61a9ad5b1eab339ab02c34eda9c8ea7429ff5dd1edf29b8382a2f782353923e8

Analysis

max time kernel
146s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 22:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61a9ad5b1eab339ab02c34eda9c8ea7429ff5dd1edf29b8382a2f782353923e8.exe
Size

163KB
MD5

087ac931967fd86c24202350e473d3bf
SHA1

80d2d3d4fbd8facc65614a4d731cf44e62e4e436
SHA256

61a9ad5b1eab339ab02c34eda9c8ea7429ff5dd1edf29b8382a2f782353923e8
SHA512

19811773e53df89f2793e1ae16c3b47a39f86b2c9ab66d849c51119ba4226f63539d9755211749cb3de0547dfce0f457ede3612be2c701c7cfc6a745df6ff6a4
SSDEEP

1536:Nn4dCITSa8aah16xxC9ptWPSylQtfeX90AtGRhKW+jujAEjh8DTL9GIvg/SylQ7j:N4dPSa8t0TC9rWHYgnWAUjWDUIwLyc4F

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbdoof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iloidijb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phaahggp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nadleilm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfkbfd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cglgjeci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dapkni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pojcjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnbnhedj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcimdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eqncnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddfbgelh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfqkddfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cqpbglno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imnocf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oalipoiq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fealin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmmlla32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdmgfedl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iepaaico.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cippgm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idkkpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gldglf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Illfdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikaggmii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfadkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebhglj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qaalblgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nodiqp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qpbnhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdpnda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdbhkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjffdalb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blgifbil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klhnfo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogjdmbil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eplnpeol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nimbkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aodogdmn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpqjglii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbjena32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Plhnda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nimbkc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afkknogn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bopocbcq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eiokinbk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjoppf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abjmkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pckppl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hgiepjga.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aeaanjkl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Illfdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpqjglii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngjkfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apeknk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjmgfgdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Likcilhh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhcjqinf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jqknkedi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boeebnhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gldglf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bapgdm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amhfkopc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjhcjq32.exe

Executes dropped EXE 64 IoCs

pid	Process
1992	Pmdkch32.exe
1844	Pgioqq32.exe
868	Pdmpje32.exe
1916	Pnfdcjkg.exe
4908	Qqfmde32.exe
3972	Cenahpha.exe
4716	Ceqnmpfo.exe
2352	Cjmgfgdf.exe
2808	Cnkplejl.exe
772	Ceehho32.exe
3464	Calhnpgn.exe
404	Dhfajjoj.exe
4356	Dopigd32.exe
440	Danecp32.exe
1980	Eaonjngh.exe
4128	Ehiffh32.exe
3148	Ekiohclf.exe
4788	Feapkk32.exe
2172	Fnmepn32.exe
4608	Fdijbg32.exe
448	Hhgloc32.exe
4816	Hhihdcbp.exe
2472	Hdpiid32.exe
4776	Ifbbig32.exe
4760	Igcoqocb.exe
4072	Ikaggmii.exe
1604	Ioopml32.exe
1120	Ieliebnf.exe
5028	Ifleoe32.exe
2308	Jngjch32.exe
4828	Jkkjmlan.exe
2892	Jfpojead.exe
3540	Joiccj32.exe
3440	Jgdhgmep.exe
4484	Jnnpdg32.exe
1312	Jgfdmlcm.exe
3724	Jieagojp.exe
4904	Knbiofhg.exe
1100	Knefeffd.exe
1432	Kijjbofj.exe
888	Kngcje32.exe
4404	Klkcdj32.exe
5088	Kbekqdjh.exe
3948	Kiodmn32.exe
4480	Kpiljh32.exe
4732	Kefdbo32.exe
3732	Lnnikdnj.exe
556	Lhfmdj32.exe
1252	Lblaabdp.exe
3920	Lhijijbg.exe
3568	Lbnngbbn.exe
4328	Llgcph32.exe
4844	Likcilhh.exe
744	Loglacfo.exe
2856	Mpghkf32.exe
3412	Medqcmki.exe
3868	Mibijk32.exe
2584	Mffjcopi.exe
1096	Moaogand.exe
544	Niipjj32.exe
1376	Nhnlkfpp.exe
3304	Npedmdab.exe
1940	Nlleaeff.exe
1804	Ngaionfl.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bpqjjjjl.exe	Bmbnnn32.exe
File opened for modification	C:\Windows\SysWOW64\Aleckinj.exe	Ahjgjj32.exe
File opened for modification	C:\Windows\SysWOW64\Fdglmkeg.exe	Fmndpq32.exe
File created	C:\Windows\SysWOW64\Fmliok32.dll	Dpnbog32.exe
File opened for modification	C:\Windows\SysWOW64\Omegjomb.exe	Oldjcg32.exe
File created	C:\Windows\SysWOW64\Pahpfc32.exe	Pojcjh32.exe
File created	C:\Windows\SysWOW64\Dbcmakpl.exe	Dpphjp32.exe
File opened for modification	C:\Windows\SysWOW64\Qaalblgi.exe	Pocpfphe.exe
File created	C:\Windows\SysWOW64\Cqopkcbn.dll	Fihnomjp.exe
File created	C:\Windows\SysWOW64\Obnehj32.exe	Ockdmmoj.exe
File opened for modification	C:\Windows\SysWOW64\Aaiqcnhg.exe	Amnebo32.exe
File opened for modification	C:\Windows\SysWOW64\Aqmlknnd.exe	Ajcdnd32.exe
File opened for modification	C:\Windows\SysWOW64\Dmihij32.exe	Djklmo32.exe
File created	C:\Windows\SysWOW64\Cgieglah.dll	Pcmeke32.exe
File created	C:\Windows\SysWOW64\Hgfapd32.exe	Hlambk32.exe
File opened for modification	C:\Windows\SysWOW64\Jgnqgqan.exe	Jnelok32.exe
File opened for modification	C:\Windows\SysWOW64\Dnmhpg32.exe	Dkokcl32.exe
File created	C:\Windows\SysWOW64\Ldfakpfj.dll	Ajaelc32.exe
File opened for modification	C:\Windows\SysWOW64\Kpiljh32.exe	Kiodmn32.exe
File created	C:\Windows\SysWOW64\Moaogand.exe	Mffjcopi.exe
File opened for modification	C:\Windows\SysWOW64\Adgmoigj.exe	Aaiqcnhg.exe
File opened for modification	C:\Windows\SysWOW64\Idghpmnp.exe	Iqklon32.exe
File created	C:\Windows\SysWOW64\Popbpqjh.exe	Phfjcf32.exe
File opened for modification	C:\Windows\SysWOW64\Pckppl32.exe	Plagcbdn.exe
File opened for modification	C:\Windows\SysWOW64\Edjgfcec.exe	Empoiimf.exe
File created	C:\Windows\SysWOW64\Dmkalh32.dll	Fmfgek32.exe
File opened for modification	C:\Windows\SysWOW64\Jkkjmlan.exe	Jngjch32.exe
File opened for modification	C:\Windows\SysWOW64\Lhijijbg.exe	Lblaabdp.exe
File created	C:\Windows\SysWOW64\Cmniml32.exe	Cfcqpa32.exe
File opened for modification	C:\Windows\SysWOW64\Gigaka32.exe	Gpnmbl32.exe
File created	C:\Windows\SysWOW64\Okopkl32.dll	Lhijijbg.exe
File opened for modification	C:\Windows\SysWOW64\Aflaie32.exe	Aobilkcl.exe
File created	C:\Windows\SysWOW64\Kpccmhdg.exe	Kapfiqoj.exe
File created	C:\Windows\SysWOW64\Hpomcp32.exe	Hkbdki32.exe
File opened for modification	C:\Windows\SysWOW64\Gbdoof32.exe	Gmggfp32.exe
File created	C:\Windows\SysWOW64\Chalkm32.dll	Oldamm32.exe
File opened for modification	C:\Windows\SysWOW64\Ceqnmpfo.exe	Cenahpha.exe
File created	C:\Windows\SysWOW64\Fdijbg32.exe	Fnmepn32.exe
File created	C:\Windows\SysWOW64\Nhfjcpfb.dll	Fmmmfj32.exe
File opened for modification	C:\Windows\SysWOW64\Hpiecd32.exe	Hipmfjee.exe
File created	C:\Windows\SysWOW64\Phajna32.exe	Pjmjdm32.exe
File created	C:\Windows\SysWOW64\Qfbobf32.exe	Qcdbfk32.exe
File opened for modification	C:\Windows\SysWOW64\Iakiia32.exe	Ijcahd32.exe
File created	C:\Windows\SysWOW64\Eejlephc.dll	Dmglcj32.exe
File created	C:\Windows\SysWOW64\Mlmlcjoo.dll	Ibobdqid.exe
File created	C:\Windows\SysWOW64\Phahglpk.dll	Bfbaonae.exe
File opened for modification	C:\Windows\SysWOW64\Ejchhgid.exe	Elbhjp32.exe
File created	C:\Windows\SysWOW64\Okilfdgl.dll	Dcogje32.exe
File created	C:\Windows\SysWOW64\Paedlhhc.dll	Maiccajf.exe
File opened for modification	C:\Windows\SysWOW64\Hhdhon32.exe	Hajpbckl.exe
File created	C:\Windows\SysWOW64\Mglfplgk.exe	Lenicahg.exe
File opened for modification	C:\Windows\SysWOW64\Peahgl32.exe	Oogpjbbb.exe
File created	C:\Windows\SysWOW64\Dbkqfe32.exe	Dhclmp32.exe
File created	C:\Windows\SysWOW64\Jbaojpgb.exe	Jkhgmf32.exe
File created	C:\Windows\SysWOW64\Afkknogn.exe	Acmobchj.exe
File opened for modification	C:\Windows\SysWOW64\Npedmdab.exe	Nhnlkfpp.exe
File created	C:\Windows\SysWOW64\Jenmcggo.exe	Jgkmgk32.exe
File created	C:\Windows\SysWOW64\Kpmdfonj.exe	Kgdpni32.exe
File created	C:\Windows\SysWOW64\Lqhdbm32.exe	Kfpcoefj.exe
File created	C:\Windows\SysWOW64\Cjmgfgdf.exe	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Mobnnd32.dll	Lmmolepp.exe
File opened for modification	C:\Windows\SysWOW64\Iklgah32.exe	Haafcb32.exe
File opened for modification	C:\Windows\SysWOW64\Ooqqdi32.exe	Objpoh32.exe
File created	C:\Windows\SysWOW64\Ffchaq32.dll	Adikdfna.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7940	6692	WerFault.exe	733

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ieliebnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbjena32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekiapmnp.dll"	Chiblk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhfjcpfb.dll"	Fmmmfj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Klkcdj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmdjdfgl.dll"	Fkihnmhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oflpld32.dll"	Oifeab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Emoadlfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ceqnmpfo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ppahmb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Niipjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hphlgp32.dll"	Cmfclm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djcoai32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ondljl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hghklqmm.dll"	Kapfiqoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qbkbgfif.dll"	Ehiffh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hhihdcbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hdpiid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipeeobbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Plpjoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plpjfnfg.dll"	Gaefgd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hajpbckl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Maodigil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnmdme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnmdme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmlmkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jgdhgmep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnaoodjg.dll"	Cmniml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hekgfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aaiqcnhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpghkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgddbm32.dll"	Afgacokc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eppqqn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paenokbf.dll"	Aaiqcnhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahjgjj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcgnbaeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nijqcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kidiae32.dll"	Aflaie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjpank32.dll"	Blgifbil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ocmconhk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bmbnnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Niooqcad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aodogdmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgnqimah.dll"	Ojbacd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naeheh32.dll"	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aihaoqlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jqlefl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlpokp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dnmhpg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fmikeaap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hplbickp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfmolc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odblin32.dll"	Ohlimd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kjhcjq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmdnljan.dll"	Bjcmebie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dohnnkjk.dll"	Acqgojmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkkgmlcm.dll"	Ggbook32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hidgai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Niipjj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ploknb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jedohked.dll"	Hkbdki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcggmk32.dll"	Fdpnda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aobilkcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaejbl32.dll"	Kkjlic32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1992	1668	61a9ad5b1eab339ab02c34eda9c8ea7429ff5dd1edf29b8382a2f782353923e8.exe	88
PID 1668 wrote to memory of 1992	1668	61a9ad5b1eab339ab02c34eda9c8ea7429ff5dd1edf29b8382a2f782353923e8.exe	88
PID 1668 wrote to memory of 1992	1668	61a9ad5b1eab339ab02c34eda9c8ea7429ff5dd1edf29b8382a2f782353923e8.exe	88
PID 1992 wrote to memory of 1844	1992	Pmdkch32.exe	89
PID 1992 wrote to memory of 1844	1992	Pmdkch32.exe	89
PID 1992 wrote to memory of 1844	1992	Pmdkch32.exe	89
PID 1844 wrote to memory of 868	1844	Pgioqq32.exe	90
PID 1844 wrote to memory of 868	1844	Pgioqq32.exe	90
PID 1844 wrote to memory of 868	1844	Pgioqq32.exe	90
PID 868 wrote to memory of 1916	868	Pdmpje32.exe	91
PID 868 wrote to memory of 1916	868	Pdmpje32.exe	91
PID 868 wrote to memory of 1916	868	Pdmpje32.exe	91
PID 1916 wrote to memory of 4908	1916	Pnfdcjkg.exe	93
PID 1916 wrote to memory of 4908	1916	Pnfdcjkg.exe	93
PID 1916 wrote to memory of 4908	1916	Pnfdcjkg.exe	93
PID 4908 wrote to memory of 3972	4908	Qqfmde32.exe	94
PID 4908 wrote to memory of 3972	4908	Qqfmde32.exe	94
PID 4908 wrote to memory of 3972	4908	Qqfmde32.exe	94
PID 3972 wrote to memory of 4716	3972	Cenahpha.exe	95
PID 3972 wrote to memory of 4716	3972	Cenahpha.exe	95
PID 3972 wrote to memory of 4716	3972	Cenahpha.exe	95
PID 4716 wrote to memory of 2352	4716	Ceqnmpfo.exe	96
PID 4716 wrote to memory of 2352	4716	Ceqnmpfo.exe	96
PID 4716 wrote to memory of 2352	4716	Ceqnmpfo.exe	96
PID 2352 wrote to memory of 2808	2352	Cjmgfgdf.exe	97
PID 2352 wrote to memory of 2808	2352	Cjmgfgdf.exe	97
PID 2352 wrote to memory of 2808	2352	Cjmgfgdf.exe	97
PID 2808 wrote to memory of 772	2808	Cnkplejl.exe	98
PID 2808 wrote to memory of 772	2808	Cnkplejl.exe	98
PID 2808 wrote to memory of 772	2808	Cnkplejl.exe	98
PID 772 wrote to memory of 3464	772	Ceehho32.exe	99
PID 772 wrote to memory of 3464	772	Ceehho32.exe	99
PID 772 wrote to memory of 3464	772	Ceehho32.exe	99
PID 3464 wrote to memory of 404	3464	Calhnpgn.exe	100
PID 3464 wrote to memory of 404	3464	Calhnpgn.exe	100
PID 3464 wrote to memory of 404	3464	Calhnpgn.exe	100
PID 404 wrote to memory of 4356	404	Dhfajjoj.exe	101
PID 404 wrote to memory of 4356	404	Dhfajjoj.exe	101
PID 404 wrote to memory of 4356	404	Dhfajjoj.exe	101
PID 4356 wrote to memory of 440	4356	Dopigd32.exe	102
PID 4356 wrote to memory of 440	4356	Dopigd32.exe	102
PID 4356 wrote to memory of 440	4356	Dopigd32.exe	102
PID 440 wrote to memory of 1980	440	Danecp32.exe	103
PID 440 wrote to memory of 1980	440	Danecp32.exe	103
PID 440 wrote to memory of 1980	440	Danecp32.exe	103
PID 1980 wrote to memory of 4128	1980	Eaonjngh.exe	104
PID 1980 wrote to memory of 4128	1980	Eaonjngh.exe	104
PID 1980 wrote to memory of 4128	1980	Eaonjngh.exe	104
PID 4128 wrote to memory of 3148	4128	Ehiffh32.exe	105
PID 4128 wrote to memory of 3148	4128	Ehiffh32.exe	105
PID 4128 wrote to memory of 3148	4128	Ehiffh32.exe	105
PID 3148 wrote to memory of 4788	3148	Ekiohclf.exe	106
PID 3148 wrote to memory of 4788	3148	Ekiohclf.exe	106
PID 3148 wrote to memory of 4788	3148	Ekiohclf.exe	106
PID 4788 wrote to memory of 2172	4788	Feapkk32.exe	107
PID 4788 wrote to memory of 2172	4788	Feapkk32.exe	107
PID 4788 wrote to memory of 2172	4788	Feapkk32.exe	107
PID 2172 wrote to memory of 4608	2172	Fnmepn32.exe	108
PID 2172 wrote to memory of 4608	2172	Fnmepn32.exe	108
PID 2172 wrote to memory of 4608	2172	Fnmepn32.exe	108
PID 4608 wrote to memory of 448	4608	Fdijbg32.exe	109
PID 4608 wrote to memory of 448	4608	Fdijbg32.exe	109
PID 4608 wrote to memory of 448	4608	Fdijbg32.exe	109
PID 448 wrote to memory of 4816	448	Hhgloc32.exe	110

C:\Users\Admin\AppData\Local\Temp\61a9ad5b1eab339ab02c34eda9c8ea7429ff5dd1edf29b8382a2f782353923e8.exe
"C:\Users\Admin\AppData\Local\Temp\61a9ad5b1eab339ab02c34eda9c8ea7429ff5dd1edf29b8382a2f782353923e8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\Pmdkch32.exe
  C:\Windows\system32\Pmdkch32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\SysWOW64\Pgioqq32.exe
    C:\Windows\system32\Pgioqq32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1844
  - - C:\Windows\SysWOW64\Pdmpje32.exe
      C:\Windows\system32\Pdmpje32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:868
    - - C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1916
      - C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4908
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4716
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2352
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2808
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3464
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:404
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4356
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:440
        
        C:\Windows\SysWOW64\Eaonjngh.exe
        
        C:\Windows\system32\Eaonjngh.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1980
        
        C:\Windows\SysWOW64\Ehiffh32.exe
        
        C:\Windows\system32\Ehiffh32.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4128
        
        C:\Windows\SysWOW64\Ekiohclf.exe
        
        C:\Windows\system32\Ekiohclf.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3148
        
        C:\Windows\SysWOW64\Feapkk32.exe
        
        C:\Windows\system32\Feapkk32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4788
        
        C:\Windows\SysWOW64\Fnmepn32.exe
        
        C:\Windows\system32\Fnmepn32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Windows\SysWOW64\Fdijbg32.exe
        
        C:\Windows\system32\Fdijbg32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\SysWOW64\Hhgloc32.exe
        
        C:\Windows\system32\Hhgloc32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:448
        
        C:\Windows\SysWOW64\Hhihdcbp.exe
        
        C:\Windows\system32\Hhihdcbp.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4816
        
        C:\Windows\SysWOW64\Hdpiid32.exe
        
        C:\Windows\system32\Hdpiid32.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2472
        
        C:\Windows\SysWOW64\Hofmfmhj.exe
        
        C:\Windows\system32\Hofmfmhj.exe
        25⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\Ifbbig32.exe
        
        C:\Windows\system32\Ifbbig32.exe
        26⤵
        Executes dropped EXE
        
        PID:4776
        
        C:\Windows\SysWOW64\Igcoqocb.exe
        
        C:\Windows\system32\Igcoqocb.exe
        27⤵
        Executes dropped EXE
        
        PID:4760
        
        C:\Windows\SysWOW64\Ikaggmii.exe
        
        C:\Windows\system32\Ikaggmii.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4072
        
        C:\Windows\SysWOW64\Ioopml32.exe
        
        C:\Windows\system32\Ioopml32.exe
        29⤵
        Executes dropped EXE
        
        PID:1604
        
        C:\Windows\SysWOW64\Ieliebnf.exe
        
        C:\Windows\system32\Ieliebnf.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1120
        
        C:\Windows\SysWOW64\Ifleoe32.exe
        
        C:\Windows\system32\Ifleoe32.exe
        31⤵
        Executes dropped EXE
        
        PID:5028
        
        C:\Windows\SysWOW64\Jngjch32.exe
        
        C:\Windows\system32\Jngjch32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2308
        
        C:\Windows\SysWOW64\Jkkjmlan.exe
        
        C:\Windows\system32\Jkkjmlan.exe
        33⤵
        Executes dropped EXE
        
        PID:4828
        
        C:\Windows\SysWOW64\Jfpojead.exe
        
        C:\Windows\system32\Jfpojead.exe
        34⤵
        Executes dropped EXE
        
        PID:2892
        
        C:\Windows\SysWOW64\Joiccj32.exe
        
        C:\Windows\system32\Joiccj32.exe
        35⤵
        Executes dropped EXE
        
        PID:3540
        
        C:\Windows\SysWOW64\Jgdhgmep.exe
        
        C:\Windows\system32\Jgdhgmep.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3440
        
        C:\Windows\SysWOW64\Jnnpdg32.exe
        
        C:\Windows\system32\Jnnpdg32.exe
        37⤵
        Executes dropped EXE
        
        PID:4484
        
        C:\Windows\SysWOW64\Jgfdmlcm.exe
        
        C:\Windows\system32\Jgfdmlcm.exe
        38⤵
        Executes dropped EXE
        
        PID:1312
        
        C:\Windows\SysWOW64\Jieagojp.exe
        
        C:\Windows\system32\Jieagojp.exe
        39⤵
        Executes dropped EXE
        
        PID:3724
        
        C:\Windows\SysWOW64\Knbiofhg.exe
        
        C:\Windows\system32\Knbiofhg.exe
        40⤵
        Executes dropped EXE
        
        PID:4904
        
        C:\Windows\SysWOW64\Knefeffd.exe
        
        C:\Windows\system32\Knefeffd.exe
        41⤵
        Executes dropped EXE
        
        PID:1100
        
        C:\Windows\SysWOW64\Kijjbofj.exe
        
        C:\Windows\system32\Kijjbofj.exe
        42⤵
        Executes dropped EXE
        
        PID:1432
        
        C:\Windows\SysWOW64\Kngcje32.exe
        
        C:\Windows\system32\Kngcje32.exe
        43⤵
        Executes dropped EXE
        
        PID:888
        
        C:\Windows\SysWOW64\Klkcdj32.exe
        
        C:\Windows\system32\Klkcdj32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4404
        
        C:\Windows\SysWOW64\Kbekqdjh.exe
        
        C:\Windows\system32\Kbekqdjh.exe
        45⤵
        Executes dropped EXE
        
        PID:5088
        
        C:\Windows\SysWOW64\Kiodmn32.exe
        
        C:\Windows\system32\Kiodmn32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3948
        
        C:\Windows\SysWOW64\Kpiljh32.exe
        
        C:\Windows\system32\Kpiljh32.exe
        47⤵
        Executes dropped EXE
        
        PID:4480
        
        C:\Windows\SysWOW64\Kefdbo32.exe
        
        C:\Windows\system32\Kefdbo32.exe
        48⤵
        Executes dropped EXE
        
        PID:4732
        
        C:\Windows\SysWOW64\Lnnikdnj.exe
        
        C:\Windows\system32\Lnnikdnj.exe
        49⤵
        Executes dropped EXE
        
        PID:3732
        
        C:\Windows\SysWOW64\Lhfmdj32.exe
        
        C:\Windows\system32\Lhfmdj32.exe
        50⤵
        Executes dropped EXE
        
        PID:556
        
        C:\Windows\SysWOW64\Lblaabdp.exe
        
        C:\Windows\system32\Lblaabdp.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1252
        
        C:\Windows\SysWOW64\Lhijijbg.exe
        
        C:\Windows\system32\Lhijijbg.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3920
        
        C:\Windows\SysWOW64\Lbnngbbn.exe
        
        C:\Windows\system32\Lbnngbbn.exe
        53⤵
        Executes dropped EXE
        
        PID:3568
        
        C:\Windows\SysWOW64\Llgcph32.exe
        
        C:\Windows\system32\Llgcph32.exe
        54⤵
        Executes dropped EXE
        
        PID:4328
        
        C:\Windows\SysWOW64\Likcilhh.exe
        
        C:\Windows\system32\Likcilhh.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4844
        
        C:\Windows\SysWOW64\Loglacfo.exe
        
        C:\Windows\system32\Loglacfo.exe
        56⤵
        Executes dropped EXE
        
        PID:744
        
        C:\Windows\SysWOW64\Mpghkf32.exe
        
        C:\Windows\system32\Mpghkf32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2856
        
        C:\Windows\SysWOW64\Medqcmki.exe
        
        C:\Windows\system32\Medqcmki.exe
        58⤵
        Executes dropped EXE
        
        PID:3412
        
        C:\Windows\SysWOW64\Mibijk32.exe
        
        C:\Windows\system32\Mibijk32.exe
        59⤵
        Executes dropped EXE
        
        PID:3868
        
        C:\Windows\SysWOW64\Mffjcopi.exe
        
        C:\Windows\system32\Mffjcopi.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2584
        
        C:\Windows\SysWOW64\Moaogand.exe
        
        C:\Windows\system32\Moaogand.exe
        61⤵
        Executes dropped EXE
        
        PID:1096
        
        C:\Windows\SysWOW64\Niipjj32.exe
        
        C:\Windows\system32\Niipjj32.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:544
        
        C:\Windows\SysWOW64\Nhnlkfpp.exe
        
        C:\Windows\system32\Nhnlkfpp.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1376
        
        C:\Windows\SysWOW64\Npedmdab.exe
        
        C:\Windows\system32\Npedmdab.exe
        64⤵
        Executes dropped EXE
        
        PID:3304
        
        C:\Windows\SysWOW64\Nlleaeff.exe
        
        C:\Windows\system32\Nlleaeff.exe
        65⤵
        Executes dropped EXE
        
        PID:1940
        
        C:\Windows\SysWOW64\Ngaionfl.exe
        
        C:\Windows\system32\Ngaionfl.exe
        66⤵
        Executes dropped EXE
        
        PID:1804
        
        C:\Windows\SysWOW64\Npjnhc32.exe
        
        C:\Windows\system32\Npjnhc32.exe
        67⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\Ngdfdmdi.exe
        
        C:\Windows\system32\Ngdfdmdi.exe
        68⤵
        
        PID:4016
        
        C:\Windows\SysWOW64\Ocmconhk.exe
        
        C:\Windows\system32\Ocmconhk.exe
        69⤵
        Modifies registry class
        
        PID:4920
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        70⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\Ogklelna.exe
        
        C:\Windows\system32\Ogklelna.exe
        71⤵
        
        PID:736
        
        C:\Windows\SysWOW64\Ohlimd32.exe
        
        C:\Windows\system32\Ohlimd32.exe
        72⤵
        Modifies registry class
        
        PID:2684
        
        C:\Windows\SysWOW64\Oljaccjf.exe
        
        C:\Windows\system32\Oljaccjf.exe
        73⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\Ophjiaql.exe
        
        C:\Windows\system32\Ophjiaql.exe
        74⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\Ocffempp.exe
        
        C:\Windows\system32\Ocffempp.exe
        75⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\Ploknb32.exe
        
        C:\Windows\system32\Ploknb32.exe
        76⤵
        Modifies registry class
        
        PID:4440
        
        C:\Windows\SysWOW64\Pcicklnn.exe
        
        C:\Windows\system32\Pcicklnn.exe
        77⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Plagcbdn.exe
        
        C:\Windows\system32\Plagcbdn.exe
        78⤵
        Drops file in System32 directory
        
        PID:3188
        
        C:\Windows\SysWOW64\Pckppl32.exe
        
        C:\Windows\system32\Pckppl32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1564
        
        C:\Windows\SysWOW64\Pfillg32.exe
        
        C:\Windows\system32\Pfillg32.exe
        80⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\Ppopjp32.exe
        
        C:\Windows\system32\Ppopjp32.exe
        81⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\Pgihfj32.exe
        
        C:\Windows\system32\Pgihfj32.exe
        82⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\Phjenbhp.exe
        
        C:\Windows\system32\Phjenbhp.exe
        83⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\Pcpikkge.exe
        
        C:\Windows\system32\Pcpikkge.exe
        84⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\Pfnegggi.exe
        
        C:\Windows\system32\Pfnegggi.exe
        85⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\Plhnda32.exe
        
        C:\Windows\system32\Plhnda32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3620
        
        C:\Windows\SysWOW64\Pofjpl32.exe
        
        C:\Windows\system32\Pofjpl32.exe
        87⤵
        
        PID:488
        
        C:\Windows\SysWOW64\Qcdbfk32.exe
        
        C:\Windows\system32\Qcdbfk32.exe
        88⤵
        Drops file in System32 directory
        
        PID:3452
        
        C:\Windows\SysWOW64\Qfbobf32.exe
        
        C:\Windows\system32\Qfbobf32.exe
        89⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Qhakoa32.exe
        
        C:\Windows\system32\Qhakoa32.exe
        90⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Aokcklid.exe
        
        C:\Windows\system32\Aokcklid.exe
        91⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Agbkmijg.exe
        
        C:\Windows\system32\Agbkmijg.exe
        92⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Aqkpeopg.exe
        
        C:\Windows\system32\Aqkpeopg.exe
        93⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Ajcdnd32.exe
        
        C:\Windows\system32\Ajcdnd32.exe
        94⤵
        Drops file in System32 directory
        
        PID:5452
        
        C:\Windows\SysWOW64\Aqmlknnd.exe
        
        C:\Windows\system32\Aqmlknnd.exe
        95⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Aggegh32.exe
        
        C:\Windows\system32\Aggegh32.exe
        96⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Aihaoqlp.exe
        
        C:\Windows\system32\Aihaoqlp.exe
        97⤵
        Modifies registry class
        
        PID:5576
        
        C:\Windows\SysWOW64\Aobilkcl.exe
        
        C:\Windows\system32\Aobilkcl.exe
        98⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\Aflaie32.exe
        
        C:\Windows\system32\Aflaie32.exe
        99⤵
        Modifies registry class
        
        PID:5660
        
        C:\Windows\SysWOW64\Aodfajaj.exe
        
        C:\Windows\system32\Aodfajaj.exe
        100⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Ajjjocap.exe
        
        C:\Windows\system32\Ajjjocap.exe
        101⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Amhfkopc.exe
        
        C:\Windows\system32\Amhfkopc.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5792
        
        C:\Windows\SysWOW64\Bfqkddfd.exe
        
        C:\Windows\system32\Bfqkddfd.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5840
        
        C:\Windows\SysWOW64\Biogppeg.exe
        
        C:\Windows\system32\Biogppeg.exe
        104⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Bqfoamfj.exe
        
        C:\Windows\system32\Bqfoamfj.exe
        105⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Bgbdcgld.exe
        
        C:\Windows\system32\Bgbdcgld.exe
        106⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Bidqko32.exe
        
        C:\Windows\system32\Bidqko32.exe
        107⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Bgeaifia.exe
        
        C:\Windows\system32\Bgeaifia.exe
        108⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Bjcmebie.exe
        
        C:\Windows\system32\Bjcmebie.exe
        109⤵
        Modifies registry class
        
        PID:6112
        
        C:\Windows\SysWOW64\Bppfmigl.exe
        
        C:\Windows\system32\Bppfmigl.exe
        110⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Bggnof32.exe
        
        C:\Windows\system32\Bggnof32.exe
        111⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Cqpbglno.exe
        
        C:\Windows\system32\Cqpbglno.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5368
        
        C:\Windows\SysWOW64\Cgjjdf32.exe
        
        C:\Windows\system32\Cgjjdf32.exe
        113⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Cmfclm32.exe
        
        C:\Windows\system32\Cmfclm32.exe
        114⤵
        Modifies registry class
        
        PID:5524
        
        C:\Windows\SysWOW64\Cpeohh32.exe
        
        C:\Windows\system32\Cpeohh32.exe
        115⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Cglgjeci.exe
        
        C:\Windows\system32\Cglgjeci.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5640
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        117⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Cpglnhad.exe
        
        C:\Windows\system32\Cpglnhad.exe
        118⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Cfadkb32.exe
        
        C:\Windows\system32\Cfadkb32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5964
        
        C:\Windows\SysWOW64\Cippgm32.exe
        
        C:\Windows\system32\Cippgm32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6036
        
        C:\Windows\SysWOW64\Caghhk32.exe
        
        C:\Windows\system32\Caghhk32.exe
        121⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Cceddf32.exe
        
        C:\Windows\system32\Cceddf32.exe
        122⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Cfcqpa32.exe
        
        C:\Windows\system32\Cfcqpa32.exe
        123⤵
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Cmniml32.exe
        
        C:\Windows\system32\Cmniml32.exe
        124⤵
        Modifies registry class
        
        PID:5584
        
        C:\Windows\SysWOW64\Ccgajfeh.exe
        
        C:\Windows\system32\Ccgajfeh.exe
        125⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Cjaifp32.exe
        
        C:\Windows\system32\Cjaifp32.exe
        126⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Dmpfbk32.exe
        
        C:\Windows\system32\Dmpfbk32.exe
        127⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Dpnbog32.exe
        
        C:\Windows\system32\Dpnbog32.exe
        128⤵
        Drops file in System32 directory
        
        PID:1480
        
        C:\Windows\SysWOW64\Dfhjkabi.exe
        
        C:\Windows\system32\Dfhjkabi.exe
        129⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        130⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Dannij32.exe
        
        C:\Windows\system32\Dannij32.exe
        131⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Dclkee32.exe
        
        C:\Windows\system32\Dclkee32.exe
        132⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Dfjgaq32.exe
        
        C:\Windows\system32\Dfjgaq32.exe
        133⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Diicml32.exe
        
        C:\Windows\system32\Diicml32.exe
        134⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Dapkni32.exe
        
        C:\Windows\system32\Dapkni32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6000
        
        C:\Windows\SysWOW64\Dcogje32.exe
        
        C:\Windows\system32\Dcogje32.exe
        136⤵
        Drops file in System32 directory
        
        PID:5628
        
        C:\Windows\SysWOW64\Dfmcfp32.exe
        
        C:\Windows\system32\Dfmcfp32.exe
        137⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Dmglcj32.exe
        
        C:\Windows\system32\Dmglcj32.exe
        138⤵
        Drops file in System32 directory
        
        PID:6152
        
        C:\Windows\SysWOW64\Ddadpdmn.exe
        
        C:\Windows\system32\Ddadpdmn.exe
        139⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Dfoplpla.exe
        
        C:\Windows\system32\Dfoplpla.exe
        140⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Djklmo32.exe
        
        C:\Windows\system32\Djklmo32.exe
        141⤵
        Drops file in System32 directory
        
        PID:6272
        
        C:\Windows\SysWOW64\Dmihij32.exe
        
        C:\Windows\system32\Dmihij32.exe
        142⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Dfamapjo.exe
        
        C:\Windows\system32\Dfamapjo.exe
        143⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Emlenj32.exe
        
        C:\Windows\system32\Emlenj32.exe
        144⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Edemkd32.exe
        
        C:\Windows\system32\Edemkd32.exe
        145⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Eibfck32.exe
        
        C:\Windows\system32\Eibfck32.exe
        146⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Eplnpeol.exe
        
        C:\Windows\system32\Eplnpeol.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6520
        
        C:\Windows\SysWOW64\Empoiimf.exe
        
        C:\Windows\system32\Empoiimf.exe
        148⤵
        Drops file in System32 directory
        
        PID:6564
        
        C:\Windows\SysWOW64\Edjgfcec.exe
        
        C:\Windows\system32\Edjgfcec.exe
        149⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Eigonjcj.exe
        
        C:\Windows\system32\Eigonjcj.exe
        150⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Embkoi32.exe
        
        C:\Windows\system32\Embkoi32.exe
        151⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Epagkd32.exe
        
        C:\Windows\system32\Epagkd32.exe
        152⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Ejflhm32.exe
        
        C:\Windows\system32\Ejflhm32.exe
        153⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Fkihnmhj.exe
        
        C:\Windows\system32\Fkihnmhj.exe
        154⤵
        Modifies registry class
        
        PID:6828
        
        C:\Windows\SysWOW64\Facqkg32.exe
        
        C:\Windows\system32\Facqkg32.exe
        155⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Fdamgb32.exe
        
        C:\Windows\system32\Fdamgb32.exe
        156⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        157⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Fineoi32.exe
        
        C:\Windows\system32\Fineoi32.exe
        158⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Faenpf32.exe
        
        C:\Windows\system32\Faenpf32.exe
        159⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Fdcjlb32.exe
        
        C:\Windows\system32\Fdcjlb32.exe
        160⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Fgbfhmll.exe
        
        C:\Windows\system32\Fgbfhmll.exe
        161⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        162⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Fhabbp32.exe
        
        C:\Windows\system32\Fhabbp32.exe
        163⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Fmnkkg32.exe
        
        C:\Windows\system32\Fmnkkg32.exe
        164⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Fkbkdkpp.exe
        
        C:\Windows\system32\Fkbkdkpp.exe
        165⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Falcae32.exe
        
        C:\Windows\system32\Falcae32.exe
        166⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        167⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        168⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Ggkiol32.exe
        
        C:\Windows\system32\Ggkiol32.exe
        169⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Gmeakf32.exe
        
        C:\Windows\system32\Gmeakf32.exe
        170⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Gdoihpbk.exe
        
        C:\Windows\system32\Gdoihpbk.exe
        171⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Gaefgd32.exe
        
        C:\Windows\system32\Gaefgd32.exe
        172⤵
        Modifies registry class
        
        PID:6788
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        173⤵
        Modifies registry class
        
        PID:6852
        
        C:\Windows\SysWOW64\Giqkkf32.exe
        
        C:\Windows\system32\Giqkkf32.exe
        174⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Gahcmd32.exe
        
        C:\Windows\system32\Gahcmd32.exe
        175⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        176⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Hajpbckl.exe
        
        C:\Windows\system32\Hajpbckl.exe
        177⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7148
        
        C:\Windows\SysWOW64\Hhdhon32.exe
        
        C:\Windows\system32\Hhdhon32.exe
        178⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        179⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6336
        
        C:\Windows\SysWOW64\Hpomcp32.exe
        
        C:\Windows\system32\Hpomcp32.exe
        180⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Hgiepjga.exe
        
        C:\Windows\system32\Hgiepjga.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6588
        
        C:\Windows\SysWOW64\Hncmmd32.exe
        
        C:\Windows\system32\Hncmmd32.exe
        182⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        183⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        184⤵
        Drops file in System32 directory
        
        PID:6896
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        185⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Iqklon32.exe
        
        C:\Windows\system32\Iqklon32.exe
        186⤵
        Drops file in System32 directory
        
        PID:7160
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        187⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Igedlh32.exe
        
        C:\Windows\system32\Igedlh32.exe
        188⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Ijcahd32.exe
        
        C:\Windows\system32\Ijcahd32.exe
        189⤵
        Drops file in System32 directory
        
        PID:6632
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        190⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Ikcmbfcj.exe
        
        C:\Windows\system32\Ikcmbfcj.exe
        191⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Iqpfjnba.exe
        
        C:\Windows\system32\Iqpfjnba.exe
        192⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Ihgnkkbd.exe
        
        C:\Windows\system32\Ihgnkkbd.exe
        193⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Ijhjcchb.exe
        
        C:\Windows\system32\Ijhjcchb.exe
        194⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Ibobdqid.exe
        
        C:\Windows\system32\Ibobdqid.exe
        195⤵
        Drops file in System32 directory
        
        PID:7132
        
        C:\Windows\SysWOW64\Jhijqj32.exe
        
        C:\Windows\system32\Jhijqj32.exe
        196⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Jkhgmf32.exe
        
        C:\Windows\system32\Jkhgmf32.exe
        197⤵
        Drops file in System32 directory
        
        PID:7028
        
        C:\Windows\SysWOW64\Jbaojpgb.exe
        
        C:\Windows\system32\Jbaojpgb.exe
        198⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        199⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        200⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        201⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Jdbhkk32.exe
        
        C:\Windows\system32\Jdbhkk32.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7224
        
        C:\Windows\SysWOW64\Jklphekp.exe
        
        C:\Windows\system32\Jklphekp.exe
        203⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Jqiipljg.exe
        
        C:\Windows\system32\Jqiipljg.exe
        204⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Jgcamf32.exe
        
        C:\Windows\system32\Jgcamf32.exe
        205⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        206⤵
        Modifies registry class
        
        PID:7388
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        207⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        208⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Kghjhemo.exe
        
        C:\Windows\system32\Kghjhemo.exe
        209⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Kjffdalb.exe
        
        C:\Windows\system32\Kjffdalb.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7556
        
        C:\Windows\SysWOW64\Kjhcjq32.exe
        
        C:\Windows\system32\Kjhcjq32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7600
        
        C:\Windows\SysWOW64\Kbpkkn32.exe
        
        C:\Windows\system32\Kbpkkn32.exe
        212⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Kkhpdcab.exe
        
        C:\Windows\system32\Kkhpdcab.exe
        213⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Kkjlic32.exe
        
        C:\Windows\system32\Kkjlic32.exe
        214⤵
        Modifies registry class
        
        PID:7720
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        215⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Lbgalmej.exe
        
        C:\Windows\system32\Lbgalmej.exe
        216⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Leenhhdn.exe
        
        C:\Windows\system32\Leenhhdn.exe
        217⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Lkofdbkj.exe
        
        C:\Windows\system32\Lkofdbkj.exe
        218⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Lbinam32.exe
        
        C:\Windows\system32\Lbinam32.exe
        219⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Licfngjd.exe
        
        C:\Windows\system32\Licfngjd.exe
        220⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        221⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Ljgpkonp.exe
        
        C:\Windows\system32\Ljgpkonp.exe
        222⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Lndham32.exe
        
        C:\Windows\system32\Lndham32.exe
        223⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        224⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Lijlof32.exe
        
        C:\Windows\system32\Lijlof32.exe
        225⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        226⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        227⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Miofjepg.exe
        
        C:\Windows\system32\Miofjepg.exe
        228⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Mjpbam32.exe
        
        C:\Windows\system32\Mjpbam32.exe
        229⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Mlpokp32.exe
        
        C:\Windows\system32\Mlpokp32.exe
        230⤵
        Modifies registry class
        
        PID:7540
        
        C:\Windows\SysWOW64\Maodigil.exe
        
        C:\Windows\system32\Maodigil.exe
        231⤵
        Modifies registry class
        
        PID:7584
        
        C:\Windows\SysWOW64\Nemmoe32.exe
        
        C:\Windows\system32\Nemmoe32.exe
        232⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Noeahkfc.exe
        
        C:\Windows\system32\Noeahkfc.exe
        233⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\Neoieenp.exe
        
        C:\Windows\system32\Neoieenp.exe
        234⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Nimbkc32.exe
        
        C:\Windows\system32\Nimbkc32.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7872
        
        C:\Windows\SysWOW64\Niooqcad.exe
        
        C:\Windows\system32\Niooqcad.exe
        236⤵
        Modifies registry class
        
        PID:7912
        
        C:\Windows\SysWOW64\Objpoh32.exe
        
        C:\Windows\system32\Objpoh32.exe
        237⤵
        Drops file in System32 directory
        
        PID:8004
        
        C:\Windows\SysWOW64\Ooqqdi32.exe
        
        C:\Windows\system32\Ooqqdi32.exe
        238⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Oifeab32.exe
        
        C:\Windows\system32\Oifeab32.exe
        239⤵
        Modifies registry class
        
        PID:8136
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        240⤵
        Drops file in System32 directory
        
        PID:7256
        
        C:\Windows\SysWOW64\Oohgdhfn.exe
        
        C:\Windows\system32\Oohgdhfn.exe
        241⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Pojcjh32.exe
        
        C:\Windows\system32\Pojcjh32.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7448
        
        C:\Windows\SysWOW64\Pahpfc32.exe
        
        C:\Windows\system32\Pahpfc32.exe
        243⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        244⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Pcmeke32.exe
        
        C:\Windows\system32\Pcmeke32.exe
        245⤵
        Drops file in System32 directory
        
        PID:7832
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        246⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        247⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Piijno32.exe
        
        C:\Windows\system32\Piijno32.exe
        248⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Qkjgegae.exe
        
        C:\Windows\system32\Qkjgegae.exe
        249⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Ahqddk32.exe
        
        C:\Windows\system32\Ahqddk32.exe
        250⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Afgacokc.exe
        
        C:\Windows\system32\Afgacokc.exe
        251⤵
        Modifies registry class
        
        PID:7704
        
        C:\Windows\SysWOW64\Afinioip.exe
        
        C:\Windows\system32\Afinioip.exe
        252⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        253⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Akffafgg.exe
        
        C:\Windows\system32\Akffafgg.exe
        254⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Acmobchj.exe
        
        C:\Windows\system32\Acmobchj.exe
        255⤵
        Drops file in System32 directory
        
        PID:7552
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7956
        
        C:\Windows\SysWOW64\Ahjgjj32.exe
        
        C:\Windows\system32\Ahjgjj32.exe
        257⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7220
        
        C:\Windows\SysWOW64\Aleckinj.exe
        
        C:\Windows\system32\Aleckinj.exe
        258⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8188
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        260⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Blhpqhlh.exe
        
        C:\Windows\system32\Blhpqhlh.exe
        261⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Boflmdkk.exe
        
        C:\Windows\system32\Boflmdkk.exe
        262⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Bbdhiojo.exe
        
        C:\Windows\system32\Bbdhiojo.exe
        263⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Bjlpjm32.exe
        
        C:\Windows\system32\Bjlpjm32.exe
        264⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        265⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Bcddcbab.exe
        
        C:\Windows\system32\Bcddcbab.exe
        266⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        267⤵
        Drops file in System32 directory
        
        PID:8516
        
        C:\Windows\SysWOW64\Bjnmpl32.exe
        
        C:\Windows\system32\Bjnmpl32.exe
        268⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Bkoigdom.exe
        
        C:\Windows\system32\Bkoigdom.exe
        269⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        270⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Bhcjqinf.exe
        
        C:\Windows\system32\Bhcjqinf.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8684
        
        C:\Windows\SysWOW64\Bmofagfp.exe
        
        C:\Windows\system32\Bmofagfp.exe
        272⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Bcinna32.exe
        
        C:\Windows\system32\Bcinna32.exe
        273⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Bjbfklei.exe
        
        C:\Windows\system32\Bjbfklei.exe
        274⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        275⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Bopocbcq.exe
        
        C:\Windows\system32\Bopocbcq.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8924
        
        C:\Windows\SysWOW64\Bckkca32.exe
        
        C:\Windows\system32\Bckkca32.exe
        277⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Cfigpm32.exe
        
        C:\Windows\system32\Cfigpm32.exe
        278⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        279⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        280⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        281⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Cfldelik.exe
        
        C:\Windows\system32\Cfldelik.exe
        282⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        283⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Cfnqklgh.exe
        
        C:\Windows\system32\Cfnqklgh.exe
        284⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        285⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        286⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Dbjkkl32.exe
        
        C:\Windows\system32\Dbjkkl32.exe
        287⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Djqblj32.exe
        
        C:\Windows\system32\Djqblj32.exe
        288⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        289⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        290⤵
        Modifies registry class
        
        PID:1304
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        291⤵
        Drops file in System32 directory
        
        PID:8800
        
        C:\Windows\SysWOW64\Dbcmakpl.exe
        
        C:\Windows\system32\Dbcmakpl.exe
        292⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        293⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        294⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9092
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        296⤵
        Drops file in System32 directory
        
        PID:9172
        
        C:\Windows\SysWOW64\Ejchhgid.exe
        
        C:\Windows\system32\Ejchhgid.exe
        297⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        298⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        299⤵
        Modifies registry class
        
        PID:8500
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        300⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        301⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Fpbmfn32.exe
        
        C:\Windows\system32\Fpbmfn32.exe
        302⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        303⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        304⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        305⤵
        Modifies registry class
        
        PID:9208
        
        C:\Windows\SysWOW64\Fdccbl32.exe
        
        C:\Windows\system32\Fdccbl32.exe
        306⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        307⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        308⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        309⤵
        Drops file in System32 directory
        
        PID:8932
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        310⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        311⤵
        Drops file in System32 directory
        
        PID:8328
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        312⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8948
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        314⤵
        Drops file in System32 directory
        
        PID:8316
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8636
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        316⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        317⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        318⤵
        Drops file in System32 directory
        
        PID:9068
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        319⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        320⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        321⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        322⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        323⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        324⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        325⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        326⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9576
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        328⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        329⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        330⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        331⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        332⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        333⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Idkkpf32.exe
        
        C:\Windows\system32\Idkkpf32.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9876
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        335⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        336⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10012
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        338⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        339⤵
        Drops file in System32 directory
        
        PID:10092
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        340⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        341⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        342⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        343⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        344⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        345⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        346⤵
        Modifies registry class
        
        PID:9404
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        347⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9520
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        349⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        350⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        351⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        352⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        353⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        354⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        355⤵
        Drops file in System32 directory
        
        PID:9972
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        356⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        357⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        358⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        359⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        360⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        361⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        362⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        363⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        364⤵
        Drops file in System32 directory
        
        PID:9736
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        365⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        366⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        367⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        368⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        369⤵
        Drops file in System32 directory
        
        PID:9244
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        370⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        371⤵
        Modifies registry class
        
        PID:5944
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        372⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9756
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        374⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        375⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        376⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        377⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        378⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        379⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        380⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        381⤵
        Modifies registry class
        
        PID:4624
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        382⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9708
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        383⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        384⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        385⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        386⤵
        Drops file in System32 directory
        
        PID:9696
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        387⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        388⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        389⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Oodcdb32.exe
        
        C:\Windows\system32\Oodcdb32.exe
        390⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        391⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        392⤵
        Drops file in System32 directory
        
        PID:10364
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        393⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        394⤵
        Modifies registry class
        
        PID:10448
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10488
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        396⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Pajeam32.exe
        
        C:\Windows\system32\Pajeam32.exe
        397⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        398⤵
        Modifies registry class
        
        PID:10616
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        399⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        400⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        401⤵
        Drops file in System32 directory
        
        PID:10740
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        402⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        403⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        404⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        405⤵
        Drops file in System32 directory
        
        PID:10908
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        406⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10952
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        407⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        408⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        409⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11136
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        411⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        412⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        413⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        414⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        415⤵
        Drops file in System32 directory
        
        PID:10384
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        416⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        417⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        418⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        419⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        420⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        421⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10756
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        422⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10820
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        423⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        424⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        425⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        426⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        427⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        428⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        429⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        430⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        431⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        432⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        433⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        434⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        435⤵
        Drops file in System32 directory
        
        PID:10804
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        436⤵
        Modifies registry class
        
        PID:10920
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        437⤵
        Drops file in System32 directory
        
        PID:4848
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        438⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        439⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        440⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        441⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        442⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        443⤵
        
        PID:392
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        444⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        445⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4088
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        446⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        447⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        448⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        449⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        450⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        451⤵
        Modifies registry class
        
        PID:1356
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        452⤵
        
        PID:1220
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        453⤵
        
        PID:404
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        454⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        455⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        456⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        457⤵
        Drops file in System32 directory
        
        PID:10428
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        458⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        459⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        460⤵
        Drops file in System32 directory
        
        PID:3952
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        461⤵
        
        PID:868
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        462⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10624
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        463⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        464⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        465⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:228
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        466⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3280
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        467⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        468⤵
        
        PID:772
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        469⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        470⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2812
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        471⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        472⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        473⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        474⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        475⤵
        
        PID:11284
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        476⤵
        
        PID:11324
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        477⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        478⤵
        Drops file in System32 directory
        
        PID:11404
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        479⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        480⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        481⤵
        Modifies registry class
        
        PID:11528
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        482⤵
        Modifies registry class
        
        PID:11568
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        483⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        484⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        485⤵
        Modifies registry class
        
        PID:11684
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        486⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        487⤵
        
        PID:11764
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        488⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        489⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        490⤵
        
        PID:11892
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        491⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11936
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        492⤵
        Modifies registry class
        
        PID:11984
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        493⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        494⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        495⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12124
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        496⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        497⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        498⤵
        
        PID:12272
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        499⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11320
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        500⤵
        
        PID:11416
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        501⤵
        
        PID:11488
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        502⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        503⤵
        Drops file in System32 directory
        
        PID:11640
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        504⤵
        
        PID:11712
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        505⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        506⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        507⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        508⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        509⤵
        Drops file in System32 directory
        
        PID:12028
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        510⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        511⤵
        
        PID:12196
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        512⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12284
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        513⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        514⤵
        Drops file in System32 directory
        
        PID:11384
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        515⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        516⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11656
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        517⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        518⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        519⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        520⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        521⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        522⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        523⤵
        
        PID:448
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        524⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2980
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        525⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12280
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        526⤵
        
        PID:11336
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        527⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        528⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        529⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        530⤵
        
        PID:11604
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        531⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        532⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        533⤵
        
        PID:11744
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        534⤵
        
        PID:988
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        535⤵
        
        PID:492
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        536⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        537⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11944
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        538⤵
        
        PID:760
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        539⤵
        Modifies registry class
        
        PID:3472
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        540⤵
        
        PID:744
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        541⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        542⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        543⤵
        Drops file in System32 directory
        
        PID:4604
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        544⤵
        
        PID:12200
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        545⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        546⤵
        Modifies registry class
        
        PID:1496
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        547⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        548⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        549⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        550⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        551⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        552⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        553⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        554⤵
        
        PID:960
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        555⤵
        Modifies registry class
        
        PID:3896
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        556⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\Dglkoeio.exe
        
        C:\Windows\system32\Dglkoeio.exe
        557⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        558⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        559⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3140
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        560⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        561⤵
        
        PID:11920
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        562⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        563⤵
        
        PID:12048
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        564⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        565⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3296
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        566⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        567⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        568⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        569⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        570⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        571⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        572⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        573⤵
        Modifies registry class
        
        PID:3984
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        574⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5156
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        575⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        576⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        577⤵
        
        PID:1936
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        578⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        579⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        580⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        581⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        582⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        583⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        584⤵
        
        PID:3804
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        585⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        586⤵
        Drops file in System32 directory
        
        PID:11812
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        587⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        588⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        589⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        590⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        591⤵
        
        PID:212
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        592⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        593⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        594⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2432
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        595⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6596
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        596⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        597⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        598⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        599⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        600⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Qbonoghb.exe
        
        C:\Windows\system32\Qbonoghb.exe
        601⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Qapnmopa.exe
        
        C:\Windows\system32\Qapnmopa.exe
        602⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Qpbnhl32.exe
        
        C:\Windows\system32\Qpbnhl32.exe
        603⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4496
        
        C:\Windows\SysWOW64\Qbajeg32.exe
        
        C:\Windows\system32\Qbajeg32.exe
        604⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        605⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Qikbaaml.exe
        
        C:\Windows\system32\Qikbaaml.exe
        606⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Apeknk32.exe
        
        C:\Windows\system32\Apeknk32.exe
        607⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7008
        
        C:\Windows\SysWOW64\Acqgojmb.exe
        
        C:\Windows\system32\Acqgojmb.exe
        608⤵
        Modifies registry class
        
        PID:12116
        
        C:\Windows\SysWOW64\Aimogakj.exe
        
        C:\Windows\system32\Aimogakj.exe
        609⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Acccdj32.exe
        
        C:\Windows\system32\Acccdj32.exe
        610⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Abhqefpg.exe
        
        C:\Windows\system32\Abhqefpg.exe
        611⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Amnebo32.exe
        
        C:\Windows\system32\Amnebo32.exe
        612⤵
        Drops file in System32 directory
        
        PID:6620
        
        C:\Windows\SysWOW64\Aaiqcnhg.exe
        
        C:\Windows\system32\Aaiqcnhg.exe
        613⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6116
        
        C:\Windows\SysWOW64\Adgmoigj.exe
        
        C:\Windows\system32\Adgmoigj.exe
        614⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Abjmkf32.exe
        
        C:\Windows\system32\Abjmkf32.exe
        615⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2892
        
        C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        616⤵
        Drops file in System32 directory
        
        PID:7988
        
        C:\Windows\SysWOW64\Adjjeieh.exe
        
        C:\Windows\system32\Adjjeieh.exe
        617⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\Bigbmpco.exe
        
        C:\Windows\system32\Bigbmpco.exe
        618⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Bmbnnn32.exe
        
        C:\Windows\system32\Bmbnnn32.exe
        619⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7428
        
        C:\Windows\SysWOW64\Bpqjjjjl.exe
        
        C:\Windows\system32\Bpqjjjjl.exe
        620⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Bdlfjh32.exe
        
        C:\Windows\system32\Bdlfjh32.exe
        621⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\Bfkbfd32.exe
        
        C:\Windows\system32\Bfkbfd32.exe
        622⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7468
        
        C:\Windows\SysWOW64\Biiobo32.exe
        
        C:\Windows\system32\Biiobo32.exe
        623⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Bapgdm32.exe
        
        C:\Windows\system32\Bapgdm32.exe
        624⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6372
        
        C:\Windows\SysWOW64\Bbaclegm.exe
        
        C:\Windows\system32\Bbaclegm.exe
        625⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Bfmolc32.exe
        
        C:\Windows\system32\Bfmolc32.exe
        626⤵
        Modifies registry class
        
        PID:7936
        
        C:\Windows\SysWOW64\Bmggingc.exe
        
        C:\Windows\system32\Bmggingc.exe
        627⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Bfolacnc.exe
        
        C:\Windows\system32\Bfolacnc.exe
        628⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Cibain32.exe
        
        C:\Windows\system32\Cibain32.exe
        629⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\Ddfbgelh.exe
        
        C:\Windows\system32\Ddfbgelh.exe
        630⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5140
        
        C:\Windows\SysWOW64\Ephbhd32.exe
        
        C:\Windows\system32\Ephbhd32.exe
        631⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Fclhpo32.exe
        
        C:\Windows\system32\Fclhpo32.exe
        632⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Fglnkm32.exe
        
        C:\Windows\system32\Fglnkm32.exe
        633⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\Fdpnda32.exe
        
        C:\Windows\system32\Fdpnda32.exe
        634⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1256
        
        C:\Windows\SysWOW64\Gddgpqbe.exe
        
        C:\Windows\system32\Gddgpqbe.exe
        635⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6692 -s 408
        636⤵
        Program crash
        
        PID:7940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6692 -ip 6692
1⤵
PID:6608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bheplb32.exe

Filesize
163KB

MD5
dd91a3c58f6f269c4dc1e6d761e26ee2

SHA1
508f235873abab118d3c51d5d8ef63ef5ee2d826

SHA256
d1c5b97ba07925f40380a3197474bfaa176d8e0de16513332fca302dea78a81f

SHA512
af597913ed1970f257aa6fe271cdbf11f04e6542dd7623834c11ea7360e0cb9f8debe3a2e3291825292554817e518611f57b23d208dda7e633b48c0c30e18346

Download Submit
C:\Windows\SysWOW64\Calhnpgn.exe

Filesize
163KB

MD5
e49ae5f2cc025cc8990150dc1bd27e8d

SHA1
c13ab877149f0321c465ef55bca041e0198b8db7

SHA256
3db52ec1250c71df166f4e36118632682eab65ba39634190bb548c5f52270fb2

SHA512
c4e54b0e453fd21b7d13060f2276e488a9eb48e13ea9cc4dace4825df86c4918afe05d52b3a14de4384085426d8443b6c0277a94b0371cfac95cbc15080e6615

Download Submit
C:\Windows\SysWOW64\Ceehho32.exe

Filesize
163KB

MD5
a65eb94d1a0b0242236de7cd2cf80398

SHA1
afc1134bc55e323b68a69cefb74358ada0f7a685

SHA256
2911fd779ad41d5059af6748be90bb247e105806a7be465c8ea603a360131103

SHA512
65774a9ce435b287fb58608edb605f8e79e127411c3920410533074b2a78bf95b6aea3cddf7fecbc76ce620cbb70201f2bf5db2a42120d5930befc34500f7c7c

Download Submit
C:\Windows\SysWOW64\Cenahpha.exe

Filesize
163KB

MD5
200e318ae92db4e5d2997f85454fb2bc

SHA1
93646ad8a58525ae7c1d8af6ca5dc6ec3cf771e7

SHA256
77b536b558fe6193fb67e0b93901fe60ae3283ea24a6b5178c41c1720057ce84

SHA512
ac9580cf1a7f57ee220a93dff7f5b77f4f0dafeb0205e8eecc19c90b571fd5f58932f8ebdcc966e055d3aeec66fd76cae49b58e5844d4011339107168c4aaff2

Download Submit
C:\Windows\SysWOW64\Ceqnmpfo.exe

Filesize
163KB

MD5
7179a743afa176e25b2db849d16325a7

SHA1
26f3a0abe0044dea494899e18b0cc89d439d458f

SHA256
874000d078cc576bc1fee7ca6d72c4f0e78071848735b9c0b781e1d51b5ba420

SHA512
264ab2b5baeefcea5b078e4c54424cc5d66927c3b5653d44e19b2e6e10cca77f1bacf9fbc0c1301ee01add66b80dd5fdb6f8ee9d915e010012f00f923d61c136

Download Submit
C:\Windows\SysWOW64\Cjmgfgdf.exe

Filesize
163KB

MD5
90995287842d2a5ec03e72f1a29112d7

SHA1
3b1ed1ddaa96270272a0371db293ef08b5c5d105

SHA256
04205d495487edda6c1082c7985f0502817b08f71833bb7865809494b83d15a6

SHA512
faac58db34c77640354c8f22adbf41a567b3d28e11d1bae8ad37493258f69a7c4019d7076c7aad20328b1b0be73db8d4b10f35a69cf261ea79e57bfbee3521ce

Download Submit
C:\Windows\SysWOW64\Cnkplejl.exe

Filesize
163KB

MD5
36362bad674423b048493fdd449ac0e7

SHA1
fdc77048590e2547d61ebcdc10224fd4740f19e0

SHA256
d5c9bfdeebc4257558456a4877f2223a83fd96da224be6170343eee1bd8bc095

SHA512
f3a12dfb4c87338541f0f62af8592393c68d2b7a37ea8cfbfd826b849123ab74b380e04c0b608b085aef7a4dc189d5ddc2f0c5cc4ff0a5bbab1cd1ff1dd9320c

Download Submit
C:\Windows\SysWOW64\Coiaiakf.exe

Filesize
163KB

MD5
9162965f7f0d33f416fc770c13848cf8

SHA1
e1261629c0276d20d80d4b0d1d90e51acc10bfe1

SHA256
00c3822db7849ff087e56e9e543fd5dd945aff3ee60045db83327978c31c982d

SHA512
971b28e900c45cf19336bbf5689cca1eaea1913c5679bfa1ac84107be36c779d4fecf1aca399f544aad3b6e6e9addea8ea1c47ba2af26965e013fad3a944ee3c

Download Submit
C:\Windows\SysWOW64\Danecp32.exe

Filesize
163KB

MD5
867a0d5d077a05811e53f97fa6b099ba

SHA1
ec6eede117dbcbf62fcf85a29f05a4de366510c2

SHA256
822ca285e59aa4529c3b1d2bcd0e42bb065f3e73672e194b68218b1fbebc1966

SHA512
8446f161e2ecbcfa8c0a3b3371dff0162248d04611d72e580a1673335ebe55407298bbd5d5f7754dffae3f9d8aa410cd2cd57f2996439baa345251f9be5e0f5f

Download Submit
C:\Windows\SysWOW64\Dhfajjoj.exe

Filesize
163KB

MD5
bff56199a0a24558071dde360dc40f5d

SHA1
2bc9ee4fb5c01535567c32851ec44123ee97bad4

SHA256
820174265fef72ce27be56d87433ca63dac1850f001104199256fdfa091425a8

SHA512
b1abe9eb76480059a66949d8acc45399c3dc759ac0617dcc05309dc42d8cf1632c1e53dbb43f421db7a52af2a5a4052ba585b456bd66290dd7b9bbea4350be1e

Download Submit
C:\Windows\SysWOW64\Dopigd32.exe

Filesize
163KB

MD5
2c81fe5c829c0c5865f65dcc9d5cc077

SHA1
1774163c6065caac187b98f54c7275a848f34a5c

SHA256
970863cac9a5dd6fff2ab9693e72f694d72b2df8944aabd6db0e95febbbcbfc0

SHA512
8cc0d7b208ce971a9f0a7d6c1600ea500fb0a0dc3af782a120a5a7e93cfb3e50b7dcbff051f839cebda1d440eefcef1e09679ee6cee6157e32a63c5e2053eeba

Download Submit
C:\Windows\SysWOW64\Dpphjp32.exe

Filesize
163KB

MD5
bdf07503776470b3169cbeeb1f5717c3

SHA1
39a71782c1228a82deec7bbaabe6fc1d746af69b

SHA256
0ee2ab06f3fe1a8509abc2f031029e25427cd0c64494d292aceec1c68294157a

SHA512
89b7cbda00da88ff2ee7bc3bf5e6374b68233f2a34a8b36a7177db12ed940a0b76caf634bfc2ee48f2f567a0f7117fcecdb08b9ea79cd62d3d5f6590052748e1

Download Submit
C:\Windows\SysWOW64\Eaonjngh.exe

Filesize
163KB

MD5
ea568ebc4a1dbdf9103931ec6f823965

SHA1
5f8160d0b7fb477d66f0937f80bad38cfbf5ce31

SHA256
474142130dff345aa5ccfe9c7f07778513f5a88ed98b16ceacef6a6b9ebd8cfc

SHA512
ccf233253b53016fa6987e8ffde17658e172a78b22e61b6eccd0c8de8185419ac30f7ab46e132a13a9a13fcfb8ff8cd63baf9b54bd30c9a3a54dcfd211213405

Download Submit
C:\Windows\SysWOW64\Ehiffh32.exe

Filesize
163KB

MD5
024dbd3d303f321129e2006023053db4

SHA1
51d50e3bce8d850db1cb50c49bc0538fab2d4b55

SHA256
7aedc0707a5ed50d00e504ad3832303c59523e27d258983dd91716932ee341ac

SHA512
75f06bea3668c8fdb9d35617f0d89086152acf8ab629a970b11b02fa579d3cba254ce1f26dae6789705c94eb283a5802c580f149dc6ab8181c4efbda0be75f6d

Download Submit
C:\Windows\SysWOW64\Ekiohclf.exe

Filesize
163KB

MD5
58c3f59a86c03e3adb388a64130a5b0e

SHA1
10e0ac59087e8c5e4d4e2ced3445101d75046d66

SHA256
29386ab9f99cb0c947f52d5f6a3484ea7a591b29e9a255d655c82f58f329ca0e

SHA512
40273840fc4de686d3407e639d4183ba9029c4261deca1804c3e988cc1d4f2e9c477c02ec8734ae4320b5f6af8626d2ee2e6c38bd31d88512cc7bd2a62726609

Download Submit
C:\Windows\SysWOW64\Eplnpeol.exe

Filesize
163KB

MD5
ea6046ed5f50f5fe2ecbcdc83ab9e962

SHA1
86c802d7c0a66c75ed99ea26c40405d294f1987c

SHA256
c130ac0deea1908d9372df52d0834868338bf394f712508c3ac65030b4638fd7

SHA512
fc34550ff3b12cb938e8c34ea52abc6d49ad25dbc4dd5bdc4c2286bafee8630e9a6cce256e9dc56892c598f3a335176617a86bd16c58b8fbf242ec8741572674

Download Submit
C:\Windows\SysWOW64\Fdglmkeg.exe

Filesize
163KB

MD5
9b1dc841ecb5614055a5d06cefa9cd4a

SHA1
8c58ff9d161076ecfa4d0018eb3eef2db358ff6f

SHA256
e1b9dbcb014acdac348805747335850ef6c359614bb8e4058d71e5b2f9b6ef9f

SHA512
06e439e8c1738cbdd6c5df56df38e0bf336d80508d3448952af8f16d142920160a900e0688bbce995208eb4d3a73abf6baaac1dea9f94602a86dd9088b2fdf58

Download Submit
C:\Windows\SysWOW64\Fdijbg32.exe

Filesize
163KB

MD5
a6ebd4818b0eafe0bfd952b92856a74f

SHA1
67b0659d9d9444a838504f85c9230135be8d8a04

SHA256
3bdc812c19d5c1e79e0b37d79296681542a6d5f45063602c842389a3427db45a

SHA512
e1c97a57304d9eca7fefff39fa85c2d9217d72f324d8fb0d84676426088e5247836228eb153f4bbc16c9b6d1367caf5e335714e97b38c34311541f5d91c58877

Download Submit
C:\Windows\SysWOW64\Feapkk32.exe

Filesize
163KB

MD5
5d3f103c8d6571c2668191cfaf18f666

SHA1
7b38d16f2fe9619c4fd7c026d02135919d05437e

SHA256
3962deab8d6c55c45be546a3983330d8d243b308b066030dd91867e775cd65ba

SHA512
3b8d4f547160225d6e38a0d1b64eabad8113cfe5e86a3ec239a678c6a9b69aa065533eedf04e7203821302ffcf1f170645354d37d441bc9172961554a40010cb

Download Submit
C:\Windows\SysWOW64\Fnmepn32.exe

Filesize
163KB

MD5
e8c61f710cfb0fc3fa0d97fe5d8bb82b

SHA1
4c5c3f6e5c1fd9e90eaa95314cb30c8228ad480b

SHA256
3b8594a87b1ab57296f70313407bad0670f155319249cfbdfa89190b00898a0b

SHA512
0b25fc971da13a384b7dc07bf637c8aa99d4c20068bc52cc491e3a1a442064ffb89ac1a497a94ca3a1b9e72f36649be24ff6723fc83d3c97b614397db81d3823

Download Submit
C:\Windows\SysWOW64\Glkmmefl.exe

Filesize
163KB

MD5
96dc2daf51787aa7784d15fa666dd1b1

SHA1
cec4485b6e22efd234205761de368089b10119de

SHA256
4d52a6e724c106659f6715ef2bbe8c3e6cd126c907eb2f255acaa936791e7300

SHA512
e3caee407daaed4840d34b8f5d3b9ef27515935c3d583304cc15418c7682c304f98c00ab23f2fcb5ef94d90114453fd2c3be668b15b7ec607581b577c0f3eeae

Download Submit
C:\Windows\SysWOW64\Hdpiid32.exe

Filesize
163KB

MD5
3f638bb94ea23b99008a329854b8e360

SHA1
378af1fb4d5a3d298ca278460403cb7d4879556a

SHA256
8768ae2fc6a7822dac21fb17fa6f141f3e858e44774f19f62158b3bf1e78d9eb

SHA512
9c915a7a2e3bc73c63ee01c7a6d49f8c52e6c85fa435fce9344b4597740f3b6a16373586fc8f974aaa0557397791890ee50fb1e6b9e8d669438f5859e8b236db

Download Submit
C:\Windows\SysWOW64\Hhgloc32.exe

Filesize
163KB

MD5
d21484e13b2354175d55985b1000ef25

SHA1
e2090d0656966805fa8fa352289e753c8b4bd0c5

SHA256
3fee0b402242e5f34792d78e97733518a8fc8adffa4f864ff1df0ebf6d6cc9b9

SHA512
df87c1fd27ec20704ba8ba55e16c0f5ee53f5283338d5461ec55c74863340f8c6f94c1eb50df2959cf884a28310e0f96c5a3e339549cad77d327ec8c540c1e9b

Download Submit
C:\Windows\SysWOW64\Hhihdcbp.exe

Filesize
163KB

MD5
65ed6e93b9ad46b1c801cc284ecbc7d7

SHA1
6ca553de70bf4b3dbf807afb967111b86e1b87be

SHA256
16540a9096ce3ab68f7a96dda7823f8c0e403408d010d7dfa28d952c44fb699b

SHA512
969a0424e6588b7fc25c7912c62181485ff5620bfd594fd51c91a378e2ed2b41e855122eb4c0d1dcecfe2743e5f9fc880ab6cbcd8c4fd743addb008def0ac4a9

Download Submit
C:\Windows\SysWOW64\Ieliebnf.exe

Filesize
163KB

MD5
66ce0481a3bd4513d0b656017801fea2

SHA1
a2628978b831908c1521acf8cc4683f601727006

SHA256
ce3d33dd9d1cc1e084bb16fb59e0f1b5eaf3a3fc8834327269fc8fbb56a0249a

SHA512
e1ee1852f908e31be6a9aba0180182674111356536d251fd7deb4ec8f302132e5db4e098e6e4c4fbcf4e788a7844c5b6a994a0e176d9c8158b4712752d5cd897

Download Submit
C:\Windows\SysWOW64\Ifbbig32.exe

Filesize
163KB

MD5
60e5d1d8c085d843ba23432574939d66

SHA1
06041b0643462476f85394a7d62cdf89f0cf0cc8

SHA256
da754e63a5a06218e6bf7f95cfdf8ebe76888a4cafd9ff60775ab4a422b651c4

SHA512
aa70703444dc75bff5bf8fe029d25dded5eabf1f9acd17b445664180c7752f472156646f787250365383052ef306f6020e054c6ff0d50bba38a00b1ee6d455f8

Download Submit
C:\Windows\SysWOW64\Ifleoe32.exe

Filesize
163KB

MD5
2c431db4bf08031d73e3d529f291cfc0

SHA1
b2f45506abd66001190b5497cd718c493995a6b2

SHA256
f359acf31fad76edfb2a416e0a99aa6b3521c296c8c839b85494d34d8ee6fd31

SHA512
4beed184c04b48c332d7ce66514ba480c8956f61f89465808b0a074b83d4879207dccf70aa49cb32bbe083ed1b6490b8fa068f038fc35d3c993b6bb201e55f64

Download Submit
C:\Windows\SysWOW64\Igcoqocb.exe

Filesize
163KB

MD5
fa0b4ef01031c0bb1a89eddcd6c4a7f5

SHA1
4b43c58aa1f06bba207060d7c5351fdbfb2daa17

SHA256
3f1b9cafbc32845e012c39e97b55307f85c0c0f55cb32d482c57d5795a9fb17d

SHA512
ab7e59eb166a89ec1a010ceb3e52a6e158b9a987339dc1381359c583ec9e23a208733576dd44c5e43f6885c38200cecb32f95e063f390b637fe7dc2c1bec69fe

Download Submit
C:\Windows\SysWOW64\Ikaggmii.exe

Filesize
163KB

MD5
f1a2d36f809ab2578d8e935506c94c48

SHA1
77e031fbc6d3660cded489dfc99337541607c34f

SHA256
d2d853fa85e0d0413ea8ce087115184b2bc08639f1209f5e314e164586572674

SHA512
536e11b1582832e224341b40532a32f14d852bc91c27e332730b59da3cba2fe2b6b902341f3750bde3c00e1829d2fe7e41bd9910d02e3ee7df87e3ddb6b98443

Download Submit
C:\Windows\SysWOW64\Ioopml32.exe

Filesize
163KB

MD5
32341ffef35acfaff25728965eb346e7

SHA1
2f23c18790aa58675b983804e701d50b55c65ab7

SHA256
9d2f20baab21763fd9e3d0831098875433020014afeba3b119054dc4eb64c34c

SHA512
c50f5e0ec79c8ba6ed4874343723b67f69778eaf7b27888c28acbf6d4726bb9c7f77c40dcf3cc362959d48c3db40752daa0a822ed87bd01d90079f09d23bd4ba

Download Submit
C:\Windows\SysWOW64\Jfpojead.exe

Filesize
163KB

MD5
cd3f5fb6d2a081074451c1363367029b

SHA1
5447b845190da14d4889f7a22f42449226cbcb99

SHA256
c5ca92ba71a48da3f8b03aa81adec25f92c7f841b7bfffa7e79b26a017c64b9f

SHA512
52f698ef9b35d67e996003a692a5e167dd7a70af3bb9c3fccfb55201d439432cdfa339acd37c915f7fde2e1acd12e0d778c9adc185dbc8849be202faa8250531

Download Submit
C:\Windows\SysWOW64\Jkkjmlan.exe

Filesize
163KB

MD5
e278e1b7a7f9c8effac687c4d6ec3510

SHA1
0a9663a5516b4854e973ec3e38963a31408aa44d

SHA256
30214f15b91d77b0823eebc4951c28308af09dda1cda616fc997bc230ed1fc9a

SHA512
d4ad467ad7b456bd364009d2c390ad32ed12229afef3f58c1c031fc5a457a565c1bffc82ca8933e8e6e8849bd94b3aba8a3992b371d23d1acb4b3e04f6c66dbf

Download Submit
C:\Windows\SysWOW64\Jngjch32.exe

Filesize
163KB

MD5
e561564bf08db1c17921c7ff81d59a08

SHA1
c5ee8a56f4c1e862165a36e39efa70d93202d36d

SHA256
82727d051db4b6ba056721c192ac9ace77aa99fbe23405bc2bec7f5e8bb730e0

SHA512
d22828cde4dc8577d1b068c35b014533110971db0797f816770bdaa8eee9ab8310c98e591a2014969180c1624ecbcde93382700c3cfbe2e6743e23509e89d076

Download Submit
C:\Windows\SysWOW64\Joiccj32.exe

Filesize
163KB

MD5
d23fce421ed5c41b921c95a151bb37b9

SHA1
b98b28a92a5ffcdab4092fca675bc7dc2801224c

SHA256
be86f7ee8995cd19e13eea4c20bfd154446d6e3b864338786af11d03fd1286c0

SHA512
f6b507fbf9e04dd8b023655a438dc0937ce002960865445eaf70d4fc3035e352ed530582c265f56fb0ab1a0bc2b2e3f0248c0506a6c3e54569f154ad16256c66

Download Submit
C:\Windows\SysWOW64\Kkjlic32.exe

Filesize
163KB

MD5
d08c9d668c719da1a2305139e059c3cc

SHA1
dda1edb01dda79b896f7e5e61e72928506aa07ab

SHA256
624c134076d5ae5271240bb90daa076d27ff2748cd3f5ec271af07c6df9ceb53

SHA512
80553beede9888cbb168ee6026ddc3f3748668ebfa205fed5f534c38885059d8289cbee26cb58f6f0520aa6af0a5dfc725f5714cc47d6857133b04325cc2445d

Download Submit
C:\Windows\SysWOW64\Lbnngbbn.exe

Filesize
163KB

MD5
9b87a44a06ae065a617f6192793e7ce6

SHA1
cf21e120ef080a4f01b02fc68123e3ad15ad912a

SHA256
fea1dd014d2e7a4d88ad5d80f666e494bd99ae4a6107127c4cadf0fcfcf223a2

SHA512
84f199d0025f8cfd7cbe5f776d1f157516881c9674ebd562fef13eef0a36fd40e6ccf738301389be3b3e2d6c84e3810da2fbd64e059cc5018b8a6224c7db81bd

Download Submit
C:\Windows\SysWOW64\Mibijk32.exe

Filesize
163KB

MD5
e0dafaa30a7b9b4818076bcd005fc32c

SHA1
898ba73f53ccda34af8ffc6ba4330ef955ab6e9e

SHA256
6f8f667b82df257a52ba4972c85af5631430bff8ed740a839187735227198f19

SHA512
77ffb75e8ff42404f5ab4f65e02777ca06f71f3082ae179d25d1ca6c05b9dbc4f3c633e1074e57ca32606d3c47128cbe945db34d63c9c70b3d9ca7ed7cfd3e80

Download Submit
C:\Windows\SysWOW64\Mlpokp32.exe

Filesize
163KB

MD5
20a99033fa3076fcc924d069a8014fea

SHA1
374656706df37f1a7c629aa9d53485af10aaf5fa

SHA256
34f167d680c04e35a9f5ba8d19da93b6255b7234ef557b675f7ad3b45ba68f84

SHA512
200e296ea4ecb5653bb2c8fb19503dee6d29070330ef9280fb9cc99b3303dc7a19c6e8c76c636ce12598c9f9c78efd32419c1e35d2f71e69ec3fcac9651797b6

Download Submit
C:\Windows\SysWOW64\Niipjj32.exe

Filesize
163KB

MD5
8753b53f820e058be18256d4a83fdbb3

SHA1
866e07daaf7d0289f56de6d218fd1d65e0477fb8

SHA256
b4408064ff0066f0fd3af49a89f6e64ef5d65aa6210165d7e7a70f199b15a422

SHA512
727becf684c2c237638e71ec3c6ac917d0316ee13e31f4d83c0b1b3cafd12cd2712d9f552ecd854ee7c45b044eb975352607a05d38a22586078b3f3925327cea

Download Submit
C:\Windows\SysWOW64\Niooqcad.exe

Filesize
163KB

MD5
7f97e5e63ea03de68b71b5718ac15543

SHA1
c1ca1621a71eed0901a533490c7cd9761a4f7b7b

SHA256
7b8bee06c629c5ba66d77a4d6364bfc8092b7e4a17439b146455d512ceab8252

SHA512
8e7a56b146571191455124405563272f21ef96e65848d396a1f4a7d048460d6c3006460aae1b119a88c4fa523ebf4ae3cfbe256a4ce3e187fedabd6418dd42ab

Download Submit
C:\Windows\SysWOW64\Pcmeke32.exe

Filesize
163KB

MD5
fa082d0e6343d7f8bd4ab1b6f1b5c269

SHA1
d75087223144954b25372c3a4c050be5f0869b77

SHA256
f31e063c0e162254549314274cb8266b1e39b7a7c9a1d5769304463befeb8288

SHA512
00ce5f53fb2c3b19193cfcde7c79adc8abb8b55bfed0134aca1dd57ff560b47cba6691e12faaa10e9ff9da433a9346770c9c14de934e544cde565b2fd7b16bc1

Download Submit
C:\Windows\SysWOW64\Pdmpje32.exe

Filesize
163KB

MD5
ef2309e6c313d401671d605e78676639

SHA1
6403c22ba590b855509632789b9fc6a41594d20f

SHA256
b846148e9b6f11a0995a87ec0cf1de2691f979e2d79d135e18cb4cd87865a14f

SHA512
162ed5f7353a0faa196a2097cdfda066d658ca464749d6a30fa5955953d4f66d283f676e82a4279d344223e2bf3ef3322f6cc533ff8d4cc84b36f6add880a034

Download Submit
C:\Windows\SysWOW64\Pgioqq32.exe

Filesize
163KB

MD5
0bc91206b16dfee3eccdb5e7da56e011

SHA1
5f5d6d543ed56f43c1c0741fb02d6c4f51db6fa9

SHA256
a351fabaad2806b0a7ccbf5388881f20e3c269f76f79dc05e34da01d2ca07dbc

SHA512
cdc8e6e17ffdc9a076276c05a8cd5255214d208a37f1397506d1e4a14fce42dbb1e3148c28eac4794d60c298af1053ed4d45bb001bcc3d932d1ebe49ed94f90a

Download Submit
C:\Windows\SysWOW64\Ploknb32.exe

Filesize
163KB

MD5
9c9488ee81c779eae17b4c1e8aa0fe75

SHA1
a2f534cbcc08393ac682c439b5dfc60bd9f27820

SHA256
a1e82ac0fca40e69b6fa2233ef9f8a5748f9433012ba3ebf57eade1f514b7638

SHA512
3c4501e40c0c75b2dfd3f27511ac76039cd447a7f30b1db04481d3f69ac023fa086617228f1c8012ee052a442132ea3def89ebf49486ed611831162235d1498b

Download Submit
C:\Windows\SysWOW64\Pmdkch32.exe

Filesize
163KB

MD5
f711ff89f435fe324f4ecfaa85762129

SHA1
4cfce09626e7e2145ec2c8c6269421197c495ec2

SHA256
d4101f5f348f926edc4dbad1c0abe064058f1fdf95e618672e03c575044fbb59

SHA512
3ba0a74544b77064fe0641238e2cb23ec571680466cb82484841b63eb8a3e9880de0d5b0c9c8ff4b31dc214d6683076a18af27e84e115fea3b7cb8e6857f2985

Download Submit
C:\Windows\SysWOW64\Pnfdcjkg.exe

Filesize
128KB

MD5
a777790e7d325c8c47c04dc85fb309cd

SHA1
c72748efdaa6ad9e9ab7d93c0cf9cc8260e3893e

SHA256
0aeb71da14eab85a04200fd281013cf2be5565b75fef7999b574b60c6b3f6998

SHA512
85708cae7e48fe16b8eea5401df90ab9f30ecdef6ca2ea19b31340ebced085c7a392f37ff9704a03785ae42b79a7da3eba3533aca7ac36737a8c899245ff6825

Download Submit
C:\Windows\SysWOW64\Pnfdcjkg.exe

Filesize
64KB

MD5
44aa321d99b5d35b4bdf40b408ec1178

SHA1
e0a0e3dc3e42c1d7050b78a45f0ca16bae192009

SHA256
37b1dca92789b341270db164c137ccf0d66dfb1af18f0afb24ba8a2c29cfe8a4

SHA512
101ba1f2517edfd893f68ffe1a5427ad8ce77ae57cb8395f3ecd4ff70fda5ad59525ae4311502c4becbe398b828fd0095888d38a1b16d4c307e6655e84bc7f53

Download Submit
C:\Windows\SysWOW64\Qoelkp32.exe

Filesize
163KB

MD5
f7b774339e18fd727a53b0f054496b4d

SHA1
2f7f8045dbbcfe6aa7885c31c9f48802714f8698

SHA256
9dec239e06f01bcfae28ba6c91376ffc87d4543e37611c1244bb8703ee028269

SHA512
5ca456e2b3c9d418098d3014db06f9bf39a7fe5b7699069386a2ca62d10a0c7fcfe31dc90f40c4421e77264896c915f3f91186135558a37feff15796da774537

Download Submit
C:\Windows\SysWOW64\Qqfmde32.exe

Filesize
163KB

MD5
1102b198eebde59195b95242becaca60

SHA1
091e3fd63924c70f019094011993464290c551da

SHA256
76edc0b7f56697eef3cefed592a782b1a355f13cd2aa23a7d9f95992f6ca4073

SHA512
f266fb59cc4b265d0ab1c368c13a20684b0623797f5c84aa4d9ed00e0edadf6e6411f4afb7aea4b2b185ac414e5b9d6b1796f71bd7cbce2ba9220fc05e27bfdc

Download Submit
memory/404-96-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/440-112-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/448-168-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/544-425-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/556-353-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/744-389-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/772-79-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/868-24-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/888-311-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1096-419-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1100-299-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1120-225-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1252-359-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1312-282-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1376-431-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1432-305-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1604-215-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1668-0-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1844-16-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1916-32-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1940-443-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1980-120-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/1992-12-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2172-151-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2308-241-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2352-63-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2472-183-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2584-415-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2808-71-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2856-395-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/2892-257-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3148-135-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3304-437-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3412-401-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3440-274-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3464-92-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3540-264-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3568-371-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3724-288-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3732-347-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3868-407-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3920-365-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3948-333-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/3972-48-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4072-208-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4128-128-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4328-377-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4356-104-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4388-184-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4404-317-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4480-335-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4484-280-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4608-160-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4716-56-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4732-341-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4760-199-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4776-192-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4788-144-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4816-176-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4828-249-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4844-383-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/4908-40-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/5028-232-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/5088-323-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads