1e06e2cbcea0abbe07d1b0477a9ce1b47239ef4060ed07ab91effe93eef89320

Analysis

max time kernel
116s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e06e2cbcea0abbe07d1b0477a9ce1b47239ef4060ed07ab91effe93eef89320.exe
Size

165KB
MD5

3ecd4131086634a188565c4ec5329e3d
SHA1

37945108d48d664dc477a59891f130cf54d465b5
SHA256

1e06e2cbcea0abbe07d1b0477a9ce1b47239ef4060ed07ab91effe93eef89320
SHA512

3d22ab1f3529dce4a049c5008273b2fe44fd8b2f6865cc9aaf80fca0929d11736d1614a73e6448bcc51926e934de5785021a0622e2e1939091310d92889b9efa
SSDEEP

3072:TT8OwuWee8nmOT3vQfEdArGzHq+egM5bylnO/hZP:FwumK9bQMdArGzHregqgnO

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmjlcj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndghmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhnnep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcioiood.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeklkchg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Clnjjpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcncpbmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obdkma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iihkpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ieolehop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ampkof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdgljmcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfhdlh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbabgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlmllkja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abemjmgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cehkhecb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fchddejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipnjab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjgcgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Daconoae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogjmdigk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eabbjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdqejn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njciko32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jefbfgig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mnebeogl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofcmfodb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qbgqio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fohoigfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Glhonj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifefimom.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcmgfbhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogpmjb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbbgnpgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bobcpmfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fhqcam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gicinj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	1e06e2cbcea0abbe07d1b0477a9ce1b47239ef4060ed07ab91effe93eef89320.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbjoljdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkjjij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmknaell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Neeqea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmoahijl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Okhfjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocgdji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iikhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klimip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndfqbhia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anogiicl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnmcjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Banllbdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfaigm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceckcp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofqpqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjagjhnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obdkma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blpnib32.exe

Executes dropped EXE 64 IoCs

pid	Process
2384	Lkiqbl32.exe
1652	Laciofpa.exe
4308	Lgpagm32.exe
4940	Lnjjdgee.exe
2876	Lphfpbdi.exe
4072	Lgbnmm32.exe
3908	Mahbje32.exe
2852	Mdfofakp.exe
1448	Mgekbljc.exe
1984	Mpmokb32.exe
1444	Mcklgm32.exe
2744	Mgghhlhq.exe
2304	Mnapdf32.exe
4820	Mcnhmm32.exe
3504	Mkepnjng.exe
1396	Mjhqjg32.exe
1868	Maohkd32.exe
2160	Mcpebmkb.exe
2072	Mnfipekh.exe
3008	Mcbahlip.exe
2692	Nkjjij32.exe
908	Nqfbaq32.exe
1368	Nceonl32.exe
4084	Nklfoi32.exe
3520	Nnmopdep.exe
4524	Ndghmo32.exe
3124	Ngedij32.exe
2868	Njcpee32.exe
4320	Ncldnkae.exe
640	Nggqoj32.exe
3028	Ndkahnhh.exe
3572	Ogjmdigk.exe
3824	Okhfjh32.exe
4844	Obangb32.exe
4496	Occkojkm.exe
2860	Okjbpglo.exe
3416	Obdkma32.exe
2916	Odbgim32.exe
2636	Onklabip.exe
1200	Oqihnn32.exe
60	Ocgdji32.exe
1380	Okolkg32.exe
720	Obidhaog.exe
3836	Pcjapi32.exe
396	Pbkamqmd.exe
1620	Peimil32.exe
692	Pghieg32.exe
3004	Pqpnombl.exe
4660	Pgjfkg32.exe
872	Pndohaqe.exe
3860	Pengdk32.exe
1160	Pkhoae32.exe
3048	Pbbgnpgl.exe
3268	Pcccfh32.exe
4432	Pbddcoei.exe
2768	Qecppkdm.exe
1968	Qjpiha32.exe
980	Qbgqio32.exe
2964	Qloebdig.exe
436	Qbimoo32.exe
2176	Agffge32.exe
4968	Abkjdnoa.exe
2316	Acmflf32.exe
4208	Aldomc32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Miifeq32.exe	Mgkjhe32.exe
File created	C:\Windows\SysWOW64\Ngmgne32.exe	Ndokbi32.exe
File opened for modification	C:\Windows\SysWOW64\Bfhhoi32.exe	Beglgani.exe
File created	C:\Windows\SysWOW64\Mcklgm32.exe	Mpmokb32.exe
File created	C:\Windows\SysWOW64\Dkgqfl32.exe	Dldpkoil.exe
File created	C:\Windows\SysWOW64\Dgdelcpg.dll	Jcefno32.exe
File created	C:\Windows\SysWOW64\Qqfmde32.exe	Qmkadgpo.exe
File created	C:\Windows\SysWOW64\Eeiakn32.dll	Bebblb32.exe
File created	C:\Windows\SysWOW64\Iqjikg32.dll	Beihma32.exe
File created	C:\Windows\SysWOW64\Jhondp32.dll	Gkmlofol.exe
File opened for modification	C:\Windows\SysWOW64\Afmhck32.exe	Acnlgp32.exe
File opened for modification	C:\Windows\SysWOW64\Bcebhoii.exe	Bebblb32.exe
File opened for modification	C:\Windows\SysWOW64\Lmbmibhb.exe	Lekehdgp.exe
File created	C:\Windows\SysWOW64\Fjegoh32.dll	Nlaegk32.exe
File opened for modification	C:\Windows\SysWOW64\Njefqo32.exe	Nfjjppmm.exe
File created	C:\Windows\SysWOW64\Baacma32.dll	Ampkof32.exe
File created	C:\Windows\SysWOW64\Hihbijhn.exe	Helfik32.exe
File created	C:\Windows\SysWOW64\Anmcpemd.dll	Jmbdbd32.exe
File created	C:\Windows\SysWOW64\Cojlbcgp.dll	Lbmhlihl.exe
File created	C:\Windows\SysWOW64\Gfgjgo32.exe	Gblngpbd.exe
File opened for modification	C:\Windows\SysWOW64\Oflgep32.exe	Odkjng32.exe
File opened for modification	C:\Windows\SysWOW64\Qqfmde32.exe	Qmkadgpo.exe
File created	C:\Windows\SysWOW64\Cjinkg32.exe	Chjaol32.exe
File opened for modification	C:\Windows\SysWOW64\Nnmopdep.exe	Nklfoi32.exe
File created	C:\Windows\SysWOW64\Dajbcgdm.dll	Baocghgi.exe
File opened for modification	C:\Windows\SysWOW64\Eoolbinc.exe	Elppfmoo.exe
File created	C:\Windows\SysWOW64\Faihkbci.exe	Fkopnh32.exe
File created	C:\Windows\SysWOW64\Pohkbc32.dll	Gblngpbd.exe
File created	C:\Windows\SysWOW64\Pmdkch32.exe	Pnakhkol.exe
File opened for modification	C:\Windows\SysWOW64\Mcklgm32.exe	Mpmokb32.exe
File opened for modification	C:\Windows\SysWOW64\Abkjdnoa.exe	Agffge32.exe
File opened for modification	C:\Windows\SysWOW64\Acmflf32.exe	Abkjdnoa.exe
File opened for modification	C:\Windows\SysWOW64\Hcmgfbhd.exe	Hobkfd32.exe
File opened for modification	C:\Windows\SysWOW64\Qgqeappe.exe	Qdbiedpa.exe
File opened for modification	C:\Windows\SysWOW64\Ajhddjfn.exe	Afmhck32.exe
File opened for modification	C:\Windows\SysWOW64\Cdfbibnb.exe	Cecbmf32.exe
File created	C:\Windows\SysWOW64\Kpmmhi32.dll	Dkoggkjo.exe
File created	C:\Windows\SysWOW64\Elikfp32.dll	Gkoiefmj.exe
File created	C:\Windows\SysWOW64\Kemhff32.exe	Kfjhkjle.exe
File opened for modification	C:\Windows\SysWOW64\Ednaqo32.exe	Eapedd32.exe
File opened for modification	C:\Windows\SysWOW64\Gcagkdba.exe	Gkkojgao.exe
File created	C:\Windows\SysWOW64\Hfcicmqp.exe	Hbgmcnhf.exe
File opened for modification	C:\Windows\SysWOW64\Oponmilc.exe	Olcbmj32.exe
File created	C:\Windows\SysWOW64\Pdmpje32.exe	Pmfhig32.exe
File opened for modification	C:\Windows\SysWOW64\Baicac32.exe	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Ceipnc32.dll	Qjpiha32.exe
File created	C:\Windows\SysWOW64\Ncfmpnfb.dll	Bnlnon32.exe
File created	C:\Windows\SysWOW64\Dkcfedla.dll	Hodgkc32.exe
File created	C:\Windows\SysWOW64\Hfanhp32.dll	Cegdnopg.exe
File created	C:\Windows\SysWOW64\Kmfjodai.dll	Djdmffnn.exe
File created	C:\Windows\SysWOW64\Kpdobeck.dll	Mdfofakp.exe
File created	C:\Windows\SysWOW64\Bdhfhe32.exe	Bajjli32.exe
File created	C:\Windows\SysWOW64\Chagok32.exe	Ceckcp32.exe
File created	C:\Windows\SysWOW64\Lmbmibhb.exe	Lekehdgp.exe
File opened for modification	C:\Windows\SysWOW64\Bjmnoi32.exe	Agoabn32.exe
File opened for modification	C:\Windows\SysWOW64\Mcpebmkb.exe	Maohkd32.exe
File created	C:\Windows\SysWOW64\Ehjgecbe.dll	Pbbgnpgl.exe
File created	C:\Windows\SysWOW64\Fafkecel.exe	Fohoigfh.exe
File created	C:\Windows\SysWOW64\Jpcmfk32.dll	Pqdqof32.exe
File created	C:\Windows\SysWOW64\Fmjkjk32.dll	Cnicfe32.exe
File created	C:\Windows\SysWOW64\Jjjald32.dll	Dejacond.exe
File opened for modification	C:\Windows\SysWOW64\Okolkg32.exe	Ocgdji32.exe
File created	C:\Windows\SysWOW64\Mnepdqjg.dll	Elppfmoo.exe
File opened for modification	C:\Windows\SysWOW64\Gblngpbd.exe	Gomakdcp.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11980	11740	WerFault.exe	585

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnepdqjg.dll"	Elppfmoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Collmj32.dll"	Ekjfcipa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcllonma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlplhfon.dll"	Klimip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Adgbpc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Occkojkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdhfhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgimcebb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgkjhe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Andqdh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qghlmgij.dll"	Ghaliknf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iejcji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajfhnjhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfogkano.dll"	Okhfjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egjpehcm.dll"	Obdkma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Facagg32.dll"	Bopgjmhe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Baaplhef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npfhbbpk.dll"	Dekhneap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hikhen32.dll"	Glhonj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqgmgehp.dll"	Mmbfpp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npfkgjdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofcmfodb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgcail32.dll"	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ainpbi32.dll"	Gkaejf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjbbkg32.dll"	Njefqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmgbnq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mahbje32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajiknpjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Daolnf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ehljfnpn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Flqimk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jefbfgig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgbnmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Balfaiil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lepncd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndhmhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oncmnnje.dll"	Pnonbk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pclgkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gblnkg32.dll"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdolhc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dldpkoil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kldggoeb.dll"	Fkopnh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Icgjmapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmdfog32.dll"	Kfoafi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olmeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oicmfmok.dll"	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnpppgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Daconoae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnnaog32.dll"	Odbgim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbgkimpf.dll"	Dkgqfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddpeoafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Flnlhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Imdgqfbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdgljmcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlmllkja.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogkcpbam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkiqbl32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 2384	3672	1e06e2cbcea0abbe07d1b0477a9ce1b47239ef4060ed07ab91effe93eef89320.exe	86
PID 3672 wrote to memory of 2384	3672	1e06e2cbcea0abbe07d1b0477a9ce1b47239ef4060ed07ab91effe93eef89320.exe	86
PID 3672 wrote to memory of 2384	3672	1e06e2cbcea0abbe07d1b0477a9ce1b47239ef4060ed07ab91effe93eef89320.exe	86
PID 2384 wrote to memory of 1652	2384	Lkiqbl32.exe	87
PID 2384 wrote to memory of 1652	2384	Lkiqbl32.exe	87
PID 2384 wrote to memory of 1652	2384	Lkiqbl32.exe	87
PID 1652 wrote to memory of 4308	1652	Laciofpa.exe	88
PID 1652 wrote to memory of 4308	1652	Laciofpa.exe	88
PID 1652 wrote to memory of 4308	1652	Laciofpa.exe	88
PID 4308 wrote to memory of 4940	4308	Lgpagm32.exe	89
PID 4308 wrote to memory of 4940	4308	Lgpagm32.exe	89
PID 4308 wrote to memory of 4940	4308	Lgpagm32.exe	89
PID 4940 wrote to memory of 2876	4940	Lnjjdgee.exe	90
PID 4940 wrote to memory of 2876	4940	Lnjjdgee.exe	90
PID 4940 wrote to memory of 2876	4940	Lnjjdgee.exe	90
PID 2876 wrote to memory of 4072	2876	Lphfpbdi.exe	91
PID 2876 wrote to memory of 4072	2876	Lphfpbdi.exe	91
PID 2876 wrote to memory of 4072	2876	Lphfpbdi.exe	91
PID 4072 wrote to memory of 3908	4072	Lgbnmm32.exe	92
PID 4072 wrote to memory of 3908	4072	Lgbnmm32.exe	92
PID 4072 wrote to memory of 3908	4072	Lgbnmm32.exe	92
PID 3908 wrote to memory of 2852	3908	Mahbje32.exe	93
PID 3908 wrote to memory of 2852	3908	Mahbje32.exe	93
PID 3908 wrote to memory of 2852	3908	Mahbje32.exe	93
PID 2852 wrote to memory of 1448	2852	Mdfofakp.exe	94
PID 2852 wrote to memory of 1448	2852	Mdfofakp.exe	94
PID 2852 wrote to memory of 1448	2852	Mdfofakp.exe	94
PID 1448 wrote to memory of 1984	1448	Mgekbljc.exe	95
PID 1448 wrote to memory of 1984	1448	Mgekbljc.exe	95
PID 1448 wrote to memory of 1984	1448	Mgekbljc.exe	95
PID 1984 wrote to memory of 1444	1984	Mpmokb32.exe	96
PID 1984 wrote to memory of 1444	1984	Mpmokb32.exe	96
PID 1984 wrote to memory of 1444	1984	Mpmokb32.exe	96
PID 1444 wrote to memory of 2744	1444	Mcklgm32.exe	97
PID 1444 wrote to memory of 2744	1444	Mcklgm32.exe	97
PID 1444 wrote to memory of 2744	1444	Mcklgm32.exe	97
PID 2744 wrote to memory of 2304	2744	Mgghhlhq.exe	98
PID 2744 wrote to memory of 2304	2744	Mgghhlhq.exe	98
PID 2744 wrote to memory of 2304	2744	Mgghhlhq.exe	98
PID 2304 wrote to memory of 4820	2304	Mnapdf32.exe	99
PID 2304 wrote to memory of 4820	2304	Mnapdf32.exe	99
PID 2304 wrote to memory of 4820	2304	Mnapdf32.exe	99
PID 4820 wrote to memory of 3504	4820	Mcnhmm32.exe	100
PID 4820 wrote to memory of 3504	4820	Mcnhmm32.exe	100
PID 4820 wrote to memory of 3504	4820	Mcnhmm32.exe	100
PID 3504 wrote to memory of 1396	3504	Mkepnjng.exe	101
PID 3504 wrote to memory of 1396	3504	Mkepnjng.exe	101
PID 3504 wrote to memory of 1396	3504	Mkepnjng.exe	101
PID 1396 wrote to memory of 1868	1396	Mjhqjg32.exe	102
PID 1396 wrote to memory of 1868	1396	Mjhqjg32.exe	102
PID 1396 wrote to memory of 1868	1396	Mjhqjg32.exe	102
PID 1868 wrote to memory of 2160	1868	Maohkd32.exe	103
PID 1868 wrote to memory of 2160	1868	Maohkd32.exe	103
PID 1868 wrote to memory of 2160	1868	Maohkd32.exe	103
PID 2160 wrote to memory of 2072	2160	Mcpebmkb.exe	104
PID 2160 wrote to memory of 2072	2160	Mcpebmkb.exe	104
PID 2160 wrote to memory of 2072	2160	Mcpebmkb.exe	104
PID 2072 wrote to memory of 3008	2072	Mnfipekh.exe	105
PID 2072 wrote to memory of 3008	2072	Mnfipekh.exe	105
PID 2072 wrote to memory of 3008	2072	Mnfipekh.exe	105
PID 3008 wrote to memory of 2692	3008	Mcbahlip.exe	106
PID 3008 wrote to memory of 2692	3008	Mcbahlip.exe	106
PID 3008 wrote to memory of 2692	3008	Mcbahlip.exe	106
PID 2692 wrote to memory of 908	2692	Nkjjij32.exe	107

C:\Users\Admin\AppData\Local\Temp\1e06e2cbcea0abbe07d1b0477a9ce1b47239ef4060ed07ab91effe93eef89320.exe
"C:\Users\Admin\AppData\Local\Temp\1e06e2cbcea0abbe07d1b0477a9ce1b47239ef4060ed07ab91effe93eef89320.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\SysWOW64\Lkiqbl32.exe
  C:\Windows\system32\Lkiqbl32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\Laciofpa.exe
    C:\Windows\system32\Laciofpa.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Windows\SysWOW64\Lgpagm32.exe
      C:\Windows\system32\Lgpagm32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4308
    - - C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4940
      - C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2876
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4072
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3908
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2852
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1448
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1984
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1444
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2304
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4820
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3504
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1396
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1868
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2160
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2072
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3008
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2692
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        23⤵
        Executes dropped EXE
        
        PID:908
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        24⤵
        Executes dropped EXE
        
        PID:1368
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4084
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        26⤵
        Executes dropped EXE
        
        PID:3520
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4524
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        28⤵
        Executes dropped EXE
        
        PID:3124
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        29⤵
        Executes dropped EXE
        
        PID:2868
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        30⤵
        Executes dropped EXE
        
        PID:4320
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        31⤵
        Executes dropped EXE
        
        PID:640
        
        C:\Windows\SysWOW64\Ndkahnhh.exe
        
        C:\Windows\system32\Ndkahnhh.exe
        32⤵
        Executes dropped EXE
        
        PID:3028
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3572
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3824
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        35⤵
        Executes dropped EXE
        
        PID:4844
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4496
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        37⤵
        Executes dropped EXE
        
        PID:2860
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3416
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2916
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        40⤵
        Executes dropped EXE
        
        PID:2636
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        41⤵
        Executes dropped EXE
        
        PID:1200
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:60
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        43⤵
        Executes dropped EXE
        
        PID:1380
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        44⤵
        Executes dropped EXE
        
        PID:720
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        45⤵
        Executes dropped EXE
        
        PID:3836
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        46⤵
        Executes dropped EXE
        
        PID:396
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        47⤵
        Executes dropped EXE
        
        PID:1620
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        48⤵
        Executes dropped EXE
        
        PID:692
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        49⤵
        Executes dropped EXE
        
        PID:3004
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        50⤵
        Executes dropped EXE
        
        PID:4660
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        51⤵
        Executes dropped EXE
        
        PID:872
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        52⤵
        Executes dropped EXE
        
        PID:3860
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        53⤵
        Executes dropped EXE
        
        PID:1160
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3048
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        55⤵
        Executes dropped EXE
        
        PID:3268
        
        C:\Windows\SysWOW64\Pbddcoei.exe
        
        C:\Windows\system32\Pbddcoei.exe
        56⤵
        Executes dropped EXE
        
        PID:4432
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        57⤵
        Executes dropped EXE
        
        PID:2768
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1968
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:980
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        60⤵
        Executes dropped EXE
        
        PID:2964
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        61⤵
        Executes dropped EXE
        
        PID:436
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2176
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4968
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        64⤵
        Executes dropped EXE
        
        PID:2316
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        65⤵
        Executes dropped EXE
        
        PID:4208
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        66⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        67⤵
        Modifies registry class
        
        PID:2728
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        68⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        69⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        70⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        71⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        72⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1720
        
        C:\Windows\SysWOW64\Becifhfj.exe
        
        C:\Windows\system32\Becifhfj.exe
        74⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        75⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        76⤵
        Drops file in System32 directory
        
        PID:2340
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        77⤵
        Drops file in System32 directory
        
        PID:4768
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        78⤵
        Modifies registry class
        
        PID:4584
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2248
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        80⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        81⤵
        Modifies registry class
        
        PID:636
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        82⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        83⤵
        Modifies registry class
        
        PID:1048
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        84⤵
        Drops file in System32 directory
        
        PID:1312
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        85⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        86⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5232
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        88⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        89⤵
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        90⤵
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        91⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        92⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        93⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        94⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        95⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        96⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        97⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        98⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        99⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        100⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        101⤵
        Drops file in System32 directory
        
        PID:5820
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        102⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5904
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        104⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        105⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        106⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        107⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6132
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5176
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        110⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        111⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        112⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        113⤵
        Modifies registry class
        
        PID:5456
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        114⤵
        Modifies registry class
        
        PID:5520
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        115⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5596
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        116⤵
        Modifies registry class
        
        PID:5692
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        117⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        118⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        119⤵
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        120⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        121⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        122⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        123⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5340
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        125⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        126⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        127⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        128⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        129⤵
        Drops file in System32 directory
        
        PID:6060
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        130⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        131⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        132⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        133⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        134⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        135⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        136⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5200
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        137⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        138⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        139⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        140⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        141⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        142⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        143⤵
        Drops file in System32 directory
        
        PID:6404
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        144⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        145⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        146⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6580
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        148⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        149⤵
        Modifies registry class
        
        PID:6660
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        150⤵
        Modifies registry class
        
        PID:6700
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        151⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        152⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        153⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        154⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6908
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        156⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        157⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7028
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        159⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7080
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        160⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        161⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        162⤵
        Modifies registry class
        
        PID:6208
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        163⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6392
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        165⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        166⤵
        Modifies registry class
        
        PID:6544
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        167⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        168⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        169⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        170⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        171⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        172⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        173⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        174⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        175⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        176⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6472
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        178⤵
        Drops file in System32 directory
        
        PID:6632
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        179⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        180⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        181⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7072
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        183⤵
        Drops file in System32 directory
        
        PID:6240
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        184⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        185⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        186⤵
        Modifies registry class
        
        PID:6832
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        187⤵
        Drops file in System32 directory
        
        PID:7012
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        188⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        189⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        190⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6528
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        192⤵
        Modifies registry class
        
        PID:6804
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        193⤵
        Drops file in System32 directory
        
        PID:1964
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        194⤵
        Drops file in System32 directory
        
        PID:6892
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        195⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        196⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        197⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        198⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        199⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        200⤵
        Drops file in System32 directory
        
        PID:7408
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        201⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        202⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        203⤵
        Drops file in System32 directory
        
        PID:7532
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7564
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        205⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        206⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        207⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        208⤵
        Drops file in System32 directory
        
        PID:7752
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        209⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        210⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        211⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        212⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        213⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        214⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        215⤵
        Drops file in System32 directory
        
        PID:8036
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        216⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        217⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        218⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        219⤵
        Modifies registry class
        
        PID:8188
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7192
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        221⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        222⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7400
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        224⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        225⤵
        Modifies registry class
        
        PID:7512
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        226⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        227⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        228⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7816
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        230⤵
        Modifies registry class
        
        PID:7920
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        231⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        232⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8128
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8168
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        235⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        236⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        237⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        238⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        239⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7896
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        241⤵
        Drops file in System32 directory
        
        PID:7992
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        242⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7320
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        244⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        245⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        246⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        247⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6152
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        249⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        250⤵
        Drops file in System32 directory
        
        PID:8056
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        251⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        252⤵
        Modifies registry class
        
        PID:7188
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        253⤵
        Drops file in System32 directory
        
        PID:7232
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        254⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        255⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        256⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        257⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        258⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        259⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8484
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        261⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8524
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        262⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        263⤵
        Modifies registry class
        
        PID:8604
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        264⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        265⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        266⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        267⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        268⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        269⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        270⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        271⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8956
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        273⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        274⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        275⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        276⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        277⤵
        Drops file in System32 directory
        
        PID:9152
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9188
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        279⤵
        Drops file in System32 directory
        
        PID:8196
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        280⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        281⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        282⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        283⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        284⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        285⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        286⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        287⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8784
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        289⤵
        Modifies registry class
        
        PID:8876
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        290⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        291⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        292⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        293⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        294⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        295⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        296⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        297⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        298⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        299⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        300⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        301⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        302⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        303⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        304⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        305⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        306⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        307⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        308⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        309⤵
        Modifies registry class
        
        PID:8704
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        310⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        311⤵
        Modifies registry class
        
        PID:9212
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        312⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        313⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        314⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7652
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        315⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9272
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        317⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        318⤵
        Drops file in System32 directory
        
        PID:9352
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        319⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        320⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        321⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        322⤵
        Modifies registry class
        
        PID:9520
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        323⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        324⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        325⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9676
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        327⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        328⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9796
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        330⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        331⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9924
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        333⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        334⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10068
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        336⤵
        Drops file in System32 directory
        
        PID:10124
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        337⤵
        Modifies registry class
        
        PID:10168
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        338⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        339⤵
        Drops file in System32 directory
        
        PID:8240
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        340⤵
        Modifies registry class
        
        PID:9280
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        341⤵
        Drops file in System32 directory
        
        PID:9360
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        342⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        343⤵
        Drops file in System32 directory
        
        PID:9500
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        344⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        345⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        346⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        347⤵
        Modifies registry class
        
        PID:9748
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        348⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        349⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        350⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10016
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        352⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        353⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        354⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        355⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        356⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9388
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9504
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        358⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        359⤵
        Modifies registry class
        
        PID:9732
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        360⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        361⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        362⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        363⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9392
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        365⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        366⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        367⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        368⤵
        Modifies registry class
        
        PID:10148
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        369⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        370⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        371⤵
        Modifies registry class
        
        PID:10164
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        372⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        373⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        374⤵
        Drops file in System32 directory
        
        PID:10056
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        375⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        376⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10316
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        378⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        379⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        380⤵
        Drops file in System32 directory
        
        PID:10448
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        381⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        382⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        383⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        384⤵
        Drops file in System32 directory
        
        PID:10644
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        385⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        386⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        387⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10752
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        388⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        389⤵
        Drops file in System32 directory
        
        PID:10848
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        390⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        391⤵
        Drops file in System32 directory
        
        PID:10928
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        392⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        393⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        394⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        395⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        396⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        397⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        398⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        399⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11236
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        400⤵
        Modifies registry class
        
        PID:9596
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        401⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        402⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        403⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10544
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        405⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        406⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        407⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        408⤵
        Modifies registry class
        
        PID:10796
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        409⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10912
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        410⤵
        Drops file in System32 directory
        
        PID:11000
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        411⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11088
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        412⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        413⤵
        Modifies registry class
        
        PID:10372
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        414⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        415⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        416⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        417⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        418⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        419⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        420⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        421⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        422⤵
        Drops file in System32 directory
        
        PID:11128
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        423⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        424⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10340
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        425⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        426⤵
        Drops file in System32 directory
        
        PID:10828
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        427⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        428⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        429⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        430⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:11048
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        431⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        432⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        433⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        434⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11276
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        435⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11312
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        436⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        437⤵
        Drops file in System32 directory
        
        PID:11392
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        438⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        439⤵
        Modifies registry class
        
        PID:11476
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        440⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11516
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        441⤵
        Drops file in System32 directory
        
        PID:11552
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        442⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        443⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        444⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        445⤵
        
        PID:11708
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        446⤵
        
        PID:11744
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        447⤵
        Drops file in System32 directory
        
        PID:11780
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        448⤵
        Modifies registry class
        
        PID:11820
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        449⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11860
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        450⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11896
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        451⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11940
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        452⤵
        
        PID:11984
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        453⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        454⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        455⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        456⤵
        
        PID:12136
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        457⤵
        Drops file in System32 directory
        
        PID:12176
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        458⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12216
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        459⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:12260
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        460⤵
        
        PID:11296
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        461⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        462⤵
        
        PID:11456
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        463⤵
        
        PID:11532
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        464⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        465⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        466⤵
        Modifies registry class
        
        PID:11732
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        467⤵
        Modifies registry class
        
        PID:11812
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        468⤵
        Drops file in System32 directory
        
        PID:11884
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        469⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        470⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        471⤵
        Drops file in System32 directory
        
        PID:5424
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        472⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        473⤵
        Drops file in System32 directory
        
        PID:12204
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        474⤵
        Modifies registry class
        
        PID:11268
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        475⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        476⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        477⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        478⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        479⤵
        
        PID:11920
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        480⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        481⤵
        Modifies registry class
        
        PID:12124
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        482⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12252
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        483⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11496
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        484⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        485⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        486⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        487⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        488⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11740 -s 396
        489⤵
        Program crash
        
        PID:11980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 11740 -ip 11740
1⤵
PID:12244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Anogiicl.exe

Filesize
165KB

MD5
c01d29058362f37c2a9dcb3a373a7d0b

SHA1
32b5913a46af48fd3aebc9293c0e92d23561f628

SHA256
c874f13ad6d08df99f7fb7ff6c32042e9e20c102cd796660776c37ac80925e4b

SHA512
9ebfdbe49d8c3808b0ff770a5c8f21b258fe36724a67906e1f576d269c914c323962ad97dfc87f9a429069c5f34ada4d930389fe5881bdb9ab2dd6cf47cb73cc

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
165KB

MD5
3969c9fc80de65574490a008cdebc1e8

SHA1
80e6e9a40e073be0ce27ac381c45977caa8e0efc

SHA256
48ee5e65628cc98572e5ca626e0cce4adc0e66610869446bf02639b43929b695

SHA512
8d481d9a73f77525035362756b3521f53c60abc25d8ad43ba64c4fb73a31ca5d6ca8560bbc4455c8d74e54844e469d4fbc7b03fcec9ef1ad8fd2589581eac111

Download Submit
C:\Windows\SysWOW64\Cnffqf32.exe

Filesize
165KB

MD5
9e8cfb6dfae13c459ee60d8f7fd497b2

SHA1
23b9dbfd4ffaae689c3b1bbe888d0e56b5d2a832

SHA256
e7daa2bf258438006398beaf9fcf7dc29a2b456c2cbf5d69658f205367f31574

SHA512
32acc89fa13ee12b8dcf252cd170e78fe4e58ddea5c3e4dfa36a0ae177b8c6d437585bdd1052f13489cd3710673ac94ab0fc9c97606c7151ad7970e160ed836f

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
165KB

MD5
470a3fcfcc3f9ee3b4ca1e5840192905

SHA1
7aa02a2bfc26e16c8ce61d09ce70e196a67c9d59

SHA256
bc6ee8d11c629b72050be3fa131474c67884d062e7ce9ad8846e0f825d44a471

SHA512
3b3790f0769beb48a4949e372003b2a07036c87d8c23e9e16c872ed6733186d063b6269a231708d299b032a40dbcda62f11db4af70d1b3a6869526754b774550

Download Submit
C:\Windows\SysWOW64\Fdialn32.exe

Filesize
165KB

MD5
0aff2af7579d95f0795173dbfe5cb2f2

SHA1
1c88a8a17cbf9a1103f153fb556e7a6b22cfd93b

SHA256
dc0679edfba8e45664d91e0f5b3e264628e9353a9d884f5f9fa217ac82a0a8c8

SHA512
146e38f86a8754dbf3e7a5909d4d71e672ad263d9963b720245fd432cf5853fad65fc7c31b62d836e0c6a0f4acb17dd7178d26ea79c7b0370bdac08b7539289c

Download Submit
C:\Windows\SysWOW64\Iehfdi32.exe

Filesize
165KB

MD5
d3d4f52d93af6d483c9158ef90bc8019

SHA1
c363ea379565569ce7564341ea9098dce477e8a7

SHA256
72fc6c128b47509dcf797df95f1b124aca7f9a2f0b560477310536027be61e4f

SHA512
97c5e5f6dc7de00c1e3f3d206ac6e36ab660c3e0ceb27fd6f8b02a9d52c29de3adfccb03152eeb8cc937ed4965b2e84028d0a6531f511e86b93690e5b5231b8a

Download Submit
C:\Windows\SysWOW64\Laciofpa.exe

Filesize
165KB

MD5
150156225c07ac9e98d55bb618c1edf6

SHA1
85384b7ce0a12b1777efc939462772c8a829e467

SHA256
82b45d78b4dec2dc4395ac48d601fb8b2c973378b843e292e9bc23d28696ee99

SHA512
b8bb79b7e1ec8880b2a26761285af40f8597dc3bf205dff1f0ddee0780b5827e45814f92054e445ff8b02ceced57483e85d60fc17bf5678a4f81932370ee71ed

Download Submit
C:\Windows\SysWOW64\Lgbnmm32.exe

Filesize
165KB

MD5
a5ffe12814efdc328564602600cdffeb

SHA1
ab0ecbeb2f33fc63bad88eed4c1f3bf14441db02

SHA256
ad5a47974a2918ef72730daacc220f35d24c696e809556eb4b8e145312a8698d

SHA512
90cb032f5dd79e6e12b413f56956f5e636a22954bc3025ef9db9ef1d69cfe4fe316928a91fa3452dbd05ff8cdc946dee12fadbe4d8ae0ff2596e28dda8e4c703

Download Submit
C:\Windows\SysWOW64\Lgpagm32.exe

Filesize
165KB

MD5
edbe5039580750bbd3fbed5a8c7171d5

SHA1
3f16435e6012abda52f7582e6c72fdb1b51eeefb

SHA256
7f0648ed1cc7e78b4432bb8e1fc8fdac52f87b5dc8214e2cb60cf522bff60ef2

SHA512
04aff99e85906087aaf8b01238d58bdf7a90dd3120e1ef4a4f948935fe9cece93ab1afbb1f1517bc970f094e12e1c3c3ea3ea963d0dfd1e7b4639296fb0d2e0b

Download Submit
C:\Windows\SysWOW64\Lkiqbl32.exe

Filesize
165KB

MD5
0c41500a7e1a8c44f347ac3b6a1ee82f

SHA1
67e0ba3a15cb4c358e48840f5f0b5f46327f9598

SHA256
eda9ea331aded46145e5f60608e22cd8713c20b4d03826f206aecf21ec562e8f

SHA512
24c5cb02856c904b6d5c32f6feaad0a06b0980de0b3efa1fa459baed16511e5792695da07e2d6649b7d114db4170b1eb39d71dfcd23b0ed0858c3d6c03ca2933

Download Submit
C:\Windows\SysWOW64\Lnjjdgee.exe

Filesize
165KB

MD5
10109e53c7af093fee1e7ca21b77e182

SHA1
39cbc9bca473f39040f4d44dd0a935ac88ddc8c1

SHA256
7791728c6242d440eb1eb26596a80fe47c87ff2eba3ee88d824e2347ae3414e1

SHA512
c9d326795d72f6d3d8f3e2909b6015265554da1724bfde5fa938b3e9b41943aa31a309de58ea6abba513a1b2b42979c8a2480a1febffc60fc196c7685cb04bd2

Download Submit
C:\Windows\SysWOW64\Lphfpbdi.exe

Filesize
165KB

MD5
de83c90de28a29abdfda01729d4ca2f9

SHA1
12a5b3526af87be44928276af6e021be10f2f522

SHA256
8681616d2debd5a6680e5760df7fb6502e229c1c014edf3ca5e1fb42974cf745

SHA512
cd485128a74da43dc63e91cdbd9ec180965522688f100be049ed69c910d002882c3faddc987f08f68c24b6b72daef27d9c923bd75350495f334169ae7fba8dbd

Download Submit
C:\Windows\SysWOW64\Mahbje32.exe

Filesize
165KB

MD5
b4226328f5d4519c9d45a3509750b901

SHA1
3505d45f8eb75a062b9a8b56a2d70a74bba833de

SHA256
738e4e3e5f6aec7e4d735a0d74e78d9bf25ffc334f4e92a1b3f65ace2edeff92

SHA512
9bbc093a3df88b2aa448f3d219778ff433705b1613289ea414c60071529ff24716ecaf13f8c35f537d0d06fd34516eb997f6cce6f1a6e5aafb144e151c5eb4b9

Download Submit
C:\Windows\SysWOW64\Maohkd32.exe

Filesize
165KB

MD5
5d6c99e877e91f85ba77bbf510c196fc

SHA1
8c0320c9534375784b381cf098a292a6761b6d31

SHA256
375270f3400df96eadcd6c05431470a011088e92f33bc8140134c8271ae51141

SHA512
4f7222b14793f5191e71b3390b1735c07d3deebd14814994f6a7d39386b732b24e92d457383f057cf015da6369af66c2dea9db32e25f4a5ffbb286fbc7f8e9f5

Download Submit
C:\Windows\SysWOW64\Mbfkbhpa.exe

Filesize
165KB

MD5
6829c8fe59833b053fc9f9040f79fa25

SHA1
a024ff75cbaf68086eff3c6b43c63d306e3d27e2

SHA256
a2641b71628de846eebbb3ae36212b680fec0e0b014a86d4df21a1347589f9bb

SHA512
54c0457e049a1d2fba0c4365d58f198273b9206d0a5ab0994943edabd1960f5a4d945f8a666c0669e35b3d61c492e781e3676a2520df4f9f803f6e868f504986

Download Submit
C:\Windows\SysWOW64\Mcbahlip.exe

Filesize
165KB

MD5
c1bff7b582cf4e9f1569af2daa3be80b

SHA1
9255ec15a44ae2de5d1ad82748d8c0aac7f8be6e

SHA256
5bc6110859b1d93181d71b75036bc38093d250a3b38d333078cda08ec8cfb7c5

SHA512
0939d0b943223528c088e374e555de3986280310b81d45499b47af01461d38fb42dcd8837354f915ce728822c54ea7004b1c20166de55b2f2bd81ccd96b8edf8

Download Submit
C:\Windows\SysWOW64\Mcklgm32.exe

Filesize
165KB

MD5
0c0097156467de92279bd177a4ab8ab9

SHA1
e400f261691cd702b2a836d71eb179336333fadc

SHA256
7c819ee13718d6fdd8d88cf3497c7e698a06119d2dac027fce3ace9db716e9a9

SHA512
bed5f8f15e07f025a1618fc04f47ac12c2d6368c01d8e2e348e7c50adedf8c15506612cbe99fbd55cc4577b812c0b67b7e1559c73bfeafb7bedc699865f340c8

Download Submit
C:\Windows\SysWOW64\Mcnhmm32.exe

Filesize
165KB

MD5
e90d9c0aaf8857173a7f56286a4b2aa6

SHA1
4b02be752eda46b19c27255931c8bad0f9e0a21d

SHA256
37625e3b6d4c22d0b4370979ffdaa3a4e9488897c999b6adcd1eb2a847dc9484

SHA512
9ae740b1a3a9e14663723aa141ce29784ef2930310914c04482b47cc0c2486ac6b7d663e067bb7a11815f517a897bc7589754c697d9fec2857bf00ed9d807420

Download Submit
C:\Windows\SysWOW64\Mcpebmkb.exe

Filesize
165KB

MD5
e1c0b12f0990c5980d1713f4af7f6ad4

SHA1
3250a2d2d3cedae000668c01e8abda08dd6b19e8

SHA256
5092551e263a06c3a7d9cb885013e93ece43ff2ccb5c3e12d76ac27fa41c53d7

SHA512
a66b66b00f77e6b56b65167834a256284df0767fa69b976d02c28cd4a0f3e89f241dad61cc8b303ba8983e83a6b3df70d55e91f1ef617e5353029d7a2291c437

Download Submit
C:\Windows\SysWOW64\Mdfofakp.exe

Filesize
165KB

MD5
273b99421d32b7fbf4f0eda01bf68321

SHA1
2f2db78dac2ca762e3b7898ac755ff1194289d14

SHA256
1ec8313c954e1e4bd95174925f9141b0a8a5cec0776ae9fb1deec4b40d70e509

SHA512
9318b5665693a6ef057b6949788a049ab816d869209feca080eaa6ec90be8ea93c33c4af5cbca2eff1be660fb61d502fe92e1eb09deaa9f86ef89d2226c74b00

Download Submit
C:\Windows\SysWOW64\Mgekbljc.exe

Filesize
165KB

MD5
33d02f677dbba59a8aafa27838f818fe

SHA1
a7c2ea3926ef1594bbe8411570725bc19639f66c

SHA256
5bf304a7e1b60c98325b7f2ad79e84a83dbf1b50cc1a73cea01e68bd6147c992

SHA512
d646596a1943cc22a99e2f826fabc296b15f2911f0f9f49d089b0d19901ed196b0a3ecebef7b526657e5199da6fc0168692f6c450e00566a4c58ab7f32dc49cf

Download Submit
C:\Windows\SysWOW64\Mgghhlhq.exe

Filesize
165KB

MD5
b0e478555e4e0c03fa47948ccf8da1d0

SHA1
43c12030e86b23dd778a7913ec262b7e4137b97f

SHA256
5c62b29fcd9c0268b1d572c3cec1ab2580f58e6fc07ce060fedd9db643f02050

SHA512
bb5705357562352989dd3b7f7faa96046accd8231811e99d0778f72dd2425530c9b4c8e8bcd96da9e10a4147b2dccd84d31926cdaea2d37fefc6f322a3e2127f

Download Submit
C:\Windows\SysWOW64\Mjhqjg32.exe

Filesize
165KB

MD5
a5b2438c60629d6cd152815077df155c

SHA1
e75cdb6418bab1a4fe30619bebdf7097ada2a434

SHA256
39cd60894b723859d84c351982d914ea61b36ff83412b68b1f0958c736bc3d9e

SHA512
887da271c1d49a39d50f24c84cd8f1f17ccade370948002f2b96acc8d973b9581145279c0b2de46bfb3f55e3c5cc4e7f47a52a702e738dce48016a58ae6c6eed

Download Submit
C:\Windows\SysWOW64\Mkepnjng.exe

Filesize
165KB

MD5
74b32c67c5ab842f08b991b5d7d5b269

SHA1
263e7a74a86364b1e95d0a58fe1ec3fae4606e39

SHA256
49a600d3fe694fc96931089c6868847e23c0d892784e774802b0c1620de81583

SHA512
0bc5fd2d2482b0de3c4dfc74dc01e06f43122cba256f5782daf8ed23bd0dcacf48698b17701eac465b5ff7930516cda69055da89a01efc4a29fb90bd6bb4ddcc

Download Submit
C:\Windows\SysWOW64\Mnapdf32.exe

Filesize
165KB

MD5
1f8854d0d262ec7e096ad69bdf965df6

SHA1
0b225584cd6136930ecfb1b4aee7996ac42cef14

SHA256
74af1bf7932c4941feb55dd5c0f4a52c73de12f0dd1c7141bbc2d63378e0b0a3

SHA512
625fe4ed0aafb289bf35cd410a3efec35001c4405eb6f1ca1b7bfc3b1ea12c466ecbdd7d817a771b161aefa01c242c3de9e9d00f6381ade2209394de2cf8c33f

Download Submit
C:\Windows\SysWOW64\Mnfipekh.exe

Filesize
165KB

MD5
b16cd68055ea3ca8766fe5b762cdbb1d

SHA1
39f6bfa0a49472ff98302518cf2a78370afa4fa5

SHA256
de4c6de636e7dbd81cc4795d5040ae010496e1574b9d051d941b4f632ed40e02

SHA512
1bbb87c3932f0e909f4d3582759493464b259637f43992979234607cfdf9d8b5ea5c02668d0e64718b0f665ce72941a151266b3ff4c0aa96ba4e6bb28af537c2

Download Submit
C:\Windows\SysWOW64\Mpmokb32.exe

Filesize
165KB

MD5
59aad60b7df0f06cb702662dbc8f2dda

SHA1
f1f203d86f50063ebcaf44cd8d8d6a93c1e12dbf

SHA256
a088ef94a782218e02cad2390b3ee865692c7e72562ea966e79c044f81ca31b5

SHA512
8c65dec78801a0f85ab67376bac3424588b61e6d0fe3f5d490988c729651279dfc3527a58d06dbac1ef855ef1ce00e70633d091bbfb3d0318442a080180770bb

Download Submit
C:\Windows\SysWOW64\Nceonl32.exe

Filesize
165KB

MD5
5e226d47783c44d65efbc406d4d71839

SHA1
767a6b1c59145c4958b051bddade734375f32968

SHA256
b3549c53c5564639cfefa22339f8d72fad31d4177c7ab90b49188fd9500ba801

SHA512
30ab2d986ed90aadf695bef30129f6290046bd2abdb21f36cc9e40316f4e6c970e205b613cea5ef7a82ad8ff3c99126efdcbe843bf6ce8d9e2928cb583f4a2e7

Download Submit
C:\Windows\SysWOW64\Ncldnkae.exe

Filesize
165KB

MD5
465ea378f52229502d1e2983eea75303

SHA1
097383e5d99b08c2b5c8fd045c8318dfb0e11515

SHA256
47cf945fd4ba7685dc8344d83a41ef410624cabeac12fbc7c38bcf937ec830b4

SHA512
e99b99107bdcd0ee11f42c4e0325b199f9ae0fcb2aa7fe493dbba2ad42bc7b0683575c21cdc935dfe981aa6dc5e6d6ee3bfca23c9c86b4f2722e23b8ac972a9e

Download Submit
C:\Windows\SysWOW64\Ndghmo32.exe

Filesize
165KB

MD5
ff205524514e9452be928dca4c9d2069

SHA1
820ec678e4637c7ac1c4b8d3ba410b06a41f96d1

SHA256
5fee19444a30dd9341d54ac6263341b6c5e5b3003991055237d2d2f53717d5b0

SHA512
ac00d1a3336862b1d92ebd049ff20927045bfecee88b69b88d36c6e81fe34972672053c53aab86d825e78cddfe92486d87efe8db05873cad3e33b63bc3bcedf8

Download Submit
C:\Windows\SysWOW64\Ndkahnhh.exe

Filesize
165KB

MD5
03ae31a7188e3c1870cf7e3cf4d7e9fc

SHA1
d5d98c2ed3b464aa3c26c1631b93682874fa2534

SHA256
da3b044459c55b383ba14fedd863affa0c10b06c90d3f07f749b130b95e366b5

SHA512
f5e7bd4fd077ebe387113704d31f78028dbd3f38bd63815290585cd128e97b74a3ee4ce20a5d9789eb1a525644cc3f36851cfde921ddbc353c92315d6b670156

Download Submit
C:\Windows\SysWOW64\Ngedij32.exe

Filesize
165KB

MD5
c3afba90cb3b714d40bdfc17b07f1e72

SHA1
fac3db91feec555a71f2a189e5c77e17da30134b

SHA256
663b00b9112fb2322ceb0d31ec7c159f65a997618b5870628402f7d1ff82a696

SHA512
fdcea50f149e91f496f6ba7d6dea3228e8c18cb045e2aef57d010f1f0e7a0f664072cf2d4d1f0466a2b9f5f24b663d4badfa412b87dcff2c4d8de7b3687c8980

Download Submit
C:\Windows\SysWOW64\Nggqoj32.exe

Filesize
165KB

MD5
243d586773f314e2d44c16754c41624f

SHA1
4643eddca304c511456c3f166907586006517e9f

SHA256
d430788a7ee8707b80d21ebd4958d1359826b4d610c4da17fea157b5f824c8f3

SHA512
4d486972a26ba41c43bb46f8c03027cfc01072b2d43761654c6a351ab966790e20bf440c2cb95a073c5c3e3b204819a4fd3e4d0459898181ba4b2629f560bc48

Download Submit
C:\Windows\SysWOW64\Njcpee32.exe

Filesize
165KB

MD5
a22f70f55a474ef737f122cbe5e247b3

SHA1
1b9aeb485e46ce5e7782e6cde24fb6ee4aa21370

SHA256
381b65df5b832319a9535b1cfaad26d35c9687baceeae99fc9be7a522f068f91

SHA512
968205b74b7eb7d496c3e0f47fb10e95d8e23d1c994c8222ccc5c1e8e6b2361a4270ebb1477586abebbdf263adf53bddc02307406c913f2d923100e8de177849

Download Submit
C:\Windows\SysWOW64\Nkjjij32.exe

Filesize
165KB

MD5
53291ac19488d95495e2276d2c4194f8

SHA1
fd6da638de33c34d093fc7bec38d545efad3bb0a

SHA256
2972a14f13c75547000e9b2a916efd3bfa6fe85447494d9cdbebefd487dd616a

SHA512
8e23afe9232f736babc1d26b755fc7712978acca2e13194d65fe6053ba7a5a5730ccec9145a282216749c57fe6f6d98bf644b327aeae84a3c3e7f245b5d17edf

Download Submit
C:\Windows\SysWOW64\Nklfoi32.exe

Filesize
165KB

MD5
6443933ae4591ffe6469238d3bc7fb8e

SHA1
e484f6bbf42c691a9e24dece97b5567c409ee032

SHA256
a22ba663ded4ffb0562ed7e03489770227d8de9521b583d02b8356d710eaa764

SHA512
d69827ebfd411cb8a2337619e3f2ab3cef10e1ae3de75722113876def8ea6f8305ad0fe587e2bc1888e865718b5a34fa7ff78d76a03c626f2b4f4316f2d7d1ae

Download Submit
C:\Windows\SysWOW64\Nnmopdep.exe

Filesize
165KB

MD5
7fad14d2d4cfc526b104a26142e08223

SHA1
6410e0581e72ed4c97d805e1a2fedb64682c8feb

SHA256
c373ff72497c74241500603819528b844b1cb794d4f026379b8710de03ba5cfa

SHA512
43c5d88399e313c17774de6dbbece382421d49faca7687afcfde97c1c9b8d0bf7c11c664f2c030108731a365042d8fb27bd136a0cd880041f1dc6eaa8ced483c

Download Submit
C:\Windows\SysWOW64\Nqfbaq32.exe

Filesize
165KB

MD5
f7120dc91ee1edf2832b9b43e0568e07

SHA1
eb7a5099507aa541950e23ab169ecc7919ce1a55

SHA256
da0c48a39a67e10a77f58e77bb04608fb037291c5e4ded9b2ad42b68d67865a3

SHA512
74573899bd30ebd90a018465e6e26c92fc81141190ea46650b9c8c6495094d803e62b02e0af30c7166abbc331b15943ba9986fd2d5d571a2c4a5a0a3a04c55ad

Download Submit
C:\Windows\SysWOW64\Ogjmdigk.exe

Filesize
165KB

MD5
e7016a66a8edc70e56fd259e4b95f6dd

SHA1
ed23077a2be0a98304613e3986c0c490765ca83e

SHA256
28f66bea05458bb68d4275df6a9d187630ee30393bb6662c0feb59c58351f484

SHA512
d08e7603fcf2b7d01ef3f69777237441cae5636c9f4a1216fd8af94e33c2479b26b0acc490d921051e597eb3581a28a06b4fd69ba7c1dab9bc2ed4e2b52d95dc

Download Submit
C:\Windows\SysWOW64\Pfhfan32.exe

Filesize
165KB

MD5
96919312770336055377b497f56dda8d

SHA1
0d5cc2ccc0e5516fe5f7534b250592b196c376d5

SHA256
d27862015d82ef02b4b1e9bab0b2395a1feb39539fd0bf2148f455a67ec81982

SHA512
a588655dc2831080e9f5ab9f9ae13f00f8aa23d5d0146ed7454b758518deacb5e63fc50cd9a19ecdfe96e8743b0cce8d7fa33c360a3f8876f0985448d8ac9756

Download Submit
C:\Windows\SysWOW64\Pmoahijl.exe

Filesize
165KB

MD5
779e94dbf911eef03ed065f76a5d843a

SHA1
24c2b7e8b7145c932077a468a2707ed44e319dcb

SHA256
a6878d9bc4532290bce57da96d8001cdd3beb2647f6bcb3989b0274c807ae3f2

SHA512
72b73467217713f4686b8ef69d150dfdeb77c4df1605160e211e01691b0fe3a06eed79ad60b7a904ebb51a497e3a13047cffb0d95d44339e7a0fbda5aabb95b4

Download Submit
memory/60-307-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/396-327-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/436-416-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/640-237-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/692-339-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/720-315-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/872-361-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/908-215-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/980-408-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1040-479-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1160-369-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1200-302-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1380-309-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1396-140-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1448-100-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1620-333-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1652-17-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1720-487-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1732-481-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1968-398-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1984-92-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2072-168-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2160-156-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2176-426-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2304-148-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2316-434-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2384-12-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2608-463-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2692-195-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2728-451-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2744-126-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2768-392-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2852-69-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2860-274-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2876-46-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2916-286-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2964-410-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3004-345-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3008-194-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3048-375-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3268-381-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3416-285-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3504-136-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3572-250-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3672-241-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3672-5-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3672-0-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3824-256-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3836-321-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3860-367-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3908-56-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4072-66-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4084-186-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4208-440-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4308-25-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4320-232-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4496-268-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4508-457-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4524-247-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4640-469-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4660-351-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4844-266-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4940-40-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4968-433-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads