67aba589f139d4d4699f3aa6fc8641cb2150ef10cbe27ede842c04a0e609dbee

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 16:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

67aba589f139d4d4699f3aa6fc8641cb2150ef10cbe27ede842c04a0e609dbee.exe
Size

55KB
MD5

200f0ff93413feadc59cd0aa7243ede6
SHA1

84911cd5f86d60644df5b5b5ad1d2e377ff1d609
SHA256

67aba589f139d4d4699f3aa6fc8641cb2150ef10cbe27ede842c04a0e609dbee
SHA512

a53870875a8b5bbe65f5f9fd19e445aacda63861590f37aa7c73411f82c99013ab525a9c32edfc90139776f598b3032233e54faf6db4e9568432a8652049240b
SSDEEP

768:kzB38uVFmcKKCuATXVkfN25VxyyEmh1dN54zZ/Zufqb72mJE06b0h2p/1H5SXdnh:Q9DVdKKcWFnE54zZ/ZwIJ6Ah2LG

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onjegled.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqgkhnjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pndohaqe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fohoigfh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gblngpbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogifjcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bahmfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dahode32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifefimom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icifbang.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edkdkplj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gofkje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ffddka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Helfik32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmgfda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pncgmkmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhnnep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odkjng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Olfobjbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mckemg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdpmpdbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odednmpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffgqqaip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odapnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckedalaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcioiood.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bajjli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbabgh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmkjkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Balpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fljcmlfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeklag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpeiioac.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocpgod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkciihgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npfkgjdn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njfmke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgemphmn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bblckl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckcgkldl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llcpoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anbkio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Colffknh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dahode32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iikhfg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laciofpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pndohaqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kibgmdcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpablkhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Olcbmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkncdifl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anbkio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cogmkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbbkaako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdehlk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cabfga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dboigi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkoiefmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ippggbck.exe

Executes dropped EXE 64 IoCs

pid	Process
3788	Liekmj32.exe
1556	Lpocjdld.exe
3232	Lkdggmlj.exe
4112	Lmccchkn.exe
2972	Lpappc32.exe
1456	Lkgdml32.exe
4512	Laalifad.exe
1648	Lcbiao32.exe
396	Lkiqbl32.exe
3360	Laciofpa.exe
4880	Ldaeka32.exe
1356	Lklnhlfb.exe
752	Lnjjdgee.exe
2908	Lphfpbdi.exe
4408	Lknjmkdo.exe
4936	Mnlfigcc.exe
3132	Mdfofakp.exe
4620	Mkpgck32.exe
3208	Mnocof32.exe
2696	Mdiklqhm.exe
2336	Mcklgm32.exe
3732	Mjeddggd.exe
3556	Mpolqa32.exe
3228	Mcnhmm32.exe
3480	Mjhqjg32.exe
3580	Mdmegp32.exe
876	Mglack32.exe
1348	Mnfipekh.exe
1952	Mdpalp32.exe
4876	Mgnnhk32.exe
2548	Nnhfee32.exe
1212	Nceonl32.exe
1596	Nafokcol.exe
3164	Nddkgonp.exe
516	Nkncdifl.exe
5112	Nnmopdep.exe
3304	Ncihikcg.exe
3268	Nkqpjidj.exe
4444	Nbkhfc32.exe
2200	Ndidbn32.exe
1232	Ncldnkae.exe
3156	Njfmke32.exe
2668	Nbmelbid.exe
220	Ndkahnhh.exe
212	Ogjmdigk.exe
2364	Ojhiqefo.exe
1532	Oboaabga.exe
468	Odnnnnfe.exe
3332	Okhfjh32.exe
4344	Onfbfc32.exe
796	Obangb32.exe
3184	Odpjcm32.exe
2384	Ogogoi32.exe
3196	Onholckc.exe
1068	Oqgkhnjf.exe
1236	Ocegdjij.exe
4356	Onklabip.exe
4520	Obfhba32.exe
2740	Odednmpm.exe
848	Ocgdji32.exe
392	Ojalgcnd.exe
2716	Obidhaog.exe
3844	Pgemphmn.exe
4372	Pkaiqf32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Alhhhcal.exe	Aacckjaf.exe
File created	C:\Windows\SysWOW64\Kfankifm.exe	Klljnp32.exe
File created	C:\Windows\SysWOW64\Hgaoidec.dll	Pfaigm32.exe
File opened for modification	C:\Windows\SysWOW64\Mpolqa32.exe	Mjeddggd.exe
File created	C:\Windows\SysWOW64\Cagecd32.dll	Pkfblfab.exe
File created	C:\Windows\SysWOW64\Aipoal32.dll	Ekacmjgl.exe
File opened for modification	C:\Windows\SysWOW64\Fooeif32.exe	Fkciihgg.exe
File created	C:\Windows\SysWOW64\Gmlhii32.exe	Gdeqhl32.exe
File opened for modification	C:\Windows\SysWOW64\Gicinj32.exe	Gfembo32.exe
File opened for modification	C:\Windows\SysWOW64\Jedeph32.exe	Jcbihpel.exe
File created	C:\Windows\SysWOW64\Njciko32.exe	Ndfqbhia.exe
File opened for modification	C:\Windows\SysWOW64\Njfmke32.exe	Ncldnkae.exe
File opened for modification	C:\Windows\SysWOW64\Ahkobekf.exe	Acocaf32.exe
File opened for modification	C:\Windows\SysWOW64\Bjddphlq.exe	Bgehcmmm.exe
File created	C:\Windows\SysWOW64\Chagok32.exe	Ceckcp32.exe
File opened for modification	C:\Windows\SysWOW64\Ndaggimg.exe	Npfkgjdn.exe
File created	C:\Windows\SysWOW64\Dhbgqohi.exe	Dedkdcie.exe
File created	C:\Windows\SysWOW64\Edkdkplj.exe	Eeidoc32.exe
File created	C:\Windows\SysWOW64\Jedeph32.exe	Jcbihpel.exe
File opened for modification	C:\Windows\SysWOW64\Mlampmdo.exe	Mibpda32.exe
File opened for modification	C:\Windows\SysWOW64\Nebdoa32.exe	Ncdgcf32.exe
File opened for modification	C:\Windows\SysWOW64\Odmgcgbi.exe	Olfobjbg.exe
File created	C:\Windows\SysWOW64\Lcjakp32.dll	Acmflf32.exe
File opened for modification	C:\Windows\SysWOW64\Bjpaooda.exe	Bhaebcen.exe
File created	C:\Windows\SysWOW64\Igjnojdk.dll	Pcijeb32.exe
File created	C:\Windows\SysWOW64\Ncldnkae.exe	Ndidbn32.exe
File opened for modification	C:\Windows\SysWOW64\Ndkahnhh.exe	Nbmelbid.exe
File opened for modification	C:\Windows\SysWOW64\Ojalgcnd.exe	Ocgdji32.exe
File created	C:\Windows\SysWOW64\Mipaiqmd.dll	Qloebdig.exe
File created	C:\Windows\SysWOW64\Jeklag32.exe	Jcioiood.exe
File created	C:\Windows\SysWOW64\Ehmdjdgk.dll	Ajanck32.exe
File created	C:\Windows\SysWOW64\Jnngob32.dll	Lphfpbdi.exe
File opened for modification	C:\Windows\SysWOW64\Mgnnhk32.exe	Mdpalp32.exe
File opened for modification	C:\Windows\SysWOW64\Afmhck32.exe	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Kiljkifg.dll	Mpoefk32.exe
File created	C:\Windows\SysWOW64\Higchddh.dll	Dahode32.exe
File created	C:\Windows\SysWOW64\Ekacmjgl.exe	Dhbgqohi.exe
File opened for modification	C:\Windows\SysWOW64\Dbaemi32.exe	Dboigi32.exe
File created	C:\Windows\SysWOW64\Dhnnep32.exe	Deoaid32.exe
File opened for modification	C:\Windows\SysWOW64\Ekacmjgl.exe	Dhbgqohi.exe
File opened for modification	C:\Windows\SysWOW64\Fllpbldb.exe	Fdegandp.exe
File opened for modification	C:\Windows\SysWOW64\Kemhff32.exe	Kboljk32.exe
File opened for modification	C:\Windows\SysWOW64\Miifeq32.exe	Menjdbgj.exe
File opened for modification	C:\Windows\SysWOW64\Ldaeka32.exe	Laciofpa.exe
File created	C:\Windows\SysWOW64\Jccejahl.dll	Qajadlja.exe
File opened for modification	C:\Windows\SysWOW64\Ddmaok32.exe	Dmcibama.exe
File created	C:\Windows\SysWOW64\Qeobam32.dll	Qgcbgo32.exe
File created	C:\Windows\SysWOW64\Mglncdoj.dll	Aeniabfd.exe
File created	C:\Windows\SysWOW64\Llcpoo32.exe	Lmppcbjd.exe
File created	C:\Windows\SysWOW64\Jcjpfk32.dll	Lbabgh32.exe
File created	C:\Windows\SysWOW64\Ecaobgnf.dll	Mmlpoqpg.exe
File opened for modification	C:\Windows\SysWOW64\Ddakjkqi.exe	Daconoae.exe
File created	C:\Windows\SysWOW64\Aanjpk32.exe	Abkjdnoa.exe
File created	C:\Windows\SysWOW64\Icplcpgo.exe	Iikhfg32.exe
File created	C:\Windows\SysWOW64\Lmldgi32.dll	Iehfdi32.exe
File created	C:\Windows\SysWOW64\Abckpb32.dll	Jmhale32.exe
File opened for modification	C:\Windows\SysWOW64\Meiaib32.exe	Mckemg32.exe
File created	C:\Windows\SysWOW64\Pcijeb32.exe	Pdfjifjo.exe
File created	C:\Windows\SysWOW64\Beeoaapl.exe	Bnkgeg32.exe
File created	C:\Windows\SysWOW64\Qgallfcq.exe	Qecppkdm.exe
File created	C:\Windows\SysWOW64\Ibihdfhm.dll	Qnkdhpjn.exe
File opened for modification	C:\Windows\SysWOW64\Bdkcmdhp.exe	Balfaiil.exe
File created	C:\Windows\SysWOW64\Jffldcca.dll	Dkljak32.exe
File created	C:\Windows\SysWOW64\Ldjhpl32.exe	Llcpoo32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11832	11744	WerFault.exe	571

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cbjoljdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Camphf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jmnoof32.dll"	Gomakdcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hcdmga32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofqpqo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dhkjej32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpocjdld.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jmhale32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mckemg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anadoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnhfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kiljkifg.dll"	Mpoefk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqckln32.dll"	Ocgmpccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Empbnb32.dll"	Pcbmka32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Beeoaapl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhkhibmc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Alkdnboj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cliaoq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gfbploob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmldgi32.dll"	Iehfdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaiann32.dll"	Miemjaci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdfjifjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhqeiena.dll"	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjhqjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pegplgln.dll"	Odednmpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qnkdhpjn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Clpgpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qoecnk32.dll"	Kiidgeki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnjknp32.dll"	Ndokbi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Amgapeea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Odnnnnfe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpolqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfifebhe.dll"	Pcojkhap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fllpbldb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jeklag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpdkcl32.dll"	Klngdpdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npfkgjdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ocbddc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mglppmnd.dll"	Lnjjdgee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjpabk32.dll"	Pjmehkqk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Belebq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddmaok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfilim32.dll"	Pjeoglgc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dbaemi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipnjafgo.dll"	Hkdbpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmknaell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlaegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Feibedlp.dll"	Aqncedbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gallfmbn.dll"	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bblckl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjeddggd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ehedfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgokmgjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Laciofpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbeqmoji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jianff32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpebpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgllfjld.dll"	Pjkombfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odegmceb.dll"	Mjeddggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhnnep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkdggmlj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdlnbm32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 3788	4628	67aba589f139d4d4699f3aa6fc8641cb2150ef10cbe27ede842c04a0e609dbee.exe	85
PID 4628 wrote to memory of 3788	4628	67aba589f139d4d4699f3aa6fc8641cb2150ef10cbe27ede842c04a0e609dbee.exe	85
PID 4628 wrote to memory of 3788	4628	67aba589f139d4d4699f3aa6fc8641cb2150ef10cbe27ede842c04a0e609dbee.exe	85
PID 3788 wrote to memory of 1556	3788	Liekmj32.exe	86
PID 3788 wrote to memory of 1556	3788	Liekmj32.exe	86
PID 3788 wrote to memory of 1556	3788	Liekmj32.exe	86
PID 1556 wrote to memory of 3232	1556	Lpocjdld.exe	87
PID 1556 wrote to memory of 3232	1556	Lpocjdld.exe	87
PID 1556 wrote to memory of 3232	1556	Lpocjdld.exe	87
PID 3232 wrote to memory of 4112	3232	Lkdggmlj.exe	88
PID 3232 wrote to memory of 4112	3232	Lkdggmlj.exe	88
PID 3232 wrote to memory of 4112	3232	Lkdggmlj.exe	88
PID 4112 wrote to memory of 2972	4112	Lmccchkn.exe	89
PID 4112 wrote to memory of 2972	4112	Lmccchkn.exe	89
PID 4112 wrote to memory of 2972	4112	Lmccchkn.exe	89
PID 2972 wrote to memory of 1456	2972	Lpappc32.exe	90
PID 2972 wrote to memory of 1456	2972	Lpappc32.exe	90
PID 2972 wrote to memory of 1456	2972	Lpappc32.exe	90
PID 1456 wrote to memory of 4512	1456	Lkgdml32.exe	91
PID 1456 wrote to memory of 4512	1456	Lkgdml32.exe	91
PID 1456 wrote to memory of 4512	1456	Lkgdml32.exe	91
PID 4512 wrote to memory of 1648	4512	Laalifad.exe	92
PID 4512 wrote to memory of 1648	4512	Laalifad.exe	92
PID 4512 wrote to memory of 1648	4512	Laalifad.exe	92
PID 1648 wrote to memory of 396	1648	Lcbiao32.exe	93
PID 1648 wrote to memory of 396	1648	Lcbiao32.exe	93
PID 1648 wrote to memory of 396	1648	Lcbiao32.exe	93
PID 396 wrote to memory of 3360	396	Lkiqbl32.exe	94
PID 396 wrote to memory of 3360	396	Lkiqbl32.exe	94
PID 396 wrote to memory of 3360	396	Lkiqbl32.exe	94
PID 3360 wrote to memory of 4880	3360	Laciofpa.exe	95
PID 3360 wrote to memory of 4880	3360	Laciofpa.exe	95
PID 3360 wrote to memory of 4880	3360	Laciofpa.exe	95
PID 4880 wrote to memory of 1356	4880	Ldaeka32.exe	96
PID 4880 wrote to memory of 1356	4880	Ldaeka32.exe	96
PID 4880 wrote to memory of 1356	4880	Ldaeka32.exe	96
PID 1356 wrote to memory of 752	1356	Lklnhlfb.exe	97
PID 1356 wrote to memory of 752	1356	Lklnhlfb.exe	97
PID 1356 wrote to memory of 752	1356	Lklnhlfb.exe	97
PID 752 wrote to memory of 2908	752	Lnjjdgee.exe	98
PID 752 wrote to memory of 2908	752	Lnjjdgee.exe	98
PID 752 wrote to memory of 2908	752	Lnjjdgee.exe	98
PID 2908 wrote to memory of 4408	2908	Lphfpbdi.exe	100
PID 2908 wrote to memory of 4408	2908	Lphfpbdi.exe	100
PID 2908 wrote to memory of 4408	2908	Lphfpbdi.exe	100
PID 4408 wrote to memory of 4936	4408	Lknjmkdo.exe	101
PID 4408 wrote to memory of 4936	4408	Lknjmkdo.exe	101
PID 4408 wrote to memory of 4936	4408	Lknjmkdo.exe	101
PID 4936 wrote to memory of 3132	4936	Mnlfigcc.exe	102
PID 4936 wrote to memory of 3132	4936	Mnlfigcc.exe	102
PID 4936 wrote to memory of 3132	4936	Mnlfigcc.exe	102
PID 3132 wrote to memory of 4620	3132	Mdfofakp.exe	103
PID 3132 wrote to memory of 4620	3132	Mdfofakp.exe	103
PID 3132 wrote to memory of 4620	3132	Mdfofakp.exe	103
PID 4620 wrote to memory of 3208	4620	Mkpgck32.exe	104
PID 4620 wrote to memory of 3208	4620	Mkpgck32.exe	104
PID 4620 wrote to memory of 3208	4620	Mkpgck32.exe	104
PID 3208 wrote to memory of 2696	3208	Mnocof32.exe	105
PID 3208 wrote to memory of 2696	3208	Mnocof32.exe	105
PID 3208 wrote to memory of 2696	3208	Mnocof32.exe	105
PID 2696 wrote to memory of 2336	2696	Mdiklqhm.exe	106
PID 2696 wrote to memory of 2336	2696	Mdiklqhm.exe	106
PID 2696 wrote to memory of 2336	2696	Mdiklqhm.exe	106
PID 2336 wrote to memory of 3732	2336	Mcklgm32.exe	107

C:\Users\Admin\AppData\Local\Temp\67aba589f139d4d4699f3aa6fc8641cb2150ef10cbe27ede842c04a0e609dbee.exe
"C:\Users\Admin\AppData\Local\Temp\67aba589f139d4d4699f3aa6fc8641cb2150ef10cbe27ede842c04a0e609dbee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\Liekmj32.exe
  C:\Windows\system32\Liekmj32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Windows\SysWOW64\Lpocjdld.exe
    C:\Windows\system32\Lpocjdld.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1556
  - - C:\Windows\SysWOW64\Lkdggmlj.exe
      C:\Windows\system32\Lkdggmlj.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3232
    - - C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4112
      - C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2972
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1648
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:396
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3360
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4880
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:752
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2908
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4620
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3208
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2696
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2336
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3732
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3556
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        25⤵
        Executes dropped EXE
        
        PID:3228
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3480
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        27⤵
        Executes dropped EXE
        
        PID:3580
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        28⤵
        Executes dropped EXE
        
        PID:876
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        29⤵
        Executes dropped EXE
        
        PID:1348
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1952
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        31⤵
        Executes dropped EXE
        
        PID:4876
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2548
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        33⤵
        Executes dropped EXE
        
        PID:1212
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        34⤵
        Executes dropped EXE
        
        PID:1596
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        35⤵
        Executes dropped EXE
        
        PID:3164
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:516
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        37⤵
        Executes dropped EXE
        
        PID:5112
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        38⤵
        Executes dropped EXE
        
        PID:3304
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        39⤵
        Executes dropped EXE
        
        PID:3268
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4444
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2200
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1232
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3156
        
        C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2668
        
        C:\Windows\SysWOW64\Ndkahnhh.exe
        
        C:\Windows\system32\Ndkahnhh.exe
        45⤵
        Executes dropped EXE
        
        PID:220
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        46⤵
        Executes dropped EXE
        
        PID:212
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        47⤵
        Executes dropped EXE
        
        PID:2364
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        48⤵
        Executes dropped EXE
        
        PID:1532
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:468
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        50⤵
        Executes dropped EXE
        
        PID:3332
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        51⤵
        Executes dropped EXE
        
        PID:4344
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        52⤵
        Executes dropped EXE
        
        PID:796
        
        C:\Windows\SysWOW64\Odpjcm32.exe
        
        C:\Windows\system32\Odpjcm32.exe
        53⤵
        Executes dropped EXE
        
        PID:3184
        
        C:\Windows\SysWOW64\Ogogoi32.exe
        
        C:\Windows\system32\Ogogoi32.exe
        54⤵
        Executes dropped EXE
        
        PID:2384
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        55⤵
        Executes dropped EXE
        
        PID:3196
        
        C:\Windows\SysWOW64\Oqgkhnjf.exe
        
        C:\Windows\system32\Oqgkhnjf.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1068
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        57⤵
        Executes dropped EXE
        
        PID:1236
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        58⤵
        Executes dropped EXE
        
        PID:4356
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        59⤵
        Executes dropped EXE
        
        PID:4520
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2740
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:848
        
        C:\Windows\SysWOW64\Ojalgcnd.exe
        
        C:\Windows\system32\Ojalgcnd.exe
        62⤵
        Executes dropped EXE
        
        PID:392
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        63⤵
        Executes dropped EXE
        
        PID:2716
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3844
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        65⤵
        Executes dropped EXE
        
        PID:4372
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        66⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        67⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        68⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        69⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        70⤵
        Modifies registry class
        
        PID:3640
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        71⤵
        Drops file in System32 directory
        
        PID:2132
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4528
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        73⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        74⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        75⤵
        
        PID:676
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        76⤵
        Modifies registry class
        
        PID:3364
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        77⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        78⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        79⤵
        
        PID:224
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        80⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        81⤵
        
        PID:3704
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        82⤵
        Drops file in System32 directory
        
        PID:2220
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        83⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        84⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        85⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:560
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        86⤵
        Drops file in System32 directory
        
        PID:2456
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        87⤵
        Drops file in System32 directory
        
        PID:5160
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        88⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        89⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        90⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        91⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        92⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        93⤵
        Drops file in System32 directory
        
        PID:5448
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        94⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        95⤵
        Drops file in System32 directory
        
        PID:5540
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        96⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5632
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        98⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        99⤵
        Drops file in System32 directory
        
        PID:5724
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        100⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        101⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        102⤵
        Drops file in System32 directory
        
        PID:5848
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        103⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        104⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        105⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        106⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        107⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        108⤵
        Modifies registry class
        
        PID:6104
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        109⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5140
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        111⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        112⤵
        Drops file in System32 directory
        
        PID:5308
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        113⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        114⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5576
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        116⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        117⤵
        Drops file in System32 directory
        
        PID:5720
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        118⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        119⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        120⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6012
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        122⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        123⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        124⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        125⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        126⤵
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        127⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        128⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        129⤵
        Modifies registry class
        
        PID:5916
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6052
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        131⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        132⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        133⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5800
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        135⤵
        Modifies registry class
        
        PID:4540
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:456
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        137⤵
        Modifies registry class
        
        PID:5432
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        138⤵
        Modifies registry class
        
        PID:5904
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6076
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        140⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        141⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        142⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        143⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        144⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6240
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        146⤵
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        147⤵
        Drops file in System32 directory
        
        PID:6348
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6396
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        149⤵
        Drops file in System32 directory
        
        PID:6456
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        150⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        151⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        152⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6676
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        154⤵
        Drops file in System32 directory
        
        PID:6728
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        155⤵
        Drops file in System32 directory
        
        PID:6792
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        156⤵
        Drops file in System32 directory
        
        PID:6844
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        157⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        158⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        159⤵
        Modifies registry class
        
        PID:7008
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        160⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        161⤵
        Drops file in System32 directory
        
        PID:7100
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7144
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        163⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        164⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        165⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        166⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        167⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        168⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        169⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        170⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6836
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6924
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        173⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        174⤵
        Drops file in System32 directory
        
        PID:7084
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        175⤵
        Modifies registry class
        
        PID:7152
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        176⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6256
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        178⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        179⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6704
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6884
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        182⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        183⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        184⤵
        Modifies registry class
        
        PID:6172
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        185⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        186⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        187⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        188⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6248
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        190⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        191⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6516
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        193⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        194⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        195⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        196⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        197⤵
        Modifies registry class
        
        PID:7248
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        198⤵
        Drops file in System32 directory
        
        PID:7300
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        199⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7392
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        201⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        202⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        203⤵
        Drops file in System32 directory
        
        PID:7524
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        204⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        205⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        206⤵
        Modifies registry class
        
        PID:7648
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7692
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        208⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        209⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        210⤵
        Modifies registry class
        
        PID:7824
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        211⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7904
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        213⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        214⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        215⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        216⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        217⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        218⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        219⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        220⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        221⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        222⤵
        Modifies registry class
        
        PID:1072
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        223⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        224⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        225⤵
        Modifies registry class
        
        PID:7620
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        226⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        227⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        228⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7896
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        230⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7980
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        231⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        232⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8176
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        234⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        235⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        236⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7468
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        237⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        238⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        239⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        240⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        241⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        242⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5360
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        244⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        245⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        246⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7292
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        247⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        248⤵
        Drops file in System32 directory
        
        PID:7376
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        249⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        250⤵
        Modifies registry class
        
        PID:7224
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        251⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        252⤵
        Modifies registry class
        
        PID:7364
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        253⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        254⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        255⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8288
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8332
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        258⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        259⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        260⤵
        Drops file in System32 directory
        
        PID:8464
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        261⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        262⤵
        Modifies registry class
        
        PID:8552
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        263⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        264⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        265⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8720
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        267⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        268⤵
        Drops file in System32 directory
        
        PID:8800
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        269⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        270⤵
        Modifies registry class
        
        PID:8884
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        271⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        272⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        273⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9048
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        275⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        276⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        277⤵
        Drops file in System32 directory
        
        PID:9184
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8196
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        279⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        280⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        281⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        282⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        283⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        284⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        285⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        286⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        287⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        288⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        289⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8984
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        291⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9192
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        293⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        294⤵
        Modifies registry class
        
        PID:8316
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        295⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        296⤵
        Modifies registry class
        
        PID:8512
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        297⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        298⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        299⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        300⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        301⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        302⤵
        Drops file in System32 directory
        
        PID:9204
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        303⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8488
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        305⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        306⤵
        Drops file in System32 directory
        
        PID:8788
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        307⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        308⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8440
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        310⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        311⤵
        Modifies registry class
        
        PID:8980
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        312⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        313⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8688
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        314⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        315⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8624
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        317⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        318⤵
        Drops file in System32 directory
        
        PID:9268
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        319⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        320⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        321⤵
        Modifies registry class
        
        PID:9404
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        322⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        323⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:9532
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        325⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        326⤵
        Drops file in System32 directory
        
        PID:9620
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        327⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        328⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        329⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        330⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        331⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        332⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        333⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        334⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        335⤵
        Drops file in System32 directory
        
        PID:10040
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        336⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        337⤵
        Modifies registry class
        
        PID:10136
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        338⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        339⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        340⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8956
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9296
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9368
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        343⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9504
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        345⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9660
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        347⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        348⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        349⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        350⤵
        Modifies registry class
        
        PID:9960
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        351⤵
        Modifies registry class
        
        PID:10012
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        352⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        353⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10220
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        355⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        356⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9516
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        358⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        359⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        360⤵
        Modifies registry class
        
        PID:9840
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        361⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        362⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        363⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        364⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9340
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        365⤵
        Drops file in System32 directory
        
        PID:9440
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        366⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        367⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        368⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        369⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        370⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        371⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        372⤵
        Modifies registry class
        
        PID:9976
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        373⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        374⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        375⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        376⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9596
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        378⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        379⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        380⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        381⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        382⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10440
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        383⤵
        Modifies registry class
        
        PID:10484
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        384⤵
        Drops file in System32 directory
        
        PID:10528
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        385⤵
        Modifies registry class
        
        PID:10564
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        386⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        387⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        388⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        389⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        390⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        391⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        392⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10868
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        393⤵
        Drops file in System32 directory
        
        PID:10912
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        394⤵
        Drops file in System32 directory
        
        PID:10956
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        395⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        396⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        397⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        398⤵
        Modifies registry class
        
        PID:11116
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        399⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        400⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        401⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        402⤵
        Modifies registry class
        
        PID:10260
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        403⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        404⤵
        Drops file in System32 directory
        
        PID:10392
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        405⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        406⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        407⤵
        Modifies registry class
        
        PID:10596
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        408⤵
        Drops file in System32 directory
        
        PID:10672
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        409⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        410⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        411⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        412⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        413⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        414⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        415⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        416⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11220
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        417⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        418⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        419⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        420⤵
        Drops file in System32 directory
        
        PID:10552
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        421⤵
        Modifies registry class
        
        PID:10644
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        422⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10712
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        423⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        424⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        425⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10996
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        426⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        427⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11196
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        428⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        429⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        430⤵
        Modifies registry class
        
        PID:7316
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        431⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        432⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        433⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        434⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        435⤵
        Modifies registry class
        
        PID:10764
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        436⤵
        Modifies registry class
        
        PID:10900
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        437⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        438⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        439⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11132
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        440⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        441⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11088
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        442⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        443⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        444⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        445⤵
        
        PID:11284
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        446⤵
        
        PID:11332
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        447⤵
        
        PID:11376
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        448⤵
        Drops file in System32 directory
        
        PID:11452
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        449⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        450⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        451⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        452⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11632
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        453⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        454⤵
        
        PID:11712
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        455⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        456⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        457⤵
        Drops file in System32 directory
        
        PID:11856
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        458⤵
        Modifies registry class
        
        PID:11900
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        459⤵
        
        PID:11940
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        460⤵
        
        PID:11984
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        461⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        462⤵
        
        PID:12072
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        463⤵
        Modifies registry class
        
        PID:12116
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        464⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        465⤵
        
        PID:12196
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        466⤵
        Drops file in System32 directory
        
        PID:12244
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        467⤵
        
        PID:12284
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        468⤵
        
        PID:11328
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        469⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        470⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        471⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        472⤵
        
        PID:11652
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        473⤵
        
        PID:11744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11744 -s 396
        474⤵
        Program crash
        
        PID:11832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 11744 -ip 11744
1⤵
PID:11792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Colffknh.exe

Filesize
55KB

MD5
5f8bdfed65016e9d90d96f2139ecf41a

SHA1
7418bcf4f029119021612f974e81b419dc9b50bc

SHA256
c90338e4a011956c8da2b734fa72403ea545b577a9891886dedbfb0f6358df78

SHA512
78a115207fae9d0d6f79d6c430a87d51158a961d89a3b505f3d1b979d13ced1e91ce6cb175e35cdea886c184309b0ea0d0d77edc2bd7fa6a6dee66c660b49670

Download Submit
C:\Windows\SysWOW64\Jcbihpel.exe

Filesize
55KB

MD5
e0fc34a04c217b6197a8898b39d3ac0c

SHA1
e54e26e86daeaf486f378f21e262c5ff1626bf0f

SHA256
77747c7947f52121ce3b9d74a6e679c1e9a3619b58622412fdc1ae36a5d5620f

SHA512
15a7c43e20707dff48660d7745fc435894efd253a8bb1392de519fb733a17e2321eaafcc1e85626689c359008c8b9650314510cfbcc8b0dfbf1138c4a91aa4b6

Download Submit
C:\Windows\SysWOW64\Klngdpdd.exe

Filesize
55KB

MD5
a21bc51c305f86bab9bc7469447e4179

SHA1
69fa85d343d6af2963cabeaced9fa571a6954ea2

SHA256
6ad30915c508daee974a1a56399ef37d9035370dad46f91155bba8ffb319fe5d

SHA512
6f9ad71e0bb39e81d5f99de4a8efe788fdae626d5d9dca6852af5dd9d76f49c5c843c2bf4ac8b490ab5a67cfb895c5d2dbdfeb7c82b7c61f2c5ffe75869fe0f2

Download Submit
C:\Windows\SysWOW64\Laalifad.exe

Filesize
55KB

MD5
25e80786ae9f553378055e04e0693f47

SHA1
22c38f3cd0170d3e8d5bf48882524db00f952b1a

SHA256
d65f196c3300cfa32a97146effc24129b5bb2a8400befe304a4d7a9ac3068ede

SHA512
390cc7d4bea81d2b1423ca3b85ee110cb8757c230296bb7d484ec1eefe3ce447bc301d8c6aeec2b10e2eb09cb9e5f95e11d9479847f3e368667158965b5f9f6f

Download Submit
C:\Windows\SysWOW64\Laciofpa.exe

Filesize
55KB

MD5
f990847ba064bbb50ea8aba40666512b

SHA1
cabda36906954b3e9a41b914979d188ef898858f

SHA256
0f502166effd929cec3b0e1650c4d67185d8cff6b0828832562431757fce0a77

SHA512
6374f4d8ba4a165aebaccaa13185febfd1063616636d4b4fb256b04b759bcf17d18e9217e310bee3fce6b634c99c4fc62515646851921cafc3db39566978efd9

Download Submit
C:\Windows\SysWOW64\Lcbiao32.exe

Filesize
55KB

MD5
4c917e1ee0f9b0a45211c9afd3e2e47f

SHA1
78339eb9c0864aa1483fc96349ed4c6ec5ba13d6

SHA256
ffbf2b2983e4205926ca379aa9b6e90e9f2d93a92faa809f6f9d97cdfcf7bf39

SHA512
cd569e7a6c669f943b2cc3c95f5ca2e9023d55f6aa91e2ff5645b5f8b54b110adf902317ba30b92f11109cd594a9dbe4f1031fab9250993070d5c17539fa29e6

Download Submit
C:\Windows\SysWOW64\Ldaeka32.exe

Filesize
55KB

MD5
a454a8096cad7c69e0d8441740a34c5f

SHA1
7fcf5168e869369f3db9a6e0097c2b11c777627d

SHA256
9a212e066da456ce5e4f281344c4a77b22e0b7ceb67eb6a709260d12ee1bcb9f

SHA512
ee5a4a905815a2e1f2988b25864f7da95a3a2caf994c1676add8b626d73542bf957ba224ea82c8dca12d4bd0c4c9edd6f297e6d6dd69004ab1bb2f0f8bd770ba

Download Submit
C:\Windows\SysWOW64\Liekmj32.exe

Filesize
55KB

MD5
ea4bff32782a6f1ca04ceb07e73153f3

SHA1
21207fd24744ccaaea86dca3fd2dcfec0b93926a

SHA256
d8a0238e5d6a09b959b687b85d864e4b82b7f9ec8e01fcc1662754f0e2ea689f

SHA512
b22f621c4059072317fc7667bbcce229c12ce7bab2f7ebf1fe6161bab8c040fc5942ba7302d148f2ffa64a9fdb6671a2032434f87df6b0384dfcb6e13a02ee95

Download Submit
C:\Windows\SysWOW64\Lkdggmlj.exe

Filesize
55KB

MD5
d9e58a9bcdf718f168192438dd51202d

SHA1
6a6f646aa7e2c66e6450bd8d0d82330d4d93caf9

SHA256
e467ce306b7f65e16c17d3b9e569a85092c0643ead69d1e88b2d63833b47de5d

SHA512
2b2705a0155aa53497ce47cd93e57433b2e1bb2c9420dfeb97fa57e43534ec2fdfca72f16b4f2228589c701b6eec48e5f6aeb73f2f9122d3d7cb2fa2be8959be

Download Submit
C:\Windows\SysWOW64\Lkgdml32.exe

Filesize
55KB

MD5
4f276041d1ad0b8ea4444c9381391b59

SHA1
aa09b9cf579ab95d7eade4a05f04d54b0c66db46

SHA256
22c9c6d48e178d125f664842a1f90816ed00dabf513be52a919f16c5c3f7b1d3

SHA512
c753997b768daa6e24fd97897161f9953f7be68ca6a26bb35a9ecca0a1e2302687a88cc97fe4cab5a48fa0f251661a0c9d7f136cb9d989f938e1cbc1bf1a4592

Download Submit
C:\Windows\SysWOW64\Lkiqbl32.exe

Filesize
55KB

MD5
d7832ca5dc74c78ab8145e353273f976

SHA1
cf79a6ce809908012c52027a1dde2811c6ec73cf

SHA256
a0cad99205e833c57a84e46a9442be776472020ea5fa686ca7ef889acd3622e2

SHA512
a74a0a93e5c29f7c58aa7b221cc5dc9d0b1e292d9cc8e620261aafe4d50c821c96f2a7330195734eaf0e5da0988ff9d17da1852a5180c39f03aaf3ad8e511760

Download Submit
C:\Windows\SysWOW64\Lklnhlfb.exe

Filesize
55KB

MD5
49f2b83d0be8118446f81bc2126f1e98

SHA1
54d3c9b49d0f4de3f88119f5c87c6b5f8a99c6ce

SHA256
255285f34eac424d72a8cdafa7f4c2e711f21ed957cbcb0aebe705acb3bffc41

SHA512
15eeac23fc5cb31c5016eeaa95423020fdd5f41b6651c31482ea38d9cde1ea125634af9a2ebcb8f6011e2e11b343ff890a635b119d475cac22ddd40685d3af2b

Download Submit
C:\Windows\SysWOW64\Lknjmkdo.exe

Filesize
55KB

MD5
797aeb96fb6d8e87a348f0633d9ac75e

SHA1
a4b432221fe9a928c48473243808821110fa2a13

SHA256
1afec2028d67343c1d0f92e74cc25fde130a396618f7552c1231969a892a9c4c

SHA512
c62f54a9c519d208fcbc663a9fe4240158581dd8a6f97cb679e102a9f21d70be9e100d1b8af951b01b5b0f2eb201906ab3c2a9be5db0565ba726219ef5aa526e

Download Submit
C:\Windows\SysWOW64\Lmccchkn.exe

Filesize
55KB

MD5
a6725e7d511277f30c425b5f90e8dc1f

SHA1
2c344ca13ff4e1168f911d3dfe159024032f68e9

SHA256
efc5d6d835e4107eb96350b2598d712781c0af92a3ace1c1461a6c09b4681432

SHA512
433fde0ca3f8f0eb2bfd2b26a3565a1ad327461f66ab4d111945828a1f2e42e38aa0d66a7fd959c8059c1e8a67e6768dfe5ecd2e8b4b8c54ffc80d3983f7f307

Download Submit
C:\Windows\SysWOW64\Lnjjdgee.exe

Filesize
55KB

MD5
0fdd90be0f63bf673888400968bce1cc

SHA1
5312d0aa709714c661ecf077d7924656d5d0c685

SHA256
49e88f2da76ecceae7097ab7ac7d68404d41bbef22ab6eca6fe3184e3f863b77

SHA512
cb2aebdfe97260be9ed5b20fb321f2f1d316985c3ab2dea23b11592e32a5eef4702441c3c226ebd499cb4132df0813918877b795d78216ed1c580bbe1ee04576

Download Submit
C:\Windows\SysWOW64\Lpappc32.exe

Filesize
55KB

MD5
9b541e4588bf9f2f2796b4cc36b62419

SHA1
02c140e9da7372ea22bf979f7526b4c836eb5201

SHA256
e1cadcf70898d2c6824dd7c2b705edb031a3402014052864da0f6385e966cc9e

SHA512
27808353ed139cce70446be18b0a8f793c51fcf2e8dc9080ae0419a2f02b679aad56a2c99361326bd625f5248fbae1ad6d637b1c3a16aaff3990e5ffeb371528

Download Submit
C:\Windows\SysWOW64\Lphfpbdi.exe

Filesize
55KB

MD5
4f82f19255c3452faf5ba1df779f7df6

SHA1
557d8c90f2b47be08709ba91193d4fdef3382dcf

SHA256
4420b7b968761217fda6605b0a45d73a9607107900ffbac3b1859c3888c9b2cc

SHA512
622f67d81c13b77b6d6536bc8b9744794ca5be28ab0b00a1d3bb8b5adbc4cbd5c90513c2beb6ea910a4b7a4bd6a74a588123f7eb5cc79390d69ac8a154b89c4b

Download Submit
C:\Windows\SysWOW64\Lpocjdld.exe

Filesize
55KB

MD5
5099879e727febf8fa34957205bc8ef6

SHA1
dee1100a881f5d0c17cc2c316f7da3ebb65590d3

SHA256
050450d077aa309974e2596f67d59be4b9d4441190a8f8fa9928469e86939e0e

SHA512
0355a86570985405cfc19337defcfd90cfb7514e8796438e73eaea4a9d3e134630252345cb9d22ff2493da5f623ceea2b96946f7018cebbbbfff0c47075eb41f

Download Submit
C:\Windows\SysWOW64\Mcklgm32.exe

Filesize
55KB

MD5
100e75d789adfdc574474fdbc7c02590

SHA1
ba0c9ea96e5bb9cd44542868345a4d04038a97a1

SHA256
6ebe9ccec55a52f35eb96cb4e4b4d257cdd78716cdb111a4dea2901650586b29

SHA512
86e25f3ff6cb372108a5d5c2b4747c6918d4a5e5124e8dfba8c9c43e1b4ecf97e6086dfb11158e7f3e9f80f6eba10c2a5d0204828c12252a843f393294643628

Download Submit
C:\Windows\SysWOW64\Mcnhmm32.exe

Filesize
55KB

MD5
3523271adc55a7f9c611bee86d377145

SHA1
f43fd2c7ff2922c1d295eaa51ce9a02415bb47a3

SHA256
6d6358ca7fef4ff59004dca7d13a856eb4e82e08ad614d33b0badd8336d37361

SHA512
03bcd82f6aa18b5ee03ecba15cf59c5432f45081853d4186712ecc03d2812366128f2fd85275dbf1c4217f33eaeac9c420009fa96fd803d7ff97ee6ede640f73

Download Submit
C:\Windows\SysWOW64\Mdfofakp.exe

Filesize
55KB

MD5
d0be02925a3411ec75272a0709c1e0ed

SHA1
6ccfabeb53e762240ac779a09c3033ea3b7b9f28

SHA256
0670e2c17fb09ef851dd6537cb932fda2974a5de29d46d8b7d652d98b36a3c5e

SHA512
d319f109be4d3bf0eafa87af3153013c3c01d000f91338873b6487c22eed4e1331edadcfa016e0864b9ab3e747aeccce39e6796b0287869bf092fdd751d6cf49

Download Submit
C:\Windows\SysWOW64\Mdiklqhm.exe

Filesize
55KB

MD5
7740b2a012d3a4821abb0221d06e101e

SHA1
c874850fa1d7ee4140b5d12f64d9c6fc0db49f15

SHA256
6a79229e8671029fd83650f831f2d72cd3dfdcb6a8a6bfbe668150bbc4ef3f47

SHA512
96af640b398decb624e54a7eb54a25fd1a197df6eee4908d797fef845159008cfe643d55e0e25650a6d645fc295928e90e3e449a9b214323ef1144f1fffc05f1

Download Submit
C:\Windows\SysWOW64\Mdmegp32.exe

Filesize
55KB

MD5
790e57d07ff82666542c8859b5a842c7

SHA1
5dfba8f8590f02b0679b04e8f3112393d376fa70

SHA256
40b088b768d6c83db5567a0322444b37fe332b5ea98795cc272cea341c078102

SHA512
c95089c79beb2a21aff7f09ad90b0d4c5e8caa524cfa442310a08cf3c74a21aa6cbcc2d51325e7bd5167f1845b3f33d1c552b1efa9fb1e5219bd43c88f2095de

Download Submit
C:\Windows\SysWOW64\Mdpalp32.exe

Filesize
55KB

MD5
635cb369fb0446f9828b656d53a34a6a

SHA1
203b201d753367f9dc3e792e15acbeec3f1726ef

SHA256
602845a980ca622c36c480ee7ecc0d4faf7989d67abf55f1f78083c992f81858

SHA512
9a76173bd72ecc67b90edba0a2c50184480fc5176d8ec4b42426759e81695a2feb59be74da9dd4fe50d192b5246c97201da4c0c77f4210cb3d6d16e3f02ae063

Download Submit
C:\Windows\SysWOW64\Mglack32.exe

Filesize
55KB

MD5
a7a9a12672d4f0bfca0aa516954a38ba

SHA1
85f9c5b019944364c679d01a2aae963b7b52e569

SHA256
048e80bf34768874d90b85e74fc5cd3e86c81481f33e2ae24d3ae8d551e614b7

SHA512
c12612bb882e7a12a08854891239a1fffa60294cc26746897a629d338d17f6eca929ed176625f7bb68c8b45881fdc495f8a9cb350b2bd569017851a9b7513a6b

Download Submit
C:\Windows\SysWOW64\Mgnnhk32.exe

Filesize
55KB

MD5
4e97eaece64430e3bf551df1be972090

SHA1
4dca0757dc916019d9addfd66f0c3b92eff32644

SHA256
244f2dd93077290500a6ebb13893edb34f23cc12356d7ff726acd7009032fe58

SHA512
de0b8d107d8e66b86eba176fe7f6203bb43991dc44249dcfe84622fd0121d59b1c91c3bb91bc77456e5d82b011b8624389b40f294052e5fceef4c38fe4110111

Download Submit
C:\Windows\SysWOW64\Mjeddggd.exe

Filesize
55KB

MD5
1ca865e7b42777cae0fbc11f4fadffb0

SHA1
4e7e38df628fd95f27a4c1a94719d669c96c7259

SHA256
6b0d09a818dde82fe9d8a2d1ee9067c9473a514b67a01b6f7e04f80401588a95

SHA512
8ba281a57bb6cdd1022d3e782f1468994ab2a2e89f640b862dd1a4574fdde456e8218ddb29872ccd5c102aa66eb343401794d4fcf883c321ba18bb54faac7ea0

Download Submit
C:\Windows\SysWOW64\Mjhqjg32.exe

Filesize
55KB

MD5
794167760958ceb5f67c80f0786e76cb

SHA1
98d5ffab3fa8781bf0586b8fe756152743f48e7c

SHA256
1b6973e65c450c289d4de9ea5bdff3c82610f290efbdcb4f6ba11625e44e3ece

SHA512
fdc8f9fe556a79e7527ca040319c32347ce0bb83c8693ece22f9b04df2088414dc892f44aa3c1e62bcd0cb7f6caffc8c2b3a711e845bea27b8615aa43799085b

Download Submit
C:\Windows\SysWOW64\Mkpgck32.exe

Filesize
55KB

MD5
fc4f6b3e5865605d4ae9b351f6e2739f

SHA1
de2005e4fbf1a17f5957a26d8e5612125dec48d7

SHA256
d45ab127d04170746c2376d7efd459541c102842dc1b9ec8c2f7f8f9514f7843

SHA512
d197fc5ead71cfe982189917454a8a6deb7c31833943ad562f4365c842f15530d6e3c8ff5999ae4bd659e57b5dc3c35fa14fc2c8b07d21d01182e553148f3b1d

Download Submit
C:\Windows\SysWOW64\Mnfipekh.exe

Filesize
55KB

MD5
81c6ad9ff550a453c5bd026ad717f113

SHA1
38fb9916966c0260c095424f0341c164e16ab6e0

SHA256
3ac899377d0f7ca9a4fe6898f592e085d11d4d92f6f7a341de32f79141c88c26

SHA512
3a523f1c5bfdee8bd4b0c7eeae317f06e1531d1dc4b735e2c219e24201894ba6f501fb126bec3de7115c06e4d2ca87b15c6e606ea9661b79238ef1bdc25616e9

Download Submit
C:\Windows\SysWOW64\Mnlfigcc.exe

Filesize
55KB

MD5
53f50c5f59c2cff2cb97976818e97070

SHA1
5dee698f4aa05c075cd35033916a3944d7d33a1e

SHA256
00a8ffdc1d11ac6cfdf195c3fac9b634f754b6cc736caee512478d2ab586fd7f

SHA512
3e69e5ed93146c06d8b8b55c651f02c657bc2e80b2e8974971c4c76e0217f2d6b9b17e53ab633cbe2e71871225db23e1c8900df576f2bf2d0d5571a6d150d8e2

Download Submit
C:\Windows\SysWOW64\Mnocof32.exe

Filesize
55KB

MD5
0284ad0fc87480b2ab52f6cc7aa076d9

SHA1
54d4f0a67d6a886c305155b9d7f3ff222075f2ec

SHA256
04595bec52d644fe906f9aac4ee34421e90ceb6bc72d0e4ae4dcf424131c9c7b

SHA512
3c4b16d9ccc05c7cbdac50a746d1c26bac98fe566f91c4caa09d19b1c2075028a78b87013aff8658baeec4c232d22520658fba8dd21a3a143f4deb04b5a83e18

Download Submit
C:\Windows\SysWOW64\Mpolqa32.exe

Filesize
55KB

MD5
9d16d1e8ad6c1830b9e7e6cf970eaeb9

SHA1
5528aca618a507ba81c3dbbe479d800d81f8095d

SHA256
6eafe2a6e723356ce37f793aa764f6b883235c1b3026940b3277a10764deaf8d

SHA512
f4eeb915717d72aac8be964454640b113cf8c98086c86366915bbc84910983d60a56a2d2543b85e09cfa2ee9bc2983d3c81ea1f1f0b31410e95a792404c005c0

Download Submit
C:\Windows\SysWOW64\Nceonl32.exe

Filesize
55KB

MD5
64d51dc0c2622802b6bf188a71bd2f5b

SHA1
941c520a4a041939247fa6c74e022b41e561a939

SHA256
5cc474f10965eff0fcb8b425a95fc06e1e6c3b18259fd01ddedbe1133d6e778b

SHA512
b7e1a7b453f4879cf95b733bdf7a72a40852f2bb1746d1ce0ccbb047b542799e08fb864475a5790b7e6d1ac39e195f9c32bc0fd0579d78cd115cb53d8e2a069d

Download Submit
C:\Windows\SysWOW64\Nnhfee32.exe

Filesize
55KB

MD5
6cd9bdb8d7997b878f7ed417995d8697

SHA1
4a32a267704e11e963c198a730fce3b6d8aa66f5

SHA256
7fd08100a96c7da7c5f703e2682f315a47d71da5697b4faa5d5d1d8cb9e996f0

SHA512
b9f72a534727d90f43cee3761790823e2ac39f7dc1f606c03871b15facd9565592fda698394d89b8625a34a3543e62ceaf428fd2a74c78dc0b05080273c32b7b

Download Submit
memory/212-335-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/220-329-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/392-431-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/396-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/468-353-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/516-279-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/752-105-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/796-375-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/848-425-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/876-221-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1068-400-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1212-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1232-315-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1236-401-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1348-225-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1356-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1456-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1532-347-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1556-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1596-267-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1648-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1952-233-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2200-310-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2336-169-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2364-341-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2384-383-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2548-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2668-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2696-165-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2716-437-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2740-419-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2908-112-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2972-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3132-137-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3156-317-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3164-273-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3184-377-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3196-394-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3208-153-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3228-193-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3232-29-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3268-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3304-287-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3332-359-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3360-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3480-200-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3556-188-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3580-209-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3732-177-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3788-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4112-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4344-365-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4356-407-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4408-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4444-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4512-61-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4520-413-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4620-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4628-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4628-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4876-241-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4880-89-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4936-129-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5112-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/8024-3144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10428-3141-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/10588-3140-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11552-3115-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11744-3113-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/11900-3126-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/12024-3123-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/12072-3122-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/12196-3119-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/12284-3117-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads