bfca7b30847a59dc6669e837e58a7ae1414b37c457f2587ab0274d1c8be81d76

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bfca7b30847a59dc6669e837e58a7ae1414b37c457f2587ab0274d1c8be81d76.exe
Size

295KB
MD5

0b878f012719697340c7d4966a81546c
SHA1

9293baa9dea3c7b60568325c3d076b8bc4c0c89f
SHA256

bfca7b30847a59dc6669e837e58a7ae1414b37c457f2587ab0274d1c8be81d76
SHA512

33d6984a8ac1dfbc2a31a8e293f57124a725c98fbb8a2cd0b68e52c8e973eb60182c98793191d4a0e4dddf819290dd098e5e32d6f158d76e75317b518cbfd62d
SSDEEP

3072:6wgqiyO/awaWCm62jyOaWCeqmSu62i+KGyOaWCeqmSu62i+KGyOaWCeqmSu6+K1h:6XtjJtrWXrpiCo+BTPB

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckcgkldl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlnnmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nphhmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmoahijl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipnalhii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbocea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eodlho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijdeiaio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbbgnpgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anpncp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dagiil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dllmfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pabkdmpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhbgqohi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmknaell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndhmhh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbeghene.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfcfml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdcoim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkceffcd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpebpm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbapjafe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Blfdia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iejcji32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhfajjoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Efneehef.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbckbepg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ffggkgmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gcggpj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnihcq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aaqgek32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cogmkl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Denlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ejlmkgkl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njefqo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdkcmdhp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbgbgj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kimnbd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlopkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmdkch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfdbojmq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojhiqefo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jibeql32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lphfpbdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eadopc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlopkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmbfpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dofpgqji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbfpobpb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbjoljdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqohnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imgkql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adapgfqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adcmmeog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kplpjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkfblfab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnihcq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebnoikqb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpaghf32.exe

Executes dropped EXE 64 IoCs

pid	Process
3904	Dcopbp32.exe
4152	Denlnk32.exe
1396	Dpcpkc32.exe
5064	Dofpgqji.exe
1960	Dephckaf.exe
1216	Dljqpd32.exe
664	Dohmlp32.exe
624	Dagiil32.exe
1420	Debeijoc.exe
4612	Dllmfd32.exe
60	Dfdbojmq.exe
4116	Dlojkddn.exe
5108	Ejbkehcg.exe
3724	Eoocmoao.exe
1684	Ebnoikqb.exe
940	Ejegjh32.exe
3392	Epopgbia.exe
2192	Eflhoigi.exe
4592	Eleplc32.exe
1716	Eodlho32.exe
2780	Efneehef.exe
3960	Eofinnkf.exe
3900	Ejlmkgkl.exe
2304	Eqfeha32.exe
4344	Ffbnph32.exe
3116	Fjnjqfij.exe
4936	Fhajlc32.exe
1296	Fcgoilpj.exe
2544	Ffekegon.exe
2164	Ficgacna.exe
4364	Fcikolnh.exe
784	Ffggkgmk.exe
1116	Fifdgblo.exe
4976	Fopldmcl.exe
5008	Fmclmabe.exe
1428	Fqohnp32.exe
4204	Fbqefhpm.exe
2628	Fjhmgeao.exe
3600	Fijmbb32.exe
3292	Fodeolof.exe
1460	Gbcakg32.exe
4192	Gfnnlffc.exe
1624	Gjjjle32.exe
3504	Gogbdl32.exe
1500	Gbenqg32.exe
4824	Gjlfbd32.exe
2440	Goiojk32.exe
2520	Gbgkfg32.exe
1940	Giacca32.exe
2208	Gcggpj32.exe
2624	Gbjhlfhb.exe
4892	Gfedle32.exe
1040	Gidphq32.exe
4412	Gqkhjn32.exe
5040	Gfhqbe32.exe
868	Gjclbc32.exe
3576	Gppekj32.exe
536	Hclakimb.exe
4384	Hihicplj.exe
1948	Hmdedo32.exe
3492	Hpbaqj32.exe
2272	Hbanme32.exe
720	Hfljmdjc.exe
5016	Habnjm32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Njogjfoj.exe	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Qchmagie.exe	Qnkdhpjn.exe
File opened for modification	C:\Windows\SysWOW64\Kmkfhc32.exe	Kfankifm.exe
File created	C:\Windows\SysWOW64\Cfjbmnlq.dll	Fmclmabe.exe
File opened for modification	C:\Windows\SysWOW64\Odednmpm.exe	Ojopad32.exe
File created	C:\Windows\SysWOW64\Pcagphom.exe	Pabkdmpi.exe
File created	C:\Windows\SysWOW64\Fkffog32.exe	Fdlnbm32.exe
File opened for modification	C:\Windows\SysWOW64\Bjagjhnc.exe	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Ocbakl32.dll	Mgekbljc.exe
File created	C:\Windows\SysWOW64\Eaacilcc.dll	Qcepkg32.exe
File created	C:\Windows\SysWOW64\Knkkfojb.dll	Ndokbi32.exe
File opened for modification	C:\Windows\SysWOW64\Kmegbjgn.exe	Jkfkfohj.exe
File opened for modification	C:\Windows\SysWOW64\Kdhbec32.exe	Kajfig32.exe
File created	C:\Windows\SysWOW64\Nkncdifl.exe	Ncgkcl32.exe
File created	C:\Windows\SysWOW64\Efjecajf.dll	Klngdpdd.exe
File created	C:\Windows\SysWOW64\Nphhmj32.exe	Nnjlpo32.exe
File created	C:\Windows\SysWOW64\Ndhkdnkh.dll	Bclhhnca.exe
File created	C:\Windows\SysWOW64\Fdjlic32.dll	Ogifjcdp.exe
File created	C:\Windows\SysWOW64\Ehaaclak.dll	Pdkcde32.exe
File created	C:\Windows\SysWOW64\Dofqcl32.dll	Fhajlc32.exe
File created	C:\Windows\SysWOW64\Bpflfc32.dll	Anpncp32.exe
File created	C:\Windows\SysWOW64\Oapgek32.dll	Cbjoljdo.exe
File created	C:\Windows\SysWOW64\Fkmchi32.exe	Edbklofb.exe
File created	C:\Windows\SysWOW64\Ifjigbdo.dll	Hfqlnm32.exe
File opened for modification	C:\Windows\SysWOW64\Npjebj32.exe	Nnlhfn32.exe
File opened for modification	C:\Windows\SysWOW64\Mlampmdo.exe	Mmnldp32.exe
File opened for modification	C:\Windows\SysWOW64\Oflgep32.exe	Ogifjcdp.exe
File created	C:\Windows\SysWOW64\Jpcmfk32.dll	Pmidog32.exe
File created	C:\Windows\SysWOW64\Kajfig32.exe	Kmnjhioc.exe
File created	C:\Windows\SysWOW64\Ooojbbid.dll	Anfmjhmd.exe
File created	C:\Windows\SysWOW64\Dllmfd32.exe	Debeijoc.exe
File opened for modification	C:\Windows\SysWOW64\Febgea32.exe	Fafkecel.exe
File created	C:\Windows\SysWOW64\Fhqcam32.exe	Febgea32.exe
File opened for modification	C:\Windows\SysWOW64\Hmklen32.exe	Hbeghene.exe
File created	C:\Windows\SysWOW64\Dhkapp32.exe	Dboigi32.exe
File created	C:\Windows\SysWOW64\Hoiafcic.exe	Hmjdjgjo.exe
File created	C:\Windows\SysWOW64\Jcefno32.exe	Jlnnmb32.exe
File created	C:\Windows\SysWOW64\Ojoign32.exe	Odapnf32.exe
File opened for modification	C:\Windows\SysWOW64\Pjdilcla.exe	Pgemphmn.exe
File opened for modification	C:\Windows\SysWOW64\Pnihcq32.exe	Pkjlge32.exe
File created	C:\Windows\SysWOW64\Klimip32.exe	Kikame32.exe
File created	C:\Windows\SysWOW64\Pcjapi32.exe	Oqkdcn32.exe
File created	C:\Windows\SysWOW64\Ajkhdp32.exe	Alhhhcal.exe
File opened for modification	C:\Windows\SysWOW64\Gokdeeec.exe	Gmlhii32.exe
File opened for modification	C:\Windows\SysWOW64\Icifbang.exe	Ikbnacmd.exe
File opened for modification	C:\Windows\SysWOW64\Fbqefhpm.exe	Fqohnp32.exe
File created	C:\Windows\SysWOW64\Lpebpm32.exe	Lljfpnjg.exe
File created	C:\Windows\SysWOW64\Bclgpkgk.dll	Ijhodq32.exe
File opened for modification	C:\Windows\SysWOW64\Imihfl32.exe	Ifopiajn.exe
File created	C:\Windows\SysWOW64\Oimhnoch.dll	Kgdbkohf.exe
File created	C:\Windows\SysWOW64\Hecmijim.exe	Hfqlnm32.exe
File created	C:\Windows\SysWOW64\Lljfpnjg.exe	Likjcbkc.exe
File opened for modification	C:\Windows\SysWOW64\Daqbip32.exe	Dobfld32.exe
File opened for modification	C:\Windows\SysWOW64\Dlojkddn.exe	Dfdbojmq.exe
File created	C:\Windows\SysWOW64\Dadofijl.dll	Gjlfbd32.exe
File opened for modification	C:\Windows\SysWOW64\Ddonekbl.exe	Daqbip32.exe
File opened for modification	C:\Windows\SysWOW64\Ipnalhii.exe	Impepm32.exe
File opened for modification	C:\Windows\SysWOW64\Jbfpobpb.exe	Jaedgjjd.exe
File created	C:\Windows\SysWOW64\Ncfmpnfb.dll	Bnlnon32.exe
File opened for modification	C:\Windows\SysWOW64\Aqppkd32.exe	Afjlnk32.exe
File created	C:\Windows\SysWOW64\Aomaga32.dll	Lljfpnjg.exe
File created	C:\Windows\SysWOW64\Eeidoc32.exe	Ecjhcg32.exe
File opened for modification	C:\Windows\SysWOW64\Pdkcde32.exe	Pmdkch32.exe
File created	C:\Windows\SysWOW64\Dmnlpfhd.dll	Fcikolnh.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12704	13220	WerFault.exe	669

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djnkap32.dll"	Qdbiedpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kepelfam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hqdeld32.dll"	Kimnbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndokbi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkbchk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmjfkopm.dll"	Fdlnbm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hpgkkioa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njljefql.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bagflcje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chagok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kkihknfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgfoan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cahfmgoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jimekgff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Milgab32.dll"	Kdcijcke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbanme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndcdmikd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ffggkgmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkbbae32.dll"	Hofdacke.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kfmepi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kibgmdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bajjli32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ffddka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mcpnhfhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpjphglm.dll"	Bajjli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jdhine32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjdilcla.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qdbiedpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnkplejl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eflhoigi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjghpn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebnoikqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjeddggd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fcmnpe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjeoglgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbbfkb32.dll"	Ejbkehcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olmeci32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aqppkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flpafo32.dll"	Kfmepi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojaelm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmdkch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Alcidkmm.dll"	Dhhnpjmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgdbkohf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfnjafap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fqohnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enlqgg32.dll"	Hmjdjgjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Llemdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Denlnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hadkpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckafhlkg.dll"	Dafbne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbpnkama.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kplpjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgppolie.dll"	Ojaelm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qceiaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehbccoaj.dll"	Habnjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdeqhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldfgeigq.dll"	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddonekbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhbgqohi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pnihcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aaqgek32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcbmka32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 3904	840	bfca7b30847a59dc6669e837e58a7ae1414b37c457f2587ab0274d1c8be81d76.exe	86
PID 840 wrote to memory of 3904	840	bfca7b30847a59dc6669e837e58a7ae1414b37c457f2587ab0274d1c8be81d76.exe	86
PID 840 wrote to memory of 3904	840	bfca7b30847a59dc6669e837e58a7ae1414b37c457f2587ab0274d1c8be81d76.exe	86
PID 3904 wrote to memory of 4152	3904	Dcopbp32.exe	87
PID 3904 wrote to memory of 4152	3904	Dcopbp32.exe	87
PID 3904 wrote to memory of 4152	3904	Dcopbp32.exe	87
PID 4152 wrote to memory of 1396	4152	Denlnk32.exe	88
PID 4152 wrote to memory of 1396	4152	Denlnk32.exe	88
PID 4152 wrote to memory of 1396	4152	Denlnk32.exe	88
PID 1396 wrote to memory of 5064	1396	Dpcpkc32.exe	89
PID 1396 wrote to memory of 5064	1396	Dpcpkc32.exe	89
PID 1396 wrote to memory of 5064	1396	Dpcpkc32.exe	89
PID 5064 wrote to memory of 1960	5064	Dofpgqji.exe	90
PID 5064 wrote to memory of 1960	5064	Dofpgqji.exe	90
PID 5064 wrote to memory of 1960	5064	Dofpgqji.exe	90
PID 1960 wrote to memory of 1216	1960	Dephckaf.exe	91
PID 1960 wrote to memory of 1216	1960	Dephckaf.exe	91
PID 1960 wrote to memory of 1216	1960	Dephckaf.exe	91
PID 1216 wrote to memory of 664	1216	Dljqpd32.exe	92
PID 1216 wrote to memory of 664	1216	Dljqpd32.exe	92
PID 1216 wrote to memory of 664	1216	Dljqpd32.exe	92
PID 664 wrote to memory of 624	664	Dohmlp32.exe	93
PID 664 wrote to memory of 624	664	Dohmlp32.exe	93
PID 664 wrote to memory of 624	664	Dohmlp32.exe	93
PID 624 wrote to memory of 1420	624	Dagiil32.exe	94
PID 624 wrote to memory of 1420	624	Dagiil32.exe	94
PID 624 wrote to memory of 1420	624	Dagiil32.exe	94
PID 1420 wrote to memory of 4612	1420	Debeijoc.exe	96
PID 1420 wrote to memory of 4612	1420	Debeijoc.exe	96
PID 1420 wrote to memory of 4612	1420	Debeijoc.exe	96
PID 4612 wrote to memory of 60	4612	Dllmfd32.exe	97
PID 4612 wrote to memory of 60	4612	Dllmfd32.exe	97
PID 4612 wrote to memory of 60	4612	Dllmfd32.exe	97
PID 60 wrote to memory of 4116	60	Dfdbojmq.exe	98
PID 60 wrote to memory of 4116	60	Dfdbojmq.exe	98
PID 60 wrote to memory of 4116	60	Dfdbojmq.exe	98
PID 4116 wrote to memory of 5108	4116	Dlojkddn.exe	100
PID 4116 wrote to memory of 5108	4116	Dlojkddn.exe	100
PID 4116 wrote to memory of 5108	4116	Dlojkddn.exe	100
PID 5108 wrote to memory of 3724	5108	Ejbkehcg.exe	101
PID 5108 wrote to memory of 3724	5108	Ejbkehcg.exe	101
PID 5108 wrote to memory of 3724	5108	Ejbkehcg.exe	101
PID 3724 wrote to memory of 1684	3724	Eoocmoao.exe	102
PID 3724 wrote to memory of 1684	3724	Eoocmoao.exe	102
PID 3724 wrote to memory of 1684	3724	Eoocmoao.exe	102
PID 1684 wrote to memory of 940	1684	Ebnoikqb.exe	103
PID 1684 wrote to memory of 940	1684	Ebnoikqb.exe	103
PID 1684 wrote to memory of 940	1684	Ebnoikqb.exe	103
PID 940 wrote to memory of 3392	940	Ejegjh32.exe	104
PID 940 wrote to memory of 3392	940	Ejegjh32.exe	104
PID 940 wrote to memory of 3392	940	Ejegjh32.exe	104
PID 3392 wrote to memory of 2192	3392	Epopgbia.exe	106
PID 3392 wrote to memory of 2192	3392	Epopgbia.exe	106
PID 3392 wrote to memory of 2192	3392	Epopgbia.exe	106
PID 2192 wrote to memory of 4592	2192	Eflhoigi.exe	107
PID 2192 wrote to memory of 4592	2192	Eflhoigi.exe	107
PID 2192 wrote to memory of 4592	2192	Eflhoigi.exe	107
PID 4592 wrote to memory of 1716	4592	Eleplc32.exe	108
PID 4592 wrote to memory of 1716	4592	Eleplc32.exe	108
PID 4592 wrote to memory of 1716	4592	Eleplc32.exe	108
PID 1716 wrote to memory of 2780	1716	Eodlho32.exe	109
PID 1716 wrote to memory of 2780	1716	Eodlho32.exe	109
PID 1716 wrote to memory of 2780	1716	Eodlho32.exe	109
PID 2780 wrote to memory of 3960	2780	Efneehef.exe	110

C:\Users\Admin\AppData\Local\Temp\bfca7b30847a59dc6669e837e58a7ae1414b37c457f2587ab0274d1c8be81d76.exe
"C:\Users\Admin\AppData\Local\Temp\bfca7b30847a59dc6669e837e58a7ae1414b37c457f2587ab0274d1c8be81d76.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\Dcopbp32.exe
  C:\Windows\system32\Dcopbp32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\SysWOW64\Denlnk32.exe
    C:\Windows\system32\Denlnk32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Windows\SysWOW64\Dpcpkc32.exe
      C:\Windows\system32\Dpcpkc32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1396
    - - C:\Windows\SysWOW64\Dofpgqji.exe
        
        C:\Windows\system32\Dofpgqji.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5064
      - C:\Windows\SysWOW64\Dephckaf.exe
        
        C:\Windows\system32\Dephckaf.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1960
        
        C:\Windows\SysWOW64\Dljqpd32.exe
        
        C:\Windows\system32\Dljqpd32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1216
        
        C:\Windows\SysWOW64\Dohmlp32.exe
        
        C:\Windows\system32\Dohmlp32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:664
        
        C:\Windows\SysWOW64\Dagiil32.exe
        
        C:\Windows\system32\Dagiil32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:624
        
        C:\Windows\SysWOW64\Debeijoc.exe
        
        C:\Windows\system32\Debeijoc.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1420
        
        C:\Windows\SysWOW64\Dllmfd32.exe
        
        C:\Windows\system32\Dllmfd32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\Windows\SysWOW64\Dfdbojmq.exe
        
        C:\Windows\system32\Dfdbojmq.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:60
        
        C:\Windows\SysWOW64\Dlojkddn.exe
        
        C:\Windows\system32\Dlojkddn.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4116
        
        C:\Windows\SysWOW64\Ejbkehcg.exe
        
        C:\Windows\system32\Ejbkehcg.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\SysWOW64\Eoocmoao.exe
        
        C:\Windows\system32\Eoocmoao.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3724
        
        C:\Windows\SysWOW64\Ebnoikqb.exe
        
        C:\Windows\system32\Ebnoikqb.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1684
        
        C:\Windows\SysWOW64\Ejegjh32.exe
        
        C:\Windows\system32\Ejegjh32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:940
        
        C:\Windows\SysWOW64\Epopgbia.exe
        
        C:\Windows\system32\Epopgbia.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3392
        
        C:\Windows\SysWOW64\Eflhoigi.exe
        
        C:\Windows\system32\Eflhoigi.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2192
        
        C:\Windows\SysWOW64\Eleplc32.exe
        
        C:\Windows\system32\Eleplc32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4592
        
        C:\Windows\SysWOW64\Eodlho32.exe
        
        C:\Windows\system32\Eodlho32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1716
        
        C:\Windows\SysWOW64\Efneehef.exe
        
        C:\Windows\system32\Efneehef.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        C:\Windows\SysWOW64\Eofinnkf.exe
        
        C:\Windows\system32\Eofinnkf.exe
        23⤵
        Executes dropped EXE
        
        PID:3960
        
        C:\Windows\SysWOW64\Ejlmkgkl.exe
        
        C:\Windows\system32\Ejlmkgkl.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3900
        
        C:\Windows\SysWOW64\Eqfeha32.exe
        
        C:\Windows\system32\Eqfeha32.exe
        25⤵
        Executes dropped EXE
        
        PID:2304
        
        C:\Windows\SysWOW64\Ffbnph32.exe
        
        C:\Windows\system32\Ffbnph32.exe
        26⤵
        Executes dropped EXE
        
        PID:4344
        
        C:\Windows\SysWOW64\Fjnjqfij.exe
        
        C:\Windows\system32\Fjnjqfij.exe
        27⤵
        Executes dropped EXE
        
        PID:3116
        
        C:\Windows\SysWOW64\Fhajlc32.exe
        
        C:\Windows\system32\Fhajlc32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4936
        
        C:\Windows\SysWOW64\Fcgoilpj.exe
        
        C:\Windows\system32\Fcgoilpj.exe
        29⤵
        Executes dropped EXE
        
        PID:1296
        
        C:\Windows\SysWOW64\Ffekegon.exe
        
        C:\Windows\system32\Ffekegon.exe
        30⤵
        Executes dropped EXE
        
        PID:2544
        
        C:\Windows\SysWOW64\Ficgacna.exe
        
        C:\Windows\system32\Ficgacna.exe
        31⤵
        Executes dropped EXE
        
        PID:2164
        
        C:\Windows\SysWOW64\Fcikolnh.exe
        
        C:\Windows\system32\Fcikolnh.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4364
        
        C:\Windows\SysWOW64\Ffggkgmk.exe
        
        C:\Windows\system32\Ffggkgmk.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:784
        
        C:\Windows\SysWOW64\Fifdgblo.exe
        
        C:\Windows\system32\Fifdgblo.exe
        34⤵
        Executes dropped EXE
        
        PID:1116
        
        C:\Windows\SysWOW64\Fopldmcl.exe
        
        C:\Windows\system32\Fopldmcl.exe
        35⤵
        Executes dropped EXE
        
        PID:4976
        
        C:\Windows\SysWOW64\Fmclmabe.exe
        
        C:\Windows\system32\Fmclmabe.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5008
        
        C:\Windows\SysWOW64\Fqohnp32.exe
        
        C:\Windows\system32\Fqohnp32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1428
        
        C:\Windows\SysWOW64\Fbqefhpm.exe
        
        C:\Windows\system32\Fbqefhpm.exe
        38⤵
        Executes dropped EXE
        
        PID:4204
        
        C:\Windows\SysWOW64\Fjhmgeao.exe
        
        C:\Windows\system32\Fjhmgeao.exe
        39⤵
        Executes dropped EXE
        
        PID:2628
        
        C:\Windows\SysWOW64\Fijmbb32.exe
        
        C:\Windows\system32\Fijmbb32.exe
        40⤵
        Executes dropped EXE
        
        PID:3600
        
        C:\Windows\SysWOW64\Fodeolof.exe
        
        C:\Windows\system32\Fodeolof.exe
        41⤵
        Executes dropped EXE
        
        PID:3292
        
        C:\Windows\SysWOW64\Gbcakg32.exe
        
        C:\Windows\system32\Gbcakg32.exe
        42⤵
        Executes dropped EXE
        
        PID:1460
        
        C:\Windows\SysWOW64\Gfnnlffc.exe
        
        C:\Windows\system32\Gfnnlffc.exe
        43⤵
        Executes dropped EXE
        
        PID:4192
        
        C:\Windows\SysWOW64\Gjjjle32.exe
        
        C:\Windows\system32\Gjjjle32.exe
        44⤵
        Executes dropped EXE
        
        PID:1624
        
        C:\Windows\SysWOW64\Gogbdl32.exe
        
        C:\Windows\system32\Gogbdl32.exe
        45⤵
        Executes dropped EXE
        
        PID:3504
        
        C:\Windows\SysWOW64\Gbenqg32.exe
        
        C:\Windows\system32\Gbenqg32.exe
        46⤵
        Executes dropped EXE
        
        PID:1500
        
        C:\Windows\SysWOW64\Gjlfbd32.exe
        
        C:\Windows\system32\Gjlfbd32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4824
        
        C:\Windows\SysWOW64\Goiojk32.exe
        
        C:\Windows\system32\Goiojk32.exe
        48⤵
        Executes dropped EXE
        
        PID:2440
        
        C:\Windows\SysWOW64\Gbgkfg32.exe
        
        C:\Windows\system32\Gbgkfg32.exe
        49⤵
        Executes dropped EXE
        
        PID:2520
        
        C:\Windows\SysWOW64\Giacca32.exe
        
        C:\Windows\system32\Giacca32.exe
        50⤵
        Executes dropped EXE
        
        PID:1940
        
        C:\Windows\SysWOW64\Gcggpj32.exe
        
        C:\Windows\system32\Gcggpj32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2208
        
        C:\Windows\SysWOW64\Gbjhlfhb.exe
        
        C:\Windows\system32\Gbjhlfhb.exe
        52⤵
        Executes dropped EXE
        
        PID:2624
        
        C:\Windows\SysWOW64\Gfedle32.exe
        
        C:\Windows\system32\Gfedle32.exe
        53⤵
        Executes dropped EXE
        
        PID:4892
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        54⤵
        Executes dropped EXE
        
        PID:1040
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        55⤵
        Executes dropped EXE
        
        PID:4412
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        56⤵
        Executes dropped EXE
        
        PID:5040
        
        C:\Windows\SysWOW64\Gjclbc32.exe
        
        C:\Windows\system32\Gjclbc32.exe
        57⤵
        Executes dropped EXE
        
        PID:868
        
        C:\Windows\SysWOW64\Gppekj32.exe
        
        C:\Windows\system32\Gppekj32.exe
        58⤵
        Executes dropped EXE
        
        PID:3576
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        59⤵
        Executes dropped EXE
        
        PID:536
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        60⤵
        Executes dropped EXE
        
        PID:4384
        
        C:\Windows\SysWOW64\Hmdedo32.exe
        
        C:\Windows\system32\Hmdedo32.exe
        61⤵
        Executes dropped EXE
        
        PID:1948
        
        C:\Windows\SysWOW64\Hpbaqj32.exe
        
        C:\Windows\system32\Hpbaqj32.exe
        62⤵
        Executes dropped EXE
        
        PID:3492
        
        C:\Windows\SysWOW64\Hbanme32.exe
        
        C:\Windows\system32\Hbanme32.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2272
        
        C:\Windows\SysWOW64\Hfljmdjc.exe
        
        C:\Windows\system32\Hfljmdjc.exe
        64⤵
        Executes dropped EXE
        
        PID:720
        
        C:\Windows\SysWOW64\Habnjm32.exe
        
        C:\Windows\system32\Habnjm32.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5016
        
        C:\Windows\SysWOW64\Hbckbepg.exe
        
        C:\Windows\system32\Hbckbepg.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3844
        
        C:\Windows\SysWOW64\Hadkpm32.exe
        
        C:\Windows\system32\Hadkpm32.exe
        67⤵
        Modifies registry class
        
        PID:3656
        
        C:\Windows\SysWOW64\Hpgkkioa.exe
        
        C:\Windows\system32\Hpgkkioa.exe
        68⤵
        Modifies registry class
        
        PID:1188
        
        C:\Windows\SysWOW64\Hbeghene.exe
        
        C:\Windows\system32\Hbeghene.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2720
        
        C:\Windows\SysWOW64\Hmklen32.exe
        
        C:\Windows\system32\Hmklen32.exe
        70⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\Hpihai32.exe
        
        C:\Windows\system32\Hpihai32.exe
        71⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\Hfcpncdk.exe
        
        C:\Windows\system32\Hfcpncdk.exe
        72⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\Hibljoco.exe
        
        C:\Windows\system32\Hibljoco.exe
        73⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\Haidklda.exe
        
        C:\Windows\system32\Haidklda.exe
        74⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\Ibjqcd32.exe
        
        C:\Windows\system32\Ibjqcd32.exe
        75⤵
        
        PID:3244
        
        C:\Windows\SysWOW64\Impepm32.exe
        
        C:\Windows\system32\Impepm32.exe
        76⤵
        Drops file in System32 directory
        
        PID:1880
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3448
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        78⤵
        
        PID:1028
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2604
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        80⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\Ifjfnb32.exe
        
        C:\Windows\system32\Ifjfnb32.exe
        81⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\Imdnklfp.exe
        
        C:\Windows\system32\Imdnklfp.exe
        82⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        83⤵
        
        PID:756
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        84⤵
        Drops file in System32 directory
        
        PID:316
        
        C:\Windows\SysWOW64\Imgkql32.exe
        
        C:\Windows\system32\Imgkql32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5000
        
        C:\Windows\SysWOW64\Ipegmg32.exe
        
        C:\Windows\system32\Ipegmg32.exe
        86⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        87⤵
        
        PID:928
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        88⤵
        Drops file in System32 directory
        
        PID:2128
        
        C:\Windows\SysWOW64\Imihfl32.exe
        
        C:\Windows\system32\Imihfl32.exe
        89⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        90⤵
        Drops file in System32 directory
        
        PID:768
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:952
        
        C:\Windows\SysWOW64\Jpjqhgol.exe
        
        C:\Windows\system32\Jpjqhgol.exe
        92⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        93⤵
        
        PID:3736
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        94⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\Jjpeepnb.exe
        
        C:\Windows\system32\Jjpeepnb.exe
        95⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Jibeql32.exe
        
        C:\Windows\system32\Jibeql32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5188
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        97⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        98⤵
        Modifies registry class
        
        PID:5276
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        99⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        100⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        101⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        102⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        103⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5560
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5604
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        106⤵
        Drops file in System32 directory
        
        PID:5648
        
        C:\Windows\SysWOW64\Kmegbjgn.exe
        
        C:\Windows\system32\Kmegbjgn.exe
        107⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5776
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        109⤵
        Modifies registry class
        
        PID:5820
        
        C:\Windows\SysWOW64\Kilhgk32.exe
        
        C:\Windows\system32\Kilhgk32.exe
        110⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        111⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        112⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        113⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        114⤵
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        115⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        116⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5596
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        118⤵
        Drops file in System32 directory
        
        PID:5688
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        119⤵
        Drops file in System32 directory
        
        PID:5764
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        120⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Kgfoan32.exe
        
        C:\Windows\system32\Kgfoan32.exe
        121⤵
        Modifies registry class
        
        PID:5960
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        122⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        123⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        124⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        125⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        126⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5324
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        128⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        129⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        130⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        131⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6032
        
        C:\Windows\SysWOW64\Lcgblncm.exe
        
        C:\Windows\system32\Lcgblncm.exe
        133⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        134⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Mjqjih32.exe
        
        C:\Windows\system32\Mjqjih32.exe
        135⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        136⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        137⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        138⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        139⤵
        Drops file in System32 directory
        
        PID:6072
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        140⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        141⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        142⤵
        Modifies registry class
        
        PID:5972
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        143⤵
        Modifies registry class
        
        PID:5288
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        144⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        145⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        146⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        147⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        148⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        149⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        150⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        151⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        152⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        153⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        154⤵
        Modifies registry class
        
        PID:6440
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        155⤵
        Drops file in System32 directory
        
        PID:6484
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        156⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        157⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        158⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        159⤵
        Drops file in System32 directory
        
        PID:6652
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        160⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        161⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        162⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        163⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        164⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        165⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        166⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        167⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Nnaikd32.exe
        
        C:\Windows\system32\Nnaikd32.exe
        168⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        169⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        170⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        171⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6176
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        173⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        174⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        175⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        176⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        177⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        178⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        179⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        180⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Oqgkhnjf.exe
        
        C:\Windows\system32\Oqgkhnjf.exe
        181⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        182⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        183⤵
        Drops file in System32 directory
        
        PID:6916
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        184⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Oqkdcn32.exe
        
        C:\Windows\system32\Oqkdcn32.exe
        185⤵
        Drops file in System32 directory
        
        PID:7060
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        186⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        187⤵
        Drops file in System32 directory
        
        PID:6216
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        188⤵
        Modifies registry class
        
        PID:6380
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        189⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        190⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6688
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        192⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        193⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6984
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        195⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6344
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        197⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        198⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6808
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        200⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        201⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        202⤵
        Drops file in System32 directory
        
        PID:6388
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6736
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        204⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        205⤵
        Drops file in System32 directory
        
        PID:6420
        
        C:\Windows\SysWOW64\Qkmhlekj.exe
        
        C:\Windows\system32\Qkmhlekj.exe
        206⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        207⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        208⤵
        Drops file in System32 directory
        
        PID:7184
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        209⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        210⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Acjjfggb.exe
        
        C:\Windows\system32\Acjjfggb.exe
        211⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        212⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7388
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        214⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        215⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        216⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        217⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7596
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        219⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        220⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        221⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        222⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        223⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Adapgfqj.exe
        
        C:\Windows\system32\Adapgfqj.exe
        224⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7848
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        225⤵
        Drops file in System32 directory
        
        PID:7884
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        226⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        227⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8004
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        229⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        230⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        231⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        232⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        233⤵
        Drops file in System32 directory
        
        PID:6948
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        234⤵
        Modifies registry class
        
        PID:7216
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        235⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        236⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        237⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7524
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        239⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        240⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        241⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        242⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        243⤵
        Modifies registry class
        
        PID:7844
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        244⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        245⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        246⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8116
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        248⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        249⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        250⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7420
        
        C:\Windows\SysWOW64\Cafigg32.exe
        
        C:\Windows\system32\Cafigg32.exe
        252⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        253⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        254⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        255⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        256⤵
        Modifies registry class
        
        PID:7972
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        257⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        258⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        259⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        260⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7500
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        261⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7832
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8028
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        264⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        265⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        266⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        267⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        268⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        269⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Docmgjhp.exe
        
        C:\Windows\system32\Docmgjhp.exe
        270⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        271⤵
        Drops file in System32 directory
        
        PID:7608
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        272⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        273⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        274⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        275⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        276⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        277⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        278⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        279⤵
        Modifies registry class
        
        PID:8556
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        280⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        281⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        282⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8772
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        284⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        285⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        286⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        287⤵
        Drops file in System32 directory
        
        PID:8988
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        288⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        289⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        290⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        291⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        292⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        293⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        294⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8408
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        296⤵
        Drops file in System32 directory
        
        PID:8428
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        297⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        298⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        299⤵
        Drops file in System32 directory
        
        PID:8700
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        300⤵
        Drops file in System32 directory
        
        PID:8764
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        301⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        302⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        303⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        304⤵
        Modifies registry class
        
        PID:9100
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        305⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        306⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        307⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        308⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        309⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        310⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        311⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8528
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        312⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        313⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        314⤵
        Modifies registry class
        
        PID:9164
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        315⤵
        Modifies registry class
        
        PID:7528
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        316⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        317⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        318⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        319⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        320⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        321⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        322⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        323⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        324⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        325⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        326⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        327⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        328⤵
        Modifies registry class
        
        PID:8336
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        329⤵
        Drops file in System32 directory
        
        PID:9228
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        330⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        331⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        332⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        333⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        334⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        335⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Hopnqdan.exe
        
        C:\Windows\system32\Hopnqdan.exe
        336⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        337⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        338⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        339⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        340⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        341⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        342⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        343⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        344⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        345⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        346⤵
        Modifies registry class
        
        PID:9964
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        347⤵
        Drops file in System32 directory
        
        PID:10004
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        348⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        349⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10084
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        350⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        351⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        352⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        353⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        354⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        355⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        356⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        357⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        358⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        359⤵
        Drops file in System32 directory
        
        PID:9624
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        360⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9772
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        362⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        363⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        364⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        365⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        366⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        367⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        368⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        369⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        370⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        371⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        372⤵
        Modifies registry class
        
        PID:9676
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        373⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        374⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        375⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        376⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9264
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9392
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        379⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        380⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        381⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        382⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        383⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        384⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        385⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        386⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        387⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        388⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        389⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        390⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        391⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        392⤵
        
        PID:3168
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        393⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        394⤵
        Modifies registry class
        
        PID:8884
        
        C:\Windows\SysWOW64\Kepelfam.exe
        
        C:\Windows\system32\Kepelfam.exe
        395⤵
        Modifies registry class
        
        PID:10256
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        396⤵
        Drops file in System32 directory
        
        PID:10296
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        397⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        398⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        399⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        400⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10468
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        401⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        402⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        403⤵
        Drops file in System32 directory
        
        PID:10588
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        404⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        405⤵
        Drops file in System32 directory
        
        PID:10676
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        406⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        407⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        408⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        409⤵
        Modifies registry class
        
        PID:10852
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        410⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        411⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10936
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        412⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        413⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        414⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        415⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        416⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        417⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        418⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        419⤵
        Modifies registry class
        
        PID:11256
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        420⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        421⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        422⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        423⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        424⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        425⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        426⤵
        Drops file in System32 directory
        
        PID:10696
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        427⤵
        Drops file in System32 directory
        
        PID:10792
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        428⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10844
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        429⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        430⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        431⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        432⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        433⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        434⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        435⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10388
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        436⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        437⤵
        Drops file in System32 directory
        
        PID:10664
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        438⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        439⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        440⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        441⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        442⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        443⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        444⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10476
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        445⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        446⤵
        Modifies registry class
        
        PID:10920
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        447⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        448⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        449⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10580
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        450⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        451⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        452⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        453⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        454⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        455⤵
        Drops file in System32 directory
        
        PID:10316
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        456⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11304
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        457⤵
        Modifies registry class
        
        PID:11348
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        458⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        459⤵
        Drops file in System32 directory
        
        PID:11428
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        460⤵
        
        PID:11472
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        461⤵
        
        PID:11508
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        462⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        463⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11588
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        464⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        465⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11672
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        466⤵
        
        PID:11712
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        467⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        468⤵
        Drops file in System32 directory
        
        PID:11800
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        469⤵
        
        PID:11840
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        470⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        471⤵
        
        PID:11920
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        472⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        473⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        474⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        475⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        476⤵
        
        PID:12124
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        477⤵
        
        PID:12168
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        478⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        479⤵
        Drops file in System32 directory
        
        PID:12252
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        480⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        481⤵
        Modifies registry class
        
        PID:11312
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        482⤵
        
        PID:11368
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        483⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        484⤵
        Modifies registry class
        
        PID:11504
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        485⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11568
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        486⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        487⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        488⤵
        
        PID:11776
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        489⤵
        
        PID:11820
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        490⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        491⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        492⤵
        Modifies registry class
        
        PID:12032
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        493⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:12120
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        494⤵
        Drops file in System32 directory
        
        PID:12192
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        495⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        496⤵
        
        PID:11292
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        497⤵
        
        PID:11376
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        498⤵
        
        PID:11460
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        499⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        500⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        501⤵
        
        PID:11836
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        502⤵
        Drops file in System32 directory
        
        PID:11944
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        503⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        504⤵
        Modifies registry class
        
        PID:12160
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        505⤵
        
        PID:12276
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        506⤵
        
        PID:11340
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        507⤵
        Modifies registry class
        
        PID:11544
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        508⤵
        Modifies registry class
        
        PID:11584
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        509⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11900
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        510⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        511⤵
        
        PID:12240
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        512⤵
        
        PID:11560
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        513⤵
        
        PID:11908
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        514⤵
        
        PID:12108
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        515⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Anogiicl.exe
        
        C:\Windows\system32\Anogiicl.exe
        516⤵
        
        PID:11656
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        517⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        518⤵
        Drops file in System32 directory
        
        PID:11828
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        519⤵
        Modifies registry class
        
        PID:11668
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        520⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        521⤵
        Modifies registry class
        
        PID:12324
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        522⤵
        
        PID:12360
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        523⤵
        
        PID:12396
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        524⤵
        
        PID:12432
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        525⤵
        Drops file in System32 directory
        
        PID:12468
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        526⤵
        Modifies registry class
        
        PID:12504
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        527⤵
        
        PID:12540
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        528⤵
        Modifies registry class
        
        PID:12576
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        529⤵
        
        PID:12612
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        530⤵
        
        PID:12644
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        531⤵
        Drops file in System32 directory
        
        PID:12684
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        532⤵
        
        PID:12720
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        533⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12756
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        534⤵
        
        PID:12792
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        535⤵
        
        PID:12828
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        536⤵
        Drops file in System32 directory
        
        PID:12864
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        537⤵
        
        PID:12900
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        538⤵
        
        PID:12936
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        539⤵
        
        PID:12976
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        540⤵
        
        PID:13012
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        541⤵
        
        PID:13048
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        542⤵
        
        PID:13084
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        543⤵
        
        PID:13120
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        544⤵
        
        PID:13156
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        545⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13192
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        546⤵
        
        PID:13228
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        547⤵
        
        PID:13264
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        548⤵
        
        PID:13300
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        549⤵
        
        PID:12312
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        550⤵
        Modifies registry class
        
        PID:12392
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        551⤵
        Modifies registry class
        
        PID:5052
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        552⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        553⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        554⤵
        
        PID:12524
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        555⤵
        
        PID:12604
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        556⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        557⤵
        
        PID:12716
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        558⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12776
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        559⤵
        
        PID:12848
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        560⤵
        
        PID:12908
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        561⤵
        
        PID:12972
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        562⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:13040
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        563⤵
        Drops file in System32 directory
        
        PID:13108
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        564⤵
        Drops file in System32 directory
        
        PID:13180
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        565⤵
        Modifies registry class
        
        PID:13212
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        566⤵
        Modifies registry class
        
        PID:13296
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        567⤵
        
        PID:12348
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        568⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        569⤵
        
        PID:12536
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        570⤵
        
        PID:12632
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        571⤵
        
        PID:12764
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        572⤵
        
        PID:12856
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        573⤵
        
        PID:13000
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        574⤵
        
        PID:13116
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        575⤵
        
        PID:13220
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13220 -s 400
        576⤵
        Program crash
        
        PID:12704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 13220 -ip 13220
1⤵
PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aeiofcji.exe

Filesize
295KB

MD5
e21c4132bd1d3997a2320c4d94eab6df

SHA1
8aedae457277d71064966ead8d5ec388b1b35424

SHA256
261332326a388ae9a9ef42d46ca88563df2ebda76139ef42760c291b8b9afd11

SHA512
cc671eeab151c523a97dc6e6895e38b0d54112a353806211545a4f2c4ae1520c501c60c89919f7d9d7e52e707619a60c7fb6cb5d29eeedebd76062bfd625cd66

Download Submit
C:\Windows\SysWOW64\Aeklkchg.exe

Filesize
295KB

MD5
24bb630464da902d0d47c1249ec171cc

SHA1
b21932303876508ebf25a1286aa2a0d09a53e471

SHA256
9f3c7fbb1a614ed5afcddeb5a5bd6eb65a09ae79a78f5ebd41accb4016429baf

SHA512
e6acd1446ac10693a9b936fc15e2b7d268dd2947216e84d78d039d6eb3cc7c9ae1a2e6adc4f45a7430ed2aa3ae6de933c24fcb9b2120d16461fb397c0edf65e7

Download Submit
C:\Windows\SysWOW64\Ajneip32.exe

Filesize
295KB

MD5
c43b23599293bbc28415e7161ca1e8f6

SHA1
d2181995fcd826988d06bbfabd9b247c1f78278d

SHA256
e7486020da18dcd8ccfc48a123c1266eae77e9d9682565a7a5f3f4961a6bba5e

SHA512
d8d6f0cb680f3642ad2131c37817eb4e1c5af2b984fd75f8e9ab20494cee8131c7998f97675da465442aedc0d3db92ac74ec6cf8a18cbc2bc8c28fa1624d2b3f

Download Submit
C:\Windows\SysWOW64\Aqkgpedc.exe

Filesize
295KB

MD5
55503556f30a21f6a6c99d7e3ae9dac3

SHA1
8bf373fa79d58d203535454d20791894fc395c45

SHA256
4579ad1d53edea0fcc2373e1de7dd46eea81506850922ae53096f1199e9ad40e

SHA512
3b7f5e9b96e2b3d69ead71b16170de8ec281343ada932cc8e6dc7217fe8d7449273d6d739ddac305136b165b676d8dc58c10603559e38a8d49b992a6c22d406f

Download Submit
C:\Windows\SysWOW64\Bagflcje.exe

Filesize
256KB

MD5
8ac75a39e1a531e8c947bf09bf8d6a74

SHA1
de10a913e90c8b598ae1bb745ceb7743fabe9d1b

SHA256
b84960723dd5eb22f9b9e3ea438ac7636ad2c774d59f972c9cbefda76524560a

SHA512
ca0f52d13d99241c700d0dea10f2531069c1746f8cabd3829d75df5c63f0dffe695ebd1e2aa10fe9d008ac65e8c8b6e9905106bbed8f32229e4bedbee121ddac

Download Submit
C:\Windows\SysWOW64\Bcjlcn32.exe

Filesize
295KB

MD5
882970184a4400d5e964a1e4121b079f

SHA1
fad5e6b780719171bb479bff0dc1edc504da4603

SHA256
85f192833cf136b900242fbdaca1a4f3387e61ad04ea201c1f4d7cfe3c3a4e67

SHA512
0ae07426ac0388e26f240e17a829b4d56e2de3614c2cf2bc97ae8c164afa7c24331401cf1787b23463b7971713a2c6ff317678c3ef18d77fb21a68f059b9d41f

Download Submit
C:\Windows\SysWOW64\Chagok32.exe

Filesize
295KB

MD5
ea59bfe7acb4ec2ccb936c325462618d

SHA1
f3b9de3dd836d3b49ec6eac95d26d9e64fd81c1e

SHA256
53c1ff7e088bc86d410ebefcdf254e249336f5d4885bc4b7381e42241d743962

SHA512
1b5b6655c1a4eb9db8850f378ab45ae593c9f132ec4093510fdbb09fbff6f19e50c27f4ee7bbf7e7ae4e0d29595484a2bfb80ee5491e9b8b508df3cf9e100418

Download Submit
C:\Windows\SysWOW64\Chokikeb.exe

Filesize
295KB

MD5
8447c65dc5d0cc6592b61cf78c2a7034

SHA1
f00db99788b6eca95ad0ea43b06a1afd7543ee73

SHA256
8de0a2e5b091050b1e3ccf196b53f5e5ef5fbe5850c6a1368bea6fa3ccf1bd8d

SHA512
ceb81d6ccfac2ee78f5c26c8984687e11f09ad146db5353d1e81e11bdfce6c437377a4ba95d74fd6da7fe30a555d1c51d634a74d96ebbf6a4d61e40f0329be9f

Download Submit
C:\Windows\SysWOW64\Cndikf32.exe

Filesize
295KB

MD5
b5c0d71b0864a2d2e3604049411645b7

SHA1
c9ef9f69eaa88dc4601d20bb26c80659d6c2920d

SHA256
fa4b88c0b1c53192eb61fcbcec00ba32ba69b8266197c052d6501f842942819e

SHA512
9fba3ccf8897ebe67ba4512d0534ad5ed85d4468f410786c8883abd0b3f236483205433c55ee9f2463badf8afbb49276145c6efc581d7df54b7464accebc00a0

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
295KB

MD5
13c5404d20a58359bcc45fef111170e7

SHA1
bc030b549dd7000a137fe110108e4bd8ce062eaf

SHA256
2a5fe617fcac59e5195acdd910143ffbb4422dc7c3b1271133ecea70b4e3b837

SHA512
e4c483ef384db7c558408867bd040a4981b393e24a08c2957d54692553bdd1ce4d1ef78f0b3c5c8fddf474ce4c269f1cc5bacd464bf9ed90376e8a296a48e3d3

Download Submit
C:\Windows\SysWOW64\Dagiil32.exe

Filesize
295KB

MD5
2148e56bb1beee4ed50d90c35fd9d084

SHA1
75b6f0a47b153064c0a3348a8f18960e6ed60e58

SHA256
1ed7dd3f15c802fc0f19a8ab16beb99714372774fb3ff26029ac507fa8bbd322

SHA512
b0c51d33344780d3b5c2cb1e74c67f0757b4986db8b46a8bf3e9083ec19318c71c8c02a13c9df5d5fc70cd56d3cec480e7b0423cd78a0bf747e9ed7b4bef7019

Download Submit
C:\Windows\SysWOW64\Dcopbp32.exe

Filesize
295KB

MD5
3c2d8e628eaf418f9cda53382389a595

SHA1
03f81912a42330268e9253e1b87f744540b28795

SHA256
826d37644d0d4ae8aa7cf6192fae62aac73c2c534a5948cb2e0fc694d1c8fa3d

SHA512
20093c67f029dcf1917044962a9aef324f69312038566e61b81d7d7d82fc5f7bcb9efbb49211810f8d4fb8d2ebc836f3ed24617ea9fc31e1f2420797e4672e49

Download Submit
C:\Windows\SysWOW64\Debeijoc.exe

Filesize
295KB

MD5
cefb019442c11b9a94472e8ca4cb2014

SHA1
904f06653eccfefce5bdcc0fa092021be0373b38

SHA256
3166be8d45411ed54730049f6745219219d7bced67f8b9fcda2b446faaa642d3

SHA512
7820ad45331e0abcc3d3dd29f6f04c9f7643ee87e3d08560d9926d2bc57b05c2464a7f2b127f46ef694ef65e291fbf6b3d450d1e49af1913aa90ddb7708b2da6

Download Submit
C:\Windows\SysWOW64\Dejacond.exe

Filesize
295KB

MD5
9d95f7558df91791001843e1c47e6c31

SHA1
960f38f706524a8e89ad28e231fc07f604e5c43a

SHA256
b9d4ca316580ea57de952186f17b9abaf885647e49921b981aa6e6287b8dc421

SHA512
596237154cf45cc5b95be08d69a97c198aa87bcfd603b6813435daa430f90945756014371348a4166c885df0f485df482650fb082dd8e6daa743ecac7ab3f0e1

Download Submit
C:\Windows\SysWOW64\Denlnk32.exe

Filesize
295KB

MD5
6502012ea7a9159813d5cbea14a2d135

SHA1
b39507a38080bb88687b5ec10944953a90d18af8

SHA256
0464de9681b7f9327456f7ab9e13359b1c9fd8975f9c1aee68010dfd1cc294e0

SHA512
58c9ac19a79243d387d3a5b292e86c0de0ebab84348f21dda354b0641c27c34eb121ecd4446223c9d71af4e6731fd94f8754082bd6487fc13fdc1f5bba61ac3f

Download Submit
C:\Windows\SysWOW64\Dephckaf.exe

Filesize
295KB

MD5
a7a5105da462b779b2f116672d066001

SHA1
3a9f14d147b7c3552503961bb18395ffdffe4dce

SHA256
11e9e4084943bbc26e59f920111a518747e9e5d0a5d703bcfee60673478998ec

SHA512
067f935d2ebf9c43eeac1e474d33e0e47e5a8a28ecc3a75e6fa0d064e7540a90affe21875ae4948e8c4b54b82d0e8d8b1ed22a912243f6b9d169695fc10b70b0

Download Submit
C:\Windows\SysWOW64\Dfdbojmq.exe

Filesize
295KB

MD5
5fe689f2173aad1a25f3d4f01bf45ff2

SHA1
1e07d80157473d6d82e4e860b1d9cbf3bde6b937

SHA256
c01da0a8ada0dfa55e6b4aa2eb4d0dc6e41102bfbe1828d8318804e53e9d4342

SHA512
8fc2e2e31f765a09e4ee93b00d9249ffda7c5f057a3303d5001daa91787d6f790b0cff23f422d30605b0d36747e0f8332cf2cd455ea2a90f935860c9847baee2

Download Submit
C:\Windows\SysWOW64\Dgbdlf32.exe

Filesize
295KB

MD5
df8c84d7f8befb7986aadd8ca2871a09

SHA1
c1557fba860b5414ca07587faa61e324ecaa80d1

SHA256
afb478b283218271b5dae4684107af80ce55724746f7f4c1c83b5ca653148621

SHA512
1106dc0f4f951f24d4318109948d91c66404b83ace7d9c1f93627a62232d3ef060dcd9eacb4b9f2e8a0a91cbcd0da67a962bd85371379884c725655c4b41835e

Download Submit
C:\Windows\SysWOW64\Dhfajjoj.exe

Filesize
295KB

MD5
01d52d31c0eb3fbfd5bbbaede028e657

SHA1
64195d6289e79c436078ace77748ee056b3e8e4d

SHA256
8bb63d2dd8df8c22c35e9d83ffe531157c77e6c0e85d0c2c608969598818e569

SHA512
a4d27fed35e6d32afba94add204cea53fcf88a12f78c2e86f7c627518512846eb4a7529337fc0a59c5c2a923887570013a0b21d68664543a8515d34ef94b0c59

Download Submit
C:\Windows\SysWOW64\Dljqpd32.exe

Filesize
295KB

MD5
b616f23c04cf6170c7852155fc1d0ea2

SHA1
dc95ce0973879dba2b49a2f882756d3834ecae6b

SHA256
1fdf943c357258373a74607eb20a63a9ca75d6dae3be0103277243dc3ce716ce

SHA512
6ac7fbe1f2172777137447ded0ebea9d4ed5cdb83986761646dce91a22c34421b39f1bff78b4d6f6bda15ef46646cc2987f7bd9228157712e2370884c7cfe68c

Download Submit
C:\Windows\SysWOW64\Dllmfd32.exe

Filesize
295KB

MD5
c026497fe76770ae34a9a9c3f54e2192

SHA1
8d36631746c198748670c02eed9ce62c3f4c30d2

SHA256
e62d211e52260857a8330e4359a76e1a60a67fffbc04983b605c428687468a38

SHA512
04679e0c5bee154be12c10efe86c31ee8aa61f52718a30950f6d034b5a3dcd13bf1ca84fa3afc3ed4b06fb707b0991c1dbe2241dc71e350b9b1e9088537b2110

Download Submit
C:\Windows\SysWOW64\Dlojkddn.exe

Filesize
295KB

MD5
62051eab00e130af9c2e6ecca187bbc6

SHA1
6a4eb84ca89a6ec86202179fc103dc285220f4bb

SHA256
854e30a635edf47f1bc719c1380ddcd3e3c06f80eb003db2737ffd617e466440

SHA512
b58540709c2f3634edb82b27e77c2d6dea18c4748d67a4c65ec9c4b9f4efd148847e661960249fc4804da19347b21d095dbd97883b1ceb145b88bf102065941a

Download Submit
C:\Windows\SysWOW64\Dobfld32.exe

Filesize
295KB

MD5
c50da1d36e295a6ab1ce96a89bd2c5c2

SHA1
d59a2ca194b15b190c30d5c0feb1425bd7380853

SHA256
0289d403854fb8d20f63da7df86cdf7bd02503a5034c60aa6ad38f4a7f56b951

SHA512
03093d3ede8039ff12065d093931d33055da452e86dbf608d7a256dbfcc893e4a500f60bc21ac5621e1645d6da5254defa5f76fec3cc581ff01545dbff6d9a79

Download Submit
C:\Windows\SysWOW64\Dofpgqji.exe

Filesize
295KB

MD5
431dbbcefa8148efdf46c488b583328d

SHA1
a5ee8106ef930351613a9143f46be8c5398b1dc2

SHA256
7989f6f10040cf3abdd64b0abae6182a1d51e00c45980f142bf874313388a947

SHA512
463d00ef9b2b24ae11b065ddf156bc847b5e74367ea3078bb1fc1c9d95bd21e48af22a5ff902502c46da3bd94b719cc565e40658297a48273d659639e169cbbe

Download Submit
C:\Windows\SysWOW64\Dogogcpo.exe

Filesize
192KB

MD5
11edf080b9f1370710b2a0a59afc97b9

SHA1
22637e9de2d91b3dd1e47b606374d9975651922f

SHA256
43bc27f716c5c516853d5be18a44b835969db26aa9d1252169cef43a6fbaa3b1

SHA512
2277e13df1512b8ec2dda5f59fad0d3fd675b86f6b4a78ad9b2df65415bae5a8d4b3294bf4eebba4fda183f62841bf607218e53230d94aab4d6de7d44f18eebe

Download Submit
C:\Windows\SysWOW64\Dohmlp32.exe

Filesize
295KB

MD5
9f1e6cab1f513d4fce787ced4c0b468e

SHA1
e8441f74434dffeee61fa511a5e32fc0feb0e22e

SHA256
5aeabb149034129cb858f1305451b9a676825df0ab948a1cc0540d136a1afb6d

SHA512
0b076ef4df09a6edd7f483dba597cb8c7e67e86df58c93eff381fbab80593dbdde6402d1193df5ea8216d42efc4889b72019a1358cfeb3cdb030907ea52621df

Download Submit
C:\Windows\SysWOW64\Dpcpkc32.exe

Filesize
295KB

MD5
a659c9bb17ae98576e70c799c65eb351

SHA1
8513fdc511d2c3ff7df8930ab5006c9b86ca96d5

SHA256
b235b1cbe98127ea0aeb990bc03db96acdbcc147d0d3025792e251765ff1b3b6

SHA512
68c39efbc6e84cc4c3ce702451eb637e5374d451fe1008d839d5d00c78db26d2a5be0cf80cd4b6036404eee73aa129fb18284137d878c11c18d1bda956f9560b

Download Submit
C:\Windows\SysWOW64\Ebnoikqb.exe

Filesize
295KB

MD5
d0c8be368ef0cec2b3fa895539babcf5

SHA1
533a66c078fed270b6a89395bd54cbfc382f3fad

SHA256
c6cef4a7a834e4bcfc2edebda064261029e04b0d9ee53fbafa57452b7d86929d

SHA512
c09f52abf3805238dfabf6df01649a936a974205bb3fe187c24c10f84d4a765e535df7428a1183231dd761f6dc004e8007dd8b3ab66bc6c349b00bb784d3f0a4

Download Submit
C:\Windows\SysWOW64\Eflhoigi.exe

Filesize
295KB

MD5
d42c414e029f396919e950c25ed12eb0

SHA1
1c34e497bd8542d06480e1a860adfd709da2eecd

SHA256
3eb3565f8d17a5d85aef0449324012bc99112a4d5192c2cfe64405a60308d550

SHA512
0968984796f13e937798e39f789a76c76cf8665ea69ff36bcdfecba4721022e0b46ef8bffd810b712015e6ad689ce7f26c2a9766965fe840d8cb0cede1dce2a3

Download Submit
C:\Windows\SysWOW64\Efneehef.exe

Filesize
295KB

MD5
935e32149e9ca874030470ce2c773646

SHA1
dc0d9178c2d1a740b0ac709fa668ca8469bb374c

SHA256
934fdb88647383584c4cd38ffe331de03d9cbe558365bbc7e3e96cf4882fe507

SHA512
8d802105034caf7e9d823da35ac1cf5166551ed13dddcbe0623b869bd26db2e43c301990c4999217b5e952537a44773e6bd5e7d14c41cdade3d13a0fce54ff4d

Download Submit
C:\Windows\SysWOW64\Ejbkehcg.exe

Filesize
295KB

MD5
eaae670c68fdfcc110c594031ad9f54c

SHA1
6adaab97a4db8a34bb5b0e689bf719a60af8fae8

SHA256
d51e856f4b75a652c5571a9af184683b1d78644f10bae01e8edddb872d7f46fc

SHA512
f96394c80eb89a66ea14ef87e7a43a7c0d58396d56bb457ffd9494448f29dd2d33d99c60ba51f62f29980a98e209d159a7db3dd618b55d11c22009501a748042

Download Submit
C:\Windows\SysWOW64\Ejegjh32.exe

Filesize
295KB

MD5
c5f97003a4733b62cf0169a0efb36831

SHA1
74e13f8fa026a2ab04c32148ae6ae87235af89d0

SHA256
d2e7eca1010416c4c7b5ba0e682e52a741eaaa84ce94d8b11c3ae95f598f8ff6

SHA512
b7461ef938fde094a153e9cb6b9617947754f88b9b2611739801f3652515313e27023e2efb316de244f801ec13a95c1f2620a7fce2463cb86db8c58ca93692c3

Download Submit
C:\Windows\SysWOW64\Ejlmkgkl.exe

Filesize
295KB

MD5
6c28b181b228b51733337a63153b9a95

SHA1
64b30adf4bbf0e32a591ad5d66a6d8824f335d8d

SHA256
c44b15292a88609e37a0623edf9eae8fd38af87307afe620db32b916b578910f

SHA512
69fdfe7c3d19f17cab1c30cf78db53b2ede37ff8569b1a6ed26a6daffb05272e5adb2ea1e5a8449971d2adac8e0c8f33bd32f4d63c1d45f760f75e30bdedda46

Download Submit
C:\Windows\SysWOW64\Eleplc32.exe

Filesize
295KB

MD5
022f8838d09fd948944aa91d341c1623

SHA1
4c6d9b80c3fd4e3450100cc2f4feac95c9ea8bee

SHA256
aef83058411e4d744ea604a015efc23c7ba12c2b220a7aa2a3465c5b4f5bfb70

SHA512
2735ceacb4cf8f17a29a0abbaff4055acbef495a927aeb74a954d7267277f4b086d85420339a09149c1c3ac2f5baa75fc03f182cb14de1891dd23cd69105d060

Download Submit
C:\Windows\SysWOW64\Eodlho32.exe

Filesize
295KB

MD5
1c0b5079f618d357b30bf06ff1437185

SHA1
18c5796b8745665af0e44d5fc132298eb696cd66

SHA256
1c0b3358f2db4ac995a4d9048de470056eaf5efa42517a6d5aa7c2d387038eb5

SHA512
73c98d24e0930ddec03a5c2ef378e29a2242556808970fda82b93dc99769f396a5e1a59c6aa6a62016281288c67d0daeef3bb6dbaeda3107a494a0550ab18a36

Download Submit
C:\Windows\SysWOW64\Eofinnkf.exe

Filesize
295KB

MD5
34f4e4d602cfb867ca90adc9d1d7363b

SHA1
e8aa424e933f489eed2e3e13ffbb2e28766e881c

SHA256
d625955ceb6fa6f3d3789a2d5392942c3cd3c4fbbb1747299fc7e7c090452e5d

SHA512
23b4da1d15822a2465d6e7044f72630d2c5c7a8236fbf682f935bd355770f846fb6a66af31ccff4be9b05dd1e61925cee5287d2e52bee6fce6bf7e8220bdec92

Download Submit
C:\Windows\SysWOW64\Eoocmoao.exe

Filesize
295KB

MD5
ac47fcf1c924c2c685975c3f14d8ea77

SHA1
bd7bad525bd636926ddc766e790a06bc503147e9

SHA256
db80f63f031443f6de55b868f4bb5b6a5b5c0e8a4bb21fb38760db529f133d08

SHA512
cb4d73bd778cb783914cbcf04b04ed1e8a0d49d70196895da08a5b00c70a70ad13069f51f1dd6600b6fe86815105e231612721cd406e68d681cadc8d86e85d8a

Download Submit
C:\Windows\SysWOW64\Epopgbia.exe

Filesize
295KB

MD5
493b2436b3f9ae06ba7b853f0c08cce2

SHA1
6610f8ea80cafef517db6407ace9a6f25cb6f909

SHA256
6b4af07fcc959a8af1f47bfd1a81b1803858a918daf01bcfaea3e397ac141875

SHA512
9f22643b05d8619e8e0754db72429d82b150119173dae6c32b6b2753c10b71920161d9379c730db94e47786260df11c0b9629ba9cea607455ca09f337d7efdb4

Download Submit
C:\Windows\SysWOW64\Eqfeha32.exe

Filesize
295KB

MD5
a88a4b73fb33054471cb055456ad35f8

SHA1
c7c421abb3fcd7b14202122a342a84cc9e60d680

SHA256
8cbefcb8ab16863b3d6cd201ba9526a32284815e41f94ba6136f421b0acf2bba

SHA512
0e939ec51d28bba66ae9efca500478a98d784bcfbfc3f48b2a43d8f1952ea0f316bc461f1d11e442fd435c9880c18358884e3f9aaf22612a373f5353be969dae

Download Submit
C:\Windows\SysWOW64\Fcgoilpj.exe

Filesize
295KB

MD5
b60b940d116ac5c9ca9ef163d9e49ab2

SHA1
bfd9116e8d77b26c8bf9d37be2be3628c534fd53

SHA256
e27b48734f287722f7510b4ef50301886923d33153ff7515f47a5fee7395d09c

SHA512
a7189c1445acb68596e5a11fb286a5bb32ec851993fffc183df9913f186982a121c3427bf9b767125792e251c8658bb00aa270db05b02be6b78f1ba14132e548

Download Submit
C:\Windows\SysWOW64\Fcikolnh.exe

Filesize
295KB

MD5
9312dfd25360b066fee253b364f258ab

SHA1
2066dfa2a5daa1958a195884f9d36463659fda8a

SHA256
6bec3bfac8e90795723a5530f6f4f66d27fb39ee9d9ce9bbf934063b0c7cb8cc

SHA512
3e7c437cea567e013751842ac92112429a97d42c5101f8a71a77ed8ee7bea30252b54f242e0503f1daf0e47cb2c895a02f769a36b3c2b14c9682f26a71137883

Download Submit
C:\Windows\SysWOW64\Ffbnph32.exe

Filesize
295KB

MD5
e9da0282c4297f82832a5074acb53bb4

SHA1
4a8771098b5ba7c578fce837f9df3903fdd8021c

SHA256
c782dc60852a4b4059a1ed8ebe175bd7bcaa4f1329402f25eb7020e7737e5373

SHA512
76b247f3471eac0a97a1a6ccc8bef209e075320288fa10644dd2714b4ce1aab49f392a909a17b9375e05684c6c627e4a14615212d80da2758a1069fa92ae1f63

Download Submit
C:\Windows\SysWOW64\Ffekegon.exe

Filesize
295KB

MD5
b7283b9afc882f2d2b435bbca1614cc1

SHA1
8e87bd713601548652c829a7d5adc384d0fa44cf

SHA256
21b8850ab2264784488a886f87330ec2dfbb8afb4191a0b8bc0b2d2746dd0cdb

SHA512
0849aede342a50640b17442be71cbe411ea0bf39204f96e68733d0c1dc8beb218d817feed7d02e004faa641ea79a65c9fa088718cf734a71d7dd12ff10729000

Download Submit
C:\Windows\SysWOW64\Ffggkgmk.exe

Filesize
295KB

MD5
a6716010b986820b5257acfac771b74c

SHA1
c8105561d2d31575da8f518404c070549aef1b1c

SHA256
3f3d3c4e101ef2e4adc26f268d5d1fc01fd5c11c93064fc76674ca39fa2a41b4

SHA512
f2d080a5c869cb3d441439988ef356286209ee33a2d0ccb5486f93bf1caf702dcd35bf96ed5e7455892d182f260ee21e7f19f4e9bc8825bc5a080ed649a6eb69

Download Submit
C:\Windows\SysWOW64\Fhajlc32.exe

Filesize
295KB

MD5
485df1b5ca9bc9195bc005fe80e555e7

SHA1
a484d3134ddbc0a5973a9f00204335053b5b8b2e

SHA256
f5917cbd46561c9094016b587368dded9ddd4d3f83cd56fc8b12d9cc12585ade

SHA512
30a3bcdd09c545b2d1604520e6d32704bf8cd88cb1e42db142d8439d13903c6bcf396705b18c62ded9c87878aef32d2c7947a05903c72e949c06bf3c849d0698

Download Submit
C:\Windows\SysWOW64\Ficgacna.exe

Filesize
295KB

MD5
2e7cb88e461bd3308d7b261b3e2cd311

SHA1
7d8188cda5fdd70a6e8d7b7ade687599bef4e770

SHA256
c43a00b458bae33ea1a4a6ec79d2b78921697075b910d5a5da499f47517b4220

SHA512
e9091320b224fdfe2f23f5e37ab5501789469ec9d2e7d9b8deca683557e6849c45514344817975c5fe9ad2e1d395ba5e467283ed9094602a8e33e130c73e8490

Download Submit
C:\Windows\SysWOW64\Fjnjqfij.exe

Filesize
295KB

MD5
04f8a2aed5d1fa252a1ca92f9a6ca576

SHA1
bec555605d3ce773ff56542f992f3e0ec7408227

SHA256
f39900b9b95ba2551d5db853469d2e8148cc016427e2e161bebbeeea9ef01eb9

SHA512
ea6c816f1b0188f59c72f33d7def07e890df6f710084aa6384d591a84d2edf8e7fa33a5db0b4d959b841e195b317f990bcb155a5f10ce5c4449da98388c97bd5

Download Submit
C:\Windows\SysWOW64\Hclakimb.exe

Filesize
295KB

MD5
920d545b3c1f87d6050b3c71fb404b9e

SHA1
d5685b0a2bbe4a912ce55ed6e8537ecbf26947dd

SHA256
4249349ecd0aea6dedb3f73703892a9b4b8fe51b5549342079b9ed1a3fdc6f8e

SHA512
44e4c692e8f7e7e317a82699a219320289d32e46d8e0643c5d93ce33bca0b5ee0219bb9f1fd775e762bac17cf58460bf5b316527c03d1a7d5cf6b5cf17c25350

Download Submit
C:\Windows\SysWOW64\Ijdeiaio.exe

Filesize
295KB

MD5
1ad16c19a1e7c3df79245db9318309c5

SHA1
b314bb286c3902ca4b2a3aa4b721978a353075f9

SHA256
3cb1430f18362fad6dfafcc60c79f4532ff3a7266024f86d01dc2668edfa532b

SHA512
f3377e5f667ab6cffcd59e869d642a21b8205ffae6b64d4034c8edd5a9b9678fb8a3c2d193e4903566a3351967e7f09ddd39a26730aff4c1005277d2080dd084

Download Submit
C:\Windows\SysWOW64\Kpepcedo.exe

Filesize
295KB

MD5
481c40a300113fbf84b93c401f562774

SHA1
bc5bf0ebfc72c6b45af5dc98a649994e5fa2a717

SHA256
1353ea61a638735a775f433b93a320898a64110b9736103a44b4d08b5e2188f6

SHA512
5a334f356630bc5e207c468b4b3d39eb0522ccea686b41354cd0ea1b52fc843cd576a50465e499e7488bd4058967aafe06b43fef68fac84752454b8b1b2e6c63

Download Submit
C:\Windows\SysWOW64\Lgbnmm32.exe

Filesize
295KB

MD5
6087310a535001b0542e7acdd65d7dc8

SHA1
94981c14667bc9aab2aca9550be56fa6535b3c89

SHA256
c65067444f76fda5b0836538370590c304983f7c194e9950b94a31099a3dd362

SHA512
6ffe1a580df19c3aaf474379b20f73b88cbc3eaa9eaf8029ab0a2b114f026dccae9bab50570865f68eafebd66b1deeb88e99155104e4c7a5f65fc197b6b812ac

Download Submit
C:\Windows\SysWOW64\Llcpoo32.exe

Filesize
295KB

MD5
72a51ae4708b3f288efe0bc6200c369c

SHA1
49c8aeadd01949a2514696f623275ba0187b7998

SHA256
8abb43fd32cf80e6e09cee98c859f6b3a7168e8a0f1e68f519dfcc3808c4ad2c

SHA512
b9020715bd8c610129b4a4c3856c1f3053131730b4277e9ee1887a82aa20bd25259d5f8599b7560cf57e5b0c6445c273f474197bea4da58a3526fb7c2cb31a10

Download Submit
C:\Windows\SysWOW64\Oqkdcn32.exe

Filesize
295KB

MD5
561b79c0cd07547829d0dc28a5f5a979

SHA1
8fc5d72d83d671666478add60bb6515751982204

SHA256
157e48727120323e49f80fc70b633e6b2cae76efc984d3c100b53de68423eb54

SHA512
919c9454a63dc12ccb4dcba0e70fbe301ca9f2df16c62516299ebd321b734cf030c200698a462b1b5e9396966812af75f095216172a23087ce32dd490edcbaf2

Download Submit
memory/60-90-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/536-419-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/624-65-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/664-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/784-258-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/840-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/840-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/840-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/868-402-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/940-130-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1040-388-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1116-266-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1216-49-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1296-226-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1396-25-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1420-73-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1428-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1460-317-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1500-336-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1624-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1684-122-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1716-162-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1940-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1948-430-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1960-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2164-242-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2192-145-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2208-366-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2304-199-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2440-352-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2520-354-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2544-234-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2624-376-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2628-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2780-169-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3116-213-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3292-307-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3392-137-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3492-433-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3504-330-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3576-408-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3600-300-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3724-113-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3900-186-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3904-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3960-177-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4116-97-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4152-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4192-322-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4204-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4344-206-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4364-253-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4384-425-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4412-395-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4592-158-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4612-81-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4792-3678-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4824-342-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4892-382-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4936-218-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4976-270-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5008-276-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5040-400-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5064-33-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5108-106-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12348-3679-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12536-3677-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12632-3676-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12764-3675-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12848-3687-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12856-3674-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12908-3686-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/12972-3685-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/13000-3673-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/13040-3684-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/13108-3683-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/13116-3672-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/13180-3682-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/13212-3681-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/13220-3671-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/13296-3680-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads