2a8662ca25f88664d060b2a8446dbd077076de37ce0cff17aa3877c3bceb53b5

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2024, 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a8662ca25f88664d060b2a8446dbd077076de37ce0cff17aa3877c3bceb53b5.exe
Size

197KB
MD5

a53ef7d12d7e59205fd571bca8df926f
SHA1

eef214519dceb2d3389cf01746af92eba1cf51a9
SHA256

2a8662ca25f88664d060b2a8446dbd077076de37ce0cff17aa3877c3bceb53b5
SHA512

b5de298a2c0b0820d27b4fd9b6870782d44bee907387218e6c77f3f27aff94edb729001beb8c7416c5087317086e3284059786dbf079a4591b80a28e47be9552
SSDEEP

6144:ad5P4Wg4fQkjxqvak+PH/RARMHGb3fJt4X:ad5Ab4IyxqCfRARR6

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aelcfilb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldleel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcbiao32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojalgcnd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Impepm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifopiajn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfaloa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jagqlj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhqaefng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olmeci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjjhbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djpnohej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpjlklok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qgcbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Debeijoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gifmnpnl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imdnklfp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbddcoei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nngokoej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djlddi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Efikji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cklaknjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipknlb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfaedkdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojoign32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdjfcecp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Maohkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkjlge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hecmijim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnaikd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gcojed32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmpngk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caebma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhqaefng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dphifcoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbenqg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfffjqdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhaebcen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Blbknaib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fljcmlfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmnaakne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfhbppbc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmjqmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgbefoji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdcijcke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abngjnmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbllbibl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddmhja32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfbploob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mckemg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqknig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ageolo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgpagm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blbknaib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cojjqlpk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eoolbinc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Docmgjhp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bganhm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icgqggce.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfffjqdf.exe

Executes dropped EXE 64 IoCs

pid	Process
2536	Clqnjf32.exe
2108	Coojfa32.exe
4760	Chgoogfa.exe
1148	Ccmclp32.exe
3232	Cekohk32.exe
4932	Dpacfd32.exe
868	Dcopbp32.exe
3708	Dlgdkeje.exe
1112	Dcalgo32.exe
4040	Djlddi32.exe
4552	Dhnepfpj.exe
1412	Dagiil32.exe
1268	Debeijoc.exe
4488	Dhqaefng.exe
4808	Dhqaefng.exe
3544	Dphifcoi.exe
4332	Dcfebonm.exe
2416	Djpnohej.exe
4928	Dpjflb32.exe
2856	Dakbckbe.exe
3592	Ehekqe32.exe
1120	Epmcab32.exe
1296	Eckonn32.exe
2136	Efikji32.exe
4636	Elccfc32.exe
1444	Ecmlcmhe.exe
644	Ejgdpg32.exe
4784	Ejjqeg32.exe
3332	Elhmablc.exe
1448	Ecbenm32.exe
992	Efpajh32.exe
1172	Emjjgbjp.exe
4632	Fjnjqfij.exe
3208	Fmmfmbhn.exe
224	Ficgacna.exe
220	Fmocba32.exe
456	Fbllkh32.exe
4136	Fifdgblo.exe
3324	Fqmlhpla.exe
4100	Fbnhphbp.exe
4144	Fjepaecb.exe
1092	Fqohnp32.exe
3696	Fcnejk32.exe
3648	Fjhmgeao.exe
2056	Fmficqpc.exe
3552	Fmficqpc.exe
2808	Gcpapkgp.exe
4372	Gbcakg32.exe
2860	Gjjjle32.exe
4832	Gimjhafg.exe
3236	Gqdbiofi.exe
3156	Gbenqg32.exe
4284	Gfqjafdq.exe
2908	Gjlfbd32.exe
2248	Gmkbnp32.exe
4400	Gqfooodg.exe
3772	Gcekkjcj.exe
1492	Gfcgge32.exe
3892	Giacca32.exe
4684	Gqikdn32.exe
1864	Gpklpkio.exe
4156	Gidphq32.exe
32	Gqkhjn32.exe
840	Gpnhekgl.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Aecqac32.dll	Cklaknjd.exe
File created	C:\Windows\SysWOW64\Nfjjppmm.exe	Ndhmhh32.exe
File created	C:\Windows\SysWOW64\Beihma32.exe	Bjddphlq.exe
File created	C:\Windows\SysWOW64\Dlgdkeje.exe	Dcopbp32.exe
File opened for modification	C:\Windows\SysWOW64\Dcfebonm.exe	Dphifcoi.exe
File created	C:\Windows\SysWOW64\Hmklen32.exe	Hjmoibog.exe
File created	C:\Windows\SysWOW64\Pjmlbbdg.exe	Pkjlge32.exe
File created	C:\Windows\SysWOW64\Dekclg32.dll	Gfbploob.exe
File opened for modification	C:\Windows\SysWOW64\Dopigd32.exe	Dhfajjoj.exe
File created	C:\Windows\SysWOW64\Dngdgf32.dll	Lgkhlnbn.exe
File created	C:\Windows\SysWOW64\Pclneicb.exe	Pnpemb32.exe
File created	C:\Windows\SysWOW64\Ifmafkkf.dll	Gdhmnlcj.exe
File opened for modification	C:\Windows\SysWOW64\Ojoign32.exe	Ogpmjb32.exe
File created	C:\Windows\SysWOW64\Eagncfoj.dll	Hclakimb.exe
File opened for modification	C:\Windows\SysWOW64\Doeiljfn.exe	Dlgmpogj.exe
File created	C:\Windows\SysWOW64\Fjpqmmkb.dll	Doeiljfn.exe
File created	C:\Windows\SysWOW64\Edihepnm.exe	Eaklidoi.exe
File opened for modification	C:\Windows\SysWOW64\Pbpjhp32.exe	Pjhbgb32.exe
File created	C:\Windows\SysWOW64\Mdmnlj32.exe	Mlefklpj.exe
File created	C:\Windows\SysWOW64\Pgnilpah.exe	Pqdqof32.exe
File created	C:\Windows\SysWOW64\Genjanmh.dll	Djlddi32.exe
File created	C:\Windows\SysWOW64\Hefffnbk.dll	Kipabjil.exe
File created	C:\Windows\SysWOW64\Pcojkhap.exe	Peljol32.exe
File created	C:\Windows\SysWOW64\Geplnioe.dll	Fkalchij.exe
File created	C:\Windows\SysWOW64\Dapgdeib.dll	Npfkgjdn.exe
File created	C:\Windows\SysWOW64\Jibeql32.exe	Jbhmdbnp.exe
File opened for modification	C:\Windows\SysWOW64\Nnhfee32.exe	Nkjjij32.exe
File created	C:\Windows\SysWOW64\Mdemcacc.dll	Lnepih32.exe
File opened for modification	C:\Windows\SysWOW64\Nnjbke32.exe	Nklfoi32.exe
File opened for modification	C:\Windows\SysWOW64\Aeopki32.exe	Abpcon32.exe
File created	C:\Windows\SysWOW64\Ijlbqboa.dll	Hihbijhn.exe
File created	C:\Windows\SysWOW64\Djlddi32.exe	Dcalgo32.exe
File created	C:\Windows\SysWOW64\Kilhgk32.exe	Kdopod32.exe
File opened for modification	C:\Windows\SysWOW64\Lcmofolg.exe	Lalcng32.exe
File created	C:\Windows\SysWOW64\Ihidnp32.dll	Dkifae32.exe
File opened for modification	C:\Windows\SysWOW64\Jbhmdbnp.exe	Jpjqhgol.exe
File created	C:\Windows\SysWOW64\Hhapkbgi.dll	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Gjhilj32.dll	Gcojed32.exe
File created	C:\Windows\SysWOW64\Mjhmqf32.dll	Hmhhehlb.exe
File created	C:\Windows\SysWOW64\Jjhijoaa.dll	Lgmngglp.exe
File created	C:\Windows\SysWOW64\Ddakjkqi.exe	Deokon32.exe
File created	C:\Windows\SysWOW64\Hboagf32.exe	Hclakimb.exe
File created	C:\Windows\SysWOW64\Nbkhfc32.exe	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Elhcgeja.dll	Gmoeoidl.exe
File created	C:\Windows\SysWOW64\Epmcab32.exe	Ehekqe32.exe
File opened for modification	C:\Windows\SysWOW64\Kpepcedo.exe	Kacphh32.exe
File opened for modification	C:\Windows\SysWOW64\Bnhjohkb.exe	Bfabnjjp.exe
File created	C:\Windows\SysWOW64\Eaacilcc.dll	Qgallfcq.exe
File opened for modification	C:\Windows\SysWOW64\Pqknig32.exe	Ojaelm32.exe
File opened for modification	C:\Windows\SysWOW64\Lpappc32.exe	Lmccchkn.exe
File opened for modification	C:\Windows\SysWOW64\Mnlfigcc.exe	Lgbnmm32.exe
File created	C:\Windows\SysWOW64\Ikfcpn32.dll	Coojfa32.exe
File created	C:\Windows\SysWOW64\Mlilmlna.dll	Iiffen32.exe
File opened for modification	C:\Windows\SysWOW64\Imdnklfp.exe	Ijfboafl.exe
File opened for modification	C:\Windows\SysWOW64\Jiikak32.exe	Jpaghf32.exe
File opened for modification	C:\Windows\SysWOW64\Kmjqmi32.exe	Kinemkko.exe
File created	C:\Windows\SysWOW64\Lmccchkn.exe	Lcmofolg.exe
File created	C:\Windows\SysWOW64\Enlqgg32.dll	Hmjdjgjo.exe
File created	C:\Windows\SysWOW64\Fojjgcdm.dll	Gfqjafdq.exe
File created	C:\Windows\SysWOW64\Chbijmok.dll	Gqfooodg.exe
File opened for modification	C:\Windows\SysWOW64\Balpgb32.exe	Bmpcfdmg.exe
File created	C:\Windows\SysWOW64\Jagqlj32.exe	Jiphkm32.exe
File created	C:\Windows\SysWOW64\Dajbcgdm.dll	Baocghgi.exe
File opened for modification	C:\Windows\SysWOW64\Fjnjqfij.exe	Emjjgbjp.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
14148	14016	WerFault.exe	703

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lifenaok.dll"	Mdfofakp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidlk32.dll"	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Djlddi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbopfj32.dll"	Dhqaefng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmccchkn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcbihpel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dedkdcie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fqohnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekfnlmai.dll"	Fqohnp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qchmagie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnambi32.dll"	Dafbne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckfliccm.dll"	Ficgacna.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcbiao32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iiffen32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aniajnnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efmolq32.dll"	Adgbpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gogiek32.dll"	Ehgqln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fkopnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkjlibkf.dll"	Mnebeogl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onjegled.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deeiam32.dll"	Pflplnlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgenhgdd.dll"	Gcpapkgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jflepa32.dll"	Jpaghf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cacmah32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onjegled.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bemlmgnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmocba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmioonpn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anfmjhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olfdahne.dll"	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hidipe32.dll"	Okjbpglo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qbimoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aomaga32.dll"	Lmgfda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndhmhh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cleqadmh.dll"	Abpcon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dokfjo32.dll"	Qkmhlekj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Edbklofb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chgoogfa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Imdnklfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfaedkdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lqnjfo32.dll"	Qnhahj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgddhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Megdccmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Echegpbb.dll"	Afmhck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dcopbp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gdeqhl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpnchp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jmbdbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Coojfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldaeka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ldjhpl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iehfdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdjagjco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndfqbhia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npfkgjdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Empblm32.dll"	Nfgmjqop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eckonn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmafhe32.dll"	Lcmofolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dajbcgdm.dll"	Baocghgi.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2536	1244	2a8662ca25f88664d060b2a8446dbd077076de37ce0cff17aa3877c3bceb53b5.exe	88
PID 1244 wrote to memory of 2536	1244	2a8662ca25f88664d060b2a8446dbd077076de37ce0cff17aa3877c3bceb53b5.exe	88
PID 1244 wrote to memory of 2536	1244	2a8662ca25f88664d060b2a8446dbd077076de37ce0cff17aa3877c3bceb53b5.exe	88
PID 2536 wrote to memory of 2108	2536	Clqnjf32.exe	89
PID 2536 wrote to memory of 2108	2536	Clqnjf32.exe	89
PID 2536 wrote to memory of 2108	2536	Clqnjf32.exe	89
PID 2108 wrote to memory of 4760	2108	Coojfa32.exe	90
PID 2108 wrote to memory of 4760	2108	Coojfa32.exe	90
PID 2108 wrote to memory of 4760	2108	Coojfa32.exe	90
PID 4760 wrote to memory of 1148	4760	Chgoogfa.exe	91
PID 4760 wrote to memory of 1148	4760	Chgoogfa.exe	91
PID 4760 wrote to memory of 1148	4760	Chgoogfa.exe	91
PID 1148 wrote to memory of 3232	1148	Ccmclp32.exe	92
PID 1148 wrote to memory of 3232	1148	Ccmclp32.exe	92
PID 1148 wrote to memory of 3232	1148	Ccmclp32.exe	92
PID 3232 wrote to memory of 4932	3232	Cekohk32.exe	93
PID 3232 wrote to memory of 4932	3232	Cekohk32.exe	93
PID 3232 wrote to memory of 4932	3232	Cekohk32.exe	93
PID 4932 wrote to memory of 868	4932	Dpacfd32.exe	94
PID 4932 wrote to memory of 868	4932	Dpacfd32.exe	94
PID 4932 wrote to memory of 868	4932	Dpacfd32.exe	94
PID 868 wrote to memory of 3708	868	Dcopbp32.exe	95
PID 868 wrote to memory of 3708	868	Dcopbp32.exe	95
PID 868 wrote to memory of 3708	868	Dcopbp32.exe	95
PID 3708 wrote to memory of 1112	3708	Dlgdkeje.exe	96
PID 3708 wrote to memory of 1112	3708	Dlgdkeje.exe	96
PID 3708 wrote to memory of 1112	3708	Dlgdkeje.exe	96
PID 1112 wrote to memory of 4040	1112	Dcalgo32.exe	97
PID 1112 wrote to memory of 4040	1112	Dcalgo32.exe	97
PID 1112 wrote to memory of 4040	1112	Dcalgo32.exe	97
PID 4040 wrote to memory of 4552	4040	Djlddi32.exe	98
PID 4040 wrote to memory of 4552	4040	Djlddi32.exe	98
PID 4040 wrote to memory of 4552	4040	Djlddi32.exe	98
PID 4552 wrote to memory of 1412	4552	Dhnepfpj.exe	100
PID 4552 wrote to memory of 1412	4552	Dhnepfpj.exe	100
PID 4552 wrote to memory of 1412	4552	Dhnepfpj.exe	100
PID 1412 wrote to memory of 1268	1412	Dagiil32.exe	101
PID 1412 wrote to memory of 1268	1412	Dagiil32.exe	101
PID 1412 wrote to memory of 1268	1412	Dagiil32.exe	101
PID 1268 wrote to memory of 4488	1268	Debeijoc.exe	102
PID 1268 wrote to memory of 4488	1268	Debeijoc.exe	102
PID 1268 wrote to memory of 4488	1268	Debeijoc.exe	102
PID 4488 wrote to memory of 4808	4488	Dhqaefng.exe	103
PID 4488 wrote to memory of 4808	4488	Dhqaefng.exe	103
PID 4488 wrote to memory of 4808	4488	Dhqaefng.exe	103
PID 4808 wrote to memory of 3544	4808	Dhqaefng.exe	104
PID 4808 wrote to memory of 3544	4808	Dhqaefng.exe	104
PID 4808 wrote to memory of 3544	4808	Dhqaefng.exe	104
PID 3544 wrote to memory of 4332	3544	Dphifcoi.exe	105
PID 3544 wrote to memory of 4332	3544	Dphifcoi.exe	105
PID 3544 wrote to memory of 4332	3544	Dphifcoi.exe	105
PID 4332 wrote to memory of 2416	4332	Dcfebonm.exe	106
PID 4332 wrote to memory of 2416	4332	Dcfebonm.exe	106
PID 4332 wrote to memory of 2416	4332	Dcfebonm.exe	106
PID 2416 wrote to memory of 4928	2416	Djpnohej.exe	107
PID 2416 wrote to memory of 4928	2416	Djpnohej.exe	107
PID 2416 wrote to memory of 4928	2416	Djpnohej.exe	107
PID 4928 wrote to memory of 2856	4928	Dpjflb32.exe	108
PID 4928 wrote to memory of 2856	4928	Dpjflb32.exe	108
PID 4928 wrote to memory of 2856	4928	Dpjflb32.exe	108
PID 2856 wrote to memory of 3592	2856	Dakbckbe.exe	109
PID 2856 wrote to memory of 3592	2856	Dakbckbe.exe	109
PID 2856 wrote to memory of 3592	2856	Dakbckbe.exe	109
PID 3592 wrote to memory of 1120	3592	Ehekqe32.exe	110

C:\Users\Admin\AppData\Local\Temp\2a8662ca25f88664d060b2a8446dbd077076de37ce0cff17aa3877c3bceb53b5.exe
"C:\Users\Admin\AppData\Local\Temp\2a8662ca25f88664d060b2a8446dbd077076de37ce0cff17aa3877c3bceb53b5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Windows\SysWOW64\Clqnjf32.exe
  C:\Windows\system32\Clqnjf32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\SysWOW64\Coojfa32.exe
    C:\Windows\system32\Coojfa32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2108
  - - C:\Windows\SysWOW64\Chgoogfa.exe
      C:\Windows\system32\Chgoogfa.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:4760
    - - C:\Windows\SysWOW64\Ccmclp32.exe
        
        C:\Windows\system32\Ccmclp32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1148
      - C:\Windows\SysWOW64\Cekohk32.exe
        
        C:\Windows\system32\Cekohk32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3232
        
        C:\Windows\SysWOW64\Dpacfd32.exe
        
        C:\Windows\system32\Dpacfd32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4932
        
        C:\Windows\SysWOW64\Dcopbp32.exe
        
        C:\Windows\system32\Dcopbp32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:868
        
        C:\Windows\SysWOW64\Dlgdkeje.exe
        
        C:\Windows\system32\Dlgdkeje.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3708
        
        C:\Windows\SysWOW64\Dcalgo32.exe
        
        C:\Windows\system32\Dcalgo32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1112
        
        C:\Windows\SysWOW64\Djlddi32.exe
        
        C:\Windows\system32\Djlddi32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4040
        
        C:\Windows\SysWOW64\Dhnepfpj.exe
        
        C:\Windows\system32\Dhnepfpj.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\Dagiil32.exe
        
        C:\Windows\system32\Dagiil32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1412
        
        C:\Windows\SysWOW64\Debeijoc.exe
        
        C:\Windows\system32\Debeijoc.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1268
        
        C:\Windows\SysWOW64\Dhqaefng.exe
        
        C:\Windows\system32\Dhqaefng.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\SysWOW64\Dhqaefng.exe
        
        C:\Windows\system32\Dhqaefng.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\Dphifcoi.exe
        
        C:\Windows\system32\Dphifcoi.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3544
        
        C:\Windows\SysWOW64\Dcfebonm.exe
        
        C:\Windows\system32\Dcfebonm.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4332
        
        C:\Windows\SysWOW64\Djpnohej.exe
        
        C:\Windows\system32\Djpnohej.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2416
        
        C:\Windows\SysWOW64\Dpjflb32.exe
        
        C:\Windows\system32\Dpjflb32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4928
        
        C:\Windows\SysWOW64\Dakbckbe.exe
        
        C:\Windows\system32\Dakbckbe.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\SysWOW64\Ehekqe32.exe
        
        C:\Windows\system32\Ehekqe32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3592
        
        C:\Windows\SysWOW64\Epmcab32.exe
        
        C:\Windows\system32\Epmcab32.exe
        23⤵
        Executes dropped EXE
        
        PID:1120
        
        C:\Windows\SysWOW64\Eckonn32.exe
        
        C:\Windows\system32\Eckonn32.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1296
        
        C:\Windows\SysWOW64\Efikji32.exe
        
        C:\Windows\system32\Efikji32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2136
        
        C:\Windows\SysWOW64\Elccfc32.exe
        
        C:\Windows\system32\Elccfc32.exe
        26⤵
        Executes dropped EXE
        
        PID:4636
        
        C:\Windows\SysWOW64\Ecmlcmhe.exe
        
        C:\Windows\system32\Ecmlcmhe.exe
        27⤵
        Executes dropped EXE
        
        PID:1444
        
        C:\Windows\SysWOW64\Ejgdpg32.exe
        
        C:\Windows\system32\Ejgdpg32.exe
        28⤵
        Executes dropped EXE
        
        PID:644
        
        C:\Windows\SysWOW64\Ejjqeg32.exe
        
        C:\Windows\system32\Ejjqeg32.exe
        29⤵
        Executes dropped EXE
        
        PID:4784
        
        C:\Windows\SysWOW64\Elhmablc.exe
        
        C:\Windows\system32\Elhmablc.exe
        30⤵
        Executes dropped EXE
        
        PID:3332
        
        C:\Windows\SysWOW64\Ecbenm32.exe
        
        C:\Windows\system32\Ecbenm32.exe
        31⤵
        Executes dropped EXE
        
        PID:1448
        
        C:\Windows\SysWOW64\Efpajh32.exe
        
        C:\Windows\system32\Efpajh32.exe
        32⤵
        Executes dropped EXE
        
        PID:992
        
        C:\Windows\SysWOW64\Emjjgbjp.exe
        
        C:\Windows\system32\Emjjgbjp.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1172
        
        C:\Windows\SysWOW64\Fjnjqfij.exe
        
        C:\Windows\system32\Fjnjqfij.exe
        34⤵
        Executes dropped EXE
        
        PID:4632
        
        C:\Windows\SysWOW64\Fmmfmbhn.exe
        
        C:\Windows\system32\Fmmfmbhn.exe
        35⤵
        Executes dropped EXE
        
        PID:3208
        
        C:\Windows\SysWOW64\Ficgacna.exe
        
        C:\Windows\system32\Ficgacna.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:224
        
        C:\Windows\SysWOW64\Fmocba32.exe
        
        C:\Windows\system32\Fmocba32.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:220
        
        C:\Windows\SysWOW64\Fbllkh32.exe
        
        C:\Windows\system32\Fbllkh32.exe
        38⤵
        Executes dropped EXE
        
        PID:456
        
        C:\Windows\SysWOW64\Fifdgblo.exe
        
        C:\Windows\system32\Fifdgblo.exe
        39⤵
        Executes dropped EXE
        
        PID:4136
        
        C:\Windows\SysWOW64\Fqmlhpla.exe
        
        C:\Windows\system32\Fqmlhpla.exe
        40⤵
        Executes dropped EXE
        
        PID:3324
        
        C:\Windows\SysWOW64\Fbnhphbp.exe
        
        C:\Windows\system32\Fbnhphbp.exe
        41⤵
        Executes dropped EXE
        
        PID:4100
        
        C:\Windows\SysWOW64\Fjepaecb.exe
        
        C:\Windows\system32\Fjepaecb.exe
        42⤵
        Executes dropped EXE
        
        PID:4144
        
        C:\Windows\SysWOW64\Fqohnp32.exe
        
        C:\Windows\system32\Fqohnp32.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1092
        
        C:\Windows\SysWOW64\Fcnejk32.exe
        
        C:\Windows\system32\Fcnejk32.exe
        44⤵
        Executes dropped EXE
        
        PID:3696
        
        C:\Windows\SysWOW64\Fjhmgeao.exe
        
        C:\Windows\system32\Fjhmgeao.exe
        45⤵
        Executes dropped EXE
        
        PID:3648
        
        C:\Windows\SysWOW64\Fmficqpc.exe
        
        C:\Windows\system32\Fmficqpc.exe
        46⤵
        Executes dropped EXE
        
        PID:2056
        
        C:\Windows\SysWOW64\Fmficqpc.exe
        
        C:\Windows\system32\Fmficqpc.exe
        47⤵
        Executes dropped EXE
        
        PID:3552
        
        C:\Windows\SysWOW64\Gcpapkgp.exe
        
        C:\Windows\system32\Gcpapkgp.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2808
        
        C:\Windows\SysWOW64\Gbcakg32.exe
        
        C:\Windows\system32\Gbcakg32.exe
        49⤵
        Executes dropped EXE
        
        PID:4372
        
        C:\Windows\SysWOW64\Gjjjle32.exe
        
        C:\Windows\system32\Gjjjle32.exe
        50⤵
        Executes dropped EXE
        
        PID:2860
        
        C:\Windows\SysWOW64\Gimjhafg.exe
        
        C:\Windows\system32\Gimjhafg.exe
        51⤵
        Executes dropped EXE
        
        PID:4832
        
        C:\Windows\SysWOW64\Gqdbiofi.exe
        
        C:\Windows\system32\Gqdbiofi.exe
        52⤵
        Executes dropped EXE
        
        PID:3236
        
        C:\Windows\SysWOW64\Gbenqg32.exe
        
        C:\Windows\system32\Gbenqg32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3156
        
        C:\Windows\SysWOW64\Gfqjafdq.exe
        
        C:\Windows\system32\Gfqjafdq.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4284
        
        C:\Windows\SysWOW64\Gjlfbd32.exe
        
        C:\Windows\system32\Gjlfbd32.exe
        55⤵
        Executes dropped EXE
        
        PID:2908
        
        C:\Windows\SysWOW64\Gmkbnp32.exe
        
        C:\Windows\system32\Gmkbnp32.exe
        56⤵
        Executes dropped EXE
        
        PID:2248
        
        C:\Windows\SysWOW64\Gqfooodg.exe
        
        C:\Windows\system32\Gqfooodg.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4400
        
        C:\Windows\SysWOW64\Gcekkjcj.exe
        
        C:\Windows\system32\Gcekkjcj.exe
        58⤵
        Executes dropped EXE
        
        PID:3772
        
        C:\Windows\SysWOW64\Gfcgge32.exe
        
        C:\Windows\system32\Gfcgge32.exe
        59⤵
        Executes dropped EXE
        
        PID:1492
        
        C:\Windows\SysWOW64\Giacca32.exe
        
        C:\Windows\system32\Giacca32.exe
        60⤵
        Executes dropped EXE
        
        PID:3892
        
        C:\Windows\SysWOW64\Gqikdn32.exe
        
        C:\Windows\system32\Gqikdn32.exe
        61⤵
        Executes dropped EXE
        
        PID:4684
        
        C:\Windows\SysWOW64\Gpklpkio.exe
        
        C:\Windows\system32\Gpklpkio.exe
        62⤵
        Executes dropped EXE
        
        PID:1864
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        63⤵
        Executes dropped EXE
        
        PID:4156
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        64⤵
        Executes dropped EXE
        
        PID:32
        
        C:\Windows\SysWOW64\Gpnhekgl.exe
        
        C:\Windows\system32\Gpnhekgl.exe
        65⤵
        Executes dropped EXE
        
        PID:840
        
        C:\Windows\SysWOW64\Gcidfi32.exe
        
        C:\Windows\system32\Gcidfi32.exe
        66⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        67⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\Gifmnpnl.exe
        
        C:\Windows\system32\Gifmnpnl.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1352
        
        C:\Windows\SysWOW64\Gmaioo32.exe
        
        C:\Windows\system32\Gmaioo32.exe
        69⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        70⤵
        Drops file in System32 directory
        
        PID:2484
        
        C:\Windows\SysWOW64\Hboagf32.exe
        
        C:\Windows\system32\Hboagf32.exe
        71⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\Hapaemll.exe
        
        C:\Windows\system32\Hapaemll.exe
        72⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Hbanme32.exe
        
        C:\Windows\system32\Hbanme32.exe
        73⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        74⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        75⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\Habnjm32.exe
        
        C:\Windows\system32\Habnjm32.exe
        76⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\Hcqjfh32.exe
        
        C:\Windows\system32\Hcqjfh32.exe
        77⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\Hjjbcbqj.exe
        
        C:\Windows\system32\Hjjbcbqj.exe
        78⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\Hmioonpn.exe
        
        C:\Windows\system32\Hmioonpn.exe
        79⤵
        Modifies registry class
        
        PID:872
        
        C:\Windows\SysWOW64\Hpgkkioa.exe
        
        C:\Windows\system32\Hpgkkioa.exe
        80⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\Hfachc32.exe
        
        C:\Windows\system32\Hfachc32.exe
        81⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\Hjmoibog.exe
        
        C:\Windows\system32\Hjmoibog.exe
        82⤵
        Drops file in System32 directory
        
        PID:2692
        
        C:\Windows\SysWOW64\Hmklen32.exe
        
        C:\Windows\system32\Hmklen32.exe
        83⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        84⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Hbhdmd32.exe
        
        C:\Windows\system32\Hbhdmd32.exe
        85⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        86⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Hibljoco.exe
        
        C:\Windows\system32\Hibljoco.exe
        87⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5340
        
        C:\Windows\SysWOW64\Iffmccbi.exe
        
        C:\Windows\system32\Iffmccbi.exe
        89⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Ijaida32.exe
        
        C:\Windows\system32\Ijaida32.exe
        90⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        91⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Impepm32.exe
        
        C:\Windows\system32\Impepm32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5492
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        93⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Icjmmg32.exe
        
        C:\Windows\system32\Icjmmg32.exe
        94⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Iiffen32.exe
        
        C:\Windows\system32\Iiffen32.exe
        95⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5628
        
        C:\Windows\SysWOW64\Ipqnahgf.exe
        
        C:\Windows\system32\Ipqnahgf.exe
        96⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        97⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Ifjfnb32.exe
        
        C:\Windows\system32\Ifjfnb32.exe
        98⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        99⤵
        Drops file in System32 directory
        
        PID:5796
        
        C:\Windows\SysWOW64\Imdnklfp.exe
        
        C:\Windows\system32\Imdnklfp.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5840
        
        C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        101⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        102⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        103⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        104⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        105⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6080
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        107⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Jpgdbg32.exe
        
        C:\Windows\system32\Jpgdbg32.exe
        108⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        109⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Jfaloa32.exe
        
        C:\Windows\system32\Jfaloa32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5256
        
        C:\Windows\SysWOW64\Jiphkm32.exe
        
        C:\Windows\system32\Jiphkm32.exe
        111⤵
        Drops file in System32 directory
        
        PID:5324
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5384
        
        C:\Windows\SysWOW64\Jpjqhgol.exe
        
        C:\Windows\system32\Jpjqhgol.exe
        113⤵
        Drops file in System32 directory
        
        PID:5444
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        114⤵
        Drops file in System32 directory
        
        PID:5536
        
        C:\Windows\SysWOW64\Jibeql32.exe
        
        C:\Windows\system32\Jibeql32.exe
        115⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5648
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5764
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5824
        
        C:\Windows\SysWOW64\Jaljgidl.exe
        
        C:\Windows\system32\Jaljgidl.exe
        119⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5984
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6064
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        122⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Jangmibi.exe
        
        C:\Windows\system32\Jangmibi.exe
        123⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        124⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5244
        
        C:\Windows\SysWOW64\Jiikak32.exe
        
        C:\Windows\system32\Jiikak32.exe
        125⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        126⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        127⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        128⤵
        Drops file in System32 directory
        
        PID:5676
        
        C:\Windows\SysWOW64\Kilhgk32.exe
        
        C:\Windows\system32\Kilhgk32.exe
        129⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        130⤵
        Drops file in System32 directory
        
        PID:5948
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        131⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        132⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        133⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        134⤵
        Drops file in System32 directory
        
        PID:5516
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5672
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        136⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6052
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        138⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5436
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        140⤵
        Drops file in System32 directory
        
        PID:5864
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        141⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        142⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        143⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        144⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        145⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        146⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        147⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        148⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        149⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        150⤵
        Drops file in System32 directory
        
        PID:6372
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        151⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6420
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        152⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6464
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        153⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        154⤵
        Drops file in System32 directory
        
        PID:6544
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        155⤵
        Modifies registry class
        
        PID:6584
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        156⤵
        Drops file in System32 directory
        
        PID:6636
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        157⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        158⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6764
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        160⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        161⤵
        Modifies registry class
        
        PID:6852
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6892
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        163⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        164⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        165⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        166⤵
        Drops file in System32 directory
        
        PID:7080
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        167⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        168⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        169⤵
        Modifies registry class
        
        PID:6208
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        170⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        171⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        172⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        173⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        174⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        175⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        176⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        177⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        178⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        179⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        180⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7020
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        182⤵
        Drops file in System32 directory
        
        PID:7124
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        183⤵
        Modifies registry class
        
        PID:5804
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        184⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        185⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        186⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        187⤵
        Drops file in System32 directory
        
        PID:6596
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        188⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        189⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        190⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        191⤵
        Drops file in System32 directory
        
        PID:7092
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        192⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        193⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        194⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        195⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        196⤵
        Drops file in System32 directory
        
        PID:7036
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        197⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        198⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        199⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        200⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Nnaikd32.exe
        
        C:\Windows\system32\Nnaikd32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7176
        
        C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        202⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Ndkahnhh.exe
        
        C:\Windows\system32\Ndkahnhh.exe
        203⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        204⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Ondeac32.exe
        
        C:\Windows\system32\Ondeac32.exe
        205⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        206⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Ojjffddl.exe
        
        C:\Windows\system32\Ojjffddl.exe
        207⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        208⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        209⤵
        Modifies registry class
        
        PID:7592
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        210⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Oqgkhnjf.exe
        
        C:\Windows\system32\Oqgkhnjf.exe
        211⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        212⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        213⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        214⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        215⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Ojalgcnd.exe
        
        C:\Windows\system32\Ojalgcnd.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7908
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        217⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        218⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        219⤵
        Drops file in System32 directory
        
        PID:8028
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        220⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        221⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        222⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        223⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        224⤵
        Drops file in System32 directory
        
        PID:7208
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        225⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        226⤵
        Drops file in System32 directory
        
        PID:7436
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        227⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        228⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        229⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        230⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        231⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        232⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7936
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        234⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Pbddcoei.exe
        
        C:\Windows\system32\Pbddcoei.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8064
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        236⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        237⤵
        Drops file in System32 directory
        
        PID:7188
        
        C:\Windows\SysWOW64\Qkmhlekj.exe
        
        C:\Windows\system32\Qkmhlekj.exe
        238⤵
        Modifies registry class
        
        PID:7300
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        239⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        240⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        241⤵
        Modifies registry class
        
        PID:7704
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        242⤵
        Modifies registry class
        
        PID:7852
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        243⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        244⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        245⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        246⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        247⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        248⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        249⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8076
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7260
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        252⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        253⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        254⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2896
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        255⤵
        
        PID:760
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        256⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        257⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        258⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        259⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        260⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        261⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        262⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        263⤵
        Modifies registry class
        
        PID:8440
        
        C:\Windows\SysWOW64\Becifhfj.exe
        
        C:\Windows\system32\Becifhfj.exe
        264⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        265⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8532
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        266⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        267⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        268⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        269⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        270⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        271⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        272⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        273⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        274⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8956
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        276⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        277⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9036
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        278⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        279⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        280⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        281⤵
        Modifies registry class
        
        PID:9208
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        282⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        283⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        284⤵
        Modifies registry class
        
        PID:8340
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        285⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        286⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        287⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8556
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        288⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        289⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        290⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        291⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        292⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8976
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        294⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        295⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        296⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        297⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        298⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        299⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        300⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        301⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        302⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        303⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7296
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8256
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        306⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8648
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        308⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        309⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        310⤵
        Drops file in System32 directory
        
        PID:8252
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        311⤵
        Drops file in System32 directory
        
        PID:8676
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        312⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        313⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        314⤵
        Modifies registry class
        
        PID:8464
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        315⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        316⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        317⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        318⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        319⤵
        Modifies registry class
        
        PID:9312
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        320⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        321⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        322⤵
        Drops file in System32 directory
        
        PID:9448
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        323⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        324⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9576
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        326⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        327⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        328⤵
        Modifies registry class
        
        PID:9696
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        329⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        330⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        331⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        332⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        333⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        334⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        335⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        336⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        337⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        338⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        339⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        340⤵
        Modifies registry class
        
        PID:10224
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9004
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        342⤵
        Modifies registry class
        
        PID:9296
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        343⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        344⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        345⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        346⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        347⤵
        Drops file in System32 directory
        
        PID:9612
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        348⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        349⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        350⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        351⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        352⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        353⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        354⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        355⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        356⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        357⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        358⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9480
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        360⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        361⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        362⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        363⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        364⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        365⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9252
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        367⤵
        Modifies registry class
        
        PID:9524
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        368⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        369⤵
        Drops file in System32 directory
        
        PID:9900
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        370⤵
        Drops file in System32 directory
        
        PID:10076
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        371⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        372⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        373⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        374⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        375⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        376⤵
        Drops file in System32 directory
        
        PID:9692
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        377⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        378⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        379⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        380⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        381⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        382⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        383⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        384⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        385⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        386⤵
        Drops file in System32 directory
        
        PID:10608
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        387⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        388⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        389⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        390⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10796
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        391⤵
        Drops file in System32 directory
        
        PID:10856
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        392⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        393⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        394⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11040
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        396⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        397⤵
        Modifies registry class
        
        PID:11124
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        398⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        399⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        400⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        401⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        402⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        403⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        404⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        405⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        406⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        407⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        408⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        409⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        410⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        411⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        412⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        413⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        414⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        415⤵
        Modifies registry class
        
        PID:10324
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        416⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10484
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        417⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        418⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        419⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        420⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        421⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        422⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        423⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        424⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        425⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        426⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        427⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        428⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        429⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        430⤵
        Modifies registry class
        
        PID:10956
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        431⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        432⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        433⤵
        Modifies registry class
        
        PID:10660
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        434⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        435⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        436⤵
        
        PID:11344
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        437⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        438⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        439⤵
        
        PID:11472
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        440⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        441⤵
        
        PID:11556
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        442⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        443⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        444⤵
        
        PID:11688
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        445⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        446⤵
        
        PID:11772
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        447⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        448⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        449⤵
        
        PID:11892
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        450⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        451⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        452⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        453⤵
        
        PID:12060
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        454⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        455⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        456⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        457⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        458⤵
        
        PID:12268
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        459⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        460⤵
        
        PID:11340
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        461⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        462⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        463⤵
        Modifies registry class
        
        PID:11592
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        464⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        465⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        466⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        467⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11884
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        468⤵
        
        PID:11940
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        469⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        470⤵
        Drops file in System32 directory
        
        PID:12080
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        471⤵
        Modifies registry class
        
        PID:12156
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        472⤵
        
        PID:12224
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        473⤵
        
        PID:12276
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        474⤵
        
        PID:11324
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        475⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        476⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        477⤵
        
        PID:11764
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        478⤵
        
        PID:11876
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        479⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11964
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        480⤵
        
        PID:12096
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        481⤵
        Modifies registry class
        
        PID:12192
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        482⤵
        Modifies registry class
        
        PID:10828
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        483⤵
        
        PID:11420
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        484⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        485⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11828
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        486⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        487⤵
        
        PID:12152
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        488⤵
        Modifies registry class
        
        PID:11416
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        489⤵
        
        PID:11720
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        490⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        491⤵
        Drops file in System32 directory
        
        PID:12252
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        492⤵
        
        PID:11708
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        493⤵
        
        PID:11292
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        494⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        495⤵
        Modifies registry class
        
        PID:11900
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        496⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        497⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        498⤵
        
        PID:11792
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        499⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7100
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        500⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12332
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        501⤵
        
        PID:12372
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        502⤵
        
        PID:12412
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        503⤵
        
        PID:12452
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        504⤵
        
        PID:12488
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        505⤵
        
        PID:12536
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        506⤵
        Modifies registry class
        
        PID:12576
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        507⤵
        
        PID:12616
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        508⤵
        Modifies registry class
        
        PID:12664
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        509⤵
        
        PID:12700
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        510⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12744
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        511⤵
        
        PID:12792
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        512⤵
        
        PID:12840
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        513⤵
        
        PID:12884
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        514⤵
        
        PID:12932
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        515⤵
        
        PID:12968
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        516⤵
        
        PID:13004
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        517⤵
        
        PID:13044
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        518⤵
        
        PID:13080
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        519⤵
        
        PID:13116
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        520⤵
        
        PID:13152
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        521⤵
        
        PID:13188
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        522⤵
        
        PID:13224
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        523⤵
        
        PID:13260
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        524⤵
        
        PID:13296
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        525⤵
        Drops file in System32 directory
        
        PID:12304
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        526⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12356
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        527⤵
        Modifies registry class
        
        PID:12440
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        528⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12496
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        529⤵
        
        PID:12524
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        530⤵
        Drops file in System32 directory
        
        PID:12584
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        531⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12648
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        532⤵
        
        PID:12708
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        533⤵
        
        PID:12768
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        534⤵
        
        PID:12828
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        535⤵
        
        PID:12876
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        536⤵
        Modifies registry class
        
        PID:12920
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        537⤵
        
        PID:13000
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        538⤵
        
        PID:13072
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        539⤵
        
        PID:13140
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        540⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13220
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        541⤵
        Drops file in System32 directory
        
        PID:13268
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        542⤵
        
        PID:12316
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        543⤵
        Modifies registry class
        
        PID:12420
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        544⤵
        
        PID:12512
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        545⤵
        
        PID:12644
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        546⤵
        
        PID:12724
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        547⤵
        
        PID:12776
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        548⤵
        
        PID:12916
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        549⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13076
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        550⤵
        
        PID:13180
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        551⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        552⤵
        Modifies registry class
        
        PID:13308
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        553⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12568
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        554⤵
        
        PID:12824
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        555⤵
        
        PID:12956
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        556⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        557⤵
        Modifies registry class
        
        PID:1872
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        558⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6672
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        559⤵
        
        PID:13248
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        560⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12436
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        561⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        562⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        563⤵
        
        PID:13088
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        564⤵
        Modifies registry class
        
        PID:13052
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        565⤵
        
        PID:12684
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        566⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        567⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        568⤵
        Drops file in System32 directory
        
        PID:4204
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        569⤵
        
        PID:2548
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        570⤵
        Modifies registry class
        
        PID:13320
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        571⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13356
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        572⤵
        
        PID:13392
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        573⤵
        Modifies registry class
        
        PID:13428
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        574⤵
        
        PID:13464
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        575⤵
        
        PID:13500
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        576⤵
        Drops file in System32 directory
        
        PID:13536
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        577⤵
        
        PID:13568
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        578⤵
        Modifies registry class
        
        PID:13612
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        579⤵
        
        PID:13648
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        580⤵
        Drops file in System32 directory
        
        PID:13696
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        581⤵
        
        PID:13740
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        582⤵
        
        PID:13776
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        583⤵
        
        PID:13828
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        584⤵
        Modifies registry class
        
        PID:13864
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        585⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13900
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        586⤵
        
        PID:13936
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        587⤵
        
        PID:13972
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        588⤵
        
        PID:14008
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        589⤵
        
        PID:14044
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        590⤵
        
        PID:14080
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        591⤵
        
        PID:14116
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        592⤵
        
        PID:14160
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        593⤵
        
        PID:14196
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        594⤵
        
        PID:14236
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        595⤵
        Drops file in System32 directory
        
        PID:14276
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        596⤵
        
        PID:14308
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        597⤵
        
        PID:13328
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        598⤵
        
        PID:13384
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        599⤵
        
        PID:13448
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        600⤵
        
        PID:13528
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        601⤵
        Drops file in System32 directory
        
        PID:13584
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        602⤵
        
        PID:13656
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        603⤵
        
        PID:13732
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        604⤵
        Drops file in System32 directory
        
        PID:13824
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        605⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13888
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        606⤵
        
        PID:13968
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        607⤵
        
        PID:14016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14016 -s 404
        608⤵
        Program crash
        
        PID:14148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 14016 -ip 14016
1⤵
PID:14108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abpcon32.exe

Filesize
197KB

MD5
74770afba7c593be1dfdfa1972cbb6d5

SHA1
b2285fe3feb3ace694ed2bd2926eb0e42fa8d405

SHA256
375420fe933b7539eccdbf65e14e30fe945eead32b4f9eda6dcfa6260eec905b

SHA512
60c31dff55941fdf3f353c3568e788e34bcfe6eb2b46dea40dda20dfef2ee61b41a94ff550e71b840f5b2771dfee10f98ce3bfc90d67b25477a37d51a81e6c60

Download Submit
C:\Windows\SysWOW64\Aeklkchg.exe

Filesize
197KB

MD5
515499dde68dd0bf0b408fe485e6e796

SHA1
6652b79a8152f33c6dd220c16bcc1edcb38a0392

SHA256
98956f5dd417af941a60222b91c3d33c16b43abfec723694c4077d3cf1d3b87e

SHA512
174bf08a2e65c8e13d6e6098600ae33c10f4d0b3b66ab8e15205c8a371d4ae27c2991be1312a8fd163e4a34cd59f6dcd1eb8f6b0517f35d963acdff740071d26

Download Submit
C:\Windows\SysWOW64\Bagflcje.exe

Filesize
197KB

MD5
687e0caf1a25bc779e6b208b4e5f1c5f

SHA1
063d49a7c704cb299fa62e917b5723b1fe6bc792

SHA256
7f56b61667bf2d96ce470b69f293865ff6d2b11ef6dc6c3b303d9c95ca34a7a9

SHA512
bc2f7bf840f7a60d785c581ffc6899b8eda038d89344a7ce03a2fd8da3978ca7ecc85e128fb4d3eb373390a2e3eb441aa16ec7ad9d39e70f9f4e09c07b33325e

Download Submit
C:\Windows\SysWOW64\Bbopfj32.dll

Filesize
6KB

MD5
3f4d74bfa40ba87415c1452d5a4e37ee

SHA1
16585af4216ce2133f044204f91f7d6e74aa4801

SHA256
d220ee728fd1126c95e13c69340a32a1e1597b978275acf15862af3194765d09

SHA512
b9f859a99253a2c29adac3aa67ef2dc4e4790a81a7b155a2dd3200a2706c56219d16afa4da71f985a5f1b492a612300e9b4248df22a3300a6672b73863e1f93e

Download Submit
C:\Windows\SysWOW64\Bdmpcdfm.exe

Filesize
197KB

MD5
7eb256842b91d15f47fa62b202e13774

SHA1
5fe1fa604d4427963a1a579c2dbf63426d87cc76

SHA256
e57240b82d81787c4f9ff7ba34340f2b36d087e8e5fedd587b3aad246e71e1b5

SHA512
916fcdb09bc1ec15ca9fff568c17aac975041462d06ca9d5a3843e3679bc2573070edfce625aa5a0d76b59b56940f43a4309b6c803d710f6eb5a25e4d56f0fb4

Download Submit
C:\Windows\SysWOW64\Bnkgeg32.exe

Filesize
197KB

MD5
d5b73d6882ad6cde6155218ba2fa61b8

SHA1
a7080b09a4c3e694beff832cc211ef570bcc34d8

SHA256
f7bca9b4d35e68e16d2e7169b8c1c206781bbe90bd009cfbca45fbb17a07e4c6

SHA512
76132d99ceadfe8e40869da07e01063a79ccbcaf2c772a85b76e218b12e0797125fde5c92a45af6cbcc704ff0a8f77916c95aa6248818ce7bfaf43c479b57cc7

Download Submit
C:\Windows\SysWOW64\Bopgjmhe.exe

Filesize
197KB

MD5
e7688b64ba920579fed4f2e0d78121e1

SHA1
420278398b39ee7e88099d8d541d5a444b1dcb8f

SHA256
b945985237c249dbae2ac68baecb0764c00d9599c8665f821b1bd6cad1e67201

SHA512
c08b5b41d28fd131e9bc9dff5ae79b0aeeb57583e5475d78b9faaf0e18e4c2734719fd47a526e71bcc759aad92ffdf17019f6db540bfc4f0ac4d377f519bf352

Download Submit
C:\Windows\SysWOW64\Ccmclp32.exe

Filesize
197KB

MD5
3a2f67f15971f1a5fb30735b6fe342e7

SHA1
5c3bfd2a3a1a9e9d90322ca66cd90a6a92c2195d

SHA256
38672d2b198f9ef226baa56fb1ba265ef6aeec604d80054d0d2a3c2ab256ff5e

SHA512
9ec9b4925427d6e456f8b3e510d4b5868d9fd7e823e1aa6945cf8ebd22335a7079e2127e8d267fea13354b2bceb22279c5e338278f00e1daa8d0dc650d471407

Download Submit
C:\Windows\SysWOW64\Cdhhdlid.exe

Filesize
197KB

MD5
86e32e5aedf2701b4012e0a1ade29179

SHA1
47b6c98937b1e9c8b2fe69d9dea011fa3a43127a

SHA256
9475caab67ff739996a42fc85fefe7af269b47e39ba7838cbe6e1616e7b5877b

SHA512
0b97efe8cba5c1e17e7a3f502c3d5fb9382678ab674c43a22d9b44dd1307448a1fe454f65f7c92d920cc1dfbeeebb9e0ffdc09607abdcaae7c93297202dbbf56

Download Submit
C:\Windows\SysWOW64\Cekohk32.exe

Filesize
197KB

MD5
5aedc8cc4130d28457d69e64611d7a0a

SHA1
986d037a4fac8b0ba80aa9d16ad3d264e3e38a83

SHA256
364c6c993b7b0336e56344b251441410bc157b747f6c77729e245d85888c7250

SHA512
21a3ff27b9ff30cb7ec9c5016177dd5e031822301e215d6cf01dbd59338dd63216ef3faff7eb97e954aeb923a4ed24b731bf72985292aa8216d5995bc559abce

Download Submit
C:\Windows\SysWOW64\Chgoogfa.exe

Filesize
197KB

MD5
9b451c30957cc3264e2885e94e6f7d91

SHA1
9e37f0fca4af08726f98cef4a47a2579e808d7ba

SHA256
7d5930aea9b6826e48cd52286c88cb4d4584076f33f7b657fbf4dcd47ba33056

SHA512
5535f2f2fa891a0089a56c03184d50b62c41fc4bb0f3c61107f7ff6336c79bcdf5f1fb6a76e58196dc7b6cb35c8eea72e9389186b9477d53673d15414cf17ccf

Download Submit
C:\Windows\SysWOW64\Clbceo32.exe

Filesize
197KB

MD5
779487918485de0f958c907d82408497

SHA1
8f49957635dcc1ced9583ebe2b2c0cd7382e8825

SHA256
48c2f9d6111a6b782d2eb31fd9a1d0ca7b6a0ec0fa3c5da2d4c0e334d02fff9d

SHA512
146c93b1ed5122eab418588e6646cca744f4853a8c7e6dc85041c4834de577bdb349faab0952833cc5bda9399da1029083cfbda13122c68bea3aeb0669f384fc

Download Submit
C:\Windows\SysWOW64\Clqnjf32.exe

Filesize
197KB

MD5
b2d011dd437d609f122579655365a521

SHA1
49cf8363ae259471d955d0c87084fc4828b0adf0

SHA256
ff27bb5fc76553786cec6f2a3977a1465db0c72bc7638a1994f991efaf0cc922

SHA512
8c1f63f8a7b1a04532d16fa14e1bc5c956728158b5bc2b2cc9b9ed2dfd7af810a4200272d3f1543564833638976df69f71bf10c1a89f27371f8751d57571fc05

Download Submit
C:\Windows\SysWOW64\Coojfa32.exe

Filesize
197KB

MD5
c040171ff5773672506d58ec30c938cb

SHA1
2f38eb3d08706c8e7da371a42bed13040e11df60

SHA256
f62823b97310f924ca0b3043f537738b5eadb5d0302a4bdea0fd9b354378b1be

SHA512
819b2c3e556d6c0f4f3b299cdf86927cd3f68f077fc757cb24c8a7f47507718a4c51cffd449893a3df0937a9fc9a45d0e54e774d56a15f9a435ded97ac729ae5

Download Submit
C:\Windows\SysWOW64\Dagiil32.exe

Filesize
197KB

MD5
158de82be9ffe9c9b6061abdd6c470be

SHA1
245e798bd0aaaf89d375bc9c34a0679b98e227c4

SHA256
f0184d203721a9c336d75c5240f9380e02fc706bcab811fadf44b649c853e62f

SHA512
c163f5dc92b7b6153c7c7874bdcf3745aa69c878337bf4072636986b8e39bfe2132169526a4fdd336ebadc34db73ad48df7854c6f1d1e76fcd061751fbe9960b

Download Submit
C:\Windows\SysWOW64\Dakbckbe.exe

Filesize
197KB

MD5
b4491c10c48ee2805aec75de5e489fa0

SHA1
1a783392b78bf161fbeac2f03d15af9a0da0feb0

SHA256
2e74efb7d4bc79e712fd110ea6637834fe19de383b130a8d7a7e1f0b1b4c50cf

SHA512
aa4114fe8d60bacaf34d4f938603701d9e72bf122ddbf8c99f0d0319dc958e94ee1e4be950c91aab70263990b57ac67aba7da8f039cb12a06a3c6530deb8419d

Download Submit
C:\Windows\SysWOW64\Dcalgo32.exe

Filesize
197KB

MD5
9d97d3da608228552e7b3cd55265cdaa

SHA1
9330cdf8e359a0d3ec973ffaab2501b9dcac3ed6

SHA256
7ec862a3bc025a0468ac515a88e9a93b48a5747c257d94f1b14bef70f08fb0c3

SHA512
42a8e14ea8566ac1c80d4fca061cf55fec3bee0f327599882706818465712363b8653d56482008d5e3933a787f9990901af6c2fc1cd029e44c232bfcac3c0cb7

Download Submit
C:\Windows\SysWOW64\Dcfebonm.exe

Filesize
197KB

MD5
646e6977621c4c41645c56843c6ab279

SHA1
af2ecc9b2bc47bc71f35a709f1448a70f971ad05

SHA256
762211a38ae1fdb65e765d48f9bae357a73e27805c2def6f2d1d35df08516482

SHA512
90599580cdfaf00f9e9de94e71d65991d83a849c9b6668bf9d14a11ea87fe3a7a7f8c5a5fe55edf91422c0ea9c84e9a6d43083976c11b5c35ebb8d847b21fcb7

Download Submit
C:\Windows\SysWOW64\Dcopbp32.exe

Filesize
197KB

MD5
82de669d3d3d748c05925a5b1f2fe3f1

SHA1
6f67b304ea58edb406d2e854b8b0b9a16cc38b0c

SHA256
5d7a21be18485a5e2c9e58b948f2afd9a56942f936fe466500dfb2e863d83c20

SHA512
d648882b06120a8c30f8ab7a1518ceb578e369a1352f166412d58669f0a0145aac192e5f4722a744ff7d4e538b5c30cb67fa027209ee4e7462e515bb8cf65727

Download Submit
C:\Windows\SysWOW64\Ddakjkqi.exe

Filesize
197KB

MD5
53f8b9755f453c7ab2d452068584f532

SHA1
d027043fe985d990bbdcc56653f3559d980330da

SHA256
063a82bc3d872a340907b20cd72f2eb67122f35568fe2fa78fb555b5817683e2

SHA512
860042c2fdec9a6c1da854cf13766710629f9c2c6584f3fd81693ebb13d2c8569a25fcd7fd3bcc0099a49adff9a0b4c802d3964d49ebf6e39fc59186a4fc3815

Download Submit
C:\Windows\SysWOW64\Ddonekbl.exe

Filesize
197KB

MD5
99faee064f9a4bf697d77532ace1450b

SHA1
2007bb48b14d71316db1d28a24d42f497f41c105

SHA256
9629abcefd7d9eacb772be423edfb5d8d6dce5af5b079a0c2feb36b3999f6ed2

SHA512
437a732489928379673237416c2e3ee31a96d24ef12f3fbed400318fbc99e6fa973001f2d44a7aca3b7ad564d5899d9c60c0b20e2d7225110b1069dde0ba5b86

Download Submit
C:\Windows\SysWOW64\Debeijoc.exe

Filesize
197KB

MD5
b754bea033201d8c591da5d4d028eede

SHA1
9ec068685c3d54319340cf1e2d73c7189dbb5580

SHA256
58b89090a6c332134e9d3d39446e44199b32f6a119729b217b8ffa0433f3fb31

SHA512
4a9535588ae8012f81d0c9882237243d79732e8f4ab7b4b1d6178cef019ef1573caa932627f60167787352da8c1b2cfe116043727d50651e7480b240d62a0499

Download Submit
C:\Windows\SysWOW64\Dhfajjoj.exe

Filesize
197KB

MD5
fdbc1b454b795c87675adb31757baf2f

SHA1
e51f2ecbae78328309e3cb29b82d12c9609c3c96

SHA256
eeb1dbf91c1619daec6a3a61507bed893bff07eae08bf694ae290b5118b537c5

SHA512
a8e3ca1066145abe90263993feedc73d5892afbda5d1d2d04433950cc962b919c2c8fe89d1aa30f7ef1149e519b26f2464c2cb727cb0bc339a42855a7c701926

Download Submit
C:\Windows\SysWOW64\Dhnepfpj.exe

Filesize
197KB

MD5
5da9e406cd6778febcd0048c1973eb79

SHA1
ddeb9726f1bcd6fbfd5598b102ddec3834741b96

SHA256
07548c8b39b8e6ac64b52c8d10a98b2e67f3eef6338ac24ff1d30a771d319cc3

SHA512
93b59b47430a4906d0618a4ffa25c0ef2c4faaab9178e821099fb001ba5a57d8028b1a0aa30c3ed5939c29026aaf54aac0453d17023c5b549034dec4a84eec4b

Download Submit
C:\Windows\SysWOW64\Dhqaefng.exe

Filesize
197KB

MD5
b3df2950d3807aa52bb60ff9bc32a68f

SHA1
f555425314abbc903aa11c2af5a5f2c9f2286315

SHA256
50116412cbd070dce90a56183241e1736a4e56d1da5e4d5a515359b57ea4d0c7

SHA512
c982d611887f94e020a83e00b9c5e010995c7ef2a4df290b5a0710cf2b1cc69c6f383c3c81c6e59facbd57f3aba1506f739a3515da64021d286253c561682c11

Download Submit
C:\Windows\SysWOW64\Djlddi32.exe

Filesize
197KB

MD5
fd9a3f2213f246422f573f77e9f28199

SHA1
7a61c3f6a57bcc8e7fe98ef50f67febc64b89708

SHA256
212c41e7ab239838473cc760cf8b48825577d828b944446cc327c1f1bff3da57

SHA512
4acb605b23731f03067168938635829741c5bbfbdd84e6b1d13c0cd8b48bf1a657f4a2002f678836fc55e20069a4938d6c7c41bce2e72dfc43d5cfb7b50634f0

Download Submit
C:\Windows\SysWOW64\Djpnohej.exe

Filesize
197KB

MD5
d5dcc80622d24b57f4448b561db44be1

SHA1
2de748a5d77aa19754f791e9f6341531c079ae9a

SHA256
9ee8dcb00d64a3127fdc4ddf7b182f2a6665af977d659ed83167e298b122d5ba

SHA512
b723955699fc25cf4b46e8bd2fbadab509813a1898711c3df4c5f4f276db4ce9cdfa2c55e5c30c786fea03799bcb1af56d6f72c314df3f3479e8b50ebab96a2b

Download Submit
C:\Windows\SysWOW64\Dlgdkeje.exe

Filesize
197KB

MD5
be5dc1f0a47f19a4b0e8df0e4cbd78d9

SHA1
1ecfb7cb4e8519e5172ba9b60dc18daeff86aa4a

SHA256
3670479e7a1da6d4fcf0fd0d00ba0505b1755b73546eb95c186094015e6ca775

SHA512
f121529eec5d7a05e967e9a3cf4dd07989baaa01ffe80c90a84b7e770e285d676ce2769538e6f6e29a6e0a65b646567df5da0e74a9cc6989ad8d1265c2de8d61

Download Submit
C:\Windows\SysWOW64\Dpacfd32.exe

Filesize
197KB

MD5
1554148826ed0e760f3b3a03ac76ba55

SHA1
80b71d904a39fca62759ddd0c0d91c01b395ce75

SHA256
f3054a5a459dce3df823963a649a5774fe4ed0f23cd6b6466479d7beaa57ac55

SHA512
6551082fe2484c304ded18d9f11f21b6c43fe50a0508250e979b932dde98d6bcc0e972267fef9db76c2a988eebc89a67869d5dc24ff34d3b963bac32c01ffc0e

Download Submit
C:\Windows\SysWOW64\Dphifcoi.exe

Filesize
197KB

MD5
7abbfd0f4ee1ca037e5c0e1b13a878e2

SHA1
2e580a09c9563e48b2705c3439372e9b68e73133

SHA256
49eac4f1537f1f58751e683c7d2b282aba4f068b3606f9305123bfdf6baa1280

SHA512
d5af1e766de16d4970340a12eccfc6b818b43c8d0ee36b1d51c95b50c6b151f6511efc79cd800296cdfe5e6cf5a1fb35d4ef4ae207edc1ac39ff5b452b403b56

Download Submit
C:\Windows\SysWOW64\Dpjflb32.exe

Filesize
197KB

MD5
c29d67a513a26281eaeaa69162bd8227

SHA1
89704a35b97dca376067678d51cdba2937caefd4

SHA256
7fabe738c2486caa2706135c78ce8717d6470cf952a4a3847f74990deb4a1740

SHA512
8e96991027cddd89015763941b546501f3e425974ebbd8d6f8649055ba981c4aa02c6f09306566e08b989429b27da550cced294bec805ce1351379d545f17f80

Download Submit
C:\Windows\SysWOW64\Ecbenm32.exe

Filesize
197KB

MD5
a1a56691e2b830877fcd784459b4d90f

SHA1
956252c996d0fb2af9ed5a5f269e8165b1b33b45

SHA256
b9b521ba3fa0c1ddc63a6d76446053aee51ecbe3067ff4a03e59374028a53217

SHA512
1dbcb6164eee8f0fcfeb972e3714041fd93ac5c909a09a92e73ac1fb0664678193c32786a7127447ce3a31656251a3baf26ca263e7c030d6628ef96c2aaaf847

Download Submit
C:\Windows\SysWOW64\Eckonn32.exe

Filesize
197KB

MD5
8fde0bfacc2d3eb57fb69b0b97215307

SHA1
eb878e8f24556d261500640d703dd5d156dcd519

SHA256
6d63a5b17848ab6d303d5a38e680b8c2146770b60ad279b0cdc66c2727b10c59

SHA512
df5e6b6990071c5f930dfd175a09a4eb9c8f55c5f4f650b7e4aac58485d8afc8a749c66d2d84ab17466abe2aa38a3cfa4a59a9afc045c80f772b135a4fc8e476

Download Submit
C:\Windows\SysWOW64\Ecmlcmhe.exe

Filesize
197KB

MD5
cf0872e42c5518507e8577e626192767

SHA1
8d6cac9649403e18f99cd9d84d696895d91793ee

SHA256
64d11668bc69172b613460db50b8fc5cf7c0a00410354ffbd4121ebdfb368793

SHA512
dd2638d11f41bb96b029a5aea39839908d557a9ddb82fbc4859d0387211e2af8a39638b0146fca4e338a943a6872ccddda35a723e6e11ec179b247832300bd14

Download Submit
C:\Windows\SysWOW64\Eeidoc32.exe

Filesize
197KB

MD5
7fcaf24753dcb05930d1635fd0438598

SHA1
3aedc5b4c95269ab190784160211ea1d6163ea14

SHA256
5770f5ec4eda7b1af3722401b6ebaf92f8c8f48b6b69061b82ee259d50d20c78

SHA512
354639e71d4a08b040b4298c85a308d12b1b8910f101b10d3420c3d2f8f90dc247cc04b4a5d197d2df9bfd526fc4299210960665a2cd23f69e7fddbaff35aa6c

Download Submit
C:\Windows\SysWOW64\Efikji32.exe

Filesize
197KB

MD5
1fdc366abcd94ee8d917d2b99f14218a

SHA1
dcf7298593a7a4f24ec62097986220a1ed92f3c9

SHA256
463a1445da11b6625eb0a6dcbb321fa6b22c7167864db833dce092706877196f

SHA512
eddf9f322b10313e2cf780414f56469696425b0f5d33fafc4de26f29f1eae4faf05a68a7ed8011d329adf86d899bba398617f072551a002a69d4fc4a17fe2d00

Download Submit
C:\Windows\SysWOW64\Efpajh32.exe

Filesize
197KB

MD5
f7dfd2fbe0bfa2d7270f94388ad11c41

SHA1
f672e33acf2cee364689ad9ffc70f18ae0787263

SHA256
8aca9fba42e62a969dca11f6fdd20ee5a5789acd05ae02d506929032b6c21e26

SHA512
16732b1e0fef855e1f664722f938d0f987c9e2b728c2db47f760c846ee74613dbec3ec51305ffa07c5d5075e3568f0311f63962bd76d2fb087f8a11770e3685d

Download Submit
C:\Windows\SysWOW64\Ehekqe32.exe

Filesize
197KB

MD5
003be0fcd1f75f22abce3b9920148021

SHA1
9fdb5b491bb1e33e0bcb5261d47fe6abc19edf1f

SHA256
62bbd960dea7d8d3ad288179e4edfdf8dbc155ce8035355cd57e850198aa0aa4

SHA512
02846ea5c49349e53be64677958346263a190cb5923e9f579dcfe78f3c6d62db1f95151c340de2ec0a110be748c07181a88e431d7ab70e25a4979433c078520b

Download Submit
C:\Windows\SysWOW64\Ejgdpg32.exe

Filesize
197KB

MD5
7be97d740e71104c038b4a7ca410840d

SHA1
9674cd54c421abfa814ed13e6a08a70bd0464d52

SHA256
d341202dd311b3e3fcd3f8ff0eabb02fbafbe63b87f1bee863ce7dcd0c2f5c3e

SHA512
b0fbbf2a595bb9c3bdfd187328146a6dab64792cf8aec8a19c3260cb3d87b668785eec535e6afcb3838ceb00f75757d35a9a1f8ee188ca8f2620d77275c143e5

Download Submit
C:\Windows\SysWOW64\Ejjqeg32.exe

Filesize
197KB

MD5
92fa8c3c28a9770b821ada17f497bbea

SHA1
d9990639b02fd07ed1bcf68d0351b5f39bd1f67f

SHA256
981572bcce890863ca06c721fe91e8b52012008984e653d31771d2ef684d74a7

SHA512
66d975457dd3c11c9cc14bc18e7762a30fb502cc5b63d408a59205df142ffd7cd4386dd04b4dce38f3dc83506e6c3827ad6f8d6e2a9baa9b5b14c99562e3a3b9

Download Submit
C:\Windows\SysWOW64\Elccfc32.exe

Filesize
197KB

MD5
5e620563b8dc567dd7dd5833187c6d37

SHA1
ace7236f70990666ebc01e3b405c1f81bd6cc5e6

SHA256
1d4e097a609ca5901e9ef1827152d8844f2d275c6cd18f9e2cabf658cc58cb39

SHA512
3deb89bdf1b39e94acfc488625ae0ccf56487e124580dca45e528a8d6e61e93e8881659bfbc8c556a98ec86795c281d17cbedf5320f344c8169a33efa4e40641

Download Submit
C:\Windows\SysWOW64\Elhmablc.exe

Filesize
197KB

MD5
616b0806771956c8aadc59c097377228

SHA1
a5fb3e13a52cae5e423312931909a65bb3bdea8f

SHA256
a418cbe7bc43abd38546e873b2eb70120be174fd1e9d5393818febc5fc8fcb94

SHA512
73d00d1db93a89deb7aeae8cb73e0d79f5c671a31855038bee8b6eafe8599651d26fe60e56669035f0afcbae8ea026c2af0c85be4d422657c9e476b1b7db601d

Download Submit
C:\Windows\SysWOW64\Emjjgbjp.exe

Filesize
197KB

MD5
5256a1587b3075c87665fe9182796317

SHA1
6066ad73ad61d7c62e5dee1dd58f30e1c44b964b

SHA256
0d1ee0b71a63963a6782c746abfae7a1cbdf1c7e1a22a2ba9455cc5b170f0f73

SHA512
48e998e50ff146cf41846ab5a90afc5f651ba61024c79667ab8bddbb189506e784db400b76352e75e2ff57274fd3affc1a775fc9e7b9aa5a1023ce06b98639c7

Download Submit
C:\Windows\SysWOW64\Epmcab32.exe

Filesize
197KB

MD5
fd3a6d9ced370b4b42b9de3d3f07b95b

SHA1
45134651ab607784bbe59410a58379d4097166e9

SHA256
71e55eb92e997348b6c20b906242135a8b0d17db498ab866b3217ec62b185834

SHA512
b291d28091536e7b1813f9bee770712a7da22aeb686233a4ffa2d7358a4931eb1f7ad255a720503496526e7f3204184ab073a04f28534596b2c45d117572307b

Download Submit
C:\Windows\SysWOW64\Fdlnbm32.exe

Filesize
197KB

MD5
d4c5b022b8f53081f51af4ebcbea576f

SHA1
dd71c60fa84cd6f17722092e6191cee6a91b1bab

SHA256
ffbba3b6be5ce3da8da7ba558565aed4c49d9abb490516f71f4604f858951793

SHA512
44d74dddf3dd93d6abb7bdf11693c74024933b181c603fb69e6d4d50d48035a10b0384dfe2da761d51828ed9fcf7a3da9e32d16b8ed50f0ec46e9768e5829baf

Download Submit
C:\Windows\SysWOW64\Gmaioo32.exe

Filesize
197KB

MD5
e43a4c6260f7a5a65f7143afcf68a2a1

SHA1
c6794394d594e675255fd60dd41d0a8662e89a69

SHA256
8dcbc62eff617add112aa097f8eb9d3b9c0be32736a12a3da89b89da9caf01e8

SHA512
a7c78e11e15e8778091137c7bfb5726438c94568d0893a9841be443eb54adea77aa0a8215db2f61add5987681c91c2d7be0d449685d826743b803422a449b552

Download Submit
C:\Windows\SysWOW64\Hbhdmd32.exe

Filesize
197KB

MD5
196b4fc36319aeb48df6cf6da39b8562

SHA1
58a1c1bef34100814f831f7ce735bab2f452cff4

SHA256
a8cb6844c8b21bed1ae91593aad8f2474db05033e601e5365e16f74d35c0fab9

SHA512
fc53b4c92464999550f23b846fe2daeab7719c06b7e66d9ad8092d2b6afda8dfba8b64bee2b1d9b415ccf8a8691955f5478d3bf2849441ec00a2a6da3ac2b889

Download Submit
C:\Windows\SysWOW64\Iblfnn32.exe

Filesize
197KB

MD5
c333a227136bf90ed092c6fa1e208af6

SHA1
1b059a545a1eeccfbff1edc0a2f6fc3a7e9c8c16

SHA256
7653d744d31826c68058f76a9ce5cbe537425eaaa3f78258c1d3eb12846e5aff

SHA512
be50323c881f36a5e88c46373be8a45fa35e3ac1c246d13632db4be8b6a81c36da77ddceca5a3b5bc06d79f48be27dfafb7da84251a41e9aee70fb56792a7192

Download Submit
C:\Windows\SysWOW64\Jeaikh32.exe

Filesize
197KB

MD5
75b5b49e521958104d61bea3da890a8f

SHA1
7e6a047c8035a343c5179176f1c89254c86a7dc3

SHA256
71eeeafe7a4090b0b768d7470f7baa470b12ad8161371ffef5d07263f6a09a33

SHA512
5f9fd1612569fdee8802691c1d21226ea1ab7527e97ed37a53dd52cf84120d28ae8088b42f239fcd440d7349272e9989ef96e372e7bb2525e5b2ec6ba59cdd9c

Download Submit
C:\Windows\SysWOW64\Jehokgge.exe

Filesize
197KB

MD5
c0ce37f88d9d9c1e91ef383b3cedd153

SHA1
63fd80bfcf73adf7c47b3b5d7d287c9cc3964931

SHA256
a3a14fcb1062252c498f9edbe56f4c087aaa5255b93f058017c6c4f730f22ec5

SHA512
867f428b4e1fb5336b6df79b87a501e1168f8dad1678baf37047bc79935e40266656978912cbb42d98edf922efda0b6a7fb50a00ede18149f25b8f85b7439aa5

Download Submit
C:\Windows\SysWOW64\Lalcng32.exe

Filesize
197KB

MD5
e3844cbe174ee7c57519a0874bf2776f

SHA1
8844f26cf73e59220d7548728dc5e5db281ea3bf

SHA256
541b5e6b536eb77fc204e4a4b8566caebb4f95767b35abd8ec583b220bbe7cb3

SHA512
c66138ea1a25fe16e04af7aea300c9713fd40fba0950ffd4ca90f4dd9d49f182c40f361595c785b4dc0f4065a50ead1f7f6a1e2be177f6199857497ecbe3a1fb

Download Submit
C:\Windows\SysWOW64\Ldoaklml.exe

Filesize
197KB

MD5
ee6cf609f78cbdc8ae99e877f053ece1

SHA1
62dcc4208f393ee7341a4424b54a7a26e818a1dd

SHA256
b24895f916a9eaf9da9175d74babd6b12e612e44a51118106c2721979389d7e9

SHA512
495d3b4645d79127f3c7161df4888fe44582f5bb3a11f842061c5032bc096bc85e8714c1d42c2b6e842fefc24f96385bc36306c70b8cd18818c435fbfdeded70

Download Submit
C:\Windows\SysWOW64\Mipcob32.exe

Filesize
197KB

MD5
b7cb8006cd31f9d9293524db779bf5b3

SHA1
416343c997dd8dfba074cd3164efed542b5a46b0

SHA256
25f6aa9f0d96714417ce00f71a93c2de880373d6ccaac9e33699545a56a3f049

SHA512
6865bee8fcf85f4ce3d504e5a9585d123ebb3cdd6c2f56f3ab15fb7b5974b8815070d3f58f7f588f77837e3855d959fbb6f489470f361749719e0b74b459994a

Download Submit
C:\Windows\SysWOW64\Mjhqjg32.exe

Filesize
197KB

MD5
0b873be96eddb3a9075c61aa4e69bc8a

SHA1
3fdb8a7c208d0a958b0d49abba01f8699f972246

SHA256
224584ed4f08e77dc31a35360351099c50f40a4f7d220d238dbb9bfca4d617d7

SHA512
1e4d8e167938a00cbb397e9687c953be15183ea1667545ea31aefd339652287326c12abca94740f4665d347ce014de075f9aeed37f80d74f07ecf3c0640923ac

Download Submit
C:\Windows\SysWOW64\Ndfqbhia.exe

Filesize
197KB

MD5
09ac09a0613256e6bdf208ef4272b408

SHA1
5161c0293c4ed93ab8a015541e25bfc4707a8ed9

SHA256
40008589b4d2ca508b74e82b66e74b37cfab569c4407e75b7fce11c77b7f1c75

SHA512
db0aa96ac534df0b5eb072ab460394d7a24effd00167f8c68c8b3482d8d39239c63f2fd92788f73c764f032b8cc7a0b5a8e0af2fd469b95d1e66ea59b671dda4

Download Submit
C:\Windows\SysWOW64\Nlmllkja.exe

Filesize
197KB

MD5
0d7a50101874ecfed4a1ed79ad53c080

SHA1
6d6acb1d7de2bd3bc2e967fc530778ac4e25fa21

SHA256
bce556fcab7307d858cc23164d66a42cfd68dbcbb3e80bc7fe4bfa1333c45846

SHA512
caa08d41691bd934c19dc6d49e382a27b1985634341d4ea7cc69ae63584ad322c9a52c615cca2939251a6a30a98fb5de5927b071cc0fd9db4a3b7d03c0b81160

Download Submit
C:\Windows\SysWOW64\Nnmopdep.exe

Filesize
197KB

MD5
bf40321d3ff3fff995878b56221f4837

SHA1
04351a3379c26c33062df2d92463d5ba9e719a6a

SHA256
1a871ea631d95a82185c9554576df2882d30e87ff429d039236c6ed4fe078f1d

SHA512
4df3c24cbd22d0fbe230f05de67380c76fdf7b7a8357cd960c15f0588848e529dd318f1a040dc40ede1aef0fa3d789b1d1d888ab2d65404a6a736ddc450eee13

Download Submit
C:\Windows\SysWOW64\Ojaelm32.exe

Filesize
197KB

MD5
16726e674194f42d4c78d5a48c569095

SHA1
8d5965fb6b5004ad838d5cadeb126031c4a44796

SHA256
004e277dc3fcebe4d6584956954793dab1aa89342b99cf3bc762d89cbe29dc6d

SHA512
f5a482e369f4bbf25eddf91f4a5e4afca4494aa9cc7abac01da39d5dc08966097f1f96a30e74886d64c2eec2c5e6098ef3abeb6c8607ff8337e4383da81dcf6e

Download Submit
C:\Windows\SysWOW64\Olmeci32.exe

Filesize
197KB

MD5
f180bdc2284b1d59ba64233897c2b61f

SHA1
5941aaef66b3b3dad3da5025213965e7f0025731

SHA256
becf0c4de789f0b2af095ca64caf16e75aa5b9559ee10d04c7a6a3c0aac5e858

SHA512
e760c3cf6714d09bf3f22d0e4e5084ff03bb0b76fdd16bfe3a2445fafcc44561fcd1ac2ae1c2028df805f8271d7e1db5ffdc323023bc5cd145fac45720c0f57b

Download Submit
C:\Windows\SysWOW64\Pggbkagp.exe

Filesize
197KB

MD5
15490dbbd4a871bd7a0b7d2b01159acd

SHA1
2f8b5c9786317234f02a7d42b72073d397775147

SHA256
f6a25ab3ec4a0223605efa01a4cdbdad5eefe2cf58b91184bc63a50ce3dd0eda

SHA512
1bf48932bb90ae4c2418f2f9356e542042f026791a4a34deca7d0cfb82d724a4c5ff113a66eb3e449aac0d9d07e34dbfa48b99fac07bd5cfbb73430fc6921720

Download Submit
C:\Windows\SysWOW64\Pqdqof32.exe

Filesize
197KB

MD5
033bbf6d1633539ba3087f85df4510b6

SHA1
d234ba111fb9b55d0acf3ed126a84ed64ee12b6f

SHA256
2b212e03c3ed9ac8f91343b333551a0b1a14a433e40b9dab309d197698603d30

SHA512
5f79b6dc63f76005cdc3ee74bea9c3f47d7a8fa7d3f2735827129b21e18c424e3902a559fc02e864831ba5e92c8d75dd0fc14ffd811e0786c6fe22e889c4fc88

Download Submit
C:\Windows\SysWOW64\Qbimoo32.exe

Filesize
197KB

MD5
830494002eb71773e90d1c22a61569b7

SHA1
267514e3f37e1b78c2f208ae391e1f07d64b4487

SHA256
896e4979aa0785333927810fa93f934dc82a17b246923c96ad6a1618fe9a813b

SHA512
8a3627af9bb76fa38eb067c26b61b0c9cb70c8ecc14ca622414ca13d2600e041c5954a9d8967506c0778c2aed9d354d7d9663fc30d4787d479aa15deaa6a7c2e

Download Submit
memory/220-292-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/224-291-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/456-304-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/644-298-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/644-223-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/868-56-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/868-195-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/992-325-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/992-258-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1112-79-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1120-187-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1148-32-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1148-153-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1172-265-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1172-335-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1244-77-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1244-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1244-5-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1268-220-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1268-106-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1296-193-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1412-122-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1444-222-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1448-248-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1448-323-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2108-114-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2108-16-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2136-198-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2136-278-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2416-151-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2536-9-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2536-90-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2856-162-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2856-255-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3208-279-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3232-40-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3232-167-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3324-312-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3332-240-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3332-313-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3544-143-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3592-257-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3592-171-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3708-203-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3708-64-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4040-213-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4040-84-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4100-326-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4136-311-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4144-327-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4332-149-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4488-126-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4552-96-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4632-272-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4636-205-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4636-289-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4760-140-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4760-24-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4784-232-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4784-309-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4808-134-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4928-161-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4932-49-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4932-183-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads