3141149fe131c462e9603add85cf2a166b124c07a8ca9a09abd0a4f157e8899007b69af7981962976601c6a6e20e2196279f627669cd2b3444fa3b

Download Submit
C:\Windows\SysWOW64\Ckebcg32.exe

Filesize
512KB

MD5
694f9a9ca89f189c46f48b428e7d1f28

SHA1
f30c5af3b9df7010141fe8d9ad91da3bfc28dc1b

SHA256
f5e2dab21936afb50309333f1285ea08fdc977051e0a4f459934431dea69ba5f

SHA512
bb0d13c9170bb9a3f8fca0e674f86680035a422d2ee6952881e66ecd445e5199e755788d5da91dd35860e56f4d9d6813187c1f7647c5243370703bc41edba7d3

Download Submit
C:\Windows\SysWOW64\Dmfeidbe.exe

Filesize
512KB

MD5
ff4265b0eda5b91385b663bd204f34dd

SHA1
d1e065e4e09978d257a3cf3e38afc07111b34f9e

SHA256
086250384e452907dad8b1c0888c10cfa26beb84d1151a7a30b21632124a4499

SHA512
939832e683d0783b7fcb28978b7ec80b048a66cc0d832203179836072f6492c71b9c7a54670182627bb64d1264d56965cc4fa22ca54fce9633974167d457d31f

Download Submit
C:\Windows\SysWOW64\Dndnpf32.exe

Filesize
512KB

MD5
e6348c6405446ecb6c9ddc432a8d6ad5

SHA1
8f0dbb6e958eeb7ceafee983b10450fe61761bfc

SHA256
66a6b8a0798972a51eba87b55d2dc91eb5594633970ad620354d14c8b50bc142

SHA512
261fd3a7dfa10736cc9ec76b6728a0ca58921e703cbe7a6cdf4e90c8e9fbd883befca50f1e9fd3c93627ea4410f85f5740119e645be505409081cfe9cbd27f79

Download Submit
C:\Windows\SysWOW64\Eciplm32.exe

Filesize
512KB

MD5
0608e885a2c8592c0680b3306fe388f9

SHA1
8a249715378dc26a2301948a187c9869f5df9a00

SHA256
35be02a7e81a91c4e2f6ded8372280fc1a0e51ec1609363a72e1aa0c9b0ae66a

SHA512
540182996fcbd7e14e66c7403df9b7b857bbc7a141a057007ff88a2066ba56ca360b0ef4f9c3497f07170bd41249b209547388693fe49c771ae394906b396f46

Download Submit
C:\Windows\SysWOW64\Ekcgkb32.exe

Filesize
512KB

MD5
d3be378b05a409b654beb59fdb48a269

SHA1
4731dcf98e740b05d8ea3dc6ecaa21589fc4b72b

SHA256
e9b3855fadb4affec0bc091b14d8f3147f4c3de31a9a92064cd7b503ecda186e

SHA512
7ab59f25677db89a8f98b7dbe97eff98f52261a9722f926180ded0dfaefac5bb580848f43de376fafdda7d4997c690ed552b7dd6a5ae2e37f530900a78c378bd

Download Submit
C:\Windows\SysWOW64\Ekmhejao.exe

Filesize
512KB

MD5
f8e3240e510e878947e8e71bf19701bd

SHA1
52671a0998c452c4b598b0fca1f051bc78e93572

SHA256
c71435c8b3566f98c21260852e55909a871b4be41ed16aa0e87444756a7e98fc

SHA512
e1ce0d77241eb9d2d7561bd42a98f44e84a69eea0fc440c532d82b9eb759f62f2ec9a069ef371e795bc3bfbee2077fcd2ccc20a614b39a3aa491ec60ee4d25bf

Download Submit
C:\Windows\SysWOW64\Eleepoob.exe

Filesize
64KB

MD5
82c835e7ada8b2bf96935ccaf4f125cd

SHA1
9c800c4a80af896035c15d62e8b07eb8839e3943

SHA256
6b92e5e96c3b5c1241c09aaf065739a11b4e119b37bf8100b2d5e3dfa3e2d6a7

SHA512
8f9331d57415012c736a89e45459716e7377790ff5088b75b8b65df287f152fa0bc0ae3efed8012dfe6f0760e24a19f2bdd2fdffcb96a3483d3e67e1189d7acf

Download Submit
C:\Windows\SysWOW64\Gilapgqb.exe

Filesize
512KB

MD5
b3320aa2a116807fbef8266c8fef2d6d

SHA1
90c6f3823314e9fb101e7e680de07d613f96403f

SHA256
a054e8c92518002637a929c8513fa003963edef7be8cc11de7152c2d88c1b297

SHA512
32cd25599624cb7f25c0930cde21e9421a3db8a4b2dc83392dd6275dfcf4de349df2194d6728764edda21cc5f0b59e977f3b09462fe7b37f2f93494b0b341866

Download Submit
C:\Windows\SysWOW64\Ginnfgop.exe

Filesize
512KB

MD5
3dc7e05290026e1fd1eab925667ee790

SHA1
21373f452ee966c41bbc9024db16a687c2253461

SHA256
1d0da90fad7b3ca859be4a634b71fd90834ff7ac526db4fe06818a432b26d802

SHA512
b86221f8aba4141a7749fffbd758c08076361c45e39dc86d8f0ca83c191c0d711726605ea2ff774915d8b2bdf9c13b5d6c55c06be35c94c2f88ad3af6aff7f9f

Download Submit
C:\Windows\SysWOW64\Gkdhjknm.exe

Filesize
512KB

MD5
542206ddd2a89d591b004881eee5263b

SHA1
39d89015ace329b8a6069c6fed0089bd369c7dc2

SHA256
0826a6c0f7b65d3179e3ea69ed8384f34ff660dcb6d80d8364e016f013448430

SHA512
3fbd085d93bc16f9f4af931bf26e0080cf7d1a818d09ba45ca74969b52985caaa1edc305cba5083bdf297589e483fc3293a2e716a0533e86b6d080df96b4d2b1

Download Submit
C:\Windows\SysWOW64\Gmeakf32.exe

Filesize
512KB

MD5
6649725ed89ac3be6e15c7c4384e108a

SHA1
41babdaa9f123cebf492c1b32e9c8817d8a73b6c

SHA256
6027fe231d2564cf61dfdd08a67b09252a1d1f673fb937e959078cd33c595714

SHA512
f223fa98c58ff7c7b5751c230b2ce72c3e7845688df37fb591fd298dd7b4c3560551684ae903ced1d0f5c63974a34f3c51216eb0595222bd17640945d805a3dc

Download Submit
C:\Windows\SysWOW64\Gphgbafl.exe

Filesize
512KB

MD5
78323b888359313b00e12af6edb6e7d8

SHA1
4280ebda1b1ce8aa0c4b98d7a92ae90bef38166c

SHA256
2c5dc7ec7566f6592784d2a1b8f50272b07540241ef631e37290d88ddc04111f

SHA512
fa5316879be6dbca693a4b736b4643e559970a2bbd1791e0eada9f5e81ae79a71208fbeeec0fe6cce0b549e9ccec4a2a12da4ffff1ba5cc553129796cca09910

Download Submit
C:\Windows\SysWOW64\Gpkchqdj.exe

Filesize
512KB

MD5
27fbfaae6b06f19b64da957ce5aa975a

SHA1
ab8653d6911ee122807c31779c9e493185897dcc

SHA256
c0a11157f60900e974d978c9ad8fb6e8b76cb391a4b2b7ca6c6b39371c4ccd80

SHA512
bd0ffd3c80641473927a1f81c18c3c07f8346fad252494f3c0b7c91607915e406bece37a7a5ca31cf7168703a2a1a56b4fbc945269c9c6a0ceb325a48590516b

Download Submit
C:\Windows\SysWOW64\Hcblpdgg.exe

Filesize
384KB

MD5
152e0668439884876ba7722ceadcfd82

SHA1
b685d2566991e69270e99acdb7c6639bf9dfac14

SHA256
b8439b21b3d1d0828cc46e3265508648cc64c18bbca6359adac60b3bbbfa3d9d

SHA512
606ce0156d905576f5330c0b2b7405371d3c18167943f4ee033c54801f33f1e9e3b42a97b63d197d6efde2d28497d2ae4d95714f0a7efa1d170c43693689295d

Download Submit
C:\Windows\SysWOW64\Hgdejd32.exe

Filesize
512KB

MD5
5867c154ec6791272253194ac456b5c1

SHA1
81b59ea6723d931dae087ddffa5ad244d69a91aa

SHA256
ed88ca595013e6b4cf967a5a7a02de61129338e46d5b65f9435f7620c6d66adb

SHA512
ed48e5495428d47c7e32eca3458f636087d6a8f49442a1606857081e21505f0d9326aca970530f7005e8b9cd5bdc420005932bda22caf9a1ee93d7fd36c9ccbb

Download Submit
C:\Windows\SysWOW64\Hhdhon32.exe

Filesize
512KB

MD5
bc8be4b72b749aece17ccdbf0ce726a5

SHA1
f81479fd6432df2d5ab043eed8b3a4b59ebd1a81

SHA256
3df6d4409efaba09bde33e5304f26dc9ee55d06a7aa93c7af96e77a0983c2254

SHA512
4d09e32e3d568dca992c2aa3f2fc186a441708b494c53c55d2a375b205ba0b28b05091f58c09f9d2671fdc5c19e13292b2170c2b7ed1fdebb6b416bda90963d7

Download Submit
C:\Windows\SysWOW64\Iakiia32.exe

Filesize
512KB

MD5
12f5d9dd769930b79efcfe7509c31c36

SHA1
7aab0f3c238c7670b4101544fb001ff7f3660d2d

SHA256
06a7b4df3f1245aebea463def4e0d45637cef39050a69ba00f7e5024d1289296

SHA512
0f95225fabcdca962a1d0097f6a496443e377cd1efcd2b6d302203d79bd97144c1e5142c84a7be6e199cfdc30956afc72f3c8019aaf8263bf47eafb80575124a

Download Submit
C:\Windows\SysWOW64\Iipfmggc.exe

Filesize
512KB

MD5
bdd5130316d1c4eaf4467eaeec5f414e

SHA1
b4339f4fe56ca29b130f5ed101c993f2c88564a7

SHA256
f5fe6dd91be03ab3ed9cd47b3c5475241f4b49125c6956a833e88391c2ee3a35

SHA512
d75e8fde8cbdd37696a04321b7de20759bf55fb3df4458c4dfaa32ad3654546d8b415ca4198d5e7f145626c19bacb54658df7ec2f5b309c2add4d27dd898255e

Download Submit
C:\Windows\SysWOW64\Ikndgg32.exe

Filesize
512KB

MD5
f05bfeeacfe7e31028b5570fdd5ff14d

SHA1
66e86fbb949b8cf1a8e773e3062ce1098ac3e438

SHA256
c3f4cbf0d5432464a3ab581c285263f3718628079a9beaef5b7262603d48c892

SHA512
d9a061910ebaa4a5baf340a5a8252e960ee747b0a863a87c9ab28da1d37cc867661ca91474679d3f97054e693517ed14c600c9785d8783145a3300d589abb1ba

Download Submit
C:\Windows\SysWOW64\Indfca32.exe

Filesize
512KB

MD5
c385a1e6373aa88390ff19e4e9f517d4

SHA1
bd078c009a248b5c56c7de0194183e92b31b6d95

SHA256
d119ed89a653f3ba0aa4408e79f88de135e5a9bf1b6f7ffc566e880313dc6ecd

SHA512
af521c6b08ebc19ed644f82769e438355f652939099807a06e07c9245eaad6991307d5de0b3398d6019c4dcfc14149cf8ee612577dd901148226381f12c9d880

Download Submit
C:\Windows\SysWOW64\Ipoopgnf.exe

Filesize
512KB

MD5
4811870b3c9bc72e4af5bb0a9f4e6bff

SHA1
de0c306f683d79dcec19d285ddeb6eb99bb3198c

SHA256
70ebb639b364ab30e17e425e8079dbe7534e9a253de91ee9dd9745c69d7d6428

SHA512
3a586ae7e77a1a6e541f9929cdd8570aaf92357185bf4b833e6626b7a3eea4fa965028a4f2fb2834272b04733c25bd6aa8466a964e005a10c580920179471d2c

Download Submit
C:\Windows\SysWOW64\Jglklggl.exe

Filesize
512KB

MD5
34c2e53dd890156c6a9bc6f7f93285fa

SHA1
598cc371202bf38748e494d648fece64749604b6

SHA256
ecfe81f177fdc6b3b632d0ae4ba212cb92a182d49ea70ff1243949a544d9cfa7

SHA512
b63384daa288a65421194df3c38bca9074b61b7e92b42dcd3b091cef068043edc8ba6d444e356bfe9e77b607088c8a7f48967cec812acc7fb6c0cc93c00336c4

Download Submit
C:\Windows\SysWOW64\Jiglnf32.exe

Filesize
128KB

MD5
132bce2c0a7253a8706c36f8f18a36aa

SHA1
d124f7e05189bb6d3c7f65e4bc04d77d362b13ec

SHA256
03eab07c0b4bf21ef9a8778551d33148ba51791dc308ecb3964262663abef634

SHA512
dcd0c2c2ea68b2a7ac494b1d700ffb1909ce95260c8bd64f42898126863511b5ceda2c89dd2a58dc79db46238e53ff7acd7bc6ceb64c710bbae60302676b0513

Download Submit
C:\Windows\SysWOW64\Jnmijq32.exe

Filesize
512KB

MD5
88484d636d209732d57265116f991789

SHA1
df13ac614b24f2fb8ef79f36e01681f8994888d4

SHA256
78c3789b0ceded9a00243d6fa1b13e5955e91b49211276f26144f0036efbce57

SHA512
17158649d5bed08561cdf6e7688732ddb4a1f490ea93fd0612bbdf5dadf88ef5cb7dec5248b3b58fa999c4bc906aa2b860b5a649ad6ea0b7b995e09b6178e579

Download Submit
C:\Windows\SysWOW64\Jnpfop32.exe

Filesize
512KB

MD5
47cf08e33b726fe225d80b5eb0b6d1e9

SHA1
f405791f9e52f495f4211584eff06fda12ccb0a9

SHA256
38e64d292b6a5c68bb770f4e5782f7850e8d4405f0396609254ea4d670068424

SHA512
1184d606751b76e4319030e643df4d80d55ed81fa820c57b7e53740c61a6161db4e3a65da31cce3b04b6eff9d2f85b64af0a1380ad726bb9328666101e8d6a8a

Download Submit
C:\Windows\SysWOW64\Jqdoem32.exe

Filesize
512KB

MD5
4a01eab1d32f1e2f45833a87bf911263

SHA1
ba6ca91c7714dc768012b7e5f4dccc08b913ae3f

SHA256
e1c8254c76cd818baf398533895348d419168980824b4960d096a3fcd60d9902

SHA512
84afe5e33ed6521713d1fb8fd4752633776182d128cde9463d3848e258a058b4cf1f95a11debc23c731caf7bb219a48c6aad36f601bd3e262c4ee5780e0e44a9

Download Submit
C:\Windows\SysWOW64\Kjjiej32.exe

Filesize
512KB

MD5
eabd8d239d1a288852bc0fae6349cd80

SHA1
d311caffa278874a2b7d01383ae3b91d0a1b20c5

SHA256
ac2ca4a16a73d50347d4e744cff38fb087622a052a19e8229d7ccf6f83a516dc

SHA512
f0d56c6101f883c5f9b9179ab3acad1591331bc4ce71570e087431e06042400121fcd202be15e8e41d6fb122413b7a3b9c3adb6f22f94c5d429add98443e81ae

Download Submit
C:\Windows\SysWOW64\Kjkpoq32.exe

Filesize
512KB

MD5
8b8a127567435b950cea81830f85d129

SHA1
3644da4dbcf99856d85b111060c24e970810e3dc

SHA256
e47c25ead2f566c0476f40ece44832eacd412d73d5313ccf8d4f7c7a078da216

SHA512
ae64c2218aa79f552c832cfd97f6166cbb3a2ca3560dfe78bf66cc5c8b4e60b3cd8c315baf9c903c678e704243efc1ebb9561dd324ad7f2fa821a8f033c6d5bd

Download Submit
C:\Windows\SysWOW64\Kndojobi.exe

Filesize
512KB

MD5
18465334151fe77a7cdd9491f87056a7

SHA1
8e04455f9212cae46a5b46410ba0d146bfc1b732

SHA256
37992e0a9c22552f40863ef5edf9539fa2c8153c5ed69964f21dc26317c1d448

SHA512
1de92e36bbf84b4b65499a599c5a3867bfc4b4e920768d9e29aff0d6cbed3f5485fbf12b5607dc8f4556bf9db255a0c7d8572a20f4e6f36ade78a9d4e4d56b7e

Download Submit
C:\Windows\SysWOW64\Kqpoakco.exe

Filesize
512KB

MD5
1f2d9c5cffd06cd02c52bdec1bcf937d

SHA1
c4374912df5d66da409a846df3f547edddc7823c

SHA256
d037226d593133b6a5ddbc27df5feffbc52bc6185a31040b8cc55ed61262e773

SHA512
7714bf29860756228deb5fb29af3989c666b986f0d1120c5965ce667790babe43c4e1f76a9fb8b9f01aaeb7741d5a325429a82a55c39d830d4ffa4d474fb6c17

Download Submit
C:\Windows\SysWOW64\Lacdmh32.exe

Filesize
512KB

MD5
3c02d6c69a23745e09d201ac5841b5a9

SHA1
918f5dfb7d5b9d3e0e9c0e7e04c16397a47342cd

SHA256
a3b9d16411387bb17d676d49c298769f7705e1013f167f1741699c2490f12ff9

SHA512
aa3829d19574d0eecd7fa246671f8177e52e6dbe7f1a903f38d5f5bf25259772c8060a6a75f048aab408677f84d0dd10eec499091e5db2ac6198f9c28e95aaca

Download Submit
C:\Windows\SysWOW64\Lenicahg.exe

Filesize
512KB

MD5
c5528c981d9ee689fd811ba0caf86bbd

SHA1
ddb3c6f00988ad2bea8dd108caf4221112b6eda2

SHA256
43acb859d2ab6d653cc6deb7dbccf1418bcd92f7cfabc748f83f8deb2ba10acc

SHA512
49ac91ca044d4252dd14e0a20d194d6c2a288884bd889084ce5b1121aa76e7e8dbd960085fa9b0473cee3b0041573220372a9b89ef18bf9c31d38bfe2a9df3ff

Download Submit
C:\Windows\SysWOW64\Lnbklm32.exe

Filesize
512KB

MD5
4d5d9733fedc7397a9b77c9bfdb80386

SHA1
1210286d01853e507df29d5035b762b2b5c7a66d

SHA256
30d1f704cef80629077a48627351a0a5bf6bd20336a4e5e5425a82ef2a55a3d8

SHA512
d74938d82410f90d409decf7632950b1a81bf59f0a0ea1a04c64a664e43384009edb02ab0a742cca49f130679c3c0771400bbf72152ed50f501d58505c3ff92f

Download Submit
C:\Windows\SysWOW64\Mbighjdd.exe

Filesize
512KB

MD5
3c0e0d03adea0931eef5225692ce5d9e

SHA1
e2257ce0460303e8de6a7dca5851aca04afecea4

SHA256
ff5725309efe72d63b7e03a9adfb46529db87a38d57b3e025654cc8d4702fb2d

SHA512
a952ead625ed946f435d6f99c315b54d89b33e6624518a20adde64cc76693b08f04e89357533b23f4a29279575b0292f1c11bd1b357d8f1cf8b8238e8b2118f1

Download Submit
C:\Windows\SysWOW64\Mhafeb32.exe

Filesize
512KB

MD5
661b24ab856514bc779217121d04e9cb

SHA1
84d69c39960a8427ff82651f4be790785525cd0c

SHA256
82f7d097f4a6b1e4d28169e8a705ccdbc768ac936fceb24abe74214e724da213

SHA512
e94f33df2dc92dcafcc69e4013d3514ead448527e2a9613b6c479095125cb5ece161cbbf8ee25fc687cdb7fffe63419b640b5a5453c8edcbfea4da027f6bedb6

Download Submit
C:\Windows\SysWOW64\Miaboe32.exe

Filesize
512KB

MD5
5aa2b78506bd09a564e29b867ef2bfcf

SHA1
978666370b19b530666de793dd98ab5b82d88171

SHA256
8b6db6e5ef969da0acf22f263e4fcad1d3d70546023877130c539d0fd15e91cd

SHA512
793f6648df7c4abe77ed3d12602f478699d265e6cf4f9b7f1f85de3fd5806e1cf8a34ecac954b505ad386dc7823d7cb313fb08865d7b0783cba7a76d7b3b1eba

Download Submit
C:\Windows\SysWOW64\Mniallpq.exe

Filesize
512KB

MD5
26f511c5182a82129aa877c91a379378

SHA1
3399edf318b67f0da3e8f9b69940beb0c00e68b2

SHA256
d7328424cad675feccab84bc645533261ba0492da0155a8aaac1e6f650f6db62

SHA512
64a2ce04721c94f0aa1b0b4f0ec7f2e38e27aa1597b0a174a65a72b8ba900f57406ec55ae6649916996c9b008024a49a0c0a2c8f3eacee2b9858ca2668ccc5c1

Download Submit
C:\Windows\SysWOW64\Moipoh32.exe

Filesize
512KB

MD5
748ee7f72ea745d3e4fbabb6382bd1fc

SHA1
e931dbc3225369ce1d0189d88214101e7d6cd884

SHA256
73fcbed2312054a957db1e0ccff62821772d56deb854f4268ee0380f36582822

SHA512
79ab2f9a9dddb13946122ec16fbef6164a1a7f9129693f5e1c870b0c7fa6ce19d69559b4321d5366dce0ad5a572ca3a6f2383e81185c458ad60d361d375863da

Download Submit
C:\Windows\SysWOW64\Mplafeil.exe

Filesize
512KB

MD5
67ed075e8139739f7ba68ac4feda05d4

SHA1
93640b913a0ac7ffd88632651c0b184790c47fc9

SHA256
8806ab8a6fda0b06731b0162c62aeb38a378ad9f860ad37cfa737b0d3572ceba

SHA512
1802a8604cf31963e4eef899ff661bed7c3df43096ee35e9bc398a8059ca06305688ee15784de15350a6c8bfa757210f57ebe4195964b7185e9315e10a84185f

Download Submit
C:\Windows\SysWOW64\Naaqofgj.exe

Filesize
512KB

MD5
dc8f9420ac4d21f1951dc57c2b33c379

SHA1
08f93af92c91f2890dabe389c37b2f47ab489523

SHA256
944529564073f1894681c9e9be8ca93a80133f6d892149bb961ca2e12b21f54a

SHA512
f38e5b53b5989f4581092ee583f625f4dd8efc2393f02a1292c137b7ce39a99193f950e891624679840b77b57de028032375e20eeefe2d87a8d7ca774713d72c

Download Submit
C:\Windows\SysWOW64\Najceeoo.exe

Filesize
512KB

MD5
fe99a137516eb3f177afdc0a9d47379c

SHA1
39f7d94605ef723d6bd49b4c7b1f946aa771ef32

SHA256
a9b8b8225bae02435b85a860b0423d8d3c70c55afef26125f77663b9a2656b26

SHA512
8a5024dd0896e417134de18fb11ed2d62fd790518ed290bb799799fb46637408a72c7646b485099ed86cf9b3f9b524fab51b3e759ab7b7e271f0fe6052b3a2f7

Download Submit
C:\Windows\SysWOW64\Neccpd32.exe

Filesize
512KB

MD5
c329b05d0261674821813c2342be817c

SHA1
42e587faceefdefb809d6ca6bef67414a3b6904e

SHA256
a6b282fed477409170a5b96d36742e2922a8e39a10e463b19b812ba09019f928

SHA512
aa24c1fb696e4d295f84c742b85fe654db7750f4d77e420105d18cabf6d15bb656bb3273995aa546965086f8f00c337614a7fc66bd886edc3b168549a6425952

Download Submit
C:\Windows\SysWOW64\Ngjbaj32.exe

Filesize
512KB

MD5
af8e2da051181c425e5e7c340b8d5369

SHA1
c5fecff56744493571d929bdcafc92a49ff5c47b

SHA256
7f7d700486ae4a30448c3ae47fb5a7f55a6fac0b4dc1486d6024fb947ffb73bc

SHA512
7d1454f4da2e8f68a513b743d56a8e3722f5281135dc113fa78e224f377b0e302181dc56eb72301fb0167b32f304410d15b541dd774f00ba9cb494ae6fb8c136

Download Submit
C:\Windows\SysWOW64\Njpdnedf.exe

Filesize
512KB

MD5
850a95273ae6d20fc1bfe1595e7671a9

SHA1
2e7bce3f23d5184b4b804db9320c16f45073e366

SHA256
2f473db1c7dd3777344f09d97ba97e42cf61de35bb9ac7a72c2c57113b91e881

SHA512
3bb57c9744eea8f27b2e012f1ce860d1345f76f2eb8db63a94c01338061e4b989d327387d4295cbf94462f5fc3121ac4f439cd4322f47e630455be0ba8f4a12c

Download Submit
C:\Windows\SysWOW64\Nlfelogp.exe

Filesize
512KB

MD5
68fff31a85a5e62196c58303f803a377

SHA1
7d74b98343eceebdbc0abe8642ee777f30717636

SHA256
ffe67413aed400f703dfa8d357bec8efdbe195691fbb6f1f3f5e484fe418f1c0

SHA512
4ef7564bf444614630eed610c868ed14a40d4076231d62a133ce81992733148fbc325a35dcf8ef7ae36c05f5abca54fae0837ce210090cf27a7f3dc17b547414

Download Submit
C:\Windows\SysWOW64\Nlkngo32.exe

Filesize
512KB

MD5
49334b1789bf2c24b41fc5e12e6ff618

SHA1
9e3a9df685c8972821268d4f938a3f840baaf49d

SHA256
6c2d580ddc4dc02559d7f6dd29e2377b66f4e0d6797d7dae29ecaeecf4d5bfc0

SHA512
fa3cb097504f3829431dee3ff92e5873d5f0d7e2c54939c4d5d518b5c317634ecffe3bd1cc1fa1c93ae101ead9eadb1ccc20cd299f8141ed439c383a8388fb2a

Download Submit
C:\Windows\SysWOW64\Nnafno32.exe

Filesize
64KB

MD5
c0f14df950cb41388eab8bb27d3c773c

SHA1
14ac7c85887824dbfedaa72b80c0a671a026eaf0

SHA256
5a5cd3a96481b6d5ec5f4e659ff0800274e564aa0404739507ab8b63c150e879

SHA512
367c0f16b5c604f028d9537d8903bff68c099c4b26cfa0ff7e85e4fb0e2c5ab8b10c6ce26cdf0e300b16ad4a897bd80997aecc83c9b98de787e322777afb3d82

Download Submit
C:\Windows\SysWOW64\Ohnohn32.exe

Filesize
512KB

MD5
11f01d57be516f1bea63a1faa2905d0d

SHA1
47ac37fd128bfe4288d25d21c8f1070b17364a3e

SHA256
5fce0fe8a8b28348343d22b0fe9ea72837523d8143da36a79ab3f67bdec81eaa

SHA512
8a1b2c64580bebd10f1a55b9f38c23b2aaddad9e22e8ac452daae4121a13903bcd80f2490325b4d6e1df8d8a590539eb3f5ac3d807d57521e93ceb0d7eb6ee8f

Download Submit
C:\Windows\SysWOW64\Okchnk32.exe

Filesize
512KB

MD5
d9bd3cc9499096a857091a631a37dd21

SHA1
1db73c2e0c749c003cab8f189167730bc1d58e50

SHA256
5a12df9a62bb282123c1b2ca0605494b18d7b41667f472be68f0aec0462c13b5

SHA512
1c620418b8818ed16d3f8b3b41b2b93b397100e46a3a66f84a570b7cac4ff6602edeeaeb14c04d8c6d649af02bdfb20472cbac087037ed0a07394e4e78b2ef01

Download Submit
C:\Windows\SysWOW64\Okgaijaj.exe

Filesize
512KB

MD5
ea819aeb9e58e52e69a18b5aed36479f

SHA1
ad3702c26117d9d9f757ba8b8b931102012c340e

SHA256
7c0c604e6356926467f50a87b51c183f12f4a0110af3ad1d29cad09ce5c580c8

SHA512
a37368daad038041f0c350421e5c517996b95768958e43e4046ab1c3ff128d95d00ba9cfd1257e5c264853a850cd46d0020fc6d87b9aa6c7e2a2040251ecdf71

Download Submit
C:\Windows\SysWOW64\Paeelgnj.exe

Filesize
512KB

MD5
26cab92259670304b4390258166eafa5

SHA1
a46398327cecc3d7ca807c640454929eb0fdb827

SHA256
080f6a9939f8bb7e50afd4ffff51706a825fc0c925e2bd9a89593dcafbba34fd

SHA512
82805ef8187564f4ad55b33531bacfcfb65e1b5ba80621925f2ef5543809fab54ae5b16c784ca89cf2537f8549f74755bc337540bad98abe5e20b39652b68219

Download Submit
memory/216-186-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/216-691-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/392-303-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/412-273-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/452-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/620-412-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/684-418-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/752-234-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/752-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/784-575-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/784-130-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1020-57-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1020-458-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1208-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1316-431-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1336-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1336-444-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1500-523-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1500-98-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1508-509-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1508-82-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1536-252-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1544-146-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1544-601-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1616-406-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1696-388-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1716-358-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1804-314-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1952-285-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2132-49-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2132-446-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2188-382-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2232-334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2268-732-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2268-219-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2320-705-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2320-203-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2368-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2616-194-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2616-692-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2840-297-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3044-536-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3044-106-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3132-29-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3192-760-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3192-247-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3228-582-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3228-137-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3240-171-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3240-664-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3296-463-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3296-65-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3356-114-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3356-537-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3396-432-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3408-465-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3408-74-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3468-267-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3612-400-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3672-153-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3672-606-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3748-279-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3764-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3764-72-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3764-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3840-33-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3840-425-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3976-90-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3976-514-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4016-121-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4016-556-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4048-672-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4048-178-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4108-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4280-340-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4288-712-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4288-210-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4344-243-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4408-726-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4408-211-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4632-259-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4640-376-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4668-352-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4724-291-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4876-17-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4876-309-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4928-167-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4956-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4972-739-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4972-226-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5016-322-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5096-346-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads