98e2c710088437db65ab6a983849d3737e295d0deba59886cb320fce62d9dce1

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 08:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98e2c710088437db65ab6a983849d3737e295d0deba59886cb320fce62d9dce1.exe
Size

197KB
MD5

2cbeea3d0e1c73e0707d28482a71747c
SHA1

9672ff3310c09cf2399c1096445e088a7cef179a
SHA256

98e2c710088437db65ab6a983849d3737e295d0deba59886cb320fce62d9dce1
SHA512

35847159dcc87b12c08cbdb7ecf2e134ec272dc90097abfd48e282f5283443a26b8adda4c9a9ddbf2d9327a6780e1254a50d89264b34ea6912fc84ecd9f09ef9
SSDEEP

6144:O4/oXKrl4Yg4fQkjxqvak+PH/RARMHGb3fJt4X:O4AXKryN4IyxqCfRARR6

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndhmhh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dpjflb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfpcgpae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcmgfbhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfmepi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffbnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqpego32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajdbcano.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfgjgo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkaiqf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdjjckag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipdqba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlefklpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfhqbe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibmmhdhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpjqhgol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcmofolg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmlcbbcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dljqpd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Domfgpca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cogmkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnonbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Diihojkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdaldd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfhfan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fomhdg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfolbmje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daqbip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ecbenm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcggpj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljnnch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Becifhfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dobfld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqfeha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onfbfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fafkecel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nljofl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Laefdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbaemi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glebhjlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdmnlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ieolehop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpgfooop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qnjnnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bagflcje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gidphq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpojcf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjeddggd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdlnbm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chcddk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahmlgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdmpcdfm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqohnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijfboafl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Okloegjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcpclbfa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpgfooop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afjlnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qnjnnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agoabn32.exe

Executes dropped EXE 64 IoCs

pid	Process
956	Dlegeemh.exe
2620	Dcopbp32.exe
1968	Diihojkb.exe
3032	Dpcpkc32.exe
2992	Dcalgo32.exe
1216	Dephckaf.exe
4028	Dljqpd32.exe
3904	Dpemacql.exe
4348	Dohmlp32.exe
212	Dagiil32.exe
4604	Debeijoc.exe
1360	Djnaji32.exe
2780	Dhqaefng.exe
4932	Dllmfd32.exe
1900	Dokjbp32.exe
1236	Dcfebonm.exe
3920	Daifnk32.exe
1648	Dfdbojmq.exe
2480	Djpnohej.exe
4896	Dlojkddn.exe
2476	Dpjflb32.exe
4516	Domfgpca.exe
4472	Dchbhn32.exe
3708	Ejbkehcg.exe
1672	Epmcab32.exe
3316	Ejegjh32.exe
3232	Epopgbia.exe
3852	Ebploj32.exe
4332	Eleplc32.exe
936	Eodlho32.exe
5076	Ecphimfb.exe
840	Efneehef.exe
4800	Elhmablc.exe
4944	Eofinnkf.exe
1700	Ecbenm32.exe
216	Efpajh32.exe
1656	Eqfeha32.exe
2964	Ffbnph32.exe
1908	Fhajlc32.exe
1932	Fokbim32.exe
4564	Fbioei32.exe
4728	Fjqgff32.exe
3452	Fmocba32.exe
4480	Fomonm32.exe
4520	Fbllkh32.exe
3228	Fjcclf32.exe
3272	Fopldmcl.exe
3636	Fbnhphbp.exe
2648	Ffjdqg32.exe
2876	Fqohnp32.exe
1508	Fbqefhpm.exe
4568	Fmficqpc.exe
2744	Fodeolof.exe
1432	Gjjjle32.exe
2004	Gogbdl32.exe
4184	Gjlfbd32.exe
4248	Goiojk32.exe
984	Gcekkjcj.exe
1204	Giacca32.exe
2976	Gcggpj32.exe
4540	Gfedle32.exe
2616	Gidphq32.exe
3020	Gpnhekgl.exe
1400	Gbldaffp.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Dmefhako.exe	Dobfld32.exe
File created	C:\Windows\SysWOW64\Nqmhbpba.exe	Nkqpjidj.exe
File created	C:\Windows\SysWOW64\Pnihcq32.exe	Pjmlbbdg.exe
File created	C:\Windows\SysWOW64\Fqplhmkl.dll	Jbhfjljd.exe
File created	C:\Windows\SysWOW64\Amfoeb32.dll	Daconoae.exe
File created	C:\Windows\SysWOW64\Ifegaglc.dll	Gfedle32.exe
File opened for modification	C:\Windows\SysWOW64\Ncdgcf32.exe	Nljofl32.exe
File created	C:\Windows\SysWOW64\Nnjaqjfh.dll	Bhhdil32.exe
File created	C:\Windows\SysWOW64\Jdcpcf32.exe	Jaedgjjd.exe
File opened for modification	C:\Windows\SysWOW64\Cmlcbbcj.exe	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Mdmnlj32.exe	Mlefklpj.exe
File opened for modification	C:\Windows\SysWOW64\Bmemac32.exe	Bfkedibe.exe
File opened for modification	C:\Windows\SysWOW64\Jibeql32.exe	Jjpeepnb.exe
File opened for modification	C:\Windows\SysWOW64\Qloebdig.exe	Qchmagie.exe
File created	C:\Windows\SysWOW64\Lpqiemge.exe	Lmbmibhb.exe
File created	C:\Windows\SysWOW64\Laffdj32.dll	Hmhhehlb.exe
File opened for modification	C:\Windows\SysWOW64\Iejcji32.exe	Ifgbnlmj.exe
File created	C:\Windows\SysWOW64\Mogqfgka.dll	Bfkedibe.exe
File created	C:\Windows\SysWOW64\Jdmaid32.dll	Efneehef.exe
File opened for modification	C:\Windows\SysWOW64\Ngcgcjnc.exe	Ncgkcl32.exe
File created	C:\Windows\SysWOW64\Ojaelm32.exe	Oddmdf32.exe
File created	C:\Windows\SysWOW64\Pkbbae32.dll	Hbeqmoji.exe
File created	C:\Windows\SysWOW64\Idnljnaa.dll	Andqdh32.exe
File created	C:\Windows\SysWOW64\Dohmlp32.exe	Dpemacql.exe
File created	C:\Windows\SysWOW64\Agkbbg32.dll	Dekhneap.exe
File created	C:\Windows\SysWOW64\Gfgjgo32.exe	Gblngpbd.exe
File opened for modification	C:\Windows\SysWOW64\Heapdjlp.exe	Hbbdholl.exe
File created	C:\Windows\SysWOW64\Lemphdgj.dll	Mgkjhe32.exe
File created	C:\Windows\SysWOW64\Kjpgii32.dll	Ojaelm32.exe
File opened for modification	C:\Windows\SysWOW64\Daconoae.exe	Dodbbdbb.exe
File created	C:\Windows\SysWOW64\Bnckcnhb.dll	Kmgdgjek.exe
File opened for modification	C:\Windows\SysWOW64\Andgoobc.exe	Ajiknpjj.exe
File created	C:\Windows\SysWOW64\Hbcbgk32.dll	Eeidoc32.exe
File opened for modification	C:\Windows\SysWOW64\Ffimfqgm.exe	Flqimk32.exe
File opened for modification	C:\Windows\SysWOW64\Chcddk32.exe	Ceehho32.exe
File created	C:\Windows\SysWOW64\Mgcail32.dll	Cmqmma32.exe
File created	C:\Windows\SysWOW64\Ncnaabfm.dll	Jplfcpin.exe
File created	C:\Windows\SysWOW64\Ndqgbjkm.dll	Jeklag32.exe
File created	C:\Windows\SysWOW64\Plbehnol.dll	98e2c710088437db65ab6a983849d3737e295d0deba59886cb320fce62d9dce1.exe
File created	C:\Windows\SysWOW64\Gqpmkibm.dll	Diihojkb.exe
File opened for modification	C:\Windows\SysWOW64\Ipnalhii.exe	Impepm32.exe
File opened for modification	C:\Windows\SysWOW64\Pqmjog32.exe	Pnonbk32.exe
File created	C:\Windows\SysWOW64\Geekfi32.dll	Hjjbcbqj.exe
File opened for modification	C:\Windows\SysWOW64\Chghdqbf.exe	Cdkldb32.exe
File created	C:\Windows\SysWOW64\Hioiji32.exe	Hfqlnm32.exe
File created	C:\Windows\SysWOW64\Gcggpj32.exe	Giacca32.exe
File created	C:\Windows\SysWOW64\Pbbgnpgl.exe	Pnfkma32.exe
File created	C:\Windows\SysWOW64\Blfiei32.dll	Pcppfaka.exe
File opened for modification	C:\Windows\SysWOW64\Dpemacql.exe	Dljqpd32.exe
File created	C:\Windows\SysWOW64\Hfachc32.exe	Hccglh32.exe
File opened for modification	C:\Windows\SysWOW64\Ojgbfocc.exe	Ogifjcdp.exe
File created	C:\Windows\SysWOW64\Okloegjl.exe	Odbgim32.exe
File created	C:\Windows\SysWOW64\Phadlp32.dll	Ahmlgd32.exe
File created	C:\Windows\SysWOW64\Fqqlehck.dll	Helfik32.exe
File opened for modification	C:\Windows\SysWOW64\Jeklag32.exe	Jcioiood.exe
File created	C:\Windows\SysWOW64\Cmlcbbcj.exe	Cjmgfgdf.exe
File created	C:\Windows\SysWOW64\Dhqaefng.exe	Djnaji32.exe
File opened for modification	C:\Windows\SysWOW64\Fodeolof.exe	Fmficqpc.exe
File created	C:\Windows\SysWOW64\Baefid32.dll	Laalifad.exe
File created	C:\Windows\SysWOW64\Amjknl32.dll	Deagdn32.exe
File created	C:\Windows\SysWOW64\Pcpopjlq.dll	Bkidenlg.exe
File created	C:\Windows\SysWOW64\Pcijeb32.exe	Pmoahijl.exe
File created	C:\Windows\SysWOW64\Ndhmhh32.exe	Nnneknob.exe
File created	C:\Windows\SysWOW64\Dkkcge32.exe	Dfpgffpm.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
744	13756	WerFault.exe	713

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Domfgpca.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fibgnfha.dll"	Fokbim32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgbefoji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jglkll32.dll"	Ocgdji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjghpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Opakbi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcmofolg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ifjodl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgcifj32.dll"	Mpolqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgjpndjd.dll"	Agffge32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aeopki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjcgohig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnmkhg32.dll"	Okolkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbqefhpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jiikak32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hkikkeeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlefklpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnigkegh.dll"	Clkndpag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiecmmbf.dll"	Lfhdlh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ijhodq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgkhlnbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjdgcbkb.dll"	Bajjli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ieakglmn.dll"	Hmjdjgjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cogmkl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jplfcpin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnkhmbin.dll"	Meiaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdencjac.dll"	Bjghpn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chcddk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmqmma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdeahgnm.dll"	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Imoneg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lingibiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Agoabn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebploj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qloebdig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaelmc32.dll"	Angddopp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bkidenlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Keajjc32.dll"	Hkmefd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dagiil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdcfcpdf.dll"	Eofinnkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgidml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkomqm32.dll"	Gcddpdpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpkqnp32.dll"	Gpnhekgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjffbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnlnon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgdjapoo.dll"	Icnpmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgmngglp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldkojb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dekhneap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hflcbngh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nabqkgan.dll"	Ieolehop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekacmjgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnaijinl.dll"	Gcagkdba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnhjmp32.dll"	Kboljk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chfgkj32.dll"	Nilcjp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgioqq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djdmffnn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eodlho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdemcacc.dll"	Lijdhiaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Obdkma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hioiji32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4936 wrote to memory of 956	4936	98e2c710088437db65ab6a983849d3737e295d0deba59886cb320fce62d9dce1.exe	89
PID 4936 wrote to memory of 956	4936	98e2c710088437db65ab6a983849d3737e295d0deba59886cb320fce62d9dce1.exe	89
PID 4936 wrote to memory of 956	4936	98e2c710088437db65ab6a983849d3737e295d0deba59886cb320fce62d9dce1.exe	89
PID 956 wrote to memory of 2620	956	Dlegeemh.exe	90
PID 956 wrote to memory of 2620	956	Dlegeemh.exe	90
PID 956 wrote to memory of 2620	956	Dlegeemh.exe	90
PID 2620 wrote to memory of 1968	2620	Dcopbp32.exe	91
PID 2620 wrote to memory of 1968	2620	Dcopbp32.exe	91
PID 2620 wrote to memory of 1968	2620	Dcopbp32.exe	91
PID 1968 wrote to memory of 3032	1968	Diihojkb.exe	92
PID 1968 wrote to memory of 3032	1968	Diihojkb.exe	92
PID 1968 wrote to memory of 3032	1968	Diihojkb.exe	92
PID 3032 wrote to memory of 2992	3032	Dpcpkc32.exe	93
PID 3032 wrote to memory of 2992	3032	Dpcpkc32.exe	93
PID 3032 wrote to memory of 2992	3032	Dpcpkc32.exe	93
PID 2992 wrote to memory of 1216	2992	Dcalgo32.exe	94
PID 2992 wrote to memory of 1216	2992	Dcalgo32.exe	94
PID 2992 wrote to memory of 1216	2992	Dcalgo32.exe	94
PID 1216 wrote to memory of 4028	1216	Dephckaf.exe	95
PID 1216 wrote to memory of 4028	1216	Dephckaf.exe	95
PID 1216 wrote to memory of 4028	1216	Dephckaf.exe	95
PID 4028 wrote to memory of 3904	4028	Dljqpd32.exe	96
PID 4028 wrote to memory of 3904	4028	Dljqpd32.exe	96
PID 4028 wrote to memory of 3904	4028	Dljqpd32.exe	96
PID 3904 wrote to memory of 4348	3904	Dpemacql.exe	97
PID 3904 wrote to memory of 4348	3904	Dpemacql.exe	97
PID 3904 wrote to memory of 4348	3904	Dpemacql.exe	97
PID 4348 wrote to memory of 212	4348	Dohmlp32.exe	98
PID 4348 wrote to memory of 212	4348	Dohmlp32.exe	98
PID 4348 wrote to memory of 212	4348	Dohmlp32.exe	98
PID 212 wrote to memory of 4604	212	Dagiil32.exe	99
PID 212 wrote to memory of 4604	212	Dagiil32.exe	99
PID 212 wrote to memory of 4604	212	Dagiil32.exe	99
PID 4604 wrote to memory of 1360	4604	Debeijoc.exe	100
PID 4604 wrote to memory of 1360	4604	Debeijoc.exe	100
PID 4604 wrote to memory of 1360	4604	Debeijoc.exe	100
PID 1360 wrote to memory of 2780	1360	Djnaji32.exe	101
PID 1360 wrote to memory of 2780	1360	Djnaji32.exe	101
PID 1360 wrote to memory of 2780	1360	Djnaji32.exe	101
PID 2780 wrote to memory of 4932	2780	Dhqaefng.exe	102
PID 2780 wrote to memory of 4932	2780	Dhqaefng.exe	102
PID 2780 wrote to memory of 4932	2780	Dhqaefng.exe	102
PID 4932 wrote to memory of 1900	4932	Dllmfd32.exe	103
PID 4932 wrote to memory of 1900	4932	Dllmfd32.exe	103
PID 4932 wrote to memory of 1900	4932	Dllmfd32.exe	103
PID 1900 wrote to memory of 1236	1900	Dokjbp32.exe	104
PID 1900 wrote to memory of 1236	1900	Dokjbp32.exe	104
PID 1900 wrote to memory of 1236	1900	Dokjbp32.exe	104
PID 1236 wrote to memory of 3920	1236	Dcfebonm.exe	105
PID 1236 wrote to memory of 3920	1236	Dcfebonm.exe	105
PID 1236 wrote to memory of 3920	1236	Dcfebonm.exe	105
PID 3920 wrote to memory of 1648	3920	Daifnk32.exe	106
PID 3920 wrote to memory of 1648	3920	Daifnk32.exe	106
PID 3920 wrote to memory of 1648	3920	Daifnk32.exe	106
PID 1648 wrote to memory of 2480	1648	Dfdbojmq.exe	107
PID 1648 wrote to memory of 2480	1648	Dfdbojmq.exe	107
PID 1648 wrote to memory of 2480	1648	Dfdbojmq.exe	107
PID 2480 wrote to memory of 4896	2480	Djpnohej.exe	108
PID 2480 wrote to memory of 4896	2480	Djpnohej.exe	108
PID 2480 wrote to memory of 4896	2480	Djpnohej.exe	108
PID 4896 wrote to memory of 2476	4896	Dlojkddn.exe	109
PID 4896 wrote to memory of 2476	4896	Dlojkddn.exe	109
PID 4896 wrote to memory of 2476	4896	Dlojkddn.exe	109
PID 2476 wrote to memory of 4516	2476	Dpjflb32.exe	110

C:\Users\Admin\AppData\Local\Temp\98e2c710088437db65ab6a983849d3737e295d0deba59886cb320fce62d9dce1.exe
"C:\Users\Admin\AppData\Local\Temp\98e2c710088437db65ab6a983849d3737e295d0deba59886cb320fce62d9dce1.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Windows\SysWOW64\Dlegeemh.exe
  C:\Windows\system32\Dlegeemh.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\SysWOW64\Dcopbp32.exe
    C:\Windows\system32\Dcopbp32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2620
  - - C:\Windows\SysWOW64\Diihojkb.exe
      C:\Windows\system32\Diihojkb.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1968
    - - C:\Windows\SysWOW64\Dpcpkc32.exe
        
        C:\Windows\system32\Dpcpkc32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3032
      - C:\Windows\SysWOW64\Dcalgo32.exe
        
        C:\Windows\system32\Dcalgo32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2992
        
        C:\Windows\SysWOW64\Dephckaf.exe
        
        C:\Windows\system32\Dephckaf.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1216
        
        C:\Windows\SysWOW64\Dljqpd32.exe
        
        C:\Windows\system32\Dljqpd32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4028
        
        C:\Windows\SysWOW64\Dpemacql.exe
        
        C:\Windows\system32\Dpemacql.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3904
        
        C:\Windows\SysWOW64\Dohmlp32.exe
        
        C:\Windows\system32\Dohmlp32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Windows\SysWOW64\Dagiil32.exe
        
        C:\Windows\system32\Dagiil32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\SysWOW64\Debeijoc.exe
        
        C:\Windows\system32\Debeijoc.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4604
        
        C:\Windows\SysWOW64\Djnaji32.exe
        
        C:\Windows\system32\Djnaji32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1360
        
        C:\Windows\SysWOW64\Dhqaefng.exe
        
        C:\Windows\system32\Dhqaefng.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        C:\Windows\SysWOW64\Dllmfd32.exe
        
        C:\Windows\system32\Dllmfd32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4932
        
        C:\Windows\SysWOW64\Dokjbp32.exe
        
        C:\Windows\system32\Dokjbp32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1900
        
        C:\Windows\SysWOW64\Dcfebonm.exe
        
        C:\Windows\system32\Dcfebonm.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1236
        
        C:\Windows\SysWOW64\Daifnk32.exe
        
        C:\Windows\system32\Daifnk32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3920
        
        C:\Windows\SysWOW64\Dfdbojmq.exe
        
        C:\Windows\system32\Dfdbojmq.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1648
        
        C:\Windows\SysWOW64\Djpnohej.exe
        
        C:\Windows\system32\Djpnohej.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2480
        
        C:\Windows\SysWOW64\Dlojkddn.exe
        
        C:\Windows\system32\Dlojkddn.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4896
        
        C:\Windows\SysWOW64\Dpjflb32.exe
        
        C:\Windows\system32\Dpjflb32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2476
        
        C:\Windows\SysWOW64\Domfgpca.exe
        
        C:\Windows\system32\Domfgpca.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4516
        
        C:\Windows\SysWOW64\Dchbhn32.exe
        
        C:\Windows\system32\Dchbhn32.exe
        24⤵
        Executes dropped EXE
        
        PID:4472
        
        C:\Windows\SysWOW64\Ejbkehcg.exe
        
        C:\Windows\system32\Ejbkehcg.exe
        25⤵
        Executes dropped EXE
        
        PID:3708
        
        C:\Windows\SysWOW64\Epmcab32.exe
        
        C:\Windows\system32\Epmcab32.exe
        26⤵
        Executes dropped EXE
        
        PID:1672
        
        C:\Windows\SysWOW64\Ejegjh32.exe
        
        C:\Windows\system32\Ejegjh32.exe
        27⤵
        Executes dropped EXE
        
        PID:3316
        
        C:\Windows\SysWOW64\Epopgbia.exe
        
        C:\Windows\system32\Epopgbia.exe
        28⤵
        Executes dropped EXE
        
        PID:3232
        
        C:\Windows\SysWOW64\Ebploj32.exe
        
        C:\Windows\system32\Ebploj32.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3852
        
        C:\Windows\SysWOW64\Eleplc32.exe
        
        C:\Windows\system32\Eleplc32.exe
        30⤵
        Executes dropped EXE
        
        PID:4332
        
        C:\Windows\SysWOW64\Eodlho32.exe
        
        C:\Windows\system32\Eodlho32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:936
        
        C:\Windows\SysWOW64\Ecphimfb.exe
        
        C:\Windows\system32\Ecphimfb.exe
        32⤵
        Executes dropped EXE
        
        PID:5076
        
        C:\Windows\SysWOW64\Efneehef.exe
        
        C:\Windows\system32\Efneehef.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:840
        
        C:\Windows\SysWOW64\Elhmablc.exe
        
        C:\Windows\system32\Elhmablc.exe
        34⤵
        Executes dropped EXE
        
        PID:4800
        
        C:\Windows\SysWOW64\Eofinnkf.exe
        
        C:\Windows\system32\Eofinnkf.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4944
        
        C:\Windows\SysWOW64\Ecbenm32.exe
        
        C:\Windows\system32\Ecbenm32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1700
        
        C:\Windows\SysWOW64\Efpajh32.exe
        
        C:\Windows\system32\Efpajh32.exe
        37⤵
        Executes dropped EXE
        
        PID:216
        
        C:\Windows\SysWOW64\Eqfeha32.exe
        
        C:\Windows\system32\Eqfeha32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1656
        
        C:\Windows\SysWOW64\Ffbnph32.exe
        
        C:\Windows\system32\Ffbnph32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2964
        
        C:\Windows\SysWOW64\Fhajlc32.exe
        
        C:\Windows\system32\Fhajlc32.exe
        40⤵
        Executes dropped EXE
        
        PID:1908
        
        C:\Windows\SysWOW64\Fokbim32.exe
        
        C:\Windows\system32\Fokbim32.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1932
        
        C:\Windows\SysWOW64\Fbioei32.exe
        
        C:\Windows\system32\Fbioei32.exe
        42⤵
        Executes dropped EXE
        
        PID:4564
        
        C:\Windows\SysWOW64\Fjqgff32.exe
        
        C:\Windows\system32\Fjqgff32.exe
        43⤵
        Executes dropped EXE
        
        PID:4728
        
        C:\Windows\SysWOW64\Fmocba32.exe
        
        C:\Windows\system32\Fmocba32.exe
        44⤵
        Executes dropped EXE
        
        PID:3452
        
        C:\Windows\SysWOW64\Fomonm32.exe
        
        C:\Windows\system32\Fomonm32.exe
        45⤵
        Executes dropped EXE
        
        PID:4480
        
        C:\Windows\SysWOW64\Fbllkh32.exe
        
        C:\Windows\system32\Fbllkh32.exe
        46⤵
        Executes dropped EXE
        
        PID:4520
        
        C:\Windows\SysWOW64\Fjcclf32.exe
        
        C:\Windows\system32\Fjcclf32.exe
        47⤵
        Executes dropped EXE
        
        PID:3228
        
        C:\Windows\SysWOW64\Fopldmcl.exe
        
        C:\Windows\system32\Fopldmcl.exe
        48⤵
        Executes dropped EXE
        
        PID:3272
        
        C:\Windows\SysWOW64\Fbnhphbp.exe
        
        C:\Windows\system32\Fbnhphbp.exe
        49⤵
        Executes dropped EXE
        
        PID:3636
        
        C:\Windows\SysWOW64\Ffjdqg32.exe
        
        C:\Windows\system32\Ffjdqg32.exe
        50⤵
        Executes dropped EXE
        
        PID:2648
        
        C:\Windows\SysWOW64\Fqohnp32.exe
        
        C:\Windows\system32\Fqohnp32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2876
        
        C:\Windows\SysWOW64\Fbqefhpm.exe
        
        C:\Windows\system32\Fbqefhpm.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1508
        
        C:\Windows\SysWOW64\Fmficqpc.exe
        
        C:\Windows\system32\Fmficqpc.exe
        53⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4568
        
        C:\Windows\SysWOW64\Fodeolof.exe
        
        C:\Windows\system32\Fodeolof.exe
        54⤵
        Executes dropped EXE
        
        PID:2744
        
        C:\Windows\SysWOW64\Gjjjle32.exe
        
        C:\Windows\system32\Gjjjle32.exe
        55⤵
        Executes dropped EXE
        
        PID:1432
        
        C:\Windows\SysWOW64\Gogbdl32.exe
        
        C:\Windows\system32\Gogbdl32.exe
        56⤵
        Executes dropped EXE
        
        PID:2004
        
        C:\Windows\SysWOW64\Gjlfbd32.exe
        
        C:\Windows\system32\Gjlfbd32.exe
        57⤵
        Executes dropped EXE
        
        PID:4184
        
        C:\Windows\SysWOW64\Goiojk32.exe
        
        C:\Windows\system32\Goiojk32.exe
        58⤵
        Executes dropped EXE
        
        PID:4248
        
        C:\Windows\SysWOW64\Gcekkjcj.exe
        
        C:\Windows\system32\Gcekkjcj.exe
        59⤵
        Executes dropped EXE
        
        PID:984
        
        C:\Windows\SysWOW64\Giacca32.exe
        
        C:\Windows\system32\Giacca32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1204
        
        C:\Windows\SysWOW64\Gcggpj32.exe
        
        C:\Windows\system32\Gcggpj32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2976
        
        C:\Windows\SysWOW64\Gfedle32.exe
        
        C:\Windows\system32\Gfedle32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4540
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2616
        
        C:\Windows\SysWOW64\Gpnhekgl.exe
        
        C:\Windows\system32\Gpnhekgl.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3020
        
        C:\Windows\SysWOW64\Gbldaffp.exe
        
        C:\Windows\system32\Gbldaffp.exe
        65⤵
        Executes dropped EXE
        
        PID:1400
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4396
        
        C:\Windows\SysWOW64\Gmaioo32.exe
        
        C:\Windows\system32\Gmaioo32.exe
        67⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\Gameonno.exe
        
        C:\Windows\system32\Gameonno.exe
        68⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\Hboagf32.exe
        
        C:\Windows\system32\Hboagf32.exe
        69⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\Hfjmgdlf.exe
        
        C:\Windows\system32\Hfjmgdlf.exe
        70⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        71⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\Hpbaqj32.exe
        
        C:\Windows\system32\Hpbaqj32.exe
        72⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\Hcnnaikp.exe
        
        C:\Windows\system32\Hcnnaikp.exe
        73⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        74⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\Hikfip32.exe
        
        C:\Windows\system32\Hikfip32.exe
        75⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\Habnjm32.exe
        
        C:\Windows\system32\Habnjm32.exe
        76⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\Hfofbd32.exe
        
        C:\Windows\system32\Hfofbd32.exe
        77⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\Hjjbcbqj.exe
        
        C:\Windows\system32\Hjjbcbqj.exe
        78⤵
        Drops file in System32 directory
        
        PID:4804
        
        C:\Windows\SysWOW64\Hadkpm32.exe
        
        C:\Windows\system32\Hadkpm32.exe
        79⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Hccglh32.exe
        
        C:\Windows\system32\Hccglh32.exe
        80⤵
        Drops file in System32 directory
        
        PID:2732
        
        C:\Windows\SysWOW64\Hfachc32.exe
        
        C:\Windows\system32\Hfachc32.exe
        81⤵
        
        PID:1152
        
        C:\Windows\SysWOW64\Hjmoibog.exe
        
        C:\Windows\system32\Hjmoibog.exe
        82⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\Hmklen32.exe
        
        C:\Windows\system32\Hmklen32.exe
        83⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\Hpihai32.exe
        
        C:\Windows\system32\Hpihai32.exe
        84⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\Hbhdmd32.exe
        
        C:\Windows\system32\Hbhdmd32.exe
        85⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Ipldfi32.exe
        
        C:\Windows\system32\Ipldfi32.exe
        86⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        87⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Iffmccbi.exe
        
        C:\Windows\system32\Iffmccbi.exe
        88⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        89⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Impepm32.exe
        
        C:\Windows\system32\Impepm32.exe
        90⤵
        Drops file in System32 directory
        
        PID:5364
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        91⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Icjmmg32.exe
        
        C:\Windows\system32\Icjmmg32.exe
        92⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5488
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        94⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Ipqnahgf.exe
        
        C:\Windows\system32\Ipqnahgf.exe
        95⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Ibojncfj.exe
        
        C:\Windows\system32\Ibojncfj.exe
        96⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5660
        
        C:\Windows\SysWOW64\Imdnklfp.exe
        
        C:\Windows\system32\Imdnklfp.exe
        98⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        99⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        100⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        101⤵
        Modifies registry class
        
        PID:5832
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        102⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        103⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Ijkljp32.exe
        
        C:\Windows\system32\Ijkljp32.exe
        104⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        105⤵
        Drops file in System32 directory
        
        PID:6004
        
        C:\Windows\SysWOW64\Jdcpcf32.exe
        
        C:\Windows\system32\Jdcpcf32.exe
        106⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Jfaloa32.exe
        
        C:\Windows\system32\Jfaloa32.exe
        107⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Jiphkm32.exe
        
        C:\Windows\system32\Jiphkm32.exe
        108⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        109⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Jpjqhgol.exe
        
        C:\Windows\system32\Jpjqhgol.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5252
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        111⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Jjpeepnb.exe
        
        C:\Windows\system32\Jjpeepnb.exe
        112⤵
        Drops file in System32 directory
        
        PID:5416
        
        C:\Windows\SysWOW64\Jibeql32.exe
        
        C:\Windows\system32\Jibeql32.exe
        113⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        114⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Jjbako32.exe
        
        C:\Windows\system32\Jjbako32.exe
        115⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        116⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5856
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        118⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        119⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        120⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Jangmibi.exe
        
        C:\Windows\system32\Jangmibi.exe
        121⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        122⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Jiikak32.exe
        
        C:\Windows\system32\Jiikak32.exe
        123⤵
        Modifies registry class
        
        PID:5468
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        124⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Kgmlkp32.exe
        
        C:\Windows\system32\Kgmlkp32.exe
        125⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        126⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        127⤵
        Drops file in System32 directory
        
        PID:5996
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5168
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        129⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        130⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        131⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        132⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        133⤵
        Modifies registry class
        
        PID:5516
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6116
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        135⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        136⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        137⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        138⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        139⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        140⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        141⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        142⤵
        Modifies registry class
        
        PID:6436
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6476
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        144⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        145⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        146⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        147⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        148⤵
        Modifies registry class
        
        PID:6716
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        149⤵
        Modifies registry class
        
        PID:6760
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        150⤵
        Drops file in System32 directory
        
        PID:6808
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        151⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        152⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        153⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        154⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        155⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        156⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5340
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6172
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        159⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        160⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        161⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        162⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        163⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        164⤵
        Modifies registry class
        
        PID:6712
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        165⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        166⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6940
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        168⤵
        Modifies registry class
        
        PID:7056
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        169⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        170⤵
        Modifies registry class
        
        PID:6216
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        171⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        172⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        173⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        174⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        175⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        176⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        177⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        178⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        179⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        180⤵
        Drops file in System32 directory
        
        PID:6752
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        181⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        182⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        183⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        184⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        185⤵
        Drops file in System32 directory
        
        PID:7100
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        186⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Nnaikd32.exe
        
        C:\Windows\system32\Nnaikd32.exe
        187⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7176
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        189⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        190⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        191⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Ocqnij32.exe
        
        C:\Windows\system32\Ocqnij32.exe
        192⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        193⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7436
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        195⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        196⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Ojmcld32.exe
        
        C:\Windows\system32\Ojmcld32.exe
        197⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        198⤵
        Modifies registry class
        
        PID:7620
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        199⤵
        Drops file in System32 directory
        
        PID:7664
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7716
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        201⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        202⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        203⤵
        Modifies registry class
        
        PID:7852
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        204⤵
        Modifies registry class
        
        PID:7892
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        205⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        206⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8024
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        208⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        209⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Pjffbc32.exe
        
        C:\Windows\system32\Pjffbc32.exe
        210⤵
        Modifies registry class
        
        PID:8148
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        211⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        212⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        213⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        214⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        215⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        216⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        217⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        218⤵
        Drops file in System32 directory
        
        PID:7648
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        219⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        220⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        221⤵
        Drops file in System32 directory
        
        PID:7832
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        222⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        223⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        224⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        225⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        226⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        227⤵
        Drops file in System32 directory
        
        PID:7376
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        228⤵
        Modifies registry class
        
        PID:7472
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        229⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        230⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        231⤵
        Modifies registry class
        
        PID:7876
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8032
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        233⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        234⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        235⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        236⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        237⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        238⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        239⤵
        Drops file in System32 directory
        
        PID:7492
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        240⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        241⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        242⤵
        Modifies registry class
        
        PID:8176
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7968
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        244⤵
        Modifies registry class
        
        PID:8200
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        245⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        246⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        247⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        248⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        249⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Becifhfj.exe
        
        C:\Windows\system32\Becifhfj.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8460
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        251⤵
        Modifies registry class
        
        PID:8500
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        252⤵
        Modifies registry class
        
        PID:8536
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        253⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        254⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        255⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        256⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        257⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        258⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        259⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8872
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        261⤵
        Modifies registry class
        
        PID:8916
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        262⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        263⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        264⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        265⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9088
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        266⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        267⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        268⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        269⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8320
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        271⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        272⤵
        Modifies registry class
        
        PID:8488
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        273⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        274⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        275⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        276⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        277⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        278⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        279⤵
        Drops file in System32 directory
        
        PID:8992
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        280⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        281⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        282⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        283⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8300
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        284⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        285⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        286⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        287⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        288⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        289⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9084
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        291⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        292⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        293⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        294⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        295⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        296⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        297⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        298⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        299⤵
        Modifies registry class
        
        PID:8724
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        300⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        301⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        302⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        303⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        304⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        305⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        306⤵
        Drops file in System32 directory
        
        PID:8860
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        307⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        308⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        309⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        310⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        311⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        312⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        313⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        314⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        315⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        316⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        317⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        318⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        319⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        320⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9896
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        322⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        323⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        324⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        325⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        326⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10168
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        328⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        329⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        330⤵
        Drops file in System32 directory
        
        PID:9332
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        331⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9444
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        333⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        334⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        335⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        336⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        337⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9956
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        339⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        340⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        341⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        342⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        343⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        344⤵
        Modifies registry class
        
        PID:9416
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9620
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        346⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        347⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        348⤵
        Modifies registry class
        
        PID:9888
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        349⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        350⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        351⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        352⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        353⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        354⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        355⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        356⤵
        Drops file in System32 directory
        
        PID:9288
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9680
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10096
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        359⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        360⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        361⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        362⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        363⤵
        Drops file in System32 directory
        
        PID:8640
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        364⤵
        
        PID:10260
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        365⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        366⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10336
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        367⤵
        Modifies registry class
        
        PID:10384
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        368⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        369⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        370⤵
        Modifies registry class
        
        PID:10512
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        371⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10556
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        372⤵
        Drops file in System32 directory
        
        PID:10600
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        373⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        374⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        375⤵
        Drops file in System32 directory
        
        PID:10736
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        376⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        377⤵
        Drops file in System32 directory
        
        PID:10828
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        378⤵
        Drops file in System32 directory
        
        PID:10872
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        379⤵
        Modifies registry class
        
        PID:10912
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        380⤵
        Modifies registry class
        
        PID:10948
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        381⤵
        Modifies registry class
        
        PID:10988
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        382⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        383⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        384⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        385⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        386⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        387⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        388⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        389⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        390⤵
        Modifies registry class
        
        PID:10408
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        391⤵
        Drops file in System32 directory
        
        PID:10480
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        392⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        393⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        394⤵
        Modifies registry class
        
        PID:10668
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        395⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        396⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        397⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        398⤵
        Modifies registry class
        
        PID:10976
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        399⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        400⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        401⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11184
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        402⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        403⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10308
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        404⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        405⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        406⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        407⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        408⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        409⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        410⤵
        Drops file in System32 directory
        
        PID:11056
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        411⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        412⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        413⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10528
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        414⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        415⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        416⤵
        Drops file in System32 directory
        
        PID:11084
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        417⤵
        Drops file in System32 directory
        
        PID:10248
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        418⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        419⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        420⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        421⤵
        Modifies registry class
        
        PID:10404
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        422⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        423⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        424⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6196
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        425⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        426⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        427⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        428⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        429⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        430⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11304
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        431⤵
        
        PID:11344
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        432⤵
        
        PID:11384
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        433⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        434⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        435⤵
        
        PID:11504
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        436⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        437⤵
        
        PID:11584
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        438⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        439⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        440⤵
        
        PID:11712
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        441⤵
        Modifies registry class
        
        PID:11752
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        442⤵
        
        PID:11796
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        443⤵
        Drops file in System32 directory
        
        PID:11836
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        444⤵
        
        PID:11884
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        445⤵
        
        PID:11924
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        446⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        447⤵
        
        PID:12008
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        448⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        449⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        450⤵
        Modifies registry class
        
        PID:12144
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        451⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        452⤵
        
        PID:12224
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        453⤵
        
        PID:12264
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        454⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        455⤵
        Modifies registry class
        
        PID:11332
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        456⤵
        
        PID:11404
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        457⤵
        
        PID:11460
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        458⤵
        
        PID:11532
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        459⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        460⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        461⤵
        
        PID:11736
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        462⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        463⤵
        Modifies registry class
        
        PID:11868
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        464⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        465⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        466⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        467⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        468⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:12232
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        469⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12276
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        470⤵
        Drops file in System32 directory
        
        PID:11340
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        471⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        472⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        473⤵
        
        PID:11704
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        474⤵
        
        PID:11792
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        475⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        476⤵
        Modifies registry class
        
        PID:12068
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12112
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        478⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        479⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        480⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        481⤵
        
        PID:11720
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        482⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        483⤵
        
        PID:11976
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        484⤵
        Drops file in System32 directory
        
        PID:12180
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        485⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11300
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        486⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        487⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        488⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        489⤵
        
        PID:11768
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        490⤵
        Drops file in System32 directory
        
        PID:12212
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        491⤵
        
        PID:11540
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        492⤵
        Modifies registry class
        
        PID:11648
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        493⤵
        
        PID:12324
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        494⤵
        
        PID:12372
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        495⤵
        
        PID:12416
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        496⤵
        
        PID:12456
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        497⤵
        
        PID:12496
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        498⤵
        
        PID:12536
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        499⤵
        
        PID:12572
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        500⤵
        Drops file in System32 directory
        
        PID:12616
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        501⤵
        Drops file in System32 directory
        
        PID:12664
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        502⤵
        
        PID:12700
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        503⤵
        Drops file in System32 directory
        
        PID:12740
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        504⤵
        
        PID:12788
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        505⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12828
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        506⤵
        
        PID:12864
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        507⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12912
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        508⤵
        
        PID:12956
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        509⤵
        
        PID:12996
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        510⤵
        
        PID:13044
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        511⤵
        
        PID:13080
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        512⤵
        
        PID:13120
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        513⤵
        
        PID:13160
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        514⤵
        
        PID:13208
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        515⤵
        Modifies registry class
        
        PID:13248
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        516⤵
        
        PID:13288
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        517⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        518⤵
        
        PID:12336
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        519⤵
        Drops file in System32 directory
        
        PID:12384
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        520⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12448
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        521⤵
        
        PID:12504
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        522⤵
        
        PID:12560
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        523⤵
        
        PID:12612
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        524⤵
        
        PID:12684
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        525⤵
        
        PID:12728
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        526⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12784
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        527⤵
        
        PID:12852
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        528⤵
        
        PID:12904
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        529⤵
        
        PID:12968
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        530⤵
        
        PID:13036
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        531⤵
        
        PID:13076
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        532⤵
        
        PID:13168
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        533⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13200
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        534⤵
        
        PID:13236
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        535⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        536⤵
        
        PID:12380
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        537⤵
        
        PID:12452
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        538⤵
        
        PID:12548
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        539⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12656
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        540⤵
        
        PID:12760
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        541⤵
        Modifies registry class
        
        PID:12860
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        542⤵
        
        PID:12984
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        543⤵
        
        PID:13068
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        544⤵
        
        PID:13192
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        545⤵
        Drops file in System32 directory
        
        PID:13308
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        546⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12348
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        547⤵
        
        PID:12652
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        548⤵
        
        PID:12776
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        549⤵
        
        PID:12964
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        550⤵
        
        PID:13148
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        551⤵
        
        PID:12304
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        552⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12736
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        553⤵
        
        PID:13072
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        554⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11476
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        555⤵
        
        PID:13116
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        556⤵
        
        PID:13220
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        557⤵
        
        PID:13324
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        558⤵
        
        PID:13360
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        559⤵
        
        PID:13396
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        560⤵
        
        PID:13432
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        561⤵
        
        PID:13468
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        562⤵
        
        PID:13504
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        563⤵
        
        PID:13540
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        564⤵
        
        PID:13576
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        565⤵
        
        PID:13612
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        566⤵
        
        PID:13648
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        567⤵
        Drops file in System32 directory
        
        PID:13684
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        568⤵
        Drops file in System32 directory
        
        PID:13720
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        569⤵
        
        PID:13760
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        570⤵
        
        PID:13796
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        571⤵
        
        PID:13832
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        572⤵
        
        PID:13868
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        573⤵
        
        PID:13904
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        574⤵
        
        PID:13940
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        575⤵
        
        PID:13976
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        576⤵
        
        PID:14012
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        577⤵
        
        PID:14052
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        578⤵
        Modifies registry class
        
        PID:14096
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        579⤵
        
        PID:14132
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        580⤵
        Drops file in System32 directory
        
        PID:14168
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        581⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14204
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        582⤵
        
        PID:14240
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        583⤵
        
        PID:14272
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        584⤵
        
        PID:14312
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        585⤵
        
        PID:13332
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        586⤵
        
        PID:13380
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        587⤵
        Drops file in System32 directory
        
        PID:13456
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        588⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:13512
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        589⤵
        
        PID:13572
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        590⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:13656
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        591⤵
        
        PID:13708
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        592⤵
        
        PID:13780
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        593⤵
        Modifies registry class
        
        PID:13820
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        594⤵
        
        PID:13912
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        595⤵
        
        PID:13972
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        596⤵
        
        PID:14032
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        597⤵
        
        PID:14120
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        598⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:14212
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        599⤵
        
        PID:14248
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        600⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14308
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        601⤵
        
        PID:13392
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        602⤵
        
        PID:13492
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        603⤵
        Drops file in System32 directory
        
        PID:13640
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        604⤵
        Drops file in System32 directory
        
        PID:13768
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        605⤵
        
        PID:13876
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        606⤵
        
        PID:14040
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        607⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:14124
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        608⤵
        Modifies registry class
        
        PID:14228
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        609⤵
        
        PID:13384
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        610⤵
        Drops file in System32 directory
        
        PID:13496
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        611⤵
        
        PID:13748
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        612⤵
        
        PID:13960
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        613⤵
        
        PID:14196
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        614⤵
        
        PID:13756
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13756 -s 396
        615⤵
        Program crash
        
        PID:744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 13756 -ip 13756
1⤵
PID:14092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Andqdh32.exe

Filesize
197KB

MD5
409d1e7c730422de6e5c51c9c0fca4e8

SHA1
2e0e458bbbdb3c1a0c7b73c085bf08c56435745e

SHA256
04d6a153f430abbeb20b8b0a691fa218031ce10f0f53c7458e8c9cee284d5c83

SHA512
d0039aa0cbd67ac132ff4c98485cc7c833acf9881f376ee26cb753da34b13edcca12292ec8af2ce64568a1854720aaeb30120c69d7ac17cb4f3f64dce5b55150

Download Submit
C:\Windows\SysWOW64\Bagflcje.exe

Filesize
197KB

MD5
068f383796fd722986a125542104390d

SHA1
a00fb177088efb55bb1cd65b7a14def60f3c34ed

SHA256
cbebcff1e227630fa244483f081f48dc406064f6b9d96beb73b02ee22df168d0

SHA512
491aae4444b0b2a2b3fa8c3457101a20e68a45afb624a3c0b58294fbd6bf27726808b997468fb27c0861a69fb98396d4849ae445292eb1d3979a6988b2b886dd

Download Submit
C:\Windows\SysWOW64\Bdkcmdhp.exe

Filesize
197KB

MD5
7e1723cc9b2394edf5ccd8c12da87df6

SHA1
eaf9797e4c8f1ce27f922aaeccdc62fd5e4dc876

SHA256
75ae2b1850df09c5a4832ecacb5853493fff11f5a6578a6458774418029c1c6c

SHA512
36be683d55f40ffc875a8b5af408db62acc315f556a3977b7e25860d40b82adbc599f1fe99e87380a432ea569c3eb5abb1cbdea9fd5177f7946aae531538a196

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
192KB

MD5
16a3b84d4667fa48c25531297196e159

SHA1
4c666c8d6163f9a179cf3719037a5b82ec9cdc5e

SHA256
8caa9783e8b5d101c5a7bcfd5d2cce7943b1211fcc76e2121efbd4f0336a7add

SHA512
46c21f432d5f216cbb66bdd789f51c0eef38156af8fe533518add6196f3397e34a8b6e5b9ab14ab6737660147ea462f3587db6e08c054dc62aad9e80c7531422

Download Submit
C:\Windows\SysWOW64\Bmemac32.exe

Filesize
197KB

MD5
6819b7a3d57ae8a110b5877aa5912156

SHA1
3b2e014a095d77a41999ebe8d188fb1e8278cc74

SHA256
9804317326a0cc4339afa708b9ebcc75224df074b8c092ffa163942959c334ef

SHA512
541120042f1ae00705633a19a75d2c90c844683ededc5b3649cd97aaddfcdeae92a430d169a2a281fd12b64d845b09f0f0b8584f9b7661753190688728586327

Download Submit
C:\Windows\SysWOW64\Bnkgeg32.exe

Filesize
197KB

MD5
624b6ad341d5601c0911e030aebfb90e

SHA1
6cb16c53dfe57ddb702bf006ad7c968aae518533

SHA256
6713a63a8c7ad8677e288d3309dc9f835ac3b847a90cb23b8eee3a395b51093c

SHA512
6adc1abce5a957d2e9cd083eeb9c634d492924905a368ac0273c78293453c93cd836b5b329c258734bc96ad40c50421cfb4cbc2d968147d32877417c32eec54c

Download Submit
C:\Windows\SysWOW64\Cjinkg32.exe

Filesize
197KB

MD5
dccdbcc92be186dc2a851d9e2e4ea6f6

SHA1
7e4bf478fb4de76573556a2fcce1feb1e102511c

SHA256
aab5a24c948f88e0bb1f30860312942b1476eaa2d5764f86dc2adc12651d2344

SHA512
2608a28b44c5d5a1556fea8e0c4998fca17a6da948db8817f4db0f5d358ec982832b14b51c2a313022e01245846f23dc7dc468591c88227118b0cb93d65f8b6e

Download Submit
C:\Windows\SysWOW64\Cjpckf32.exe

Filesize
197KB

MD5
538f4223e549caa0268d78e78e89ae9b

SHA1
512376607d95a2b8741511359e37d5db025af563

SHA256
30c4cff0c21d59952c543903f0ab8041e11516aef83cd9607344b5d86c3622af

SHA512
9667e0e7c8cea7d83738d890cfa14c4db07767e05c6de21ddedb0d76ff3d93543f93ce865ee4ab059cb99297f8765d86512f6d1fa679f1165f8a5c0b8c574fc0

Download Submit
C:\Windows\SysWOW64\Cogmkl32.exe

Filesize
197KB

MD5
a37b0ec627203dff3ce008526f7d4dda

SHA1
75efacf5ac0b25822a6ff06105911e89fbe68199

SHA256
10f723b253c922771892b82b96577faf12301677ece8e8f0c7cf834994224ee2

SHA512
2e25126a30a15abf956891f0924a7ae443c5676f4b58d6775066917e7b5d52955ae2a2993e1bc48e007a7396de2faf5c539022e873b11205795d49fe1394a8f1

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
197KB

MD5
34945d6a46bf46a6a4467466e15a2bfc

SHA1
ea39e1b886b843c95e096b44a06c23e2be2cd048

SHA256
7fd42e78cf213bf066c0953c73f0fadc58544823cc8204f47601a7c736b38fb4

SHA512
a99500bef648dce9c94d57712f261273e5f954b252599e33e007c09673a968857b13e0e847fccd7010ae483e80b823ebbdd54e597d9b1839edf3f3c17c39d92c

Download Submit
C:\Windows\SysWOW64\Dagiil32.exe

Filesize
197KB

MD5
f3aa83dd4f06d3692e8f5f9e7c125754

SHA1
917e9b0b674562cd43c41ef68e665384d926b6cc

SHA256
091cd8513cb6395325eb4e3aa706c4da4e3d93b6a3a7d9a427e9205a928c1034

SHA512
320a0baa155ebaecf2b5bdba863592942c3fa492479e439c082b834ba89373b0a786f8c6189119b28fb3834d9b4cba90d2bf90f725435c420ddf796debe021bf

Download Submit
C:\Windows\SysWOW64\Daifnk32.exe

Filesize
197KB

MD5
4d0fcf6e497e8e78fc6100ffcdca6564

SHA1
6a4b41c20d007da2e3be0321f542fe51ca2d932f

SHA256
2350b1e9b790a927853268eef53853b5798a595e173044dcb8cde4c5c8c87d11

SHA512
8a80a8a432c4ad282ec3f472f7f41538fa0b93bc737c389e27dff9781882f1bd874d2fce57fe6a291e80199657db954a6feb45cf201d6bca0458564640fda8fc

Download Submit
C:\Windows\SysWOW64\Dcalgo32.exe

Filesize
197KB

MD5
9d97d3da608228552e7b3cd55265cdaa

SHA1
9330cdf8e359a0d3ec973ffaab2501b9dcac3ed6

SHA256
7ec862a3bc025a0468ac515a88e9a93b48a5747c257d94f1b14bef70f08fb0c3

SHA512
42a8e14ea8566ac1c80d4fca061cf55fec3bee0f327599882706818465712363b8653d56482008d5e3933a787f9990901af6c2fc1cd029e44c232bfcac3c0cb7

Download Submit
C:\Windows\SysWOW64\Dcfebonm.exe

Filesize
197KB

MD5
f95ccecb9bc0c9886c68bfc0418c2a44

SHA1
fe608ed8e4d88bdda96d56e63daf520554cfcc35

SHA256
026f4a0b8874d13a31d20940c99cca89d8aa35c64d685c8a60f7af0f8e663511

SHA512
9bd461f5d1c646755172f5a5fdb2725a3ac15d11a665bfb80dd5d52409e163cf819e1da3ab6c06deb11c6bbba19f176725c33b2ae02faf8642e4f84f80cd7e4d

Download Submit
C:\Windows\SysWOW64\Dchbhn32.exe

Filesize
197KB

MD5
9224f50c8167540f74e5feaa878cc1aa

SHA1
3bff6d0c91dcb022d1e6cc665c8e7d384ac39b52

SHA256
e3cefb6774006152596f4f71f01cc1f415a5e884a1c1371e556c209a1ca74296

SHA512
9102ee04ff8e32ad0cf9f84135c00e018375a9e859e59ea83a1c60775bf7e52660668884551b64adc69c9241be277ec1855948d562e3bc810bdbf0c5638b50df

Download Submit
C:\Windows\SysWOW64\Dcopbp32.exe

Filesize
197KB

MD5
82de669d3d3d748c05925a5b1f2fe3f1

SHA1
6f67b304ea58edb406d2e854b8b0b9a16cc38b0c

SHA256
5d7a21be18485a5e2c9e58b948f2afd9a56942f936fe466500dfb2e863d83c20

SHA512
d648882b06120a8c30f8ab7a1518ceb578e369a1352f166412d58669f0a0145aac192e5f4722a744ff7d4e538b5c30cb67fa027209ee4e7462e515bb8cf65727

Download Submit
C:\Windows\SysWOW64\Debeijoc.exe

Filesize
197KB

MD5
40b5c497dc4b83f7927a280efc2a14d9

SHA1
62c88132ce4138895aa1cf2f3ba22567d893a889

SHA256
7027e18b141e1667b5aa43da245d391e1011442135d1dd6f1051dfc2a2895060

SHA512
9ef78ce2bcb7af23be494dbf4669140345dcbde76f2deb27e4651449f1430bd18766ad21ac2c130920db2172fe4568ffc1cff8b378ffe29364c5d98805cfdff9

Download Submit
C:\Windows\SysWOW64\Dephckaf.exe

Filesize
197KB

MD5
e5046e25398b84a7ba520346d2c7451e

SHA1
e3d0bc4a2cc59f8608c5a058e0a4a262c00e001d

SHA256
ea053ee3b1f5da1e921ee68beb869ddc097f01438a6536ac8968465c89ce1bf1

SHA512
3d6becdf77007d6a609b164984e882f8ae442e22ef21a2ac17300ad1cc1d4b0b4e02e9556fc635501a6bddcf70a81530af5a188c7adf25c2b2b6360eb6d2cb2d

Download Submit
C:\Windows\SysWOW64\Dfdbojmq.exe

Filesize
197KB

MD5
8fa2e1a524eadc070256d91d54cf6e76

SHA1
1519334660c9798926eba4bfaf50b2135ec156e7

SHA256
482f193a769f92377b16957a6af0dfc5a3cfb1370113b272374de3ede184c8e6

SHA512
a3df5f4ed270a3c3b9a49da063a1f8a2217d8854e87988f8f5d2262e60956c22e5d75ef84c4ecfb9130927f11d848ecc405e428940ca57e898681da0661b7a89

Download Submit
C:\Windows\SysWOW64\Dhocqigp.exe

Filesize
197KB

MD5
b54490204a4038f2aba37cd0fba977d6

SHA1
dd8aa8bcc7fcf5acdbe2599c86443f002fe8258c

SHA256
b37e0a26c9eca25dda5756abef82e9b7678cdc0eefe8aec0dbbad39cef6848b9

SHA512
18caf040405de8bf6fb8919c9135a2e20b904933a808503b66007a54f1c7d28c3d94f2c93e0bb0a001189164f480d2c572dac4e5e2335f3d947e239916907c70

Download Submit
C:\Windows\SysWOW64\Dhqaefng.exe

Filesize
197KB

MD5
c5f095da9d6873b036d0c41eca895fd8

SHA1
fba5e49d0ca69e65e6d42a13f2c3a6a185247cc3

SHA256
1a022636c5bced1a27040d3a43dea2b7703dd9558255f2ca81180965330ccd3a

SHA512
cc3e27621d3f96fefaea197d9a9d1f63366e45e7cdaae0c131ed532b6cfed68d7fc4cdec9208fd58ee155fdef9365633cbc5193d082c3d0b0de513341443d9a2

Download Submit
C:\Windows\SysWOW64\Diihojkb.exe

Filesize
197KB

MD5
143b0a52ed68e3794a457bef4e645935

SHA1
8c7590b6827054d9233d41e4589d7d7f0589a720

SHA256
d1a08dda8ec70b12db5e7fdb23c64a386b2fd44e075877dd15abad04f2155d27

SHA512
67ed35b9e796eff782c5ac31f9213e6f083c96d13ed1c4b336422e7b1eb69bc2407d74e492d8874f818e7fca01feca05bd27ced0b70892066b0980b7fad77ad2

Download Submit
C:\Windows\SysWOW64\Djnaji32.exe

Filesize
197KB

MD5
bfdf3fe64330a18aad917625be68c2dc

SHA1
edc98fc1d6a74c33649ec0dac4ce5b9156b6f2c2

SHA256
ded96533c84f27ef0fc98f29347c3c0a4781a5f637da9bf07433e57d79fb0b10

SHA512
3af98a8167c09cdc7496c4669ffa9a265705cffdee2c14b1dc3f9a11f77b0567d757c0437b8ce4133b020ff3f4ec080fdaa18e6f9eec6051f86842a49e0bc7fc

Download Submit
C:\Windows\SysWOW64\Djpnohej.exe

Filesize
197KB

MD5
d5dcc80622d24b57f4448b561db44be1

SHA1
2de748a5d77aa19754f791e9f6341531c079ae9a

SHA256
9ee8dcb00d64a3127fdc4ddf7b182f2a6665af977d659ed83167e298b122d5ba

SHA512
b723955699fc25cf4b46e8bd2fbadab509813a1898711c3df4c5f4f276db4ce9cdfa2c55e5c30c786fea03799bcb1af56d6f72c314df3f3479e8b50ebab96a2b

Download Submit
C:\Windows\SysWOW64\Dlegeemh.exe

Filesize
197KB

MD5
8141121a02eb4857ab6ef4129fdf01b2

SHA1
f3c356b831a3801688484e91eece370ecee1e987

SHA256
46b1e2996bbc6f400ff7132b3c2b58b1b8f3de2d1ef8434b93a1d41c8b497fa4

SHA512
cecadabb1f4eebee05f7a2dbd93867733a3a9794a5eadb50f4751e739f23cabb3832522aabe8030e47bc5eb71f6a07edaa611929f3e30fa4a75d6b27772026fe

Download Submit
C:\Windows\SysWOW64\Dljqpd32.exe

Filesize
197KB

MD5
65239d5fad4dabb492120b32d388c52e

SHA1
e19a722f5e20ef9ac2fdb46915dd013f657ac1b6

SHA256
1fa4f804d0eb336ffe2d3821b7a18b2676e58221f675a9b3836a40b3d0ceab63

SHA512
4d2f4308c2ba0c3c1f69725a5bb46d0a0bdbb6e5efb433048d363459a3ecd747469115b22d366909f5f9350c17ed1dccfb66350d5e5ff58a9d39185dbf6b5219

Download Submit
C:\Windows\SysWOW64\Dllmfd32.exe

Filesize
197KB

MD5
dc276c5040b814fe3fb25674454ad87e

SHA1
13a77dad202e6381a3478c98eb6b8041e8b28adc

SHA256
412015b06957790151c8b99fbcde044dff1f50efa9a2554a45d33134fd916c15

SHA512
eb7869dcd0d5ca356b7f069afe671095664ad37749ee0135b48da9eb804045d5ec3182b882d647cbba25d634f1e9f84701cd83fb6745c21ae6d7bc1385dbf23f

Download Submit
C:\Windows\SysWOW64\Dlojkddn.exe

Filesize
197KB

MD5
254f2ac2ea749f90b139b0b23bde63d7

SHA1
0ff54e50ca4f8c463fb0f61a0bf6f0ec0c415ae5

SHA256
ba505db934ed04b39de392447cf04b16fdf5e8a25c031d0e81c90ce2448d837f

SHA512
14070e45b4b750b39c7be81cc3ed9cbb6895b3371b027f8cc55df2281d748b4071924a8d393893e7f8a637dc427b4a8d22726b7af86e4b6d8e8664201ce1c05f

Download Submit
C:\Windows\SysWOW64\Dohmlp32.exe

Filesize
197KB

MD5
84187bfa21e39401bd3433d134bdb20e

SHA1
83ccb1f13f276889d96a33b69168b4165d6b95a4

SHA256
eff21cc0cba70b2ff9af689b6cb97c436290633c1bb1a3dcfefb63d22a6713a4

SHA512
27e955b238e6080d9da964b17b776692560bee80f37f43a71fa9772234df28296d3fd74d2373520933a2fc9445e1fa20e6c0b184983511a52386ad3697f778ce

Download Submit
C:\Windows\SysWOW64\Dokjbp32.exe

Filesize
197KB

MD5
8c2e4680046c4b881b192159c99d3007

SHA1
4603fd88ea25093516ecac8119f742444772d06e

SHA256
9032090c6eb6bfe3b1c9cb72590ce60ddcfc0e04f30dbb95eaf5d76ff92bdf6b

SHA512
8e489606804e5d9237aa355967981b5cbc76470645b51bd7355b751b0c9395d2c31e771dabafae9570e2c653a60880618b8593730f19e72aad84513a36fbfbf9

Download Submit
C:\Windows\SysWOW64\Domfgpca.exe

Filesize
197KB

MD5
bc1ad019bc8128172d3afbfe1c0a193c

SHA1
bd791d32dc9439cfb53301c9ca883ee314cd187b

SHA256
a21fa9cf9e25911ad6b1276f98d2a56ac4e5745d403bc7356d6e7dfede546f75

SHA512
d8bf6d42e48cc79848a510608f5a6c285916fa152bf74cb14fd123b061ed49d117602f263e5406c7c5a5ba88ba3bf1dcf48c4ef0ae334197b9339d70854bfae9

Download Submit
C:\Windows\SysWOW64\Dpcpkc32.exe

Filesize
197KB

MD5
f28f1dc7551a8aef1c1dc43685d83565

SHA1
00bcd42966c7a2ff11adb96aad8f080fd10a9262

SHA256
0c6b3dd0b8da0ee9d1c9e717f69a68850cf5ca6e3071e6c376c8df618f7d08a4

SHA512
fe118a91ee9981f9ff9312b46c975e87acd3ff12704343f285f7d8950838437d7381cece2b2f5345d55898030bd435e0c878f3a2c1b0d01ce14a33e99c2d05d2

Download Submit
C:\Windows\SysWOW64\Dpemacql.exe

Filesize
197KB

MD5
7aefc309f577848b7b77b1a3b0bedd81

SHA1
77d60ae251b6573b0ff2d81e1cfbe40890ddc61e

SHA256
c77c9218ff30a530987866e6ca413215caee168f8b77ee3dfdc4115c03b3691e

SHA512
045e0f2aef87962e55af2f8ec584a209b84b4189e890cf7f5ecfbf66ae7c4dc51cc910bcb853e720437f365c25fb7f213015d03e972b904acb620aa30165ab91

Download Submit
C:\Windows\SysWOW64\Dpjflb32.exe

Filesize
197KB

MD5
c29d67a513a26281eaeaa69162bd8227

SHA1
89704a35b97dca376067678d51cdba2937caefd4

SHA256
7fabe738c2486caa2706135c78ce8717d6470cf952a4a3847f74990deb4a1740

SHA512
8e96991027cddd89015763941b546501f3e425974ebbd8d6f8649055ba981c4aa02c6f09306566e08b989429b27da550cced294bec805ce1351379d545f17f80

Download Submit
C:\Windows\SysWOW64\Ebploj32.exe

Filesize
197KB

MD5
1e83d2dbd7afc4414ab4169e99769b0c

SHA1
40979e05eecc1f688a4358b773bf515b483dfc22

SHA256
a63f127a11d9977fd82a386829dadc00c3417840ea7344207c8b8bf768316bc7

SHA512
21c8b71d78600f125d15846575006c201e466329441971d820fd8c9c35a21872007796fefb68183d4276bbfc830c4b1c0a073e4a2d5c271fa8de84a4d214d0e4

Download Submit
C:\Windows\SysWOW64\Ecphimfb.exe

Filesize
197KB

MD5
0b0deb9d4c2809332c9c99cd13c6eccd

SHA1
11160a310b25b6f6fe8bfd6f33cf6bd727600131

SHA256
1bdb41053ec14085b4cea0a31b38744e8fc3caf520cda3eb9b05a103a165a2f6

SHA512
00c2c0cf4f032bbfafa287d0e7a8856412c7c2726df786b8b8efd4f7c713c102663ef22ca3b8112d1392d2ef90367338236b0a6d417181607e718cbdd7aab7f3

Download Submit
C:\Windows\SysWOW64\Efneehef.exe

Filesize
197KB

MD5
813becd490039616357525dfdabb68e9

SHA1
fdf0fb480e987ed2e86f6aee5bc53b147f166da1

SHA256
4887d2dabe087eec1a278c5e797ef27698976fafc25294c9f9074964206243d5

SHA512
c8a75f47da264c32c44860d01211ec93c713d7574de7327e563114d7395545542aaa8b7165181bf7db5e5ff5af6075f4b94c7b2e4fe999b63a0dc3367a9fc366

Download Submit
C:\Windows\SysWOW64\Ejbkehcg.exe

Filesize
197KB

MD5
0ca37a30e02bb74877b0ee4965381676

SHA1
a0d87e3512e00551492abbc634c0683e86ed9503

SHA256
a992a65f8b8ae08dbf9485109b375b1adcfef2593968a086f768d4e4e8b5cfa8

SHA512
8a5872cbff379fc55488c7a801d1770c4851ec35a8bf4b242db63d7bcd51ab53cb8603b22c41f3246b8f5e6e1a24d1760dec84e96845044589df93ca38b5a851

Download Submit
C:\Windows\SysWOW64\Ejegjh32.exe

Filesize
197KB

MD5
a3ebb4b75066effa9e315e874bd71e6f

SHA1
e2949f26e4524b4e234e2a33016d2256b7e630d0

SHA256
c5c832e9fec044f94ee390186bc43be2b308fdca1fb16e0be873ff8c28651b10

SHA512
ede17f87ed8a3bf153bff0f6e8cf524383d080a5e3c65b902c6ef38a9a54dd88bc47f06927dcb6d02ce667963d95e6d692f0bb87313ea90051ee69853d2df4d5

Download Submit
C:\Windows\SysWOW64\Eleplc32.exe

Filesize
197KB

MD5
5be4f8c9c5d57970a3963eac080f124c

SHA1
b1c8413f063bde4dddc2843ec22a0c70cc67d570

SHA256
67fb1d6f9e2ad4650477c1c2792f4c85e72976d647793b9b6ff51106e10c40fb

SHA512
364414a63ef380138a96e71354159c5bba5f4e45efadee35b99f48661f552e082410cfd17775cc092d70d539bc6c6e6f0a1c2b2bc3f9852aed9bb6d6c911a02a

Download Submit
C:\Windows\SysWOW64\Eodlho32.exe

Filesize
197KB

MD5
75fab255e0a41a0a542058216cf65548

SHA1
573dd0a94e85b3ce88c779732c3796ddcf59c330

SHA256
6717b11547ed9e0ad18c42511b57985c84f748fea2cc605631adf66c8485bc13

SHA512
e6c06153d72565532730e8a4883c5b5d235953cc54f33bcceb32484aa5684478c2abf1edf13ddbe8c809012d0eff2e1d1469facf3a8553547fa2668e603962b1

Download Submit
C:\Windows\SysWOW64\Epmcab32.exe

Filesize
197KB

MD5
fd3a6d9ced370b4b42b9de3d3f07b95b

SHA1
45134651ab607784bbe59410a58379d4097166e9

SHA256
71e55eb92e997348b6c20b906242135a8b0d17db498ab866b3217ec62b185834

SHA512
b291d28091536e7b1813f9bee770712a7da22aeb686233a4ffa2d7358a4931eb1f7ad255a720503496526e7f3204184ab073a04f28534596b2c45d117572307b

Download Submit
C:\Windows\SysWOW64\Epopgbia.exe

Filesize
197KB

MD5
3561e49c30ff44bfce10f40bf6fd63b0

SHA1
3c4a23f24d7920e9fa77cfe25b5c405b6ac26f43

SHA256
30b8c835a98711c6efc6d8d573fbfebe5e972abc253f66539f6e57c6845269cd

SHA512
8fd90b9bcd60f867889536c2452e476f995bd78c4d627cbb466f78ca26f282197f8f5a4b38aea7ef07b46874e034a8c3c200686b223ad9114358f4368dd87af4

Download Submit
C:\Windows\SysWOW64\Fcmnpe32.exe

Filesize
197KB

MD5
25a27c3090c048326edea659a70209d6

SHA1
d21a40c27a9ec176475c6a58717a9018650a8507

SHA256
ffcff3267a8885b3041a0638f49f496672cb81a2d88bb4176d0bcfef09af55cb

SHA512
bea50dfc2b0d94e764aa4986d92a8f99a61cd713711f26becd30e1fb8c671a729bb065973eba8f967c21579322b07d191ca7aeed2d1a8a47f0418759b913abfa

Download Submit
C:\Windows\SysWOW64\Gfedle32.exe

Filesize
197KB

MD5
e31e444187f69c8d6a7ee1274c58d158

SHA1
a8249a60d521c63b331843a679faa9f33f3176fb

SHA256
81414bfd6174fb16d1db3c92de5b6046f87adde3490104a032a8b218ecdd6f23

SHA512
fc8390fffeb80ad7a68613035b7d4d9491d5cff2cbe1fb2d3610976391201bb346bfa61783b99a6ca8635156ec24e3f4faf54df6ed0d6cadc9ec4bd0da49d5c4

Download Submit
C:\Windows\SysWOW64\Hihicplj.exe

Filesize
197KB

MD5
2fbf099e1d5f648d3142fcee1b7b6a5f

SHA1
7e5f233cc2a71b4eab7d43dddc26a4c87a5c05eb

SHA256
bb16a61be489f0acce09dfefd634a84da26c5adf47b393befa6208738dc99884

SHA512
469330f56ad11a1edaa06bb3a80927524e3ce95fded397e5f10588baacdd76c544ec897ef9f07d7f71dd4d6d31822b80e2f6a0b59c585d521e8b0f8cbe2898a7

Download Submit
C:\Windows\SysWOW64\Ijhodq32.exe

Filesize
197KB

MD5
7e9a0d3ad24b08c646bfca51da6bddfa

SHA1
5e02e494d6efce20b892736f28246eacd6d50ebc

SHA256
42c9f90ae15fa9c67ed128d8e7fb327bca96307424d07634d32eb7a6e0c04603

SHA512
d99da5d662530fa12b7504168e9abc7ad4c875bb4b166a03e41ff2d4ac5fc94409f666c95b9cd5526517ce6160180b94f2f6deb1a4cb3d96764c38707fb442a4

Download Submit
C:\Windows\SysWOW64\Ikpaldog.exe

Filesize
197KB

MD5
54edaaa4a8de68c3e2aebd4f4d23b34c

SHA1
4fc63e8778c48dae883981bcf74bfe781ba28d79

SHA256
69e3a9292a6f65840a76ed0e27e3c28c6d720811c9762fa4e9620c34b1c7ecbd

SHA512
acffffbc05400f61cc832d8485fc18359161bb5ae0d658f4977459ae0d4b913c87922ccb7bb7cf3b79d5a8bb9fb746395d34fcfb25148785fad1aee27da43ff5

Download Submit
C:\Windows\SysWOW64\Imoneg32.exe

Filesize
197KB

MD5
634954468eb6f59de05c6a95da11455d

SHA1
cb9efafb3fb1e0e57fd8d0f7746f3a4517255f7d

SHA256
ea574d5a6cea938fbc42862a904359e01accac91b91f805ff54cccf7cdfab712

SHA512
2104f2000415857f489e7ff9d59355786866aeeb166eaf36ac1575ff0130c2bd50880083b63c55910b072323bb861aaef661aa2c11bfe5969e5f2c7458c819e3

Download Submit
C:\Windows\SysWOW64\Jbjcolha.exe

Filesize
197KB

MD5
6c1e23e1748fdba310230aaef7ebe265

SHA1
2b532ea88e52d88fd404a6d91545135f47ce2690

SHA256
381b5f17584df8b98976a229baef59d275b1fb7a3209a30bd448e3ec2a9daceb

SHA512
242b6cc0e076aed4f8b24b9903832d19ce035edb9bc0633a81c87a27065a71cdf58444c1c0777e3df903d2041bd29de264a2c560909c8ef0b3ade7a6ae9ced5c

Download Submit
C:\Windows\SysWOW64\Kdaldd32.exe

Filesize
197KB

MD5
23ee5072a8874f057021a09eb2f74a80

SHA1
ff3bcb9fbb83d0098cfb7b85caac51c0de0e33df

SHA256
378def9153bfddc08ea603959fe0fc7743703e9475b2f0ea93d76cfeffb9710b

SHA512
4e72b1fec79083166be29d627a75754a48e54aff9921ac5c52991ce4419f91145f34b110e4df145f3dc4d57740c41f2c5ec424c4bbc8247fe3d2907683555d21

Download Submit
C:\Windows\SysWOW64\Ngbpidjh.exe

Filesize
197KB

MD5
d22247873fc68024d31586433f85187a

SHA1
bb94a0576bb84645eae5118ce89dd0872a50ae75

SHA256
b4c9692b9ab46828d3df8e469f44bd0cb5b51b3918826352bac49df5b4bac905

SHA512
cc51d6763062dd5fb7515f884c375d1e6a0c260cffe52cdea96a95666bad07b400f05ccf5613568dead94e722fd26740fff67ac3eeb9385464545de51fe85456

Download Submit
C:\Windows\SysWOW64\Oqdoboli.exe

Filesize
197KB

MD5
2bcee6e3c4abdca0961c08679b43e319

SHA1
435022f250bfa3dd45567e6f09f58717e7f882c2

SHA256
b5ce60c1ba9867c123fc9b524d535489f281f30763efac5d108de89ea1cf87a9

SHA512
4e8bc5116f34d1b0f74b272d89a276fdf1e6d7eea9d9a6ab348afdec8a8dcf483cec2178f9ce21b7b4c07a1ef40b6007eabcdf3a5bc6a758adc6f47a68ae5e44

Download Submit
C:\Windows\SysWOW64\Pnfkma32.exe

Filesize
197KB

MD5
d44d0009a1a8d9d6e371ad5ca889fcd8

SHA1
9648c6eba246c06b913c17d05a034ee2ddf3db72

SHA256
abfcd34c89349d3eeb23ec63ab7d5cc7a0f0ef1493f3db195e916ea6991f4c67

SHA512
852a0cf8faada221f56240342c22f3b7e76d874e30ede61192c587dda36f2e9c3a885694c1b42ef79274c0a2716bf2f70079cbcee05151d154d23e28d22ee756

Download Submit
C:\Windows\SysWOW64\Qddfkd32.exe

Filesize
197KB

MD5
696f8f0599420a302d2298c1e0c45685

SHA1
d6ecfba7b96684387e43338ae053650a0793724a

SHA256
c0577f2926264166baa45737f260429c3fe3296cf6f822586b74f5776bb5940c

SHA512
bb04c09e84d29938005c461d520ef63b7c82670cb219763af16484169f0635b968f55f5451d307e40c0697e31effc2bde110cf5a20d4ac6ca8db7ac399c16fc3

Download Submit
memory/212-183-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/216-316-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/840-315-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/936-309-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/956-13-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1216-405-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1216-49-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1236-212-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1360-192-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1432-398-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1508-372-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1648-221-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1656-322-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1672-289-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1700-281-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1900-210-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1908-335-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1932-340-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1968-24-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1968-389-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2004-406-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2476-264-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2480-236-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2620-378-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2620-19-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2648-369-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2744-391-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2780-195-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2876-371-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2964-328-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2992-399-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2992-41-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3032-392-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3032-32-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3228-357-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3232-300-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3272-363-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3316-295-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3452-349-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3636-364-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3708-288-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3852-302-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3904-287-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3920-217-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4028-167-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4184-411-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4332-308-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4348-175-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4472-270-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4480-355-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4516-266-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4520-356-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4564-342-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4568-383-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4604-186-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4728-347-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4800-274-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4896-259-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4932-203-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4936-334-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4936-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4936-1-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4944-280-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5076-273-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads