279283d1536859eaa5935f492d192d361e12c370d81999a4407c394aeb32ab16

Analysis

max time kernel
94s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 18:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

279283d1536859eaa5935f492d192d361e12c370d81999a4407c394aeb32ab16.exe
Size

109KB
MD5

8ba41631270bdf8b3510b99c920e7d74
SHA1

dee84a20f5008808f09d1efe4b93c26aa4bbeb22
SHA256

279283d1536859eaa5935f492d192d361e12c370d81999a4407c394aeb32ab16
SHA512

3c25dcafc731774058d3386506c9860426100eeee08e7c750c7ba61fb8354ac676517133999ebb472b9fc49bfbe9c0b5999adadfd35b4402ad295643d4a29912
SSDEEP

3072:k7ibI1BtwDKKmrvz6bUTnJ9WLCqwzBu1DjHLMVDqqkSpR:EiDrmSbKnJ9ywtu1DjrFqhz

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mamleegg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eoolbinc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Immapg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnnlaehj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pbmncp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmjdjgjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mnebeogl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fobiilai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgjfkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hopnqdan.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcppfaka.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cajlhqjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Capchmmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fdlnbm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afoeiklb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ejgdpg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Himcoo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmfmmcbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dlegeemh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Abkjdnoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hcpclbfa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlbgha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Doilmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gameonno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbllbibl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bobcpmfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eefhjc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfnphn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jeklag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgokmgjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bffkij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gbiaapdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iifokh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndcdmikd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocpgod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hfqlnm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lpcfkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mcpebmkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqbdjfln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fjhmgeao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nljofl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ondeac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pcjapi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Conclk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hecmijim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jaljgidl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kdhbec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmqgnhmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dllfkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Imakkfdg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llemdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gfhqbe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Maohkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fdnjgmle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdfjifjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gbgkfg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkiqbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfifmnij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mncmjfmk.exe

Executes dropped EXE 64 IoCs

pid	Process
2192	Ceibclgn.exe
2500	Chgoogfa.exe
2368	Cpofpdgd.exe
4900	Coagla32.exe
4904	Capchmmb.exe
4532	Cekohk32.exe
1368	Digkijmd.exe
208	Dlegeemh.exe
2296	Dpacfd32.exe
1520	Doccaall.exe
4856	Dabpnlkp.exe
4344	Denlnk32.exe
452	Dpcpkc32.exe
2448	Dcalgo32.exe
1200	Dadlclim.exe
4488	Dephckaf.exe
2964	Dhnepfpj.exe
1460	Dpemacql.exe
3812	Djnaji32.exe
4356	Dllmfd32.exe
376	Dphifcoi.exe
1600	Dcfebonm.exe
1872	Daifnk32.exe
812	Dhcnke32.exe
1068	Dpjflb32.exe
404	Efgodj32.exe
2764	Ehekqe32.exe
3576	Epmcab32.exe
4992	Ebnoikqb.exe
1972	Efikji32.exe
3984	Ecmlcmhe.exe
684	Ejgdpg32.exe
2420	Eleplc32.exe
2060	Eodlho32.exe
1588	Ejjqeg32.exe
4576	Eqciba32.exe
996	Ecbenm32.exe
740	Ejlmkgkl.exe
5008	Fjnjqfij.exe
1452	Fokbim32.exe
1104	Fbioei32.exe
4260	Fomonm32.exe
552	Fbllkh32.exe
4440	Fifdgblo.exe
1628	Fmapha32.exe
3868	Fbnhphbp.exe
5020	Fobiilai.exe
5028	Fcnejk32.exe
216	Fbqefhpm.exe
3744	Fjhmgeao.exe
1988	Fqaeco32.exe
3268	Gfnnlffc.exe
2332	Gmhfhp32.exe
4068	Gcbnejem.exe
3832	Gbenqg32.exe
3276	Gjlfbd32.exe
3316	Gmkbnp32.exe
372	Gbgkfg32.exe
4040	Gmmocpjk.exe
4292	Gpklpkio.exe
4216	Gjapmdid.exe
4516	Gqkhjn32.exe
696	Gfhqbe32.exe
3580	Gmaioo32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Eepjpb32.exe	Eadopc32.exe
File created	C:\Windows\SysWOW64\Blleba32.dll	Medgncoe.exe
File created	C:\Windows\SysWOW64\Cjmgfgdf.exe	Chokikeb.exe
File created	C:\Windows\SysWOW64\Dllmfd32.exe	Djnaji32.exe
File created	C:\Windows\SysWOW64\Jioaqfcc.exe	Jedeph32.exe
File created	C:\Windows\SysWOW64\Kimnbd32.exe	Kfoafi32.exe
File created	C:\Windows\SysWOW64\Ajhddjfn.exe	Afmhck32.exe
File opened for modification	C:\Windows\SysWOW64\Ebnoikqb.exe	Epmcab32.exe
File opened for modification	C:\Windows\SysWOW64\Maohkd32.exe	Mncmjfmk.exe
File created	C:\Windows\SysWOW64\Ndbnboqb.exe	Nacbfdao.exe
File created	C:\Windows\SysWOW64\Hmphmhjc.dll	Pfaigm32.exe
File opened for modification	C:\Windows\SysWOW64\Qdbiedpa.exe	Qnhahj32.exe
File created	C:\Windows\SysWOW64\Hihjpn32.dll	Fmapha32.exe
File created	C:\Windows\SysWOW64\Hpgkkioa.exe	Hadkpm32.exe
File created	C:\Windows\SysWOW64\Hiaohfpc.dll	Ibagcc32.exe
File created	C:\Windows\SysWOW64\Ieakglmn.dll	Hmjdjgjo.exe
File created	C:\Windows\SysWOW64\Jcllonma.exe	Jpppnp32.exe
File created	C:\Windows\SysWOW64\Ojgbfocc.exe	Ocnjidkf.exe
File created	C:\Windows\SysWOW64\Iabgaklg.exe	Iikopmkd.exe
File created	C:\Windows\SysWOW64\Jgengpmj.dll	Mjeddggd.exe
File opened for modification	C:\Windows\SysWOW64\Klngdpdd.exe	Kfankifm.exe
File created	C:\Windows\SysWOW64\Jdkhlo32.dll	Gmaioo32.exe
File created	C:\Windows\SysWOW64\Gbledndp.dll	Iinlemia.exe
File created	C:\Windows\SysWOW64\Ojmmkpmf.dll	Kpepcedo.exe
File created	C:\Windows\SysWOW64\Dcjfkm32.dll	Eocenh32.exe
File created	C:\Windows\SysWOW64\Fljcmlfd.exe	Edbklofb.exe
File opened for modification	C:\Windows\SysWOW64\Gmlhii32.exe	Ghaliknf.exe
File created	C:\Windows\SysWOW64\Gpamgn32.dll	Okhfjh32.exe
File created	C:\Windows\SysWOW64\Klqcioba.exe	Kmncnb32.exe
File created	C:\Windows\SysWOW64\Njefqo32.exe	Nfjjppmm.exe
File created	C:\Windows\SysWOW64\Popodg32.dll	Pdifoehl.exe
File created	C:\Windows\SysWOW64\Fbqefhpm.exe	Fcnejk32.exe
File opened for modification	C:\Windows\SysWOW64\Jiikak32.exe	Jbocea32.exe
File created	C:\Windows\SysWOW64\Ipkobd32.dll	Njacpf32.exe
File created	C:\Windows\SysWOW64\Libddmim.dll	Bnnjen32.exe
File created	C:\Windows\SysWOW64\Onhhamgg.exe	Ofqpqo32.exe
File created	C:\Windows\SysWOW64\Chjaol32.exe	Bcoenmao.exe
File created	C:\Windows\SysWOW64\Doccaall.exe	Dpacfd32.exe
File opened for modification	C:\Windows\SysWOW64\Dpcpkc32.exe	Denlnk32.exe
File created	C:\Windows\SysWOW64\Ebjmif32.dll	Dhnepfpj.exe
File opened for modification	C:\Windows\SysWOW64\Gameonno.exe	Gmaioo32.exe
File created	C:\Windows\SysWOW64\Enfioebm.dll	Pjmlbbdg.exe
File created	C:\Windows\SysWOW64\Agkbbg32.dll	Dbllbibl.exe
File created	C:\Windows\SysWOW64\Cbcilkjg.exe	Cliaoq32.exe
File opened for modification	C:\Windows\SysWOW64\Amgapeea.exe	Ajhddjfn.exe
File created	C:\Windows\SysWOW64\Bbjiol32.dll	Mmnldp32.exe
File created	C:\Windows\SysWOW64\Lmccchkn.exe	Lkdggmlj.exe
File created	C:\Windows\SysWOW64\Jheiojpj.dll	Nggqoj32.exe
File created	C:\Windows\SysWOW64\Iclnemml.dll	Acjjfggb.exe
File created	C:\Windows\SysWOW64\Hfqlnm32.exe	Hcbpab32.exe
File created	C:\Windows\SysWOW64\Hjjdjk32.dll	Balpgb32.exe
File created	C:\Windows\SysWOW64\Miifeq32.exe	Menjdbgj.exe
File created	C:\Windows\SysWOW64\Nbgngp32.dll	Danecp32.exe
File created	C:\Windows\SysWOW64\Eoodnhmi.dll	Efikji32.exe
File opened for modification	C:\Windows\SysWOW64\Kmgdgjek.exe	Kbapjafe.exe
File created	C:\Windows\SysWOW64\Ienanm32.dll	Cacmah32.exe
File created	C:\Windows\SysWOW64\Cddecc32.exe	Cafigg32.exe
File created	C:\Windows\SysWOW64\Kiidgeki.exe	Kemhff32.exe
File created	C:\Windows\SysWOW64\Eonefj32.dll	Mibpda32.exe
File created	C:\Windows\SysWOW64\Dapgdeib.dll	Ndaggimg.exe
File created	C:\Windows\SysWOW64\Kpepcedo.exe	Kmgdgjek.exe
File created	C:\Windows\SysWOW64\Ilkojc32.dll	Peimil32.exe
File created	C:\Windows\SysWOW64\Eepjpb32.exe	Eadopc32.exe
File opened for modification	C:\Windows\SysWOW64\Pqbdjfln.exe	Pmfhig32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
13832	13748	WerFault.exe	691

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ednaqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dngdgf32.dll"	Lgkhlnbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pnlaml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecnpbjmi.dll"	Hcdmga32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mmbfpp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ahhblemi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Chjaol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bldgdago.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kiidgeki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmnbeadp.dll"	Bapiabak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cpofpdgd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dcalgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmafhe32.dll"	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eofbch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ehgqln32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kmfmmcbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ndaggimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbgaem32.dll"	Hadkpm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aealah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldfgeigq.dll"	Bfabnjjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmlgol32.dll"	Jmbklj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kefkme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llmglb32.dll"	Ojjolnaq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dacdmi32.dll"	Dphifcoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilaidmmo.dll"	Gcbnejem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dlijfneg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hddeok32.dll"	Ndfqbhia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhnepfpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flgmek32.dll"	Baaplhef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Conclk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ocpgod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qoqbfpfe.dll"	Afhohlbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aeniabfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eefhjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dkkcge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfghpl32.dll"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Peljol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qcepkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abckpb32.dll"	Jimekgff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Capchmmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hfjmgdlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hipnbb32.dll"	Nqpego32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dlijfneg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcgdbi32.dll"	Gofkje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eonefj32.dll"	Mibpda32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oqgkhnjf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Agffge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Megkhf32.dll"	Bjbndobo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jcgbco32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ndcdmikd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jflepa32.dll"	Jbocea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpaeonmc.dll"	Boepel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpnnia32.dll"	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egdmkp32.dll"	Cknnpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iemppiab.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mdjagjco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pfaigm32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 2192	5012	279283d1536859eaa5935f492d192d361e12c370d81999a4407c394aeb32ab16.exe	85
PID 5012 wrote to memory of 2192	5012	279283d1536859eaa5935f492d192d361e12c370d81999a4407c394aeb32ab16.exe	85
PID 5012 wrote to memory of 2192	5012	279283d1536859eaa5935f492d192d361e12c370d81999a4407c394aeb32ab16.exe	85
PID 2192 wrote to memory of 2500	2192	Ceibclgn.exe	86
PID 2192 wrote to memory of 2500	2192	Ceibclgn.exe	86
PID 2192 wrote to memory of 2500	2192	Ceibclgn.exe	86
PID 2500 wrote to memory of 2368	2500	Chgoogfa.exe	87
PID 2500 wrote to memory of 2368	2500	Chgoogfa.exe	87
PID 2500 wrote to memory of 2368	2500	Chgoogfa.exe	87
PID 2368 wrote to memory of 4900	2368	Cpofpdgd.exe	88
PID 2368 wrote to memory of 4900	2368	Cpofpdgd.exe	88
PID 2368 wrote to memory of 4900	2368	Cpofpdgd.exe	88
PID 4900 wrote to memory of 4904	4900	Coagla32.exe	89
PID 4900 wrote to memory of 4904	4900	Coagla32.exe	89
PID 4900 wrote to memory of 4904	4900	Coagla32.exe	89
PID 4904 wrote to memory of 4532	4904	Capchmmb.exe	90
PID 4904 wrote to memory of 4532	4904	Capchmmb.exe	90
PID 4904 wrote to memory of 4532	4904	Capchmmb.exe	90
PID 4532 wrote to memory of 1368	4532	Cekohk32.exe	91
PID 4532 wrote to memory of 1368	4532	Cekohk32.exe	91
PID 4532 wrote to memory of 1368	4532	Cekohk32.exe	91
PID 1368 wrote to memory of 208	1368	Digkijmd.exe	92
PID 1368 wrote to memory of 208	1368	Digkijmd.exe	92
PID 1368 wrote to memory of 208	1368	Digkijmd.exe	92
PID 208 wrote to memory of 2296	208	Dlegeemh.exe	93
PID 208 wrote to memory of 2296	208	Dlegeemh.exe	93
PID 208 wrote to memory of 2296	208	Dlegeemh.exe	93
PID 2296 wrote to memory of 1520	2296	Dpacfd32.exe	94
PID 2296 wrote to memory of 1520	2296	Dpacfd32.exe	94
PID 2296 wrote to memory of 1520	2296	Dpacfd32.exe	94
PID 1520 wrote to memory of 4856	1520	Doccaall.exe	95
PID 1520 wrote to memory of 4856	1520	Doccaall.exe	95
PID 1520 wrote to memory of 4856	1520	Doccaall.exe	95
PID 4856 wrote to memory of 4344	4856	Dabpnlkp.exe	96
PID 4856 wrote to memory of 4344	4856	Dabpnlkp.exe	96
PID 4856 wrote to memory of 4344	4856	Dabpnlkp.exe	96
PID 4344 wrote to memory of 452	4344	Denlnk32.exe	97
PID 4344 wrote to memory of 452	4344	Denlnk32.exe	97
PID 4344 wrote to memory of 452	4344	Denlnk32.exe	97
PID 452 wrote to memory of 2448	452	Dpcpkc32.exe	98
PID 452 wrote to memory of 2448	452	Dpcpkc32.exe	98
PID 452 wrote to memory of 2448	452	Dpcpkc32.exe	98
PID 2448 wrote to memory of 1200	2448	Dcalgo32.exe	99
PID 2448 wrote to memory of 1200	2448	Dcalgo32.exe	99
PID 2448 wrote to memory of 1200	2448	Dcalgo32.exe	99
PID 1200 wrote to memory of 4488	1200	Dadlclim.exe	100
PID 1200 wrote to memory of 4488	1200	Dadlclim.exe	100
PID 1200 wrote to memory of 4488	1200	Dadlclim.exe	100
PID 4488 wrote to memory of 2964	4488	Dephckaf.exe	101
PID 4488 wrote to memory of 2964	4488	Dephckaf.exe	101
PID 4488 wrote to memory of 2964	4488	Dephckaf.exe	101
PID 2964 wrote to memory of 1460	2964	Dhnepfpj.exe	102
PID 2964 wrote to memory of 1460	2964	Dhnepfpj.exe	102
PID 2964 wrote to memory of 1460	2964	Dhnepfpj.exe	102
PID 1460 wrote to memory of 3812	1460	Dpemacql.exe	104
PID 1460 wrote to memory of 3812	1460	Dpemacql.exe	104
PID 1460 wrote to memory of 3812	1460	Dpemacql.exe	104
PID 3812 wrote to memory of 4356	3812	Djnaji32.exe	105
PID 3812 wrote to memory of 4356	3812	Djnaji32.exe	105
PID 3812 wrote to memory of 4356	3812	Djnaji32.exe	105
PID 4356 wrote to memory of 376	4356	Dllmfd32.exe	106
PID 4356 wrote to memory of 376	4356	Dllmfd32.exe	106
PID 4356 wrote to memory of 376	4356	Dllmfd32.exe	106
PID 376 wrote to memory of 1600	376	Dphifcoi.exe	107

C:\Users\Admin\AppData\Local\Temp\279283d1536859eaa5935f492d192d361e12c370d81999a4407c394aeb32ab16.exe
"C:\Users\Admin\AppData\Local\Temp\279283d1536859eaa5935f492d192d361e12c370d81999a4407c394aeb32ab16.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Windows\SysWOW64\Ceibclgn.exe
  C:\Windows\system32\Ceibclgn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\SysWOW64\Chgoogfa.exe
    C:\Windows\system32\Chgoogfa.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Windows\SysWOW64\Cpofpdgd.exe
      C:\Windows\system32\Cpofpdgd.exe
      4⤵
      Executes dropped EXE
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2368
    - - C:\Windows\SysWOW64\Coagla32.exe
        
        C:\Windows\system32\Coagla32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4900
      - C:\Windows\SysWOW64\Capchmmb.exe
        
        C:\Windows\system32\Capchmmb.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\SysWOW64\Cekohk32.exe
        
        C:\Windows\system32\Cekohk32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4532
        
        C:\Windows\SysWOW64\Digkijmd.exe
        
        C:\Windows\system32\Digkijmd.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1368
        
        C:\Windows\SysWOW64\Dlegeemh.exe
        
        C:\Windows\system32\Dlegeemh.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:208
        
        C:\Windows\SysWOW64\Dpacfd32.exe
        
        C:\Windows\system32\Dpacfd32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2296
        
        C:\Windows\SysWOW64\Doccaall.exe
        
        C:\Windows\system32\Doccaall.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1520
        
        C:\Windows\SysWOW64\Dabpnlkp.exe
        
        C:\Windows\system32\Dabpnlkp.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Windows\SysWOW64\Denlnk32.exe
        
        C:\Windows\system32\Denlnk32.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4344
        
        C:\Windows\SysWOW64\Dpcpkc32.exe
        
        C:\Windows\system32\Dpcpkc32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:452
        
        C:\Windows\SysWOW64\Dcalgo32.exe
        
        C:\Windows\system32\Dcalgo32.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2448
        
        C:\Windows\SysWOW64\Dadlclim.exe
        
        C:\Windows\system32\Dadlclim.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1200
        
        C:\Windows\SysWOW64\Dephckaf.exe
        
        C:\Windows\system32\Dephckaf.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\SysWOW64\Dhnepfpj.exe
        
        C:\Windows\system32\Dhnepfpj.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Windows\SysWOW64\Dpemacql.exe
        
        C:\Windows\system32\Dpemacql.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1460
        
        C:\Windows\SysWOW64\Djnaji32.exe
        
        C:\Windows\system32\Djnaji32.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3812
        
        C:\Windows\SysWOW64\Dllmfd32.exe
        
        C:\Windows\system32\Dllmfd32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4356
        
        C:\Windows\SysWOW64\Dphifcoi.exe
        
        C:\Windows\system32\Dphifcoi.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:376
        
        C:\Windows\SysWOW64\Dcfebonm.exe
        
        C:\Windows\system32\Dcfebonm.exe
        23⤵
        Executes dropped EXE
        
        PID:1600
        
        C:\Windows\SysWOW64\Daifnk32.exe
        
        C:\Windows\system32\Daifnk32.exe
        24⤵
        Executes dropped EXE
        
        PID:1872
        
        C:\Windows\SysWOW64\Dhcnke32.exe
        
        C:\Windows\system32\Dhcnke32.exe
        25⤵
        Executes dropped EXE
        
        PID:812
        
        C:\Windows\SysWOW64\Dpjflb32.exe
        
        C:\Windows\system32\Dpjflb32.exe
        26⤵
        Executes dropped EXE
        
        PID:1068
        
        C:\Windows\SysWOW64\Efgodj32.exe
        
        C:\Windows\system32\Efgodj32.exe
        27⤵
        Executes dropped EXE
        
        PID:404
        
        C:\Windows\SysWOW64\Ehekqe32.exe
        
        C:\Windows\system32\Ehekqe32.exe
        28⤵
        Executes dropped EXE
        
        PID:2764
        
        C:\Windows\SysWOW64\Epmcab32.exe
        
        C:\Windows\system32\Epmcab32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3576
        
        C:\Windows\SysWOW64\Ebnoikqb.exe
        
        C:\Windows\system32\Ebnoikqb.exe
        30⤵
        Executes dropped EXE
        
        PID:4992
        
        C:\Windows\SysWOW64\Efikji32.exe
        
        C:\Windows\system32\Efikji32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1972
        
        C:\Windows\SysWOW64\Ecmlcmhe.exe
        
        C:\Windows\system32\Ecmlcmhe.exe
        32⤵
        Executes dropped EXE
        
        PID:3984
        
        C:\Windows\SysWOW64\Ejgdpg32.exe
        
        C:\Windows\system32\Ejgdpg32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:684
        
        C:\Windows\SysWOW64\Eleplc32.exe
        
        C:\Windows\system32\Eleplc32.exe
        34⤵
        Executes dropped EXE
        
        PID:2420
        
        C:\Windows\SysWOW64\Eodlho32.exe
        
        C:\Windows\system32\Eodlho32.exe
        35⤵
        Executes dropped EXE
        
        PID:2060
        
        C:\Windows\SysWOW64\Ejjqeg32.exe
        
        C:\Windows\system32\Ejjqeg32.exe
        36⤵
        Executes dropped EXE
        
        PID:1588
        
        C:\Windows\SysWOW64\Eqciba32.exe
        
        C:\Windows\system32\Eqciba32.exe
        37⤵
        Executes dropped EXE
        
        PID:4576
        
        C:\Windows\SysWOW64\Ecbenm32.exe
        
        C:\Windows\system32\Ecbenm32.exe
        38⤵
        Executes dropped EXE
        
        PID:996
        
        C:\Windows\SysWOW64\Ejlmkgkl.exe
        
        C:\Windows\system32\Ejlmkgkl.exe
        39⤵
        Executes dropped EXE
        
        PID:740
        
        C:\Windows\SysWOW64\Fjnjqfij.exe
        
        C:\Windows\system32\Fjnjqfij.exe
        40⤵
        Executes dropped EXE
        
        PID:5008
        
        C:\Windows\SysWOW64\Fokbim32.exe
        
        C:\Windows\system32\Fokbim32.exe
        41⤵
        Executes dropped EXE
        
        PID:1452
        
        C:\Windows\SysWOW64\Fbioei32.exe
        
        C:\Windows\system32\Fbioei32.exe
        42⤵
        Executes dropped EXE
        
        PID:1104
        
        C:\Windows\SysWOW64\Fomonm32.exe
        
        C:\Windows\system32\Fomonm32.exe
        43⤵
        Executes dropped EXE
        
        PID:4260
        
        C:\Windows\SysWOW64\Fbllkh32.exe
        
        C:\Windows\system32\Fbllkh32.exe
        44⤵
        Executes dropped EXE
        
        PID:552
        
        C:\Windows\SysWOW64\Fifdgblo.exe
        
        C:\Windows\system32\Fifdgblo.exe
        45⤵
        Executes dropped EXE
        
        PID:4440
        
        C:\Windows\SysWOW64\Fmapha32.exe
        
        C:\Windows\system32\Fmapha32.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1628
        
        C:\Windows\SysWOW64\Fbnhphbp.exe
        
        C:\Windows\system32\Fbnhphbp.exe
        47⤵
        Executes dropped EXE
        
        PID:3868
        
        C:\Windows\SysWOW64\Fobiilai.exe
        
        C:\Windows\system32\Fobiilai.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5020
        
        C:\Windows\SysWOW64\Fcnejk32.exe
        
        C:\Windows\system32\Fcnejk32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5028
        
        C:\Windows\SysWOW64\Fbqefhpm.exe
        
        C:\Windows\system32\Fbqefhpm.exe
        50⤵
        Executes dropped EXE
        
        PID:216
        
        C:\Windows\SysWOW64\Fjhmgeao.exe
        
        C:\Windows\system32\Fjhmgeao.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3744
        
        C:\Windows\SysWOW64\Fqaeco32.exe
        
        C:\Windows\system32\Fqaeco32.exe
        52⤵
        Executes dropped EXE
        
        PID:1988
        
        C:\Windows\SysWOW64\Gfnnlffc.exe
        
        C:\Windows\system32\Gfnnlffc.exe
        53⤵
        Executes dropped EXE
        
        PID:3268
        
        C:\Windows\SysWOW64\Gmhfhp32.exe
        
        C:\Windows\system32\Gmhfhp32.exe
        54⤵
        Executes dropped EXE
        
        PID:2332
        
        C:\Windows\SysWOW64\Gcbnejem.exe
        
        C:\Windows\system32\Gcbnejem.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4068
        
        C:\Windows\SysWOW64\Gbenqg32.exe
        
        C:\Windows\system32\Gbenqg32.exe
        56⤵
        Executes dropped EXE
        
        PID:3832
        
        C:\Windows\SysWOW64\Gjlfbd32.exe
        
        C:\Windows\system32\Gjlfbd32.exe
        57⤵
        Executes dropped EXE
        
        PID:3276
        
        C:\Windows\SysWOW64\Gmkbnp32.exe
        
        C:\Windows\system32\Gmkbnp32.exe
        58⤵
        Executes dropped EXE
        
        PID:3316
        
        C:\Windows\SysWOW64\Goiojk32.exe
        
        C:\Windows\system32\Goiojk32.exe
        59⤵
        
        PID:1952
        
        C:\Windows\SysWOW64\Gbgkfg32.exe
        
        C:\Windows\system32\Gbgkfg32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:372
        
        C:\Windows\SysWOW64\Gmmocpjk.exe
        
        C:\Windows\system32\Gmmocpjk.exe
        61⤵
        Executes dropped EXE
        
        PID:4040
        
        C:\Windows\SysWOW64\Gpklpkio.exe
        
        C:\Windows\system32\Gpklpkio.exe
        62⤵
        Executes dropped EXE
        
        PID:4292
        
        C:\Windows\SysWOW64\Gjapmdid.exe
        
        C:\Windows\system32\Gjapmdid.exe
        63⤵
        Executes dropped EXE
        
        PID:4216
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        64⤵
        Executes dropped EXE
        
        PID:4516
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:696
        
        C:\Windows\SysWOW64\Gmaioo32.exe
        
        C:\Windows\system32\Gmaioo32.exe
        66⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3580
        
        C:\Windows\SysWOW64\Gameonno.exe
        
        C:\Windows\system32\Gameonno.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4496
        
        C:\Windows\SysWOW64\Hfjmgdlf.exe
        
        C:\Windows\system32\Hfjmgdlf.exe
        68⤵
        Modifies registry class
        
        PID:2792
        
        C:\Windows\SysWOW64\Hapaemll.exe
        
        C:\Windows\system32\Hapaemll.exe
        69⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\Hpbaqj32.exe
        
        C:\Windows\system32\Hpbaqj32.exe
        70⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\Hcnnaikp.exe
        
        C:\Windows\system32\Hcnnaikp.exe
        71⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\Hfljmdjc.exe
        
        C:\Windows\system32\Hfljmdjc.exe
        72⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Hikfip32.exe
        
        C:\Windows\system32\Hikfip32.exe
        73⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\Hcqjfh32.exe
        
        C:\Windows\system32\Hcqjfh32.exe
        74⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\Himcoo32.exe
        
        C:\Windows\system32\Himcoo32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3968
        
        C:\Windows\SysWOW64\Hadkpm32.exe
        
        C:\Windows\system32\Hadkpm32.exe
        76⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1484
        
        C:\Windows\SysWOW64\Hpgkkioa.exe
        
        C:\Windows\system32\Hpgkkioa.exe
        77⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\Hbeghene.exe
        
        C:\Windows\system32\Hbeghene.exe
        78⤵
        
        PID:1160
        
        C:\Windows\SysWOW64\Hippdo32.exe
        
        C:\Windows\system32\Hippdo32.exe
        79⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\Hpihai32.exe
        
        C:\Windows\system32\Hpihai32.exe
        80⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        81⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        82⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Ibjqcd32.exe
        
        C:\Windows\system32\Ibjqcd32.exe
        83⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\Ijaida32.exe
        
        C:\Windows\system32\Ijaida32.exe
        84⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\Impepm32.exe
        
        C:\Windows\system32\Impepm32.exe
        85⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        86⤵
        
        PID:808
        
        C:\Windows\SysWOW64\Iiffen32.exe
        
        C:\Windows\system32\Iiffen32.exe
        87⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        88⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\Iiibkn32.exe
        
        C:\Windows\system32\Iiibkn32.exe
        89⤵
        
        PID:1044
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        90⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        91⤵
        Drops file in System32 directory
        
        PID:1644
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        92⤵
        
        PID:4164
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        93⤵
        Drops file in System32 directory
        
        PID:3008
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        94⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\Ipegmg32.exe
        
        C:\Windows\system32\Ipegmg32.exe
        95⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        96⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        97⤵
        Drops file in System32 directory
        
        PID:5144
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        98⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Jfaloa32.exe
        
        C:\Windows\system32\Jfaloa32.exe
        99⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Jiphkm32.exe
        
        C:\Windows\system32\Jiphkm32.exe
        100⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        101⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Jjpeepnb.exe
        
        C:\Windows\system32\Jjpeepnb.exe
        102⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        103⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Jbkjjblm.exe
        
        C:\Windows\system32\Jbkjjblm.exe
        104⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        105⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Jaljgidl.exe
        
        C:\Windows\system32\Jaljgidl.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5520
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        107⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        108⤵
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        109⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Jiikak32.exe
        
        C:\Windows\system32\Jiikak32.exe
        110⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        111⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        112⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        113⤵
        Drops file in System32 directory
        
        PID:5896
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        114⤵
        Drops file in System32 directory
        
        PID:5936
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        115⤵
        Drops file in System32 directory
        
        PID:5976
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        116⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        117⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        118⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        119⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        120⤵
        Modifies registry class
        
        PID:5164
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        121⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        122⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        123⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        124⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5544
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        126⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        127⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5780
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        129⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        130⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5924
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        131⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        132⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        133⤵
        Modifies registry class
        
        PID:2548
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        134⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        135⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        136⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5596
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        138⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        139⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        140⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        141⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        142⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        143⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        144⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        145⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        146⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        147⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        148⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        149⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        150⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        151⤵
        Drops file in System32 directory
        
        PID:6260
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6300
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6348
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6392
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6428
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        156⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        157⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        158⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        159⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        160⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        161⤵
        Drops file in System32 directory
        
        PID:6708
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        162⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        163⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        164⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        165⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        166⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        167⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7000
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        169⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        170⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        171⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        172⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        173⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        174⤵
        Drops file in System32 directory
        
        PID:6244
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        175⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        176⤵
        Modifies registry class
        
        PID:6412
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        177⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        178⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Ondeac32.exe
        
        C:\Windows\system32\Ondeac32.exe
        179⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6612
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        180⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        181⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Ogljjiei.exe
        
        C:\Windows\system32\Ogljjiei.exe
        182⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        183⤵
        Drops file in System32 directory
        
        PID:6900
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        184⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        185⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Ojmcld32.exe
        
        C:\Windows\system32\Ojmcld32.exe
        186⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        187⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Oqgkhnjf.exe
        
        C:\Windows\system32\Oqgkhnjf.exe
        188⤵
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Okloegjl.exe
        
        C:\Windows\system32\Okloegjl.exe
        189⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        190⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        191⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        192⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Ojalgcnd.exe
        
        C:\Windows\system32\Ojalgcnd.exe
        193⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        194⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7112
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        196⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        197⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        198⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        199⤵
        Drops file in System32 directory
        
        PID:6784
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        200⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6240
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        202⤵
        Modifies registry class
        
        PID:6516
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6796
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        204⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        205⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        206⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        207⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        208⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        209⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        210⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        211⤵
        Drops file in System32 directory
        
        PID:7288
        
        C:\Windows\SysWOW64\Pbddcoei.exe
        
        C:\Windows\system32\Pbddcoei.exe
        212⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        213⤵
        Modifies registry class
        
        PID:7372
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        214⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        215⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        216⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        217⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        218⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        219⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        220⤵
        Drops file in System32 directory
        
        PID:7668
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        221⤵
        Modifies registry class
        
        PID:7708
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7756
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        223⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        224⤵
        Modifies registry class
        
        PID:7864
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        225⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        226⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        227⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        228⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        229⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        230⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        231⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        232⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        233⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        234⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        235⤵
        Modifies registry class
        
        PID:7360
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        236⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        237⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        238⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        239⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        240⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        241⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        242⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        243⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        244⤵
        Modifies registry class
        
        PID:7976
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        245⤵
        Drops file in System32 directory
        
        PID:8056
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        246⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        247⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        248⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        249⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        250⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        251⤵
        Modifies registry class
        
        PID:7604
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7752
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        253⤵
        Modifies registry class
        
        PID:7852
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        254⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        255⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        256⤵
        Modifies registry class
        
        PID:8176
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        257⤵
        Drops file in System32 directory
        
        PID:7340
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        258⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        259⤵
        Drops file in System32 directory
        
        PID:7688
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        260⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        261⤵
        Drops file in System32 directory
        
        PID:8100
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        262⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        263⤵
        Modifies registry class
        
        PID:7504
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        264⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        265⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        266⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        267⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        268⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        269⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        270⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8216
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        272⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        273⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        274⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        275⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8424
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        277⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        278⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        279⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        280⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        281⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        282⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        283⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        284⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        285⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        286⤵
        Modifies registry class
        
        PID:8824
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        287⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        288⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        289⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8988
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        291⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        292⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        293⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        294⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9208
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        296⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Eoolbinc.exe
        
        C:\Windows\system32\Eoolbinc.exe
        297⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8312
        
        C:\Windows\SysWOW64\Eamhodmf.exe
        
        C:\Windows\system32\Eamhodmf.exe
        298⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        299⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        300⤵
        Modifies registry class
        
        PID:8500
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        301⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        302⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        303⤵
        Modifies registry class
        
        PID:8716
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        304⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        305⤵
        Drops file in System32 directory
        
        PID:8856
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        306⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        307⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        308⤵
        Modifies registry class
        
        PID:9056
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        309⤵
        Drops file in System32 directory
        
        PID:9108
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        310⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        311⤵
        Drops file in System32 directory
        
        PID:8256
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        312⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        313⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        314⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        315⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        316⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        317⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        318⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        319⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        320⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        321⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        322⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        323⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        324⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9176
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        326⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        327⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9296
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        329⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        330⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        331⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        332⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        333⤵
        Modifies registry class
        
        PID:9516
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        334⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        335⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        336⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        337⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        338⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        339⤵
        Drops file in System32 directory
        
        PID:9776
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        340⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        341⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9900
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        343⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        344⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        345⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        346⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        347⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10160
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        349⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8984
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        351⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        352⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        353⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        354⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        355⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        356⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9608
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9680
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        358⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        359⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        360⤵
        Drops file in System32 directory
        
        PID:9892
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9968
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10032
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        363⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10152
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        365⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        366⤵
        Modifies registry class
        
        PID:9280
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        367⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9532
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        369⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        370⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        371⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        372⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10076
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        374⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10196
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        375⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        376⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        377⤵
        Modifies registry class
        
        PID:9592
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        378⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        379⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        380⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        381⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        382⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        383⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        384⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        385⤵
        Modifies registry class
        
        PID:9840
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        386⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        387⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        388⤵
        Drops file in System32 directory
        
        PID:9696
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        389⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        390⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        391⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        392⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        393⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        394⤵
        Modifies registry class
        
        PID:10472
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        395⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        396⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        397⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10592
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        398⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        399⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10680
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        400⤵
        Drops file in System32 directory
        
        PID:10716
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        401⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        402⤵
        Drops file in System32 directory
        
        PID:10800
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        403⤵
        Modifies registry class
        
        PID:10844
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        404⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        405⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        406⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        407⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        408⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11048
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        409⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        410⤵
        Drops file in System32 directory
        
        PID:11132
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        411⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        412⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        413⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        414⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        415⤵
        Drops file in System32 directory
        
        PID:10336
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        416⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        417⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        418⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        419⤵
        Modifies registry class
        
        PID:10616
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        420⤵
        Drops file in System32 directory
        
        PID:10676
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        421⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        422⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        423⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        424⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        425⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        426⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        427⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11168
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        428⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        429⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        430⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10436
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        431⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        432⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        433⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        434⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10752
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        435⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        436⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        437⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        438⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        439⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        440⤵
        Drops file in System32 directory
        
        PID:10352
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        441⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        442⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        443⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10772
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        444⤵
        Drops file in System32 directory
        
        PID:10888
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        445⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        446⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        447⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        448⤵
        Modifies registry class
        
        PID:10584
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        449⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        450⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        451⤵
        Modifies registry class
        
        PID:10404
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        452⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        453⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        454⤵
        Drops file in System32 directory
        
        PID:11056
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        455⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        456⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11268
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        457⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        458⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        459⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11400
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        460⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11444
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        461⤵
        
        PID:11484
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        462⤵
        
        PID:11528
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        463⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        464⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11608
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        465⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        466⤵
        Modifies registry class
        
        PID:11720
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        467⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        468⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        469⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        470⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        471⤵
        Drops file in System32 directory
        
        PID:11924
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        472⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        473⤵
        
        PID:12008
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        474⤵
        Drops file in System32 directory
        
        PID:12044
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        475⤵
        
        PID:12096
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        476⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12180
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        478⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        479⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        480⤵
        Modifies registry class
        
        PID:11196
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        481⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        482⤵
        Drops file in System32 directory
        
        PID:11392
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        483⤵
        
        PID:11476
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        484⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        485⤵
        
        PID:11604
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        486⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        487⤵
        
        PID:11748
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        488⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        489⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        490⤵
        
        PID:11956
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        491⤵
        Modifies registry class
        
        PID:12028
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        492⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        493⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12168
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        494⤵
        
        PID:12224
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        495⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        496⤵
        Drops file in System32 directory
        
        PID:11376
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        497⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        498⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        499⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        500⤵
        Drops file in System32 directory
        
        PID:11824
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        501⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11948
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        502⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12016
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        503⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        504⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        505⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11436
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        506⤵
        Drops file in System32 directory
        
        PID:11588
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        507⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        508⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        509⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        510⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        511⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        512⤵
        
        PID:11808
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        513⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        514⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        515⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        516⤵
        Modifies registry class
        
        PID:12220
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        517⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        518⤵
        
        PID:11840
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        519⤵
        Modifies registry class
        
        PID:12308
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        520⤵
        
        PID:12344
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        521⤵
        
        PID:12380
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        522⤵
        
        PID:12416
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        523⤵
        
        PID:12452
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        524⤵
        
        PID:12488
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        525⤵
        Drops file in System32 directory
        
        PID:12524
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        526⤵
        Drops file in System32 directory
        
        PID:12560
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        527⤵
        
        PID:12596
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        528⤵
        Modifies registry class
        
        PID:12632
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        529⤵
        
        PID:12668
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        530⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12704
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        531⤵
        
        PID:12740
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        532⤵
        
        PID:12776
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        533⤵
        
        PID:12812
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        534⤵
        Modifies registry class
        
        PID:12848
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        535⤵
        
        PID:12884
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        536⤵
        
        PID:12920
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        537⤵
        
        PID:12956
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        538⤵
        
        PID:12992
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        539⤵
        
        PID:13028
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        540⤵
        
        PID:13064
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        541⤵
        
        PID:13100
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        542⤵
        Modifies registry class
        
        PID:13136
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        543⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13172
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        544⤵
        
        PID:13208
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        545⤵
        Drops file in System32 directory
        
        PID:13244
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        546⤵
        
        PID:13284
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        547⤵
        
        PID:12296
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        548⤵
        Modifies registry class
        
        PID:12372
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        549⤵
        
        PID:12448
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        550⤵
        
        PID:12508
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        551⤵
        
        PID:12580
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        552⤵
        
        PID:12584
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        553⤵
        
        PID:12700
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        554⤵
        Modifies registry class
        
        PID:12768
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        555⤵
        Drops file in System32 directory
        
        PID:12836
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        556⤵
        Modifies registry class
        
        PID:12904
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        557⤵
        
        PID:12964
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        558⤵
        
        PID:13024
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        559⤵
        
        PID:13096
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        560⤵
        
        PID:13168
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        561⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13216
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        562⤵
        
        PID:13280
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        563⤵
        
        PID:12376
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        564⤵
        
        PID:12484
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        565⤵
        Drops file in System32 directory
        
        PID:12592
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        566⤵
        
        PID:12712
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        567⤵
        Modifies registry class
        
        PID:12832
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        568⤵
        
        PID:12940
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        569⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        570⤵
        
        PID:13144
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        571⤵
        
        PID:13272
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        572⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12444
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        573⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        574⤵
        
        PID:12568
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        575⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12556
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        576⤵
        
        PID:12892
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        577⤵
        
        PID:13124
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        578⤵
        
        PID:12304
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        579⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        580⤵
        
        PID:12664
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        581⤵
        
        PID:13000
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        582⤵
        Drops file in System32 directory
        
        PID:12340
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        583⤵
        
        PID:12620
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        584⤵
        
        PID:13236
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        585⤵
        
        PID:13192
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        586⤵
        
        PID:12328
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        587⤵
        
        PID:13348
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        588⤵
        Modifies registry class
        
        PID:13384
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        589⤵
        
        PID:13420
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        590⤵
        
        PID:13456
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        591⤵
        
        PID:13492
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        592⤵
        
        PID:13528
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        593⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:13564
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        594⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13600
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        595⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:13644
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        596⤵
        
        PID:13680
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        597⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13716
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        598⤵
        
        PID:13748
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13748 -s 212
        599⤵
        Program crash
        
        PID:13832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 13748 -ip 13748
1⤵
PID:13808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acqimo32.exe

Filesize
109KB

MD5
ae98958d04a5464657d415935755a3f2

SHA1
63d2c04c3db1c9f3dcec80aff8df9e38904e82e5

SHA256
9621a036a28547db81d8018a9b5da400b5a93c3260b06d3cce83440e5e623d9c

SHA512
02a7d27be2ac427518beb4489a6f8aafa0e0a8f970fd091f5cb5508392d1c73404d1015fdcd81cc6ff971e3e73df28bc30529e037b9ed0c3bb9d7486d71da962

Download Submit
C:\Windows\SysWOW64\Agglboim.exe

Filesize
109KB

MD5
960d24c80e7c6aab6184464fd830737d

SHA1
d8adb51a26be5d982970bcd1cfa44a5290a4e44a

SHA256
b2f1cbdfdf9693ca0d42a7a086c165a9e7f9117dc61b24384c74f68927c58126

SHA512
99c670514c0e3b9d2fca424f0d8710b82cd3345102513ed28ade0eb96fc354e3e9129169299aff8db77024e12c4b9329424733374be6d620fdc159a2bb6b0691

Download Submit
C:\Windows\SysWOW64\Ajhddjfn.exe

Filesize
109KB

MD5
8af2fb5de326a4a2896dedbe8a0e67e9

SHA1
dad96cef00b796fb6b10cc68043d88452f1c268f

SHA256
1e8cf29ea80bad053aaab5836fe2e385f389a6c3d56fc84f4efa7388d6fb43ae

SHA512
a32f53bb27aa4c744713ddf83dc34edc4a157f44e35c5eb7ab3f347b2a0abd47717fe3f93180c15a93efb896f18c25e11e9daccdb6320425407068475fc11ed0

Download Submit
C:\Windows\SysWOW64\Aminee32.exe

Filesize
109KB

MD5
deb2c21342a370d6c2c74a7aa8cd8bd6

SHA1
2d93fdc3f321517ea07d04f3f5a2fcc11a95405e

SHA256
1813af39f4d6ce89f8858716edd731fa5062f213e3346988fced9772186e3cda

SHA512
69acaf8204d9b5572a216072313c0ba44213418155bf9e08da16121a7ff5c0f41bab65f816c9190fee4518c2d98d674c85b31712b2ef02ea13199041f8f58805

Download Submit
C:\Windows\SysWOW64\Anogiicl.exe

Filesize
64KB

MD5
ecb8e3083ff293312f85ba5f9eedbbd6

SHA1
9c341254f4fdb9fd1f4b34c1dccd25d52fdda441

SHA256
e43f908b3722162fbf42fae88c5343c7f995986138e9aabe00cb0ff2ed2ad541

SHA512
2294d88995e8fc0db6fb6da980417bfa7d2bfeb485e0830c6366c597ee90662ad3f37827f1f267598da39a7bcaf3ac0e45f42369985a5eb2c7fd6ab4e08e7f74

Download Submit
C:\Windows\SysWOW64\Bcjlcn32.exe

Filesize
109KB

MD5
6d335fdbcb1fe8c92c64bfa2d3d92a8c

SHA1
7432818b833602d387de567456ab815ba5d8560c

SHA256
89cdd4ccffa9ba27479281f4a4c0954428d37ca1874c9006f2f6580430769f12

SHA512
beccb86a9f68f03b945b22006a1e28ed442745833a4d1be537317adfbf9d75b5b5341954d2e109bca8b886ce9e18e0df2e510bfd32470cfdce7b2205ca8f2c12

Download Submit
C:\Windows\SysWOW64\Bcoenmao.exe

Filesize
109KB

MD5
15ff50f04eb210cf92842cd8734845a4

SHA1
2113f8615ac42ef957e71b1154777db7be4bec57

SHA256
68720ed3e5075bf97c3b36486356815f3d20a0e256b4b025c6c21eb8cb7f34af

SHA512
74eb339b33c82b463aafe7c84f1bdb9ff608e6d1180f9af9a4ad062cd716c6dc8aaecf55fbe010d9a47ed5e18bcefd0915082ff018aaaa63380cd483fb2dfac2

Download Submit
C:\Windows\SysWOW64\Bfkedibe.exe

Filesize
109KB

MD5
f780f73dd9106ac6d98760d384fc1a36

SHA1
1ebc3697c9ac0fe5fe78c51d27593a6f5d75e40c

SHA256
044b04402a04abaa53be0f5e130b530ce6b89eee328f913e70e165759c52ad9a

SHA512
e087203704b246bc94acb9bc0f9685e68d0126189e087502662e068d0ead5e50b74846dd1a90e7a480879b78c97e84ecf3a7a15c2b6ce7fdae25c680d25af40c

Download Submit
C:\Windows\SysWOW64\Bgcknmop.exe

Filesize
109KB

MD5
35bb20a27bfb3841a6f2103efbd57c5f

SHA1
6f305b26de341dd934f53b752e4c2f46e6bc5cad

SHA256
04ba087e56d069af4f1e8100c028507be6ca28f3d1bd7fe41b7519d5b916f20d

SHA512
42e4939340df112cc696f50f7bfc48d03a1d034dbffcb8d72626ec1cc505dc2c74b107438a15b07fad0b30caf707026f8d9702c721ebacf2537e460fbafb87e9

Download Submit
C:\Windows\SysWOW64\Bjmnoi32.exe

Filesize
109KB

MD5
ef6feae612e05e9728513144fda1c15c

SHA1
029870c268a49fb305b523075878eebaf8ba3f43

SHA256
76382dbfac238af59916522da5d4ab90737e671856d52b21d6d40a47e4411d35

SHA512
639343555b578e7b0516049d11a2ef6e900f0a7f0b2a018dd46e8c3c642237df537f037ac002d25806445273180abfcf5abd3541fdb8ecf56f5ce44b52292d8f

Download Submit
C:\Windows\SysWOW64\Bjokdipf.exe

Filesize
109KB

MD5
9c82c58c188dd829cf5e7b556d36d310

SHA1
95e49a70a3748536fb6b70004da361ecfe4bbfb3

SHA256
fb705ec018ccae61469ced9e474ffb1ae461b3b656288863639cac5048c9c8a2

SHA512
ead935117d53874967b262d57a5cf1092e7933fb7b8fd3afcf182c17e0452be4e219d639bb7ab65c973573650e2795f49de901223306ddd6670ab7c72a84e07b

Download Submit
C:\Windows\SysWOW64\Caebma32.exe

Filesize
109KB

MD5
3424c004259e928c22317f884b204a48

SHA1
6607e055096c086ff8418fed6996849e92bbc55c

SHA256
e487926baab4f59ea40202e66b9b9a8602ec660fed6581ec44eb8187f9298723

SHA512
ce543ccfce04bc9cc3afe8b3ae7d342ac5650a9b1675de70a8d28e2ad7e14277c4595641622f545768cfe30bbec4fd90d82e8d079039b0d8b6a616cae7872de2

Download Submit
C:\Windows\SysWOW64\Cafigg32.exe

Filesize
109KB

MD5
09f116659c33d0d195d50a7912932384

SHA1
5ff60b65edba866e84fd21d96391c5486a59ff4c

SHA256
5cdc08ee018fce79867fdb7feb6bcc734c56a6817c2162bc2bc1d1068660be48

SHA512
fbc8cd76bbdf7eeade901adcd6eae4707945771f4677947b8fe2afcf55f7ce372967f5255ac913aeca0669e6730784910f533c2d0ec7b995c1571e8e63087f97

Download Submit
C:\Windows\SysWOW64\Capchmmb.exe

Filesize
109KB

MD5
d25589c5fbaeb7c1980e6bf7847167ae

SHA1
b10d1eb376c6d0298b28d1d24e5ec2528964769e

SHA256
79fd77da7c1d44334395718b1dcdc3d643a24b75a44407692200ae15275e3353

SHA512
5e54c68171b1bf673982dc495484d276877bcfe5747f902a610fea302752e5c0c48fd882fc1b0b5045da10af9679dcf5868981d2e16196f6fa919258ee0092fe

Download Submit
C:\Windows\SysWOW64\Ceehho32.exe

Filesize
109KB

MD5
b926595aeb482162b574b3a28488546d

SHA1
13547891f382c9ba9d2e1b5990ac3aa8e77eb8a1

SHA256
853326b949df016d90391639f7ab90f0fe567a152b405c3870406efbf46c56fc

SHA512
5d4570a8ec9de96b5db798681d7575b3a6f2de298a9079ebe1c677f0a500f669a8699ae5e453b99b4834f42666005bb1fe43af8b8107ded3e3c884ca849cf774

Download Submit
C:\Windows\SysWOW64\Ceibclgn.exe

Filesize
109KB

MD5
1a6c0b577e9876af9c784193a8455797

SHA1
e1482d3a6d13a77219b42edc6af21b6f9736bb3b

SHA256
4902166055410ea1a2be8ebac34435f70bf984b6a848f37871c258513ef328ee

SHA512
3f5b0f23c76686ec12caccad91466beac7fe10a3a27fca38729c5812db3a98c5fc681591583d9d83cac9a31c49ccb4709e5d470475a27e0a13d9369e374d27fe

Download Submit
C:\Windows\SysWOW64\Cekohk32.exe

Filesize
109KB

MD5
2b0f5a7464f7cca6ca0f3ecf8eaac181

SHA1
578b04a00825b4bc375bdaa34b76bf7083cf3384

SHA256
5528b06dc16824dec038480c0ac9917dd791434823bcfe85d469c93e86d83393

SHA512
760baa930360b5bc27694e444b84dc0a01d91b1657170646a6b3f49a7623c525983e8d86f1957bdd0f40e26416cc38031964dc723d89564489f3871830b503b3

Download Submit
C:\Windows\SysWOW64\Chagok32.exe

Filesize
109KB

MD5
cfe7476c32d98fe5d96c6ece7976fc5c

SHA1
b92d271174344565c7c4aeed881f2b824d8f890d

SHA256
2007ce76fe821c2374db86556257c1112274c8af8956d031c84ea9f0b1a499ce

SHA512
9f8dc4ce2eec607595d18297da55456a6645c0b6594e5172a6e09e1aebaf5c5698eb538efd9eaf0af24baf693fd8f9e69fa6a60a4f610191b7b73d2650e4aae0

Download Submit
C:\Windows\SysWOW64\Chdkoa32.exe

Filesize
109KB

MD5
0b17023130e6124ac2bea2f97a7832fd

SHA1
5001cbbabfe1c3f48fc3392e8209e46d83ad01ef

SHA256
78ee2cb44a994e6d62af756b7d2449b4923f17a003938b5e07731ef398bd022f

SHA512
aa810fe9dff14a8660cee81713e40efd6a37b054c68f581c092025781c49eb73602e62f13d853d12d1be395694139f97af78af82980243d0d5120efa561bbb60

Download Submit
C:\Windows\SysWOW64\Chgoogfa.exe

Filesize
109KB

MD5
44ebcda5c950c97973985bf9b4d10c66

SHA1
dfaef2756943975bc578499f0bb310809705b4d2

SHA256
0c4713b51c317889d2dfc5f089957657be8b4042e095eeaf84331541687528a7

SHA512
27a74d7406c0fef930417c6fa21a7326b6e388a07160daf6e6c802a55c443b439c68e9fd180b4e3e676e077b5e47666d36a16f62a307315b0e1f1fd9f40787d6

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
109KB

MD5
16009e525dfeefdea40bdf59438a8a65

SHA1
786b775a44028a49b50cecc5b328433537b4890f

SHA256
5f1b303aff5b8ff17ccfb41a97a305b83fcc67b8b12072977311f247ae68da6e

SHA512
0cb1d2cdd9d0c90ebf33e4b1ed74b9a07e40b56e36f9d4ddbe6c378755f7ab7444326b52f146e099a1fcbb48efd5dbe9994d30ba69dbd27feeb8c00b8d2bae78

Download Submit
C:\Windows\SysWOW64\Cjinkg32.exe

Filesize
109KB

MD5
c9410e4c46534ac50ce077c630cd64d7

SHA1
bf99120c5b172eda1b7a6dff92ed42c5ea405f29

SHA256
7d442b62ef7df9f73d0f4ccf9832466e6116bc890ae844eeaff75b7a75b44ce0

SHA512
4374c209cfdc76a157358e882c0b135cd41b3ffc62c4e5961de85a369865942731f3ca2debddcf043f4e5862611788cc48456c944f9a6803e6c1b425acc99664

Download Submit
C:\Windows\SysWOW64\Cmlcbbcj.exe

Filesize
109KB

MD5
244cbf6f4be14b2af57657bbdb79a564

SHA1
ca905afd44a8b7879030895ecd26b4dd7d104f63

SHA256
094e72279ae6eb838ddbe0f20e203ac7b4a0232cffdaf23bbeeaa03004781ad9

SHA512
c21dc439f2acecb757a98e389e7cd51ed3d77db35c7676aaba82aed04224d8bcb092a7a742d5c07c7c270dbe2b25652dae2be043db0c3a76d5354b994ce47a71

Download Submit
C:\Windows\SysWOW64\Cnnlaehj.exe

Filesize
109KB

MD5
c40f1c588215e4cad67994beb78698fe

SHA1
4656ff3f06f46622a3fe7e4541a4f42218657e59

SHA256
6bc2076d02e542679709a2d44da5096da514079b6b2823d192981bf18a565510

SHA512
4da8f4940d72e32b271b317daef298065d511d62f5d2edcd48c50b5e72099fd80f7ab2322292671ef14e69df44af07b293922a01540ebfba358561d12426a859

Download Submit
C:\Windows\SysWOW64\Coagla32.exe

Filesize
109KB

MD5
f70cf5c6b6d90394a1ffb7fd3bf43f9a

SHA1
10b9b2dc7b8693a03048119fb7e591ba2f75866d

SHA256
54ac2d5902ed5bacfc77cc91205455b0c6cac6d35cdb1d767958f7dfdbc297e4

SHA512
2dd3fba2aac1c440de90d1385febf6805accb858828c08660563cc4790652b72afc95a6824c22f9e07e1d7b593e74decb24dce560fdddc11f1c3e7e2443a1d68

Download Submit
C:\Windows\SysWOW64\Cpofpdgd.exe

Filesize
109KB

MD5
6d775dfdd7054dd71077ffb62f5d334d

SHA1
f4ef088ced54a0605db3916fe82c8becad675f9e

SHA256
691548243d70f59f0df398e241a6c05e2651b8a7a036e6b38e43c5467bc60d95

SHA512
c3c9ae5e0828736f7fd1561c2fc525cc339215d0b5abcbaf9152c27fc3e931eec2c9b503c2e26300742f81665115e48665d4bef0879a4d047a83331cecbe606f

Download Submit
C:\Windows\SysWOW64\Dabpnlkp.exe

Filesize
109KB

MD5
4be8069077e0be18bb7c4c33c1406c43

SHA1
68e050abd645b32aacac0317b46864fc2bc1d251

SHA256
d9fa385c05e811607a75961f8a5b9c00d4cd3ba70413f5f4af5daa03514b7822

SHA512
8a23eb958d723083b736758a29f88731b53186f8cd9560538f357f36c4eeed65d1f78cb1fa082996fe41d073ebb381bba4a6ca262b33855beda8182dc0e4783d

Download Submit
C:\Windows\SysWOW64\Dadlclim.exe

Filesize
109KB

MD5
1d5da06e1629b5707a755d07b8bf66d7

SHA1
a3e7541f227390dc8db4cf693def3a1392126a49

SHA256
9e8f19d131be0d33a9eb6942b940008eb23b84e43bd8b4ce11c4e9f65bc992b1

SHA512
b799df0b66c4535cca71b8a92a4f520c1d8b9936dc5932abf16a566f0feb506624448c7898b9be577449248610a8c4ccbc8df7508df1cf7b26bd8914e0d0a542

Download Submit
C:\Windows\SysWOW64\Daifnk32.exe

Filesize
109KB

MD5
7af74e229b59d5c7c9642a799f4022fa

SHA1
867fae7aade0ec7db91297fd9636e70e3f6788d7

SHA256
4221bf32c68280d99305fdfcbb756865abe6a0f52cc43c54c903dc3934fdf7b6

SHA512
0a24d2df8167092d331a571147595d2532c3c0df7912eab7b58d680c5ebf16203637ca8fb693894c1cd54739d061363d253b70dd8ed0db07105e6286347bd0da

Download Submit
C:\Windows\SysWOW64\Dcalgo32.exe

Filesize
109KB

MD5
21b15e9657056166f0d90640dd66e331

SHA1
10ebebd336299faf3c93aa066c72f7e5cd327a73

SHA256
a40987839375bd5ddde13fd904330c5de9179a27e9a339ab1db97aab350f98af

SHA512
490c163c6c046b96cc4016013d9b0e31dfeb8e3b2bd6fc382c7f3f21addbd8b22d79bbb3e4d1da83926bd688d8bcace575b9b2c001a3a6cdb245cf3234ee7a8e

Download Submit
C:\Windows\SysWOW64\Dcfebonm.exe

Filesize
109KB

MD5
bb92e2a630009eb5cb84071c83f98ccd

SHA1
b3e04c9f676a7a1b444fd4ff8958830481ce656d

SHA256
a2a9aa9271efe85317a6ecb1aa210f97749e02dbefc0188932f60f1ad259440f

SHA512
26fb4a39ca9aec86f55ea80b99ab4261a4e47610ed4533ddec6b96485498d29a527bcd6434fbfea835c88608383df1dd10967c214564035a9fb0be6251f37db4

Download Submit
C:\Windows\SysWOW64\Ddonekbl.exe

Filesize
109KB

MD5
3da29a9b85bdbfaadff26ad7281dacf6

SHA1
5eda4288680b6906bc5cc6ec5d99502db237d532

SHA256
1cf0bf0cace9433f5e9f48631087cd3786e3cd2d9cf33d1be6e109750a444cea

SHA512
8406d2bcfd37d8b329f19f57dfe88f046badd7c6f301f4953c0ba21e4821913c4e654a48ef3c8b2713d32f2c6f89898586928108f8ca826b178baad913d36b29

Download Submit
C:\Windows\SysWOW64\Denlnk32.exe

Filesize
109KB

MD5
c8a6aff86336898de4c76a2cbb2f07c8

SHA1
94c5bed23bc15453986a45b30df611ca7f070ba3

SHA256
f08f9e6dfe40334cda19c67a6dd89e5cd2ede312de06bad2f874c0fba947733d

SHA512
e33710d8ae3b8b0e9e8d299427013bcf31acaa1675a60b7e51d39eeb0a943f874b5400593381c769dd3a20db71140b1b3b2a933edc9cab46cb0e47c86b59d1cd

Download Submit
C:\Windows\SysWOW64\Dephckaf.exe

Filesize
109KB

MD5
883467045d5014d76d1d3f0bf1993571

SHA1
2997afda64751591d4db8b991aae3aa63d4c1d91

SHA256
f2789fa7afafcd4772e0f59792e4fa9016cdb0d1d0ceb8e783709383e7f362de

SHA512
506181ba7680748d463644643b196623f6203b28d9d12ba3f269c06aaa0e30587a65dacf816fb684791f2312ab36eba542079d4e6698b445d1b82120c63e22e3

Download Submit
C:\Windows\SysWOW64\Dhcnke32.exe

Filesize
109KB

MD5
e5bbbbb04a8ef0e0cd5f19286ef070c1

SHA1
03085770bf2868973fff7407cd5e910bd0d9ae10

SHA256
68e6093613057cd9bf6ac2131c499f69f3304dcbba3e52e1e2468dd2306e5a7a

SHA512
faf59d72ef6d2ba7a33308c74536bdba1cfb66d40be2943c112fe4bd7cc746c537f5376225033fcddc3a403fe6507ec6a9779ccb512e851f6fab02138bea6e28

Download Submit
C:\Windows\SysWOW64\Dhhnpjmh.exe

Filesize
109KB

MD5
d19950c90dba0640b2cfc8804be5af6b

SHA1
803383487cbf76382f2a78bdc1a5b66f57f9cd75

SHA256
14a58055905b19e1fd29ca297d152c2886b756e17d5e4620b242b04966e719cb

SHA512
566833cedac4f82633f4420281f4087ac384819ae8fe8c500486095edcb425c2a9fa79aebcefcaf0d2f6f0add8146d0cd5e2b96c12a321a394c4f2c3b2ddf648

Download Submit
C:\Windows\SysWOW64\Dhnepfpj.exe

Filesize
109KB

MD5
96bbb94bab46399973611b3df7a6cf3c

SHA1
703048d1514cb752f8aa1a44b5f105cd3c7583d0

SHA256
52181fb1b696b568544242754afd6fdb645ab4b20470f92fa5b59dd67a00784e

SHA512
2394ba3cc645e16529a4499e1eb8697b447c01326fb52de0341f4eb98cdff833920922e15eddefefd23dfbbb11e3eeba4570ff41a7bf06277c48d8031852cda8

Download Submit
C:\Windows\SysWOW64\Digkijmd.exe

Filesize
109KB

MD5
d988869da00e643b24c0fd10b7d15808

SHA1
1dbf89b98f6b89faaea7f2e6a5c34bfcc2189b10

SHA256
38abf02efbb12e7fbe4a97750d1df4b36b2c69e8de93368cd1d8b7350f52ac12

SHA512
65ea57bb93008e6e8a7c9147c776278275662162c82cea788c95dd1cb5efc4aef2629403bf79fac6525ab9219fcf6102a272839dda02b533365ccbf2ed9814e9

Download Submit
C:\Windows\SysWOW64\Djnaji32.exe

Filesize
109KB

MD5
82e0d15181e4d88c87c91f7df0f02d47

SHA1
3aa6c0bf1485959f91b23cd834a7451d87447816

SHA256
bb5f8aa4628a76b529255c441c1bb15f25cb8710773d39107897623835fb64d9

SHA512
40311164a3b717276d08131e2389e176d18c8a7bf0d632ef462098ad66ec57c0b15d735e3894327e089f8392757ce254af99bbda454e50a6c416c53b5f80a342

Download Submit
C:\Windows\SysWOW64\Dkkcge32.exe

Filesize
109KB

MD5
a08e055a0a71b3e843b7ba30c37c7c10

SHA1
2d472960ab3de6748f687e6978b23b6f026a78aa

SHA256
ece0dff3f17c825a89620e78eb644b124fa28c7937b18129603ef549c8a1fe46

SHA512
300a932044902c89777513b12c6c4b1b01da64fcb7d2b59fc286c2b1eca13248bae150d5cc84c113b962b852bba03bf9f6ae71392af82d57e7ebaf81ae5b479f

Download Submit
C:\Windows\SysWOW64\Dlegeemh.exe

Filesize
109KB

MD5
ae0faf9637c9aa1eed1f2699f35b2847

SHA1
5c90b3c9dcd278fead969baca50cd20bd02f1286

SHA256
d5dabe55fe88a479ef6142a18754b705cc7b0a920756d41d75ae7f2477269ffd

SHA512
d40507ecbb3f51ca96d43fb4f983323f3943c56604ded63839afd4999b5e63142eebe524a0b32ad14696f3e8bb341e62882db978096d90f36dbe25e92c434112

Download Submit
C:\Windows\SysWOW64\Dllmfd32.exe

Filesize
109KB

MD5
c34c52e8aabaf993d48d87419f77b6e6

SHA1
c486464992775d2d8409a0d3085123bce31d08fd

SHA256
74e41c0780c0c6f7e5357c17614190658da1b597b4e38494fcceedd8ed440004

SHA512
5e67dd3192cb1babee80793902fe24974e3b40ac0330f4e4444577ee1df65fba36c9ed212412d0f7074e5bafda115d36ef71c113ca8b51a9cd2b201c0724cb49

Download Submit
C:\Windows\SysWOW64\Doccaall.exe

Filesize
109KB

MD5
14deede906e748b87915fc5f2d5f8bd1

SHA1
bd194d201c408e6c52b7e197409321c64b1ea892

SHA256
09b09f0819a243ecc8947141b6b7168bcc03259b2f20857f40a0c0e41b1a6f02

SHA512
fd80d90a02c25b2380a0cc50c2ea46192917a2dd77d2613250f8fc02bfb817b7609fc00b38a30029c8bada247f3ace383b3115eb1b33ba01cde3d6f6c694cfc7

Download Submit
C:\Windows\SysWOW64\Dpacfd32.exe

Filesize
109KB

MD5
5c758cce102575985882b088ddb90b33

SHA1
5c877ac62af3355dd7a4c4fdfec87946bc296998

SHA256
f75509506c0ab33ea93a2b3d7fde924346e6e8b348fe0b7481cefb1bcd41cf62

SHA512
4e20f2a5a879acd84200e8e0ae4f3a008060dff22733ac753945274e2b5e6dd0b17c9d0c6a4bc1799e65e60c8700cec9b938ce33288402a481f2a9204d426569

Download Submit
C:\Windows\SysWOW64\Dpcpkc32.exe

Filesize
109KB

MD5
b2e59e46d9ee6d98e7246251b7360e18

SHA1
80b934cc3c2b3317052164b58295c942ac73e833

SHA256
9e6c380301aa430ce9ee05ce4472834fabfa9ccb2b555b8dab93d9cceae195f9

SHA512
70460a3f8969c37e83f4a0256473632dda9c2fcd3e6764628fa7cc3f657d2970a7c3d0604da21dc5d31ee1dc846ee99854a83542b2e9ef9aa1c6dfdc43b7d515

Download Submit
C:\Windows\SysWOW64\Dpemacql.exe

Filesize
109KB

MD5
90aaef1715b3c19ceda15f1de673b342

SHA1
67babf4a8ed741de3911d225db4a5c90842c5b69

SHA256
9f3165c2d4c6cda0e961d0f5c01a1797d889f40052dfe22be67c0d45e1879e67

SHA512
e749a277ac73d5ab284d5a46e7212e82577cba040d69e1ad2c3f399ca1dac75d6204563b9125c9e4084a727eb92f758ccb401b2b00e6b53181c6afc493657aee

Download Submit
C:\Windows\SysWOW64\Dphifcoi.exe

Filesize
109KB

MD5
7c35dc29996755bf5438fcbb77728f2e

SHA1
0bf8f900a2026a46e4629144d7ae4f8cadc3af7a

SHA256
bf64e949cab500e1e7775f37b2451ba36806c3907723e19a770298c5d1e49554

SHA512
bc1592a218e98bb4ead4e4b9ea89b4b6ede820a0673ceb403725987e8e4353ec1c781c95a7ecff0910ef0467ac4ecb5c1b88eef702fbacb9c9f98e79e0bee137

Download Submit
C:\Windows\SysWOW64\Dpjflb32.exe

Filesize
109KB

MD5
6a6227229c73ba54c90a1b024e0e7a5f

SHA1
76f6cabc574791d013df2f784cfb044e1b3b1432

SHA256
4f3f1b1fce8a5cf6dd523a4fe08a09d320ebd799e6f3c8ea1f6f3ee9c5ec03bd

SHA512
9083a2fe4d6dcb635c105a8143417347dcca40c06465a6e356e4b22bc826db5a43472346c11b2ba350de7796fab12e5cf0244deafe3404dc85cf95255f97451a

Download Submit
C:\Windows\SysWOW64\Ebnoikqb.exe

Filesize
109KB

MD5
c43ab4fce3a6224548f84bf54059a5cd

SHA1
417ed5c4724918e1683d19fc23a4aaa22649b410

SHA256
7302aae357b456867b9761da2342bc83cf806b90cb76baf157f6f5149ec01d6d

SHA512
7273bc8022e7a99317640b38b187085826a54036af1e09ec9cbe70676dd5bde65ea924a2ba1e6772eda64e78ff40b18d905a056f35e02e72a27d18733ced0fad

Download Submit
C:\Windows\SysWOW64\Ecmlcmhe.exe

Filesize
109KB

MD5
7235aabb4eb1dea189fed9481a6fb9a5

SHA1
fbcd103282c6ee0f43d71fb2d8fa5565c151102f

SHA256
0eee8c96b668c5c7ca6b059a6b7c561d268bad71fae136df4bba8e57cff504dd

SHA512
4398f7aeeee264f9fcfacaa082e50bbb7bf57681a2b532837cdc40fe904e58ef2c036503f1c3a6d7cf55da0e8d0719daf8fb2bc500ed6e788c5b7de20c3f6b61

Download Submit
C:\Windows\SysWOW64\Efgodj32.exe

Filesize
109KB

MD5
93d00da662c94a964c8f11adf51f7999

SHA1
f4067c70abec3045c8941dc2a8c26decd9375032

SHA256
e12aefa0544bbb98d15da629f68cd249d20a50c4049b7cc408dc418038b9cba9

SHA512
71a80df20226ce4916c1daadf2360933a25defc0fdc393928a2e7f5d926ffc7a758a41f4f76113f34ddc564bc5b11adc454059f6cf49e2823bee0c851a5ba479

Download Submit
C:\Windows\SysWOW64\Efikji32.exe

Filesize
109KB

MD5
567b9c7b7ff7c4fed11eaa745d9eb989

SHA1
673a4aded28bda5ff690b76f23c234177ffb2416

SHA256
894bdd55a77b709663d572edd83dafc37c1e3d8127c4972f9b1b35b22f7aa610

SHA512
4e630a10b2f3e741613a79b9ba5168fd97a0a66ba293e196d3494d966270a3987866fd93e28830d7b36b506b96e6bc4fb166cbd8e12b3b14b1abaac3776b2652

Download Submit
C:\Windows\SysWOW64\Ehekqe32.exe

Filesize
109KB

MD5
e9ab1668901b608b55798aea2a6f389d

SHA1
3b463019b0cacf8fe096fc1d0d63a265c4a010a7

SHA256
e1d256c2ce235a542329f409246617605bb425729acd3c82e2ba7c79533310fd

SHA512
5797a6c9d9948470533b902ee367fb40702be3d26d645333f56c5c39d92c7082fb593f7bd7479190d9cc3a58a0a85b7da342f5f0fcfd2b5881936296c715e8dd

Download Submit
C:\Windows\SysWOW64\Ejgdpg32.exe

Filesize
109KB

MD5
cb4134fd554ac7b884e1af70aabb84ba

SHA1
d1370ddd621297286e299ea50128cac2a78c6372

SHA256
ea86044c34d84669b06fa5ec16e432d53824dacf6b5247e79fb40c8885eea399

SHA512
e28e6c7603f5b5ecf264a1a188a28354e008402552ac4ab8a50a1814f6ebd22b23f5ab78787b061826ddde21601626d3aca4e89bf102d4b88a2445c34dd4e546

Download Submit
C:\Windows\SysWOW64\Epmcab32.exe

Filesize
109KB

MD5
ab894db6fa1dac0af61ac9680687a80f

SHA1
9b13b3c3b310d7b635a09b14705804f75c397f3a

SHA256
d6f9e5734aecb0426eaad9972d2321e7a5a4ddfe67bceabecb55aae715d479be

SHA512
a8a04d221f26069e7d1913f52757ed485708dd7e795c9a1b368610a94c6c747a37c73e28b3821d3a1ff29b3868c4756b98ab05bfa6fcbe9981138c4e351efed0

Download Submit
C:\Windows\SysWOW64\Jfifijhb.dll

Filesize
7KB

MD5
bc75239294385b024634e577393d9c52

SHA1
c19938f2c1007b5be67dbe32e61c5dde9aabd0b4

SHA256
34b71f6da5876633f64d5d6a54e89ac14a98b0b0191ee34290cb82eb4bf57c35

SHA512
9934820d2cba4ca67906cb6d24a0a50e719b23b3fe5ac9151c96f1fd848e45ab7b6ddaa6ad927e0e0e4b91187870de5f9a72c633474217b7f8a6170310476cc1

Download Submit
C:\Windows\SysWOW64\Kpjcdn32.exe

Filesize
109KB

MD5
e3e2d339b96b600651b7159bf49ab571

SHA1
8cc17fed8249b5c3ef0c623cb32a65cc888becc0

SHA256
7dee4e8158d3f99864d9fa4668943ff5f6644e4c59d423f45318e1cf9afd5e5d

SHA512
704420158b32104b7ce7efc26bf26a911046fb75c797e676c24c7123bc139023c396be51be65b5581d37a164d6fbf9b2a57c1db966595d7aab0e5743803ea54e

Download Submit
memory/208-78-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/216-363-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/372-417-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/376-175-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/404-211-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/452-104-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/552-324-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/684-256-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/740-292-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/812-192-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/996-291-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1068-199-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1104-310-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1200-120-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1368-63-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1452-304-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1460-144-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1520-95-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1588-278-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1600-180-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1628-338-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1872-184-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1952-408-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1972-239-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1988-370-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2060-268-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2192-7-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2296-93-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2332-382-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2368-24-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2420-262-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2448-112-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2500-16-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2764-215-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2964-141-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3268-381-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3276-400-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3316-406-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3576-228-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3744-364-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3812-152-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3832-394-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3868-340-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3984-247-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4040-419-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4068-388-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4216-435-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4260-316-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4292-429-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4344-103-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4356-160-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4440-332-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4488-132-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4516-441-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4532-55-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4576-280-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4856-86-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4900-32-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4904-49-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4992-232-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5008-298-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5012-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5020-350-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5028-352-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads