3bc4a01272638debddd1d79f4dcbc7f9bb9d4bcd3f1569dd05f9ad8eb0305f5c

Analysis

max time kernel
138s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2023, 17:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7945dbcd599b7e4eb85983c58b475eb9_JC.exe
Size

42KB
MD5

7945dbcd599b7e4eb85983c58b475eb9
SHA1

740392bb7d2528eb7713a6752d6158853392172e
SHA256

3bc4a01272638debddd1d79f4dcbc7f9bb9d4bcd3f1569dd05f9ad8eb0305f5c
SHA512

cd12df2cc781e710eab5050d32a20ecd635836bf4c408633593d328431b35d95802824573f304240232e3ebba93acfa0808fba67538909403c99d9828d7e607b
SSDEEP

768:WBRYNK1lGVk+yKrYzXBZzsy8O8KRPqatE3mq/1H5S:S6ioVfysYzXB+yj8KRCcwc

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dkhnjk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmdlmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mqkiok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddkbmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcblpdgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipflihfq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilmmni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilqoobdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Koodbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edgbii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nciopppp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Padnaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fefedmil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ihkjno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkoigdom.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnelok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdigadjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cofnik32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpimlfke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilqoobdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	BackgroundTransferHost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjnffjkl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Domdjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmdlmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Opclldhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlbejloe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhegig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojnfihmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojnfihmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldipha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjepjkhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogcnmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jojdlfeo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbdoof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qmepam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnoknihb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njmqnobn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cglbhhga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Khbiello.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qlgpod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bklfgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llmhaold.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhpofl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Foclgq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njfkmphe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofhknodl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgcihgaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnjnqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Doaneiop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpmomo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlkipgpe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Heegad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjnffjkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hgfapd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blnoga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipihpkkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcimdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekcgkb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Noblkqca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgkkkcbc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcphab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnfihkqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bllbaa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cleegp32.exe

Executes dropped EXE 64 IoCs

pid	Process
4680	Ackbmcjl.exe
1408	Alcfei32.exe
1788	Afkknogn.exe
2636	Aodogdmn.exe
1376	Bjicdmmd.exe
752	Boflmdkk.exe
616	Bljlfh32.exe
2016	Bbgeno32.exe
1156	Bkoigdom.exe
4152	Bjpjel32.exe
3228	Bmofagfp.exe
2080	Bheffh32.exe
3392	Cfigpm32.exe
4160	Cobkhb32.exe
1184	Ckilmcgb.exe
2632	Cbbdjm32.exe
3788	Cofecami.exe
3476	Cfqmpl32.exe
3968	Coiaiakf.exe
5032	Cjnffjkl.exe
4444	Ckpbnb32.exe
3876	Dbjkkl32.exe
4384	Dmoohe32.exe
4636	Dblgpl32.exe
1236	Dpphjp32.exe
2972	Dihlbf32.exe
3064	Dpbdopck.exe
4360	Djhimica.exe
4440	Dpdaepai.exe
232	Dbcmakpl.exe
4024	Ecbjkngo.exe
5108	Eiobceef.exe
4964	Epikpo32.exe
1552	Efccmidp.exe
1896	Emmkiclm.exe
4048	Emphocjj.exe
1780	Eifhdd32.exe
2208	Eclmamod.exe
1536	Eiieicml.exe
3700	Fcniglmb.exe
2360	Fikbocki.exe
5012	Flqdlnde.exe
1240	Fideeaco.exe
3104	Gbmingjo.exe
3732	Gmbmkpie.exe
2792	Gdlfhj32.exe
5056	Giinpa32.exe
4604	Gbabigfj.exe
4608	Gikkfqmf.exe
984	Gbdoof32.exe
2592	Gmiclo32.exe
4352	Gkmdecbg.exe
3880	Hbhijepa.exe
2236	Hkpqkcpd.exe
3860	Hgfapd32.exe
2136	Hienlpel.exe
4968	Hpofii32.exe
3576	Hginecde.exe
4760	Hdmoohbo.exe
5008	Hgkkkcbc.exe
1204	Hlhccj32.exe
912	Hcblpdgg.exe
3824	Ipflihfq.exe
4612	Ikkpgafg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Pfojdh32.exe	Ppdbgncl.exe
File created	C:\Windows\SysWOW64\Ncgjlnfh.dll	Kqbdldnq.exe
File created	C:\Windows\SysWOW64\Lmpkadnm.exe	Ljaoeini.exe
File created	C:\Windows\SysWOW64\Pcmdgodo.dll	Chkobkod.exe
File created	C:\Windows\SysWOW64\Bkgppbgc.dll	Lljdai32.exe
File opened for modification	C:\Windows\SysWOW64\Dpdaepai.exe	Djhimica.exe
File created	C:\Windows\SysWOW64\Iefgbh32.exe	Ilnbicff.exe
File opened for modification	C:\Windows\SysWOW64\Dgcihgaj.exe	Dddllkbf.exe
File created	C:\Windows\SysWOW64\Doagjc32.exe	Dgjoif32.exe
File created	C:\Windows\SysWOW64\Ngckdnpn.dll	Gbkkik32.exe
File opened for modification	C:\Windows\SysWOW64\Anmfbl32.exe	Alkijdci.exe
File created	C:\Windows\SysWOW64\Mjfmcmai.dll	Cohkokgj.exe
File created	C:\Windows\SysWOW64\Jdgccn32.dll	Eokqkh32.exe
File created	C:\Windows\SysWOW64\Hfaajnfb.exe	Gmimai32.exe
File created	C:\Windows\SysWOW64\Modpib32.exe	Mledmg32.exe
File created	C:\Windows\SysWOW64\Hcoejf32.dll	Mhldbh32.exe
File created	C:\Windows\SysWOW64\Pcegclgp.exe	Pafkgphl.exe
File created	C:\Windows\SysWOW64\Cqichhmn.dll	Pmoiqneg.exe
File created	C:\Windows\SysWOW64\Qmepam32.exe	Phigif32.exe
File created	C:\Windows\SysWOW64\Lmgnid32.dll	Enigke32.exe
File created	C:\Windows\SysWOW64\Ebgpad32.exe	Ekmhejao.exe
File created	C:\Windows\SysWOW64\Gbchdp32.exe	Gikdkj32.exe
File created	C:\Windows\SysWOW64\Filclgic.dll	Gbchdp32.exe
File created	C:\Windows\SysWOW64\Kghfphob.dll	Ipoheakj.exe
File created	C:\Windows\SysWOW64\Opclldhj.exe	Ojfcdnjc.exe
File created	C:\Windows\SysWOW64\Ibcjqgnm.exe	Ipdndloi.exe
File created	C:\Windows\SysWOW64\Pmemlfol.dll	Hdmoohbo.exe
File opened for modification	C:\Windows\SysWOW64\Nlcalieg.exe	Meiioonj.exe
File created	C:\Windows\SysWOW64\Jbofpe32.dll	Nagiji32.exe
File created	C:\Windows\SysWOW64\Oanokhdb.exe	Ofhknodl.exe
File created	C:\Windows\SysWOW64\Pnplfj32.exe	Pdjgha32.exe
File created	C:\Windows\SysWOW64\Begfqa32.dll	Edionhpn.exe
File opened for modification	C:\Windows\SysWOW64\Fkmjaa32.exe	Fofilp32.exe
File created	C:\Windows\SysWOW64\Gaaklfpn.dll	Pblajhje.exe
File opened for modification	C:\Windows\SysWOW64\Bheffh32.exe	Bmofagfp.exe
File opened for modification	C:\Windows\SysWOW64\Addaif32.exe	Aafemk32.exe
File opened for modification	C:\Windows\SysWOW64\Cpmapodj.exe	Bgelgi32.exe
File opened for modification	C:\Windows\SysWOW64\Jbccge32.exe	Jbagbebm.exe
File opened for modification	C:\Windows\SysWOW64\Llcghg32.exe	Ljdkll32.exe
File created	C:\Windows\SysWOW64\Pdhbmh32.exe	Pmoiqneg.exe
File opened for modification	C:\Windows\SysWOW64\Gbnoiqdq.exe	Gejopl32.exe
File created	C:\Windows\SysWOW64\Klhnfo32.exe	Kfnfjehl.exe
File opened for modification	C:\Windows\SysWOW64\Pnplfj32.exe	Pdjgha32.exe
File created	C:\Windows\SysWOW64\Nfihbk32.exe	Nckkfp32.exe
File created	C:\Windows\SysWOW64\Mdkgabfn.dll	Epmmqheb.exe
File created	C:\Windows\SysWOW64\Cgogbi32.dll	Llqjbhdc.exe
File created	C:\Windows\SysWOW64\Mpeiie32.exe	Mhoahh32.exe
File created	C:\Windows\SysWOW64\Jlpncq32.dll	Nelfeo32.exe
File created	C:\Windows\SysWOW64\Jomnmjjb.dll	Boeebnhp.exe
File opened for modification	C:\Windows\SysWOW64\Jlolpq32.exe	Jcfggkac.exe
File opened for modification	C:\Windows\SysWOW64\Llodgnja.exe	Llmhaold.exe
File created	C:\Windows\SysWOW64\Dnmaea32.exe	Dgcihgaj.exe
File created	C:\Windows\SysWOW64\Gbhibfek.dll	Pplhhm32.exe
File created	C:\Windows\SysWOW64\Kamhmbej.dll	Dpdaepai.exe
File created	C:\Windows\SysWOW64\Oclkgccf.exe	Oanokhdb.exe
File created	C:\Windows\SysWOW64\Jibclo32.dll	Fgmdec32.exe
File opened for modification	C:\Windows\SysWOW64\Ihkjno32.exe	Haaaaeim.exe
File created	C:\Windows\SysWOW64\Iimcma32.exe	Ibcjqgnm.exe
File opened for modification	C:\Windows\SysWOW64\Boflmdkk.exe	Bjicdmmd.exe
File created	C:\Windows\SysWOW64\Fnofdl32.dll	Djhimica.exe
File opened for modification	C:\Windows\SysWOW64\Lklbdm32.exe	Kmkbfeab.exe
File created	C:\Windows\SysWOW64\Bcflijmh.dll	Lkalplel.exe
File created	C:\Windows\SysWOW64\Feqeog32.exe	Foclgq32.exe
File created	C:\Windows\SysWOW64\Pfccogfc.exe	Pcegclgp.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12012	11908	WerFault.exe	569

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gkdpbpih.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhihhecc.dll"	Bklfgo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bebjdgmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Flpmagqi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Doagjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnijfj32.dll"	Edgbii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdafpj32.dll"	Kqdaadln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbihjifh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jleijb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndqojdee.dll"	Nopfpgip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pccahbmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfqedp32.dll"	Lcfidb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcejdp32.dll"	Mfbaalbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oifppdpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Epmfkk32.dll"	Bbgeno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjinodke.dll"	Ahgcjddh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jblmgf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mhoahh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ooibkpmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bllbaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmjmhg32.dll"	Coohhlpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pnfiplog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Addaif32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bklfgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciggeb32.dll"	Bnoknihb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpdaepai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbflncid.dll"	Hgfapd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jdodkebj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehkljb32.dll"	Lmpkadnm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qmepam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iajdgcab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfipab32.dll"	Eecphp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kfbdfl32.dll"	Eiahnnph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdmlme32.dll"	Mnjqmpgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdenmbkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gakbde32.dll"	Hehdfdek.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bbgeno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kglmio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoqqpnlk.dll"	Cndeii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dbbffdlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iocbnhog.dll"	Mcgiefen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	BackgroundTransferHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdhbmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Liabph32.dll"	Llmhaold.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjdjokcd.dll"	Kifojnol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lindkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mablfnne.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpbjkn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iondqhpl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofgdcipq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjokgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Palbgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdbfab32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oclkgccf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbhhlfgd.dll"	Bnlhncgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpbdopck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glaecb32.dll"	Gmiclo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gmimai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clahmb32.dll"	Lmdnbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckpbnb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kglmio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmcclm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oaabap32.dll"	Hmdlmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llmhaold.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 4680	1544	7945dbcd599b7e4eb85983c58b475eb9_JC.exe	82
PID 1544 wrote to memory of 4680	1544	7945dbcd599b7e4eb85983c58b475eb9_JC.exe	82
PID 1544 wrote to memory of 4680	1544	7945dbcd599b7e4eb85983c58b475eb9_JC.exe	82
PID 4680 wrote to memory of 1408	4680	Ackbmcjl.exe	84
PID 4680 wrote to memory of 1408	4680	Ackbmcjl.exe	84
PID 4680 wrote to memory of 1408	4680	Ackbmcjl.exe	84
PID 1408 wrote to memory of 1788	1408	Alcfei32.exe	85
PID 1408 wrote to memory of 1788	1408	Alcfei32.exe	85
PID 1408 wrote to memory of 1788	1408	Alcfei32.exe	85
PID 1788 wrote to memory of 2636	1788	Afkknogn.exe	86
PID 1788 wrote to memory of 2636	1788	Afkknogn.exe	86
PID 1788 wrote to memory of 2636	1788	Afkknogn.exe	86
PID 2636 wrote to memory of 1376	2636	Aodogdmn.exe	87
PID 2636 wrote to memory of 1376	2636	Aodogdmn.exe	87
PID 2636 wrote to memory of 1376	2636	Aodogdmn.exe	87
PID 1376 wrote to memory of 752	1376	Bjicdmmd.exe	88
PID 1376 wrote to memory of 752	1376	Bjicdmmd.exe	88
PID 1376 wrote to memory of 752	1376	Bjicdmmd.exe	88
PID 752 wrote to memory of 616	752	Boflmdkk.exe	89
PID 752 wrote to memory of 616	752	Boflmdkk.exe	89
PID 752 wrote to memory of 616	752	Boflmdkk.exe	89
PID 616 wrote to memory of 2016	616	Bljlfh32.exe	90
PID 616 wrote to memory of 2016	616	Bljlfh32.exe	90
PID 616 wrote to memory of 2016	616	Bljlfh32.exe	90
PID 2016 wrote to memory of 1156	2016	Bbgeno32.exe	91
PID 2016 wrote to memory of 1156	2016	Bbgeno32.exe	91
PID 2016 wrote to memory of 1156	2016	Bbgeno32.exe	91
PID 1156 wrote to memory of 4152	1156	Bkoigdom.exe	92
PID 1156 wrote to memory of 4152	1156	Bkoigdom.exe	92
PID 1156 wrote to memory of 4152	1156	Bkoigdom.exe	92
PID 4152 wrote to memory of 3228	4152	Bjpjel32.exe	93
PID 4152 wrote to memory of 3228	4152	Bjpjel32.exe	93
PID 4152 wrote to memory of 3228	4152	Bjpjel32.exe	93
PID 3228 wrote to memory of 2080	3228	Bmofagfp.exe	94
PID 3228 wrote to memory of 2080	3228	Bmofagfp.exe	94
PID 3228 wrote to memory of 2080	3228	Bmofagfp.exe	94
PID 2080 wrote to memory of 3392	2080	Bheffh32.exe	95
PID 2080 wrote to memory of 3392	2080	Bheffh32.exe	95
PID 2080 wrote to memory of 3392	2080	Bheffh32.exe	95
PID 3392 wrote to memory of 4160	3392	Cfigpm32.exe	96
PID 3392 wrote to memory of 4160	3392	Cfigpm32.exe	96
PID 3392 wrote to memory of 4160	3392	Cfigpm32.exe	96
PID 4160 wrote to memory of 1184	4160	Cobkhb32.exe	97
PID 4160 wrote to memory of 1184	4160	Cobkhb32.exe	97
PID 4160 wrote to memory of 1184	4160	Cobkhb32.exe	97
PID 1184 wrote to memory of 2632	1184	Ckilmcgb.exe	98
PID 1184 wrote to memory of 2632	1184	Ckilmcgb.exe	98
PID 1184 wrote to memory of 2632	1184	Ckilmcgb.exe	98
PID 2632 wrote to memory of 3788	2632	Cbbdjm32.exe	99
PID 2632 wrote to memory of 3788	2632	Cbbdjm32.exe	99
PID 2632 wrote to memory of 3788	2632	Cbbdjm32.exe	99
PID 3788 wrote to memory of 3476	3788	Cofecami.exe	100
PID 3788 wrote to memory of 3476	3788	Cofecami.exe	100
PID 3788 wrote to memory of 3476	3788	Cofecami.exe	100
PID 3476 wrote to memory of 3968	3476	Cfqmpl32.exe	101
PID 3476 wrote to memory of 3968	3476	Cfqmpl32.exe	101
PID 3476 wrote to memory of 3968	3476	Cfqmpl32.exe	101
PID 3968 wrote to memory of 5032	3968	Coiaiakf.exe	102
PID 3968 wrote to memory of 5032	3968	Coiaiakf.exe	102
PID 3968 wrote to memory of 5032	3968	Coiaiakf.exe	102
PID 5032 wrote to memory of 4444	5032	Cjnffjkl.exe	103
PID 5032 wrote to memory of 4444	5032	Cjnffjkl.exe	103
PID 5032 wrote to memory of 4444	5032	Cjnffjkl.exe	103
PID 4444 wrote to memory of 3876	4444	Ckpbnb32.exe	104

C:\Users\Admin\AppData\Local\Temp\7945dbcd599b7e4eb85983c58b475eb9_JC.exe
"C:\Users\Admin\AppData\Local\Temp\7945dbcd599b7e4eb85983c58b475eb9_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\SysWOW64\Ackbmcjl.exe
  C:\Windows\system32\Ackbmcjl.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\SysWOW64\Alcfei32.exe
    C:\Windows\system32\Alcfei32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - C:\Windows\SysWOW64\Afkknogn.exe
      C:\Windows\system32\Afkknogn.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1788
    - - C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2636
      - C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1376
        
        C:\Windows\SysWOW64\Boflmdkk.exe
        
        C:\Windows\system32\Boflmdkk.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:752
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:616
        
        C:\Windows\SysWOW64\Bbgeno32.exe
        
        C:\Windows\system32\Bbgeno32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        C:\Windows\SysWOW64\Bkoigdom.exe
        
        C:\Windows\system32\Bkoigdom.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1156
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4152
        
        C:\Windows\SysWOW64\Bmofagfp.exe
        
        C:\Windows\system32\Bmofagfp.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3228
        
        C:\Windows\SysWOW64\Bheffh32.exe
        
        C:\Windows\system32\Bheffh32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\SysWOW64\Cfigpm32.exe
        
        C:\Windows\system32\Cfigpm32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3392
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4160
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1184
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2632
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3788
        
        C:\Windows\SysWOW64\Cfqmpl32.exe
        
        C:\Windows\system32\Cfqmpl32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3476
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3968
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5032
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4444
        
        C:\Windows\SysWOW64\Dbjkkl32.exe
        
        C:\Windows\system32\Dbjkkl32.exe
        23⤵
        Executes dropped EXE
        
        PID:3876
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        24⤵
        Executes dropped EXE
        
        PID:4384
        
        C:\Windows\SysWOW64\Dblgpl32.exe
        
        C:\Windows\system32\Dblgpl32.exe
        25⤵
        Executes dropped EXE
        
        PID:4636
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        26⤵
        Executes dropped EXE
        
        PID:1236
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        27⤵
        Executes dropped EXE
        
        PID:2972
        
        C:\Windows\SysWOW64\Dpbdopck.exe
        
        C:\Windows\system32\Dpbdopck.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3064
        
        C:\Windows\SysWOW64\Djhimica.exe
        
        C:\Windows\system32\Djhimica.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4360
        
        C:\Windows\SysWOW64\Dpdaepai.exe
        
        C:\Windows\system32\Dpdaepai.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4440
        
        C:\Windows\SysWOW64\Dbcmakpl.exe
        
        C:\Windows\system32\Dbcmakpl.exe
        31⤵
        Executes dropped EXE
        
        PID:232
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        32⤵
        Executes dropped EXE
        
        PID:4024
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        33⤵
        Executes dropped EXE
        
        PID:5108
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        34⤵
        Executes dropped EXE
        
        PID:4964
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        35⤵
        Executes dropped EXE
        
        PID:1552
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        36⤵
        Executes dropped EXE
        
        PID:1896
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        37⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        38⤵
        Executes dropped EXE
        
        PID:4048
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        39⤵
        Executes dropped EXE
        
        PID:1780
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        40⤵
        Executes dropped EXE
        
        PID:2208
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        41⤵
        Executes dropped EXE
        
        PID:1536
        
        C:\Windows\SysWOW64\Fcniglmb.exe
        
        C:\Windows\system32\Fcniglmb.exe
        42⤵
        Executes dropped EXE
        
        PID:3700
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        43⤵
        Executes dropped EXE
        
        PID:2360
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        44⤵
        Executes dropped EXE
        
        PID:5012
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        45⤵
        Executes dropped EXE
        
        PID:1240
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        46⤵
        Executes dropped EXE
        
        PID:3104
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        47⤵
        Executes dropped EXE
        
        PID:3732
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        48⤵
        Executes dropped EXE
        
        PID:2792
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        49⤵
        Executes dropped EXE
        
        PID:5056
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        50⤵
        Executes dropped EXE
        
        PID:4604
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        51⤵
        Executes dropped EXE
        
        PID:4608
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:984
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2592
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        54⤵
        Executes dropped EXE
        
        PID:4352
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        55⤵
        Executes dropped EXE
        
        PID:3880
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        56⤵
        Executes dropped EXE
        
        PID:2236
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3860
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        58⤵
        Executes dropped EXE
        
        PID:2136
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        59⤵
        Executes dropped EXE
        
        PID:4968
        
        C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        60⤵
        Executes dropped EXE
        
        PID:3576
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4760
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5008
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        63⤵
        Executes dropped EXE
        
        PID:1204
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:912
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3824
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        66⤵
        Executes dropped EXE
        
        PID:4612
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1920
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        68⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        69⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        70⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        71⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        72⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        73⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        74⤵
        
        PID:1344
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        75⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2132
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4164
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        78⤵
        Modifies registry class
        
        PID:4960
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:452
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        80⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        81⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        82⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        83⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        84⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        85⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5168
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5216
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        88⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        89⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        90⤵
        Drops file in System32 directory
        
        PID:5344
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        91⤵
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        92⤵
        Modifies registry class
        
        PID:5440
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        93⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        94⤵
        Drops file in System32 directory
        
        PID:5540
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        95⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5628
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        97⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        98⤵
        Drops file in System32 directory
        
        PID:5716
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        99⤵
        Modifies registry class
        
        PID:5760
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        100⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        101⤵
        Drops file in System32 directory
        
        PID:5848
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5892
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        103⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        104⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        105⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        106⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        107⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        108⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        109⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        110⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        111⤵
        Modifies registry class
        
        PID:5340
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        112⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        113⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        114⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        115⤵
        Drops file in System32 directory
        
        PID:5636
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        116⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        117⤵
        Drops file in System32 directory
        
        PID:5772
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        118⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        119⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        120⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        121⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        122⤵
        
        PID:760
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        123⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        124⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        125⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        126⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        127⤵
        Drops file in System32 directory
        
        PID:5744
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        128⤵
        Modifies registry class
        
        PID:636
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        129⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        130⤵
        Modifies registry class
        
        PID:6112
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        131⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        132⤵
        Modifies registry class
        
        PID:5428
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        133⤵
        Drops file in System32 directory
        
        PID:5616
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5796
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        135⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5200
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        137⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        138⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        139⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        140⤵
        Drops file in System32 directory
        
        PID:5384
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        141⤵
        Modifies registry class
        
        PID:5816
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        142⤵
        Drops file in System32 directory
        
        PID:5288
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        143⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        144⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        145⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        146⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        147⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        148⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        149⤵
        Modifies registry class
        
        PID:6332
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        150⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        151⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        152⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6508
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        154⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        155⤵
        Drops file in System32 directory
        
        PID:6600
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        156⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        157⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6736
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        159⤵
        Modifies registry class
        
        PID:6792
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6832
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        161⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6928
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6972
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        164⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        165⤵
        Modifies registry class
        
        PID:7068
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        166⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        167⤵
        Modifies registry class
        
        PID:7156
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6200
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        169⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        170⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6384
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        172⤵
        Modifies registry class
        
        PID:6444
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        173⤵
        Drops file in System32 directory
        
        PID:6536
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        174⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        175⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        176⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        177⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        178⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6940
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        180⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        181⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        182⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6228
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        184⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6492
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        186⤵
        Modifies registry class
        
        PID:6660
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        187⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        188⤵
        Drops file in System32 directory
        
        PID:6896
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        189⤵
        Modifies registry class
        
        PID:7060
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        190⤵
        Drops file in System32 directory
        
        PID:6152
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        191⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        192⤵
        Modifies registry class
        
        PID:6592
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        193⤵
        Drops file in System32 directory
        
        PID:6852
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        194⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        195⤵
        Drops file in System32 directory
        
        PID:6280
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        196⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        197⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        198⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        199⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        200⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        201⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        202⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        203⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        204⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7360
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7404
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        207⤵
        Modifies registry class
        
        PID:7444
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        208⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        209⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        210⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        211⤵
        Drops file in System32 directory
        
        PID:7624
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        212⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        213⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        214⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        215⤵
        Drops file in System32 directory
        
        PID:7796
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        216⤵
        Drops file in System32 directory
        
        PID:7840
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        217⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7884
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        218⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7972
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        220⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        221⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        222⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        223⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        224⤵
        Drops file in System32 directory
        
        PID:8184
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        225⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7280
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        227⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        228⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        229⤵
        Drops file in System32 directory
        
        PID:7472
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        230⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        231⤵
        Modifies registry class
        
        PID:7600
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        232⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        233⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        234⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        235⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        236⤵
        Drops file in System32 directory
        
        PID:7968
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        237⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        238⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        239⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7172
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        241⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        242⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        243⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        244⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        245⤵
        Drops file in System32 directory
        
        PID:7816
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        246⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        247⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        248⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        249⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        250⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7608
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        252⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8096
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        254⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        255⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        256⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        257⤵
        Modifies registry class
        
        PID:8112
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        258⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        259⤵
        
        PID:316
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        260⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        261⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        262⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        263⤵
        Modifies registry class
        
        PID:3300
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        264⤵
        Modifies registry class
        
        PID:7596
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4764
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        266⤵
        
        PID:848
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        267⤵
        Modifies registry class
        
        PID:8024
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8228
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        269⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        270⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        271⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        272⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8440
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        274⤵
        Drops file in System32 directory
        
        PID:8488
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        275⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8568
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        277⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        278⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8696
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        280⤵
        Drops file in System32 directory
        
        PID:8736
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        281⤵
        Modifies registry class
        
        PID:8776
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        282⤵
        Drops file in System32 directory
        
        PID:8828
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8864
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        284⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        285⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        286⤵
        Modifies registry class
        
        PID:8996
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        287⤵
        Modifies registry class
        
        PID:9040
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        288⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        289⤵
        Modifies registry class
        
        PID:9120
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        290⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        291⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        292⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        293⤵
        Drops file in System32 directory
        
        PID:8296
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        294⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        295⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        296⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        297⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        298⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        299⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        300⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        301⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        302⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        303⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        304⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        305⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9188
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        307⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        308⤵
        Modifies registry class
        
        PID:8344
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        309⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        310⤵
        Drops file in System32 directory
        
        PID:8576
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        311⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        312⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        313⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        314⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        315⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        316⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        317⤵
        Modifies registry class
        
        PID:9112
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3548
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        319⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        320⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        321⤵
        Drops file in System32 directory
        
        PID:1052
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        322⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        323⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        324⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        325⤵
        Drops file in System32 directory
        
        PID:9032
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8328
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        327⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        328⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        329⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        330⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        331⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Dkcndeen.exe
        
        C:\Windows\system32\Dkcndeen.exe
        332⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        333⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8304
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        335⤵
        Drops file in System32 directory
        
        PID:8688
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        336⤵
        Modifies registry class
        
        PID:9148
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        337⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        338⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        339⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        340⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Edplhjhi.exe
        
        C:\Windows\system32\Edplhjhi.exe
        341⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        342⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        343⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        344⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        345⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        346⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9648
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        348⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        349⤵
        Drops file in System32 directory
        
        PID:9736
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9780
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        351⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        352⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Fkfcqb32.exe
        
        C:\Windows\system32\Fkfcqb32.exe
        353⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        354⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        355⤵
        Drops file in System32 directory
        
        PID:9992
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        356⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10036
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        357⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        358⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        359⤵
        Drops file in System32 directory
        
        PID:10172
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        360⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        361⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        362⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        363⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        364⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        365⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9432
        
        C:\Windows\SysWOW64\Gbkkik32.exe
        
        C:\Windows\system32\Gbkkik32.exe
        366⤵
        Drops file in System32 directory
        
        PID:9500
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        367⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        368⤵
        Modifies registry class
        
        PID:9660
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        369⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        370⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        371⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        372⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Hahokfag.exe
        
        C:\Windows\system32\Hahokfag.exe
        373⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        374⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        375⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10208
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        377⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\Hbihjifh.exe
        
        C:\Windows\system32\Hbihjifh.exe
        378⤵
        Modifies registry class
        
        PID:9308
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        379⤵
        Modifies registry class
        
        PID:9416
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        380⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Hejqldci.exe
        
        C:\Windows\system32\Hejqldci.exe
        381⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        382⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        383⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        384⤵
        Drops file in System32 directory
        
        PID:9984
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        385⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10068
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        386⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        387⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        388⤵
        Drops file in System32 directory
        
        PID:9428
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        389⤵
        Drops file in System32 directory
        
        PID:9600
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        390⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Ilkoim32.exe
        
        C:\Windows\system32\Ilkoim32.exe
        391⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        392⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        393⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        394⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9724
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        396⤵
        Modifies registry class
        
        PID:10044
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        397⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        398⤵
        Modifies registry class
        
        PID:9644
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        399⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        400⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9704
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        401⤵
        Modifies registry class
        
        PID:9680
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        402⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        403⤵
        
        PID:10260
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        404⤵
        Drops file in System32 directory
        
        PID:10300
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        405⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        406⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10420
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        408⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10464
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        409⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Kifojnol.exe
        
        C:\Windows\system32\Kifojnol.exe
        410⤵
        Modifies registry class
        
        PID:10548
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        411⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        412⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        413⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        414⤵
        Drops file in System32 directory
        
        PID:10716
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        415⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        416⤵
        Modifies registry class
        
        PID:10800
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        417⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        418⤵
        Modifies registry class
        
        PID:10892
        
        C:\Windows\SysWOW64\Ledepn32.exe
        
        C:\Windows\system32\Ledepn32.exe
        419⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        420⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        421⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        422⤵
        Drops file in System32 directory
        
        PID:11056
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        423⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        424⤵
        Drops file in System32 directory
        
        PID:11140
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        425⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        426⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        427⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        428⤵
        Drops file in System32 directory
        
        PID:10328
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        429⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        430⤵
        Modifies registry class
        
        PID:10472
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        431⤵
        Drops file in System32 directory
        
        PID:10532
        
        C:\Windows\SysWOW64\Mpclce32.exe
        
        C:\Windows\system32\Mpclce32.exe
        432⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        433⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        434⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10736
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        435⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        436⤵
        Modifies registry class
        
        PID:10884
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        437⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        438⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        439⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11084
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        440⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        441⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11216
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        442⤵
        Drops file in System32 directory
        
        PID:10288
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        443⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        444⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        445⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10640
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        446⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        447⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        448⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        449⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        450⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        451⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        452⤵
        Modifies registry class
        
        PID:10360
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        453⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        454⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10752
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        455⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        456⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        457⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Ocihgnam.exe
        
        C:\Windows\system32\Ocihgnam.exe
        458⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        459⤵
        Modifies registry class
        
        PID:10876
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        460⤵
        Modifies registry class
        
        PID:11064
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        461⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        462⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        463⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        464⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        465⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        466⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        467⤵
        Drops file in System32 directory
        
        PID:11372
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        468⤵
        
        PID:11416
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        469⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11460
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        470⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        471⤵
        Drops file in System32 directory
        
        PID:11564
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        472⤵
        Drops file in System32 directory
        
        PID:11608
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        473⤵
        
        PID:11652
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        474⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        475⤵
        Drops file in System32 directory
        
        PID:11740
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        476⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        477⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        478⤵
        Drops file in System32 directory
        
        PID:11864
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        479⤵
        
        PID:11908
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11908 -s 408
        480⤵
        Program crash
        
        PID:12012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 11908 -ip 11908
1⤵
PID:11988

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:10704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ackbmcjl.exe

Filesize
42KB

MD5
20d17a66bd891b444dd89d4d3b044c19

SHA1
6d104101b44cdf3f4373eecbd60d656d127b6f2e

SHA256
fc0f1237cfb6e37071a7ba2c126d3f0f31e7a3441137182b573cb2bd1585568a

SHA512
a0f2da2a17d6115970b8366ff63c4ec6705a8137201197985bf21a6fd6d7f661041c342681057798b37a28e1bcea04762578341861a9e644ed006a7a01ac645f

Download Submit
C:\Windows\SysWOW64\Ackbmcjl.exe

Filesize
42KB

MD5
20d17a66bd891b444dd89d4d3b044c19

SHA1
6d104101b44cdf3f4373eecbd60d656d127b6f2e

SHA256
fc0f1237cfb6e37071a7ba2c126d3f0f31e7a3441137182b573cb2bd1585568a

SHA512
a0f2da2a17d6115970b8366ff63c4ec6705a8137201197985bf21a6fd6d7f661041c342681057798b37a28e1bcea04762578341861a9e644ed006a7a01ac645f

Download Submit
C:\Windows\SysWOW64\Afkknogn.exe

Filesize
42KB

MD5
3e34ba074e001fa2cfe3e900c7ec3e4e

SHA1
4993a605891077e72567d388df6fa69a486b0b2e

SHA256
90f44af697918767e50fd71c9eee99f0078aa2a9ad4859395fd5062695aea732

SHA512
025e4a4c1b462945391885e9eb69e7addc32c05684358f605aaac9fed038c4ad333442a28d81e12ec4155cea8dd1aeef251459e38c04cda69924650e4a057dfc

Download Submit
C:\Windows\SysWOW64\Afkknogn.exe

Filesize
42KB

MD5
3e34ba074e001fa2cfe3e900c7ec3e4e

SHA1
4993a605891077e72567d388df6fa69a486b0b2e

SHA256
90f44af697918767e50fd71c9eee99f0078aa2a9ad4859395fd5062695aea732

SHA512
025e4a4c1b462945391885e9eb69e7addc32c05684358f605aaac9fed038c4ad333442a28d81e12ec4155cea8dd1aeef251459e38c04cda69924650e4a057dfc

Download Submit
C:\Windows\SysWOW64\Alcfei32.exe

Filesize
42KB

MD5
4fd9d2963795a88355fab0f14e137a40

SHA1
445e7b7b9eace5019692ee5680c27ebddb386000

SHA256
7f90c1d3b49b7767bfec4f3a9f9a9d76c4bda6224196f6a5a326f6777fc0ad58

SHA512
75a9423034faf0e05b072a2c490c9bdf63d4f6ed7d3a802965f03e45539b5fe827ad1d17984029e84c08ea29260a8a698be871027b470b341c2f8c3c782a9274

Download Submit
C:\Windows\SysWOW64\Alcfei32.exe

Filesize
42KB

MD5
4fd9d2963795a88355fab0f14e137a40

SHA1
445e7b7b9eace5019692ee5680c27ebddb386000

SHA256
7f90c1d3b49b7767bfec4f3a9f9a9d76c4bda6224196f6a5a326f6777fc0ad58

SHA512
75a9423034faf0e05b072a2c490c9bdf63d4f6ed7d3a802965f03e45539b5fe827ad1d17984029e84c08ea29260a8a698be871027b470b341c2f8c3c782a9274

Download Submit
C:\Windows\SysWOW64\Aodogdmn.exe

Filesize
42KB

MD5
c0ca08f6d1cc2295f378ac9bfa353c8e

SHA1
8fbed9add83ee4b338033226267a60a9a43bf897

SHA256
f7f8a07d271174a6cf4e4676811067a0187860b7a3782f3a4b0d99e31e59e2cf

SHA512
c0c02fd8db317a4bbd78c7194c51b873a0f2526cd042f0cb65458d05d5e839a509182502418612f50f05042c2decaa21dfe3f96337830594c4ed1c6b1d661d1e

Download Submit
C:\Windows\SysWOW64\Aodogdmn.exe

Filesize
42KB

MD5
c0ca08f6d1cc2295f378ac9bfa353c8e

SHA1
8fbed9add83ee4b338033226267a60a9a43bf897

SHA256
f7f8a07d271174a6cf4e4676811067a0187860b7a3782f3a4b0d99e31e59e2cf

SHA512
c0c02fd8db317a4bbd78c7194c51b873a0f2526cd042f0cb65458d05d5e839a509182502418612f50f05042c2decaa21dfe3f96337830594c4ed1c6b1d661d1e

Download Submit
C:\Windows\SysWOW64\Bbgeno32.exe

Filesize
42KB

MD5
b974d7f59ddf499ba5290cab9897e7dd

SHA1
4233314e63afcf1db630f897fd6596377a5020a3

SHA256
3fba70a54db3b912e4aca7ec94ffa314edbfb0be8dd7dde4798af29ea8ca696d

SHA512
7f37a13eb70aba2818257802cd8697388b70b5cb5274c2674ee2ddc502d78ed12f2f359b54277fedabb85c8bf0f16a1244ca8709e21811dc5e0c8f5a6c1c6003

Download Submit
C:\Windows\SysWOW64\Bbgeno32.exe

Filesize
42KB

MD5
b974d7f59ddf499ba5290cab9897e7dd

SHA1
4233314e63afcf1db630f897fd6596377a5020a3

SHA256
3fba70a54db3b912e4aca7ec94ffa314edbfb0be8dd7dde4798af29ea8ca696d

SHA512
7f37a13eb70aba2818257802cd8697388b70b5cb5274c2674ee2ddc502d78ed12f2f359b54277fedabb85c8bf0f16a1244ca8709e21811dc5e0c8f5a6c1c6003

Download Submit
C:\Windows\SysWOW64\Bheffh32.exe

Filesize
42KB

MD5
20cf497c50c19694ef73a6d524fc2fa2

SHA1
71d9bd7bb42bce53abe0de5b977c6c73fac14584

SHA256
d8695e1fd3e335e14e3972d8a06dda3d151a289f5d4fb0e3532390e0ac2509bc

SHA512
e570ee0baa9620fff11612684e5b6691ae370dbde0873a396324921865eb8876fd18c5bb6a505c9367ba2f724dc31776216ca16869504d97ce0b6bdd413c0e63

Download Submit
C:\Windows\SysWOW64\Bheffh32.exe

Filesize
42KB

MD5
20cf497c50c19694ef73a6d524fc2fa2

SHA1
71d9bd7bb42bce53abe0de5b977c6c73fac14584

SHA256
d8695e1fd3e335e14e3972d8a06dda3d151a289f5d4fb0e3532390e0ac2509bc

SHA512
e570ee0baa9620fff11612684e5b6691ae370dbde0873a396324921865eb8876fd18c5bb6a505c9367ba2f724dc31776216ca16869504d97ce0b6bdd413c0e63

Download Submit
C:\Windows\SysWOW64\Bjicdmmd.exe

Filesize
42KB

MD5
e0fb55adb2ed4336fef112f622cb6e37

SHA1
f9a28afcf388ba969465c2d3ef96fbf072d105fa

SHA256
85e18834526ea779346ebff4723b8e6d21bdc52c5cfce24ef7568a26ff50a56a

SHA512
21da8f3be0fc8f34d151d4ac294c0071e664b10d4f740a9e41716caa259a3482615ef30896a5972c4982b3f34005d8da21386e80afac5a4c48dafdac0aa9bece

Download Submit
C:\Windows\SysWOW64\Bjicdmmd.exe

Filesize
42KB

MD5
e0fb55adb2ed4336fef112f622cb6e37

SHA1
f9a28afcf388ba969465c2d3ef96fbf072d105fa

SHA256
85e18834526ea779346ebff4723b8e6d21bdc52c5cfce24ef7568a26ff50a56a

SHA512
21da8f3be0fc8f34d151d4ac294c0071e664b10d4f740a9e41716caa259a3482615ef30896a5972c4982b3f34005d8da21386e80afac5a4c48dafdac0aa9bece

Download Submit
C:\Windows\SysWOW64\Bjpjel32.exe

Filesize
42KB

MD5
3d8ea40e7c98a65fa84ef6e4152ae610

SHA1
b2baa7b01998bc3c5a6f462745a45dcfba5d0949

SHA256
0345f481840623d1a305a6eac1734162aaf70468a648a7a30bb13c5f2fe1086d

SHA512
aca2192e538baba18b08d35b75ad8a461d4d90895a389dc5627e3ce662093371b4e1ffd7eb130b9bdb80e84b2a141282e7d5ac23164b95ced055110df478f5a7

Download Submit
C:\Windows\SysWOW64\Bjpjel32.exe

Filesize
42KB

MD5
3d8ea40e7c98a65fa84ef6e4152ae610

SHA1
b2baa7b01998bc3c5a6f462745a45dcfba5d0949

SHA256
0345f481840623d1a305a6eac1734162aaf70468a648a7a30bb13c5f2fe1086d

SHA512
aca2192e538baba18b08d35b75ad8a461d4d90895a389dc5627e3ce662093371b4e1ffd7eb130b9bdb80e84b2a141282e7d5ac23164b95ced055110df478f5a7

Download Submit
C:\Windows\SysWOW64\Bkoigdom.exe

Filesize
42KB

MD5
3869b66367257137092620471bb04691

SHA1
3279b0cc41f5e908457ed58c2158d7c93876d8ca

SHA256
75160f784cf382e7a8e98ed4a2a9df89f999b02b051bb3df278f4687cd4a7c08

SHA512
e578629ccb1ae67105e3f5cfbd44f12dfc43a9179b19c5efadf7a08fdf2e338327465a274b1676e33bb7e6a87879e04b5f28a6485131e1daeadaf6f79718a142

Download Submit
C:\Windows\SysWOW64\Bkoigdom.exe

Filesize
42KB

MD5
3869b66367257137092620471bb04691

SHA1
3279b0cc41f5e908457ed58c2158d7c93876d8ca

SHA256
75160f784cf382e7a8e98ed4a2a9df89f999b02b051bb3df278f4687cd4a7c08

SHA512
e578629ccb1ae67105e3f5cfbd44f12dfc43a9179b19c5efadf7a08fdf2e338327465a274b1676e33bb7e6a87879e04b5f28a6485131e1daeadaf6f79718a142

Download Submit
C:\Windows\SysWOW64\Bkoigdom.exe

Filesize
42KB

MD5
3869b66367257137092620471bb04691

SHA1
3279b0cc41f5e908457ed58c2158d7c93876d8ca

SHA256
75160f784cf382e7a8e98ed4a2a9df89f999b02b051bb3df278f4687cd4a7c08

SHA512
e578629ccb1ae67105e3f5cfbd44f12dfc43a9179b19c5efadf7a08fdf2e338327465a274b1676e33bb7e6a87879e04b5f28a6485131e1daeadaf6f79718a142

Download Submit
C:\Windows\SysWOW64\Bljlfh32.exe

Filesize
42KB

MD5
8daff1ed4de4f31fd09a646b6ce2fac3

SHA1
cc0fb18363defeab5f12a9f94a4109b8a6ff3fe5

SHA256
2e9302c9f21a865dea8081a19bc7244062d8d4a336d5bc5acf7731b839f71b82

SHA512
32c6a4e38ad1fb00643d27833483819eb50a17c701d505f645d76e2b418a174388ce27eec578d233e55dcba055edc45ab36c65d6c778be4bfe27e7ad468c7e1b

Download Submit
C:\Windows\SysWOW64\Bljlfh32.exe

Filesize
42KB

MD5
8daff1ed4de4f31fd09a646b6ce2fac3

SHA1
cc0fb18363defeab5f12a9f94a4109b8a6ff3fe5

SHA256
2e9302c9f21a865dea8081a19bc7244062d8d4a336d5bc5acf7731b839f71b82

SHA512
32c6a4e38ad1fb00643d27833483819eb50a17c701d505f645d76e2b418a174388ce27eec578d233e55dcba055edc45ab36c65d6c778be4bfe27e7ad468c7e1b

Download Submit
C:\Windows\SysWOW64\Bmofagfp.exe

Filesize
42KB

MD5
e7724c30d4c9ecf763e0bb01d6431702

SHA1
5bca4bc7fd8905875211ae5b2a14a956ec54a519

SHA256
3d7dd4f48397ec173b7a97f0dcc16b0953eba88e64433929914d3023c65505b5

SHA512
4cf8b06abf6a72c7d780d21585e2b75590b64e6c69ffdaf5344558829780d6f57e10d80b572d4f1d10cc2234ffdd40dfd4b6d724d82558a8f9617b5091e36687

Download Submit
C:\Windows\SysWOW64\Bmofagfp.exe

Filesize
42KB

MD5
e7724c30d4c9ecf763e0bb01d6431702

SHA1
5bca4bc7fd8905875211ae5b2a14a956ec54a519

SHA256
3d7dd4f48397ec173b7a97f0dcc16b0953eba88e64433929914d3023c65505b5

SHA512
4cf8b06abf6a72c7d780d21585e2b75590b64e6c69ffdaf5344558829780d6f57e10d80b572d4f1d10cc2234ffdd40dfd4b6d724d82558a8f9617b5091e36687

Download Submit
C:\Windows\SysWOW64\Boflmdkk.exe

Filesize
42KB

MD5
4abc3abf77430ddbae6ca362ab6b465d

SHA1
2114a3e3d6465d26919782fdeb59f5345ed2562e

SHA256
244b3f335eb9204181a56e4989671b31e54c0efe8ba077278199eb3ac2238481

SHA512
b18e62d04aa81b861ad43e42280ac35b09f9f1631cfdeaedb08cfd5de348654a2c32b37eaf77685dc4c96d1b4636e4298fa3d92bd543f43ccaeed3d95240c751

Download Submit
C:\Windows\SysWOW64\Boflmdkk.exe

Filesize
42KB

MD5
4abc3abf77430ddbae6ca362ab6b465d

SHA1
2114a3e3d6465d26919782fdeb59f5345ed2562e

SHA256
244b3f335eb9204181a56e4989671b31e54c0efe8ba077278199eb3ac2238481

SHA512
b18e62d04aa81b861ad43e42280ac35b09f9f1631cfdeaedb08cfd5de348654a2c32b37eaf77685dc4c96d1b4636e4298fa3d92bd543f43ccaeed3d95240c751

Download Submit
C:\Windows\SysWOW64\Cbbdjm32.exe

Filesize
42KB

MD5
e2fa74e0523b0ff1fbe7b8f2f6e1b2fa

SHA1
993dd1ac31f9d20339211d2cc2364ee628fb067f

SHA256
6119156f9edc259cf841c5bfb3fb2dc2b8b51379c363dfb414be810b480766ef

SHA512
183cd110f76ca46fefec03e310f9127398a9d6657918d85f6ba630112be9a1d45041e2a0f6a1060f98fcb41eebfbdc4f496ee0d03aab1dc2b272a2ffcb446e5a

Download Submit
C:\Windows\SysWOW64\Cbbdjm32.exe

Filesize
42KB

MD5
e2fa74e0523b0ff1fbe7b8f2f6e1b2fa

SHA1
993dd1ac31f9d20339211d2cc2364ee628fb067f

SHA256
6119156f9edc259cf841c5bfb3fb2dc2b8b51379c363dfb414be810b480766ef

SHA512
183cd110f76ca46fefec03e310f9127398a9d6657918d85f6ba630112be9a1d45041e2a0f6a1060f98fcb41eebfbdc4f496ee0d03aab1dc2b272a2ffcb446e5a

Download Submit
C:\Windows\SysWOW64\Cfigpm32.exe

Filesize
42KB

MD5
be19a5b4bdcec0dcbdef6fdb7e3ea67b

SHA1
4e2345546251e558e6dbbf414a41b18e8b08c895

SHA256
5f8607f43c691388fcc0412b5f431db4bf610a0b29058756fb9ee37f49ede0b7

SHA512
2d04426cd23af7998a5cf95a627440e62e8ecd2239fbc01bd5e176df2fb9089255661be966b8962dcb078d5eb0a87b9199ecc9b82d65eb307efaa8b0f592f62c

Download Submit
C:\Windows\SysWOW64\Cfigpm32.exe

Filesize
42KB

MD5
be19a5b4bdcec0dcbdef6fdb7e3ea67b

SHA1
4e2345546251e558e6dbbf414a41b18e8b08c895

SHA256
5f8607f43c691388fcc0412b5f431db4bf610a0b29058756fb9ee37f49ede0b7

SHA512
2d04426cd23af7998a5cf95a627440e62e8ecd2239fbc01bd5e176df2fb9089255661be966b8962dcb078d5eb0a87b9199ecc9b82d65eb307efaa8b0f592f62c

Download Submit
C:\Windows\SysWOW64\Cfqmpl32.exe

Filesize
42KB

MD5
1b0257c910e9ab2a78e9ce02a910a8cf

SHA1
22805286a4757aa6d2b04112b92a3f359e942cba

SHA256
61ea37acce970b5a965b5fa3b8191c85c43099b2e3dd337e72613eae2776b936

SHA512
10436afad6c4b96104ad98f2efe6b44dcb1f233b2389dd7b1338fa1421a70f0f84e8e11eeb10358b15add16526094a7ec1432a4e527a5036f54dc8878f7b8169

Download Submit
C:\Windows\SysWOW64\Cfqmpl32.exe

Filesize
42KB

MD5
1b0257c910e9ab2a78e9ce02a910a8cf

SHA1
22805286a4757aa6d2b04112b92a3f359e942cba

SHA256
61ea37acce970b5a965b5fa3b8191c85c43099b2e3dd337e72613eae2776b936

SHA512
10436afad6c4b96104ad98f2efe6b44dcb1f233b2389dd7b1338fa1421a70f0f84e8e11eeb10358b15add16526094a7ec1432a4e527a5036f54dc8878f7b8169

Download Submit
C:\Windows\SysWOW64\Chglab32.exe

Filesize
42KB

MD5
2168627f472651a735f7ce326d7d0e23

SHA1
9f8d1d57543d89a7717ece59ae0612da1fc6f4a3

SHA256
afcd16b2a2f3b3eb8cf5ea7ddb4c58f3e1b2264df6311f7b4c55cda2117994ec

SHA512
3005bc4d48cdbce4bba281db3569827d3bc74472d4d8d646f78f8d31fa68cb5cbf520c3da1c6fb560c34bf6f7cd57146fae40149693d0030787d2028de0345ca

Download Submit
C:\Windows\SysWOW64\Cjnffjkl.exe

Filesize
42KB

MD5
142b744a32f9b99d30f15e370f43b9a0

SHA1
141a3c5174cde331416e9f1fb7f9661e74d4a034

SHA256
3ed359f4968baae9fc12d92389dc60d400f5b3a8d3c07a529c7ab0b6a9f585b4

SHA512
2d79da0e76525b4e40cf455e67ef1389d2e0af6ce02e2fd5203933db32358d7e6b7b65cdbde6c06e75d51d07b9473d20808297949f41e4a9b5c1d9869f923e28

Download Submit
C:\Windows\SysWOW64\Cjnffjkl.exe

Filesize
42KB

MD5
142b744a32f9b99d30f15e370f43b9a0

SHA1
141a3c5174cde331416e9f1fb7f9661e74d4a034

SHA256
3ed359f4968baae9fc12d92389dc60d400f5b3a8d3c07a529c7ab0b6a9f585b4

SHA512
2d79da0e76525b4e40cf455e67ef1389d2e0af6ce02e2fd5203933db32358d7e6b7b65cdbde6c06e75d51d07b9473d20808297949f41e4a9b5c1d9869f923e28

Download Submit
C:\Windows\SysWOW64\Ckilmcgb.exe

Filesize
42KB

MD5
bacc81da1c9e06e0ab87ed4d3a71f6cb

SHA1
665caa1cbba67c26149ae1a7d4d2131e869d2d19

SHA256
8e300b81b6966c7f2122391d3ae878527269ce5ac34e94a4aa9353cb0a6e2f4a

SHA512
07cf37a874e92e3e5bf76386bc6f06cacc583147606d5f94c215f4283d87ae2b299d41d8a2aea86453a64de01f09746091096daa3340f4f976daf0eb635d97fa

Download Submit
C:\Windows\SysWOW64\Ckilmcgb.exe

Filesize
42KB

MD5
bacc81da1c9e06e0ab87ed4d3a71f6cb

SHA1
665caa1cbba67c26149ae1a7d4d2131e869d2d19

SHA256
8e300b81b6966c7f2122391d3ae878527269ce5ac34e94a4aa9353cb0a6e2f4a

SHA512
07cf37a874e92e3e5bf76386bc6f06cacc583147606d5f94c215f4283d87ae2b299d41d8a2aea86453a64de01f09746091096daa3340f4f976daf0eb635d97fa

Download Submit
C:\Windows\SysWOW64\Ckpbnb32.exe

Filesize
42KB

MD5
9dd6288096bd7001baa8991139b1066f

SHA1
50c473997fa0d159265a77121fc080f7ea6459fe

SHA256
257ba94b3c1dbda08a31a6c5a6aee95863b9bf49f553e68d305114b039a6dbef

SHA512
f3cf456a46819dffde10cb166af910fecd2fc0ab935194c81fa81d08d5ff6521d7b21663954af90b018be9e0606f7d671a5ffabab681809d2b37c30d1a185b64

Download Submit
C:\Windows\SysWOW64\Ckpbnb32.exe

Filesize
42KB

MD5
9dd6288096bd7001baa8991139b1066f

SHA1
50c473997fa0d159265a77121fc080f7ea6459fe

SHA256
257ba94b3c1dbda08a31a6c5a6aee95863b9bf49f553e68d305114b039a6dbef

SHA512
f3cf456a46819dffde10cb166af910fecd2fc0ab935194c81fa81d08d5ff6521d7b21663954af90b018be9e0606f7d671a5ffabab681809d2b37c30d1a185b64

Download Submit
C:\Windows\SysWOW64\Cobkhb32.exe

Filesize
42KB

MD5
68d68ce44ad80a207bdb5687d30a7ea9

SHA1
c58c6056891ec1a099d9da5b6ff35d7bebb1d6fb

SHA256
50427d886a932d872d064c5947dd21c6d8407dc3d5b82a52b99e8d04a218014c

SHA512
f105e6903342029096966da0002c0d5820c9a3ddc6f197f3d92a3f53047cf08d5fe640c5bfa25cd38bd409c9214452caa9e6982f4ad6f120c253cc056bab2cea

Download Submit
C:\Windows\SysWOW64\Cobkhb32.exe

Filesize
42KB

MD5
68d68ce44ad80a207bdb5687d30a7ea9

SHA1
c58c6056891ec1a099d9da5b6ff35d7bebb1d6fb

SHA256
50427d886a932d872d064c5947dd21c6d8407dc3d5b82a52b99e8d04a218014c

SHA512
f105e6903342029096966da0002c0d5820c9a3ddc6f197f3d92a3f53047cf08d5fe640c5bfa25cd38bd409c9214452caa9e6982f4ad6f120c253cc056bab2cea

Download Submit
C:\Windows\SysWOW64\Cofecami.exe

Filesize
42KB

MD5
f3b25cefbb5ce8e28a0cf65ed2485940

SHA1
1ed68dd736f5e23101748dc93180be7cd4d7ef77

SHA256
5905f5d85441590ee1b4126a0a794094a1035450ddf98b34ae9580ee1f0d0090

SHA512
02db419ebcbae93036c1f17b9e8efa39cf5f96d15a375bf283d9efb33afb9734840ce7fb65b2d7c424292ff18bc572a2c48b978c9062ed3de8704fd52421c699

Download Submit
C:\Windows\SysWOW64\Cofecami.exe

Filesize
42KB

MD5
f3b25cefbb5ce8e28a0cf65ed2485940

SHA1
1ed68dd736f5e23101748dc93180be7cd4d7ef77

SHA256
5905f5d85441590ee1b4126a0a794094a1035450ddf98b34ae9580ee1f0d0090

SHA512
02db419ebcbae93036c1f17b9e8efa39cf5f96d15a375bf283d9efb33afb9734840ce7fb65b2d7c424292ff18bc572a2c48b978c9062ed3de8704fd52421c699

Download Submit
C:\Windows\SysWOW64\Coiaiakf.exe

Filesize
42KB

MD5
8494ba948a8364e2f8dafeb58cbae621

SHA1
d3cdd824132472243f0fa72920193bea485ca36b

SHA256
bcd1e18a7fa672921c191becfe942cd6044083aa207a8999c7f2752ceeb3c8cb

SHA512
d1f2a0391c2bf01718aabf18a1abb1bb27ea6dc76700bcca2c0f36feba65262f3573aae7beaa798e54a75aa356d0f5bbeb0333195fcbf3704e9498b6ad42aaa1

Download Submit
C:\Windows\SysWOW64\Coiaiakf.exe

Filesize
42KB

MD5
8494ba948a8364e2f8dafeb58cbae621

SHA1
d3cdd824132472243f0fa72920193bea485ca36b

SHA256
bcd1e18a7fa672921c191becfe942cd6044083aa207a8999c7f2752ceeb3c8cb

SHA512
d1f2a0391c2bf01718aabf18a1abb1bb27ea6dc76700bcca2c0f36feba65262f3573aae7beaa798e54a75aa356d0f5bbeb0333195fcbf3704e9498b6ad42aaa1

Download Submit
C:\Windows\SysWOW64\Dbcmakpl.exe

Filesize
42KB

MD5
b31a5ee4a6051bbe82ae2f072aca2126

SHA1
138a0b0f136964745d8613f04c5ace4bf45318bb

SHA256
41e19023092bf1e20a7f0e42e102a68818c103c14e41277722e780d7f9d10777

SHA512
23795b4777361ea527cbfdeb50c0e1f0c9a3f088a36d6142578005c90d1078d7c73bd27ce2740dc64e68963ef557548a1e3dc2230fe572b0c88149211ab63f1d

Download Submit
C:\Windows\SysWOW64\Dbcmakpl.exe

Filesize
42KB

MD5
b31a5ee4a6051bbe82ae2f072aca2126

SHA1
138a0b0f136964745d8613f04c5ace4bf45318bb

SHA256
41e19023092bf1e20a7f0e42e102a68818c103c14e41277722e780d7f9d10777

SHA512
23795b4777361ea527cbfdeb50c0e1f0c9a3f088a36d6142578005c90d1078d7c73bd27ce2740dc64e68963ef557548a1e3dc2230fe572b0c88149211ab63f1d

Download Submit
C:\Windows\SysWOW64\Dbjkkl32.exe

Filesize
42KB

MD5
b873413d1b7f62a9b81562dfcc407a7c

SHA1
db2e9ea3735b7ceebdeb572d7821d00c7d09fe22

SHA256
4f1ffea559f66a523860ee17178e55488c1042ab2200646b50b0f58bbe81de43

SHA512
f7dbe17263b95e7f041a9243cb990e6becc9247250741b27f79c7425d9b4ea3e006d8e3485fd6a8fade0f2f1e694e965eca2f53fef8ac7cef601175be18ea866

Download Submit
C:\Windows\SysWOW64\Dbjkkl32.exe

Filesize
42KB

MD5
b873413d1b7f62a9b81562dfcc407a7c

SHA1
db2e9ea3735b7ceebdeb572d7821d00c7d09fe22

SHA256
4f1ffea559f66a523860ee17178e55488c1042ab2200646b50b0f58bbe81de43

SHA512
f7dbe17263b95e7f041a9243cb990e6becc9247250741b27f79c7425d9b4ea3e006d8e3485fd6a8fade0f2f1e694e965eca2f53fef8ac7cef601175be18ea866

Download Submit
C:\Windows\SysWOW64\Dblgpl32.exe

Filesize
42KB

MD5
ea377e932b237d0d427635a6d90391df

SHA1
2d907edc7665407a7564a1b499ec17ac39cba5ca

SHA256
851bfa917ab78846008cdc2f105f29f4b4c7420616841cb04f0aae2bd616e404

SHA512
2ff184d07e3735b6ae5d4a1e08da2233b9bb8577045cd733158b48e8f32f792021eece3f0196936909114a553fc8c8474541ea490a882a244620e50ac4d44f94

Download Submit
C:\Windows\SysWOW64\Dblgpl32.exe

Filesize
42KB

MD5
ea377e932b237d0d427635a6d90391df

SHA1
2d907edc7665407a7564a1b499ec17ac39cba5ca

SHA256
851bfa917ab78846008cdc2f105f29f4b4c7420616841cb04f0aae2bd616e404

SHA512
2ff184d07e3735b6ae5d4a1e08da2233b9bb8577045cd733158b48e8f32f792021eece3f0196936909114a553fc8c8474541ea490a882a244620e50ac4d44f94

Download Submit
C:\Windows\SysWOW64\Dihlbf32.exe

Filesize
42KB

MD5
213a0177ba2f69fad872cbd9ef66e13b

SHA1
55f32d9d0d5924b9b9f4d3e33abbaba8f6adcb87

SHA256
f04f6b8167d0454607a05ba841569b86bfe4b8855ed92c31394e27fcd815e828

SHA512
fe6f2614812d83433e8b42bb9224257f06bc5ad5f89103782c9fa196e92ff9883e3ca6e1df81c4933e32dc95c00c2e749db184885151646f1c0154dd610df55c

Download Submit
C:\Windows\SysWOW64\Dihlbf32.exe

Filesize
42KB

MD5
213a0177ba2f69fad872cbd9ef66e13b

SHA1
55f32d9d0d5924b9b9f4d3e33abbaba8f6adcb87

SHA256
f04f6b8167d0454607a05ba841569b86bfe4b8855ed92c31394e27fcd815e828

SHA512
fe6f2614812d83433e8b42bb9224257f06bc5ad5f89103782c9fa196e92ff9883e3ca6e1df81c4933e32dc95c00c2e749db184885151646f1c0154dd610df55c

Download Submit
C:\Windows\SysWOW64\Djhimica.exe

Filesize
42KB

MD5
9d656b0111cca940a154961ca711436c

SHA1
a17d9abcc8713f053e30680cb576fc989a9c3a9a

SHA256
3f4798f34eae354ae17c8221f7d40aa9a66e59dfb660670e8da06a91492b2836

SHA512
3775571e89a71cf10cb6abe4deb7c92f73665536706e24d9c2149de34e4471a7e31bc087392150dfd49743ed6815a37b357619a8040c9c64e34cea8eaf0607bd

Download Submit
C:\Windows\SysWOW64\Djhimica.exe

Filesize
42KB

MD5
9d656b0111cca940a154961ca711436c

SHA1
a17d9abcc8713f053e30680cb576fc989a9c3a9a

SHA256
3f4798f34eae354ae17c8221f7d40aa9a66e59dfb660670e8da06a91492b2836

SHA512
3775571e89a71cf10cb6abe4deb7c92f73665536706e24d9c2149de34e4471a7e31bc087392150dfd49743ed6815a37b357619a8040c9c64e34cea8eaf0607bd

Download Submit
C:\Windows\SysWOW64\Dmoohe32.exe

Filesize
42KB

MD5
ee34978962a17f38c07f50d3c0ce7391

SHA1
309e05cb1cf7dbfeba99e1e5e191b2972321851f

SHA256
77aacb2ea963f6b08e588f58537d6e504a2d6059bd9e14a696c8c0c3980e224f

SHA512
c849ca5e59b3c0a93470100752b0678a71d98483e11e2223b8e2ef7d38ffd1690d4936df35f9e65af93522842e486de3f1638882f3270a3f70e328d735bfba55

Download Submit
C:\Windows\SysWOW64\Dmoohe32.exe

Filesize
42KB

MD5
ee34978962a17f38c07f50d3c0ce7391

SHA1
309e05cb1cf7dbfeba99e1e5e191b2972321851f

SHA256
77aacb2ea963f6b08e588f58537d6e504a2d6059bd9e14a696c8c0c3980e224f

SHA512
c849ca5e59b3c0a93470100752b0678a71d98483e11e2223b8e2ef7d38ffd1690d4936df35f9e65af93522842e486de3f1638882f3270a3f70e328d735bfba55

Download Submit
C:\Windows\SysWOW64\Dpbdopck.exe

Filesize
42KB

MD5
9b482230bc0ba0e6e465b3ae6b5274f3

SHA1
f873ffd1d0997069f82ac14fd307ca750c7a7487

SHA256
b171aa13ae49d679fbbfa4d6e66a53e6b3a1871953f219ce88c51f1e5b05a6bb

SHA512
4008e11917f1bb004389edf13d941f946adb90f0f4f17ffaff3fe0a7d3eb0418c87d80d810ce0fdd7d240595df5b85745d675fce3eb70e37b4d580715f32eeb3

Download Submit
C:\Windows\SysWOW64\Dpbdopck.exe

Filesize
42KB

MD5
9b482230bc0ba0e6e465b3ae6b5274f3

SHA1
f873ffd1d0997069f82ac14fd307ca750c7a7487

SHA256
b171aa13ae49d679fbbfa4d6e66a53e6b3a1871953f219ce88c51f1e5b05a6bb

SHA512
4008e11917f1bb004389edf13d941f946adb90f0f4f17ffaff3fe0a7d3eb0418c87d80d810ce0fdd7d240595df5b85745d675fce3eb70e37b4d580715f32eeb3

Download Submit
C:\Windows\SysWOW64\Dpdaepai.exe

Filesize
42KB

MD5
a42b5d2aa57b715a15dd8129970d9804

SHA1
dbc880de5f54bb5e084dc63176fec3db20feae1e

SHA256
7b7cf40c82373dbdf540fdfafe94aa2184566fef1d09e085b9a6889430b674fd

SHA512
99a6e4f1b4cd2f3e078bef817008ef6dabd0bfb27ab141f801584baf0b65178739c10cf16c5265abb1be94b7fb5325027fae06bd782ced88d6aea377e7fc416b

Download Submit
C:\Windows\SysWOW64\Dpdaepai.exe

Filesize
42KB

MD5
a42b5d2aa57b715a15dd8129970d9804

SHA1
dbc880de5f54bb5e084dc63176fec3db20feae1e

SHA256
7b7cf40c82373dbdf540fdfafe94aa2184566fef1d09e085b9a6889430b674fd

SHA512
99a6e4f1b4cd2f3e078bef817008ef6dabd0bfb27ab141f801584baf0b65178739c10cf16c5265abb1be94b7fb5325027fae06bd782ced88d6aea377e7fc416b

Download Submit
C:\Windows\SysWOW64\Dpphjp32.exe

Filesize
42KB

MD5
9ba322bf870955690cc425f2ecfe248b

SHA1
b368c47f99d944e1c174f73a05ed58fa566895a2

SHA256
7e3f78db286819a00a916d91149a2717d440a61d1e52fda14d995518a230498e

SHA512
91856c1aade838eaf7a48442e86a6c6f0ae3396c4f07bb8324655c7daca6bf6821c45a7a48f3a17bccb2f18429cfc2bc42b3361c2c3a839eb4be732e27690877

Download Submit
C:\Windows\SysWOW64\Dpphjp32.exe

Filesize
42KB

MD5
9ba322bf870955690cc425f2ecfe248b

SHA1
b368c47f99d944e1c174f73a05ed58fa566895a2

SHA256
7e3f78db286819a00a916d91149a2717d440a61d1e52fda14d995518a230498e

SHA512
91856c1aade838eaf7a48442e86a6c6f0ae3396c4f07bb8324655c7daca6bf6821c45a7a48f3a17bccb2f18429cfc2bc42b3361c2c3a839eb4be732e27690877

Download Submit
C:\Windows\SysWOW64\Ecbjkngo.exe

Filesize
42KB

MD5
165dd1abd661b9d38f651e86559e98e8

SHA1
4ea666ad3f33aeeda8f4cff4805ffed02f21bf52

SHA256
f71e070aafa44752b510600fb4d8e545282b6d74b36ad99a1362ba6a97fb53c5

SHA512
539b22480fe9c505c69eb59fb1281a965e0f8152a813f8e3703648ae6d1ea1cbdd92a7fb8201e85cc100a3cf85c80e82fad3223ff5e5467319fb94d27b5a9dae

Download Submit
C:\Windows\SysWOW64\Ecbjkngo.exe

Filesize
42KB

MD5
165dd1abd661b9d38f651e86559e98e8

SHA1
4ea666ad3f33aeeda8f4cff4805ffed02f21bf52

SHA256
f71e070aafa44752b510600fb4d8e545282b6d74b36ad99a1362ba6a97fb53c5

SHA512
539b22480fe9c505c69eb59fb1281a965e0f8152a813f8e3703648ae6d1ea1cbdd92a7fb8201e85cc100a3cf85c80e82fad3223ff5e5467319fb94d27b5a9dae

Download Submit
C:\Windows\SysWOW64\Ehndnh32.exe

Filesize
42KB

MD5
dc21ddc3f2c61599772c57b6853dcf9b

SHA1
aa057cb0e99365c29cf1bec218effdf01777c8a8

SHA256
4a5b3151b7bc4d61faf324deaf6e4f25883ca0349b544050bfbbe488533f2883

SHA512
b90f6b0535d95850360d76a36b4f751acc7c2f2fc8dd4cd134bf71d7af4734081a644f77835fc559fa5f8a8746df3be17611f141c6f3eb05fe44c57c394f00ef

Download Submit
C:\Windows\SysWOW64\Eiobceef.exe

Filesize
42KB

MD5
f6fd66d2cdee318aa78e85f7c4033463

SHA1
337413aea8e6dbcfe353f8f6e501d40246e87a99

SHA256
ba5b03c50ae0da4bd5c4fb33922995553932f8440a509070ffcbd968b6fa605e

SHA512
422445e77ee24e0e44215bc51e75c517fa6f8c2785955972c0fc2954c04f6a42d58092afabfbca302fff595fd4c433082ae5fffb231b8785ba5868e7c4df04bc

Download Submit
C:\Windows\SysWOW64\Eiobceef.exe

Filesize
42KB

MD5
f6fd66d2cdee318aa78e85f7c4033463

SHA1
337413aea8e6dbcfe353f8f6e501d40246e87a99

SHA256
ba5b03c50ae0da4bd5c4fb33922995553932f8440a509070ffcbd968b6fa605e

SHA512
422445e77ee24e0e44215bc51e75c517fa6f8c2785955972c0fc2954c04f6a42d58092afabfbca302fff595fd4c433082ae5fffb231b8785ba5868e7c4df04bc

Download Submit
C:\Windows\SysWOW64\Eqiibjlj.exe

Filesize
42KB

MD5
fb75228c9d1b108cd5ed2e49860d4178

SHA1
c79b0994fc3e1cfeada5d5d06d7f97f52f4c7dfb

SHA256
5705059833be2a3e4e4efdfdfddbd0884a33c4cfdf3343ce6a36a281ea6dd35c

SHA512
d91b017b16f0a9a70c5dfbce55a0ecede327e0de8247395d7ec80f2b2ffaf0b243377bc5cef09da529f1235e887ba0986cd8609fc2a4f006396e94929a788cbb

Download Submit
C:\Windows\SysWOW64\Glhimp32.exe

Filesize
42KB

MD5
affb91cc305bac81f7e098ead24bef58

SHA1
cae66c76dac3c971f5074a0bcfca9f13ea9fa226

SHA256
492dce39bf3b0ecb1743c64d4ce178504fec55cb20cfc88df916956a385bac9d

SHA512
7ed65b8a8df4baea870acc5ea64a401178cd03cf875b3fe02fc901941cbfdbce9c1fa42c3d295e872c85fb9e3ebb9c6828c1e3432ffd7a7565aaaa25fe17044d

Download Submit
C:\Windows\SysWOW64\Hfaajnfb.exe

Filesize
42KB

MD5
1f2dee22a86a2013a8cc70bca99a9492

SHA1
2a4e91f361cf37434ed95934f79f98cf9fba903d

SHA256
284135a340d90209087a611c16e4148f149041deac90b0bb86e01fed5f60dfe2

SHA512
d9601dda679792d9648f683f1d9033f46a8d2971485f1bd9a221a064603eb84c2d5d8e28b975a8606f2aeec22b90c26a7ed16073f39c50549f8e1c491d66c2f5

Download Submit
C:\Windows\SysWOW64\Ibcaknbi.exe

Filesize
42KB

MD5
a7cc39c1dd9340e49553154a1c059222

SHA1
8ca20b34501c52e89e92d7e3c4394a6619f94f84

SHA256
d924f07d58650ee55dbf0dfbf87f1d4a6dda6f54dddf03620d57eb9360f89d3b

SHA512
98b116424b5667ed559e601def8a843736b0bf8ce4d463ad53a0e38436167b5e8b3d25f94ac542a5f165cb7c4f7db87b21081e51ceb99ce6fa9e806f83b637f9

Download Submit
C:\Windows\SysWOW64\Iciaqc32.exe

Filesize
42KB

MD5
4b43593916c194fe92506180b4ab61eb

SHA1
4f83982754ac9d6e67635c7fa043b88f072d25ac

SHA256
9e39491e8515e6bf26e6f41359854f720420e6844e0ed8ab6cfa98af06b6a915

SHA512
0a8fa84de90b064663f80002104be913de6825a7772325aa2bbf25cdb7fdf61fcfbb33720b8dcc76f93d3a694bf51684599fc1666c82b70169c774579c72afbf

Download Submit
C:\Windows\SysWOW64\Jbccge32.exe

Filesize
42KB

MD5
c03ff065d938a55a7f10db9f7070976b

SHA1
d4ee19268ed7aeb352c08a5321792aedf038fcb2

SHA256
bc57db94b10a27d9ea9a77a4ebe60d177df65a4bc9c8e9805cb4765352169e0b

SHA512
5cefe79fc5ff79ef3035bd85d19fc40d291165fefb5933575f8992c610d99a08995fa440e68e9c951eb655752cc7bb7547a439921e4290feec81455ae4cb74aa

Download Submit
C:\Windows\SysWOW64\Jblmgf32.exe

Filesize
42KB

MD5
044d408a9a64a2be0f711d98c401148f

SHA1
f816b7cdc74b1c19c33c5346f185028dac25a41d

SHA256
ea1e6f66d6c01a023ad9b7cea9029af4acfb424c4b2eab8be6f67dcaa5ae617c

SHA512
6f51be0f9a755b4c0e03e2ba1ae38e52e80a153a28b2684cc3771087a030902b21960be31ea01be2412c2b82401a7c1a9edca4d9a0a904b4a8079f20a8f34c0c

Download Submit
C:\Windows\SysWOW64\Jenmcggo.exe

Filesize
42KB

MD5
3d2d8ac8d70f401e2fefed769eb58fa2

SHA1
a364a2cf754cf6ddde7e6e9ca6a3575543ad1c4f

SHA256
0e22757df70075470c5deff141becc20992a91fb44540f3fef8d2d963e92d8cb

SHA512
b35f6edd2c1afc16ba687404630db75a6ea9d15a3c2e67f8a97a61f2c799bab48135e28ebccc6ba12a9aad9453705122aeb98fe6ef8498589fe791c299d3893a

Download Submit
C:\Windows\SysWOW64\Jojdlfeo.exe

Filesize
42KB

MD5
7e9f3ec193577a84bf17b06aaedd346c

SHA1
a99ae66e80870b7cf5d272e2f3d305eb34c88fb9

SHA256
0147b25febc8d89f6061b7428bd3026ba357f41d33ad70a875d1c325f643fb1c

SHA512
bd54ff7978c9ac70446a7939ae02b34f1753fbeaddcb02a1bdba07472a8cfa289e0fb9ab4980d7f5e11d341f2a606b12c890bf0883b5e2775f9e48adb9395b80

Download Submit
C:\Windows\SysWOW64\Jpaleglc.exe

Filesize
42KB

MD5
57e38cc35e395ca062f952284bb1fa91

SHA1
259e0d127a823d76838f61a2854fdbd547071b4d

SHA256
ca30f118803cf060d9093a2b7133a8470dc376252dbc62f296e03b42049a2db4

SHA512
2598a16053bdc48b90463301163e76350b419f028ee6cfb942ebe61bc1b3afb825f05de1c21483f01113a11b172e68b706fa95e95cf1fe489f35c6fd30271c31

Download Submit
C:\Windows\SysWOW64\Khlklj32.exe

Filesize
42KB

MD5
683f8efdb71ede921399e00be2797898

SHA1
cc97bec75106499769445bc9ae6b83a4820b2562

SHA256
ad9a875ce6ec6ef0b085f261fc657068f13e55bb83e3cde4df0211a5a041621d

SHA512
b387b214fd22011c86dd3e27d08b34fb161d2049f01bc3aaf3a7818f2abe34a2797ec4f7f2b1fd5f743e1496fd3070b37f5d4ad43117fd678ed3f3ab6081302f

Download Submit
C:\Windows\SysWOW64\Lfgipd32.exe

Filesize
42KB

MD5
11e53e5b9cf133cabd81957377c97dc0

SHA1
db1b200b2569e29adb4848686381f4b34ff0f482

SHA256
93a1052cba56dce843f8c9bbd040d5b9a5b9e5f322db3443ffe430878a679598

SHA512
ee16b30e1ab1221a77d364aa67d5e5f3f4fa32e45b179a340a8daeb4d937bbda5a85ba8c2ee10e396324d91ff52a9c58ced604870cc8ca2aaff0256d8e60d0c7

Download Submit
C:\Windows\SysWOW64\Lgibpf32.exe

Filesize
42KB

MD5
0e09653c6757075c12b68439d7a9b0cc

SHA1
7848115041372d47429c714c322147c837bbaf5a

SHA256
dac9f36d8813c946bd4c525c63f9cb191a6ae1a3ed11350e6ac2659a80570471

SHA512
b871e702b6dda0034794a6d0abd0660bb3c516325aaa5c9cc9f41071e3a7883a70398eee463025ff050bb2e6783925a47c07fdecd7133aca9da6f571df881e41

Download Submit
C:\Windows\SysWOW64\Mcgiefen.exe

Filesize
42KB

MD5
39f4bde58406cc6621542424fd6801a0

SHA1
a50252f9d54d07f5ef0c496ad2e917131b58f6d5

SHA256
095976a8c932a381bc9c1e78b77a9e5aede6fe2476c0e954adc68a6d05340f71

SHA512
cb0ff2e94404fd8087deb1cd426f15502c739e22a12064b80b96b92391b01ddf247fa4429692a73ef7295623b96c7d88fe089ce59443394aa55546b62bced544

Download Submit
C:\Windows\SysWOW64\Mgphpe32.exe

Filesize
42KB

MD5
a43634c059a1bc861669baee56976b88

SHA1
9f94311f5f0909aec38ae083c1154db89e1e9e08

SHA256
35df86723542697224171ef96990863b69604751a16a19911854b305cbea025f

SHA512
d730306336bbc0c3b390fd896279785103b252709ffd8543fe3df267bbf812469b2272832a7a643801bc2f644025642e5e27bb20b9296152fc47dbfdf4adff1b

Download Submit
C:\Windows\SysWOW64\Mmpdhboj.exe

Filesize
42KB

MD5
04862d8df90371ab7b175cc6737f7370

SHA1
a12cab0abc7e888504123a14f8b8369cb78753a6

SHA256
c6ccc8a79f4a0734807ab0645f91eecf7d73af4df4df9eaf5fad7343c274c06f

SHA512
47e4231225a66dfb8e0a0977d77ad11eb7daef74a889ecfb6bdd1cacc7606d138cf6b9c48d39287abdda3928369ea31bb83b95a2ae9b3ef0ab434aca4254d01c

Download Submit
C:\Windows\SysWOW64\Mpeiie32.exe

Filesize
42KB

MD5
7cc35bdb73cf4956e734d380e5c2b6c3

SHA1
81a4a86b3b073dfce0bd0e8e0072037ea8492a3d

SHA256
fab9e5a4cd19ec4cb9c2a126fe1b9917d1274c4f78f9d9c6f6d90a24962dfe8c

SHA512
104e46ebbba88106f266aad662681eed950a97e4c4a797f359e955d2cea38b1d4ae729453fb9fe4985b7502516f8e42e6cdc82f56ed3013edbe48f041d665218

Download Submit
C:\Windows\SysWOW64\Ndflak32.exe

Filesize
42KB

MD5
489c05a2100dbf36e9b39388c1e3094a

SHA1
7bb4b14a9848522e45ca3b6a28ff23ea8c165392

SHA256
9f4d7693ddf9418220426e4fcfc573bb4b527478b589f155a6172146112c50d6

SHA512
39dd1359b1ba59a2f2c5f76127c448e339faffd655551e90f4db974381f40b83811155aba5bdd7179d929eb24630156a9dce6f5c161c5ab652469bdd8a0e0b5c

Download Submit
C:\Windows\SysWOW64\Njjmni32.exe

Filesize
42KB

MD5
4dbb8f9a3fb31ff3d6d03d1d40d4bf66

SHA1
981beadbfc72fc3321de6f9ba39ade98f4013b9c

SHA256
569b7762d278c1747d4e8ae5ab0d6fb32971f9f1fac8521f8b0718cd1da74cbd

SHA512
0e5b454d0f8a1e1edbf5242fef74e61ba2f82a7977b9403ebf7082af3b3c3d200fea3ab3f7f829ca4ea5f1fdc8fe04ef20bf13bffb78a6dc7502b28a3dcd82c3

Download Submit
C:\Windows\SysWOW64\Oabhfg32.exe

Filesize
42KB

MD5
2ffaf1439fc08f3202988d87550e1928

SHA1
dfaffd6aad0d17f91c2a11c73a0d867fa248e69f

SHA256
efaf3ff99ece5b959ba162bad820e478bbe0469d51fbaa893d6c7fed98729361

SHA512
1a77621803f8aec484eba2f5fe5731dac4fe8df1123c481fdb4b23a391ebc7900c6e2208156bf9754f8fb5c367d0095f750fe625f466650ab585867367b023a7

Download Submit
C:\Windows\SysWOW64\Ogcnmc32.exe

Filesize
42KB

MD5
d69855aee8ee0a7cfbd95fa9d24bbd2b

SHA1
0abc48ec197ca7f13ba44795c29b95756d5f4295

SHA256
29aaaeb1f7accf38fbebbfe5505e3f951449894bcbebcb0b048b90e61aefd10e

SHA512
d7139549c51b9206379ecb79ef36e543d56b7ea46fd0273782201336de4c4b626557cde71b76f1792e02231bc52179a2884e1395255b8391353c4ba19141b403

Download Submit
C:\Windows\SysWOW64\Pafkgphl.exe

Filesize
42KB

MD5
69b63ae60017da91242e319c37bb9d1f

SHA1
5d54d899ce6d1413cf71efe3af813705f5b35955

SHA256
011593de4d62c012afffc11abd1a24869b05cd3c11026f3ec2d15603034e0f89

SHA512
55cc72671d3555fc3c31b52f432ee1aa5347b7a6fb91886eeb910ee8f0769c8daa1607467ae7a26faf8ae5f222ac27883fd505cc1eb6651543e9ee237bfd60a0

Download Submit
C:\Windows\SysWOW64\Pidlqb32.exe

Filesize
42KB

MD5
2a040f1a3c0aaef6ec9910b5a6a5ae18

SHA1
05151655aa8544b5bcdd69099f3898a38d6181c6

SHA256
773507173adf00304119f6522321b6a86652eaff97c6653f906e7d9ef0b9e043

SHA512
0c4782d5f0b11994020195f3d2d2624014c45247b5c7ebf4103d1a5a6ac5303d79e4df725ffea9f02173120b733c77780e3b29b2364836e30738beccdd980156

Download Submit
C:\Windows\SysWOW64\Qdphngfl.exe

Filesize
42KB

MD5
d9ff36e03fb62959a7598e138de24fc7

SHA1
8b911697be403df4ce4af33dbcfc13b5e88a846c

SHA256
15eb13a483a8dfb6583f50d750ab21fb604580df39a65cdf5865b2f44f2203cb

SHA512
b9ea3a9c41ff53a70db9f1dc65c3232676469d52a867dec6f0454acb2dd27cf3fcc87058aa2da4afc8c0f5be4b1d96bfd2b6619c91223d04fb92eebf4ea57d82

Download Submit
memory/232-239-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/616-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/752-47-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/912-437-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/984-365-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1156-71-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1184-120-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1204-431-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1236-200-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1240-323-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1376-39-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1408-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1536-299-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1544-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1552-268-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1780-287-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1788-23-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1896-274-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2016-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2080-95-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2136-401-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2208-293-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2236-389-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2360-311-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2592-371-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2632-127-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2636-31-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2752-275-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2792-341-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2972-207-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3064-216-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3104-329-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3228-87-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3392-103-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3476-143-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3576-413-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3700-305-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3732-335-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3788-136-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3860-395-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3876-176-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3880-383-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3968-151-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4024-248-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4048-281-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4152-80-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4160-111-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4352-377-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4360-223-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4384-184-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4440-232-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4444-167-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4604-353-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4608-359-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4636-191-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4680-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4760-419-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4964-262-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4968-411-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5008-425-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5012-317-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5032-159-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5056-347-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5108-256-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads