d03be044ef248cf8ecf5d8205d56030483b7a01876383f2d69889b3f09ffd569

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 01:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d03be044ef248cf8ecf5d8205d56030483b7a01876383f2d69889b3f09ffd569.exe
Size

109KB
MD5

1dc4e150a6a47ca4b0fc470aeff7279d
SHA1

313231fadad07dceb2f0f69ab8679855673ac51e
SHA256

d03be044ef248cf8ecf5d8205d56030483b7a01876383f2d69889b3f09ffd569
SHA512

a1f3f31cf2c46d27bad92a1b03aad2da089cb637916a0ecb3104e82b48c65bf0597554a0101d7c20c74d8f3c94af44a43946b6eaa76f2108b34e444598eccd77
SSDEEP

3072:aeJD+aqA5hcCnIwJ9KLCqwzBu1DjHLMVDqqkSpR:bJDHsQJ9+wtu1DjrFqhz

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfjcgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kmncnb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cajcbgml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kdcbom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kcifkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clkndpag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmknaell.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocbddc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecdbdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fflaff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmmocpjk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ambgef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ldjhpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Epopgbia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pnbbbabh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icgjmapi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mncmjfmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hobkfd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfcicmqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ifllil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kbfbkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Habnjm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kknafn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgidml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngdmod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odapnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmdkch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imihfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnjbke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkljak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Obidhaog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bahmfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bopgjmhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fhgjblfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Onhhamgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mpaifalo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajkhdp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dadeieea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehlaaddj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdopod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Klimip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hecmijim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbjhlfhb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkgdml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pndohaqe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daekdooc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gcggpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kfankifm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdeoemeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kfmepi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llcpoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hjolnb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmnaakne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgneampk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mibpda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olcbmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhemmlhc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkoiefmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Llemdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Onfbfc32.exe

Executes dropped EXE 64 IoCs

pid	Process
412	Ejbkehcg.exe
3216	Elagacbk.exe
3656	Eckonn32.exe
2668	Ejegjh32.exe
4852	Epopgbia.exe
2452	Eflhoigi.exe
3288	Ehjdldfl.exe
4800	Eqalmafo.exe
720	Ebbidj32.exe
4608	Ehlaaddj.exe
2324	Eqciba32.exe
4816	Efpajh32.exe
3968	Emjjgbjp.exe
2328	Ecdbdl32.exe
4496	Fjnjqfij.exe
2412	Fokbim32.exe
3432	Ffekegon.exe
2872	Fmocba32.exe
3496	Fomonm32.exe
2864	Fjcclf32.exe
1752	Fmapha32.exe
4464	Fjepaecb.exe
2772	Fflaff32.exe
2544	Fjhmgeao.exe
2516	Fijmbb32.exe
1160	Gbcakg32.exe
4124	Gjjjle32.exe
1676	Gqdbiofi.exe
2212	Gcbnejem.exe
1656	Gfqjafdq.exe
3640	Giofnacd.exe
1936	Gqfooodg.exe
1512	Gcekkjcj.exe
4312	Gfcgge32.exe
4520	Gjocgdkg.exe
3748	Gmmocpjk.exe
3988	Gcggpj32.exe
4792	Gbjhlfhb.exe
1552	Gjapmdid.exe
2716	Gmoliohh.exe
4796	Gpnhekgl.exe
1476	Gfhqbe32.exe
2644	Gifmnpnl.exe
4584	Gameonno.exe
3792	Hboagf32.exe
2980	Hjfihc32.exe
892	Hapaemll.exe
1296	Hcnnaikp.exe
3992	Hfljmdjc.exe
1984	Hjhfnccl.exe
4992	Hmfbjnbp.exe
3948	Habnjm32.exe
704	Hbckbepg.exe
2960	Hfofbd32.exe
2932	Himcoo32.exe
8	Hmioonpn.exe
1816	Hccglh32.exe
512	Hjmoibog.exe
3224	Hmklen32.exe
4996	Hpihai32.exe
1592	Hbhdmd32.exe
452	Hjolnb32.exe
3484	Haidklda.exe
2672	Ipldfi32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ogedoeae.dll	Emjjgbjp.exe
File opened for modification	C:\Windows\SysWOW64\Jdjfcecp.exe	Jaljgidl.exe
File opened for modification	C:\Windows\SysWOW64\Bemlmgnp.exe	Baaplhef.exe
File created	C:\Windows\SysWOW64\Cdiooblp.exe	Cajcbgml.exe
File opened for modification	C:\Windows\SysWOW64\Ocbddc32.exe	Olhlhjpd.exe
File created	C:\Windows\SysWOW64\Jkdnpo32.exe	Jdjfcecp.exe
File created	C:\Windows\SysWOW64\Ghiqbiae.dll	Kagichjo.exe
File opened for modification	C:\Windows\SysWOW64\Nnjbke32.exe	Nklfoi32.exe
File opened for modification	C:\Windows\SysWOW64\Ndghmo32.exe	Nbhkac32.exe
File created	C:\Windows\SysWOW64\Obidhaog.exe	Okolkg32.exe
File created	C:\Windows\SysWOW64\Fmapha32.exe	Fjcclf32.exe
File opened for modification	C:\Windows\SysWOW64\Giofnacd.exe	Gfqjafdq.exe
File opened for modification	C:\Windows\SysWOW64\Odapnf32.exe	Oqfdnhfk.exe
File opened for modification	C:\Windows\SysWOW64\Nklfoi32.exe	Ndbnboqb.exe
File opened for modification	C:\Windows\SysWOW64\Okolkg32.exe	Odednmpm.exe
File opened for modification	C:\Windows\SysWOW64\Ickchq32.exe	Imakkfdg.exe
File created	C:\Windows\SysWOW64\Jcgbco32.exe	Jplfcpin.exe
File created	C:\Windows\SysWOW64\Oeahce32.dll	Gcekkjcj.exe
File created	C:\Windows\SysWOW64\Jlnpomfk.dll	Nnjbke32.exe
File created	C:\Windows\SysWOW64\Chncif32.dll	Elgfgl32.exe
File created	C:\Windows\SysWOW64\Abemjmgg.exe	Ajneip32.exe
File opened for modification	C:\Windows\SysWOW64\Lffhfh32.exe	Kdgljmcd.exe
File created	C:\Windows\SysWOW64\Eeopdi32.dll	Ijfboafl.exe
File created	C:\Windows\SysWOW64\Kkbkamnl.exe	Kckbqpnj.exe
File opened for modification	C:\Windows\SysWOW64\Ipknlb32.exe	Iiaephpc.exe
File created	C:\Windows\SysWOW64\Jcllonma.exe	Jpppnp32.exe
File created	C:\Windows\SysWOW64\Gpaekf32.dll	Olkhmi32.exe
File created	C:\Windows\SysWOW64\Qmkadgpo.exe	Pdpmpdbd.exe
File opened for modification	C:\Windows\SysWOW64\Ceoibflm.exe	Bdolhc32.exe
File opened for modification	C:\Windows\SysWOW64\Lphoelqn.exe	Lmiciaaj.exe
File opened for modification	C:\Windows\SysWOW64\Hmklen32.exe	Hjmoibog.exe
File created	C:\Windows\SysWOW64\Bclgpkgk.dll	Iikopmkd.exe
File created	C:\Windows\SysWOW64\Lppaheqp.dll	Jigollag.exe
File created	C:\Windows\SysWOW64\Ejmcmk32.dll	Ajneip32.exe
File opened for modification	C:\Windows\SysWOW64\Likjcbkc.exe	Lepncd32.exe
File created	C:\Windows\SysWOW64\Gjjjle32.exe	Gbcakg32.exe
File created	C:\Windows\SysWOW64\Odbgim32.exe	Oqgkhnjf.exe
File created	C:\Windows\SysWOW64\Fomhdg32.exe	Flnlhk32.exe
File created	C:\Windows\SysWOW64\Fjegoh32.dll	Nlaegk32.exe
File opened for modification	C:\Windows\SysWOW64\Cjkjpgfi.exe	Chjaol32.exe
File created	C:\Windows\SysWOW64\Fakdpb32.exe	Fchddejl.exe
File created	C:\Windows\SysWOW64\Ekipni32.dll	Mcpebmkb.exe
File created	C:\Windows\SysWOW64\Mpjlklok.exe	Mmlpoqpg.exe
File opened for modification	C:\Windows\SysWOW64\Hjmoibog.exe	Hccglh32.exe
File created	C:\Windows\SysWOW64\Gjocgdkg.exe	Gfcgge32.exe
File created	C:\Windows\SysWOW64\Jaljgidl.exe	Jmpngk32.exe
File created	C:\Windows\SysWOW64\Nbkhfc32.exe	Nnolfdcn.exe
File created	C:\Windows\SysWOW64\Nhgfglco.dll	Lmgfda32.exe
File created	C:\Windows\SysWOW64\Gcbnejem.exe	Gqdbiofi.exe
File opened for modification	C:\Windows\SysWOW64\Ddpeoafg.exe	Demecd32.exe
File created	C:\Windows\SysWOW64\Fojlngce.exe	Fkopnh32.exe
File opened for modification	C:\Windows\SysWOW64\Imihfl32.exe	Ijkljp32.exe
File created	C:\Windows\SysWOW64\Laciofpa.exe	Lkiqbl32.exe
File created	C:\Windows\SysWOW64\Ajdbcano.exe	Agffge32.exe
File opened for modification	C:\Windows\SysWOW64\Kbfbkj32.exe	Kdcbom32.exe
File opened for modification	C:\Windows\SysWOW64\Mkgmcjld.exe	Mcpebmkb.exe
File opened for modification	C:\Windows\SysWOW64\Jcgbco32.exe	Jplfcpin.exe
File created	C:\Windows\SysWOW64\Fjhmgeao.exe	Fflaff32.exe
File created	C:\Windows\SysWOW64\Andgoobc.exe	Alfkbc32.exe
File opened for modification	C:\Windows\SysWOW64\Kdcbom32.exe	Klljnp32.exe
File opened for modification	C:\Windows\SysWOW64\Ojaelm32.exe	Ofeilobp.exe
File created	C:\Windows\SysWOW64\Ceoibflm.exe	Bdolhc32.exe
File created	C:\Windows\SysWOW64\Inlekh32.dll	Eadopc32.exe
File created	C:\Windows\SysWOW64\Dlgmpogj.exe	Ddpeoafg.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12792	13164	WerFault.exe	676

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aldomc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckafhlkg.dll"	Dafbne32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ipdqba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekipni32.dll"	Mcpebmkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Majknlkd.dll"	Nddkgonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anphnl32.dll"	Glebhjlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifmafkkf.dll"	Gicinj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ebbidj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Liggbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gdqgmmjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hleecc32.dll"	Mdehlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bhdbhcck.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jcbihpel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndqgbjkm.dll"	Jfhlejnh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kbceejpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kknafn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gfpcgpae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mipcob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dddojq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ekjfcipa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ehlaaddj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gqdbiofi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fkmchi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pqknig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kkpnlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Blbknaib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ifefimom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nggdeh32.dll"	Aejfpjne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gfembo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmcdaagm.dll"	Oddmdf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Laalifad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lphfpbdi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pkaiqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Abemjmgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkfbjdpq.dll"	Nnolfdcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mpablkhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpkknm32.dll"	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jglkll32.dll"	Odednmpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iblfnn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Imdgqfbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cefofm32.dll"	Jedeph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jkdnpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ldmlpbbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ajdbcano.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hfifmnij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phadlp32.dll"	Ajkhdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dkljak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcjfkm32.dll"	Ecoangbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kiidgeki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hbckbepg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lihoogdd.dll"	Ifmcdblq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kkbkamnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mdkhapfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pkceffcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kgdphnlp.dll"	Hmhhehlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcinbcgc.dll"	Iehfdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkjlibkf.dll"	Mlhbal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kipkhdeq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Naekcf32.dll"	Oqfdnhfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jibpdc32.dll"	Ijkljp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Adcmmeog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dllfkn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ekemhj32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 412	5016	d03be044ef248cf8ecf5d8205d56030483b7a01876383f2d69889b3f09ffd569.exe	88
PID 5016 wrote to memory of 412	5016	d03be044ef248cf8ecf5d8205d56030483b7a01876383f2d69889b3f09ffd569.exe	88
PID 5016 wrote to memory of 412	5016	d03be044ef248cf8ecf5d8205d56030483b7a01876383f2d69889b3f09ffd569.exe	88
PID 412 wrote to memory of 3216	412	Ejbkehcg.exe	89
PID 412 wrote to memory of 3216	412	Ejbkehcg.exe	89
PID 412 wrote to memory of 3216	412	Ejbkehcg.exe	89
PID 3216 wrote to memory of 3656	3216	Elagacbk.exe	90
PID 3216 wrote to memory of 3656	3216	Elagacbk.exe	90
PID 3216 wrote to memory of 3656	3216	Elagacbk.exe	90
PID 3656 wrote to memory of 2668	3656	Eckonn32.exe	91
PID 3656 wrote to memory of 2668	3656	Eckonn32.exe	91
PID 3656 wrote to memory of 2668	3656	Eckonn32.exe	91
PID 2668 wrote to memory of 4852	2668	Ejegjh32.exe	92
PID 2668 wrote to memory of 4852	2668	Ejegjh32.exe	92
PID 2668 wrote to memory of 4852	2668	Ejegjh32.exe	92
PID 4852 wrote to memory of 2452	4852	Epopgbia.exe	94
PID 4852 wrote to memory of 2452	4852	Epopgbia.exe	94
PID 4852 wrote to memory of 2452	4852	Epopgbia.exe	94
PID 2452 wrote to memory of 3288	2452	Eflhoigi.exe	95
PID 2452 wrote to memory of 3288	2452	Eflhoigi.exe	95
PID 2452 wrote to memory of 3288	2452	Eflhoigi.exe	95
PID 3288 wrote to memory of 4800	3288	Ehjdldfl.exe	96
PID 3288 wrote to memory of 4800	3288	Ehjdldfl.exe	96
PID 3288 wrote to memory of 4800	3288	Ehjdldfl.exe	96
PID 4800 wrote to memory of 720	4800	Eqalmafo.exe	97
PID 4800 wrote to memory of 720	4800	Eqalmafo.exe	97
PID 4800 wrote to memory of 720	4800	Eqalmafo.exe	97
PID 720 wrote to memory of 4608	720	Ebbidj32.exe	98
PID 720 wrote to memory of 4608	720	Ebbidj32.exe	98
PID 720 wrote to memory of 4608	720	Ebbidj32.exe	98
PID 4608 wrote to memory of 2324	4608	Ehlaaddj.exe	99
PID 4608 wrote to memory of 2324	4608	Ehlaaddj.exe	99
PID 4608 wrote to memory of 2324	4608	Ehlaaddj.exe	99
PID 2324 wrote to memory of 4816	2324	Eqciba32.exe	100
PID 2324 wrote to memory of 4816	2324	Eqciba32.exe	100
PID 2324 wrote to memory of 4816	2324	Eqciba32.exe	100
PID 4816 wrote to memory of 3968	4816	Efpajh32.exe	101
PID 4816 wrote to memory of 3968	4816	Efpajh32.exe	101
PID 4816 wrote to memory of 3968	4816	Efpajh32.exe	101
PID 3968 wrote to memory of 2328	3968	Emjjgbjp.exe	102
PID 3968 wrote to memory of 2328	3968	Emjjgbjp.exe	102
PID 3968 wrote to memory of 2328	3968	Emjjgbjp.exe	102
PID 2328 wrote to memory of 4496	2328	Ecdbdl32.exe	103
PID 2328 wrote to memory of 4496	2328	Ecdbdl32.exe	103
PID 2328 wrote to memory of 4496	2328	Ecdbdl32.exe	103
PID 4496 wrote to memory of 2412	4496	Fjnjqfij.exe	104
PID 4496 wrote to memory of 2412	4496	Fjnjqfij.exe	104
PID 4496 wrote to memory of 2412	4496	Fjnjqfij.exe	104
PID 2412 wrote to memory of 3432	2412	Fokbim32.exe	105
PID 2412 wrote to memory of 3432	2412	Fokbim32.exe	105
PID 2412 wrote to memory of 3432	2412	Fokbim32.exe	105
PID 3432 wrote to memory of 2872	3432	Ffekegon.exe	106
PID 3432 wrote to memory of 2872	3432	Ffekegon.exe	106
PID 3432 wrote to memory of 2872	3432	Ffekegon.exe	106
PID 2872 wrote to memory of 3496	2872	Fmocba32.exe	107
PID 2872 wrote to memory of 3496	2872	Fmocba32.exe	107
PID 2872 wrote to memory of 3496	2872	Fmocba32.exe	107
PID 3496 wrote to memory of 2864	3496	Fomonm32.exe	108
PID 3496 wrote to memory of 2864	3496	Fomonm32.exe	108
PID 3496 wrote to memory of 2864	3496	Fomonm32.exe	108
PID 2864 wrote to memory of 1752	2864	Fjcclf32.exe	109
PID 2864 wrote to memory of 1752	2864	Fjcclf32.exe	109
PID 2864 wrote to memory of 1752	2864	Fjcclf32.exe	109
PID 1752 wrote to memory of 4464	1752	Fmapha32.exe	110

C:\Users\Admin\AppData\Local\Temp\d03be044ef248cf8ecf5d8205d56030483b7a01876383f2d69889b3f09ffd569.exe
"C:\Users\Admin\AppData\Local\Temp\d03be044ef248cf8ecf5d8205d56030483b7a01876383f2d69889b3f09ffd569.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\SysWOW64\Ejbkehcg.exe
  C:\Windows\system32\Ejbkehcg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:412
- - C:\Windows\SysWOW64\Elagacbk.exe
    C:\Windows\system32\Elagacbk.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3216
  - - C:\Windows\SysWOW64\Eckonn32.exe
      C:\Windows\system32\Eckonn32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3656
    - - C:\Windows\SysWOW64\Ejegjh32.exe
        
        C:\Windows\system32\Ejegjh32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2668
      - C:\Windows\SysWOW64\Epopgbia.exe
        
        C:\Windows\system32\Epopgbia.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Windows\SysWOW64\Eflhoigi.exe
        
        C:\Windows\system32\Eflhoigi.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2452
        
        C:\Windows\SysWOW64\Ehjdldfl.exe
        
        C:\Windows\system32\Ehjdldfl.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3288
        
        C:\Windows\SysWOW64\Eqalmafo.exe
        
        C:\Windows\system32\Eqalmafo.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Windows\SysWOW64\Ebbidj32.exe
        
        C:\Windows\system32\Ebbidj32.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:720
        
        C:\Windows\SysWOW64\Ehlaaddj.exe
        
        C:\Windows\system32\Ehlaaddj.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4608
        
        C:\Windows\SysWOW64\Eqciba32.exe
        
        C:\Windows\system32\Eqciba32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2324
        
        C:\Windows\SysWOW64\Efpajh32.exe
        
        C:\Windows\system32\Efpajh32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4816
        
        C:\Windows\SysWOW64\Emjjgbjp.exe
        
        C:\Windows\system32\Emjjgbjp.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3968
        
        C:\Windows\SysWOW64\Ecdbdl32.exe
        
        C:\Windows\system32\Ecdbdl32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2328
        
        C:\Windows\SysWOW64\Fjnjqfij.exe
        
        C:\Windows\system32\Fjnjqfij.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Windows\SysWOW64\Fokbim32.exe
        
        C:\Windows\system32\Fokbim32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Windows\SysWOW64\Ffekegon.exe
        
        C:\Windows\system32\Ffekegon.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3432
        
        C:\Windows\SysWOW64\Fmocba32.exe
        
        C:\Windows\system32\Fmocba32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2872
        
        C:\Windows\SysWOW64\Fomonm32.exe
        
        C:\Windows\system32\Fomonm32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3496
        
        C:\Windows\SysWOW64\Fjcclf32.exe
        
        C:\Windows\system32\Fjcclf32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2864
        
        C:\Windows\SysWOW64\Fmapha32.exe
        
        C:\Windows\system32\Fmapha32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1752
        
        C:\Windows\SysWOW64\Fjepaecb.exe
        
        C:\Windows\system32\Fjepaecb.exe
        23⤵
        Executes dropped EXE
        
        PID:4464
        
        C:\Windows\SysWOW64\Fflaff32.exe
        
        C:\Windows\system32\Fflaff32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2772
        
        C:\Windows\SysWOW64\Fjhmgeao.exe
        
        C:\Windows\system32\Fjhmgeao.exe
        25⤵
        Executes dropped EXE
        
        PID:2544
        
        C:\Windows\SysWOW64\Fijmbb32.exe
        
        C:\Windows\system32\Fijmbb32.exe
        26⤵
        Executes dropped EXE
        
        PID:2516
        
        C:\Windows\SysWOW64\Gbcakg32.exe
        
        C:\Windows\system32\Gbcakg32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1160
        
        C:\Windows\SysWOW64\Gjjjle32.exe
        
        C:\Windows\system32\Gjjjle32.exe
        28⤵
        Executes dropped EXE
        
        PID:4124
        
        C:\Windows\SysWOW64\Gqdbiofi.exe
        
        C:\Windows\system32\Gqdbiofi.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1676
        
        C:\Windows\SysWOW64\Gcbnejem.exe
        
        C:\Windows\system32\Gcbnejem.exe
        30⤵
        Executes dropped EXE
        
        PID:2212
        
        C:\Windows\SysWOW64\Gfqjafdq.exe
        
        C:\Windows\system32\Gfqjafdq.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1656
        
        C:\Windows\SysWOW64\Giofnacd.exe
        
        C:\Windows\system32\Giofnacd.exe
        32⤵
        Executes dropped EXE
        
        PID:3640
        
        C:\Windows\SysWOW64\Gqfooodg.exe
        
        C:\Windows\system32\Gqfooodg.exe
        33⤵
        Executes dropped EXE
        
        PID:1936
        
        C:\Windows\SysWOW64\Gcekkjcj.exe
        
        C:\Windows\system32\Gcekkjcj.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1512
        
        C:\Windows\SysWOW64\Gfcgge32.exe
        
        C:\Windows\system32\Gfcgge32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4312
        
        C:\Windows\SysWOW64\Gjocgdkg.exe
        
        C:\Windows\system32\Gjocgdkg.exe
        36⤵
        Executes dropped EXE
        
        PID:4520
        
        C:\Windows\SysWOW64\Gmmocpjk.exe
        
        C:\Windows\system32\Gmmocpjk.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3748
        
        C:\Windows\SysWOW64\Gcggpj32.exe
        
        C:\Windows\system32\Gcggpj32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3988
        
        C:\Windows\SysWOW64\Gbjhlfhb.exe
        
        C:\Windows\system32\Gbjhlfhb.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4792
        
        C:\Windows\SysWOW64\Gjapmdid.exe
        
        C:\Windows\system32\Gjapmdid.exe
        40⤵
        Executes dropped EXE
        
        PID:1552
        
        C:\Windows\SysWOW64\Gmoliohh.exe
        
        C:\Windows\system32\Gmoliohh.exe
        41⤵
        Executes dropped EXE
        
        PID:2716
        
        C:\Windows\SysWOW64\Gpnhekgl.exe
        
        C:\Windows\system32\Gpnhekgl.exe
        42⤵
        Executes dropped EXE
        
        PID:4796
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        43⤵
        Executes dropped EXE
        
        PID:1476
        
        C:\Windows\SysWOW64\Gifmnpnl.exe
        
        C:\Windows\system32\Gifmnpnl.exe
        44⤵
        Executes dropped EXE
        
        PID:2644
        
        C:\Windows\SysWOW64\Gameonno.exe
        
        C:\Windows\system32\Gameonno.exe
        45⤵
        Executes dropped EXE
        
        PID:4584
        
        C:\Windows\SysWOW64\Hboagf32.exe
        
        C:\Windows\system32\Hboagf32.exe
        46⤵
        Executes dropped EXE
        
        PID:3792
        
        C:\Windows\SysWOW64\Hjfihc32.exe
        
        C:\Windows\system32\Hjfihc32.exe
        47⤵
        Executes dropped EXE
        
        PID:2980
        
        C:\Windows\SysWOW64\Hapaemll.exe
        
        C:\Windows\system32\Hapaemll.exe
        48⤵
        Executes dropped EXE
        
        PID:892
        
        C:\Windows\SysWOW64\Hcnnaikp.exe
        
        C:\Windows\system32\Hcnnaikp.exe
        49⤵
        Executes dropped EXE
        
        PID:1296
        
        C:\Windows\SysWOW64\Hfljmdjc.exe
        
        C:\Windows\system32\Hfljmdjc.exe
        50⤵
        Executes dropped EXE
        
        PID:3992
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        51⤵
        Executes dropped EXE
        
        PID:1984
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        52⤵
        Executes dropped EXE
        
        PID:4992
        
        C:\Windows\SysWOW64\Habnjm32.exe
        
        C:\Windows\system32\Habnjm32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3948
        
        C:\Windows\SysWOW64\Hbckbepg.exe
        
        C:\Windows\system32\Hbckbepg.exe
        54⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:704
        
        C:\Windows\SysWOW64\Hfofbd32.exe
        
        C:\Windows\system32\Hfofbd32.exe
        55⤵
        Executes dropped EXE
        
        PID:2960
        
        C:\Windows\SysWOW64\Himcoo32.exe
        
        C:\Windows\system32\Himcoo32.exe
        56⤵
        Executes dropped EXE
        
        PID:2932
        
        C:\Windows\SysWOW64\Hmioonpn.exe
        
        C:\Windows\system32\Hmioonpn.exe
        57⤵
        Executes dropped EXE
        
        PID:8
        
        C:\Windows\SysWOW64\Hccglh32.exe
        
        C:\Windows\system32\Hccglh32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1816
        
        C:\Windows\SysWOW64\Hjmoibog.exe
        
        C:\Windows\system32\Hjmoibog.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:512
        
        C:\Windows\SysWOW64\Hmklen32.exe
        
        C:\Windows\system32\Hmklen32.exe
        60⤵
        Executes dropped EXE
        
        PID:3224
        
        C:\Windows\SysWOW64\Hpihai32.exe
        
        C:\Windows\system32\Hpihai32.exe
        61⤵
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\Hbhdmd32.exe
        
        C:\Windows\system32\Hbhdmd32.exe
        62⤵
        Executes dropped EXE
        
        PID:1592
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:452
        
        C:\Windows\SysWOW64\Haidklda.exe
        
        C:\Windows\system32\Haidklda.exe
        64⤵
        Executes dropped EXE
        
        PID:3484
        
        C:\Windows\SysWOW64\Ipldfi32.exe
        
        C:\Windows\system32\Ipldfi32.exe
        65⤵
        Executes dropped EXE
        
        PID:2672
        
        C:\Windows\SysWOW64\Ibjqcd32.exe
        
        C:\Windows\system32\Ibjqcd32.exe
        66⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\Ijaida32.exe
        
        C:\Windows\system32\Ijaida32.exe
        67⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\Iakaql32.exe
        
        C:\Windows\system32\Iakaql32.exe
        68⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\Icjmmg32.exe
        
        C:\Windows\system32\Icjmmg32.exe
        69⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\Ifhiib32.exe
        
        C:\Windows\system32\Ifhiib32.exe
        70⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        71⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\Ipqnahgf.exe
        
        C:\Windows\system32\Ipqnahgf.exe
        72⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\Ibojncfj.exe
        
        C:\Windows\system32\Ibojncfj.exe
        73⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        74⤵
        Drops file in System32 directory
        
        PID:4552
        
        C:\Windows\SysWOW64\Iiibkn32.exe
        
        C:\Windows\system32\Iiibkn32.exe
        75⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        76⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\Ibagcc32.exe
        
        C:\Windows\system32\Ibagcc32.exe
        77⤵
        
        PID:396
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        78⤵
        Modifies registry class
        
        PID:2944
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        79⤵
        Drops file in System32 directory
        
        PID:3204
        
        C:\Windows\SysWOW64\Imgkql32.exe
        
        C:\Windows\system32\Imgkql32.exe
        80⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\Ipegmg32.exe
        
        C:\Windows\system32\Ipegmg32.exe
        81⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\Ibccic32.exe
        
        C:\Windows\system32\Ibccic32.exe
        82⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\Ijkljp32.exe
        
        C:\Windows\system32\Ijkljp32.exe
        83⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2116
        
        C:\Windows\SysWOW64\Imihfl32.exe
        
        C:\Windows\system32\Imihfl32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4984
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        85⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\Jpgdbg32.exe
        
        C:\Windows\system32\Jpgdbg32.exe
        86⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        87⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\Jjmhppqd.exe
        
        C:\Windows\system32\Jjmhppqd.exe
        88⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        89⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        90⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3312
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        92⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        93⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        94⤵
        Drops file in System32 directory
        
        PID:3456
        
        C:\Windows\SysWOW64\Jaljgidl.exe
        
        C:\Windows\system32\Jaljgidl.exe
        95⤵
        Drops file in System32 directory
        
        PID:1924
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        96⤵
        Drops file in System32 directory
        
        PID:4540
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        97⤵
        Modifies registry class
        
        PID:5112
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        98⤵
        Drops file in System32 directory
        
        PID:5132
        
        C:\Windows\SysWOW64\Jangmibi.exe
        
        C:\Windows\system32\Jangmibi.exe
        99⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Jdmcidam.exe
        
        C:\Windows\system32\Jdmcidam.exe
        100⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        101⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Jiikak32.exe
        
        C:\Windows\system32\Jiikak32.exe
        102⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        103⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5396
        
        C:\Windows\SysWOW64\Kilhgk32.exe
        
        C:\Windows\system32\Kilhgk32.exe
        105⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        106⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        107⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Kkkdan32.exe
        
        C:\Windows\system32\Kkkdan32.exe
        108⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        109⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        110⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        111⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        112⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5772
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        114⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        115⤵
        Drops file in System32 directory
        
        PID:5860
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5908
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        117⤵
        Modifies registry class
        
        PID:5948
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        118⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Kajfig32.exe
        
        C:\Windows\system32\Kajfig32.exe
        119⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        120⤵
        Drops file in System32 directory
        
        PID:6080
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        121⤵
        Modifies registry class
        
        PID:6124
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        122⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        123⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        124⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        125⤵
        Modifies registry class
        
        PID:5324
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        126⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        127⤵
        Modifies registry class
        
        PID:5512
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        128⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5688
        
        C:\Windows\SysWOW64\Lijdhiaa.exe
        
        C:\Windows\system32\Lijdhiaa.exe
        130⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        131⤵
        Modifies registry class
        
        PID:5808
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        132⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5960
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        134⤵
        Drops file in System32 directory
        
        PID:6024
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        135⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        136⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        137⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        138⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        139⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5624
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        141⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        142⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        143⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        144⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        145⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        146⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Mnapdf32.exe
        
        C:\Windows\system32\Mnapdf32.exe
        147⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        148⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Mdkhapfj.exe
        
        C:\Windows\system32\Mdkhapfj.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5940
        
        C:\Windows\SysWOW64\Mgidml32.exe
        
        C:\Windows\system32\Mgidml32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5180
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        151⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5672
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6040
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        154⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5364
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        155⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        156⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        157⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        158⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        159⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Nkjjij32.exe
        
        C:\Windows\system32\Nkjjij32.exe
        160⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        161⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        162⤵
        Drops file in System32 directory
        
        PID:6344
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        163⤵
        Drops file in System32 directory
        
        PID:6392
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6452
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        165⤵
        Modifies registry class
        
        PID:6512
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        166⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        167⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        168⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        169⤵
        Drops file in System32 directory
        
        PID:6716
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        170⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        171⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        172⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        173⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6904
        
        C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        174⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        175⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7044
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        177⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        178⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Ndkahnhh.exe
        
        C:\Windows\system32\Ndkahnhh.exe
        179⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        180⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Okeieh32.exe
        
        C:\Windows\system32\Okeieh32.exe
        181⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Ondeac32.exe
        
        C:\Windows\system32\Ondeac32.exe
        182⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Oboaabga.exe
        
        C:\Windows\system32\Oboaabga.exe
        183⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Ocqnij32.exe
        
        C:\Windows\system32\Ocqnij32.exe
        184⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        185⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Ojjffddl.exe
        
        C:\Windows\system32\Ojjffddl.exe
        186⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6796
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        188⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        189⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Ojmcld32.exe
        
        C:\Windows\system32\Ojmcld32.exe
        190⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Oqgkhnjf.exe
        
        C:\Windows\system32\Oqgkhnjf.exe
        191⤵
        Drops file in System32 directory
        
        PID:7120
        
        C:\Windows\SysWOW64\Odbgim32.exe
        
        C:\Windows\system32\Odbgim32.exe
        192⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        193⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        194⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        195⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6572
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        196⤵
        Drops file in System32 directory
        
        PID:6692
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6828
        
        C:\Windows\SysWOW64\Oqkdcn32.exe
        
        C:\Windows\system32\Oqkdcn32.exe
        198⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        199⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        200⤵
        Modifies registry class
        
        PID:6176
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        201⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Pghieg32.exe
        
        C:\Windows\system32\Pghieg32.exe
        202⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        203⤵
        Modifies registry class
        
        PID:6976
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7096
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        205⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        206⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        207⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6592
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        209⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Pcagphom.exe
        
        C:\Windows\system32\Pcagphom.exe
        210⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        211⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        212⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Paegjl32.exe
        
        C:\Windows\system32\Paegjl32.exe
        213⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        214⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        215⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        216⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        217⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        218⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        219⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Qkmhlekj.exe
        
        C:\Windows\system32\Qkmhlekj.exe
        220⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        221⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        222⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        223⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Qjbena32.exe
        
        C:\Windows\system32\Qjbena32.exe
        224⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        225⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        226⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        227⤵
        Drops file in System32 directory
        
        PID:7852
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        228⤵
        Modifies registry class
        
        PID:7892
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        229⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        230⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        231⤵
        Modifies registry class
        
        PID:8016
        
        C:\Windows\SysWOW64\Aldomc32.exe
        
        C:\Windows\system32\Aldomc32.exe
        232⤵
        Modifies registry class
        
        PID:8060
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        233⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        234⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        235⤵
        Drops file in System32 directory
        
        PID:8184
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        236⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Aacckjaf.exe
        
        C:\Windows\system32\Aacckjaf.exe
        237⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        238⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        239⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7432
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        241⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Adcmmeog.exe
        
        C:\Windows\system32\Adcmmeog.exe
        242⤵
        Modifies registry class
        
        PID:7604
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        243⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        244⤵
        Drops file in System32 directory
        
        PID:7740
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        245⤵
        Modifies registry class
        
        PID:7804
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7880
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        247⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        248⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        249⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        250⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Bhdbhcck.exe
        
        C:\Windows\system32\Bhdbhcck.exe
        251⤵
        Modifies registry class
        
        PID:6432
        
        C:\Windows\SysWOW64\Bjbndobo.exe
        
        C:\Windows\system32\Bjbndobo.exe
        252⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        253⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        254⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        255⤵
        Modifies registry class
        
        PID:7644
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7716
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        257⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        258⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        259⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        260⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        261⤵
        Drops file in System32 directory
        
        PID:7424
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        262⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        263⤵
        Drops file in System32 directory
        
        PID:7824
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        264⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        265⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        266⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        267⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        268⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        269⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7428
        
        C:\Windows\SysWOW64\Cojjqlpk.exe
        
        C:\Windows\system32\Cojjqlpk.exe
        271⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        272⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        273⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        274⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        275⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8388
        
        C:\Windows\SysWOW64\Cdiooblp.exe
        
        C:\Windows\system32\Cdiooblp.exe
        277⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        278⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        279⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        280⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        281⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        282⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        283⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        284⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        285⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        286⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        287⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        288⤵
        Drops file in System32 directory
        
        PID:8888
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        289⤵
        Drops file in System32 directory
        
        PID:8924
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        290⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        291⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9056
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        293⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        294⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9176
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        296⤵
        Modifies registry class
        
        PID:7348
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        297⤵
        Modifies registry class
        
        PID:8212
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        298⤵
        Modifies registry class
        
        PID:8248
        
        C:\Windows\SysWOW64\Dojcgi32.exe
        
        C:\Windows\system32\Dojcgi32.exe
        299⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        300⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        301⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        302⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        303⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Eolpmi32.exe
        
        C:\Windows\system32\Eolpmi32.exe
        304⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        305⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        306⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        307⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        308⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        309⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        310⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        311⤵
        Modifies registry class
        
        PID:9160
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        312⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        313⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        314⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        315⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        316⤵
        Modifies registry class
        
        PID:8592
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        317⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        318⤵
        Drops file in System32 directory
        
        PID:8796
        
        C:\Windows\SysWOW64\Ekjfcipa.exe
        
        C:\Windows\system32\Ekjfcipa.exe
        319⤵
        Modifies registry class
        
        PID:8944
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        320⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        321⤵
        Drops file in System32 directory
        
        PID:9124
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        322⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        323⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        324⤵
        Modifies registry class
        
        PID:8584
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        325⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        326⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        327⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        328⤵
        Drops file in System32 directory
        
        PID:8408
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        329⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        330⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        331⤵
        Drops file in System32 directory
        
        PID:8208
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        332⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        333⤵
        Drops file in System32 directory
        
        PID:9048
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        334⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8500
        
        C:\Windows\SysWOW64\Fkciihgg.exe
        
        C:\Windows\system32\Fkciihgg.exe
        336⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        337⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        338⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9348
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        340⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        341⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        342⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        343⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        344⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        345⤵
        Modifies registry class
        
        PID:9604
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        346⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        347⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        348⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        349⤵
        Modifies registry class
        
        PID:9772
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        350⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        351⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        352⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        353⤵
        Modifies registry class
        
        PID:9928
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        354⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Gkmlofol.exe
        
        C:\Windows\system32\Gkmlofol.exe
        355⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        356⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        357⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        358⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10188
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        360⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        361⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        362⤵
        Modifies registry class
        
        PID:9340
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        363⤵
        Modifies registry class
        
        PID:9408
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        364⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        365⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        366⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        367⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        368⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        369⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        370⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        371⤵
        Modifies registry class
        
        PID:10048
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        372⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10168
        
        C:\Windows\SysWOW64\Hbpgbo32.exe
        
        C:\Windows\system32\Hbpgbo32.exe
        374⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        375⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        376⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        377⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        378⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        379⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        380⤵
        Modifies registry class
        
        PID:10112
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        381⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        382⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        383⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9696
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        384⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        385⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        386⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        387⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9876
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        388⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        389⤵
        Drops file in System32 directory
        
        PID:9760
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        390⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        391⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10128
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        392⤵
        Modifies registry class
        
        PID:10280
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        393⤵
        Modifies registry class
        
        PID:10316
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        394⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        395⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        396⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        397⤵
        Modifies registry class
        
        PID:10488
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        398⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        399⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        400⤵
        Drops file in System32 directory
        
        PID:10616
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        401⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        402⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        403⤵
        Modifies registry class
        
        PID:10756
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        404⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        405⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        406⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10872
        
        C:\Windows\SysWOW64\Ieolehop.exe
        
        C:\Windows\system32\Ieolehop.exe
        407⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        408⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        409⤵
        Modifies registry class
        
        PID:10992
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        410⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        411⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        412⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        413⤵
        Modifies registry class
        
        PID:11180
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        414⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        415⤵
        Modifies registry class
        
        PID:10060
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        416⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10272
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        417⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        418⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        419⤵
        
        PID:10484
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        420⤵
        Drops file in System32 directory
        
        PID:10564
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        421⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        422⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        423⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        424⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        425⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        426⤵
        Modifies registry class
        
        PID:10984
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        427⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        428⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        429⤵
        Drops file in System32 directory
        
        PID:11156
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        430⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        431⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        432⤵
        Modifies registry class
        
        PID:10408
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        433⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        434⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        435⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10832
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        437⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        438⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11068
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        439⤵
        Modifies registry class
        
        PID:11160
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        440⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        441⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        442⤵
        Drops file in System32 directory
        
        PID:10540
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        443⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10828
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        444⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10932
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        445⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11112
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        446⤵
        Modifies registry class
        
        PID:10344
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        447⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        448⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10820
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        449⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        450⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10476
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        451⤵
        Drops file in System32 directory
        
        PID:11020
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        452⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        453⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        454⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11256
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11276
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        456⤵
        
        PID:11324
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        457⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        458⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        459⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11448
        
        C:\Windows\SysWOW64\Ldleel32.exe
        
        C:\Windows\system32\Ldleel32.exe
        460⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        461⤵
        
        PID:11532
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        462⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        463⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        464⤵
        Drops file in System32 directory
        
        PID:11652
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        465⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        466⤵
        Drops file in System32 directory
        
        PID:11732
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        467⤵
        
        PID:11768
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        468⤵
        
        PID:11808
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        469⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        470⤵
        Drops file in System32 directory
        
        PID:11896
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        471⤵
        
        PID:11936
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        472⤵
        
        PID:11976
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        473⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        474⤵
        Modifies registry class
        
        PID:12056
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        475⤵
        Drops file in System32 directory
        
        PID:12100
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        476⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        477⤵
        Modifies registry class
        
        PID:12180
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        478⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        479⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12272
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        480⤵
        
        PID:11296
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        481⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        482⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        483⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        484⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        485⤵
        
        PID:972
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        486⤵
        
        PID:11644
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        487⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        488⤵
        Modifies registry class
        
        PID:11776
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        489⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        490⤵
        
        PID:11920
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        491⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        492⤵
        Modifies registry class
        
        PID:12040
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        493⤵
        
        PID:12140
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        494⤵
        
        PID:12188
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        495⤵
        
        PID:12268
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        496⤵
        
        PID:11344
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        497⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        498⤵
        
        PID:11404
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        499⤵
        
        PID:11484
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        500⤵
        
        PID:11560
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        501⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        502⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        503⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        504⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        505⤵
        
        PID:12048
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        506⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        507⤵
        Modifies registry class
        
        PID:12248
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        508⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11420
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        509⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        510⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        511⤵
        Drops file in System32 directory
        
        PID:11568
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        512⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        513⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        514⤵
        
        PID:12240
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        515⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        516⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:640
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        517⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        518⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        519⤵
        
        PID:12168
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        520⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        521⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        522⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        523⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        524⤵
        
        PID:12292
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        525⤵
        
        PID:12328
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        526⤵
        Drops file in System32 directory
        
        PID:12364
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        527⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12400
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        528⤵
        
        PID:12436
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        529⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12472
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        530⤵
        Drops file in System32 directory
        
        PID:12504
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        531⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12540
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        532⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12576
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        533⤵
        
        PID:12612
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        534⤵
        
        PID:12656
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        535⤵
        
        PID:12692
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        536⤵
        
        PID:12728
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        537⤵
        Modifies registry class
        
        PID:12772
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        538⤵
        Drops file in System32 directory
        
        PID:12808
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        539⤵
        
        PID:12840
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        540⤵
        Modifies registry class
        
        PID:12880
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        541⤵
        
        PID:12916
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        542⤵
        
        PID:12956
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        543⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12992
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        544⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13028
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        545⤵
        
        PID:13064
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        546⤵
        
        PID:13100
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        547⤵
        
        PID:13136
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        548⤵
        
        PID:13172
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        549⤵
        Drops file in System32 directory
        
        PID:13208
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        550⤵
        
        PID:13248
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        551⤵
        
        PID:13284
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        552⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        553⤵
        
        PID:12352
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        554⤵
        
        PID:12432
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        555⤵
        
        PID:12480
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        556⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12528
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        557⤵
        
        PID:12600
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        558⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12680
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        559⤵
        
        PID:12748
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        560⤵
        
        PID:12800
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        561⤵
        
        PID:12868
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        562⤵
        
        PID:12924
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        563⤵
        
        PID:12980
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        564⤵
        
        PID:13060
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        565⤵
        
        PID:13124
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        566⤵
        
        PID:13204
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        567⤵
        Drops file in System32 directory
        
        PID:13256
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        568⤵
        
        PID:11400
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        569⤵
        
        PID:12392
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        570⤵
        
        PID:12584
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        571⤵
        Modifies registry class
        
        PID:12608
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        572⤵
        
        PID:12724
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        573⤵
        
        PID:12848
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        574⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        575⤵
        
        PID:13056
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        576⤵
        
        PID:13160
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        577⤵
        
        PID:13292
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        578⤵
        
        PID:12424
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        579⤵
        
        PID:12568
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        580⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12780
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        581⤵
        
        PID:12964
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        582⤵
        
        PID:13164
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13164 -s 408
        583⤵
        Program crash
        
        PID:12792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 13164 -ip 13164
1⤵
PID:12620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aglemn32.exe

Filesize
109KB

MD5
8e051ca5c339a21bd6eaf0ff8e59be3e

SHA1
393cb9599a4457385c3a818a3d2cce15a41532b8

SHA256
38ccc5f3d2ae1c65f737bf109ec6948bce86c92efcf336e8bbdee38c96c77902

SHA512
2ef2c90f2bea31631b941c88efa04a1a9e76baff48b3fe7851428be55274ec6c9d695839fe6ea52f742d0fb443664a3be0258ed33f70575ab440342ad6c0cf98

Download Submit
C:\Windows\SysWOW64\Bclhhnca.exe

Filesize
109KB

MD5
bb80e9430dfb1408aa5bfbd6683bb3cb

SHA1
c3afc8c18a23874a1c456cead35f8f25c69d670d

SHA256
0dfff41e4feb190ed14ce8e8e4f671ef2fe60ea38558fb766861020719c9fffc

SHA512
19beabf75f7caade22f9829fb31a61647f86ed7eec19ea41af053f0f80a3521b66e2ab71cb9a2dde52ea946cc17004fd945219625971e01923269ba42ebc0d38

Download Submit
C:\Windows\SysWOW64\Bnmcjg32.exe

Filesize
109KB

MD5
000b1b22cfe42c55ee4e69a08954229d

SHA1
575b5ce164362cc647e154ba375387237dad9a7f

SHA256
4243018ac28d6c18e398811c6e1f944ec603ee803f7f32d64b3fa150a666943b

SHA512
64620d6d6226f6fd0d8f6caf827f67ee886df9489259ff9b09ecf876c1b16397dbc3450977b945702d47cfa72138f1afb796d7bf2d148109b4828e0e61fd984f

Download Submit
C:\Windows\SysWOW64\Cichoi32.dll

Filesize
7KB

MD5
d8e2371aa3ab93cbf315a1f14f355dac

SHA1
942d6cd8c472d5a89518fb1b9bd9fec8666320b8

SHA256
f3aea0e77e162b85cf13b9a01c4156c59e8384e7833cc01fa4b0d34a56163cfd

SHA512
b62b1653d5b1096b7201390c0bc732b55c65a57f96e938f3ff8ed01b921ef8a37d6d64a4dd1467db152c7525604a0b9ee778013ac07fb20553cb32965000cd87

Download Submit
C:\Windows\SysWOW64\Cmiflbel.exe

Filesize
109KB

MD5
33803d3ab47ea37f77b3db9a7588c027

SHA1
32c6ea2d41064af55dcbe5f96cfc95173dbd3120

SHA256
e945949dff5e049716034d9027984aef19e98e1e755a66c2bc74bc90d25eb9b1

SHA512
b9a372fa22f36b0cbee5d9da3bce93adb0fcb71029d4508219cf30b4056310782b035a3c002b354e193f661c2e199e0c7d858d826be9c5c355d0cb8cb2fd1d76

Download Submit
C:\Windows\SysWOW64\Dogogcpo.exe

Filesize
109KB

MD5
9600c0b6808e3fb19e8c913c5dd5f943

SHA1
50682d2aafca08b32a932ca775c9446b1e4827a0

SHA256
637b7c67017a043b7ae4a4cf75177bcd3f5fab2492b0c2ceb000e75a13045452

SHA512
4dceded62ae34f2204be0dc39d27edbbe6ec680069ca909df7c55518c388b26790596aa61f1b45803169a8461a905842c401b0da043cb7615a72150618056711

Download Submit
C:\Windows\SysWOW64\Ebbidj32.exe

Filesize
109KB

MD5
02d395689b5485f96b021ee9fc43d664

SHA1
47735d0d915c04db5173d261ab72d8fe321914a3

SHA256
7c9866dc57d0658e072997dc6e78a102f04cab92057b59ea569423944da4f506

SHA512
2dcf44d7493860cde178ff468a89376666dd871991c47f591cce5b900844eace1b219c91df4868e3a6a089ca24a7f4a306708a8d5f708be02b885d9fece959b1

Download Submit
C:\Windows\SysWOW64\Ecdbdl32.exe

Filesize
109KB

MD5
73270f38e611f9fb867f4df64fec0e50

SHA1
fbf5766bce8466da2f705c48e6b0c6aa0a7a2aba

SHA256
4aa7b2592be0fa134b7024c8b8f6b30e2b6d26b902237f2f57549019d7635d92

SHA512
5a9d2138c67d15e2a7c5aa1a06d7b88dd0da74a5ab40a40bbf11e2170b51ebaaba23e9985734b568b787e596f6f481897314ba5ae38baa2b4b79345246bcbeae

Download Submit
C:\Windows\SysWOW64\Eckonn32.exe

Filesize
109KB

MD5
49baad739ec72b1112291d62fea40906

SHA1
c3d3933adb74381d7abf760c9b6f57e3bdb1a17d

SHA256
3136994a5dec960c7fe3c61ee507815c38165b609f2812410de51497d35f705d

SHA512
87adb109f507a4678b84bb9bd2d7245ed0de093a2bfcb3631e7d29eae885761c69f89ee65b1eb2f3bf6820d04519c22767ca51dc5d969c79082c019476bb62ed

Download Submit
C:\Windows\SysWOW64\Eflhoigi.exe

Filesize
109KB

MD5
1b5b9a27a574f8457d830faec2556cf2

SHA1
a09c0aa0eeddc09087814af332b75fd7aa499a3b

SHA256
0b74c5385eba695d94ee90872aa67203da2947cf5f67eb23c11fc2ca20f9c073

SHA512
36a774dd22a26c9143ce88840a89fdb05fe5a1ce866b68932203db18d3929bf92635e4c2cd5f8e9976f62083f2dbf7beb8d0fe8924efae8f76e2198d92f6449a

Download Submit
C:\Windows\SysWOW64\Efpajh32.exe

Filesize
109KB

MD5
c4549906c1fa6a2148d73a1e895ad68c

SHA1
a47efad356c62f533f0f24cdd1d1d7abcdb69939

SHA256
be6985ce9d3007e6ec5dfc6d8f391d435dfce41868fa9115572df89755b828ac

SHA512
8b8388b6b330e1867d72738ed6aa34ab23e0151f8c715153d2af33b1466b6f4e534668de9ce32c76e8c56c8ebbe6c2b0a4aefef847b14b3fa9258001e5b8838a

Download Submit
C:\Windows\SysWOW64\Ehjdldfl.exe

Filesize
109KB

MD5
c85e0e0803c58a82c45ad8dc7df60ac5

SHA1
cbf5c87ec07312fa7a33c6c2c5247fcc000b67fe

SHA256
f6192d633fc53bc898c4df6bb3950502b977c398616f8a11dede19461e8d8aaf

SHA512
2ce59c6208a614317ca4d53de37e73cad1c273a4a5a29100196f309a21fd33d7e7098796cb56df39f1ffcc9ac61b0a4e3b656c9619722e8296579b6f6837e046

Download Submit
C:\Windows\SysWOW64\Ehlaaddj.exe

Filesize
109KB

MD5
f4416c196c90e154cdf716f998d91a25

SHA1
7bd37c62aa3f645cfc891c23267933a7da683c97

SHA256
7b41bf82eafd47471c17a7b73eda4d2826597cfbf418ca48598a11b89061101c

SHA512
4a6503d9fd4638f315ac2f740a769b41c709fd6a8a40f54bd82255cf7eb308e44f6252131e515c2473198edf09da51035b3429413aa8365105175f6395a2e18f

Download Submit
C:\Windows\SysWOW64\Ejbkehcg.exe

Filesize
109KB

MD5
317fd1fcb4e5afd73d055c2cf6473896

SHA1
6793b7597067dc36b9cd256634cccf3a6be5965f

SHA256
e2c5bbb39e5959fe30be0bec71fdcda6ceea31f0d52e0edf0eec4c1f4f0f6463

SHA512
d03dc710707929da0d5d39c8e52c68a889dc64feaf8678849c9a77d7237a11d974b1fb05455750607f81a694f895126a29f23bf3eb95765adc7d5ffe4fb5482f

Download Submit
C:\Windows\SysWOW64\Ejegjh32.exe

Filesize
109KB

MD5
fefe58a8495f752b894b0ac5d0d4d298

SHA1
18c9d947b317ee225b4099af85732b0dc4045a3f

SHA256
41de2e74a83ccf522804348c9cbcd8b28641d6980c0e07e89efb9eff8ed81ff3

SHA512
d2117e55effda3c67d9fdaff18aeeeba56d7a7de13b43e1a2b7a3f4043dcd459782dd44226052aba3b528158e8510a1d4010c50d1378dd14740ad6184faef3e0

Download Submit
C:\Windows\SysWOW64\Elagacbk.exe

Filesize
109KB

MD5
b8a4754dea7604e7d2c9c25d4d523bda

SHA1
de49e5949dbfc74a6c888c242a6fbb30078abdce

SHA256
27ef2b10d3c3f45f17eb2977175aa140d73e71c60c55d24b496aaf0d7d6e39a3

SHA512
ab9ffa091b2f3ad67cf006659683e3506846d174b83961cb527ec5760d8689fb00143a790e54885c353ad31c1298d68179b6c2377784f80e1456464c6fc50d93

Download Submit
C:\Windows\SysWOW64\Emjjgbjp.exe

Filesize
109KB

MD5
2f04b7bab7e18e761e12410002b64ab0

SHA1
0e17f048f2dd7f067efda7bfaad4607948e76ed3

SHA256
edfafaa7dbf7e8dca76b9301fb49700e0192ddb5af42a1b7c9242cfd380de7de

SHA512
ed4b43a208f91e48a5a245ffcdd3b0b4468a8477f07848c5536ef1236b4e8cb3f324bc97c31ad756bbd2b42eb874a72a90d966968dd79a2cf17fd047eb7c2e03

Download Submit
C:\Windows\SysWOW64\Epopgbia.exe

Filesize
109KB

MD5
9515a196469facdb4f59dfdba1f31c95

SHA1
31bf95f103f12a188aebaedbfc2196ff3fbbe807

SHA256
21e6b2d3cb1953172d302c6bdf556007b345898f34cb72dc5aada3818d8100e2

SHA512
eb11c318a5c2aa946f74c6479490420d8b0ed60da9355a620a21a9dbb1d1b8e5e14824a20ec024646e6c596da4fab9879572d12731c4a37bca0fbe01220066e5

Download Submit
C:\Windows\SysWOW64\Eqalmafo.exe

Filesize
109KB

MD5
f950f977a01672f7bd458ca9a8addc83

SHA1
b14b0c97c7c745e1de9498957223851db39b376c

SHA256
415156566bb165f23532dbbff51153f86af4a4edaa65e4226c5fa74f3c06eb44

SHA512
0df7a885c0c013c426ab1f9c2c834b18185b693fdff487e826cb0ec3d8944ff0ee81f95481d166e61e65ff1e1829b11f153f163d3d4368ce58303772928b34bc

Download Submit
C:\Windows\SysWOW64\Eqciba32.exe

Filesize
109KB

MD5
a085227623795c8c5ca91034a0e27d13

SHA1
dbac20066e7c5d9fe6ea88c9695b806047fc51ca

SHA256
54ee6542c74997b4986b1a5e4837af47fbf8c1490c6e753fc1ffe8e36233d286

SHA512
8acde67c438d2a82396075cf11846a066cf8454530fd911fbeddf1f55174575c9dc7d2cd281651c4d827e2e0b83306f64d896c3e26c429c60c597f5f2d8f2609

Download Submit
C:\Windows\SysWOW64\Ffekegon.exe

Filesize
109KB

MD5
d7a1a6d8ca563e1799608a6f01cc54af

SHA1
11962378cbdfb297830abc69c7ba659a9c146165

SHA256
a2808d9cd01516ee11ceb6cea56cd7adb852ae62d72d2d3b22ef83e08cac9969

SHA512
91b48512c17fae3f9e36746292f0ef87c4d31577578cc1263c071d82f8921cd13de10219e5fd4e2f3ade05fdc0c8c2dea81ceb97afa103137b852812e5c005e5

Download Submit
C:\Windows\SysWOW64\Fflaff32.exe

Filesize
109KB

MD5
9034e310a3963179e4b5697cd74843c3

SHA1
e10500ecbca094c3e533f9e7b6e2b25e2eefdc30

SHA256
8f907f9501b3a30536f96eb4c1ecc315ab0373c0f3caf65096f14dc4f21ba019

SHA512
0af9a7219cf684fb23f80ccbba1e6f4edb16fb7109366b1040b39a3a958016485bba28bbb10623778bd5a0e6d7e31fcb69109baf2fc4f3c5b0f298827c0c32d4

Download Submit
C:\Windows\SysWOW64\Fijmbb32.exe

Filesize
109KB

MD5
3d22be7de8e7f927105e7ff9af6827f6

SHA1
3585d709a507ffb85de5542ab58d9160e7ffbda7

SHA256
bbfbc931cc22699c90accf17c4b2d10e6f73a727a0ed83d4ec5c2c37a30fd317

SHA512
4964607df51f111c6660db6c1add45ffad6801c1b6900ed986e7761355d45903ca11c9cf6ecc101b6f05bb5a9ab0784d46ccc869203986c0d5bc8f9dfeb1fbcb

Download Submit
C:\Windows\SysWOW64\Fjcclf32.exe

Filesize
109KB

MD5
5a62fbcf1b6c2d487165528818a22b61

SHA1
f0c70721b25245838028b0196b976b1fbcee69ef

SHA256
cecd9a940c2079b86a87f1f6ec2010a67f9f1f07d7520aab6ebb18257e580a00

SHA512
a7a02ff6eea5a22225c6f352fa78ad6e3b3af7841d9750c49728b08131ec1f2a40e1dafa9a0ee785af7be6de36b373b79085b9c779dd4840c5d2423b1a752f99

Download Submit
C:\Windows\SysWOW64\Fjepaecb.exe

Filesize
109KB

MD5
39f119e3ea5198ab4e1cad058199113f

SHA1
aaa28c42a6835955bd845e3e00d30bb7bbce1d8d

SHA256
053029689b2535a528994ff8ac7d816ace6c5cace67d892c12f3199434012ed4

SHA512
2630acaedfed6fc81408464c6905778d670069c674e4b9bb0860e8f570e6258604ae3b54463201dcce747211b4a16af498d5a51ccdb5718be146e2966e648c7b

Download Submit
C:\Windows\SysWOW64\Fjhmgeao.exe

Filesize
109KB

MD5
8d394599621879b3dd2f5ad0d7bee0cf

SHA1
24f6d38b9ed3d244d12a8898023c073d47ca2543

SHA256
45bd98763e7a39bb56f627f44e5c039417fb2e7955ef25b805b19ac9993d30df

SHA512
542bdd298481ef0aae460dcc83b4d84f638b8134b101a36c617893b23b11a43e720e0501646288e55a37b810e09eefb95422bbb93757330e8c07acce4a32aee2

Download Submit
C:\Windows\SysWOW64\Fjnjqfij.exe

Filesize
109KB

MD5
586c054f89d30f538b067b905f58b4bb

SHA1
39f7585c07f4f0af203d0a632ffe6776770e9336

SHA256
4d49f69f72f132d90fd29ca2f7a3a4bd0d25432c21459f8052519c0225b81b14

SHA512
a207d68c0e397daa2ba18215ba4e65c5a7217ade9e1cc614c14b1eceaee233fe471ff32d250478d2a07754986b5cf0673669d75f9904d2c17d569aa31f480674

Download Submit
C:\Windows\SysWOW64\Fmapha32.exe

Filesize
109KB

MD5
b1f5068ab6dbbbc97ddd704c0df5b852

SHA1
928fc4fc0928f1771df001dabda6135ef6e1afaa

SHA256
b0ce4e6f82ef154fdd7d3443417a832bc7f12a895985927b04dce5249a57cdb1

SHA512
e80123535cc67c1a3a1daf71c276466b160af8695eabd233edfc414484edb74f12fcf74613f4b6e0662f7856825588f447fb8c371aee55041fea0d46ea659bc2

Download Submit
C:\Windows\SysWOW64\Fmocba32.exe

Filesize
109KB

MD5
0a6533caf98f8e734e9216d48cd9bad6

SHA1
611233194700b7bcf694fbf89ac566cfc6d75087

SHA256
0720d37892e1cef3abb000d221c4f561764ddc9b81e120fb88d4f6bf2d0744cb

SHA512
844c23753c8fd13aadd908ec60587a13e61a0cb6390cdd53a0ac0cd424b4f81bbd26c06f74005bd737f35004a498bfc99b8e16ca8f5aec757cd9a526715cc881

Download Submit
C:\Windows\SysWOW64\Fokbim32.exe

Filesize
109KB

MD5
69f7089d84a19c1772e8fcfc841c1d38

SHA1
14bb2b8b21ecd02f2190176bace6643259477e1e

SHA256
619d1965ba059e74e11113dd2cf156c6be1a4c858d6e9772ba9633ef293afac9

SHA512
4a3514c5204ccf0fd3446d3d8558046c27d147937b7ed8a71742809e3fa60f68e49327a30c89ac826caaf23640f09ffdcf4a4730b3ec00754c24ff7dcdfcfd08

Download Submit
C:\Windows\SysWOW64\Fomonm32.exe

Filesize
109KB

MD5
574bb8c0e679d2299aefcbf7a4575f82

SHA1
784ff99143d2acee8bf4e5489064c667661fbd94

SHA256
40ff895cf9c15b35cc0ea8604b68c50ee88f7a38119ed14d276af33d6bf01e68

SHA512
f8a03ffb77026b319471010b2c09dbe3d4e359346e8396d69e03003d97815415703083489b955401d917f5835a4c0f44bae7bf22bb74a7bc245c04c745d687e5

Download Submit
C:\Windows\SysWOW64\Gbcakg32.exe

Filesize
109KB

MD5
ab4df9295fabde978d44fcfbe215041f

SHA1
bf5bcdb92d315c1645465ed8b366038b6cd9c56d

SHA256
5cbf524f5bb3f102334414015cb068e82fcbf6999851bd930d15d160fe4dab01

SHA512
cf9984cfffbe26b42ed834eee7dc5e2bc55d6e63e73ae8b4e6233ab3785348b76a9ed27a45faf7ae368631f4ffd6903a744f284eba3319287a9a77d4dd2c3d59

Download Submit
C:\Windows\SysWOW64\Gcbnejem.exe

Filesize
109KB

MD5
bb0ce8f3b917065a49200007830b1bd8

SHA1
8ad96c98d16aa12105f50ad836ae1da8f1261526

SHA256
bd6b39bcd02005140dbad700ff9ea64b906c4d9fe21232bf853a8400a90af26d

SHA512
a319881596f73392c21b3f021d86e33d86693a473b072e821b459c47cd4721b549f5c68171930a30f421539100cf9c9028372d209267e7c96270fe084929ece4

Download Submit
C:\Windows\SysWOW64\Gfqjafdq.exe

Filesize
109KB

MD5
31d0180f429e82535cc900914a8b7c3c

SHA1
92eed1bc59dc30505231bb03ff68a6dc840d12b4

SHA256
9cce3b133aebace4e51c7a7d9459658aa73ca0479d65960459a9c9a4e9c57894

SHA512
72d54fed3dbd4b8a6784517e45badc0d1705fd5ca2bede7ca79188fc1464271fc43df2dcd17a29f0a75b53a6e71c8d1f943b25f1c82a560b1b2e46116ddf8e1e

Download Submit
C:\Windows\SysWOW64\Giofnacd.exe

Filesize
109KB

MD5
3e04c3f0268700f862e440f781913983

SHA1
84a51cbae5ae1990ed8ad2b61a6a5b8c4b888cf1

SHA256
78434db1218f6054b3941e07cd45d03fdf2cc6cbe14005b95e471ec4a447ab92

SHA512
52b120ba6bd54adbbd60aa6ff3e2aea4ad1eeda1e00b8f852584b74510ddbad39a5012a29113c150c3d3829a057eea879e04950478b91280a6d027b9c4c5ba21

Download Submit
C:\Windows\SysWOW64\Gjjjle32.exe

Filesize
109KB

MD5
0966df5f758623f5b40a974774e37661

SHA1
3ce032d8f3dea5a0c119a74b7a834424eb740de4

SHA256
3a32a9ea9d07694255f4887dc63ed51c6d64409ad23fbb1a1fe67bcf70d6e779

SHA512
0271c60263b08587cb6494cda61ec25ef33f7e2f70b64765371f319635f10899e393793fe563d6918a30fc24eda339db8d55995e7cbce135bb19f863c0778003

Download Submit
C:\Windows\SysWOW64\Gqdbiofi.exe

Filesize
109KB

MD5
1ec483c3d8dc0e965c6a71036ba63d8c

SHA1
8b3f40ccb473890e4e80af0cfeda687d5f85deba

SHA256
669e76cb6f819daecdc6fdbf27416b1f90455e0a9da397b8f16b7b531311cae9

SHA512
6c324f515725683a67cc2d1b0468792cd678f6433f0944ebee6c0137d09dbe03e76225147b925b6da77c0e2bddc07993a8bfc5760285988971005da185f2a599

Download Submit
C:\Windows\SysWOW64\Gqfooodg.exe

Filesize
109KB

MD5
ce3b014888bd5a8a53a13ffb1754741b

SHA1
ad9464b3f1509afee8fc1117c59bf8c852331b01

SHA256
8ea82fd98a5f6d28de624ebbeea3309463d637c5abeb45b174e2e713d68d7cdf

SHA512
9240a647ab18b9d42f092f6b5fcb009de43613b91eb070662aca3f98661410401088a76dfa15c61109f205c4537da34fb5a8c51a773cc1c14be72c46daea0422

Download Submit
C:\Windows\SysWOW64\Hapaemll.exe

Filesize
109KB

MD5
6928caae9607159fd4371b540ad663c5

SHA1
b9e82a8c8b390d382252bcb171e013d4d4be29b0

SHA256
68793c94fda4eeb2648809d30dbdcda90166d7b308a22fb4ba41b0599b74c543

SHA512
318f5ebe78438a4355e66204d6e156981c23f0f0d1b8100fae09947f067ebace05dd3bb7bed1e808a84eead7bffb3074a6da72a2e4a6b677be81e1728b2050a3

Download Submit
C:\Windows\SysWOW64\Jdhine32.exe

Filesize
109KB

MD5
304f8ce18573779ac70582d240f8d327

SHA1
f4d23bc99d386d0050c9f060be1d91c0ed438c14

SHA256
209d748c91e9a5afcb135cbd74db1b9410417601d6323ac8d3b8e77542eacccb

SHA512
0693ee227d1b43e46d73d3ef6595ab8f545408217b1101e65c4b6d7371b96a7f79ac91bfd8dfd3ba087e63b3da4ae8b0b7fe4ec0c397497d836b683f1df09b83

Download Submit
C:\Windows\SysWOW64\Mcmabg32.exe

Filesize
109KB

MD5
7bd55442c995c4aa5d4e2a1218151371

SHA1
9aadc04720871607dd4af7e498ff538d192999fb

SHA256
1848febabaafa206b3dd7193b8383407cd5b30fae75b9c8fbb9f293fa43a9db0

SHA512
5ba428aee2f5a930ad4928f186d2fa4a75d7be61ba79abbf1adc97b343a132d13666afb1bdb1b83c9b687f98bddd4dabec5091d1cb4bbe8fc01b6d1ee03d67ea

Download Submit
C:\Windows\SysWOW64\Meiaib32.exe

Filesize
109KB

MD5
76ad6f8e21e280ebdead2783dac5a67a

SHA1
f3ce9d8aedbfa7a0d644026697b2e21f3cc6fe87

SHA256
3170478510111996915d3f2c8f065c84593a2edef5848bf1e5120f2420625dd2

SHA512
1f99266eac7ca1493f6ce05e3da61b25852cff8aa93cde1f66546d7e9f0f2c654c5bd3b2e8a978f9ec927cb98342a4c484352809d014f0a0afdf87a899b80acf

Download Submit
C:\Windows\SysWOW64\Olmeci32.exe

Filesize
109KB

MD5
9543f942df640001b037b984a2da048a

SHA1
e70cf78dd1b924bcc8c976d17fa9522e95948cb3

SHA256
6e3ce700b633c5a20cdca410ff10499052fd583d88618361f03bd86a26d9304d

SHA512
a0abdf77fb9dbca5e7950f6137c0af5bacc1cb9c6a94702c130e5b4ce0aa72a7c7a8118bcdeb5034740567374cfc2fd8f73ae7c977b7edb309cd0584ff53737c

Download Submit
C:\Windows\SysWOW64\Pcncpbmd.exe

Filesize
109KB

MD5
dece04d2f9fddc967aab2f398fc326af

SHA1
208da81547610b31cb08426ea5e04882f70202b2

SHA256
849a2f3d8fd5325b8e149335e14affcf3329c53e0e8eae877c32e512ba2a446d

SHA512
703198d6996b875f97015de75a112b5332b7561c014bfc3374a605b6d4b51af091f7b5066ca532c6e1a062a96eb9f9528dbecf5b9ec435cb4f86ca29b6b11e46

Download Submit
C:\Windows\SysWOW64\Pcppfaka.exe

Filesize
109KB

MD5
b8c3720edf22e961b19b1be9d45a1210

SHA1
05b6599c7316f526882a040952bec4e12140ada6

SHA256
790716b1875a4360a12afdcae8518cf287988d4b868973f787771a7b2a67a1d6

SHA512
816b774bd77cad537bbc2d9b82f5670b3f93de1b376bda27fdaf2ca4160168080d773763a3eb97a9ddc7a65ca8af19ef12b5ee1ed61941f926246c36c86b3fa4

Download Submit
C:\Windows\SysWOW64\Pnfdcjkg.exe

Filesize
109KB

MD5
75859a2e080c0ca3676b45ecb2ec29ac

SHA1
388f7fab9b24987a8613010d3c5dd7688746333f

SHA256
dc168ee3b3d601aa14850e2f7f19c5353b38938ff0fc159b61281edfc9a135ad

SHA512
39e56f9623943770898f17d0c255409d7209ce6fcc506426d24adaff22b42190781bd169da086bc01d7a67466ac87fcaf5941d7adc31df5a779aeac0676ef629

Download Submit
C:\Windows\SysWOW64\Pqknig32.exe

Filesize
109KB

MD5
d145b4a8ff946ed3421021e194427841

SHA1
3ad11ee2a6a2e5d47c046796656a446019ed8452

SHA256
b3fc60d1d94f4f62bb21247ee1cdd13894c236bf6c48e59199adeecf5477ff06

SHA512
fde66272d270838de3fb581c746b3930e8ee7e013e5d01d9ca98d582a8b4c89d2e7a9fc196f867903a8c64d39565d7a790d933bc870d0afeff44f0508e72cd0b

Download Submit
memory/8-400-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/412-8-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/452-441-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/512-415-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/704-382-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/720-72-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/892-346-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1160-208-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1296-356-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1476-320-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1512-262-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1552-298-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1592-434-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1656-244-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1676-224-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1752-167-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1816-410-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1936-256-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1984-364-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2212-235-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2324-88-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2328-112-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2412-128-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2452-52-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2516-199-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2544-192-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2644-322-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2668-32-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2716-308-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2772-188-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2864-160-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2872-143-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2932-398-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2960-396-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2980-340-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3216-20-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3224-418-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3288-60-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3432-136-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3484-442-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3496-151-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3640-248-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3656-23-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3748-284-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3792-338-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3948-376-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3968-103-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3988-286-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3992-358-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4124-215-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4312-272-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4464-175-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4496-119-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4520-278-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4584-331-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4608-79-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4792-292-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4796-310-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4800-64-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4816-96-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4852-39-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4992-375-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4996-424-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5016-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads