b9bbad1de7b41b2041c7dd6f44d8bb6083baf75164c5fccc0b0aa59e0da4c254

Analysis

max time kernel
93s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b9bbad1de7b41b2041c7dd6f44d8bb6083baf75164c5fccc0b0aa59e0da4c254.exe
Size

128KB
MD5

fdac725a08ab6a4d7f6f75853b9bcef0
SHA1

188340cd87c0d0ca5f8b3c06ae56c12432c28cdf
SHA256

b9bbad1de7b41b2041c7dd6f44d8bb6083baf75164c5fccc0b0aa59e0da4c254
SHA512

8d454bc2ea5f6629b391c9061be75874b4b06506241f56c27dc0e23ab11b9540c4235aad2d37f3902ce7c9316daed346fe6abe076b88705f69d360a859f37aae
SSDEEP

3072:u7Pr5TbNhcsUauXw8asCHNhMXi6Y0HYSx9m9jqLsFmp:gpT8X2xUS6UJjws6

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcbahlip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocgdji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gcagkdba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lknjmkdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jaimbj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aegikj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cacmah32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lboeaifi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhhdil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Giacca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfpcgpae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iicbehnq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klqcioba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mdfofakp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmlnbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcdegnep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gofkje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfifmnij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jeaikh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eofinnkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baocghgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Clnjjpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdjjckag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdfjifjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngpjnkpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgopffec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdnjgmle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iemppiab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogljjiei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpcfkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqmjog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmabdibj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfnphn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbkamqmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibjqcd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kilhgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldohebqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahmlgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eleiam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icgjmapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfqjafdq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjhqjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aejfpjne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lffhfh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbmfoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nggqoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkikkeeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Efikji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfjmgdlf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blfdia32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Leihbeib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elccfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icplcpgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmpgldhg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmppcbjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Clpgpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jlbgha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmbmibhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chdkoa32.exe

Executes dropped EXE 64 IoCs

pid	Process
1472	Dagiil32.exe
840	Dllmfd32.exe
720	Dokjbp32.exe
4548	Dcfebonm.exe
3928	Djpnohej.exe
3720	Dlojkddn.exe
4196	Domfgpca.exe
4804	Ejbkehcg.exe
224	Elagacbk.exe
2828	Eoocmoao.exe
2848	Efikji32.exe
532	Ehhgfdho.exe
3276	Elccfc32.exe
3916	Epopgbia.exe
1860	Ecmlcmhe.exe
1672	Eflhoigi.exe
4736	Eqalmafo.exe
2628	Eodlho32.exe
5016	Efneehef.exe
928	Ehlaaddj.exe
1340	Eofinnkf.exe
3404	Ebeejijj.exe
4168	Emjjgbjp.exe
844	Ecdbdl32.exe
620	Ffbnph32.exe
4092	Fmmfmbhn.exe
64	Fokbim32.exe
3712	Fbioei32.exe
2028	Ficgacna.exe
4440	Fcikolnh.exe
3296	Fjcclf32.exe
2508	Fmapha32.exe
4288	Fopldmcl.exe
4536	Ffjdqg32.exe
1516	Fmclmabe.exe
3708	Fcnejk32.exe
4448	Fflaff32.exe
2756	Fijmbb32.exe
1632	Fqaeco32.exe
4468	Gcpapkgp.exe
1252	Gfnnlffc.exe
2196	Gmhfhp32.exe
1988	Gogbdl32.exe
3336	Gfqjafdq.exe
2024	Gmkbnp32.exe
2236	Gcekkjcj.exe
2232	Gfcgge32.exe
436	Giacca32.exe
548	Gqikdn32.exe
4492	Gbjhlfhb.exe
2080	Gjapmdid.exe
3496	Gqkhjn32.exe
4584	Gpnhekgl.exe
1904	Gbldaffp.exe
1508	Gjclbc32.exe
1328	Gifmnpnl.exe
552	Gameonno.exe
2184	Hclakimb.exe
2248	Hfjmgdlf.exe
4360	Hihicplj.exe
4204	Hapaemll.exe
3724	Hcnnaikp.exe
2256	Hfljmdjc.exe
4940	Habnjm32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Jbocea32.exe	Jpaghf32.exe
File created	C:\Windows\SysWOW64\Lfhdlh32.exe	Ldjhpl32.exe
File created	C:\Windows\SysWOW64\Pmgmnjcj.dll	Bganhm32.exe
File created	C:\Windows\SysWOW64\Jplmmfmi.exe	Jaimbj32.exe
File created	C:\Windows\SysWOW64\Kpmfddnf.exe	Kmnjhioc.exe
File created	C:\Windows\SysWOW64\Lekehdgp.exe	Lfhdlh32.exe
File opened for modification	C:\Windows\SysWOW64\Bhhdil32.exe	Banllbdn.exe
File opened for modification	C:\Windows\SysWOW64\Mnfipekh.exe	Mkgmcjld.exe
File created	C:\Windows\SysWOW64\Nhmkghpm.dll	Qcepkg32.exe
File created	C:\Windows\SysWOW64\Bejfanad.dll	Elgfgl32.exe
File created	C:\Windows\SysWOW64\Qmkadgpo.exe	Pgnilpah.exe
File opened for modification	C:\Windows\SysWOW64\Ncldnkae.exe	Ndidbn32.exe
File opened for modification	C:\Windows\SysWOW64\Eaklidoi.exe	Dlncan32.exe
File created	C:\Windows\SysWOW64\Banllbdn.exe	Bgehcmmm.exe
File created	C:\Windows\SysWOW64\Mfogkh32.dll	Hcedaheh.exe
File opened for modification	C:\Windows\SysWOW64\Clnjjpod.exe	Cdfbibnb.exe
File opened for modification	C:\Windows\SysWOW64\Dhnnep32.exe	Dadeieea.exe
File created	C:\Windows\SysWOW64\Onholckc.exe	Okjbpglo.exe
File created	C:\Windows\SysWOW64\Ogaceh32.exe	Oqgkhnjf.exe
File created	C:\Windows\SysWOW64\Cajcbgml.exe	Ckpjfm32.exe
File created	C:\Windows\SysWOW64\Knkkfojb.dll	Npcoakfp.exe
File created	C:\Windows\SysWOW64\Phaedfje.dll	Jpgmha32.exe
File created	C:\Windows\SysWOW64\Efjecajf.dll	Kmkfhc32.exe
File created	C:\Windows\SysWOW64\Llgjjnlj.exe	Lboeaifi.exe
File opened for modification	C:\Windows\SysWOW64\Lepncd32.exe	Lbabgh32.exe
File created	C:\Windows\SysWOW64\Efikji32.exe	Eoocmoao.exe
File created	C:\Windows\SysWOW64\Bclgpkgk.dll	Ijhodq32.exe
File created	C:\Windows\SysWOW64\Kcfcjd32.dll	Cknnpm32.exe
File created	C:\Windows\SysWOW64\Bkankc32.dll	Majopeii.exe
File created	C:\Windows\SysWOW64\Ogpnaafp.dll	Ngedij32.exe
File opened for modification	C:\Windows\SysWOW64\Ddgkpp32.exe	Dahode32.exe
File opened for modification	C:\Windows\SysWOW64\Mibpda32.exe	Mchhggno.exe
File created	C:\Windows\SysWOW64\Ekfnlmai.dll	Fmclmabe.exe
File opened for modification	C:\Windows\SysWOW64\Ipckgh32.exe	Imdnklfp.exe
File opened for modification	C:\Windows\SysWOW64\Ibccic32.exe	Iabgaklg.exe
File opened for modification	C:\Windows\SysWOW64\Laopdgcg.exe	Lmccchkn.exe
File created	C:\Windows\SysWOW64\Bbamkcqa.dll	Hihicplj.exe
File created	C:\Windows\SysWOW64\Gbdhjm32.dll	Ndcdmikd.exe
File created	C:\Windows\SysWOW64\Cdcoim32.exe	Cnffqf32.exe
File opened for modification	C:\Windows\SysWOW64\Dhhnpjmh.exe	Dopigd32.exe
File created	C:\Windows\SysWOW64\Pellipfm.dll	Lmccchkn.exe
File opened for modification	C:\Windows\SysWOW64\Qeemej32.exe	Qbgqio32.exe
File created	C:\Windows\SysWOW64\Bobgoedj.dll	Ejbkehcg.exe
File opened for modification	C:\Windows\SysWOW64\Cbcilkjg.exe	Cogmkl32.exe
File created	C:\Windows\SysWOW64\Mplhql32.exe	Mibpda32.exe
File created	C:\Windows\SysWOW64\Kebbafoj.exe	Kdqejn32.exe
File opened for modification	C:\Windows\SysWOW64\Hbhdmd32.exe	Hcedaheh.exe
File created	C:\Windows\SysWOW64\Blmacb32.exe	Bhaebcen.exe
File created	C:\Windows\SysWOW64\Ippohl32.dll	Jlpkba32.exe
File created	C:\Windows\SysWOW64\Jifhaenk.exe	Jeklag32.exe
File opened for modification	C:\Windows\SysWOW64\Iabgaklg.exe	Imgkql32.exe
File created	C:\Windows\SysWOW64\Ejmcmk32.dll	Ajneip32.exe
File created	C:\Windows\SysWOW64\Gicinj32.exe	Gdhmnlcj.exe
File created	C:\Windows\SysWOW64\Adecfl32.dll	Iblfnn32.exe
File opened for modification	C:\Windows\SysWOW64\Lgokmgjm.exe	Ldanqkki.exe
File created	C:\Windows\SysWOW64\Ngpjnkpf.exe	Ndbnboqb.exe
File created	C:\Windows\SysWOW64\Mlhblb32.dll	Ndbnboqb.exe
File opened for modification	C:\Windows\SysWOW64\Pgopffec.exe	Peqcjkfp.exe
File opened for modification	C:\Windows\SysWOW64\Abngjnmo.exe	Ahhblemi.exe
File created	C:\Windows\SysWOW64\Hbgmcnhf.exe	Hoiafcic.exe
File opened for modification	C:\Windows\SysWOW64\Oqihnn32.exe	Obfhba32.exe
File opened for modification	C:\Windows\SysWOW64\Ekemhj32.exe	Edkdkplj.exe
File opened for modification	C:\Windows\SysWOW64\Gcagkdba.exe	Gofkje32.exe
File created	C:\Windows\SysWOW64\Gohhpe32.exe	Gmjlcj32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
14096	14016	WerFault.exe	703

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kphmie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ogljjiei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdkcde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jiikak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmafhe32.dll"	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdqfah32.dll"	Camphf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jeaikh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnaikd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ifllil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgphpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mglncdoj.dll"	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjjbcbqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nilhco32.dll"	Jigollag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oqihnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfbcpl32.dll"	Clnjjpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gogiek32.dll"	Edkdkplj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlkhie32.dll"	Icplcpgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ijfboafl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Immapg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Abngjnmo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ecjhcg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Npfkgjdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndcdmikd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njefqo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bchomn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlkagbej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkejdahi.dll"	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phiifkjp.dll"	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjgaigfg.dll"	Ndfqbhia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aeopki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ghopckpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odgdacjh.dll"	Ncbknfed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndbnboqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpepcedo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnngob32.dll"	Lgbnmm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Demecd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbgmcnhf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fcnejk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpckhigh.dll"	Gfnnlffc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dlojkddn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdkldb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcllonma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pqbdjfln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Emjjgbjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lgkhlnbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mpmokb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnlnon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chdfonda.dll"	Gdjjckag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmklen32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgokmgjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ooojbbid.dll"	Ajkaii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbmelbid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Miifeq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Doqpak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ifhiib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laapnj32.dll"	Ibnccmbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hofddb32.dll"	Fopldmcl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lddbqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcfcjd32.dll"	Cknnpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kagichjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcefno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmmjgejj.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 1472	2116	b9bbad1de7b41b2041c7dd6f44d8bb6083baf75164c5fccc0b0aa59e0da4c254.exe	85
PID 2116 wrote to memory of 1472	2116	b9bbad1de7b41b2041c7dd6f44d8bb6083baf75164c5fccc0b0aa59e0da4c254.exe	85
PID 2116 wrote to memory of 1472	2116	b9bbad1de7b41b2041c7dd6f44d8bb6083baf75164c5fccc0b0aa59e0da4c254.exe	85
PID 1472 wrote to memory of 840	1472	Dagiil32.exe	86
PID 1472 wrote to memory of 840	1472	Dagiil32.exe	86
PID 1472 wrote to memory of 840	1472	Dagiil32.exe	86
PID 840 wrote to memory of 720	840	Dllmfd32.exe	87
PID 840 wrote to memory of 720	840	Dllmfd32.exe	87
PID 840 wrote to memory of 720	840	Dllmfd32.exe	87
PID 720 wrote to memory of 4548	720	Dokjbp32.exe	88
PID 720 wrote to memory of 4548	720	Dokjbp32.exe	88
PID 720 wrote to memory of 4548	720	Dokjbp32.exe	88
PID 4548 wrote to memory of 3928	4548	Dcfebonm.exe	89
PID 4548 wrote to memory of 3928	4548	Dcfebonm.exe	89
PID 4548 wrote to memory of 3928	4548	Dcfebonm.exe	89
PID 3928 wrote to memory of 3720	3928	Djpnohej.exe	90
PID 3928 wrote to memory of 3720	3928	Djpnohej.exe	90
PID 3928 wrote to memory of 3720	3928	Djpnohej.exe	90
PID 3720 wrote to memory of 4196	3720	Dlojkddn.exe	91
PID 3720 wrote to memory of 4196	3720	Dlojkddn.exe	91
PID 3720 wrote to memory of 4196	3720	Dlojkddn.exe	91
PID 4196 wrote to memory of 4804	4196	Domfgpca.exe	92
PID 4196 wrote to memory of 4804	4196	Domfgpca.exe	92
PID 4196 wrote to memory of 4804	4196	Domfgpca.exe	92
PID 4804 wrote to memory of 224	4804	Ejbkehcg.exe	93
PID 4804 wrote to memory of 224	4804	Ejbkehcg.exe	93
PID 4804 wrote to memory of 224	4804	Ejbkehcg.exe	93
PID 224 wrote to memory of 2828	224	Elagacbk.exe	94
PID 224 wrote to memory of 2828	224	Elagacbk.exe	94
PID 224 wrote to memory of 2828	224	Elagacbk.exe	94
PID 2828 wrote to memory of 2848	2828	Eoocmoao.exe	96
PID 2828 wrote to memory of 2848	2828	Eoocmoao.exe	96
PID 2828 wrote to memory of 2848	2828	Eoocmoao.exe	96
PID 2848 wrote to memory of 532	2848	Efikji32.exe	97
PID 2848 wrote to memory of 532	2848	Efikji32.exe	97
PID 2848 wrote to memory of 532	2848	Efikji32.exe	97
PID 532 wrote to memory of 3276	532	Ehhgfdho.exe	98
PID 532 wrote to memory of 3276	532	Ehhgfdho.exe	98
PID 532 wrote to memory of 3276	532	Ehhgfdho.exe	98
PID 3276 wrote to memory of 3916	3276	Elccfc32.exe	99
PID 3276 wrote to memory of 3916	3276	Elccfc32.exe	99
PID 3276 wrote to memory of 3916	3276	Elccfc32.exe	99
PID 3916 wrote to memory of 1860	3916	Epopgbia.exe	100
PID 3916 wrote to memory of 1860	3916	Epopgbia.exe	100
PID 3916 wrote to memory of 1860	3916	Epopgbia.exe	100
PID 1860 wrote to memory of 1672	1860	Ecmlcmhe.exe	101
PID 1860 wrote to memory of 1672	1860	Ecmlcmhe.exe	101
PID 1860 wrote to memory of 1672	1860	Ecmlcmhe.exe	101
PID 1672 wrote to memory of 4736	1672	Eflhoigi.exe	102
PID 1672 wrote to memory of 4736	1672	Eflhoigi.exe	102
PID 1672 wrote to memory of 4736	1672	Eflhoigi.exe	102
PID 4736 wrote to memory of 2628	4736	Eqalmafo.exe	103
PID 4736 wrote to memory of 2628	4736	Eqalmafo.exe	103
PID 4736 wrote to memory of 2628	4736	Eqalmafo.exe	103
PID 2628 wrote to memory of 5016	2628	Eodlho32.exe	104
PID 2628 wrote to memory of 5016	2628	Eodlho32.exe	104
PID 2628 wrote to memory of 5016	2628	Eodlho32.exe	104
PID 5016 wrote to memory of 928	5016	Efneehef.exe	105
PID 5016 wrote to memory of 928	5016	Efneehef.exe	105
PID 5016 wrote to memory of 928	5016	Efneehef.exe	105
PID 928 wrote to memory of 1340	928	Ehlaaddj.exe	106
PID 928 wrote to memory of 1340	928	Ehlaaddj.exe	106
PID 928 wrote to memory of 1340	928	Ehlaaddj.exe	106
PID 1340 wrote to memory of 3404	1340	Eofinnkf.exe	107

C:\Users\Admin\AppData\Local\Temp\b9bbad1de7b41b2041c7dd6f44d8bb6083baf75164c5fccc0b0aa59e0da4c254.exe
"C:\Users\Admin\AppData\Local\Temp\b9bbad1de7b41b2041c7dd6f44d8bb6083baf75164c5fccc0b0aa59e0da4c254.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\Dagiil32.exe
  C:\Windows\system32\Dagiil32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1472
- - C:\Windows\SysWOW64\Dllmfd32.exe
    C:\Windows\system32\Dllmfd32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\Windows\SysWOW64\Dokjbp32.exe
      C:\Windows\system32\Dokjbp32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:720
    - - C:\Windows\SysWOW64\Dcfebonm.exe
        
        C:\Windows\system32\Dcfebonm.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4548
      - C:\Windows\SysWOW64\Djpnohej.exe
        
        C:\Windows\system32\Djpnohej.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\SysWOW64\Dlojkddn.exe
        
        C:\Windows\system32\Dlojkddn.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3720
        
        C:\Windows\SysWOW64\Domfgpca.exe
        
        C:\Windows\system32\Domfgpca.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4196
        
        C:\Windows\SysWOW64\Ejbkehcg.exe
        
        C:\Windows\system32\Ejbkehcg.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4804
        
        C:\Windows\SysWOW64\Elagacbk.exe
        
        C:\Windows\system32\Elagacbk.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:224
        
        C:\Windows\SysWOW64\Eoocmoao.exe
        
        C:\Windows\system32\Eoocmoao.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2828
        
        C:\Windows\SysWOW64\Efikji32.exe
        
        C:\Windows\system32\Efikji32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2848
        
        C:\Windows\SysWOW64\Ehhgfdho.exe
        
        C:\Windows\system32\Ehhgfdho.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:532
        
        C:\Windows\SysWOW64\Elccfc32.exe
        
        C:\Windows\system32\Elccfc32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3276
        
        C:\Windows\SysWOW64\Epopgbia.exe
        
        C:\Windows\system32\Epopgbia.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3916
        
        C:\Windows\SysWOW64\Ecmlcmhe.exe
        
        C:\Windows\system32\Ecmlcmhe.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1860
        
        C:\Windows\SysWOW64\Eflhoigi.exe
        
        C:\Windows\system32\Eflhoigi.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1672
        
        C:\Windows\SysWOW64\Eqalmafo.exe
        
        C:\Windows\system32\Eqalmafo.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4736
        
        C:\Windows\SysWOW64\Eodlho32.exe
        
        C:\Windows\system32\Eodlho32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2628
        
        C:\Windows\SysWOW64\Efneehef.exe
        
        C:\Windows\system32\Efneehef.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5016
        
        C:\Windows\SysWOW64\Ehlaaddj.exe
        
        C:\Windows\system32\Ehlaaddj.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:928
        
        C:\Windows\SysWOW64\Eofinnkf.exe
        
        C:\Windows\system32\Eofinnkf.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1340
        
        C:\Windows\SysWOW64\Ebeejijj.exe
        
        C:\Windows\system32\Ebeejijj.exe
        23⤵
        Executes dropped EXE
        
        PID:3404
        
        C:\Windows\SysWOW64\Emjjgbjp.exe
        
        C:\Windows\system32\Emjjgbjp.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4168
        
        C:\Windows\SysWOW64\Ecdbdl32.exe
        
        C:\Windows\system32\Ecdbdl32.exe
        25⤵
        Executes dropped EXE
        
        PID:844
        
        C:\Windows\SysWOW64\Ffbnph32.exe
        
        C:\Windows\system32\Ffbnph32.exe
        26⤵
        Executes dropped EXE
        
        PID:620
        
        C:\Windows\SysWOW64\Fmmfmbhn.exe
        
        C:\Windows\system32\Fmmfmbhn.exe
        27⤵
        Executes dropped EXE
        
        PID:4092
        
        C:\Windows\SysWOW64\Fokbim32.exe
        
        C:\Windows\system32\Fokbim32.exe
        28⤵
        Executes dropped EXE
        
        PID:64
        
        C:\Windows\SysWOW64\Fbioei32.exe
        
        C:\Windows\system32\Fbioei32.exe
        29⤵
        Executes dropped EXE
        
        PID:3712
        
        C:\Windows\SysWOW64\Ficgacna.exe
        
        C:\Windows\system32\Ficgacna.exe
        30⤵
        Executes dropped EXE
        
        PID:2028
        
        C:\Windows\SysWOW64\Fcikolnh.exe
        
        C:\Windows\system32\Fcikolnh.exe
        31⤵
        Executes dropped EXE
        
        PID:4440
        
        C:\Windows\SysWOW64\Fjcclf32.exe
        
        C:\Windows\system32\Fjcclf32.exe
        32⤵
        Executes dropped EXE
        
        PID:3296
        
        C:\Windows\SysWOW64\Fmapha32.exe
        
        C:\Windows\system32\Fmapha32.exe
        33⤵
        Executes dropped EXE
        
        PID:2508
        
        C:\Windows\SysWOW64\Fopldmcl.exe
        
        C:\Windows\system32\Fopldmcl.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4288
        
        C:\Windows\SysWOW64\Ffjdqg32.exe
        
        C:\Windows\system32\Ffjdqg32.exe
        35⤵
        Executes dropped EXE
        
        PID:4536
        
        C:\Windows\SysWOW64\Fmclmabe.exe
        
        C:\Windows\system32\Fmclmabe.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1516
        
        C:\Windows\SysWOW64\Fcnejk32.exe
        
        C:\Windows\system32\Fcnejk32.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3708
        
        C:\Windows\SysWOW64\Fflaff32.exe
        
        C:\Windows\system32\Fflaff32.exe
        38⤵
        Executes dropped EXE
        
        PID:4448
        
        C:\Windows\SysWOW64\Fijmbb32.exe
        
        C:\Windows\system32\Fijmbb32.exe
        39⤵
        Executes dropped EXE
        
        PID:2756
        
        C:\Windows\SysWOW64\Fqaeco32.exe
        
        C:\Windows\system32\Fqaeco32.exe
        40⤵
        Executes dropped EXE
        
        PID:1632
        
        C:\Windows\SysWOW64\Gcpapkgp.exe
        
        C:\Windows\system32\Gcpapkgp.exe
        41⤵
        Executes dropped EXE
        
        PID:4468
        
        C:\Windows\SysWOW64\Gfnnlffc.exe
        
        C:\Windows\system32\Gfnnlffc.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1252
        
        C:\Windows\SysWOW64\Gmhfhp32.exe
        
        C:\Windows\system32\Gmhfhp32.exe
        43⤵
        Executes dropped EXE
        
        PID:2196
        
        C:\Windows\SysWOW64\Gogbdl32.exe
        
        C:\Windows\system32\Gogbdl32.exe
        44⤵
        Executes dropped EXE
        
        PID:1988
        
        C:\Windows\SysWOW64\Gfqjafdq.exe
        
        C:\Windows\system32\Gfqjafdq.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3336
        
        C:\Windows\SysWOW64\Gmkbnp32.exe
        
        C:\Windows\system32\Gmkbnp32.exe
        46⤵
        Executes dropped EXE
        
        PID:2024
        
        C:\Windows\SysWOW64\Gcekkjcj.exe
        
        C:\Windows\system32\Gcekkjcj.exe
        47⤵
        Executes dropped EXE
        
        PID:2236
        
        C:\Windows\SysWOW64\Gfcgge32.exe
        
        C:\Windows\system32\Gfcgge32.exe
        48⤵
        Executes dropped EXE
        
        PID:2232
        
        C:\Windows\SysWOW64\Giacca32.exe
        
        C:\Windows\system32\Giacca32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:436
        
        C:\Windows\SysWOW64\Gqikdn32.exe
        
        C:\Windows\system32\Gqikdn32.exe
        50⤵
        Executes dropped EXE
        
        PID:548
        
        C:\Windows\SysWOW64\Gbjhlfhb.exe
        
        C:\Windows\system32\Gbjhlfhb.exe
        51⤵
        Executes dropped EXE
        
        PID:4492
        
        C:\Windows\SysWOW64\Gjapmdid.exe
        
        C:\Windows\system32\Gjapmdid.exe
        52⤵
        Executes dropped EXE
        
        PID:2080
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        53⤵
        Executes dropped EXE
        
        PID:3496
        
        C:\Windows\SysWOW64\Gpnhekgl.exe
        
        C:\Windows\system32\Gpnhekgl.exe
        54⤵
        Executes dropped EXE
        
        PID:4584
        
        C:\Windows\SysWOW64\Gbldaffp.exe
        
        C:\Windows\system32\Gbldaffp.exe
        55⤵
        Executes dropped EXE
        
        PID:1904
        
        C:\Windows\SysWOW64\Gjclbc32.exe
        
        C:\Windows\system32\Gjclbc32.exe
        56⤵
        Executes dropped EXE
        
        PID:1508
        
        C:\Windows\SysWOW64\Gifmnpnl.exe
        
        C:\Windows\system32\Gifmnpnl.exe
        57⤵
        Executes dropped EXE
        
        PID:1328
        
        C:\Windows\SysWOW64\Gameonno.exe
        
        C:\Windows\system32\Gameonno.exe
        58⤵
        Executes dropped EXE
        
        PID:552
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        59⤵
        Executes dropped EXE
        
        PID:2184
        
        C:\Windows\SysWOW64\Hfjmgdlf.exe
        
        C:\Windows\system32\Hfjmgdlf.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2248
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4360
        
        C:\Windows\SysWOW64\Hapaemll.exe
        
        C:\Windows\system32\Hapaemll.exe
        62⤵
        Executes dropped EXE
        
        PID:4204
        
        C:\Windows\SysWOW64\Hcnnaikp.exe
        
        C:\Windows\system32\Hcnnaikp.exe
        63⤵
        Executes dropped EXE
        
        PID:3724
        
        C:\Windows\SysWOW64\Hfljmdjc.exe
        
        C:\Windows\system32\Hfljmdjc.exe
        64⤵
        Executes dropped EXE
        
        PID:2256
        
        C:\Windows\SysWOW64\Habnjm32.exe
        
        C:\Windows\system32\Habnjm32.exe
        65⤵
        Executes dropped EXE
        
        PID:4940
        
        C:\Windows\SysWOW64\Hcqjfh32.exe
        
        C:\Windows\system32\Hcqjfh32.exe
        66⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Hbckbepg.exe
        
        C:\Windows\system32\Hbckbepg.exe
        67⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\Hjjbcbqj.exe
        
        C:\Windows\system32\Hjjbcbqj.exe
        68⤵
        Modifies registry class
        
        PID:4484
        
        C:\Windows\SysWOW64\Hmioonpn.exe
        
        C:\Windows\system32\Hmioonpn.exe
        69⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\Hpgkkioa.exe
        
        C:\Windows\system32\Hpgkkioa.exe
        70⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\Hbeghene.exe
        
        C:\Windows\system32\Hbeghene.exe
        71⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\Hjmoibog.exe
        
        C:\Windows\system32\Hjmoibog.exe
        72⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\Hippdo32.exe
        
        C:\Windows\system32\Hippdo32.exe
        73⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\Hmklen32.exe
        
        C:\Windows\system32\Hmklen32.exe
        74⤵
        Modifies registry class
        
        PID:4644
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        75⤵
        Drops file in System32 directory
        
        PID:4304
        
        C:\Windows\SysWOW64\Hbhdmd32.exe
        
        C:\Windows\system32\Hbhdmd32.exe
        76⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        77⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\Hmmhjm32.exe
        
        C:\Windows\system32\Hmmhjm32.exe
        78⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\Ipldfi32.exe
        
        C:\Windows\system32\Ipldfi32.exe
        79⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\Ibjqcd32.exe
        
        C:\Windows\system32\Ibjqcd32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2940
        
        C:\Windows\SysWOW64\Impepm32.exe
        
        C:\Windows\system32\Impepm32.exe
        81⤵
        
        PID:876
        
        C:\Windows\SysWOW64\Icjmmg32.exe
        
        C:\Windows\system32\Icjmmg32.exe
        82⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\Ifhiib32.exe
        
        C:\Windows\system32\Ifhiib32.exe
        83⤵
        Modifies registry class
        
        PID:960
        
        C:\Windows\SysWOW64\Ipqnahgf.exe
        
        C:\Windows\system32\Ipqnahgf.exe
        84⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Ibojncfj.exe
        
        C:\Windows\system32\Ibojncfj.exe
        85⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        86⤵
        Modifies registry class
        
        PID:3872
        
        C:\Windows\SysWOW64\Imdnklfp.exe
        
        C:\Windows\system32\Imdnklfp.exe
        87⤵
        Drops file in System32 directory
        
        PID:2348
        
        C:\Windows\SysWOW64\Ipckgh32.exe
        
        C:\Windows\system32\Ipckgh32.exe
        88⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        89⤵
        Drops file in System32 directory
        
        PID:2384
        
        C:\Windows\SysWOW64\Imgkql32.exe
        
        C:\Windows\system32\Imgkql32.exe
        90⤵
        Drops file in System32 directory
        
        PID:3756
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        91⤵
        Drops file in System32 directory
        
        PID:1764
        
        C:\Windows\SysWOW64\Ibccic32.exe
        
        C:\Windows\system32\Ibccic32.exe
        92⤵
        
        PID:800
        
        C:\Windows\SysWOW64\Ijkljp32.exe
        
        C:\Windows\system32\Ijkljp32.exe
        93⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        94⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\Jfaloa32.exe
        
        C:\Windows\system32\Jfaloa32.exe
        95⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\Jiphkm32.exe
        
        C:\Windows\system32\Jiphkm32.exe
        96⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\Jpjqhgol.exe
        
        C:\Windows\system32\Jpjqhgol.exe
        97⤵
        
        PID:3408
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        98⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\Jibeql32.exe
        
        C:\Windows\system32\Jibeql32.exe
        99⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5192
        
        C:\Windows\SysWOW64\Jplmmfmi.exe
        
        C:\Windows\system32\Jplmmfmi.exe
        101⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Jjbako32.exe
        
        C:\Windows\system32\Jjbako32.exe
        102⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        103⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        104⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Jbmfoa32.exe
        
        C:\Windows\system32\Jbmfoa32.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5416
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        106⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        107⤵
        Modifies registry class
        
        PID:5500
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        108⤵
        Drops file in System32 directory
        
        PID:5544
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        109⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Jfkoeppq.exe
        
        C:\Windows\system32\Jfkoeppq.exe
        110⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Jiikak32.exe
        
        C:\Windows\system32\Jiikak32.exe
        111⤵
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        112⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        113⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Kbapjafe.exe
        
        C:\Windows\system32\Kbapjafe.exe
        114⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Kilhgk32.exe
        
        C:\Windows\system32\Kilhgk32.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5876
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        116⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        117⤵
        Modifies registry class
        
        PID:5972
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        118⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        119⤵
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        120⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Kphmie32.exe
        
        C:\Windows\system32\Kphmie32.exe
        121⤵
        Modifies registry class
        
        PID:3476
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        122⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5224
        
        C:\Windows\SysWOW64\Kagichjo.exe
        
        C:\Windows\system32\Kagichjo.exe
        124⤵
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        125⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        126⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Kibnhjgj.exe
        
        C:\Windows\system32\Kibnhjgj.exe
        127⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        128⤵
        Drops file in System32 directory
        
        PID:5576
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        129⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        130⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Liekmj32.exe
        
        C:\Windows\system32\Liekmj32.exe
        131⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        132⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        133⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        134⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        135⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        136⤵
        Modifies registry class
        
        PID:6128
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        137⤵
        Drops file in System32 directory
        
        PID:5180
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        138⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        139⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Lcpllo32.exe
        
        C:\Windows\system32\Lcpllo32.exe
        140⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        141⤵
        Modifies registry class
        
        PID:5672
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        142⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        143⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5952
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        145⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Lkiqbl32.exe
        
        C:\Windows\system32\Lkiqbl32.exe
        146⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        147⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Laciofpa.exe
        
        C:\Windows\system32\Laciofpa.exe
        148⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        149⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5872
        
        C:\Windows\SysWOW64\Lgpagm32.exe
        
        C:\Windows\system32\Lgpagm32.exe
        151⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        152⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        153⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        154⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        155⤵
        Modifies registry class
        
        PID:5716
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        156⤵
        Modifies registry class
        
        PID:5676
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6160
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        158⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        159⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6292
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        161⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        162⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        163⤵
        Drops file in System32 directory
        
        PID:6432
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        164⤵
        Modifies registry class
        
        PID:6488
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        165⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Mcklgm32.exe
        
        C:\Windows\system32\Mcklgm32.exe
        166⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        167⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        168⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        169⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Mjhqjg32.exe
        
        C:\Windows\system32\Mjhqjg32.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6800
        
        C:\Windows\SysWOW64\Maohkd32.exe
        
        C:\Windows\system32\Maohkd32.exe
        171⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        172⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        173⤵
        Drops file in System32 directory
        
        PID:6920
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        174⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        175⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        176⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7100
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        178⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Nnhfee32.exe
        
        C:\Windows\system32\Nnhfee32.exe
        179⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        180⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6388
        
        C:\Windows\SysWOW64\Nnjbke32.exe
        
        C:\Windows\system32\Nnjbke32.exe
        183⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        184⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        185⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        186⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        187⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        188⤵
        Drops file in System32 directory
        
        PID:6896
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        189⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        190⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        191⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        192⤵
        Drops file in System32 directory
        
        PID:5176
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        193⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6376
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        195⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Nnaikd32.exe
        
        C:\Windows\system32\Nnaikd32.exe
        196⤵
        Modifies registry class
        
        PID:6616
        
        C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        197⤵
        Modifies registry class
        
        PID:6824
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        198⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        199⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        200⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        201⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        202⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        203⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Ogljjiei.exe
        
        C:\Windows\system32\Ogljjiei.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6928
        
        C:\Windows\SysWOW64\Ojjffddl.exe
        
        C:\Windows\system32\Ojjffddl.exe
        205⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        206⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Odpjcm32.exe
        
        C:\Windows\system32\Odpjcm32.exe
        207⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Ogogoi32.exe
        
        C:\Windows\system32\Ogogoi32.exe
        208⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        209⤵
        Drops file in System32 directory
        
        PID:6624
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        210⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Oqgkhnjf.exe
        
        C:\Windows\system32\Oqgkhnjf.exe
        211⤵
        Drops file in System32 directory
        
        PID:7140
        
        C:\Windows\SysWOW64\Ogaceh32.exe
        
        C:\Windows\system32\Ogaceh32.exe
        212⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        213⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Obfhba32.exe
        
        C:\Windows\system32\Obfhba32.exe
        214⤵
        Drops file in System32 directory
        
        PID:7256
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        215⤵
        Modifies registry class
        
        PID:7292
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7336
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        217⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Onmhgb32.exe
        
        C:\Windows\system32\Onmhgb32.exe
        218⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        219⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        220⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Pkaiqf32.exe
        
        C:\Windows\system32\Pkaiqf32.exe
        221⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7588
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        223⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        224⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Pjffbc32.exe
        
        C:\Windows\system32\Pjffbc32.exe
        225⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Pbmncp32.exe
        
        C:\Windows\system32\Pbmncp32.exe
        226⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        227⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        228⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        229⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        230⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        231⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Pjkombfj.exe
        
        C:\Windows\system32\Pjkombfj.exe
        232⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        233⤵
        Drops file in System32 directory
        
        PID:8040
        
        C:\Windows\SysWOW64\Pgopffec.exe
        
        C:\Windows\system32\Pgopffec.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8084
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        235⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        236⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        237⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Qcepkg32.exe
        
        C:\Windows\system32\Qcepkg32.exe
        238⤵
        Drops file in System32 directory
        
        PID:7240
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        239⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        240⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        241⤵
        Drops file in System32 directory
        
        PID:7440
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        242⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        243⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        244⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Qjbena32.exe
        
        C:\Windows\system32\Qjbena32.exe
        245⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        246⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7832
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        248⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        249⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Aejfpjne.exe
        
        C:\Windows\system32\Aejfpjne.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8048
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        251⤵
        Drops file in System32 directory
        
        PID:8116
        
        C:\Windows\SysWOW64\Abngjnmo.exe
        
        C:\Windows\system32\Abngjnmo.exe
        252⤵
        Modifies registry class
        
        PID:8176
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        253⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        254⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Ajiknpjj.exe
        
        C:\Windows\system32\Ajiknpjj.exe
        255⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        256⤵
        Modifies registry class
        
        PID:7616
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7776
        
        C:\Windows\SysWOW64\Ajkhdp32.exe
        
        C:\Windows\system32\Ajkhdp32.exe
        258⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        259⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        260⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        261⤵
        Drops file in System32 directory
        
        PID:8180
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        262⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        263⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        264⤵
        Drops file in System32 directory
        
        PID:7736
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        265⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        266⤵
        Modifies registry class
        
        PID:8080
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        267⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        268⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        269⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        270⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        271⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        272⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        273⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Baocghgi.exe
        
        C:\Windows\system32\Baocghgi.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8196
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        275⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        276⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        277⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        278⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8408
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        280⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        281⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8528
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        283⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        284⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        285⤵
        Drops file in System32 directory
        
        PID:8664
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        286⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        287⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        288⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        289⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8820
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        290⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        291⤵
        Drops file in System32 directory
        
        PID:8908
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8948
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        293⤵
        Drops file in System32 directory
        
        PID:8988
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        294⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9072
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9120
        
        C:\Windows\SysWOW64\Ckcgkldl.exe
        
        C:\Windows\system32\Ckcgkldl.exe
        297⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        298⤵
        Modifies registry class
        
        PID:9204
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        299⤵
        Modifies registry class
        
        PID:8224
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        300⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        301⤵
        Modifies registry class
        
        PID:8352
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        302⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Dhidjpqc.exe
        
        C:\Windows\system32\Dhidjpqc.exe
        303⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        304⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        305⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        306⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        307⤵
        Modifies registry class
        
        PID:8760
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        308⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        309⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        310⤵
        Drops file in System32 directory
        
        PID:8960
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        311⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        312⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        313⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        314⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        315⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        316⤵
        Drops file in System32 directory
        
        PID:8388
        
        C:\Windows\SysWOW64\Ddgkpp32.exe
        
        C:\Windows\system32\Ddgkpp32.exe
        317⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        318⤵
        Drops file in System32 directory
        
        PID:8600
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        319⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        320⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        321⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        322⤵
        Modifies registry class
        
        PID:9048
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        323⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        324⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8212
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        325⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        326⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8832
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        328⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Ecoangbg.exe
        
        C:\Windows\system32\Ecoangbg.exe
        329⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        330⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        331⤵
        Drops file in System32 directory
        
        PID:8896
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        332⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        333⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        334⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        335⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        336⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        337⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        338⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        339⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        340⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Flnlhk32.exe
        
        C:\Windows\system32\Flnlhk32.exe
        341⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        342⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        343⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Fdialn32.exe
        
        C:\Windows\system32\Fdialn32.exe
        344⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        345⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        346⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        347⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        348⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        349⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        350⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9872
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        352⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        353⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        354⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        355⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        356⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10148
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10200
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8776
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        360⤵
        Modifies registry class
        
        PID:9264
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        361⤵
        Drops file in System32 directory
        
        PID:9324
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        362⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        363⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        364⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        365⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        366⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        367⤵
        Drops file in System32 directory
        
        PID:9864
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        368⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        369⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        370⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        371⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10160
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        372⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8644
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        373⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        374⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9532
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        376⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        377⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        378⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        379⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        380⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        381⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        382⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        383⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9856
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        384⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        385⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        386⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9392
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        387⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        388⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        389⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        390⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        391⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        392⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        393⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        394⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        395⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        396⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        397⤵
        Drops file in System32 directory
        
        PID:10420
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        398⤵
        Modifies registry class
        
        PID:10456
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        399⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        400⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        401⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        402⤵
        Modifies registry class
        
        PID:10620
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        403⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10704
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        405⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        406⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10824
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        408⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        409⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        410⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        411⤵
        Drops file in System32 directory
        
        PID:10992
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        412⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        413⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        414⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        415⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        416⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        417⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        418⤵
        Modifies registry class
        
        PID:10276
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        419⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        420⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10404
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        421⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        422⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        423⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        424⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        425⤵
        Modifies registry class
        
        PID:10760
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        426⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        427⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        428⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        429⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11028
        
        C:\Windows\SysWOW64\Ibcmom32.exe
        
        C:\Windows\system32\Ibcmom32.exe
        430⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        431⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        432⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11236
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        433⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        434⤵
        Modifies registry class
        
        PID:10476
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        435⤵
        Drops file in System32 directory
        
        PID:10528
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        436⤵
        
        PID:10644
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        437⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        438⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        439⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        440⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        441⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        442⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        443⤵
        Modifies registry class
        
        PID:10428
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        444⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        445⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        446⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        447⤵
        Modifies registry class
        
        PID:11192
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        448⤵
        Drops file in System32 directory
        
        PID:10976
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        449⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        450⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        451⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        452⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        453⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        454⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11228
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10400
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        456⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        457⤵
        
        PID:11344
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        458⤵
        Drops file in System32 directory
        
        PID:11388
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        459⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        460⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        461⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        462⤵
        Modifies registry class
        
        PID:11556
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        463⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        464⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        465⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        466⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        467⤵
        
        PID:11764
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        468⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        469⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        470⤵
        Drops file in System32 directory
        
        PID:11908
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        471⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        472⤵
        
        PID:11988
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        473⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        474⤵
        
        PID:12072
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        475⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        476⤵
        
        PID:12268
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        477⤵
        Drops file in System32 directory
        
        PID:11416
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        478⤵
        
        PID:11488
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        479⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        480⤵
        
        PID:11624
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        481⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        482⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11744
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        483⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        484⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        485⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11996
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        486⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12060
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        487⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12112
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        488⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        489⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        490⤵
        Drops file in System32 directory
        
        PID:10948
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        491⤵
        Drops file in System32 directory
        
        PID:10604
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        492⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        493⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11524
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        494⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        495⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11644
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        496⤵
        
        PID:11836
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        497⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11904
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        498⤵
        Drops file in System32 directory
        
        PID:12012
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        499⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        500⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        501⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        502⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        503⤵
        Drops file in System32 directory
        
        PID:11284
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        504⤵
        Modifies registry class
        
        PID:11620
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        505⤵
        
        PID:11892
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        506⤵
        
        PID:12008
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        507⤵
        
        PID:12196
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        508⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        509⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        510⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        511⤵
        
        PID:12096
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        512⤵
        Drops file in System32 directory
        
        PID:11320
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        513⤵
        Drops file in System32 directory
        
        PID:11792
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        514⤵
        
        PID:11976
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        515⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        516⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        517⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        518⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        519⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        520⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        521⤵
        
        PID:11796
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        522⤵
        Modifies registry class
        
        PID:12300
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        523⤵
        Drops file in System32 directory
        
        PID:12336
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        524⤵
        Modifies registry class
        
        PID:12372
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        525⤵
        
        PID:12408
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        526⤵
        Modifies registry class
        
        PID:12444
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        527⤵
        
        PID:12480
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        528⤵
        
        PID:12516
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        529⤵
        
        PID:12552
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        530⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12588
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        531⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        532⤵
        
        PID:12660
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        533⤵
        Modifies registry class
        
        PID:12696
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        534⤵
        
        PID:12732
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        535⤵
        
        PID:12768
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        536⤵
        
        PID:12804
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        537⤵
        Modifies registry class
        
        PID:12840
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        538⤵
        
        PID:12876
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        539⤵
        
        PID:12912
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        540⤵
        
        PID:12948
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        541⤵
        
        PID:12984
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        542⤵
        
        PID:13020
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        543⤵
        
        PID:13056
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        544⤵
        
        PID:13092
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        545⤵
        
        PID:13128
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        546⤵
        
        PID:13164
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        547⤵
        
        PID:13200
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        548⤵
        
        PID:13236
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        549⤵
        
        PID:13276
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        550⤵
        
        PID:12292
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        551⤵
        
        PID:12344
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        552⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12356
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        553⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        554⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12544
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        555⤵
        
        PID:12608
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        556⤵
        Modifies registry class
        
        PID:12668
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        557⤵
        
        PID:12740
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        558⤵
        Modifies registry class
        
        PID:12788
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        559⤵
        
        PID:12868
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        560⤵
        
        PID:12932
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        561⤵
        Drops file in System32 directory
        
        PID:12992
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        562⤵
        
        PID:13040
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        563⤵
        
        PID:13116
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        564⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        565⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1388
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        566⤵
        
        PID:13196
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        567⤵
        Modifies registry class
        
        PID:13264
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        568⤵
        
        PID:12328
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        569⤵
        
        PID:12468
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        570⤵
        
        PID:12596
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        571⤵
        Modifies registry class
        
        PID:12680
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        572⤵
        
        PID:12800
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        573⤵
        Modifies registry class
        
        PID:12860
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        574⤵
        
        PID:12972
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        575⤵
        Modifies registry class
        
        PID:13064
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        576⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        577⤵
        
        PID:13152
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        578⤵
        Modifies registry class
        
        PID:13248
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        579⤵
        
        PID:12440
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        580⤵
        Drops file in System32 directory
        
        PID:12648
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        581⤵
        
        PID:12812
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        582⤵
        Modifies registry class
        
        PID:13008
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        583⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        584⤵
        
        PID:12324
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        585⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12320
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        586⤵
        Drops file in System32 directory
        
        PID:13048
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        587⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13268
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        588⤵
        
        PID:12968
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        589⤵
        
        PID:12452
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        590⤵
        
        PID:13260
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        591⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13320
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        592⤵
        Drops file in System32 directory
        
        PID:13364
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        593⤵
        
        PID:13404
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        594⤵
        
        PID:13440
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        595⤵
        
        PID:13476
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        596⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13512
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        597⤵
        
        PID:13548
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        598⤵
        
        PID:13584
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        599⤵
        
        PID:13620
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        600⤵
        
        PID:13656
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        601⤵
        Drops file in System32 directory
        
        PID:13692
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        602⤵
        
        PID:13728
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        603⤵
        
        PID:13764
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        604⤵
        
        PID:13800
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        605⤵
        
        PID:13836
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        606⤵
        
        PID:13872
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        607⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13908
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        608⤵
        
        PID:13944
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        609⤵
        
        PID:13980
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        610⤵
        
        PID:14016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14016 -s 404
        611⤵
        Program crash
        
        PID:14096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 14016 -ip 14016
1⤵
PID:14068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aadifclh.exe

Filesize
128KB

MD5
38487c5085d95f0ef7a89f3cc05950da

SHA1
54e3e968984300b39b88ac9afa910d2c47cb9b03

SHA256
e2195e3b25a1fe7d46e57d8624f36bff4acf8d2d45f78973a31312fa4ea2dc86

SHA512
4e44744332c7038f44687c2114024f01e9b6237b7aefbc637a6b10e28609c850fd7129b8c580befd7cc35559d877ce8a032314e678e6862aa0ec9129bef1ac61

Download Submit
C:\Windows\SysWOW64\Aeiofcji.exe

Filesize
128KB

MD5
1dcfe7831b18a44b67c1197873d0119d

SHA1
09190ee4e02704c05ec0fb8d772c0654fbba6439

SHA256
af9c1d247cb667e1e97c2105cdbf8357a8d2b12f4315ee647fbcae213c73e7c0

SHA512
76471ffa0811f4f6e9c92e9e6079a9ec303fadc093517b36c23bf35af6ed16eecabbb2a04d15ff563e14e4bd84ea0c91eea655b119e017a10f497565dab73fa1

Download Submit
C:\Windows\SysWOW64\Bebblb32.exe

Filesize
128KB

MD5
e3f7b421efb8509420573456558986d4

SHA1
a9af04fc747da433c8c9cf81d8fc2cd0fec30d38

SHA256
e441c5792d9f9e96851758957f2fd82e06b27d5f94f32f307fc33ffa2b862335

SHA512
38124b04d1478567a7446f079f223a23ec52a1870d6b57e35bcd6e1d38452a1781e70ae8a75db54f18af78c7387f1508d4c066f132bd56d1b0aae15c52788fef

Download Submit
C:\Windows\SysWOW64\Cabfga32.exe

Filesize
128KB

MD5
b4439312f51cffee03dc308b63034f2d

SHA1
c4711f708e7ff087291210892ec0656b92a6984d

SHA256
f671d0321a255eb7b15e5d3998b4be663b8ce33d188882e0eaaf322fc2e098d3

SHA512
4ab9be45ccbb6a66f8fe847d1e69d01432c0333cc65005229de4d1bd00feaaa95e5e2a79fb674d39ab3e1e366428acbb450fe54e0277948a49bd1885b755b96e

Download Submit
C:\Windows\SysWOW64\Cmnpgb32.exe

Filesize
128KB

MD5
b6ddc00919fae0604fef57ce2559627e

SHA1
8c566d3d22cecfc29c08749df0cf76eefabacd35

SHA256
3f4bd80be0d489d9e3dd0ace4d6d2391aea5c11c565e0aefc0e4f7c39ecf6328

SHA512
9a22fb69e9f96692f0c88d0cb4ec8a666768239e6459b5e4a48454f256ccd4bfd64719a6f48b0ce67ad3958f4676b53bdc59a3d5c3b0aa40c6d44e60895b4c5d

Download Submit
C:\Windows\SysWOW64\Cnicfe32.exe

Filesize
128KB

MD5
ae776de2b0cdebc5e9b42fb38878bc4c

SHA1
3014588a8f34294495c136d371038607aef9f111

SHA256
61e8fcd5982f3599788b2859912681fd1be962d54fd7ff00ce9de2d40084b94b

SHA512
91dd829de0406ac0c59503957922a22f0fe8fd67141f417475d14aa5ecc3525c8345f1666cba14caf736b4947c1a06a9af8586e30de9e6c0348ae4cde3ac9e0d

Download Submit
C:\Windows\SysWOW64\Dagiil32.exe

Filesize
128KB

MD5
60e2ead8edaf34503091bfebe58492ad

SHA1
0037c937ae384e50e106ff85075dd070d47a3bfd

SHA256
8dac78bbe5f3a6e668c61bf572a944b48fcd736f2b948fd52540935161e72e21

SHA512
2b6eb796f7c77218be2d0e9b94fb8fb8f9cef981f3b7b199b9b56e959db648d6d2143326aa907233fbc34ed5fd003fa2ee5559dfbb85d9cb1f7487ce461ecf89

Download Submit
C:\Windows\SysWOW64\Dcfebonm.exe

Filesize
128KB

MD5
a792e8d20ca841dedaaf860c47ab50a0

SHA1
aebe6ba26cf5ee68fb5bfd1fb5f17c4ff11067e5

SHA256
66cf4652d222ff8f07bb50717a6edd5b2ed15d19ee7cac656f74c95005d0d118

SHA512
e9185a8fd659a6a7e46c8601740919bc85b204929a1c86f9b25d33ce2b061456e7f118c260d48c43c3b038aabf6372348380563fcb3c7bbee0f6138e3816ae85

Download Submit
C:\Windows\SysWOW64\Djpnohej.exe

Filesize
128KB

MD5
bc3c5caeba1fe816bbe5c225d985b09c

SHA1
39ce6c5de28307d133985c6e40590e6566dcc39e

SHA256
a024e36df2f16b30381fbb2e11ef98c5abf14a98120972a3684507b093b9e3a7

SHA512
848e280e8c4914c0c3de7ee1c143c114b165049addd953237763a16cdd990f6b1c57647528812cfceaff53d5665095700ec03f8cb3be274c799badd11cd08f61

Download Submit
C:\Windows\SysWOW64\Dkifae32.exe

Filesize
128KB

MD5
245d4b1f9dea855e79873152c1e518fa

SHA1
e211255aadcdaa440782737042f30de347644285

SHA256
8e986af087e95ba76f4b64b47910d7e8ced7a9c97b9d69ec09259313a11c5903

SHA512
c11b2fe5b5087171497e193b0ae18e6dbbbe71b2e1b3715d0b628a145408cbd25f2353b960052b620a3a44ab8698ebc07eaaaebbea93200de1af0f7e245791a4

Download Submit
C:\Windows\SysWOW64\Dllmfd32.exe

Filesize
128KB

MD5
4e6053d5c77dfe49f5dad948a9ed3782

SHA1
ef03065fb777a080a22199aad0e2cb8ff3f31019

SHA256
9e725c06e34dca82e5d88907e1d2a135e65ed67bc605281e461fed5371b4e389

SHA512
804a4587c4b5fabc6c5089754e40b015818660ad1991185009f6d584141b89b62107530a3a66d3972c5f58da5d3684ae0fdb30c4814447b5919c82370a6fd417

Download Submit
C:\Windows\SysWOW64\Dlojkddn.exe

Filesize
128KB

MD5
7f2e39dbef603d8da7104499ad46c85f

SHA1
f08c800e32fe2cd8d6bf42b3d31a6bb8ad660b8e

SHA256
9fb0fa26106c000ec2398239ce3cccee00c7d8552bc5f37c4333a873a5fb957d

SHA512
e05b8dfd246a00a0ce4314f2a13608f5c868f49668dec7c9ea8869d7493ace72e1b423255e524774ac26e5efb34f0ea92da3f522dd7cf99e063e72bf6c6cb32a

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
128KB

MD5
47c152492ab0d10b8a4fb403064abed0

SHA1
977bc60d5421c8c6446c50853035fb82301e63f2

SHA256
28bce705398095846ddffe675fe23100e261aebedd92f6ac855ecb63314edaf2

SHA512
544613a2a7b6db5c753602933ef0a706acb379c1da8976c72f7dbb294487b0b145d74ece95d91cf8950c54da5061ce85f6938dcb73ae3ce4216fa9e160052381

Download Submit
C:\Windows\SysWOW64\Dokjbp32.exe

Filesize
128KB

MD5
681acc2d2b3e1d7d280fe2a17a84b175

SHA1
2515651e653a7bf0e6ce7ea72b7cea87768f0d19

SHA256
014dbb79e4b1fad4373302a1af64fc2e28e7fd508091ad32e8836edba5888c32

SHA512
fb7d2503ecf5395c7aa5c9a69390466ddca15241d75e0e17bffa814002cf2484fe5f6f86f93c0f067286095c83a2ce87405d76b46a60a4b7d162edfbad5f3bf5

Download Submit
C:\Windows\SysWOW64\Domfgpca.exe

Filesize
128KB

MD5
3bebe363b5807e904c56fc9958e6d55d

SHA1
e0a489a55eefebb6aa93864f9215e95e74fc27a3

SHA256
fb1a03fa4729da5626bdbae95f264e3c6f0909a5a9b5facb02083da54cf8bd39

SHA512
776de9c003a1f6a6e59f0dd82ad3359980480e5d812e91ff512262ae5e1b0533f1d795ef437ea918097044a70838f8c5f2645e33343787998bd66e96151acccf

Download Submit
C:\Windows\SysWOW64\Eaklidoi.exe

Filesize
128KB

MD5
e920efe6d0f7ed4a4eeaf81b5ec85726

SHA1
8d3fd06259802bc0c4999492f42069232e841632

SHA256
37c23f4ea4e3c83f8ada470db0fffcecb88621e59826701e0145c16755bbeaaf

SHA512
01cf99f3432ad22b4563f7a0649c854839103e3df1bbe884d70e04e7bed6770f62eed8c184da0a7a8e82dacdf2f881694127636a8a8ddb10e29110cd43550a5a

Download Submit
C:\Windows\SysWOW64\Ebeejijj.exe

Filesize
128KB

MD5
ade2cfb5f2d3e28f530528b3f772b9a7

SHA1
ca579afd4f0fe1444e229317965f4794b2d0bb44

SHA256
a7d8bb2d8a0f17b169fcc16ee7fbb4118cb3b83628936552c0b971b54e5f0be7

SHA512
cf4db73fccf0b48054225d08db9d53f2e7dd6a80d42ee4731c230ff74e012aaf053d818f2acf398b19c05539e4de7dc8a470f2027f6636e14bfc02970e1eba47

Download Submit
C:\Windows\SysWOW64\Ecdbdl32.exe

Filesize
128KB

MD5
449dfc7ca2e018a4fb8ae651cb3cb04f

SHA1
9e0c647822decce7deb5c3001a67cde6fb170697

SHA256
204d15b551cadfe981ac9adef92e99baf19a4b2d057ec1e9ecbc6d9f7cf3a24d

SHA512
d346317388ab63cf834651eaf961d73e0294eea2d252f08d2c932c23c088b30f05759419bac52d952c5001e0ab10b92dc9cb52e54781094bb56884e624c2843e

Download Submit
C:\Windows\SysWOW64\Ecmlcmhe.exe

Filesize
128KB

MD5
378df1e9126e7c4109ac390ab84a246b

SHA1
c0cb37e96ed8b39e056a04b5bd5e40e9323d38c6

SHA256
ca658951da67d80f7ebf733150dfc5dcf315d71f5fd5c0ed47ec78a095f21db4

SHA512
344ef5336127045b0d737781ab0f63e9315ed909172b0494484cc0609e6dac356dedd3eb35cce5de08032457ca6ca6e7bfbd5dfe5843013c5ead9c58daa16763

Download Submit
C:\Windows\SysWOW64\Efikji32.exe

Filesize
128KB

MD5
58d49f3cfaad81be8970c209280f78b5

SHA1
1cb0aa144f144ceff7fddbedd01e2282cf26781c

SHA256
65f9edf0446625b943ab2fcd7c37886068ae3949bd736b66c1c4a8028a8f5c09

SHA512
3db91c828c91c42b94fc376a2626a99dc3c792a381a2584d1940becac74528c925847654d1225e9af952a0bdf5ec5eb5c099f80a9c2b653d41de4a675b1f9cea

Download Submit
C:\Windows\SysWOW64\Eflhoigi.exe

Filesize
128KB

MD5
9ca49d7554bb3332cd7dc8ef9c71c09d

SHA1
329f868d6aa2f2ed18ca7409a84b2ed91e02ae76

SHA256
2014c077f3fc7570c1e25778703f85779c37293ad6d9adc0abdfbb5c763b1369

SHA512
4eb102d7c24cf023da3041d20b34140b228a200cc96a3a31925e286adb0cb3deb6216f2425b61624b97a032732a5d634575d2c6176d6f9603591ac98827fad79

Download Submit
C:\Windows\SysWOW64\Efneehef.exe

Filesize
128KB

MD5
e2e4bea3be26e8e8bf7cc00a442a35c9

SHA1
6d008bc75654d6abedbb5508d1c4b35b3128f006

SHA256
8238f5dd1812f39cf28b8e472cf43ab066d73152a2331fe558ad80c66414bf34

SHA512
06d4bbbfe1d25fba566acc65bfba5d37ea992b3fdd380ec3c78eb8ce7eab695f0fb8c84e9966eb50439f096b78a88e24676d48fd3d7bd827651d5728d37ce7cf

Download Submit
C:\Windows\SysWOW64\Ehhgfdho.exe

Filesize
128KB

MD5
fcef93df8e4abb43ca3a6cb2e0c8df14

SHA1
4a8d33ffbda5635a38fd75eb0e917605a8b7a6ea

SHA256
7ff509650004475845781d6826e7cc2bde67fa3d00195cfefb9a140a0dc1b882

SHA512
6b8d47e23a05c294fbdbf3205a9989935d81e52d0fc4a8144d9a8d1ec24bd4ad424c7563809c55373fca2412e9be41f710ce598189b0b7e5cbfe53cf50642fd7

Download Submit
C:\Windows\SysWOW64\Ehlaaddj.exe

Filesize
128KB

MD5
3429ffba47b18cce573d018a6b52fe99

SHA1
3f6f27344a90c9a504da417c205b70ea13348ee7

SHA256
49f2a356c69c11c6b538d8184355a1dc337953ecfe146f3da4a4fe004c1ea7fb

SHA512
40aa610c06be1fb5d3d1dade120840357430443fc2d12cd234d0a3ddbc4f937814a05344b64f72b2597aa481158af7d022db14e88b82da270a61e90dcc154276

Download Submit
C:\Windows\SysWOW64\Ejbkehcg.exe

Filesize
128KB

MD5
78083d66794da5a3b1050ef0e8d62b07

SHA1
12c9b9501dc42ba20fa0182d1c9e0debfad16c88

SHA256
b895018253feb21c5961613d592573f5614af6bafb0dd90e3e6045e987938b98

SHA512
08d62bcd6f5915374fa12d95bb9a1728b55a6783eae35494ac12d49d84f4be144544bebfaeaffefd09bebc31e47967c0bb4785fac458790f4c4685d298227c82

Download Submit
C:\Windows\SysWOW64\Elagacbk.exe

Filesize
128KB

MD5
630cdf9a7b4e6f84d59f22a89796303b

SHA1
71720830a8ea7b827f0e47d2c9ee6514d1e56b61

SHA256
0d37b38637b847d69d0337349b48baaf054732ae671fbc58ba20b6322969852c

SHA512
6b617e01eb704dcc8468d8a6a5f8aefd56876b53b490a49547dd6a8e1a4a15ada455a2fa6af3a4b8d8cc4b4742ccf26eee036640bb7d2e16739ed2c8de979403

Download Submit
C:\Windows\SysWOW64\Elccfc32.exe

Filesize
128KB

MD5
ba9a5d1f669977c8511fd188cee74d71

SHA1
be009b10b65778f14dba7c45cf4fb5fe4044355c

SHA256
1c567b1cc098fee4a6e846bb65155312854bc43d7d92cc736cf8814b8c23549a

SHA512
1a2b54e8bc4f8f4fe4a7d87fb3ed34f59865eb047cd4752898aa7db62e66b284558c09af1dd9c2aeae6176a377dcf0e06521387486a86d8ec448ab5224f8b623

Download Submit
C:\Windows\SysWOW64\Emjjgbjp.exe

Filesize
128KB

MD5
e310535d36ab989d4ecbb018c2482d21

SHA1
456bd6254b67fd24ceec08013e99769bef68372b

SHA256
355ee7d9aba12803ead34b2c9fd6f89cabc89269aeba6100720dfb8130fd425d

SHA512
ca5ae1d5bcc5fac7d1c1be97f8051fc44f5f42c5f20997526cf7abcbb29d0a1b15a1a774019bf85ad128632634b13079e12c47c00f2b162a5bbe8a2d4b56f57f

Download Submit
C:\Windows\SysWOW64\Eodlho32.exe

Filesize
128KB

MD5
eb5b575abdd211bc11593659937efb16

SHA1
a11234c4a3e9e08a137287ef460e504c8226d586

SHA256
3323ec5b72cc841de72f87a773a6672f85031538a0294ab4230bb52a8dd3e4d2

SHA512
743750a6c169cef969e1557155617abe1afae2b776a1e91aa495618a0e09dfbf1c47e6b77679029608f4fc556d1a9b02b25afd08a1dfdc03929fd7a71ed54102

Download Submit
C:\Windows\SysWOW64\Eofinnkf.exe

Filesize
128KB

MD5
8ae4af6ea529b695104302ae30d317f4

SHA1
92291b5b98b2586f2e2e682db9ae8603a3ed0da8

SHA256
d8f63566c6863a92fd98e939418f3ac2307ac5f8a2d828854a452e416472732c

SHA512
ac50ff3175ac52327b5277f4c77bb61af5b5021a5e634b713309993f5fa81170fb04238c3f092e9f3ba138eac96fd7dda3c3bea6b56d1995a1592344aeb8818a

Download Submit
C:\Windows\SysWOW64\Eoocmoao.exe

Filesize
128KB

MD5
a9faded49fed0b143c5493ea9b1d4c3d

SHA1
ff77b0623756b40d1b145e52b7d7020baa2397f7

SHA256
4f6799712bbf95f7bd6bcbab893d3c1117cd7230ab0f369a25b0dffeb493d555

SHA512
8cf89df7c4e8d583cfd977dca41066f2fabc5b3d86d6b9a204fd16b57f88377ea46865a370e10c945a56d937f70c61c458e84f7f23d3b8047b3d3de5afe09648

Download Submit
C:\Windows\SysWOW64\Epopgbia.exe

Filesize
128KB

MD5
c2e3bf5c7a733adbd240c9589043d06d

SHA1
5f243df3346b60fd8a016a0d70aee1692c54a147

SHA256
1bceed824ff1e92166c79f856ad4d2df5113dfb1ad58ea6554cac075f3902f7e

SHA512
3b614043ad0b9bcbb593d9c3eafb8e631ab48c794afdbda111c49a830ad9fc9f154a9c4d2ddcab563ef84239d20223bafa33fccdb2aec31a46f06dfead32b3ed

Download Submit
C:\Windows\SysWOW64\Eqalmafo.exe

Filesize
128KB

MD5
8497c6ef18ad0e1e22520657922b0dbb

SHA1
65650c0d2b06da36f8467a3b7ed1238c7e6c6d85

SHA256
9182e04928fac95346e01def00d1274374c66ed785fbac999c62c59e8ae12d40

SHA512
935360bcbf542e22c75397907c72402521974f8be774d544c9f5b8780cd901d410be9f013ebaed28c78c7b5d8bc1d95c28f09e37aa002c004d823bf34fca6b6a

Download Submit
C:\Windows\SysWOW64\Fbioei32.exe

Filesize
128KB

MD5
b5c19042c72b730160bca52b54ce5311

SHA1
cfdcabf248264516012ba62ba25b1b898716a48e

SHA256
be70a916664f2d5db0590a36c6bf49dddc477a85283d9b886a37980b20ad8598

SHA512
c637cd3f8cae978586a5607519698d556a3384aad1607dd1477efb7a86025fd865a7cfdeaf43d1cd52dd77c5720580d0f79c6338be376583fc2447f653bd9779

Download Submit
C:\Windows\SysWOW64\Fcikolnh.exe

Filesize
128KB

MD5
cd981d5f4fe1febbb2648efe312b0198

SHA1
aae969e710ffe20ac0f0a4d17808c5866a30d0a8

SHA256
421c93715f2c57052b5673f4651ed9bca5c672ae5d8f4e73f927a863ee9b606c

SHA512
82db20460f96bc4e560bcee50b3b0a63c655506272ad289b558bd7c35ec93484b40d5432c7ecaae14100a2b20baffde7bccbac142ae7117a2e995d521bf20a71

Download Submit
C:\Windows\SysWOW64\Ffbnph32.exe

Filesize
128KB

MD5
6f8d2312fe4d2e800a1e564d99fcb581

SHA1
400815763d6657a6a11d8bc86537aba3b537b285

SHA256
be663b0640085db2b838a2c232bff8864b0cae944e82b3a759f6965bb9241f3f

SHA512
3f663c28fda9b10fd02eacb3c384de49a973333b50dd30c2be78ef900401e2daf63b5488d9ea40eacdfad77bb629061afd7d84905297dc2307443f9f2a71fd77

Download Submit
C:\Windows\SysWOW64\Ficgacna.exe

Filesize
128KB

MD5
6c84a1aef088b3745e20f7a35d959866

SHA1
756ca0ea9c61a2c974bff9c74c7ef82e65a56ba1

SHA256
860f89162a11ecfd29b4ffc15ca87bdaedc5bbfbbb0dcd64cee0de03bc5b58ac

SHA512
215f7f1c22cc1e6f540a673a3af3f0398803f92ec5618161c5fc9b24fd51f5c5c51c3ecae6e1b229ecea326d4ddb6b12842ca4dca89dfc78ff4df627287141a7

Download Submit
C:\Windows\SysWOW64\Fjcclf32.exe

Filesize
128KB

MD5
43e912489209a618ddef6ba2bdebd2a6

SHA1
d67b679af6da03a526862aaf6a82976697b30941

SHA256
cacaaadac8e9adbba56af5318f2f26a41e06b657f5c7b983100f8e495c0fe7ba

SHA512
a71ec18c9d05ebf5bde6059b5a2add29c35d72a63ca18101c9837214b11a81d8fd49c5dbf4667896a1031a8c5469c054610355c79bf3b8b2cc83d67b64ea1855

Download Submit
C:\Windows\SysWOW64\Fmapha32.exe

Filesize
128KB

MD5
3cec1246f9f0db349223e833e58e514b

SHA1
a0c45f7ab5b627005aaf5f447e723fd0cca0c2df

SHA256
7005157308a5c04d5cd4a166e39dc5a4ff4d33fd6915087774c2a1c84b2b5283

SHA512
5a8ce14da7094eb5d9aea74f45add0fd8e4b9f84156965e9aa9c6fa9e2aa319ebbd9bc6316d5740b2cb950afca477f3986f55dfd7b0e44de65c01d8baf0ca691

Download Submit
C:\Windows\SysWOW64\Fmmfmbhn.exe

Filesize
128KB

MD5
970998903c225726a6b6e4edbc08eebd

SHA1
93fd6e139be91aefd367b4adc41f56a274bd85ce

SHA256
97cc04445804217718589f3b3e6d1a4d09e5c915dbf6b093c2e60d06fdd43978

SHA512
aaacd0ea99f43e90d55af6a22cb232b0d600d0c7e60f1c8ad5784a3d4d4bef56c5511761f4aee8798256ae559a1018a84a33d944de8c12d760c45443df78660b

Download Submit
C:\Windows\SysWOW64\Fokbim32.exe

Filesize
128KB

MD5
253008c7a562084d5b1cbac621264fb5

SHA1
a27b9e0223ba182db51003d382f529afcfda1259

SHA256
0d6a937ae276246176987845d5523cd3094289326e19b4a58f5ef299b0090edb

SHA512
629aa51618e43b89a6a36ad59f522ecde40dd056916d4f5b9edfa7129b77b8203f173da532d45f62dfae205676c144a19f612114ebfa9dacae3b283394943955

Download Submit
C:\Windows\SysWOW64\Ibjqcd32.exe

Filesize
128KB

MD5
fd2c40a42beb31ef2925c098512ad0f1

SHA1
b8a18cc453ed44773037a88d3865a0d504281a5c

SHA256
fac062fdb8106a121ed90d15b77c63753f6f1f7fcbfc222babc47c4be6d9c513

SHA512
556fec3b5365958a59be3ebe602b4aa5590849de35c9c0dc43e4ef79951c6fc448eebde5be828e2c9155c949d3a9f8423ad08e297097411f130f229ac84f2266

Download Submit
C:\Windows\SysWOW64\Iblfnn32.exe

Filesize
128KB

MD5
7dece99c4548221a183b8da649a83da5

SHA1
06cff4133f9c7f5ac97837662fb9a855b0c1438a

SHA256
991f4914039edb950a0dc6a5100856bc371ddc6133104ed22838fb7ff2d10e02

SHA512
689a766385864afd7fce10cb961773cd11c8a8ce1ae1695a5a93424b59ea4319f73eebacfffa3d6fe3a521132d6348fc59955356f937f72c7189e721cd73a78d

Download Submit
C:\Windows\SysWOW64\Iejcji32.exe

Filesize
128KB

MD5
f9926422ed18608294ea98802803f438

SHA1
b5e421a52a3094fa99920b2fc2df96712e4bf062

SHA256
dcab24b1c22f9e2915f1d3294b8a786f3554eee268a2324e6b3bcb609b3995c1

SHA512
ddf07865c34dac86193978a13da9d6b98deae50cde036717b3afb846f4e4d0f218a4859eeecc827c85387851b53b4bbc11334c98d788b9c3aa112cc04235fdb9

Download Submit
C:\Windows\SysWOW64\Jbeidl32.exe

Filesize
128KB

MD5
376d6093235ab465e48c6575e93f08ad

SHA1
88f44ea9006a26f1f857c801feff0960e1e61db0

SHA256
750c02a093e4eb2b8fa2d31e5fe990f20f9b0d28ac0955560fc7ddf4ba3bee16

SHA512
b58f3ae4db80b5d70f8e2d9eccd74a6d0f3c930806809c9c6199f1b4d2ab16b93bce80e8e4b2c7f18391e191981be7d670f229a980c3303f384d3a4487a8296d

Download Submit
C:\Windows\SysWOW64\Lpnlpnih.exe

Filesize
128KB

MD5
4e73432b04c8a6499b84058e1241eda2

SHA1
e2de9cf0a730d04b3e2dacd5d6d96bceb4b753f5

SHA256
3bb664bf1791f6bced298ca55a0328a4fb227261ae60e73312ae8e3be3fbe596

SHA512
665574e85ca323fa6168d57f6c7ccc7064b4afe73dd6f9f8539f65dbbccd191006a97371a5c188e288760643618d16e09611526457f78d885434056b20bd389e

Download Submit
C:\Windows\SysWOW64\Mgimcebb.exe

Filesize
128KB

MD5
53f720542b6bfcf2730cfab954b20408

SHA1
0d2452537ddf40b7233f5bd65e6ad61a2d49614a

SHA256
1dab7fdb701741fee0939c76e82554369aef1c4c64f8cda19a8d532db8611cc5

SHA512
f765782422c3261be26e612cd6ab7dd5eacb4938565705eaa4b1f2aa26f7173d5511b7ea47b60df8cb912296b557bb96b475c505e75464de2d89fe8ec63047e7

Download Submit
C:\Windows\SysWOW64\Mplhql32.exe

Filesize
128KB

MD5
53dd67ec77e5b89db2ee48ff7f33d0b2

SHA1
18dacde6c094c9f055eff5fb50af1e5929b9ca1c

SHA256
9fc1c15999ce843eb6bf15cf435ea60fc93c204fd3b6ed21c76490d144af9328

SHA512
b4d5e84b510ea19054a223ea1f6cde8b2b7f28992d5250b68630aa1d26dfb3a45504a075ae22c11f0c2e95a5200b3f26f779accb45538942b51c64ad3eb3b421

Download Submit
C:\Windows\SysWOW64\Ncbknfed.exe

Filesize
128KB

MD5
396f1015458cd167e9dda0b9bf233e18

SHA1
7df946561b1f691ae0392e680c88a71c240b1683

SHA256
16886eeb5d1f38b7ccc699ec3ab28ba5edb6dd49a65e9065c76d4c442604676d

SHA512
ca796ac0b5264c55ae54dc96a9e0bff0207bc38d0b55f4c4fa4b3a7a2d160a4d665d9dd155f9dd6d91c81d0ab4abe85f6bd33feb5106880ea336ccead2b82409

Download Submit
C:\Windows\SysWOW64\Nfgmjqop.exe

Filesize
128KB

MD5
d3e1a0c6ee525565ed3addfabe2bbb5f

SHA1
4d724a369c0b1e61e6ba7941862213fc0fe325d2

SHA256
d80330cdfba4c3aebc2596bc01432f8dbbc858922ed74c23258269ac3479a23c

SHA512
d0a54c66934a2928df4221a8951a02181f8fd649291adb6f022c22ce2002bbface04ae4615ef1a7e1780258fddb41e55029dfc7e611d5584a01e56d2e7dd57f3

Download Submit
C:\Windows\SysWOW64\Odkjng32.exe

Filesize
128KB

MD5
46b485e8eb146bf2d40168d73b681423

SHA1
cbfcf7b54e9a756323b26e3094afda612b15ad2d

SHA256
bd77e9a4ed551573db69870b809254908e0ace85db328159c56b7ec2dc1c94a1

SHA512
4ed24f4d116720f6292e92b4b9e92a8af96c23105ff0f17c100fe4b216dbf6aace738213b2102833a8a024181f741b81ec1958f9de7b6912c6a45a17c48319d9

Download Submit
C:\Windows\SysWOW64\Pflplnlg.exe

Filesize
128KB

MD5
98c05eb59ce6807d3b6b292b217ff4d5

SHA1
af836695b0fb5eb994bd487e5b220ef33cb9a1c7

SHA256
6dd1bcf151302fa2f63478b55adb24953b02f07981650cfa11951a3085faa2d4

SHA512
bbfb7481bd423eeed65f44b2d9289f8757d97d0bc37e57cc4f179ce067616650e3a42137e48408a00de0df27daa725898fb173818c7cfc9489cab2fbb4ba6c64

Download Submit
C:\Windows\SysWOW64\Qceiaa32.exe

Filesize
128KB

MD5
9f1d09f7569176a094452e80ff1b2181

SHA1
2ae93ce1ed391392da762d2f9427185460f750b8

SHA256
48a02571d60e05835899b4731925da125f1d5bb6f7e19178a9f0f2135828ada4

SHA512
26c81b4e0ddecf4cfee933333e54d78a9494a07df178ec19194694166e4b7040e118358703c9d318ec2681466bad64903f5b12790a268085452f53418ceae3ff

Download Submit
memory/64-221-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/224-73-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/436-357-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/532-104-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/548-363-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/552-412-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/620-200-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/720-24-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/840-17-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/844-193-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/928-161-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1252-315-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1328-401-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1340-168-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1472-8-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1508-399-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1516-275-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1632-299-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1672-129-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1860-125-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1904-389-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1988-327-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2024-335-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2028-233-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2080-375-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2116-5-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2116-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2184-413-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2196-317-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2232-352-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2236-345-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2248-419-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2508-261-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2628-145-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2756-293-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2828-85-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2848-89-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3276-116-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3296-256-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3336-329-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3404-177-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3496-381-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3708-281-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3712-230-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3720-49-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3724-441-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3916-120-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3928-41-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4092-213-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4168-185-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4196-57-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4204-431-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4288-267-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4360-429-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4440-241-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4448-287-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4468-309-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4492-369-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4536-269-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4548-32-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4584-383-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4736-141-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4804-65-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5016-153-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads