bb31913b4fe1f97f6b72b2072e1ea12529f428033b76b30f04fafafffe45abe5

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 23:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb31913b4fe1f97f6b72b2072e1ea12529f428033b76b30f04fafafffe45abe5.exe
Size

79KB
MD5

6fc5a97167b0094d123340fdf668ff6e
SHA1

ed33c54eec0340c43abba5cf146f581cb2be433d
SHA256

bb31913b4fe1f97f6b72b2072e1ea12529f428033b76b30f04fafafffe45abe5
SHA512

1e4794ce3face122072fd48f63c156898a95827ca7d7c05d6d6da5e13f59436978976bd02c06aacac088e94a5a587602dd2b86338f5828e977eb653f0c9d76e3
SSDEEP

1536:pYz/p8KpRpD+FIDpdDxAGGt5pZ06TJUEpiFkSIgiItKq9v6DK:pep8K/pD+FID/xA/E6dUEpixtBtKq9vV

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdqgmmjb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hflcbngh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmgfda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldanqkki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgllfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dagiil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojhiqefo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ffgqqaip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmbmibhb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdhdajea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Caebma32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcgoilpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbmfoa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dboigi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icgqggce.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbiaapdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Beglgani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Digkijmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dpjflb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Haidklda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lknjmkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njfmke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcagphom.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acqimo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Debeijoc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejegjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kcifkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifefimom.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmkjkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aaepqjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eadopc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmjdjgjo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmlpoqpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agoabn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfknkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkihknfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkiqbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdfibe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmijbcpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmapha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ecjhcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imdgqfbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgimcebb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfjcgn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhqaefng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Balfaiil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecandfpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amddjegd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipnalhii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dedkdcie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmfmmcbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmgfda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eckonn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Baaplhef.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbfbkj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjjhbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qloebdig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmhale32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpijnqkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bbgipldd.exe

Executes dropped EXE 64 IoCs

pid	Process
4204	Clqnjf32.exe
3364	Ccjfgphj.exe
3080	Camfbm32.exe
4456	Chgoogfa.exe
2344	Cpofpdgd.exe
4024	Ccmclp32.exe
1028	Digkijmd.exe
2844	Dlegeemh.exe
2708	Doccaall.exe
3100	Diihojkb.exe
4232	Dpcpkc32.exe
1516	Dcalgo32.exe
2580	Djlddi32.exe
3952	Dljqpd32.exe
4996	Dagiil32.exe
2752	Debeijoc.exe
4200	Dhqaefng.exe
60	Dcfebonm.exe
5108	Djpnohej.exe
1168	Dhcnke32.exe
3724	Dpjflb32.exe
2496	Ehekqe32.exe
2964	Epmcab32.exe
3736	Eckonn32.exe
3024	Ejegjh32.exe
760	Elccfc32.exe
2436	Ebploj32.exe
2284	Ehjdldfl.exe
2308	Eleplc32.exe
4912	Ecphimfb.exe
2296	Efneehef.exe
3740	Ehlaaddj.exe
3804	Eqciba32.exe
868	Ecbenm32.exe
5016	Efpajh32.exe
2816	Ehonfc32.exe
4548	Ecdbdl32.exe
2348	Ffbnph32.exe
3052	Fhajlc32.exe
232	Fqhbmqqg.exe
876	Fcgoilpj.exe
4284	Fjqgff32.exe
5088	Fqkocpod.exe
2252	Fbllkh32.exe
1628	Fjcclf32.exe
3240	Fmapha32.exe
4416	Fckhdk32.exe
3600	Ffjdqg32.exe
4144	Fihqmb32.exe
2712	Fqohnp32.exe
4260	Fobiilai.exe
2300	Fbqefhpm.exe
1584	Fmficqpc.exe
332	Fodeolof.exe
2120	Gfnnlffc.exe
3076	Gimjhafg.exe
4940	Gogbdl32.exe
3608	Gfqjafdq.exe
2264	Giofnacd.exe
3796	Goiojk32.exe
2720	Gfcgge32.exe
1912	Gjocgdkg.exe
1896	Giacca32.exe
2800	Gpklpkio.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Paihpaak.dll	Ffgqqaip.exe
File created	C:\Windows\SysWOW64\Aadifclh.exe	Anfmjhmd.exe
File created	C:\Windows\SysWOW64\Pegplgln.dll	Onklabip.exe
File opened for modification	C:\Windows\SysWOW64\Ecandfpd.exe	Eofbch32.exe
File created	C:\Windows\SysWOW64\Cdainc32.exe	Cbqlfkmi.exe
File created	C:\Windows\SysWOW64\Jmehcnhg.dll	Iblfnn32.exe
File created	C:\Windows\SysWOW64\Ddjejl32.exe	Calhnpgn.exe
File opened for modification	C:\Windows\SysWOW64\Kcifkp32.exe	Kpepcedo.exe
File created	C:\Windows\SysWOW64\Beeflhdh.exe	Bbgipldd.exe
File created	C:\Windows\SysWOW64\Heapdjlp.exe	Hbbdholl.exe
File created	C:\Windows\SysWOW64\Bfdodjhm.exe	Bebblb32.exe
File opened for modification	C:\Windows\SysWOW64\Mnlfigcc.exe	Lknjmkdo.exe
File opened for modification	C:\Windows\SysWOW64\Dedkdcie.exe	Dceohhja.exe
File created	C:\Windows\SysWOW64\Amgapeea.exe	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Naeheh32.dll	Cnnlaehj.exe
File created	C:\Windows\SysWOW64\Jkfkfohj.exe	Jbocea32.exe
File created	C:\Windows\SysWOW64\Mmnldp32.exe	Megdccmb.exe
File created	C:\Windows\SysWOW64\Jkdnpo32.exe	Jbmfoa32.exe
File created	C:\Windows\SysWOW64\Mjddiqoc.dll	Jbhfjljd.exe
File created	C:\Windows\SysWOW64\Jdeflhhf.dll	Nckndeni.exe
File created	C:\Windows\SysWOW64\Dkifae32.exe	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Fodeolof.exe	Fmficqpc.exe
File created	C:\Windows\SysWOW64\Icnpmp32.exe	Ilghlc32.exe
File created	C:\Windows\SysWOW64\Fogjfmfe.dll	Kcifkp32.exe
File opened for modification	C:\Windows\SysWOW64\Nkncdifl.exe	Ngcgcjnc.exe
File created	C:\Windows\SysWOW64\Ldamee32.dll	Ogbipa32.exe
File opened for modification	C:\Windows\SysWOW64\Ddmaok32.exe	Danecp32.exe
File opened for modification	C:\Windows\SysWOW64\Dpcpkc32.exe	Diihojkb.exe
File created	C:\Windows\SysWOW64\Fllceb32.dll	Djlddi32.exe
File created	C:\Windows\SysWOW64\Okloegjl.exe	Ocegdjij.exe
File created	C:\Windows\SysWOW64\Bjjplc32.dll	Kfjhkjle.exe
File opened for modification	C:\Windows\SysWOW64\Abpcon32.exe	Alfkbc32.exe
File created	C:\Windows\SysWOW64\Bdfibe32.exe	Abemjmgg.exe
File opened for modification	C:\Windows\SysWOW64\Jeklag32.exe	Jblpek32.exe
File opened for modification	C:\Windows\SysWOW64\Bjmnoi32.exe	Bfabnjjp.exe
File opened for modification	C:\Windows\SysWOW64\Dfnjafap.exe	Dhkjej32.exe
File created	C:\Windows\SysWOW64\Ofnpim32.dll	Ccjfgphj.exe
File opened for modification	C:\Windows\SysWOW64\Jbkjjblm.exe	Jdhine32.exe
File opened for modification	C:\Windows\SysWOW64\Hflcbngh.exe	Hcmgfbhd.exe
File opened for modification	C:\Windows\SysWOW64\Acmflf32.exe	Aanjpk32.exe
File opened for modification	C:\Windows\SysWOW64\Ecdbdl32.exe	Ehonfc32.exe
File opened for modification	C:\Windows\SysWOW64\Hcedaheh.exe	Hpihai32.exe
File opened for modification	C:\Windows\SysWOW64\Nkqpjidj.exe	Ncihikcg.exe
File created	C:\Windows\SysWOW64\Edkdkplj.exe	Eeidoc32.exe
File created	C:\Windows\SysWOW64\Hcjccj32.dll	Dfiafg32.exe
File opened for modification	C:\Windows\SysWOW64\Hbhdmd32.exe	Hcedaheh.exe
File created	C:\Windows\SysWOW64\Kckbqpnj.exe	Kpmfddnf.exe
File opened for modification	C:\Windows\SysWOW64\Nqpego32.exe	Nnaikd32.exe
File opened for modification	C:\Windows\SysWOW64\Eocenh32.exe	Ehimanbq.exe
File created	C:\Windows\SysWOW64\Fdcfcpdf.dll	Eqciba32.exe
File opened for modification	C:\Windows\SysWOW64\Jplmmfmi.exe	Jmnaakne.exe
File created	C:\Windows\SysWOW64\Pqdqof32.exe	Pmidog32.exe
File created	C:\Windows\SysWOW64\Nilhco32.dll	Jmbklj32.exe
File created	C:\Windows\SysWOW64\Mcnhmm32.exe	Mamleegg.exe
File opened for modification	C:\Windows\SysWOW64\Elppfmoo.exe	Edihepnm.exe
File created	C:\Windows\SysWOW64\Lmiciaaj.exe	Lebkhc32.exe
File created	C:\Windows\SysWOW64\Qlgene32.dll	Ceckcp32.exe
File opened for modification	C:\Windows\SysWOW64\Dopigd32.exe	Dfiafg32.exe
File opened for modification	C:\Windows\SysWOW64\Delnin32.exe	Daqbip32.exe
File opened for modification	C:\Windows\SysWOW64\Lcmofolg.exe	Lmqgnhmp.exe
File opened for modification	C:\Windows\SysWOW64\Mcklgm32.exe	Mpmokb32.exe
File created	C:\Windows\SysWOW64\Pmidog32.exe	Pjjhbl32.exe
File created	C:\Windows\SysWOW64\Afmhck32.exe	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Ocdehlgh.dll	Giacca32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
14996	14864	WerFault.exe	733

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pemfincl.dll"	Nnjlpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgehcmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnocof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kldggoeb.dll"	Fkopnh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Klljnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Liimncmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eckonn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Genaegmo.dll"	Deanodkh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Obidhaog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddbbeade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdeflhhf.dll"	Nckndeni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oeahce32.dll"	Goiojk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcklgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jiglalpk.dll"	Aaepqjpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmjdjgjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fihpfl32.dll"	Eleplc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kilhgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Offdjb32.dll"	Lmqgnhmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjghpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnepdqjg.dll"	Elppfmoo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fhjfhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lplhdc32.dll"	Mgimcebb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aadifclh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fihqmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emhmioko.dll"	Gpklpkio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Miemjaci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlbgha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdhdajea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hffdjk32.dll"	Bjpaooda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Baocghgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmcglkid.dll"	Fodeolof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gjclbc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbbdholl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oqhacgdh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Edkdkplj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fhqcam32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ifefimom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojllan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bapiabak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djlddi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeandl32.dll"	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjgfjhqm.dll"	Pfjcgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nqbjqh32.dll"	Ceaehfjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmpgldhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qloebdig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qkkdmeko.dll"	Flnlhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qfcfml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chgoogfa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Angddopp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oehldcbk.dll"	Baocghgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mifnjj32.dll"	Eocenh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibcmom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnneknob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocdehlgh.dll"	Giacca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Okloegjl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jjpeepnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akichh32.dll"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Clpgpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pggbkagp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnonbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dpcpkc32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 4204	1572	bb31913b4fe1f97f6b72b2072e1ea12529f428033b76b30f04fafafffe45abe5.exe	89
PID 1572 wrote to memory of 4204	1572	bb31913b4fe1f97f6b72b2072e1ea12529f428033b76b30f04fafafffe45abe5.exe	89
PID 1572 wrote to memory of 4204	1572	bb31913b4fe1f97f6b72b2072e1ea12529f428033b76b30f04fafafffe45abe5.exe	89
PID 4204 wrote to memory of 3364	4204	Clqnjf32.exe	90
PID 4204 wrote to memory of 3364	4204	Clqnjf32.exe	90
PID 4204 wrote to memory of 3364	4204	Clqnjf32.exe	90
PID 3364 wrote to memory of 3080	3364	Ccjfgphj.exe	91
PID 3364 wrote to memory of 3080	3364	Ccjfgphj.exe	91
PID 3364 wrote to memory of 3080	3364	Ccjfgphj.exe	91
PID 3080 wrote to memory of 4456	3080	Camfbm32.exe	92
PID 3080 wrote to memory of 4456	3080	Camfbm32.exe	92
PID 3080 wrote to memory of 4456	3080	Camfbm32.exe	92
PID 4456 wrote to memory of 2344	4456	Chgoogfa.exe	93
PID 4456 wrote to memory of 2344	4456	Chgoogfa.exe	93
PID 4456 wrote to memory of 2344	4456	Chgoogfa.exe	93
PID 2344 wrote to memory of 4024	2344	Cpofpdgd.exe	94
PID 2344 wrote to memory of 4024	2344	Cpofpdgd.exe	94
PID 2344 wrote to memory of 4024	2344	Cpofpdgd.exe	94
PID 4024 wrote to memory of 1028	4024	Ccmclp32.exe	95
PID 4024 wrote to memory of 1028	4024	Ccmclp32.exe	95
PID 4024 wrote to memory of 1028	4024	Ccmclp32.exe	95
PID 1028 wrote to memory of 2844	1028	Digkijmd.exe	96
PID 1028 wrote to memory of 2844	1028	Digkijmd.exe	96
PID 1028 wrote to memory of 2844	1028	Digkijmd.exe	96
PID 2844 wrote to memory of 2708	2844	Dlegeemh.exe	97
PID 2844 wrote to memory of 2708	2844	Dlegeemh.exe	97
PID 2844 wrote to memory of 2708	2844	Dlegeemh.exe	97
PID 2708 wrote to memory of 3100	2708	Doccaall.exe	98
PID 2708 wrote to memory of 3100	2708	Doccaall.exe	98
PID 2708 wrote to memory of 3100	2708	Doccaall.exe	98
PID 3100 wrote to memory of 4232	3100	Diihojkb.exe	99
PID 3100 wrote to memory of 4232	3100	Diihojkb.exe	99
PID 3100 wrote to memory of 4232	3100	Diihojkb.exe	99
PID 4232 wrote to memory of 1516	4232	Dpcpkc32.exe	100
PID 4232 wrote to memory of 1516	4232	Dpcpkc32.exe	100
PID 4232 wrote to memory of 1516	4232	Dpcpkc32.exe	100
PID 1516 wrote to memory of 2580	1516	Dcalgo32.exe	101
PID 1516 wrote to memory of 2580	1516	Dcalgo32.exe	101
PID 1516 wrote to memory of 2580	1516	Dcalgo32.exe	101
PID 2580 wrote to memory of 3952	2580	Djlddi32.exe	102
PID 2580 wrote to memory of 3952	2580	Djlddi32.exe	102
PID 2580 wrote to memory of 3952	2580	Djlddi32.exe	102
PID 3952 wrote to memory of 4996	3952	Dljqpd32.exe	103
PID 3952 wrote to memory of 4996	3952	Dljqpd32.exe	103
PID 3952 wrote to memory of 4996	3952	Dljqpd32.exe	103
PID 4996 wrote to memory of 2752	4996	Dagiil32.exe	104
PID 4996 wrote to memory of 2752	4996	Dagiil32.exe	104
PID 4996 wrote to memory of 2752	4996	Dagiil32.exe	104
PID 2752 wrote to memory of 4200	2752	Debeijoc.exe	105
PID 2752 wrote to memory of 4200	2752	Debeijoc.exe	105
PID 2752 wrote to memory of 4200	2752	Debeijoc.exe	105
PID 4200 wrote to memory of 60	4200	Dhqaefng.exe	106
PID 4200 wrote to memory of 60	4200	Dhqaefng.exe	106
PID 4200 wrote to memory of 60	4200	Dhqaefng.exe	106
PID 60 wrote to memory of 5108	60	Dcfebonm.exe	107
PID 60 wrote to memory of 5108	60	Dcfebonm.exe	107
PID 60 wrote to memory of 5108	60	Dcfebonm.exe	107
PID 5108 wrote to memory of 1168	5108	Djpnohej.exe	108
PID 5108 wrote to memory of 1168	5108	Djpnohej.exe	108
PID 5108 wrote to memory of 1168	5108	Djpnohej.exe	108
PID 1168 wrote to memory of 3724	1168	Dhcnke32.exe	109
PID 1168 wrote to memory of 3724	1168	Dhcnke32.exe	109
PID 1168 wrote to memory of 3724	1168	Dhcnke32.exe	109
PID 3724 wrote to memory of 2496	3724	Dpjflb32.exe	110

C:\Users\Admin\AppData\Local\Temp\bb31913b4fe1f97f6b72b2072e1ea12529f428033b76b30f04fafafffe45abe5.exe
"C:\Users\Admin\AppData\Local\Temp\bb31913b4fe1f97f6b72b2072e1ea12529f428033b76b30f04fafafffe45abe5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Windows\SysWOW64\Clqnjf32.exe
  C:\Windows\system32\Clqnjf32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\SysWOW64\Ccjfgphj.exe
    C:\Windows\system32\Ccjfgphj.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:3364
  - - C:\Windows\SysWOW64\Camfbm32.exe
      C:\Windows\system32\Camfbm32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3080
    - - C:\Windows\SysWOW64\Chgoogfa.exe
        
        C:\Windows\system32\Chgoogfa.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4456
      - C:\Windows\SysWOW64\Cpofpdgd.exe
        
        C:\Windows\system32\Cpofpdgd.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Windows\SysWOW64\Ccmclp32.exe
        
        C:\Windows\system32\Ccmclp32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4024
        
        C:\Windows\SysWOW64\Digkijmd.exe
        
        C:\Windows\system32\Digkijmd.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1028
        
        C:\Windows\SysWOW64\Dlegeemh.exe
        
        C:\Windows\system32\Dlegeemh.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2844
        
        C:\Windows\SysWOW64\Doccaall.exe
        
        C:\Windows\system32\Doccaall.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2708
        
        C:\Windows\SysWOW64\Diihojkb.exe
        
        C:\Windows\system32\Diihojkb.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3100
        
        C:\Windows\SysWOW64\Dpcpkc32.exe
        
        C:\Windows\system32\Dpcpkc32.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4232
        
        C:\Windows\SysWOW64\Dcalgo32.exe
        
        C:\Windows\system32\Dcalgo32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1516
        
        C:\Windows\SysWOW64\Djlddi32.exe
        
        C:\Windows\system32\Djlddi32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2580
        
        C:\Windows\SysWOW64\Dljqpd32.exe
        
        C:\Windows\system32\Dljqpd32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Windows\SysWOW64\Dagiil32.exe
        
        C:\Windows\system32\Dagiil32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Windows\SysWOW64\Debeijoc.exe
        
        C:\Windows\system32\Debeijoc.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2752
        
        C:\Windows\SysWOW64\Dhqaefng.exe
        
        C:\Windows\system32\Dhqaefng.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4200
        
        C:\Windows\SysWOW64\Dcfebonm.exe
        
        C:\Windows\system32\Dcfebonm.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:60
        
        C:\Windows\SysWOW64\Djpnohej.exe
        
        C:\Windows\system32\Djpnohej.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\SysWOW64\Dhcnke32.exe
        
        C:\Windows\system32\Dhcnke32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1168
        
        C:\Windows\SysWOW64\Dpjflb32.exe
        
        C:\Windows\system32\Dpjflb32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3724
        
        C:\Windows\SysWOW64\Ehekqe32.exe
        
        C:\Windows\system32\Ehekqe32.exe
        23⤵
        Executes dropped EXE
        
        PID:2496
        
        C:\Windows\SysWOW64\Epmcab32.exe
        
        C:\Windows\system32\Epmcab32.exe
        24⤵
        Executes dropped EXE
        
        PID:2964
        
        C:\Windows\SysWOW64\Eckonn32.exe
        
        C:\Windows\system32\Eckonn32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3736
        
        C:\Windows\SysWOW64\Ejegjh32.exe
        
        C:\Windows\system32\Ejegjh32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3024
        
        C:\Windows\SysWOW64\Elccfc32.exe
        
        C:\Windows\system32\Elccfc32.exe
        27⤵
        Executes dropped EXE
        
        PID:760
        
        C:\Windows\SysWOW64\Ebploj32.exe
        
        C:\Windows\system32\Ebploj32.exe
        28⤵
        Executes dropped EXE
        
        PID:2436
        
        C:\Windows\SysWOW64\Ehjdldfl.exe
        
        C:\Windows\system32\Ehjdldfl.exe
        29⤵
        Executes dropped EXE
        
        PID:2284
        
        C:\Windows\SysWOW64\Eleplc32.exe
        
        C:\Windows\system32\Eleplc32.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2308
        
        C:\Windows\SysWOW64\Ecphimfb.exe
        
        C:\Windows\system32\Ecphimfb.exe
        31⤵
        Executes dropped EXE
        
        PID:4912
        
        C:\Windows\SysWOW64\Efneehef.exe
        
        C:\Windows\system32\Efneehef.exe
        32⤵
        Executes dropped EXE
        
        PID:2296
        
        C:\Windows\SysWOW64\Ehlaaddj.exe
        
        C:\Windows\system32\Ehlaaddj.exe
        33⤵
        Executes dropped EXE
        
        PID:3740
        
        C:\Windows\SysWOW64\Eqciba32.exe
        
        C:\Windows\system32\Eqciba32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3804
        
        C:\Windows\SysWOW64\Ecbenm32.exe
        
        C:\Windows\system32\Ecbenm32.exe
        35⤵
        Executes dropped EXE
        
        PID:868
        
        C:\Windows\SysWOW64\Efpajh32.exe
        
        C:\Windows\system32\Efpajh32.exe
        36⤵
        Executes dropped EXE
        
        PID:5016
        
        C:\Windows\SysWOW64\Ehonfc32.exe
        
        C:\Windows\system32\Ehonfc32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2816
        
        C:\Windows\SysWOW64\Ecdbdl32.exe
        
        C:\Windows\system32\Ecdbdl32.exe
        38⤵
        Executes dropped EXE
        
        PID:4548
        
        C:\Windows\SysWOW64\Ffbnph32.exe
        
        C:\Windows\system32\Ffbnph32.exe
        39⤵
        Executes dropped EXE
        
        PID:2348
        
        C:\Windows\SysWOW64\Fhajlc32.exe
        
        C:\Windows\system32\Fhajlc32.exe
        40⤵
        Executes dropped EXE
        
        PID:3052
        
        C:\Windows\SysWOW64\Fqhbmqqg.exe
        
        C:\Windows\system32\Fqhbmqqg.exe
        41⤵
        Executes dropped EXE
        
        PID:232
        
        C:\Windows\SysWOW64\Fcgoilpj.exe
        
        C:\Windows\system32\Fcgoilpj.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:876
        
        C:\Windows\SysWOW64\Fjqgff32.exe
        
        C:\Windows\system32\Fjqgff32.exe
        43⤵
        Executes dropped EXE
        
        PID:4284
        
        C:\Windows\SysWOW64\Fqkocpod.exe
        
        C:\Windows\system32\Fqkocpod.exe
        44⤵
        Executes dropped EXE
        
        PID:5088
        
        C:\Windows\SysWOW64\Fbllkh32.exe
        
        C:\Windows\system32\Fbllkh32.exe
        45⤵
        Executes dropped EXE
        
        PID:2252
        
        C:\Windows\SysWOW64\Fjcclf32.exe
        
        C:\Windows\system32\Fjcclf32.exe
        46⤵
        Executes dropped EXE
        
        PID:1628
        
        C:\Windows\SysWOW64\Fmapha32.exe
        
        C:\Windows\system32\Fmapha32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3240
        
        C:\Windows\SysWOW64\Fckhdk32.exe
        
        C:\Windows\system32\Fckhdk32.exe
        48⤵
        Executes dropped EXE
        
        PID:4416
        
        C:\Windows\SysWOW64\Ffjdqg32.exe
        
        C:\Windows\system32\Ffjdqg32.exe
        49⤵
        Executes dropped EXE
        
        PID:3600
        
        C:\Windows\SysWOW64\Fihqmb32.exe
        
        C:\Windows\system32\Fihqmb32.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4144
        
        C:\Windows\SysWOW64\Fqohnp32.exe
        
        C:\Windows\system32\Fqohnp32.exe
        51⤵
        Executes dropped EXE
        
        PID:2712
        
        C:\Windows\SysWOW64\Fobiilai.exe
        
        C:\Windows\system32\Fobiilai.exe
        52⤵
        Executes dropped EXE
        
        PID:4260
        
        C:\Windows\SysWOW64\Fbqefhpm.exe
        
        C:\Windows\system32\Fbqefhpm.exe
        53⤵
        Executes dropped EXE
        
        PID:2300
        
        C:\Windows\SysWOW64\Fmficqpc.exe
        
        C:\Windows\system32\Fmficqpc.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1584
        
        C:\Windows\SysWOW64\Fodeolof.exe
        
        C:\Windows\system32\Fodeolof.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:332
        
        C:\Windows\SysWOW64\Gfnnlffc.exe
        
        C:\Windows\system32\Gfnnlffc.exe
        56⤵
        Executes dropped EXE
        
        PID:2120
        
        C:\Windows\SysWOW64\Gimjhafg.exe
        
        C:\Windows\system32\Gimjhafg.exe
        57⤵
        Executes dropped EXE
        
        PID:3076
        
        C:\Windows\SysWOW64\Gogbdl32.exe
        
        C:\Windows\system32\Gogbdl32.exe
        58⤵
        Executes dropped EXE
        
        PID:4940
        
        C:\Windows\SysWOW64\Gfqjafdq.exe
        
        C:\Windows\system32\Gfqjafdq.exe
        59⤵
        Executes dropped EXE
        
        PID:3608
        
        C:\Windows\SysWOW64\Giofnacd.exe
        
        C:\Windows\system32\Giofnacd.exe
        60⤵
        Executes dropped EXE
        
        PID:2264
        
        C:\Windows\SysWOW64\Goiojk32.exe
        
        C:\Windows\system32\Goiojk32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3796
        
        C:\Windows\SysWOW64\Gfcgge32.exe
        
        C:\Windows\system32\Gfcgge32.exe
        62⤵
        Executes dropped EXE
        
        PID:2720
        
        C:\Windows\SysWOW64\Gjocgdkg.exe
        
        C:\Windows\system32\Gjocgdkg.exe
        63⤵
        Executes dropped EXE
        
        PID:1912
        
        C:\Windows\SysWOW64\Giacca32.exe
        
        C:\Windows\system32\Giacca32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1896
        
        C:\Windows\SysWOW64\Gpklpkio.exe
        
        C:\Windows\system32\Gpklpkio.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2800
        
        C:\Windows\SysWOW64\Gcggpj32.exe
        
        C:\Windows\system32\Gcggpj32.exe
        66⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\Gfedle32.exe
        
        C:\Windows\system32\Gfedle32.exe
        67⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        68⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\Gpnhekgl.exe
        
        C:\Windows\system32\Gpnhekgl.exe
        69⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        70⤵
        
        PID:404
        
        C:\Windows\SysWOW64\Gjclbc32.exe
        
        C:\Windows\system32\Gjclbc32.exe
        71⤵
        Modifies registry class
        
        PID:220
        
        C:\Windows\SysWOW64\Gifmnpnl.exe
        
        C:\Windows\system32\Gifmnpnl.exe
        72⤵
        
        PID:3920
        
        C:\Windows\SysWOW64\Gameonno.exe
        
        C:\Windows\system32\Gameonno.exe
        73⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\Hboagf32.exe
        
        C:\Windows\system32\Hboagf32.exe
        74⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        75⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\Hapaemll.exe
        
        C:\Windows\system32\Hapaemll.exe
        76⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\Hcnnaikp.exe
        
        C:\Windows\system32\Hcnnaikp.exe
        77⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        78⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        79⤵
        
        PID:2824
        
        C:\Windows\SysWOW64\Hpenfjad.exe
        
        C:\Windows\system32\Hpenfjad.exe
        80⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Hbckbepg.exe
        
        C:\Windows\system32\Hbckbepg.exe
        81⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Hjjbcbqj.exe
        
        C:\Windows\system32\Hjjbcbqj.exe
        82⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Hmioonpn.exe
        
        C:\Windows\system32\Hmioonpn.exe
        83⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Hpgkkioa.exe
        
        C:\Windows\system32\Hpgkkioa.exe
        84⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Hbeghene.exe
        
        C:\Windows\system32\Hbeghene.exe
        85⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Hfachc32.exe
        
        C:\Windows\system32\Hfachc32.exe
        86⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Hmklen32.exe
        
        C:\Windows\system32\Hmklen32.exe
        87⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Hpihai32.exe
        
        C:\Windows\system32\Hpihai32.exe
        88⤵
        Drops file in System32 directory
        
        PID:5468
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        89⤵
        Drops file in System32 directory
        
        PID:5512
        
        C:\Windows\SysWOW64\Hbhdmd32.exe
        
        C:\Windows\system32\Hbhdmd32.exe
        90⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        91⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Haidklda.exe
        
        C:\Windows\system32\Haidklda.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5648
        
        C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5684
        
        C:\Windows\SysWOW64\Iffmccbi.exe
        
        C:\Windows\system32\Iffmccbi.exe
        94⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        95⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5828
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        97⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        98⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        99⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Ipqnahgf.exe
        
        C:\Windows\system32\Ipqnahgf.exe
        100⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        101⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        102⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Imdnklfp.exe
        
        C:\Windows\system32\Imdnklfp.exe
        103⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        104⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Idofhfmm.exe
        
        C:\Windows\system32\Idofhfmm.exe
        105⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        106⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        107⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Ipegmg32.exe
        
        C:\Windows\system32\Ipegmg32.exe
        108⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Ibccic32.exe
        
        C:\Windows\system32\Ibccic32.exe
        109⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        110⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        111⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Jpgdbg32.exe
        
        C:\Windows\system32\Jpgdbg32.exe
        112⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        113⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Jjmhppqd.exe
        
        C:\Windows\system32\Jjmhppqd.exe
        114⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Jmkdlkph.exe
        
        C:\Windows\system32\Jmkdlkph.exe
        115⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        116⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Jjpeepnb.exe
        
        C:\Windows\system32\Jjpeepnb.exe
        117⤵
        Modifies registry class
        
        PID:6112
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        118⤵
        Drops file in System32 directory
        
        PID:5196
        
        C:\Windows\SysWOW64\Jplmmfmi.exe
        
        C:\Windows\system32\Jplmmfmi.exe
        119⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        120⤵
        Drops file in System32 directory
        
        PID:5396
        
        C:\Windows\SysWOW64\Jbkjjblm.exe
        
        C:\Windows\system32\Jbkjjblm.exe
        121⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Jjbako32.exe
        
        C:\Windows\system32\Jjbako32.exe
        122⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Jaljgidl.exe
        
        C:\Windows\system32\Jaljgidl.exe
        123⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        124⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5996
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        126⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        127⤵
        Drops file in System32 directory
        
        PID:5248
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        128⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        129⤵
        Drops file in System32 directory
        
        PID:5540
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        130⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        131⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        132⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        133⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5728
        
        C:\Windows\SysWOW64\Kilhgk32.exe
        
        C:\Windows\system32\Kilhgk32.exe
        135⤵
        Modifies registry class
        
        PID:5856
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        136⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        137⤵
        Drops file in System32 directory
        
        PID:5508
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5676
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        139⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        140⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        141⤵
        Drops file in System32 directory
        
        PID:6228
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        142⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        143⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        144⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6352
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        145⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        146⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        147⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        148⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        149⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        150⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        151⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        152⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6776
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        154⤵
        Modifies registry class
        
        PID:6820
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        155⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        156⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        157⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        158⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        159⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7072
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        161⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        162⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        163⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        164⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        165⤵
        Modifies registry class
        
        PID:6296
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        166⤵
        Drops file in System32 directory
        
        PID:6332
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        167⤵
        Modifies registry class
        
        PID:6432
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        168⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        169⤵
        Drops file in System32 directory
        
        PID:6584
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        170⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        171⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        172⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        173⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        174⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        175⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        176⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        177⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        178⤵
        Modifies registry class
        
        PID:6276
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        179⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        180⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        181⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        182⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        183⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        184⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        185⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        186⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        187⤵
        Drops file in System32 directory
        
        PID:6468
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        188⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        189⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        190⤵
        Drops file in System32 directory
        
        PID:6436
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        191⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        192⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        193⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        194⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        195⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7372
        
        C:\Windows\SysWOW64\Nnaikd32.exe
        
        C:\Windows\system32\Nnaikd32.exe
        197⤵
        Drops file in System32 directory
        
        PID:7412
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        198⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        199⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7544
        
        C:\Windows\SysWOW64\Ondeac32.exe
        
        C:\Windows\system32\Ondeac32.exe
        201⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        202⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Ogljjiei.exe
        
        C:\Windows\system32\Ogljjiei.exe
        203⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        204⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        205⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Ojmcld32.exe
        
        C:\Windows\system32\Ojmcld32.exe
        206⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        207⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        208⤵
        Drops file in System32 directory
        
        PID:7876
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        209⤵
        Modifies registry class
        
        PID:7920
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        210⤵
        Drops file in System32 directory
        
        PID:7968
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        211⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        212⤵
        Modifies registry class
        
        PID:8064
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        213⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8160
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        215⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        216⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        217⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        218⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        219⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Pbddcoei.exe
        
        C:\Windows\system32\Pbddcoei.exe
        220⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        221⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        222⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Qkmhlekj.exe
        
        C:\Windows\system32\Qkmhlekj.exe
        223⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        224⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        225⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7980
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        227⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        228⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        229⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        230⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        231⤵
        Drops file in System32 directory
        
        PID:7432
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        232⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        233⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        234⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        235⤵
        Drops file in System32 directory
        
        PID:7928
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        236⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        237⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        238⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        239⤵
        Modifies registry class
        
        PID:7564
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7656
        
        C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        241⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        242⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        243⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        244⤵
        Drops file in System32 directory
        
        PID:7484
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        245⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7872
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        246⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        247⤵
        Modifies registry class
        
        PID:7844
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7280
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        249⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        250⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        251⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        252⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8324
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        254⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        255⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        256⤵
        Modifies registry class
        
        PID:8452
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        257⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        258⤵
        Modifies registry class
        
        PID:8536
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8576
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        260⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        261⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        262⤵
        Drops file in System32 directory
        
        PID:8696
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        263⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        264⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        265⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        266⤵
        Modifies registry class
        
        PID:8908
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        267⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        268⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        269⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        270⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        271⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        272⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        273⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        274⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        275⤵
        Modifies registry class
        
        PID:8268
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        276⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        277⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        278⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        279⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        280⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        281⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8776
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        283⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        284⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        285⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        286⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        287⤵
        Modifies registry class
        
        PID:9112
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        288⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        289⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        290⤵
        Modifies registry class
        
        PID:8308
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        291⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        292⤵
        Drops file in System32 directory
        
        PID:8864
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7748
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        294⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        295⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        296⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        297⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        298⤵
        Drops file in System32 directory
        
        PID:9028
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        299⤵
        Modifies registry class
        
        PID:9128
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        300⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8596
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        302⤵
        Drops file in System32 directory
        
        PID:8840
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        303⤵
        Modifies registry class
        
        PID:9064
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        304⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        305⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        306⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        307⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        308⤵
        Drops file in System32 directory
        
        PID:8464
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        309⤵
        Modifies registry class
        
        PID:8988
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        310⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        311⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        312⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        313⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        314⤵
        Drops file in System32 directory
        
        PID:9300
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9344
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9380
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        317⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        318⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        319⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        320⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        321⤵
        Modifies registry class
        
        PID:9604
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        322⤵
        Modifies registry class
        
        PID:9640
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        323⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        324⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        325⤵
        Modifies registry class
        
        PID:9764
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        326⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        327⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9888
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        329⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        330⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        331⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        332⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        333⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        334⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        335⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        336⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        337⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        338⤵
        Modifies registry class
        
        PID:9336
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        339⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        340⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        341⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9600
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        343⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        344⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        345⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        346⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        347⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        348⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        349⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        350⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        351⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        352⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        353⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9456
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        355⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        356⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        357⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        358⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        359⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        360⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        361⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        362⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        363⤵
        Drops file in System32 directory
        
        PID:9884
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10172
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        365⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        366⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        367⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9756
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        368⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        369⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        370⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        371⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        372⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10456
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        374⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        375⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        376⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        377⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        378⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        379⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        380⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        381⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10788
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        382⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        383⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        384⤵
        Drops file in System32 directory
        
        PID:10924
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        385⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        386⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        387⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        388⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        389⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        390⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11200
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        391⤵
        Drops file in System32 directory
        
        PID:11240
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        392⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        393⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        394⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        395⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        396⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        397⤵
        Modifies registry class
        
        PID:10604
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        398⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        399⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10740
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        400⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        401⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        402⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        403⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11108
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        405⤵
        Drops file in System32 directory
        
        PID:11196
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        406⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        407⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        408⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        409⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        410⤵
        Modifies registry class
        
        PID:10672
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        411⤵
        Modifies registry class
        
        PID:10776
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        412⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        413⤵
        Drops file in System32 directory
        
        PID:10984
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        414⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        415⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        416⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        417⤵
        Drops file in System32 directory
        
        PID:10644
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        418⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        419⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        420⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        421⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        422⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        423⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        424⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10352
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        425⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        426⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        427⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        428⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11288
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        429⤵
        Modifies registry class
        
        PID:11332
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        430⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11376
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        431⤵
        
        PID:11416
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        432⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        433⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        434⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        435⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        436⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        437⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        438⤵
        
        PID:11704
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        439⤵
        
        PID:11748
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        440⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        441⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        442⤵
        
        PID:11872
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        443⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11912
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        444⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        445⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        446⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        447⤵
        Modifies registry class
        
        PID:12080
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        448⤵
        
        PID:12124
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        449⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        450⤵
        
        PID:12204
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        451⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        452⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11320
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        454⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11448
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        456⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        457⤵
        Drops file in System32 directory
        
        PID:11592
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        458⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        459⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        460⤵
        
        PID:11764
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        461⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11852
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        462⤵
        
        PID:11928
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        463⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        464⤵
        Drops file in System32 directory
        
        PID:12068
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        465⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        466⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        467⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12236
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        468⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        469⤵
        Modifies registry class
        
        PID:11368
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        470⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        471⤵
        
        PID:11584
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        472⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11736
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        473⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        474⤵
        
        PID:11940
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        475⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        476⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        477⤵
        
        PID:12276
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        478⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        479⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        480⤵
        
        PID:11768
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        481⤵
        
        PID:11892
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        482⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        483⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        484⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        485⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        486⤵
        Modifies registry class
        
        PID:6696
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        487⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        488⤵
        
        PID:12200
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        489⤵
        
        PID:11684
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        490⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        491⤵
        
        PID:12108
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        492⤵
        
        PID:11924
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        493⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        494⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        495⤵
        Modifies registry class
        
        PID:11572
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        496⤵
        
        PID:12324
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        497⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12372
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        498⤵
        
        PID:12416
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        499⤵
        
        PID:12456
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        500⤵
        
        PID:12492
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        501⤵
        
        PID:12540
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        502⤵
        
        PID:12572
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        503⤵
        
        PID:12616
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        504⤵
        
        PID:12652
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        505⤵
        
        PID:12696
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        506⤵
        
        PID:12740
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        507⤵
        
        PID:12780
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        508⤵
        
        PID:12816
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        509⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        510⤵
        Modifies registry class
        
        PID:12904
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        511⤵
        
        PID:12940
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        512⤵
        
        PID:12980
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        513⤵
        
        PID:13024
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        514⤵
        
        PID:13072
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        515⤵
        Modifies registry class
        
        PID:13108
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        516⤵
        Drops file in System32 directory
        
        PID:13152
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        517⤵
        
        PID:13200
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        518⤵
        
        PID:13236
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        519⤵
        
        PID:13272
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        520⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        521⤵
        
        PID:12316
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        522⤵
        Modifies registry class
        
        PID:12388
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        523⤵
        
        PID:12444
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        524⤵
        
        PID:12528
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        525⤵
        Modifies registry class
        
        PID:12568
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        526⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12636
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        527⤵
        
        PID:12692
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        528⤵
        
        PID:12764
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        529⤵
        
        PID:12812
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        530⤵
        
        PID:12892
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        531⤵
        
        PID:12960
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        532⤵
        
        PID:13008
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        533⤵
        
        PID:13068
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        534⤵
        
        PID:13148
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        535⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:13184
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        536⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:13260
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        537⤵
        Drops file in System32 directory
        
        PID:13300
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        538⤵
        
        PID:12364
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        539⤵
        
        PID:12488
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        540⤵
        
        PID:12592
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        541⤵
        
        PID:12752
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        542⤵
        
        PID:12464
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        543⤵
        
        PID:12948
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        544⤵
        
        PID:13016
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        545⤵
        
        PID:13120
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        546⤵
        Modifies registry class
        
        PID:13256
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        547⤵
        
        PID:12344
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        548⤵
        
        PID:12560
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        549⤵
        
        PID:12800
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        550⤵
        
        PID:12900
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        551⤵
        
        PID:13172
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        552⤵
        
        PID:12480
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        553⤵
        
        PID:12976
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        554⤵
        
        PID:13264
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        555⤵
        
        PID:12688
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        556⤵
        
        PID:12380
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        557⤵
        
        PID:13316
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        558⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13352
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        559⤵
        Drops file in System32 directory
        
        PID:13392
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        560⤵
        
        PID:13428
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        561⤵
        Drops file in System32 directory
        
        PID:13468
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        562⤵
        
        PID:13504
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        563⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13540
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        564⤵
        Drops file in System32 directory
        
        PID:13580
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        565⤵
        Modifies registry class
        
        PID:13620
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        566⤵
        
        PID:13656
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        567⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13692
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        568⤵
        Drops file in System32 directory
        
        PID:13724
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        569⤵
        
        PID:13764
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        570⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13800
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        571⤵
        Drops file in System32 directory
        
        PID:13836
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        572⤵
        
        PID:13872
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        573⤵
        
        PID:13916
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        574⤵
        
        PID:13960
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        575⤵
        Modifies registry class
        
        PID:13996
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        576⤵
        
        PID:14036
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        577⤵
        
        PID:14072
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        578⤵
        
        PID:14108
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        579⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14144
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        580⤵
        Modifies registry class
        
        PID:14180
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        581⤵
        
        PID:14216
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        582⤵
        
        PID:14252
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        583⤵
        
        PID:14288
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        584⤵
        
        PID:14328
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        585⤵
        
        PID:13344
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        586⤵
        
        PID:13400
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        587⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:13476
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        588⤵
        
        PID:13528
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        589⤵
        
        PID:13552
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        590⤵
        
        PID:13644
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        591⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13680
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        592⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13772
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        593⤵
        
        PID:13820
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        594⤵
        
        PID:13892
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        595⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13968
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        596⤵
        
        PID:14024
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        597⤵
        
        PID:14096
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        598⤵
        Drops file in System32 directory
        
        PID:14172
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        599⤵
        
        PID:14236
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        600⤵
        
        PID:14296
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        601⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        602⤵
        
        PID:13460
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        603⤵
        
        PID:13564
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        604⤵
        
        PID:13672
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        605⤵
        Drops file in System32 directory
        
        PID:13824
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        606⤵
        Drops file in System32 directory
        
        PID:13908
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        607⤵
        
        PID:14020
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        608⤵
        Drops file in System32 directory
        
        PID:14132
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        609⤵
        
        PID:14280
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        610⤵
        
        PID:14308
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        611⤵
        Drops file in System32 directory
        
        PID:13576
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        612⤵
        
        PID:13788
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        613⤵
        
        PID:13984
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        614⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14244
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        615⤵
        
        PID:13388
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        616⤵
        
        PID:13732
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        617⤵
        Drops file in System32 directory
        
        PID:14064
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        618⤵
        
        PID:13676
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        619⤵
        Drops file in System32 directory
        
        PID:14176
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        620⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:13324
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        621⤵
        
        PID:14352
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        622⤵
        
        PID:14388
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        623⤵
        
        PID:14424
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        624⤵
        
        PID:14460
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        625⤵
        
        PID:14496
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        626⤵
        
        PID:14532
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        627⤵
        
        PID:14568
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        628⤵
        
        PID:14612
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        629⤵
        
        PID:14648
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        630⤵
        
        PID:14696
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        631⤵
        
        PID:14748
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        632⤵
        
        PID:14792
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        633⤵
        
        PID:14828
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        634⤵
        
        PID:14864
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14864 -s 224
        635⤵
        Program crash
        
        PID:14996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 14864 -ip 14864
1⤵
PID:14952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afhohlbj.exe

Filesize
79KB

MD5
20d0ca2a12d73fc3fbdd2db5b7032bfa

SHA1
825164f3cc3ff3dd2c0b3a097bb07f8aef4737c9

SHA256
9205c5bb203dbfee0e01b9e424093567b120999fde992b9472b3d8008f5d9750

SHA512
d7fc1282ae62b2c3cd06c32e3995c48d82309a1b94e1cab2b083f4294e3dbdd55c06d73b92fe253de35f87bed24a7f404e851b0fef94591c345d862dd7f6fe31

Download Submit
C:\Windows\SysWOW64\Ajanck32.exe

Filesize
79KB

MD5
1148613cf15c2455004ecad3c2e50572

SHA1
002a7427b99df23e71f3fc8c6345cd447c0942dd

SHA256
a2e5fd21ae090271911b1745525d6d9fb21323434bce01a232d857f5b3d575d2

SHA512
5a71c16780ada56417040a755e3319dadaa9d32a0fde2d198257e1c6c7d63cd7dc38421a371ff09bacc2262f0e67f89ceba6c107d19e36500a7fcf1a414f5872

Download Submit
C:\Windows\SysWOW64\Bclhhnca.exe

Filesize
79KB

MD5
ad59abde829bc971d82fa69d843d217b

SHA1
90ddddf306648953ab6754b2f7a674a0db9a42bb

SHA256
47e563a7410ad1e0020c9b8a530608426e8c3365a9c6b05bbfdefe8b4dec4625

SHA512
3dec6de9bba3fa2b9886fb56e0f19746f933780e129bf792d327f658ae7d8eadcc7ad6f0bc77a935febc52e0cd10d587ad3d83de1f1b2ba443f6ddf8a3e79938

Download Submit
C:\Windows\SysWOW64\Bcoenmao.exe

Filesize
79KB

MD5
469c7347fa04654eaf4e1f1373657a36

SHA1
71f38256e41cb287dd9b93a1fe1170bcb0cd6782

SHA256
8da9ec6dadca0905f50a22607020dc43340c74348afd1bb2496d75796a42f429

SHA512
9cdf79b2af3902bce4230ce25d7a389466824ae679a04189ce4c4188fc0956237e8f53f997bffdd9be70c8237a510e61aaf757fc1c5ab7dac619a6dc27d85a5d

Download Submit
C:\Windows\SysWOW64\Bebblb32.exe

Filesize
79KB

MD5
51518beba0c50b7b30669b74a01245f4

SHA1
89ccfa5a6027ba439ea674bc46d60d0fe44864a7

SHA256
9616821322acd4a19ae0ec01d33c5f609f791f0e1044a71d3ccd06f9510da998

SHA512
27457f5cdaf44a2513909268561d18a57c01fc4c5555c296deb8b92c1a53f4f6731ca8e7b26d06f11e71702c7b05612d5c901232f2fb4e345e28f5c70140a2ef

Download Submit
C:\Windows\SysWOW64\Bmpcfdmg.exe

Filesize
79KB

MD5
f51a9ecc154b183a527001850ce1e77c

SHA1
a52fcfadccbe6f30836a128b4fbb53f99f226260

SHA256
889315f17fe3ca44b5d3d5703cb3ba9d88393c69da86552d02767e0008474189

SHA512
0ff07c9d70d24edc1d96d3d4f8c70d5535b178b87b81946801110b5b046f9f8da6da7160ddd5f81241388df93703107aecd18595afaa12f956d2acc6edd5e20b

Download Submit
C:\Windows\SysWOW64\Camfbm32.exe

Filesize
79KB

MD5
9936a67318d9dbd30d14d5d3fb236c5f

SHA1
93ff9641b91c4f17f210927ec2be2103746fd70c

SHA256
409e66ef6a66762ef1318e727a5787a34643394e8cc15104f4b3927398a1c7a2

SHA512
0b8b110aad19df04bab19c3aa30a1358a514cd3da331987c12011f88d726f45148427a291d4b2288323132c443709f8d6ae4949f215885344e6e8bcb395f4a09

Download Submit
C:\Windows\SysWOW64\Ccjfgphj.exe

Filesize
79KB

MD5
a149cf616ef401652a81550f79a0f015

SHA1
ceae703a24aa39e75d473d857f60c0c8737ced00

SHA256
8c544531362542666648ed410e5ef9b406ded10195bd05d17b70d48283f1c836

SHA512
2df5304d29b1c761a367f7a8ea596f6cad4bd953ab2ea8de96b9d8fba5209e6fec0d5817fc93b6516fda6a8bb0a80c5d945fa020e3ad95335608b9440cdb5260

Download Submit
C:\Windows\SysWOW64\Ccmclp32.exe

Filesize
44KB

MD5
17cf10c04230ab9c00b03984371e6ba1

SHA1
4b3a811d6480c5012bd8c57e898812e4c0dc0b36

SHA256
8d98d4cc509bd3163372a4eda0e393db80dafca2bcd51816b038cbab35f4bc04

SHA512
f02cddb01aa3aa8c1ce22ace5d2588f34c6584b466bafb88678e7ba812eab0938c2f69ec0d5433b88a56fab74e53a5098f33323e8fed8ade124411a2df88a294

Download Submit
C:\Windows\SysWOW64\Ccmclp32.exe

Filesize
14KB

MD5
b77ae0637aa6597c71da9a6be0c372c7

SHA1
f0ec23787b63ff0d8a23d36e5ab72c36c754182d

SHA256
eddb63a1566e96cde380489180303549b29013533d8b4f6228836a23b2d669cd

SHA512
50db5f4d1918d6054857b8a29c674501520c9d49a1f995fcd9aa19ca2a763bbf0bae6c866772b7c23cf3ff7ff05a05d897200391d04829d9712c5c446cfe1d0c

Download Submit
C:\Windows\SysWOW64\Cdabcm32.exe

Filesize
79KB

MD5
b5759b31330ea2a2db8f0869b3fb38a2

SHA1
104942f64d204c49e065ccfcff07d21a7be84e6f

SHA256
40fa290366c02d8183eeeb68ae80d1452fe597dddab7fcf961b508671d890738

SHA512
e251dfac8450118a45bd4f43330b9b418b6b7281fcce89f09820bdf56ea63f9671b4d2d358d5eec21ecb39b79563a41d2062970cfe65a50e838e5b9114506dd0

Download Submit
C:\Windows\SysWOW64\Cdcoim32.exe

Filesize
79KB

MD5
de6dd401ec72796341de47231c37d73b

SHA1
69c8321c8e34186170943f1655004b604d1aaa30

SHA256
16730f3e64480d1d478d37702bef1b8030b2cf5eb17a891228ca1f0e47895207

SHA512
c8b1ad9cd2b1a70007cc79a27e6e4f1d9f9a1ecc655722b4a0ede6123ca1514bbc5e1806804cf1ca7d03a031a041d5eae5b40e1bf319d29c10e3ab4096cd3fd5

Download Submit
C:\Windows\SysWOW64\Chgoogfa.exe

Filesize
79KB

MD5
6a2671160fed356c88f8b36cbe3f062b

SHA1
2ff0e214655da77b07dd1afeba3000ca6c8a389a

SHA256
81dc200a09997858aa4dfd95808a096031c979124af6be3847856a64a48acd3b

SHA512
7369cda4693cc2f452d691efdce34b4cbbd779bc388c066502017792dcc1da48a26492a6d09757086c4b92c8fedd431fd19664964c4548e206c39ef2db26a08f

Download Submit
C:\Windows\SysWOW64\Clqnjf32.exe

Filesize
79KB

MD5
2fc6cbd2451b1a22ccb648138a1347e3

SHA1
018b8736e80e61de0c6fdc3f08066b0b37dbe890

SHA256
cc72d697411de4baf812de1476af2f9873942617218ea054826fac8a941321cf

SHA512
ad1538965afb86cdfb15dde794e0c05387807dc918b18e587acb8406009618483893414969ac135618615781edadfebe73600be5aa3c74c5e53177e8d57db119

Download Submit
C:\Windows\SysWOW64\Cpofpdgd.exe

Filesize
79KB

MD5
beec9c98958c2d2b54845856ecdc20c7

SHA1
9604f2eca87fddfbdf63c466a75026202ffa722e

SHA256
9defd57027f2b25b794e2c52911b1812c2ba6adbe972dead1248ed843ebcfbd5

SHA512
748bb98638ab7cd17d5b7fd40aa3b096e458255e211402764db7c9ed4008c7b8a75c3a0911d3e77276e908c570b785a691cef0c4b081daa868f75017765d971b

Download Submit
C:\Windows\SysWOW64\Dagiil32.exe

Filesize
79KB

MD5
4e565885dddd911450281491c2a33492

SHA1
4a08ece1d632cc4f9896682450f9edccb14e34cd

SHA256
89cf6fd2a589656e1b1073e9870723c72a421ec70311170adc7786f7ee436363

SHA512
d3968de89eaa3a20ca4c2971cce87144871705585750af752c63f5bf2b58cf6ad3a7b657422520f1e285447783bd26359a1b6f38ade82f43c3f76adcc2751a57

Download Submit
C:\Windows\SysWOW64\Dcalgo32.exe

Filesize
79KB

MD5
2415f36648a6a561228439e29ca5e604

SHA1
308c2b642ef3ef254ffbb2cfad87284625d70a88

SHA256
f867c238f2fa567f5cf74e4261bfa821d9a2f019f8ade72a6977d00fb52d8510

SHA512
c62c99eb719f6bfa55a1c5ca432398d9a27def426310678d9d54e93f576b7a036fee71b0dda38988e2eb31737a97a00f2e7d744849880bf337f87ef07c327c82

Download Submit
C:\Windows\SysWOW64\Dcfebonm.exe

Filesize
79KB

MD5
4ab8247fc89abbe6c0bb9bd213a8e196

SHA1
feca7d2cd5d62c5cdf70a412a0e32f222e9e01f5

SHA256
bc602cd4f5a0b039cbb21e7ae04cca0a52ec5572ccf557b93b514eafe4e3fcce

SHA512
ba4b1dbdb8f541d3a79dcff60448bfd5a845aabc297321d9b64fda393f3c7d679bf09f4c76c5f0f99f078ffb140b9e54d97aa5389ea50f78a3216c5df2f512a0

Download Submit
C:\Windows\SysWOW64\Debeijoc.exe

Filesize
79KB

MD5
b07cfb94c18c9a783a7fddc1ecd93447

SHA1
97caaa1cbd5821c56e5b59501a2e69a93ce16321

SHA256
65e2ab0c0843948129aae358ce0d629d0aa4eb6799a8017c9a55ef24eb079428

SHA512
9aeca74145d422dc128331134a25ee272339b9453f604c9428ec74579846388fa90114181efbc088fe59e819f4f9f47396da773bfa6d507803fb0b7f471e2aea

Download Submit
C:\Windows\SysWOW64\Dfiafg32.exe

Filesize
79KB

MD5
34bc777871b1b29c8c48a31220354ecd

SHA1
7aaa77f12e522e17056e6d13b48ce9bd72365cbd

SHA256
d81e401e4cddc9f13f6a5c673f4ea4a8812418187d8d47065b44cdae50d9e86b

SHA512
12c5ea8b1fe65e924ed9e0c7df24970f0a076267320789c1067f6bdff5dad18a7c000bbd8a10c686233daf7c906fb4eda4627923e3bdb8602f638bcd81dbb907

Download Submit
C:\Windows\SysWOW64\Dhcnke32.exe

Filesize
79KB

MD5
8de1647efc36674d0f598d1982bf6998

SHA1
eb002241fb4a4fd2a55f18ed70913d8c632372e0

SHA256
e39260074d54feffbbe862b9bdddd8fd99f7ac1b532529389444c060be87fffb

SHA512
1182ffaedc3bcf234b4276a2487876ce1fd3629c1beebc82f96505a01f73ce3a0fab472d6aa103724eec647500953232519941380cbe8537047b9474edc7e1b6

Download Submit
C:\Windows\SysWOW64\Dhqaefng.exe

Filesize
79KB

MD5
b0c15d986c58a4a7529c97d9c9b48045

SHA1
74bd78a0e9e198e8d7530e12fae0ebd5e66661e0

SHA256
254c3778f5191a920c2b25ec3a9239667f141db2c39d4ee18b922d118d39f33f

SHA512
9e18730bea478aa56dd57786b1948f5dcdd201d5f0a60c294e265c7ace28fb72b43e94ea4d3ff65c22e40f092f54cc2fe46060c3b3e32bb4ef07cce5a5d87a1e

Download Submit
C:\Windows\SysWOW64\Digkijmd.exe

Filesize
79KB

MD5
1f2a62dab653b45de587524c092de9ab

SHA1
cdc8cad58a9e80082423ff79171802036a4189ee

SHA256
8eed5b0fb0c4cdd614569842d4451ccdc9b385bd4964ddb0735b36f43bb2e849

SHA512
3602714e7eefe36fa075e1009e3880e416d8656867e40b847b21bbeb311b84d72cff62736e786d9adfbda68296b4043a0d56fbf4ac5fd27fa7db8ab5cd13b8ff

Download Submit
C:\Windows\SysWOW64\Diihojkb.exe

Filesize
79KB

MD5
fbb3c7957c243d5cfc9f6ee597668bfe

SHA1
63c085867003a86060388a836e656f6b0f3ac48a

SHA256
b3e88fee4375bf672960df2edf27451d51480c0b263f080640dd6044d60ba884

SHA512
e42592182c55b1dc271aeed7dc693ef4204daab7263ba4e8134948d2a49bb15e69bab736b758fb46c0ceceeb222e46476397cb28c8baa701df33a2271a86e3bc

Download Submit
C:\Windows\SysWOW64\Djlddi32.exe

Filesize
79KB

MD5
e4b46513ec0fd10bec631f8a2c0d2d01

SHA1
2c753d6558ecbd1a3fb6cb60c00c30cd41a3a693

SHA256
261ad01eca384e9911720c1169d87888867cbb470824e5fb15a8720134b3fa93

SHA512
e1129f86787a77a5f010183f58f32f6cea290e003642844b27c116b0a0786456640cb2197a1ffaf37753d4fa91477a1a891c189196add028b9d6ab993cd7caee

Download Submit
C:\Windows\SysWOW64\Djpnohej.exe

Filesize
79KB

MD5
118a5cb32b120b26dd33ed53b17cb350

SHA1
015da8de7940d63fded6509dec3959cde50e55bc

SHA256
ce7ce2c5bda30002c34039a2ba2ba642cab05a4596dca5e37e7df0aa012e0962

SHA512
6fed31513c962ba1bf05bd0def2b29be6cac6054e6c5bebd4aa467664243762eb937931a942247a51328074195ccc8ebbb9b9ead45dbd260dfdaf46e63ecfe27

Download Submit
C:\Windows\SysWOW64\Dlegeemh.exe

Filesize
79KB

MD5
328734cc56cdd21f961267199aaa2a20

SHA1
e1e4c7bef44eb2d92f5206198a61d7b36a70a0bb

SHA256
a168640a146cb747dde208cf0eeafa72ff8ad327c986215d873bbe5220f061a8

SHA512
87bb0cdc497fae1c304c963f77e5ebd47ae066fd9a1113558c046c28678ebce334b84fc0f1ca53bbedccfd3c92df9e81df3871911f3212fdb0089a38b8e07561

Download Submit
C:\Windows\SysWOW64\Dljqpd32.exe

Filesize
79KB

MD5
384b767983de096532e7c77eda1a091d

SHA1
6ef6f0a0f211bc857babb472ca56f6b9eebd975b

SHA256
947e203e77319ea23ba32a25947008256318c00320fbb2a141e70140781bbeaf

SHA512
33f3a9b46cb73616c554013ffd8786b562173c8ec3a8775cffae552a55d8e8dba2930250f359ae4478012200848f7deaf941a06e1d5f69577127d220052c4c18

Download Submit
C:\Windows\SysWOW64\Doccaall.exe

Filesize
79KB

MD5
07159fca3181235e8d55730aa3aba961

SHA1
3954c2b7fc4728ef0dce3b2f584fe9a8702a5693

SHA256
1d8593f1ccd3e7a0903abf954cef80999533ce32c62bba686030e452ef81f414

SHA512
e552b234ce1ce0123defa3baa73be071ba91070b57ed1de9a352925452ffca3f89b3615b5ef2ab791a78456d5580f85a48591a5f959b83d669b90fd4739c6201

Download Submit
C:\Windows\SysWOW64\Dpcpkc32.exe

Filesize
79KB

MD5
ab9173082fce6eea9cbed57d5bb7c895

SHA1
74c5f91f83f294edea37339128d52439cc284559

SHA256
77e10dc3397783b171b84c165a489e1d80ac3172bdb18a184b39a6978679ea86

SHA512
62cc65881feb4fe50c9ae4435d0cd2a55b2c4b277663250cfaab96c48f820304965bcc69e7c2a5267e7a0e63f8fd54c274e1380e397cf68675f86d075ffc39a4

Download Submit
C:\Windows\SysWOW64\Dpjflb32.exe

Filesize
79KB

MD5
7968048fdc0ebaa5ef574ac607f3966c

SHA1
74a87ed912efa4b2ba679544fd939a50431c44ff

SHA256
67df50b262ac279729b6c43874b177436eab333a60f23d989ce0023a95c73856

SHA512
bdb4e9df4049bb9f7d92a3c177dd4813b57ee54ca2876708f5d7317b029afee8647ebbd981b015fa13bf8de16666b060a8c615d56c0d9612f8436069965bdaf5

Download Submit
C:\Windows\SysWOW64\Ebploj32.exe

Filesize
79KB

MD5
1f49890a8973f165dfb54537d017fe0d

SHA1
f957a0cf9a31ccf665d24b7817a9ee306e5927e0

SHA256
9c21a42bcbe0fd50be9e94472809d389661a7228f79dfabe81bbde6001b6abeb

SHA512
36e3b90cfd77090051e549e1ce8a4609091ab3c0cf824391a64076eda0be65b268d84eea5f573af754d2e3e0ae5b6e3b477c357407eccf52ab9983b6819912a7

Download Submit
C:\Windows\SysWOW64\Eckonn32.exe

Filesize
79KB

MD5
40e8f197b64b9b1de3b5a959b0db3a3f

SHA1
c5668c29b1755b25790547dd4d7a23014256b002

SHA256
eb666fd6a38b894a57707a8295c4206d03451639de9039d4e894f0353b66e083

SHA512
e9031bac8028b923fbc1c0b54a96b0a18ad04f654e35dc7b013be16f3659dc8bdd943525c16f66f5ced6002aa6a768dc4a6bb60154822b16a2e524872aa4b3fb

Download Submit
C:\Windows\SysWOW64\Ecphimfb.exe

Filesize
79KB

MD5
8a8c8a6623bc12fcfe5141687380ff90

SHA1
faf0060ef171e8c0feb9dadca78d0ca93ad34818

SHA256
76910a2aa3c6379ef92ab29a3111d7f02fcc65fd5d4563f7d612a6a7add9ed03

SHA512
5eaabf19e2347c6cad3edc04e6d2cddba50cebbe187d469cdc112cd42c97949ea4858494d798c8412e439ead6459236b65c8332829c6965f11fa0bb180c08fad

Download Submit
C:\Windows\SysWOW64\Efneehef.exe

Filesize
79KB

MD5
78c279c14b9d793f6d7f0ccac089d073

SHA1
ca6b1e33ec1b7c19a7ce58ded7420782f6f2729a

SHA256
53609d5c71914a8bc183f2e754d12a0ab7b86fc6ed7d30030e28c23b29422027

SHA512
19ea1a5f769c92cb25e92f84420ce7b7dafc4806386f703d2d7769009bc270d0af3750e7b31c0d90ae563a8b38a0c828aade351b83d7cc033986d2b3c4b7855c

Download Submit
C:\Windows\SysWOW64\Ehekqe32.exe

Filesize
79KB

MD5
1e18891acfead66c10123f4d01297719

SHA1
7ac0a955faab63bf266cf0edbe5029fb4fe41b8a

SHA256
9df200b25aaef192b730baf6a4770cbf3530c49786a05c6883a6cba70bf6ac80

SHA512
45fab220898c706661dbc172c5b0b6196e72557dbe260a00501d7ccea45ca5cc02ab730836e3e2b94aa7cb9348a512e839be18c26544c0c2e9c30c7c29604f8b

Download Submit
C:\Windows\SysWOW64\Ehjdldfl.exe

Filesize
79KB

MD5
7b84b79c5ae592afd3f23de8eece8f90

SHA1
8fb6f883b8f56a35454aed6d0f69aba26de0c6e2

SHA256
d8cb20c0015e995bb7a923e60fc926a704be0abcd31f20262c1384a56aea31ba

SHA512
04ed2fab6f751d6e051e7505fae169659f275d12793fe35eea09a6ac28ead5ca7f476642de55717c76a62b92763e0587ca3e1fa21f5859b28b41d64845c86e37

Download Submit
C:\Windows\SysWOW64\Ehlaaddj.exe

Filesize
79KB

MD5
4646dde6259ebcb3cb399a584db31cf3

SHA1
b3fdbc3528c7e58fb261efc75659a4fd61b35027

SHA256
0d7b1cb75ad4b483f1e68a76c4fc9d200f598e81096dc893087120fe7daf746f

SHA512
ff67ea4f902d077bc130bdbdeaf8f2e3620ba0ebe6eae79aec96a8ea792c7cb03f1e5ac84ef98f0117a3796fe937ff61a2c2bd84220bf16b9bf0131c6cbf6149

Download Submit
C:\Windows\SysWOW64\Ejegjh32.exe

Filesize
79KB

MD5
4fde04279e91423eaf3b06dcb439e402

SHA1
86d66a433ce8c9320eeed895f1997210d8b140e0

SHA256
44ab2f5ad26fe5cb29d211c15c280f6a8b81fa67b9c937161ddaca8fbcaef682

SHA512
b0542534e7c6e02e3486ec270cb03bc0ee517896dab6c2a38cb22f5f22ae308786a562a68575e22d53904b3e74ab6d7db2af77bc70553db990dd2aaa2f104c23

Download Submit
C:\Windows\SysWOW64\Elccfc32.exe

Filesize
79KB

MD5
e97146fc720347b3e8cd158f1b3d15cd

SHA1
425bfe7323fc32022aa451f9c657da3442d9b43b

SHA256
dbc19346b9b0453b735ea05aa85e16d2b8ae6599942562267cafd455a54191bb

SHA512
5964eab589082694227e0f22ac3fe0de65c22ba4d071e389985d9d1f15abb44c4472dfecccd552a815ca2406ff36d43b8ebb0cfb7d8bcf0661dfd4d3631012fe

Download Submit
C:\Windows\SysWOW64\Eleplc32.exe

Filesize
79KB

MD5
85eac61db39b3f4e588254370ee54d77

SHA1
7546f2376badbb9ff31d83dadb5b58f38a348035

SHA256
7b664972d9d2238f8a929d5468eefba9dd9dfdbb3795649f1dd9d8d5ffa57b9d

SHA512
955f9d0d926778eaae658eb88a9e781db55b8465e2d857be7f6eac92fe43ddc22a7fc241439483c2e607d252885809cc4f82a3e8a9d30fef19a1cf99b7ef5996

Download Submit
C:\Windows\SysWOW64\Epmcab32.exe

Filesize
79KB

MD5
6b7eb3d339d3dcf313368b93194284a3

SHA1
85756e95846ffa1027570b39ae3a67d3ebbb2735

SHA256
de8060aa301d98ce13b5f692d7a414767aaadc08687e154a94b06746a177e729

SHA512
1f4d123046f1e2eee91edd22e7d1bec9617d2d7484f8bf3b1350b2e64eef0e60b4e1c242d9d6d0f6192a18d8a6d3ff29b52f74c54f145fb6a2f1db4d4f80632f

Download Submit
C:\Windows\SysWOW64\Gameonno.exe

Filesize
79KB

MD5
4d57aeda0bf4196ba10ad6388f3a36a3

SHA1
531fc1172a23ecf4fae5f891cba50e13b75f68bc

SHA256
60a68fe6aacf4c22bc830183381c23630fb71a840c6780a686ada9f124f6c19e

SHA512
a8e2aca29604565d2e45d0c3a5a246858a0b97b1b94bba851356ab2be681331a5c706540c08f292787a51c82bdb1ebe8ce2b1d8ec8c0af85a3c758b5224310c1

Download Submit
C:\Windows\SysWOW64\Gbgdlq32.exe

Filesize
79KB

MD5
16221f14fd3428af4db40bf49da3fd70

SHA1
36eedfc9ebdd21a69aa712038497c7e5e4510a83

SHA256
c515e134dcedbcb02485b765827cfc1912c6d6de7cd202a36afa167fd136ea63

SHA512
a36626039b967e27bdcd865ff65e5269c8d01afffa9a8046b89018fafa0e0beab3258e00dd22d849c833d7cc2700cba33b417a0538b2583a3db8bd6eb73fb662

Download Submit
C:\Windows\SysWOW64\Ocbddc32.exe

Filesize
79KB

MD5
665c141d3b79bb3c68784e497ed26d30

SHA1
ca62049d1404e64ebccc16a0da2b27a2b85a58e8

SHA256
bdc70ddfa0403229afe8e5478eb65a9cd16e6603746f9e0dfea117885cd3dab4

SHA512
c824c11f32a91634edd0133c0631bea0092a4cb779a673848e8b15a47eec6e347002e09d70e83c10335d04e0089349b02ed38873c00e4d545f361808cb3439c6

Download Submit
C:\Windows\SysWOW64\Ojgbfocc.exe

Filesize
79KB

MD5
28dd9d615c75141eb403a13a286d4f58

SHA1
12a6c6ed30ba582fb2b4ca147142b9a2be6f3da8

SHA256
532a1e9d75f813564b69352c0eed34b090b9fb05528cb8400d7aba05eadbc6ab

SHA512
c7eef477024616e5c9193640a926528de50cc4c105cb1312db5812828a049b09909cf7c2b82fc5633c7fa4890f464fe3da642fdc637e231de872e668babe8147

Download Submit
C:\Windows\SysWOW64\Pqbdjfln.exe

Filesize
79KB

MD5
9e6956121f4d10434754dcf04b0c086b

SHA1
9b29b90704b27e8130207958eba2adadd3fd8e24

SHA256
0b152e00f10a4ca0ab9589a215bb8988de4207590fda9170942a5f48ff9adde1

SHA512
be05a7315ce28b1865806db1dd977477003dda1c9e86fd5c1cec593aea737a5f836cfdb709c9d8052c0c7ab7dbbf292490a154c123459dec4671aef031c675cf

Download Submit
C:\Windows\SysWOW64\Pqdqof32.exe

Filesize
79KB

MD5
741cfee8697e919ab575f1fc9b80502d

SHA1
2b9b7472193d06a926328fcfd414ddc73e997fcb

SHA256
5db66786559725f16d4dfba54a790c444538b985a4695a357ca2a1ef5478066e

SHA512
cd1149a333d8c8101c773c93193b5a48db941ee9d63212e9dfa6bbaa72e89ab7b85a17c279591a9fc5bf590bc0ee36df08a0c25292269c6be5c55589a723545c

Download Submit
memory/60-144-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/232-310-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/332-389-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/760-209-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/868-273-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/876-315-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1028-57-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1168-161-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1516-97-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1572-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1572-5-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1584-388-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1628-335-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1912-441-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2120-399-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2252-329-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2264-423-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2284-224-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2296-249-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2300-377-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2308-233-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2344-41-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2348-293-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2436-216-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2496-177-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2580-105-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2708-72-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2712-370-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2720-436-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2752-129-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2816-281-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2844-65-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2964-185-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3024-201-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3052-299-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3076-401-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3080-24-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3100-85-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3240-341-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3364-17-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3600-353-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3608-418-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3724-168-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3736-193-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3740-257-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3796-430-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3804-268-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3952-112-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4024-51-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4144-364-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4200-137-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4204-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4232-89-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4260-371-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4284-317-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4416-351-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4456-37-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4548-287-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4912-241-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4940-411-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4996-121-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5016-275-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5088-323-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5108-152-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads