4696314a5e21adc9e8b697b86643b83058a6f75bce882c0e098a1cae75b13307

Analysis

max time kernel
93s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 19:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4696314a5e21adc9e8b697b86643b83058a6f75bce882c0e098a1cae75b13307.exe
Size

176KB
MD5

31e98044fdb24061066562686cd7a8f8
SHA1

fe00db41639a0cf35ee10970c2c494b4a501119e
SHA256

4696314a5e21adc9e8b697b86643b83058a6f75bce882c0e098a1cae75b13307
SHA512

d3164406fab832bd34da5dc53368bcfef70feada20adb046e2921b489f7014290748b1182a15ecc006019d77a9a0adf19f9f78e90b8b795c2bbdf5ef7267eb09
SSDEEP

3072:OyMO2Lb/urHZ3faZ5De/Ey032yaCMMq9FIUPv9XOVw1FaX6lwzmOJfYerMMq9FIT:Oy4HKvaZ5q/E4f9FIUpOVw86CmOJfToG

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emjjgbjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmlhii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pgmcqggf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Medgncoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jjpeepnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Okhfjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hecmijim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pmfhig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodbbdbb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Commqb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipldfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbmelbid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anbkio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fqkocpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lalcng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Balpgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfkedibe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlgdkeje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkkdan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgopffec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Docmgjhp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcfhof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqbdjfln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cpgqpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cipehkcl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiafg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddakjkqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbckbepg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Anbkio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kipabjil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgmngglp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ecphimfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cabfga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jlnnmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfolbmje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ajfhnjhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Andqdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gogbdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hobkfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Leihbeib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clnadfbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lkdggmlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocegdjij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lebkhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cojqkbdf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcggpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Icplcpgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Eflhoigi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ehjdldfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Doqpak32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpoefk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jidbflcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pjhbgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmpijp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogcpjhoq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ogcpjhoq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Demecd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ghopckpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jimekgff.exe

Executes dropped EXE 64 IoCs

pid	Process
2060	Cccpfa32.exe
940	Ceblbm32.exe
1900	Chphoh32.exe
2984	Cpgqpe32.exe
1364	Cojqkbdf.exe
1756	Caimgncj.exe
4500	Cipehkcl.exe
3788	Clnadfbp.exe
3756	Cpjmee32.exe
4040	Commqb32.exe
768	Cakjmm32.exe
2896	Cibank32.exe
4984	Clqnjf32.exe
4400	Coojfa32.exe
4668	Ccjfgphj.exe
3932	Ceibclgn.exe
2100	Clckpf32.exe
3192	Coagla32.exe
5064	Capchmmb.exe
4488	Digkijmd.exe
1988	Dlegeemh.exe
2148	Dcopbp32.exe
4744	Denlnk32.exe
3432	Dlgdkeje.exe
3484	Dpcpkc32.exe
3064	Dadlclim.exe
3360	Dhnepfpj.exe
2744	Dohmlp32.exe
4728	Dagiil32.exe
1080	Debeijoc.exe
4504	Dllmfd32.exe
4380	Dokjbp32.exe
668	Djpnohej.exe
4916	Ehekqe32.exe
1156	Ebnoikqb.exe
4352	Efikji32.exe
2524	Eoapbo32.exe
2596	Ecmlcmhe.exe
2964	Eflhoigi.exe
3408	Ehjdldfl.exe
4636	Eqalmafo.exe
4640	Ecphimfb.exe
4876	Efneehef.exe
4424	Ehlaaddj.exe
2668	Eofinnkf.exe
2184	Efpajh32.exe
3328	Emjjgbjp.exe
4176	Eqfeha32.exe
1924	Fbgbpihg.exe
2404	Fjnjqfij.exe
3348	Fmmfmbhn.exe
3316	Ffekegon.exe
4936	Fjqgff32.exe
4320	Fqkocpod.exe
524	Fcikolnh.exe
3008	Ffggkgmk.exe
4036	Fmapha32.exe
3956	Fckhdk32.exe
4772	Ffjdqg32.exe
2584	Fihqmb32.exe
4508	Fmclmabe.exe
60	Fobiilai.exe
1640	Fcnejk32.exe
1912	Fbqefhpm.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Cddecc32.exe	Ceaehfjj.exe
File created	C:\Windows\SysWOW64\Kpihae32.dll	Gokdeeec.exe
File opened for modification	C:\Windows\SysWOW64\Daqbip32.exe	Djgjlelk.exe
File created	C:\Windows\SysWOW64\Kbfbkj32.exe	Klljnp32.exe
File created	C:\Windows\SysWOW64\Cfpnph32.exe	Cdabcm32.exe
File created	C:\Windows\SysWOW64\Jbocea32.exe	Jpaghf32.exe
File created	C:\Windows\SysWOW64\Bmnjlc32.dll	Aldomc32.exe
File opened for modification	C:\Windows\SysWOW64\Eflhoigi.exe	Ecmlcmhe.exe
File created	C:\Windows\SysWOW64\Gqffnmfa.dll	Mpmokb32.exe
File created	C:\Windows\SysWOW64\Ckedalaj.exe	Cdkldb32.exe
File created	C:\Windows\SysWOW64\Ekacmjgl.exe	Dlncan32.exe
File created	C:\Windows\SysWOW64\Lfjehk32.dll	Edpnfo32.exe
File created	C:\Windows\SysWOW64\Hbanme32.exe	Hihicplj.exe
File created	C:\Windows\SysWOW64\Qddfkd32.exe	Qnjnnj32.exe
File opened for modification	C:\Windows\SysWOW64\Bnhjohkb.exe	Bfabnjjp.exe
File created	C:\Windows\SysWOW64\Jifkeoll.dll	Lalcng32.exe
File opened for modification	C:\Windows\SysWOW64\Efneehef.exe	Ecphimfb.exe
File created	C:\Windows\SysWOW64\Gpnkgo32.dll	Mdkhapfj.exe
File opened for modification	C:\Windows\SysWOW64\Bjpaooda.exe	Bdfibe32.exe
File created	C:\Windows\SysWOW64\Oehldcbk.dll	Bopgjmhe.exe
File created	C:\Windows\SysWOW64\Fhgjblfq.exe	Ffimfqgm.exe
File created	C:\Windows\SysWOW64\Gcimkc32.exe	Gkaejf32.exe
File opened for modification	C:\Windows\SysWOW64\Odgqdlnj.exe	Obidhaog.exe
File created	C:\Windows\SysWOW64\Pnbbbabh.exe	Pkceffcd.exe
File created	C:\Windows\SysWOW64\Dokfjo32.dll	Qkmhlekj.exe
File created	C:\Windows\SysWOW64\Chdfonda.dll	Hiefcj32.exe
File created	C:\Windows\SysWOW64\Bfdodjhm.exe	Bcebhoii.exe
File opened for modification	C:\Windows\SysWOW64\Gogbdl32.exe	Gmhfhp32.exe
File created	C:\Windows\SysWOW64\Ngcgcjnc.exe	Nnjbke32.exe
File opened for modification	C:\Windows\SysWOW64\Cbefaj32.exe	Cojjqlpk.exe
File opened for modification	C:\Windows\SysWOW64\Kikame32.exe	Kdnidn32.exe
File created	C:\Windows\SysWOW64\Jheiojpj.dll	Ncldnkae.exe
File created	C:\Windows\SysWOW64\Agglboim.exe	Aeiofcji.exe
File created	C:\Windows\SysWOW64\Jepjeoec.dll	Clqnjf32.exe
File opened for modification	C:\Windows\SysWOW64\Mpkbebbf.exe	Mahbje32.exe
File created	C:\Windows\SysWOW64\Bnhjohkb.exe	Bfabnjjp.exe
File opened for modification	C:\Windows\SysWOW64\Dpcpkc32.exe	Dlgdkeje.exe
File created	C:\Windows\SysWOW64\Ogaodjbe.dll	Fjnjqfij.exe
File opened for modification	C:\Windows\SysWOW64\Hclakimb.exe	Gmaioo32.exe
File created	C:\Windows\SysWOW64\Hipegc32.dll	Pnbbbabh.exe
File created	C:\Windows\SysWOW64\Gdqgmmjb.exe	Gfngap32.exe
File created	C:\Windows\SysWOW64\Ceehho32.exe	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Lmbocjjm.dll	Gmmocpjk.exe
File created	C:\Windows\SysWOW64\Hjhfnccl.exe	Hbanme32.exe
File created	C:\Windows\SysWOW64\Qecppkdm.exe	Pagdol32.exe
File created	C:\Windows\SysWOW64\Bjghpn32.exe	Bhikcb32.exe
File created	C:\Windows\SysWOW64\Opfkao32.dll	Ckpjfm32.exe
File created	C:\Windows\SysWOW64\Ghaddm32.dll	Cbgbgj32.exe
File created	C:\Windows\SysWOW64\Hcmgfbhd.exe	Hobkfd32.exe
File opened for modification	C:\Windows\SysWOW64\Jblpek32.exe	Jpnchp32.exe
File opened for modification	C:\Windows\SysWOW64\Cnnlaehj.exe	Cffdpghg.exe
File created	C:\Windows\SysWOW64\Njljefql.exe	Mgnnhk32.exe
File created	C:\Windows\SysWOW64\Flqimk32.exe	Fdialn32.exe
File created	C:\Windows\SysWOW64\Bppheeep.dll	Eqfeha32.exe
File opened for modification	C:\Windows\SysWOW64\Gmhfhp32.exe	Gjjjle32.exe
File created	C:\Windows\SysWOW64\Lmccchkn.exe	Liggbi32.exe
File opened for modification	C:\Windows\SysWOW64\Dhkapp32.exe	Demecd32.exe
File created	C:\Windows\SysWOW64\Gfpcgpae.exe	Ghlcnk32.exe
File opened for modification	C:\Windows\SysWOW64\Jfaedkdp.exe	Jcbihpel.exe
File created	C:\Windows\SysWOW64\Mkoqfnpl.dll	Jfhlejnh.exe
File created	C:\Windows\SysWOW64\Jpppnp32.exe	Jmbdbd32.exe
File created	C:\Windows\SysWOW64\Ldamee32.dll	Oddmdf32.exe
File opened for modification	C:\Windows\SysWOW64\Peimil32.exe	Pnpemb32.exe
File opened for modification	C:\Windows\SysWOW64\Bjbndobo.exe	Beeflhdh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
13784	13700	WerFault.exe	690

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nbmelbid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fqkocpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpgeph32.dll"	Ljnnch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehfnmfki.dll"	Ajanck32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Aegikj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Edkdkplj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Aeiofcji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlddhggk.dll"	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hecmijim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ipqnahgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kgmlkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmbcpkhj.dll"	Bnnjen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ecmeig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghkebndc.dll"	Hkikkeeo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gjocgdkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gcggpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cibifp32.dll"	Hcdmga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcgqhjop.dll"	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckegia32.dll"	Laciofpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kgdbkohf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fbqefhpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hjhfnccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Haggelfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jfhbppbc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Miifeq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Accfbokl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Clckpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hccglh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ifhiib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dhcbhjlp.dll"	Ddmhja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Okhfjh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Leihbeib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gifhkeje.dll"	Dmgbnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Giofnacd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Okhfjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Habnjm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cbjoljdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ifhiib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Megkhf32.dll"	Bjbndobo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mlopkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oncmnnje.dll"	Pjcbbmif.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pqpgdfnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ecmlcmhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gbcakg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Coojfa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ldaeka32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gkmlofol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Coagla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dadlclim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pejjde32.dll"	Elppfmoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odqjbebh.dll"	Hkfoeega.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eifnachf.dll"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cccpfa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Eqfeha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Conclk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jjpeepnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Hclakimb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Jbfpobpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jfoiokfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqffpbnb.dll"	Onholckc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 2060	3244	4696314a5e21adc9e8b697b86643b83058a6f75bce882c0e098a1cae75b13307.exe	86
PID 3244 wrote to memory of 2060	3244	4696314a5e21adc9e8b697b86643b83058a6f75bce882c0e098a1cae75b13307.exe	86
PID 3244 wrote to memory of 2060	3244	4696314a5e21adc9e8b697b86643b83058a6f75bce882c0e098a1cae75b13307.exe	86
PID 2060 wrote to memory of 940	2060	Cccpfa32.exe	87
PID 2060 wrote to memory of 940	2060	Cccpfa32.exe	87
PID 2060 wrote to memory of 940	2060	Cccpfa32.exe	87
PID 940 wrote to memory of 1900	940	Ceblbm32.exe	88
PID 940 wrote to memory of 1900	940	Ceblbm32.exe	88
PID 940 wrote to memory of 1900	940	Ceblbm32.exe	88
PID 1900 wrote to memory of 2984	1900	Chphoh32.exe	89
PID 1900 wrote to memory of 2984	1900	Chphoh32.exe	89
PID 1900 wrote to memory of 2984	1900	Chphoh32.exe	89
PID 2984 wrote to memory of 1364	2984	Cpgqpe32.exe	90
PID 2984 wrote to memory of 1364	2984	Cpgqpe32.exe	90
PID 2984 wrote to memory of 1364	2984	Cpgqpe32.exe	90
PID 1364 wrote to memory of 1756	1364	Cojqkbdf.exe	91
PID 1364 wrote to memory of 1756	1364	Cojqkbdf.exe	91
PID 1364 wrote to memory of 1756	1364	Cojqkbdf.exe	91
PID 1756 wrote to memory of 4500	1756	Caimgncj.exe	92
PID 1756 wrote to memory of 4500	1756	Caimgncj.exe	92
PID 1756 wrote to memory of 4500	1756	Caimgncj.exe	92
PID 4500 wrote to memory of 3788	4500	Cipehkcl.exe	93
PID 4500 wrote to memory of 3788	4500	Cipehkcl.exe	93
PID 4500 wrote to memory of 3788	4500	Cipehkcl.exe	93
PID 3788 wrote to memory of 3756	3788	Clnadfbp.exe	94
PID 3788 wrote to memory of 3756	3788	Clnadfbp.exe	94
PID 3788 wrote to memory of 3756	3788	Clnadfbp.exe	94
PID 3756 wrote to memory of 4040	3756	Cpjmee32.exe	95
PID 3756 wrote to memory of 4040	3756	Cpjmee32.exe	95
PID 3756 wrote to memory of 4040	3756	Cpjmee32.exe	95
PID 4040 wrote to memory of 768	4040	Commqb32.exe	96
PID 4040 wrote to memory of 768	4040	Commqb32.exe	96
PID 4040 wrote to memory of 768	4040	Commqb32.exe	96
PID 768 wrote to memory of 2896	768	Cakjmm32.exe	97
PID 768 wrote to memory of 2896	768	Cakjmm32.exe	97
PID 768 wrote to memory of 2896	768	Cakjmm32.exe	97
PID 2896 wrote to memory of 4984	2896	Cibank32.exe	98
PID 2896 wrote to memory of 4984	2896	Cibank32.exe	98
PID 2896 wrote to memory of 4984	2896	Cibank32.exe	98
PID 4984 wrote to memory of 4400	4984	Clqnjf32.exe	99
PID 4984 wrote to memory of 4400	4984	Clqnjf32.exe	99
PID 4984 wrote to memory of 4400	4984	Clqnjf32.exe	99
PID 4400 wrote to memory of 4668	4400	Coojfa32.exe	100
PID 4400 wrote to memory of 4668	4400	Coojfa32.exe	100
PID 4400 wrote to memory of 4668	4400	Coojfa32.exe	100
PID 4668 wrote to memory of 3932	4668	Ccjfgphj.exe	101
PID 4668 wrote to memory of 3932	4668	Ccjfgphj.exe	101
PID 4668 wrote to memory of 3932	4668	Ccjfgphj.exe	101
PID 3932 wrote to memory of 2100	3932	Ceibclgn.exe	102
PID 3932 wrote to memory of 2100	3932	Ceibclgn.exe	102
PID 3932 wrote to memory of 2100	3932	Ceibclgn.exe	102
PID 2100 wrote to memory of 3192	2100	Clckpf32.exe	103
PID 2100 wrote to memory of 3192	2100	Clckpf32.exe	103
PID 2100 wrote to memory of 3192	2100	Clckpf32.exe	103
PID 3192 wrote to memory of 5064	3192	Coagla32.exe	104
PID 3192 wrote to memory of 5064	3192	Coagla32.exe	104
PID 3192 wrote to memory of 5064	3192	Coagla32.exe	104
PID 5064 wrote to memory of 4488	5064	Capchmmb.exe	105
PID 5064 wrote to memory of 4488	5064	Capchmmb.exe	105
PID 5064 wrote to memory of 4488	5064	Capchmmb.exe	105
PID 4488 wrote to memory of 1988	4488	Digkijmd.exe	106
PID 4488 wrote to memory of 1988	4488	Digkijmd.exe	106
PID 4488 wrote to memory of 1988	4488	Digkijmd.exe	106
PID 1988 wrote to memory of 2148	1988	Dlegeemh.exe	107

C:\Users\Admin\AppData\Local\Temp\4696314a5e21adc9e8b697b86643b83058a6f75bce882c0e098a1cae75b13307.exe
"C:\Users\Admin\AppData\Local\Temp\4696314a5e21adc9e8b697b86643b83058a6f75bce882c0e098a1cae75b13307.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Windows\SysWOW64\Cccpfa32.exe
  C:\Windows\system32\Cccpfa32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\SysWOW64\Ceblbm32.exe
    C:\Windows\system32\Ceblbm32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:940
  - - C:\Windows\SysWOW64\Chphoh32.exe
      C:\Windows\system32\Chphoh32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1900
    - - C:\Windows\SysWOW64\Cpgqpe32.exe
        
        C:\Windows\system32\Cpgqpe32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2984
      - C:\Windows\SysWOW64\Cojqkbdf.exe
        
        C:\Windows\system32\Cojqkbdf.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1364
        
        C:\Windows\SysWOW64\Caimgncj.exe
        
        C:\Windows\system32\Caimgncj.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Windows\SysWOW64\Cipehkcl.exe
        
        C:\Windows\system32\Cipehkcl.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\SysWOW64\Clnadfbp.exe
        
        C:\Windows\system32\Clnadfbp.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3788
        
        C:\Windows\SysWOW64\Cpjmee32.exe
        
        C:\Windows\system32\Cpjmee32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3756
        
        C:\Windows\SysWOW64\Commqb32.exe
        
        C:\Windows\system32\Commqb32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4040
        
        C:\Windows\SysWOW64\Cakjmm32.exe
        
        C:\Windows\system32\Cakjmm32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:768
        
        C:\Windows\SysWOW64\Cibank32.exe
        
        C:\Windows\system32\Cibank32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2896
        
        C:\Windows\SysWOW64\Clqnjf32.exe
        
        C:\Windows\system32\Clqnjf32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\SysWOW64\Coojfa32.exe
        
        C:\Windows\system32\Coojfa32.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4400
        
        C:\Windows\SysWOW64\Ccjfgphj.exe
        
        C:\Windows\system32\Ccjfgphj.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\SysWOW64\Ceibclgn.exe
        
        C:\Windows\system32\Ceibclgn.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3932
        
        C:\Windows\SysWOW64\Clckpf32.exe
        
        C:\Windows\system32\Clckpf32.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2100
        
        C:\Windows\SysWOW64\Coagla32.exe
        
        C:\Windows\system32\Coagla32.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3192
        
        C:\Windows\SysWOW64\Capchmmb.exe
        
        C:\Windows\system32\Capchmmb.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5064
        
        C:\Windows\SysWOW64\Digkijmd.exe
        
        C:\Windows\system32\Digkijmd.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4488
        
        C:\Windows\SysWOW64\Dlegeemh.exe
        
        C:\Windows\system32\Dlegeemh.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        C:\Windows\SysWOW64\Dcopbp32.exe
        
        C:\Windows\system32\Dcopbp32.exe
        23⤵
        Executes dropped EXE
        
        PID:2148
        
        C:\Windows\SysWOW64\Denlnk32.exe
        
        C:\Windows\system32\Denlnk32.exe
        24⤵
        Executes dropped EXE
        
        PID:4744
        
        C:\Windows\SysWOW64\Dlgdkeje.exe
        
        C:\Windows\system32\Dlgdkeje.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3432
        
        C:\Windows\SysWOW64\Dpcpkc32.exe
        
        C:\Windows\system32\Dpcpkc32.exe
        26⤵
        Executes dropped EXE
        
        PID:3484
        
        C:\Windows\SysWOW64\Dadlclim.exe
        
        C:\Windows\system32\Dadlclim.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3064
        
        C:\Windows\SysWOW64\Dhnepfpj.exe
        
        C:\Windows\system32\Dhnepfpj.exe
        28⤵
        Executes dropped EXE
        
        PID:3360
        
        C:\Windows\SysWOW64\Dohmlp32.exe
        
        C:\Windows\system32\Dohmlp32.exe
        29⤵
        Executes dropped EXE
        
        PID:2744
        
        C:\Windows\SysWOW64\Dagiil32.exe
        
        C:\Windows\system32\Dagiil32.exe
        30⤵
        Executes dropped EXE
        
        PID:4728
        
        C:\Windows\SysWOW64\Debeijoc.exe
        
        C:\Windows\system32\Debeijoc.exe
        31⤵
        Executes dropped EXE
        
        PID:1080
        
        C:\Windows\SysWOW64\Dllmfd32.exe
        
        C:\Windows\system32\Dllmfd32.exe
        32⤵
        Executes dropped EXE
        
        PID:4504
        
        C:\Windows\SysWOW64\Dokjbp32.exe
        
        C:\Windows\system32\Dokjbp32.exe
        33⤵
        Executes dropped EXE
        
        PID:4380
        
        C:\Windows\SysWOW64\Djpnohej.exe
        
        C:\Windows\system32\Djpnohej.exe
        34⤵
        Executes dropped EXE
        
        PID:668
        
        C:\Windows\SysWOW64\Ehekqe32.exe
        
        C:\Windows\system32\Ehekqe32.exe
        35⤵
        Executes dropped EXE
        
        PID:4916
        
        C:\Windows\SysWOW64\Ebnoikqb.exe
        
        C:\Windows\system32\Ebnoikqb.exe
        36⤵
        Executes dropped EXE
        
        PID:1156
        
        C:\Windows\SysWOW64\Efikji32.exe
        
        C:\Windows\system32\Efikji32.exe
        37⤵
        Executes dropped EXE
        
        PID:4352
        
        C:\Windows\SysWOW64\Eoapbo32.exe
        
        C:\Windows\system32\Eoapbo32.exe
        38⤵
        Executes dropped EXE
        
        PID:2524
        
        C:\Windows\SysWOW64\Ecmlcmhe.exe
        
        C:\Windows\system32\Ecmlcmhe.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2596
        
        C:\Windows\SysWOW64\Eflhoigi.exe
        
        C:\Windows\system32\Eflhoigi.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2964
        
        C:\Windows\SysWOW64\Ehjdldfl.exe
        
        C:\Windows\system32\Ehjdldfl.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3408
        
        C:\Windows\SysWOW64\Eqalmafo.exe
        
        C:\Windows\system32\Eqalmafo.exe
        42⤵
        Executes dropped EXE
        
        PID:4636
        
        C:\Windows\SysWOW64\Ecphimfb.exe
        
        C:\Windows\system32\Ecphimfb.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4640
        
        C:\Windows\SysWOW64\Efneehef.exe
        
        C:\Windows\system32\Efneehef.exe
        44⤵
        Executes dropped EXE
        
        PID:4876
        
        C:\Windows\SysWOW64\Ehlaaddj.exe
        
        C:\Windows\system32\Ehlaaddj.exe
        45⤵
        Executes dropped EXE
        
        PID:4424
        
        C:\Windows\SysWOW64\Eofinnkf.exe
        
        C:\Windows\system32\Eofinnkf.exe
        46⤵
        Executes dropped EXE
        
        PID:2668
        
        C:\Windows\SysWOW64\Efpajh32.exe
        
        C:\Windows\system32\Efpajh32.exe
        47⤵
        Executes dropped EXE
        
        PID:2184
        
        C:\Windows\SysWOW64\Emjjgbjp.exe
        
        C:\Windows\system32\Emjjgbjp.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3328
        
        C:\Windows\SysWOW64\Eqfeha32.exe
        
        C:\Windows\system32\Eqfeha32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4176
        
        C:\Windows\SysWOW64\Fbgbpihg.exe
        
        C:\Windows\system32\Fbgbpihg.exe
        50⤵
        Executes dropped EXE
        
        PID:1924
        
        C:\Windows\SysWOW64\Fjnjqfij.exe
        
        C:\Windows\system32\Fjnjqfij.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2404
        
        C:\Windows\SysWOW64\Fmmfmbhn.exe
        
        C:\Windows\system32\Fmmfmbhn.exe
        52⤵
        Executes dropped EXE
        
        PID:3348
        
        C:\Windows\SysWOW64\Ffekegon.exe
        
        C:\Windows\system32\Ffekegon.exe
        53⤵
        Executes dropped EXE
        
        PID:3316
        
        C:\Windows\SysWOW64\Fjqgff32.exe
        
        C:\Windows\system32\Fjqgff32.exe
        54⤵
        Executes dropped EXE
        
        PID:4936
        
        C:\Windows\SysWOW64\Fqkocpod.exe
        
        C:\Windows\system32\Fqkocpod.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4320
        
        C:\Windows\SysWOW64\Fcikolnh.exe
        
        C:\Windows\system32\Fcikolnh.exe
        56⤵
        Executes dropped EXE
        
        PID:524
        
        C:\Windows\SysWOW64\Ffggkgmk.exe
        
        C:\Windows\system32\Ffggkgmk.exe
        57⤵
        Executes dropped EXE
        
        PID:3008
        
        C:\Windows\SysWOW64\Fmapha32.exe
        
        C:\Windows\system32\Fmapha32.exe
        58⤵
        Executes dropped EXE
        
        PID:4036
        
        C:\Windows\SysWOW64\Fckhdk32.exe
        
        C:\Windows\system32\Fckhdk32.exe
        59⤵
        Executes dropped EXE
        
        PID:3956
        
        C:\Windows\SysWOW64\Ffjdqg32.exe
        
        C:\Windows\system32\Ffjdqg32.exe
        60⤵
        Executes dropped EXE
        
        PID:4772
        
        C:\Windows\SysWOW64\Fihqmb32.exe
        
        C:\Windows\system32\Fihqmb32.exe
        61⤵
        Executes dropped EXE
        
        PID:2584
        
        C:\Windows\SysWOW64\Fmclmabe.exe
        
        C:\Windows\system32\Fmclmabe.exe
        62⤵
        Executes dropped EXE
        
        PID:4508
        
        C:\Windows\SysWOW64\Fobiilai.exe
        
        C:\Windows\system32\Fobiilai.exe
        63⤵
        Executes dropped EXE
        
        PID:60
        
        C:\Windows\SysWOW64\Fcnejk32.exe
        
        C:\Windows\system32\Fcnejk32.exe
        64⤵
        Executes dropped EXE
        
        PID:1640
        
        C:\Windows\SysWOW64\Fbqefhpm.exe
        
        C:\Windows\system32\Fbqefhpm.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1912
        
        C:\Windows\SysWOW64\Fjhmgeao.exe
        
        C:\Windows\system32\Fjhmgeao.exe
        66⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\Fijmbb32.exe
        
        C:\Windows\system32\Fijmbb32.exe
        67⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\Gcpapkgp.exe
        
        C:\Windows\system32\Gcpapkgp.exe
        68⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\Gbcakg32.exe
        
        C:\Windows\system32\Gbcakg32.exe
        69⤵
        Modifies registry class
        
        PID:4868
        
        C:\Windows\SysWOW64\Gjjjle32.exe
        
        C:\Windows\system32\Gjjjle32.exe
        70⤵
        Drops file in System32 directory
        
        PID:3164
        
        C:\Windows\SysWOW64\Gmhfhp32.exe
        
        C:\Windows\system32\Gmhfhp32.exe
        71⤵
        Drops file in System32 directory
        
        PID:672
        
        C:\Windows\SysWOW64\Gogbdl32.exe
        
        C:\Windows\system32\Gogbdl32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4480
        
        C:\Windows\SysWOW64\Gcbnejem.exe
        
        C:\Windows\system32\Gcbnejem.exe
        73⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\Gbenqg32.exe
        
        C:\Windows\system32\Gbenqg32.exe
        74⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Gjlfbd32.exe
        
        C:\Windows\system32\Gjlfbd32.exe
        75⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\Giofnacd.exe
        
        C:\Windows\system32\Giofnacd.exe
        76⤵
        Modifies registry class
        
        PID:2124
        
        C:\Windows\SysWOW64\Gqfooodg.exe
        
        C:\Windows\system32\Gqfooodg.exe
        77⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Goiojk32.exe
        
        C:\Windows\system32\Goiojk32.exe
        78⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\Gcekkjcj.exe
        
        C:\Windows\system32\Gcekkjcj.exe
        79⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\Gjocgdkg.exe
        
        C:\Windows\system32\Gjocgdkg.exe
        80⤵
        Modifies registry class
        
        PID:1572
        
        C:\Windows\SysWOW64\Gmmocpjk.exe
        
        C:\Windows\system32\Gmmocpjk.exe
        81⤵
        Drops file in System32 directory
        
        PID:4316
        
        C:\Windows\SysWOW64\Gqikdn32.exe
        
        C:\Windows\system32\Gqikdn32.exe
        82⤵
        
        PID:4356
        
        C:\Windows\SysWOW64\Gcggpj32.exe
        
        C:\Windows\system32\Gcggpj32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2152
        
        C:\Windows\SysWOW64\Gbjhlfhb.exe
        
        C:\Windows\system32\Gbjhlfhb.exe
        84⤵
        
        PID:1484
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        85⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\Gpnhekgl.exe
        
        C:\Windows\system32\Gpnhekgl.exe
        86⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        87⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\Gmaioo32.exe
        
        C:\Windows\system32\Gmaioo32.exe
        88⤵
        Drops file in System32 directory
        
        PID:3460
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        89⤵
        Modifies registry class
        
        PID:4136
        
        C:\Windows\SysWOW64\Hboagf32.exe
        
        C:\Windows\system32\Hboagf32.exe
        90⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        91⤵
        Drops file in System32 directory
        
        PID:8
        
        C:\Windows\SysWOW64\Hbanme32.exe
        
        C:\Windows\system32\Hbanme32.exe
        92⤵
        Drops file in System32 directory
        
        PID:4476
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        93⤵
        Modifies registry class
        
        PID:3916
        
        C:\Windows\SysWOW64\Habnjm32.exe
        
        C:\Windows\system32\Habnjm32.exe
        94⤵
        Modifies registry class
        
        PID:5124
        
        C:\Windows\SysWOW64\Hbckbepg.exe
        
        C:\Windows\system32\Hbckbepg.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5168
        
        C:\Windows\SysWOW64\Hjjbcbqj.exe
        
        C:\Windows\system32\Hjjbcbqj.exe
        96⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Hmioonpn.exe
        
        C:\Windows\system32\Hmioonpn.exe
        97⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Hpgkkioa.exe
        
        C:\Windows\system32\Hpgkkioa.exe
        98⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Hccglh32.exe
        
        C:\Windows\system32\Hccglh32.exe
        99⤵
        Modifies registry class
        
        PID:5336
        
        C:\Windows\SysWOW64\Hfachc32.exe
        
        C:\Windows\system32\Hfachc32.exe
        100⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        101⤵
        Modifies registry class
        
        PID:5432
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        102⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Hibljoco.exe
        
        C:\Windows\system32\Hibljoco.exe
        103⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Ipldfi32.exe
        
        C:\Windows\system32\Ipldfi32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5556
        
        C:\Windows\SysWOW64\Ibjqcd32.exe
        
        C:\Windows\system32\Ibjqcd32.exe
        105⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        106⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Ifhiib32.exe
        
        C:\Windows\system32\Ifhiib32.exe
        107⤵
        Modifies registry class
        
        PID:5696
        
        C:\Windows\SysWOW64\Iiffen32.exe
        
        C:\Windows\system32\Iiffen32.exe
        108⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Ipqnahgf.exe
        
        C:\Windows\system32\Ipqnahgf.exe
        109⤵
        Modifies registry class
        
        PID:5780
        
        C:\Windows\SysWOW64\Ibojncfj.exe
        
        C:\Windows\system32\Ibojncfj.exe
        110⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Imdnklfp.exe
        
        C:\Windows\system32\Imdnklfp.exe
        111⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        112⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Idofhfmm.exe
        
        C:\Windows\system32\Idofhfmm.exe
        113⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        114⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        115⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        116⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Ijkljp32.exe
        
        C:\Windows\system32\Ijkljp32.exe
        117⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Jpgdbg32.exe
        
        C:\Windows\system32\Jpgdbg32.exe
        118⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        119⤵
        Modifies registry class
        
        PID:5248
        
        C:\Windows\SysWOW64\Jjmhppqd.exe
        
        C:\Windows\system32\Jjmhppqd.exe
        120⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Jiphkm32.exe
        
        C:\Windows\system32\Jiphkm32.exe
        121⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        122⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        123⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        124⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Jjpeepnb.exe
        
        C:\Windows\system32\Jjpeepnb.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5704
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        126⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        127⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Jbkjjblm.exe
        
        C:\Windows\system32\Jbkjjblm.exe
        128⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6000
        
        C:\Windows\SysWOW64\Jaljgidl.exe
        
        C:\Windows\system32\Jaljgidl.exe
        130⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        131⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        132⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        133⤵
        Modifies registry class
        
        PID:5244
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        134⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        135⤵
        Drops file in System32 directory
        
        PID:5508
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        136⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Jfkoeppq.exe
        
        C:\Windows\system32\Jfkoeppq.exe
        137⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        138⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        139⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        140⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        141⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\Kgmlkp32.exe
        
        C:\Windows\system32\Kgmlkp32.exe
        142⤵
        Modifies registry class
        
        PID:5348
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        143⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        144⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        145⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        146⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        147⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5216
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        148⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        149⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Kbfiep32.exe
        
        C:\Windows\system32\Kbfiep32.exe
        150⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5772
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        152⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        153⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        154⤵
        Modifies registry class
        
        PID:5592
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        155⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        156⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        157⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        158⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        159⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6440
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        161⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6552
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        163⤵
        Drops file in System32 directory
        
        PID:6596
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        164⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        165⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        166⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        167⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        168⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        169⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        170⤵
        Modifies registry class
        
        PID:6960
        
        C:\Windows\SysWOW64\Ldaeka32.exe
        
        C:\Windows\system32\Ldaeka32.exe
        171⤵
        Modifies registry class
        
        PID:7008
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        172⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        173⤵
        Modifies registry class
        
        PID:7096
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        174⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        175⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        176⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        177⤵
        Drops file in System32 directory
        
        PID:6268
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        178⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        179⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        180⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        181⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        182⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        183⤵
        Drops file in System32 directory
        
        PID:6764
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        184⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        185⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        186⤵
        Drops file in System32 directory
        
        PID:7044
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        187⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        188⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        189⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        190⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        191⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        192⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        193⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        194⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        195⤵
        Drops file in System32 directory
        
        PID:7080
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        196⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        197⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        198⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        199⤵
        Drops file in System32 directory
        
        PID:6840
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        200⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        201⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        202⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        203⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        204⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        205⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        206⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7204
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        208⤵
        Drops file in System32 directory
        
        PID:7244
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        209⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7320
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        211⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Ndkahnhh.exe
        
        C:\Windows\system32\Ndkahnhh.exe
        212⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        213⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        214⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        215⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Ocqnij32.exe
        
        C:\Windows\system32\Ocqnij32.exe
        216⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7616
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        218⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        219⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        220⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        221⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        222⤵
        Modifies registry class
        
        PID:7816
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7860
        
        C:\Windows\SysWOW64\Ogaceh32.exe
        
        C:\Windows\system32\Ogaceh32.exe
        224⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        225⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        226⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        227⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8072
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        229⤵
        Drops file in System32 directory
        
        PID:8112
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        230⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        231⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        232⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        233⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        234⤵
        Drops file in System32 directory
        
        PID:7348
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        235⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        236⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        237⤵
        Drops file in System32 directory
        
        PID:7560
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        238⤵
        Drops file in System32 directory
        
        PID:7632
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        239⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        240⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7844
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        242⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        243⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8016
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        245⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        246⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        247⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        248⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7384
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        250⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        251⤵
        Drops file in System32 directory
        
        PID:7664
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        252⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Qkmhlekj.exe
        
        C:\Windows\system32\Qkmhlekj.exe
        253⤵
        Drops file in System32 directory
        
        PID:7940
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        254⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        255⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        256⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        257⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        258⤵
        Modifies registry class
        
        PID:7144
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        259⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        260⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        261⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        262⤵
        Drops file in System32 directory
        
        PID:7556
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7880
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        264⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        265⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        266⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        267⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        268⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        269⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        270⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        271⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        272⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        273⤵
        Drops file in System32 directory
        
        PID:8408
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        274⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        275⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        276⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        277⤵
        Drops file in System32 directory
        
        PID:8572
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        278⤵
        Modifies registry class
        
        PID:8616
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        279⤵
        Modifies registry class
        
        PID:8664
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        280⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        281⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        282⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        283⤵
        Drops file in System32 directory
        
        PID:8836
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        284⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        285⤵
        Drops file in System32 directory
        
        PID:8916
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        286⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        287⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        288⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        289⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        290⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        291⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        292⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        293⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        294⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        295⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        296⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        297⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        298⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        299⤵
        Drops file in System32 directory
        
        PID:8624
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        300⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        301⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        302⤵
        Drops file in System32 directory
        
        PID:8820
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        303⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        304⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        305⤵
        Drops file in System32 directory
        
        PID:9024
        
        C:\Windows\SysWOW64\Colffknh.exe
        
        C:\Windows\system32\Colffknh.exe
        306⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        307⤵
        Drops file in System32 directory
        
        PID:9152
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        308⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        309⤵
        Modifies registry class
        
        PID:8280
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        310⤵
        Modifies registry class
        
        PID:8372
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        311⤵
        Drops file in System32 directory
        
        PID:8484
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        312⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8704
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        314⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        315⤵
        Modifies registry class
        
        PID:8928
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9092
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        317⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8268
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        319⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        320⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        321⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        322⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        323⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        324⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        325⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        326⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        327⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        328⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        329⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        330⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        331⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        332⤵
        Drops file in System32 directory
        
        PID:9224
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        333⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        334⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        335⤵
        Modifies registry class
        
        PID:9348
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        336⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        337⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        338⤵
        Modifies registry class
        
        PID:9480
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        339⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        340⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        341⤵
        Modifies registry class
        
        PID:9604
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        342⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        343⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        344⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        345⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        346⤵
        Drops file in System32 directory
        
        PID:9876
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        347⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        348⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        349⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        350⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        351⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        352⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10232
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        354⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        355⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        356⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        357⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        358⤵
        Drops file in System32 directory
        
        PID:9532
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        359⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        360⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        361⤵
        Drops file in System32 directory
        
        PID:9808
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        362⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        363⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        364⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        365⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        366⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        367⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        368⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        369⤵
        Drops file in System32 directory
        
        PID:9512
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        370⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        371⤵
        Drops file in System32 directory
        
        PID:9684
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        372⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        373⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        374⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10072
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        375⤵
        Modifies registry class
        
        PID:10216
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        376⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9680
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        378⤵
        Drops file in System32 directory
        
        PID:9860
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        379⤵
        Drops file in System32 directory
        
        PID:10176
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        380⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        381⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        382⤵
        Drops file in System32 directory
        
        PID:10068
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        383⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        384⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        385⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        386⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        387⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        388⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        389⤵
        Modifies registry class
        
        PID:10420
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        390⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10460
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        391⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        392⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        393⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        394⤵
        Modifies registry class
        
        PID:10624
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        395⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        396⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        397⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        398⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        399⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10844
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        400⤵
        Modifies registry class
        
        PID:10896
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        401⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        402⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        403⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        404⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        405⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        406⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        407⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        408⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        409⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        410⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        411⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        412⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        413⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        414⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        415⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        416⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10752
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        418⤵
        Modifies registry class
        
        PID:10852
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        419⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10884
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        420⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        421⤵
        Drops file in System32 directory
        
        PID:11020
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        422⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        423⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11180
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        424⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        425⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        426⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        427⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        428⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        429⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        430⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        431⤵
        Drops file in System32 directory
        
        PID:10860
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        432⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        433⤵
        Drops file in System32 directory
        
        PID:11136
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        434⤵
        Drops file in System32 directory
        
        PID:11236
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        435⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        436⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        437⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        438⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        439⤵
        Drops file in System32 directory
        
        PID:11036
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        440⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        441⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        442⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        443⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        444⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        445⤵
        Drops file in System32 directory
        
        PID:11088
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        446⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        447⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        448⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        449⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        450⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        451⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        452⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11268
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        454⤵
        
        PID:11324
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        455⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        456⤵
        
        PID:11404
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        457⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        458⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        459⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11528
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        460⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        461⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        462⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11652
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        463⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        464⤵
        
        PID:11736
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        465⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11776
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        466⤵
        Modifies registry class
        
        PID:11828
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        467⤵
        
        PID:11864
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        468⤵
        
        PID:11900
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        469⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        470⤵
        
        PID:11988
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        471⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        472⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        473⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12108
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        474⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12148
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        475⤵
        
        PID:12192
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        476⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        477⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        478⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        479⤵
        Modifies registry class
        
        PID:716
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        480⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        481⤵
        
        PID:11416
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        482⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        483⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        484⤵
        
        PID:11604
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        485⤵
        
        PID:11688
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        486⤵
        
        PID:11744
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        487⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        488⤵
        
        PID:11884
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        489⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11952
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        490⤵
        
        PID:12032
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        491⤵
        
        PID:12092
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        492⤵
        
        PID:12140
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        493⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        494⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        495⤵
        
        PID:11292
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        496⤵
        
        PID:11400
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        497⤵
        
        PID:11460
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        498⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        499⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        500⤵
        
        PID:11836
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        501⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        502⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        503⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        504⤵
        Drops file in System32 directory
        
        PID:10920
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        505⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        506⤵
        
        PID:11544
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        507⤵
        Modifies registry class
        
        PID:11768
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        508⤵
        
        PID:11908
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        509⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        510⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        511⤵
        Modifies registry class
        
        PID:11356
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        512⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        513⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11860
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        514⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12132
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        515⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11304
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        516⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        517⤵
        
        PID:11928
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        518⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        519⤵
        
        PID:11872
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        520⤵
        Drops file in System32 directory
        
        PID:12224
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        521⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        522⤵
        Modifies registry class
        
        PID:12016
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        523⤵
        
        PID:12324
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        524⤵
        
        PID:12360
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        525⤵
        
        PID:12396
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        526⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12432
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        527⤵
        
        PID:12472
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        528⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12508
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        529⤵
        
        PID:12544
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        530⤵
        
        PID:12580
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        531⤵
        Modifies registry class
        
        PID:12616
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        532⤵
        Modifies registry class
        
        PID:12652
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        533⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12688
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        534⤵
        
        PID:12724
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        535⤵
        
        PID:12760
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        536⤵
        
        PID:12796
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        537⤵
        
        PID:12836
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        538⤵
        
        PID:12872
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        539⤵
        Modifies registry class
        
        PID:12908
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        540⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12944
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        541⤵
        Modifies registry class
        
        PID:12984
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        542⤵
        
        PID:13020
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        543⤵
        Drops file in System32 directory
        
        PID:13056
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        544⤵
        
        PID:13092
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        545⤵
        
        PID:13128
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        546⤵
        
        PID:13164
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        547⤵
        
        PID:13200
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        548⤵
        
        PID:13236
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        549⤵
        
        PID:13272
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        550⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13308
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        551⤵
        
        PID:12352
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        552⤵
        
        PID:12420
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        553⤵
        
        PID:12460
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        554⤵
        
        PID:12528
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        555⤵
        
        PID:12608
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        556⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12660
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        557⤵
        
        PID:12720
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        558⤵
        
        PID:12792
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        559⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        560⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12932
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        561⤵
        
        PID:12992
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        562⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13064
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        563⤵
        Drops file in System32 directory
        
        PID:13116
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        564⤵
        
        PID:13192
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        565⤵
        
        PID:13220
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        566⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        567⤵
        
        PID:12384
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        568⤵
        
        PID:12536
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        569⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        570⤵
        Modifies registry class
        
        PID:12768
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        571⤵
        
        PID:12832
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        572⤵
        
        PID:13016
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        573⤵
        
        PID:13112
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        574⤵
        Drops file in System32 directory
        
        PID:13244
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        575⤵
        
        PID:12316
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        576⤵
        Drops file in System32 directory
        
        PID:11796
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        577⤵
        
        PID:12744
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        578⤵
        
        PID:12980
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        579⤵
        
        PID:13208
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        580⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12492
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        581⤵
        
        PID:12976
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        582⤵
        
        PID:13088
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        583⤵
        
        PID:12856
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        584⤵
        Drops file in System32 directory
        
        PID:12708
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        585⤵
        
        PID:12716
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        586⤵
        
        PID:13336
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        587⤵
        Modifies registry class
        
        PID:13372
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        588⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13408
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        589⤵
        Modifies registry class
        
        PID:13444
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        590⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13484
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        591⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13520
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        592⤵
        
        PID:13556
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        593⤵
        
        PID:13592
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        594⤵
        
        PID:13628
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        595⤵
        
        PID:13664
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        596⤵
        
        PID:13700
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13700 -s 416
        597⤵
        Program crash
        
        PID:13784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 13700 -ip 13700
1⤵
PID:13760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acqimo32.exe

Filesize
176KB

MD5
87054507e5ac1a4846f8cefabda4c8cd

SHA1
3fc3d6d5e32dd69705bb46f81b454567503aa10f

SHA256
cb4d271e28f19501ac392b937465c6f527f24cafdaa402a216a243d5394a7aba

SHA512
f5d5f8f3ed7721af11bac7e935ae870fdb2b8dec278430bb9898ae020c45c4d508ee0de3473c3a2f489c43b5c2a4d1628221a4738ae01c97babe38dacf654c62

Download Submit
C:\Windows\SysWOW64\Aeiofcji.exe

Filesize
176KB

MD5
5ea86852f477772bb5cf0ea041f2655e

SHA1
d988e62f21e61a353d96c9cd534979ede79fc159

SHA256
ddf78f349fe29ab7c40f60fdefc8817f9d88c84a8b520d7f383a517898c18819

SHA512
c57ee3680f9f29e0636febdb22120404cd628820aea3c61d0a93b555bfd2618e763b53e1377132eabdef091ac2ccf28980bf65e0611a4c523a7e048380e2d1ba

Download Submit
C:\Windows\SysWOW64\Aeklkchg.exe

Filesize
176KB

MD5
fd1949b2c6447b0aed27ce71864f37de

SHA1
18bc35524466a2d992b1052ccdcb27306eb82290

SHA256
5b4efa7806ef2649a83990b543d81a3118090ae2cd8316665ff2e6423e554c67

SHA512
4100ad9d2bdf683ccb5152a334aca43dcdec4bba16da0a7f407227ed5e4ff663e287c6d1b8504bb0cc6eeb929e45ffa5a0d26b4193e06b00dca84e3b138407d7

Download Submit
C:\Windows\SysWOW64\Ageolo32.exe

Filesize
176KB

MD5
c33e9824da61ec00b7a42d8bc9025b03

SHA1
6a4d0167b5bb053257f0220de0ff1f1a1d1a5318

SHA256
881c9ab1015e4ca82d333533f6b88b5c8fc41a0df9f9f3d55a7f158a98993d05

SHA512
393b987965c0fbefb8a3ec26d5ca659d99490b7f30a7ea479af4ceece50e49de8b24f546e6c6cd1201feba6b72b0770684a8f3437144c1748abf245888259f85

Download Submit
C:\Windows\SysWOW64\Ajanck32.exe

Filesize
176KB

MD5
7380550d958ca90df2be70598c0e18b7

SHA1
930d6af16f7791054184c5774b8a3f1c71fe858f

SHA256
e6164bb2c2e62457d7364bdda9d878d763bab0b5a1be3d190bd06e308759634a

SHA512
e6d97d52c9d83918136014ea8404a8b7c8b508a6b3f1f3aec89766bb4db4bb23ad145d643ae0dad5b94ff8947fdac75c847d9faaf90380ed15045e5113c2943e

Download Submit
C:\Windows\SysWOW64\Anfmjhmd.exe

Filesize
176KB

MD5
7be538ed4774e4e88e8eef294c40201d

SHA1
810eb43f1bb8fd9101d422c75163a78519d5d2b7

SHA256
a84327a0cc9e7a653ac8e26f91a77edcad009a643d9548faf9dcf0aa85d85dac

SHA512
72c8a1acdfcd16acbf6d331f2ee47efdd411b0dccc694172c9929498905c1e1ccea557adaa306e6f8653168b24aada087bf83610eacb213b4591c400afc1381e

Download Submit
C:\Windows\SysWOW64\Baicac32.exe

Filesize
176KB

MD5
bc111cb92e6965c9504263ba6d4a2f23

SHA1
ea1d27fad61e44fad233981766d28d22cf4ab1bb

SHA256
e237ee37c8de862952e869156fa7a6ad3b4c0bbbf95ece4cbc7441a0401e72cb

SHA512
1daca2bcfb88914db8e8fc81bde2de1b560ebd1ec9e99772a1c683f83cd631647eebafd8d04d61a10a4e59a4e82c494623d23e9ce741efbfdfdd38bb5ae0483e

Download Submit
C:\Windows\SysWOW64\Bcebhoii.exe

Filesize
64KB

MD5
80fe770ab1ebe82a2552731c2b7a149e

SHA1
accad8ea3577bccd532490fd4805e17486586f3a

SHA256
b70f38e12f2b26b7bb057aa2635aa1a95e7a6c0c9a0fc1cff4cc375c101f0fad

SHA512
b804f0a38f9af39e090c8275f945ef40c633f31c9d0edfa01160ea66ecb6f8d4819798cbc36b9e945ce7c580c4e6915ff3f09cda24b5420f4f1315062472ede7

Download Submit
C:\Windows\SysWOW64\Bcoenmao.exe

Filesize
176KB

MD5
219d67ad4dc1fdf1b1c3cc8a7f591094

SHA1
cb16e021832ae22d2ad13d403c488a8e91225d34

SHA256
66492ee5096e526df8a309ac85b9a9f814946c4c3afd25ee4f4f424a06ddb6bf

SHA512
c3c7ccb7c82270a663748e8ad8da63a492af9ca87c7a3f75296fb6d196749c631156266544a85f7157461772195245164eb1704d5243492c95e9bfc30a23adf3

Download Submit
C:\Windows\SysWOW64\Bfabnjjp.exe

Filesize
176KB

MD5
370d52d3c3a177f4922b5868ae22052b

SHA1
306ec5563735394f3ef221f90a84fbb21edb1afa

SHA256
b38bc7c30e48cdadd2c696f14631c21841262c830f44ffe9eb54fc001c474ce2

SHA512
ab2879f7deadd59f33951e4b999b65cccbdbbd5020d591d52622fcd20644e3193e619ff47fac4919c2de720f07b167be1f9e2c3d4a48746d3b817a2496130502

Download Submit
C:\Windows\SysWOW64\Bffkij32.exe

Filesize
176KB

MD5
92c2ba1f6dae50ec94394e372b4343a2

SHA1
cd0c1b1b7680dda41de669107ad4f12beaa433d1

SHA256
53cde21fbd5c795e1a60628cfd0f7375b690f7f108472835d92bc5c7c18b1195

SHA512
c96c80e4c3b7f780d4f0af5cee1d615d56dcdd9149552d0b73ede7febf98c4479e593db3b007b8eae33232e62bb1316f2a44d142fd25c7acad9abe3842da9857

Download Submit
C:\Windows\SysWOW64\Bjghpn32.exe

Filesize
176KB

MD5
d1d0f308edade882f78a26b17a038886

SHA1
67e54d846e70a1c81f9e3d26ccd0f2fc59d0324b

SHA256
5862cbbc2244cee4ec7050c1d2f27203b63f5b370ec80bebf345df86ff7aabb3

SHA512
07b21eaf3e4b5a5aa518dcab0bb796df5168757997def410da561c182fb0c0f9d479b46626482afdc5b79109623fccc280391b518384cc219d31cd06e84f9c50

Download Submit
C:\Windows\SysWOW64\Bnbmefbg.exe

Filesize
128KB

MD5
151660b7ee38e029c1ec8835ebf13751

SHA1
0111b83bdd4f449faf148640a486f2fc49a4704e

SHA256
4052721ae5c9795330498603003fe780f3561ee002cfbcf1dbb4860b7368def6

SHA512
fcbda3bb531389d6c2479f39959a03460d151c57ef705a0ba648e1f6e991bdd0410361a43d1f032de18a4cd3b9729f4dd0a219f2a38d302e3051140743464aea

Download Submit
C:\Windows\SysWOW64\Bnmcjg32.exe

Filesize
176KB

MD5
844a4b9495f2c57a5027a076d6490c1a

SHA1
d56ad8930089858c645f0d27c9227f50443b4a3b

SHA256
64c30486ae81bbb30d5de930d00a5d489ba1668d1f77b48f4b858e0a15d3daf7

SHA512
b8e8e23cde132246ff4bd6852db3ecd393227f5b899c96ff297e141b2388888e3648da36cddfe6c589751871069df3c2c0f915a71a50dc7651310ba6a178d57d

Download Submit
C:\Windows\SysWOW64\Caimgncj.exe

Filesize
176KB

MD5
98ace4a9c89739f00650147131d07307

SHA1
ef99336ea3542c0413218af6eb3e13ee61eb41cb

SHA256
069e263c202260972864c360dbaf07d161d5e8acfc7ea0a04a6daf9bd1dc94c0

SHA512
fd3b39b58aaff352be76860babe7c150435b5f2e72a579d63e54b4bed78bf21ce2703499278bd93ce0bcd16cbd2336de3a4a7715f5054a1bb1acedc4d43e4f3e

Download Submit
C:\Windows\SysWOW64\Cakjmm32.exe

Filesize
176KB

MD5
0c82603ab88b563390d5901c9cc5e581

SHA1
006b046ef14489cd4e4710c6c8a50cf3e11a72ea

SHA256
94d5848497bd686dca6cf77f5ebeebdd8db9db3f8f3d64c059d6df6d40a3c7f8

SHA512
54ac1734cd194d37f2857ca3229e941a01c36ed0bbcbaf5fb155afe0540d1ba1698df72e1de1e4c8518f42407d4431b97d4a297c30ac2838c55d1d12294c3807

Download Submit
C:\Windows\SysWOW64\Capchmmb.exe

Filesize
176KB

MD5
ce49e2b1695ed0f970eb3688c83f492d

SHA1
b741149da62fa8cb562828d38fd3cad63ac6c5e1

SHA256
cc2ba58d24c545cc42cb8bc1c95a6c626f7cf10b0faef5455f6318f808ac3d86

SHA512
8016d21bedc01644e2f23a7f961de82a4d63fc60be496df17cf28b13b5bb7399776af349b1797e3b55a285052d32638c2063d653572068cd9b9cc97635f2b611

Download Submit
C:\Windows\SysWOW64\Cccpfa32.exe

Filesize
176KB

MD5
fb529eaeb045f60e6b566f1402e87f6c

SHA1
befcf1fa8aeb45b43c180d3f2b545ea98e282bc7

SHA256
8ff01088d8588802bafc25c517d702edc3e43a1fa090ba0fcf34392409753d3a

SHA512
970ea9770312cd193d1e0e017cce504b61c854405c04e23772e4274f0c9be6b523abfdc52a12c073ea2fcec0f0e041e5d0e551a166e3e29ea4e495bb2554e292

Download Submit
C:\Windows\SysWOW64\Ccjfgphj.exe

Filesize
176KB

MD5
26d5723282a1a219af150d5ab6ad0b6f

SHA1
4c20893e8930e1a132d8e3a7a3e8676c7dc0b951

SHA256
d864427da6cb44e0c2860927b98c38c74bb482ecadd891f07b8d8059b390fd06

SHA512
1c45f6918c6a34f3b663259f45301b5bc7e07c0a86cc881a2c4e2df5f4e41992a1f2d5a75917f18f7cd58ee7457c2bf117d39481160e69eed33f4cf53543a297

Download Submit
C:\Windows\SysWOW64\Cdabcm32.exe

Filesize
176KB

MD5
feae3b6eca9cbb40f30c2c1fd9f9b565

SHA1
275160eafbcad26d91f122ac85e6ea9816c5ae01

SHA256
64e1df3cd43dc81de48a8ab69a8a6d6c7601967bf6dd89a016aace6ebb138437

SHA512
384190ac81b0db709ac3f986b1d6168c433d192f7dbd32f629eb752f806c77dc7f7a6bb5193a63ef8abc705f48875478ad6db325b48421ef29a19432feab3f10

Download Submit
C:\Windows\SysWOW64\Ceblbm32.exe

Filesize
176KB

MD5
d7fa81e5f10c07385ecddc21168b20da

SHA1
ed087e37afa19dab63b01d82358872fffa0bb68a

SHA256
88c3fa0b9c5fd69e820fe6c919177128f402189b67778bf8aab62536d3953e42

SHA512
bf30f1b842e2725fb1e2d8a44b2349d691c067230470cbe2b00ab58f30e0de1cbdedd5167492c5850ca04bfabe5ddff6297a13b910a665b52d6e08d8959c01e1

Download Submit
C:\Windows\SysWOW64\Ceckcp32.exe

Filesize
176KB

MD5
e6092ead31edbaa2313bca3a34336c43

SHA1
620a359aa7b75d8fd9603b17a9b68bfc64b7258a

SHA256
54800d6b5535f1d068aa676f5c75f0bcb8a4f4de7ac660a6f0f38a27793ef6c9

SHA512
c576e16d85e883af0a5e48cd6f009dec6b3c8d840b5c84561187e6bfbb27c1027f0e00434386ecbed3963fe6a7ef270831dd7e413bb5450aa369b8ab00198442

Download Submit
C:\Windows\SysWOW64\Ceehho32.exe

Filesize
64KB

MD5
3a24372eddd2a394242368d661398548

SHA1
69f8537ba058d46a5d2368e66e5206a743b5fee9

SHA256
4269180ca017a54d10dc769d72f363d65289535638378e9999dc4283525fcfd5

SHA512
d9ba165fa15771d39481241ce78021083c6bb086ee706af39195570f6a822b328a3a6af67a776d1da31b500c6559e80827401a32f32ec996539039609e1609ba

Download Submit
C:\Windows\SysWOW64\Ceibclgn.exe

Filesize
176KB

MD5
238ef125520f471cd494969dc1ecc7b5

SHA1
d533c77b1b90ab02a10d207b9d2df7826fb043ba

SHA256
ec38a1fd2414ddfe782941319937e9e52c832ab79f6d236b65c98ce2ea598d09

SHA512
f502a5f6e74e619b485dd11fcd9d0565bb89b6579149ca2124cef574e4e3984fc7d949cca974bd4cabe880c0f1ab3fa83defa79ac535a6f667e5d6b8a3e32203

Download Submit
C:\Windows\SysWOW64\Chphoh32.exe

Filesize
176KB

MD5
7f5dde311e4f7744a5db7de73389a5b4

SHA1
8e5dee069fcf06a47d959030de3ff2bf0f0a0266

SHA256
717037fbe5149e0f081f9ee91052fa13ee2a32cf97608ddf3b636fd0f9e30718

SHA512
9056346500ea2825fd65ea2bdaf6671e66d7de9e03268e798fc31a05e386988d972a909e3c7d688d67df8a0e8e0ba735780b23f2902a611acab70c3e18d98a27

Download Submit
C:\Windows\SysWOW64\Cibank32.exe

Filesize
176KB

MD5
caf92578e042b5960abde98222dd8725

SHA1
da52564c20c6d2d81f7483c11ef511d9f4c93aff

SHA256
a81467d498b6f68c6633b2be6a8248a0dc543adee504537dbbfb28cb34b5a112

SHA512
1deb90a73dee7cca03627ba0fe16bad01a8a856a482099173d7c2cae2a36d467edf39c05ff61ce815e865628e25c7a92c2c65b0f88b625bf960a77a8cba01601

Download Submit
C:\Windows\SysWOW64\Cipehkcl.exe

Filesize
176KB

MD5
f12b286a4e5c76334fda9015e6b02976

SHA1
22154a6526b52eba5f5480d89f51fa13a75ccd46

SHA256
18eda9f1e5d5994f710ae9029710cd3d5d21272bb1c54ea2736d91eb2499de58

SHA512
94d2893d9a5c7df96f89514b43bc356a93b8ccdeaeef3f50771798be116866238e3e48ac729a27a0e3e6a67c40c4f788762672ccb18a648f4bb6975ef84d8891

Download Submit
C:\Windows\SysWOW64\Clckpf32.exe

Filesize
176KB

MD5
3c90429d6186b14733209b1352746e8f

SHA1
b9c3fc89df19f24607f633f12ffdcd8d649b1ecb

SHA256
c623c00ae983b62a17375c70fd1a9f1a7d6891ff8ce3d38e300b64fd21ce6570

SHA512
5e5703744e8a46813215a88ff7eb101eb0deb949e056fe9ebf69d3757e0d3792157a3e613b64bae21a76c96a962b6e6ca9417b2c4ab883aba5c5310e261f9257

Download Submit
C:\Windows\SysWOW64\Clnadfbp.exe

Filesize
176KB

MD5
8c8e9bf09b6812af52cf75844c79847f

SHA1
cd727aa4f6f184861adffe116835ad69636a39e4

SHA256
4266c57a767351558f450b627f7d5429e2567df48de8e1019d64cdf6ff106b67

SHA512
6970c027cd6ee430ef637ac904fae60f02ba2c9838cd94c4016a292aea099e13170cef806d8a1e0efefb3a4093c634be6672c08ba51492c0ee37403d0079cf3e

Download Submit
C:\Windows\SysWOW64\Clqnjf32.exe

Filesize
176KB

MD5
48331ef5dddfc8fae780d786c087305d

SHA1
2496150392e894645a4a752d22d9466e99724de8

SHA256
530c5296b7e383b26b414f6caaa0d2db88554e1f10961398882d68016985f33c

SHA512
93a91f74163a32ffa7842e8d8e3a241d83aeb1a54efcd20972bcfc64662ed6698c8a988db501a47a293a660cc5a14645f423bf0eddd08e88cff31c6a43f9789c

Download Submit
C:\Windows\SysWOW64\Cmnpgb32.exe

Filesize
176KB

MD5
d2f1f01d087127367afa7e8e42284605

SHA1
4a57af3b70d1c79691d0a03ad80eb272dfee8456

SHA256
d90a236eefd2a6be986d51d585cd4025af10bc1e75bd3764b600ae8c5cff9b4e

SHA512
051e5f9b30ad9c1e80f770ef128cf7ab0d1170c8b2d52fa929a24444febf9ed36ef09d8f492e23a389c2c55fbe2a9e47ea9b1ec8162507522a31337c8d2f6dd4

Download Submit
C:\Windows\SysWOW64\Coagla32.exe

Filesize
176KB

MD5
c80e638297543a1923f35dc3bac4a041

SHA1
f5a32a5e362589541f925eee32766abba83487da

SHA256
f4318ab029591bf7ce8f4f91771d5c3ad30e2016c5a2364c2f1a471cf4fb802c

SHA512
83bdb75c7eb52013103ef8d1ea2f9dedf632f41e990e6cc26d6fe83fc1ddb302bcfa1eee608213633d557cd391f37bb306d88ecbb6aa36260fe8b0b3d59be740

Download Submit
C:\Windows\SysWOW64\Cojqkbdf.exe

Filesize
176KB

MD5
64b29225d3a8cd9ee3a4f1f242ff6c5b

SHA1
f55100cfb4ffe0939cdf35c7db93caaa201cec4f

SHA256
b93d7e43feaf8988a97c15fe463367e498570cf6b5e08b3aea4359baceaed32f

SHA512
fb40db86fc347cd609f36f48fc1bff41deb166d5aef37b1921bf11b2d3366fc81206dfb3cc8ea46b4791355b217f55b0f17d30ad9f51194d9882d88daeeeff36

Download Submit
C:\Windows\SysWOW64\Commqb32.exe

Filesize
176KB

MD5
ce15720c791717bd22b0568795133ecd

SHA1
11ea3963a23cfdb5f9c6e2617136790a1994e50e

SHA256
a4fa821ea2f7939777975d894f4483bdbd069f835084344d6780563daf59bb8e

SHA512
d171c9d3cefe6901d70630bb346943811e8284226bfbb0fb9dfe0cba7e8f0ab9bd226daf8db0340a637ab4568850befa0ab4c428cac58352ce97f3e58a83971d

Download Submit
C:\Windows\SysWOW64\Coojfa32.exe

Filesize
176KB

MD5
72ddc6fbdd9ade16c3a05d2c39d2aa50

SHA1
a9773b3e48bf1cb21d4c56d3df89072c9a86ffa1

SHA256
c987487cbefce22d28ad5d4de05e55b730e28be2e1122d9b13c0896eeda3d6bb

SHA512
63f2d80768f7e5ad934bb8d92579a61a8e2e2eb2b727b99ab57f68437895f112015411963a337b01e8f9ed71af0a73f72c1fe02f00c2cbfcd670ec4f5b4f0c5a

Download Submit
C:\Windows\SysWOW64\Cpgqpe32.exe

Filesize
176KB

MD5
436dd06ebbf1dfdce23ec857af06b743

SHA1
2166ff829d93315d5196be9af15742fc21b7574f

SHA256
ed5f61f33de7d17313f50e238a659bea36cb73b17ea95ec3d9b0c60847b0d95b

SHA512
3fceac8a5ba457043e3f12b30a611e4d8f150082ae645ab10c4c517d460a7c444c33e569f1b79bff18a0f00bbb4990cbf7b9e9214c7c4f10b16e4d3eecbe13b5

Download Submit
C:\Windows\SysWOW64\Cpjmee32.exe

Filesize
176KB

MD5
a389957288c33dda6ce38245e078516b

SHA1
b7ce9b7dc5175b22994513a4b08f2738fbca052e

SHA256
3ba996640d89a0d0c7ce27b3de23f0314c25da75b67837de719dd7fc5b13e71b

SHA512
b4d5305a59b74d440edade4abddbb2022a53d1d3a090d39d88dcc3f7dcffcc5394be5bef34f7f5c2a5c54833202c95ebadad701f0894c2d7c2145e24344de176

Download Submit
C:\Windows\SysWOW64\Dadlclim.exe

Filesize
176KB

MD5
28e7f2525ce8f404c1cf707c154e344a

SHA1
504e01646562aa6d1f026e4c64f60541ac6036fc

SHA256
e8f07a0464ec2b945f6f4433a3a14aff0220ce775102556875eb434ff72310ca

SHA512
e7ffaa3b1365f7f61e1dd98344029a3aa01c00446d6b6428ab71bbe948e430611947555855150745cedf2fe4b04b5caa1b34682fd352161f7b1f203573a95de2

Download Submit
C:\Windows\SysWOW64\Dagiil32.exe

Filesize
176KB

MD5
e79b38b30f04d08f4e8e8720930c229a

SHA1
d13044f75af8a21f879a2c668cb53442cc31a70b

SHA256
2b0fa592b35a0f75ab87eec267b17277a6d4c054bbc99dedebf6f071d71040ea

SHA512
885a2bbf8a60c6824509d56134f05fa34c146e3a47d5dfebdae9b42007ca47a8965091b847446d1909f122dd5b85300ff63a43cda37efe56263420c794f408e2

Download Submit
C:\Windows\SysWOW64\Dcopbp32.exe

Filesize
176KB

MD5
ed38e52b64d2ae927d59794158b9f9a1

SHA1
005c29be6d66b8ed290bfe972317883362b49ded

SHA256
af6926d34bdacacd8e4af0e89ded745133d97d820b75cd71db349dc3d2e45269

SHA512
5baa13dc4df8b809e8f5f34d3e875251ad7da40e9b8ab9507b4c9df61201e460a78d699741ebc876f6026cde305898a6da41db6b55674b7cdba91a993e9dc3ca

Download Submit
C:\Windows\SysWOW64\Ddjejl32.exe

Filesize
176KB

MD5
dcd75923569edf82a340fa7f7a50843f

SHA1
85341724aa5bd9aea8b57128a928ae62c0bcc00e

SHA256
18fe81c0b294bd0b1c321d93785c295ae02c0a7a2c0bf3c9aa20c5ba31c7e5dd

SHA512
9136fed2e762ba20b44f3dc7040580b8b168889ce58c72427263cdff01266bc5677b44c26c66fe2668857f36de2b97eaea9bf9e5327d3dc469e2759345562440

Download Submit
C:\Windows\SysWOW64\Debeijoc.exe

Filesize
176KB

MD5
125a10f3f81b74643fb1c13daf61224a

SHA1
bc439b5077fab7c59cddb30a4943c578fe0cf311

SHA256
25891b571872085708dafe3fd186142a72c88e80caeefcfe47b1048ffec1146e

SHA512
b973bd303772db5b5e77eb3eca129eab9e007e35c461013c97e6ccfdc57f1d55f8099a54ffb823f8195a5a829a4b7dbcce297524e978f39a80a93f904244f625

Download Submit
C:\Windows\SysWOW64\Denlnk32.exe

Filesize
176KB

MD5
6e9581e0cfe8f6ae5a22e78e7e77065d

SHA1
7b1156debd22e72bc6399f5dace155d742265ff0

SHA256
ee917c8bf872953768be56f771bab72238d1bd4a28ef6410f37d7a404562bb14

SHA512
33a617ce93212a638cca1b7a80df5d442e8a31f61cfd63967d30f4433818e08ea7a5d91555c70b2dcbf49a5810a381194bdfcdc3422e19490d0b9bea6f2ed404

Download Submit
C:\Windows\SysWOW64\Dfpgffpm.exe

Filesize
176KB

MD5
3afd6a58469b832760db3e97036d0498

SHA1
370300e1714d39e79d810db5d152bee5f1d2a288

SHA256
c78d1efa48f47330064ca4a4b36fc818e7a34edc082cc0827c772c5efce8642e

SHA512
a70fc59681f7c712a51a6e19f3c0ca4142bbf3ac4216ec26b02026e3e78f73b826f25265a6f929d96c3b943b9af7ede08d90c7733391a26424d85298aefcf0e0

Download Submit
C:\Windows\SysWOW64\Dhhnpjmh.exe

Filesize
176KB

MD5
903d649119347da152dc33a87be08d48

SHA1
0d3567c88f128c3c3d0bc88c8c6a66a4662066c8

SHA256
4d9ba70c648a440342e21ad2f6cd8a5bface45503143811f16131ebbd15b30c1

SHA512
b3eda9045dd0657906ef83d2a0a1881986c07118dc5edc89a72446011ec64e0a2a4dcaf13e78ae5c1996d50ed5df3dee079f0d17b156fcde504f093854430c10

Download Submit
C:\Windows\SysWOW64\Dhkjej32.exe

Filesize
176KB

MD5
8fbcbb09fcac8ae76a10f310a10aabe8

SHA1
7ed6e5c584ff8e965443f3470bfb0c2e759e27d3

SHA256
46a480f61739e142eae36e1547e40df0118f94516f5771ad64acd850d8f907a6

SHA512
8602870fe7c7b5668a5be08934fff293573106cc55b29a241bda3ebc8a356d1ef8dcf0b7c2d8df3e90b7761c2f55540aefa58907d551b4dce10c8738f7acd44e

Download Submit
C:\Windows\SysWOW64\Dhnepfpj.exe

Filesize
176KB

MD5
d05c7371ea6e9069c86cfa86ca073e37

SHA1
a3ced82cc1cc6932339103650b2c9f7914737757

SHA256
99b0064d4ac6b7231d3edce38afff92ef8613623358b9c7c750fe4775ac5f398

SHA512
63c4dab5794c11e6d3fa6a8df7f18907a18d60a1298cc19398bd208d294ecf6f98b7a61754091086a3feda1c6a2f96ef4b871ebdae0d2e33814391064213d977

Download Submit
C:\Windows\SysWOW64\Digkijmd.exe

Filesize
176KB

MD5
f446ef5c5b9207956a116d02237fe7db

SHA1
aadc7316b89963410e7697bdba61a169b62043b8

SHA256
b56da781f3f67cb9fcdfac7eaf7b325eefb7eb8d04cf37163cfa608fd5e4e2ac

SHA512
a3590d5193699067ef974d76a1cf5380649787d9fd4f82a4bf6c1e727a0c665679869041c342aa86dd88f0b9b40c54010b800afe9d4def125322a05f329cfabd

Download Submit
C:\Windows\SysWOW64\Dknpmdfc.exe

Filesize
176KB

MD5
bee7b45ae016c2f271601ff585936f8c

SHA1
ad2044661417637478d189e756c12df94cf0a01f

SHA256
8aabd7e6be7027a1a766ba3a143c09610a209d176aca28bd04cbf0b20ef5cce3

SHA512
647842202126b7fa73603b2272d0b606d2cc6af0b752f2810bbe6c5c7acf5e7b087d660360cf0c21b47e537574b89e864c8c9223fc6fb0f258d6ef91355ddc62

Download Submit
C:\Windows\SysWOW64\Dlegeemh.exe

Filesize
176KB

MD5
ce5e061e70b1b29a32f815e673e6ab4d

SHA1
4bf7e8dac5002c628f26cf80bd1200c0978a30d5

SHA256
fc30c2e24433e5dc075ed35f9952c22db33b363c4d3db1e64acdf96c6a837325

SHA512
cca4932207a21a1216d24eaf7b7e2a88252fbaa1ea949101d8a4d9a4a6c4f65675a9816bee17a1660e989fff6cad7281bd390a8c024fcba7364078e7a3443d89

Download Submit
C:\Windows\SysWOW64\Dlgdkeje.exe

Filesize
176KB

MD5
d9c0227bbb1a887696ce96962613e1cd

SHA1
9bb7abf1af7bcc6f6fccf1e2ca5b39f9cc30e499

SHA256
8a19b37f2c5f81b71b415df094ae6060fd88c2a61876acbdd782fcd08fba6f3f

SHA512
76babdd9fb5af2a8c00a907afb9c9b796227acb5aed2b1672dcaeb1357b54632ec3995ac2410dc66fccfb7875a6116b215e35c785a4fd3065606292a4be92930

Download Submit
C:\Windows\SysWOW64\Dllmfd32.exe

Filesize
176KB

MD5
258ba77091dd6257a6744ff3f2dc6412

SHA1
bd73befc50133b1751ddeb2383d5feaae4ee9eb6

SHA256
695fef424734885076dec295464d5a033c22e76b94273a111a00612b45a1589f

SHA512
f82483bb41c66b704cb70cf3f1d8f9e54c8505de643c0999e46bed1703203d0d36701749cc5a95512e9413fa5ab5e5e5601f43520070a0aef7159015caaf14d6

Download Submit
C:\Windows\SysWOW64\Dohmlp32.exe

Filesize
176KB

MD5
9786f17765f8e692a70bda9cec26f1aa

SHA1
4b021632fab45800e45119eb19f3245e5208edf6

SHA256
a87b4d29e8fe69773d89fe2713ab3026e57f58de1a12fe83c4a25d30abd2d907

SHA512
5b0e78edd43e6fc79607461abbb312c30fc395e74cde9c1955ae156a730aec000146a8acaf299afae3c507545a0f44dc3c0e12188eaf108830f877821c38a0d9

Download Submit
C:\Windows\SysWOW64\Dokjbp32.exe

Filesize
176KB

MD5
4ed8bf8335dfc222b1e91929611d8f4f

SHA1
002b6724cb38f0b778a4677bd68e5362d484a648

SHA256
f9520f0804de3fc19239d5752047a1fa3bfa21dd0a25ddf3aec4c3e546d3fc1a

SHA512
0d97830a5a7d8cdefcfd7c63b68045a4455828389c4adc6ca523066df870ac95326f9849ae1933d06b91a99b1edcbc9709940a9c09bc2ac4aaf66523e99b9010

Download Submit
C:\Windows\SysWOW64\Dpcpkc32.exe

Filesize
176KB

MD5
c1665f136e6658f80280f4b066330bfb

SHA1
97d39d67e22f87ac454bcc69c8b4f1903241e623

SHA256
82f56abf4a4f31bb811fd30f03d6eb52643211c0f4b923dd232a1e70c06875c9

SHA512
3ab5dccbead401d00ecdb87ff26d48630920c2af7d3bcc0485eef27a84e1f7ba99f3a9e6d124d86c293a56070b44af147360f332c7b739ff5c45c593c367986e

Download Submit
C:\Windows\SysWOW64\Edkdkplj.exe

Filesize
176KB

MD5
14c4fceedd531dec19cfcfd4a99043b1

SHA1
c1b51c6c715b43a3242e83e8c70c3d94dd94ef39

SHA256
ebff80e77a961ee4c35f09bb68ee744c991c0ea3be0e6c2c438f88ec8a654770

SHA512
11c71867e19dcdc5dd647902c30e8e520ce23d9a61c2f13438f99aae7bb4ba230d430b3205af4b5c1a82b0201f2d4be08e31b2601da04ecb1ea6d739da412c37

Download Submit
C:\Windows\SysWOW64\Gmlhii32.exe

Filesize
176KB

MD5
dc522bb30a1733d88f73233390bff653

SHA1
6d728ee7507d1113b593002248c0f5295a3bb1da

SHA256
911de4bd66889aefb66d53d2b670caf41a782ff58d7090a64ae3ea323f22427f

SHA512
becd73c677e114394ea713db358dd6cb464dbecd9fbf5bb12fa98ef6314aaec39f02fb1ddb2dd8e705b31b8e68f94fbf64a93eff96516bbe5019ee92878b3e23

Download Submit
C:\Windows\SysWOW64\Haggelfd.exe

Filesize
176KB

MD5
b3f64713bfac7eb3bc8dc01a76e7ebc2

SHA1
b3db3ec93fdf7d3590d96db5c7752353da5e515c

SHA256
c7e2bddee3a2e5933d59e1a9c5006fd27ed6766c22a8f8fd7c863863eb755047

SHA512
fc3868f034b508ed3997ea2681873bb61a5f944db80ca92179b7e585925825dd223db1455080bb32e305ac6f0afd6b30b240b1955cd50871b82a92e0a54638d4

Download Submit
C:\Windows\SysWOW64\Ijkljp32.exe

Filesize
176KB

MD5
585f0df94e6b062d0daca05ef513d27f

SHA1
f1eb8d26edf1ee108bccae6d7671acbd218557e8

SHA256
96c88c4d68e10d3b2bc5da6882dfe7ff1a785150a3a81daf2e389e9a01d4a318

SHA512
6a7f57b748315a3aff90c8cd097dbe7da02bb81a7656df4cfbd7e7b40d1292f3ece982d119927cd28af936d52af78d4a9eb311a2b34dc8957871a744cc5a8e93

Download Submit
C:\Windows\SysWOW64\Ljmpfbln.dll

Filesize
7KB

MD5
dbb1a4ead22171a89408e5590bc96c77

SHA1
19809b139ebae1484b10410fc87072fac57ea4ce

SHA256
b3b72749a030ff2c4ecbe7061d3bb2ef269a7cd76fe8b1b0add21e76581d7440

SHA512
f27668713e3576070f48c8ad3ff6776578fffd218079b4d28bcaa3138641b596f076b7c5d01d39725790bd91a22bed3e0e1079d49ceb7fd1910bff792ac94b2e

Download Submit
C:\Windows\SysWOW64\Nngokoej.exe

Filesize
176KB

MD5
9d89e817255133e82ba2218c55b7ff89

SHA1
dae5002236e85e3b9be4d3323a84f7ad52083e36

SHA256
b13e0a855978ee43e99f6262d83a781d2e9deed3024666dedf0bc39eed61e881

SHA512
b39c5fa3270408e1f22630185b09084a5f05b655ad60fbd4ad84973c4af90757455421959975366ece7ecf39903211b335c65bd580c1d1ea3bfe64d783cb8c69

Download Submit
C:\Windows\SysWOW64\Nnjbke32.exe

Filesize
176KB

MD5
965f287a9838f4d7d6972a0b5507cfb7

SHA1
1ebe99b33e473bf1accaa9be320c535c2cf83809

SHA256
1b8410876227ea51d24f702e302b7d20ef7624e09ec0e63fcfe003294839148d

SHA512
4435ef223489bdf005a4262e951676e203eddb5dc61f588aefb1ade5229cb7aac75c0213859a8b5f3ed89ceeae3bf9196a3f92e82d0d212dea232ea15b9055a0

Download Submit
C:\Windows\SysWOW64\Nnqbanmo.exe

Filesize
176KB

MD5
a49526722da1cc993ea03c27d9209b08

SHA1
67fd71bbd66fd66618ce2f440b7afb4d5a48c26c

SHA256
432fbb33c2ecc73f29bf16a1f458276fa8f1b2a5b0e9a8104e8830eeb35e22bd

SHA512
fc89c5e0f882b6e8b4d9bb0d4aa1aebe47cc09e9445b7f55beb2925c2429ab76fb1a207c7c67ccfccc17f10c77449972b0e7fa09e8a0c4c0ddb60f1c0b1bfe74

Download Submit
C:\Windows\SysWOW64\Pjhbgb32.exe

Filesize
176KB

MD5
1f2c1262363de3554d77bd942cefd1e1

SHA1
ba365252007596712bb18fceff7cb7c98f1f1608

SHA256
9fc55b065306f48e4317615197476162da3f944d82865b4411eab7a14460198f

SHA512
c1e8fecab1bb56e7ab67cf250e721ac17553c75f48e03313ac89f69215582d97aa732cfd5b2fab9e512ec7cb8ac1d284b421a91f558d835277b1d56c2e865014

Download Submit
C:\Windows\SysWOW64\Pmidog32.exe

Filesize
176KB

MD5
bcd01840385437048e6e7281b052c68b

SHA1
df44b981e3b771e75158ff3aef1bcfb02430493b

SHA256
85da0cc3347175e9691f71be5b995ff231a2dae0db98ab4a837acddaedc37b60

SHA512
e4dbc486d01ffc655fc1930dca3c1cfd1232f6193f0017fda0ac4950a06d47f99972eaf528b922b5da99a434a48cef59f6c056fabb3a2a0637dbe9851420667c

Download Submit
C:\Windows\SysWOW64\Qdbiedpa.exe

Filesize
176KB

MD5
9206b1137c49137837ea0f7e2557d4c0

SHA1
8e41e09d3c11b6d6b8d14cb171a1e62a5301b98f

SHA256
e8182abfa99261bcff91d480ae810152a9eeddc302f0a85c55a08a790f600412

SHA512
333865bb22a0e27f9288ff493bd6393c51e070f47888a9472f124753fad840a7c96011c2f94ea88fa781d20891f730a2ce4902ee0712389bd67c9d3adc18927f

Download Submit
memory/60-436-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/524-398-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/668-262-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/768-89-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/940-16-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1080-240-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1156-278-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1364-40-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1640-447-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1756-52-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1900-23-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1924-362-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/1988-172-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2060-12-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2100-137-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2148-175-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2184-344-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2404-364-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2524-286-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2584-424-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2596-292-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2668-334-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2744-224-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2896-99-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2964-298-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/2984-32-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3008-404-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3064-208-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3192-144-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3244-0-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3316-380-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3328-350-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3348-370-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3360-216-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3408-304-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3432-195-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3484-199-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3756-72-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3788-64-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3932-127-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/3956-417-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4036-408-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4040-80-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4176-352-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4320-392-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4352-280-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4380-256-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4400-112-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4424-328-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4488-160-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4500-56-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4504-252-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4508-430-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4636-314-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4640-321-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4668-119-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4728-236-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4744-184-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4772-418-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4876-325-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4916-268-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4936-385-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/4984-104-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download
memory/5064-156-0x0000000000400000-0x0000000000439000-memory.dmp

Filesize
228KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads