f1be5efbc065143f1ea1d192d61baa44972f47c818471d09c6a1d34c0954aa3c

Analysis

max time kernel
130s
max time network
113s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 04:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f1be5efbc065143f1ea1d192d61baa44972f47c818471d09c6a1d34c0954aa3c.exe
Size

71KB
MD5

10afcdece29409857bfcde900a780b91
SHA1

36dfa0231c4214155ad857d8f24bdc243b31e884
SHA256

f1be5efbc065143f1ea1d192d61baa44972f47c818471d09c6a1d34c0954aa3c
SHA512

c35378c9e19fd9b26ac7577f1b5774d62e2dfe21f5f42dd716dd7ce1422ca84d9eb9164e7bbfbdf5d01ad10b28a4183d33d6b47532d437d1fa3d9777e7fda1af
SSDEEP

1536:TXJjEh3TUHpTL/RhCaP1x7VbEyYB0Ca0JGkSpgxpi0RQpK1P+ATT:T5eEpTLJl1xZxN0YWXPeYP+A3

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajckij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmbklj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aegikj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbjcolha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndcdmikd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofeilobp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmannhhj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlncan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekhjmiad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kmijbcpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocbddc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hclakimb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmiflbel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Deokon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfpgffpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kaemnhla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pgjfkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lenamdem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jkfkfohj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qajadlja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bdhfhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cajcbgml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olmeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qddfkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	f1be5efbc065143f1ea1d192d61baa44972f47c818471d09c6a1d34c0954aa3c.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dphifcoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fobiilai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hikfip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okjbpglo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Febgea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjolnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ocqnij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibnccmbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlpkba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gcpapkgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kaqcbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chpada32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfpcgpae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbnhphbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fjhmgeao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kipabjil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Mchhggno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pdfjifjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nklfoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Aeopki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcfebonm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Pdkcde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfpnph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qjoankoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cjinkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cndikf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nljofl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njnpppkn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmaioo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Njacpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahmlgd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbpnkama.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmhale32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liimncmf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oponmilc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Balpgb32.exe

Executes dropped EXE 64 IoCs

pid	Process
3840	Coagla32.exe
5104	Capchmmb.exe
2636	Digkijmd.exe
3192	Dlegeemh.exe
4120	Doccaall.exe
2204	Dabpnlkp.exe
4224	Diihojkb.exe
4576	Dlgdkeje.exe
2084	Dofpgqji.exe
1264	Dcalgo32.exe
1652	Djlddi32.exe
1932	Dhnepfpj.exe
4996	Dohmlp32.exe
3336	Dcdimopp.exe
1920	Debeijoc.exe
1180	Dhqaefng.exe
3880	Dphifcoi.exe
1632	Dcfebonm.exe
2216	Dfdbojmq.exe
5028	Dhcnke32.exe
2856	Dlojkddn.exe
4976	Domfgpca.exe
1592	Dakbckbe.exe
1884	Ejbkehcg.exe
2276	Elagacbk.exe
1628	Eoocmoao.exe
3752	Ebnoikqb.exe
1112	Efikji32.exe
3084	Ehhgfdho.exe
4300	Ecmlcmhe.exe
3176	Ebploj32.exe
1256	Ejgdpg32.exe
3152	Eodlho32.exe
4808	Ebbidj32.exe
5112	Elhmablc.exe
2680	Eofinnkf.exe
3044	Ejlmkgkl.exe
1816	Ehonfc32.exe
2384	Eqfeha32.exe
2284	Ecdbdl32.exe
4540	Fjnjqfij.exe
512	Fqhbmqqg.exe
4888	Fcgoilpj.exe
3228	Ffekegon.exe
5068	Ficgacna.exe
1772	Fqkocpod.exe
4708	Ffggkgmk.exe
2640	Fjcclf32.exe
4068	Fckhdk32.exe
4004	Fbnhphbp.exe
2732	Fmclmabe.exe
3296	Fobiilai.exe
2224	Fbqefhpm.exe
3036	Fjhmgeao.exe
3704	Fmficqpc.exe
420	Gcpapkgp.exe
2904	Gbcakg32.exe
1044	Gjjjle32.exe
4660	Gmhfhp32.exe
4944	Gqdbiofi.exe
3668	Gcbnejem.exe
3860	Gjlfbd32.exe
4648	Gmkbnp32.exe
2948	Gcekkjcj.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dammlf32.dll	Hflcbngh.exe
File created	C:\Windows\SysWOW64\Hbgmcnhf.exe	Hoiafcic.exe
File created	C:\Windows\SysWOW64\Kahdohfm.dll	Daekdooc.exe
File created	C:\Windows\SysWOW64\Okgoadbf.dll	Cnnlaehj.exe
File opened for modification	C:\Windows\SysWOW64\Cecbmf32.exe	Cbefaj32.exe
File created	C:\Windows\SysWOW64\Jcpfco32.dll	Chghdqbf.exe
File opened for modification	C:\Windows\SysWOW64\Nfgmjqop.exe	Ncianepl.exe
File opened for modification	C:\Windows\SysWOW64\Bajjli32.exe	Bnlnon32.exe
File opened for modification	C:\Windows\SysWOW64\Eqfeha32.exe	Ehonfc32.exe
File created	C:\Windows\SysWOW64\Mcbahlip.exe	Mpdelajl.exe
File opened for modification	C:\Windows\SysWOW64\Ndghmo32.exe	Njacpf32.exe
File created	C:\Windows\SysWOW64\Fqplhmkl.dll	Jfcbjk32.exe
File created	C:\Windows\SysWOW64\Kdeoemeg.exe	Klngdpdd.exe
File opened for modification	C:\Windows\SysWOW64\Ndaggimg.exe	Nljofl32.exe
File opened for modification	C:\Windows\SysWOW64\Lklnhlfb.exe	Lpfijcfl.exe
File created	C:\Windows\SysWOW64\Plbehnol.dll	Digkijmd.exe
File opened for modification	C:\Windows\SysWOW64\Ipegmg32.exe	Imgkql32.exe
File created	C:\Windows\SysWOW64\Kmjqmi32.exe	Kbdmpqcb.exe
File created	C:\Windows\SysWOW64\Gnpllc32.dll	Nfjjppmm.exe
File created	C:\Windows\SysWOW64\Ifoihl32.dll	Pflplnlg.exe
File opened for modification	C:\Windows\SysWOW64\Ifopiajn.exe	Idacmfkj.exe
File created	C:\Windows\SysWOW64\Hflheb32.dll	Llgjjnlj.exe
File opened for modification	C:\Windows\SysWOW64\Dgbdlf32.exe	Dddhpjof.exe
File opened for modification	C:\Windows\SysWOW64\Fcgoilpj.exe	Fqhbmqqg.exe
File opened for modification	C:\Windows\SysWOW64\Mkepnjng.exe	Mpolqa32.exe
File created	C:\Windows\SysWOW64\Jlgbon32.dll	Leihbeib.exe
File created	C:\Windows\SysWOW64\Qgallfcq.exe	Pagdol32.exe
File created	C:\Windows\SysWOW64\Odmkog32.dll	Eoaihhlp.exe
File opened for modification	C:\Windows\SysWOW64\Diihojkb.exe	Dabpnlkp.exe
File created	C:\Windows\SysWOW64\Bbbjnidp.dll	Jdemhe32.exe
File created	C:\Windows\SysWOW64\Mnfipekh.exe	Mkgmcjld.exe
File created	C:\Windows\SysWOW64\Dnkdikig.dll	Ldkojb32.exe
File created	C:\Windows\SysWOW64\Dalchnkg.dll	Ogaceh32.exe
File opened for modification	C:\Windows\SysWOW64\Bchomn32.exe	Beeoaapl.exe
File created	C:\Windows\SysWOW64\Ajhddjfn.exe	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Qgejif32.dll	Lgikfn32.exe
File opened for modification	C:\Windows\SysWOW64\Fcmnpe32.exe	Foabofnn.exe
File created	C:\Windows\SysWOW64\Fkgoikdb.dll	Imdgqfbd.exe
File opened for modification	C:\Windows\SysWOW64\Cegdnopg.exe	Calhnpgn.exe
File opened for modification	C:\Windows\SysWOW64\Kbhoqj32.exe	Kdeoemeg.exe
File created	C:\Windows\SysWOW64\Nfjjppmm.exe	Nggjdc32.exe
File created	C:\Windows\SysWOW64\Bgehcmmm.exe	Bcjlcn32.exe
File created	C:\Windows\SysWOW64\Ldoaklml.exe	Llgjjnlj.exe
File created	C:\Windows\SysWOW64\Mogqfgka.dll	Bnbmefbg.exe
File created	C:\Windows\SysWOW64\Gmhfhp32.exe	Gjjjle32.exe
File created	C:\Windows\SysWOW64\Pgmcqggf.exe	Pengdk32.exe
File created	C:\Windows\SysWOW64\Hfmbha32.dll	Ipdqba32.exe
File created	C:\Windows\SysWOW64\Angddopp.exe	Alhhhcal.exe
File created	C:\Windows\SysWOW64\Cbcilkjg.exe	Cogmkl32.exe
File opened for modification	C:\Windows\SysWOW64\Ajhddjfn.exe	Acnlgp32.exe
File created	C:\Windows\SysWOW64\Akichh32.dll	Bchomn32.exe
File opened for modification	C:\Windows\SysWOW64\Alfkbc32.exe	Ahkobekf.exe
File created	C:\Windows\SysWOW64\Pfaigm32.exe	Pdpmpdbd.exe
File created	C:\Windows\SysWOW64\Hjfgfh32.dll	Qmmnjfnl.exe
File created	C:\Windows\SysWOW64\Gfogkano.dll	Onfbfc32.exe
File created	C:\Windows\SysWOW64\Eoodnhmi.dll	Epopgbia.exe
File created	C:\Windows\SysWOW64\Milgab32.dll	Kaemnhla.exe
File opened for modification	C:\Windows\SysWOW64\Ghlcnk32.exe	Gfngap32.exe
File created	C:\Windows\SysWOW64\Ehifigof.dll	Jpojcf32.exe
File created	C:\Windows\SysWOW64\Bhaebcen.exe	Becifhfj.exe
File created	C:\Windows\SysWOW64\Kmipecpd.dll	Fllpbldb.exe
File opened for modification	C:\Windows\SysWOW64\Hcmgfbhd.exe	Hkfoeega.exe
File created	C:\Windows\SysWOW64\Hfligghk.dll	Nfgmjqop.exe
File opened for modification	C:\Windows\SysWOW64\Djlddi32.exe	Dcalgo32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
14116	14072	WerFault.exe	692

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qcldhk32.dll"	Mpolqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogfilp32.dll"	Cfmajipb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cagecd32.dll"	Pkfblfab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgcqbd32.dll"	Pndohaqe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fllpbldb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fcmnpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djmdfpmb.dll"	Gbjhlfhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bbnpqk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fkalchij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hflheb32.dll"	Llgjjnlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gmhfhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Onkhkpho.dll"	Ipldfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lklnhlfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eifnachf.dll"	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfdjmlhn.dll"	Ognpebpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Capchmmb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chbijmok.dll"	Gmkbnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifegaglc.dll"	Gjapmdid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnelfilp.dll"	Mncmjfmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijmanlfp.dll"	Fkmchi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Fbpnkama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mlampmdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkejdahi.dll"	Ajckij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nedmmlba.dll"	Ceqnmpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kbfbkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmcjlfqa.dll"	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Kpccnefa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Iidipnal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bhaebcen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cbcilkjg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fhemmlhc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Onholckc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pgjfkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mdmnlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Majopeii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Daaicfgd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Geplnioe.dll"	Fkalchij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lgikfn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Obangb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnhjmp32.dll"	Jlednamo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jjbako32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Lpcmec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajbajd32.dll"	Ajfoiqll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmjehihl.dll"	Dkljak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ichhhi32.dll"	Jiikak32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Okhfjh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldfgeigq.dll"	Agoabn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbkmec32.dll"	Jidbflcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hcpclbfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jbfpobpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocbakl32.dll"	Mgekbljc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pjmlbbdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inlekh32.dll"	Ecandfpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqfhilhd.dll"	Accfbokl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cenahpha.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gjlfbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohfjnoma.dll"	Ippggbck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ndqgbjkm.dll"	Jfhlejnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eoodnhmi.dll"	Epopgbia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbamkcqa.dll"	Hmdedo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpbbmhgf.dll"	Bdkcmdhp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 3840	3368	f1be5efbc065143f1ea1d192d61baa44972f47c818471d09c6a1d34c0954aa3c.exe	85
PID 3368 wrote to memory of 3840	3368	f1be5efbc065143f1ea1d192d61baa44972f47c818471d09c6a1d34c0954aa3c.exe	85
PID 3368 wrote to memory of 3840	3368	f1be5efbc065143f1ea1d192d61baa44972f47c818471d09c6a1d34c0954aa3c.exe	85
PID 3840 wrote to memory of 5104	3840	Coagla32.exe	86
PID 3840 wrote to memory of 5104	3840	Coagla32.exe	86
PID 3840 wrote to memory of 5104	3840	Coagla32.exe	86
PID 5104 wrote to memory of 2636	5104	Capchmmb.exe	87
PID 5104 wrote to memory of 2636	5104	Capchmmb.exe	87
PID 5104 wrote to memory of 2636	5104	Capchmmb.exe	87
PID 2636 wrote to memory of 3192	2636	Digkijmd.exe	88
PID 2636 wrote to memory of 3192	2636	Digkijmd.exe	88
PID 2636 wrote to memory of 3192	2636	Digkijmd.exe	88
PID 3192 wrote to memory of 4120	3192	Dlegeemh.exe	89
PID 3192 wrote to memory of 4120	3192	Dlegeemh.exe	89
PID 3192 wrote to memory of 4120	3192	Dlegeemh.exe	89
PID 4120 wrote to memory of 2204	4120	Doccaall.exe	90
PID 4120 wrote to memory of 2204	4120	Doccaall.exe	90
PID 4120 wrote to memory of 2204	4120	Doccaall.exe	90
PID 2204 wrote to memory of 4224	2204	Dabpnlkp.exe	91
PID 2204 wrote to memory of 4224	2204	Dabpnlkp.exe	91
PID 2204 wrote to memory of 4224	2204	Dabpnlkp.exe	91
PID 4224 wrote to memory of 4576	4224	Diihojkb.exe	92
PID 4224 wrote to memory of 4576	4224	Diihojkb.exe	92
PID 4224 wrote to memory of 4576	4224	Diihojkb.exe	92
PID 4576 wrote to memory of 2084	4576	Dlgdkeje.exe	93
PID 4576 wrote to memory of 2084	4576	Dlgdkeje.exe	93
PID 4576 wrote to memory of 2084	4576	Dlgdkeje.exe	93
PID 2084 wrote to memory of 1264	2084	Dofpgqji.exe	94
PID 2084 wrote to memory of 1264	2084	Dofpgqji.exe	94
PID 2084 wrote to memory of 1264	2084	Dofpgqji.exe	94
PID 1264 wrote to memory of 1652	1264	Dcalgo32.exe	95
PID 1264 wrote to memory of 1652	1264	Dcalgo32.exe	95
PID 1264 wrote to memory of 1652	1264	Dcalgo32.exe	95
PID 1652 wrote to memory of 1932	1652	Djlddi32.exe	96
PID 1652 wrote to memory of 1932	1652	Djlddi32.exe	96
PID 1652 wrote to memory of 1932	1652	Djlddi32.exe	96
PID 1932 wrote to memory of 4996	1932	Dhnepfpj.exe	97
PID 1932 wrote to memory of 4996	1932	Dhnepfpj.exe	97
PID 1932 wrote to memory of 4996	1932	Dhnepfpj.exe	97
PID 4996 wrote to memory of 3336	4996	Dohmlp32.exe	98
PID 4996 wrote to memory of 3336	4996	Dohmlp32.exe	98
PID 4996 wrote to memory of 3336	4996	Dohmlp32.exe	98
PID 3336 wrote to memory of 1920	3336	Dcdimopp.exe	99
PID 3336 wrote to memory of 1920	3336	Dcdimopp.exe	99
PID 3336 wrote to memory of 1920	3336	Dcdimopp.exe	99
PID 1920 wrote to memory of 1180	1920	Debeijoc.exe	100
PID 1920 wrote to memory of 1180	1920	Debeijoc.exe	100
PID 1920 wrote to memory of 1180	1920	Debeijoc.exe	100
PID 1180 wrote to memory of 3880	1180	Dhqaefng.exe	101
PID 1180 wrote to memory of 3880	1180	Dhqaefng.exe	101
PID 1180 wrote to memory of 3880	1180	Dhqaefng.exe	101
PID 3880 wrote to memory of 1632	3880	Dphifcoi.exe	102
PID 3880 wrote to memory of 1632	3880	Dphifcoi.exe	102
PID 3880 wrote to memory of 1632	3880	Dphifcoi.exe	102
PID 1632 wrote to memory of 2216	1632	Dcfebonm.exe	103
PID 1632 wrote to memory of 2216	1632	Dcfebonm.exe	103
PID 1632 wrote to memory of 2216	1632	Dcfebonm.exe	103
PID 2216 wrote to memory of 5028	2216	Dfdbojmq.exe	104
PID 2216 wrote to memory of 5028	2216	Dfdbojmq.exe	104
PID 2216 wrote to memory of 5028	2216	Dfdbojmq.exe	104
PID 5028 wrote to memory of 2856	5028	Dhcnke32.exe	105
PID 5028 wrote to memory of 2856	5028	Dhcnke32.exe	105
PID 5028 wrote to memory of 2856	5028	Dhcnke32.exe	105
PID 2856 wrote to memory of 4976	2856	Dlojkddn.exe	106

C:\Users\Admin\AppData\Local\Temp\f1be5efbc065143f1ea1d192d61baa44972f47c818471d09c6a1d34c0954aa3c.exe
"C:\Users\Admin\AppData\Local\Temp\f1be5efbc065143f1ea1d192d61baa44972f47c818471d09c6a1d34c0954aa3c.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\SysWOW64\Coagla32.exe
  C:\Windows\system32\Coagla32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Windows\SysWOW64\Capchmmb.exe
    C:\Windows\system32\Capchmmb.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Windows\SysWOW64\Digkijmd.exe
      C:\Windows\system32\Digkijmd.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2636
    - - C:\Windows\SysWOW64\Dlegeemh.exe
        
        C:\Windows\system32\Dlegeemh.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3192
      - C:\Windows\SysWOW64\Doccaall.exe
        
        C:\Windows\system32\Doccaall.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4120
        
        C:\Windows\SysWOW64\Dabpnlkp.exe
        
        C:\Windows\system32\Dabpnlkp.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2204
        
        C:\Windows\SysWOW64\Diihojkb.exe
        
        C:\Windows\system32\Diihojkb.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4224
        
        C:\Windows\SysWOW64\Dlgdkeje.exe
        
        C:\Windows\system32\Dlgdkeje.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4576
        
        C:\Windows\SysWOW64\Dofpgqji.exe
        
        C:\Windows\system32\Dofpgqji.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Windows\SysWOW64\Dcalgo32.exe
        
        C:\Windows\system32\Dcalgo32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1264
        
        C:\Windows\SysWOW64\Djlddi32.exe
        
        C:\Windows\system32\Djlddi32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\SysWOW64\Dhnepfpj.exe
        
        C:\Windows\system32\Dhnepfpj.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1932
        
        C:\Windows\SysWOW64\Dohmlp32.exe
        
        C:\Windows\system32\Dohmlp32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4996
        
        C:\Windows\SysWOW64\Dcdimopp.exe
        
        C:\Windows\system32\Dcdimopp.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3336
        
        C:\Windows\SysWOW64\Debeijoc.exe
        
        C:\Windows\system32\Debeijoc.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1920
        
        C:\Windows\SysWOW64\Dhqaefng.exe
        
        C:\Windows\system32\Dhqaefng.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1180
        
        C:\Windows\SysWOW64\Dphifcoi.exe
        
        C:\Windows\system32\Dphifcoi.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3880
        
        C:\Windows\SysWOW64\Dcfebonm.exe
        
        C:\Windows\system32\Dcfebonm.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Windows\SysWOW64\Dfdbojmq.exe
        
        C:\Windows\system32\Dfdbojmq.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2216
        
        C:\Windows\SysWOW64\Dhcnke32.exe
        
        C:\Windows\system32\Dhcnke32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\SysWOW64\Dlojkddn.exe
        
        C:\Windows\system32\Dlojkddn.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\SysWOW64\Domfgpca.exe
        
        C:\Windows\system32\Domfgpca.exe
        23⤵
        Executes dropped EXE
        
        PID:4976
        
        C:\Windows\SysWOW64\Dakbckbe.exe
        
        C:\Windows\system32\Dakbckbe.exe
        24⤵
        Executes dropped EXE
        
        PID:1592
        
        C:\Windows\SysWOW64\Ejbkehcg.exe
        
        C:\Windows\system32\Ejbkehcg.exe
        25⤵
        Executes dropped EXE
        
        PID:1884
        
        C:\Windows\SysWOW64\Elagacbk.exe
        
        C:\Windows\system32\Elagacbk.exe
        26⤵
        Executes dropped EXE
        
        PID:2276
        
        C:\Windows\SysWOW64\Eoocmoao.exe
        
        C:\Windows\system32\Eoocmoao.exe
        27⤵
        Executes dropped EXE
        
        PID:1628
        
        C:\Windows\SysWOW64\Ebnoikqb.exe
        
        C:\Windows\system32\Ebnoikqb.exe
        28⤵
        Executes dropped EXE
        
        PID:3752
        
        C:\Windows\SysWOW64\Efikji32.exe
        
        C:\Windows\system32\Efikji32.exe
        29⤵
        Executes dropped EXE
        
        PID:1112
        
        C:\Windows\SysWOW64\Ehhgfdho.exe
        
        C:\Windows\system32\Ehhgfdho.exe
        30⤵
        Executes dropped EXE
        
        PID:3084
        
        C:\Windows\SysWOW64\Epopgbia.exe
        
        C:\Windows\system32\Epopgbia.exe
        31⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3064
        
        C:\Windows\SysWOW64\Ecmlcmhe.exe
        
        C:\Windows\system32\Ecmlcmhe.exe
        32⤵
        Executes dropped EXE
        
        PID:4300
        
        C:\Windows\SysWOW64\Ebploj32.exe
        
        C:\Windows\system32\Ebploj32.exe
        33⤵
        Executes dropped EXE
        
        PID:3176
        
        C:\Windows\SysWOW64\Ejgdpg32.exe
        
        C:\Windows\system32\Ejgdpg32.exe
        34⤵
        Executes dropped EXE
        
        PID:1256
        
        C:\Windows\SysWOW64\Eodlho32.exe
        
        C:\Windows\system32\Eodlho32.exe
        35⤵
        Executes dropped EXE
        
        PID:3152
        
        C:\Windows\SysWOW64\Ebbidj32.exe
        
        C:\Windows\system32\Ebbidj32.exe
        36⤵
        Executes dropped EXE
        
        PID:4808
        
        C:\Windows\SysWOW64\Elhmablc.exe
        
        C:\Windows\system32\Elhmablc.exe
        37⤵
        Executes dropped EXE
        
        PID:5112
        
        C:\Windows\SysWOW64\Eofinnkf.exe
        
        C:\Windows\system32\Eofinnkf.exe
        38⤵
        Executes dropped EXE
        
        PID:2680
        
        C:\Windows\SysWOW64\Ejlmkgkl.exe
        
        C:\Windows\system32\Ejlmkgkl.exe
        39⤵
        Executes dropped EXE
        
        PID:3044
        
        C:\Windows\SysWOW64\Ehonfc32.exe
        
        C:\Windows\system32\Ehonfc32.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1816
        
        C:\Windows\SysWOW64\Eqfeha32.exe
        
        C:\Windows\system32\Eqfeha32.exe
        41⤵
        Executes dropped EXE
        
        PID:2384
        
        C:\Windows\SysWOW64\Ecdbdl32.exe
        
        C:\Windows\system32\Ecdbdl32.exe
        42⤵
        Executes dropped EXE
        
        PID:2284
        
        C:\Windows\SysWOW64\Fjnjqfij.exe
        
        C:\Windows\system32\Fjnjqfij.exe
        43⤵
        Executes dropped EXE
        
        PID:4540
        
        C:\Windows\SysWOW64\Fqhbmqqg.exe
        
        C:\Windows\system32\Fqhbmqqg.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:512
        
        C:\Windows\SysWOW64\Fcgoilpj.exe
        
        C:\Windows\system32\Fcgoilpj.exe
        45⤵
        Executes dropped EXE
        
        PID:4888
        
        C:\Windows\SysWOW64\Ffekegon.exe
        
        C:\Windows\system32\Ffekegon.exe
        46⤵
        Executes dropped EXE
        
        PID:3228
        
        C:\Windows\SysWOW64\Ficgacna.exe
        
        C:\Windows\system32\Ficgacna.exe
        47⤵
        Executes dropped EXE
        
        PID:5068
        
        C:\Windows\SysWOW64\Fqkocpod.exe
        
        C:\Windows\system32\Fqkocpod.exe
        48⤵
        Executes dropped EXE
        
        PID:1772
        
        C:\Windows\SysWOW64\Ffggkgmk.exe
        
        C:\Windows\system32\Ffggkgmk.exe
        49⤵
        Executes dropped EXE
        
        PID:4708
        
        C:\Windows\SysWOW64\Fjcclf32.exe
        
        C:\Windows\system32\Fjcclf32.exe
        50⤵
        Executes dropped EXE
        
        PID:2640
        
        C:\Windows\SysWOW64\Fckhdk32.exe
        
        C:\Windows\system32\Fckhdk32.exe
        51⤵
        Executes dropped EXE
        
        PID:4068
        
        C:\Windows\SysWOW64\Fbnhphbp.exe
        
        C:\Windows\system32\Fbnhphbp.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4004
        
        C:\Windows\SysWOW64\Fmclmabe.exe
        
        C:\Windows\system32\Fmclmabe.exe
        53⤵
        Executes dropped EXE
        
        PID:2732
        
        C:\Windows\SysWOW64\Fobiilai.exe
        
        C:\Windows\system32\Fobiilai.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3296
        
        C:\Windows\SysWOW64\Fbqefhpm.exe
        
        C:\Windows\system32\Fbqefhpm.exe
        55⤵
        Executes dropped EXE
        
        PID:2224
        
        C:\Windows\SysWOW64\Fjhmgeao.exe
        
        C:\Windows\system32\Fjhmgeao.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3036
        
        C:\Windows\SysWOW64\Fmficqpc.exe
        
        C:\Windows\system32\Fmficqpc.exe
        57⤵
        Executes dropped EXE
        
        PID:3704
        
        C:\Windows\SysWOW64\Gcpapkgp.exe
        
        C:\Windows\system32\Gcpapkgp.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:420
        
        C:\Windows\SysWOW64\Gbcakg32.exe
        
        C:\Windows\system32\Gbcakg32.exe
        59⤵
        Executes dropped EXE
        
        PID:2904
        
        C:\Windows\SysWOW64\Gjjjle32.exe
        
        C:\Windows\system32\Gjjjle32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1044
        
        C:\Windows\SysWOW64\Gmhfhp32.exe
        
        C:\Windows\system32\Gmhfhp32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4660
        
        C:\Windows\SysWOW64\Gqdbiofi.exe
        
        C:\Windows\system32\Gqdbiofi.exe
        62⤵
        Executes dropped EXE
        
        PID:4944
        
        C:\Windows\SysWOW64\Gcbnejem.exe
        
        C:\Windows\system32\Gcbnejem.exe
        63⤵
        Executes dropped EXE
        
        PID:3668
        
        C:\Windows\SysWOW64\Gjlfbd32.exe
        
        C:\Windows\system32\Gjlfbd32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3860
        
        C:\Windows\SysWOW64\Gmkbnp32.exe
        
        C:\Windows\system32\Gmkbnp32.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4648
        
        C:\Windows\SysWOW64\Gcekkjcj.exe
        
        C:\Windows\system32\Gcekkjcj.exe
        66⤵
        Executes dropped EXE
        
        PID:2948
        
        C:\Windows\SysWOW64\Gfcgge32.exe
        
        C:\Windows\system32\Gfcgge32.exe
        67⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\Giacca32.exe
        
        C:\Windows\system32\Giacca32.exe
        68⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\Gmmocpjk.exe
        
        C:\Windows\system32\Gmmocpjk.exe
        69⤵
        
        PID:444
        
        C:\Windows\SysWOW64\Gpklpkio.exe
        
        C:\Windows\system32\Gpklpkio.exe
        70⤵
        
        PID:660
        
        C:\Windows\SysWOW64\Gbjhlfhb.exe
        
        C:\Windows\system32\Gbjhlfhb.exe
        71⤵
        Modifies registry class
        
        PID:3536
        
        C:\Windows\SysWOW64\Gjapmdid.exe
        
        C:\Windows\system32\Gjapmdid.exe
        72⤵
        Modifies registry class
        
        PID:4464
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        73⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Gpnhekgl.exe
        
        C:\Windows\system32\Gpnhekgl.exe
        74⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Gbldaffp.exe
        
        C:\Windows\system32\Gbldaffp.exe
        75⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\Gjclbc32.exe
        
        C:\Windows\system32\Gjclbc32.exe
        76⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Gmaioo32.exe
        
        C:\Windows\system32\Gmaioo32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1600
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5064
        
        C:\Windows\SysWOW64\Hboagf32.exe
        
        C:\Windows\system32\Hboagf32.exe
        79⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Hjfihc32.exe
        
        C:\Windows\system32\Hjfihc32.exe
        80⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Hmdedo32.exe
        
        C:\Windows\system32\Hmdedo32.exe
        81⤵
        Modifies registry class
        
        PID:5212
        
        C:\Windows\SysWOW64\Hapaemll.exe
        
        C:\Windows\system32\Hapaemll.exe
        82⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Hbanme32.exe
        
        C:\Windows\system32\Hbanme32.exe
        83⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        84⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Hikfip32.exe
        
        C:\Windows\system32\Hikfip32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5384
        
        C:\Windows\SysWOW64\Habnjm32.exe
        
        C:\Windows\system32\Habnjm32.exe
        86⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Hfofbd32.exe
        
        C:\Windows\system32\Hfofbd32.exe
        87⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Hbeghene.exe
        
        C:\Windows\system32\Hbeghene.exe
        88⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Hjmoibog.exe
        
        C:\Windows\system32\Hjmoibog.exe
        89⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Hippdo32.exe
        
        C:\Windows\system32\Hippdo32.exe
        90⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        91⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5708
        
        C:\Windows\SysWOW64\Ipldfi32.exe
        
        C:\Windows\system32\Ipldfi32.exe
        93⤵
        Modifies registry class
        
        PID:5752
        
        C:\Windows\SysWOW64\Iffmccbi.exe
        
        C:\Windows\system32\Iffmccbi.exe
        94⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        95⤵
        Modifies registry class
        
        PID:5840
        
        C:\Windows\SysWOW64\Iakaql32.exe
        
        C:\Windows\system32\Iakaql32.exe
        96⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Icjmmg32.exe
        
        C:\Windows\system32\Icjmmg32.exe
        97⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        98⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Ifjfnb32.exe
        
        C:\Windows\system32\Ifjfnb32.exe
        99⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Iiibkn32.exe
        
        C:\Windows\system32\Iiibkn32.exe
        100⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Idofhfmm.exe
        
        C:\Windows\system32\Idofhfmm.exe
        101⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        102⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        103⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Imgkql32.exe
        
        C:\Windows\system32\Imgkql32.exe
        104⤵
        Drops file in System32 directory
        
        PID:5308
        
        C:\Windows\SysWOW64\Ipegmg32.exe
        
        C:\Windows\system32\Ipegmg32.exe
        105⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Idacmfkj.exe
        
        C:\Windows\system32\Idacmfkj.exe
        106⤵
        Drops file in System32 directory
        
        PID:5444
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        107⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Imihfl32.exe
        
        C:\Windows\system32\Imihfl32.exe
        108⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Jpgdbg32.exe
        
        C:\Windows\system32\Jpgdbg32.exe
        109⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Jbfpobpb.exe
        
        C:\Windows\system32\Jbfpobpb.exe
        110⤵
        Modifies registry class
        
        PID:5740
        
        C:\Windows\SysWOW64\Jiphkm32.exe
        
        C:\Windows\system32\Jiphkm32.exe
        111⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        112⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        113⤵
        Drops file in System32 directory
        
        PID:5960
        
        C:\Windows\SysWOW64\Jplmmfmi.exe
        
        C:\Windows\system32\Jplmmfmi.exe
        114⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Jjbako32.exe
        
        C:\Windows\system32\Jjbako32.exe
        115⤵
        Modifies registry class
        
        PID:1996
        
        C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        116⤵
        Modifies registry class
        
        PID:5200
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        117⤵
        Drops file in System32 directory
        
        PID:5288
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        118⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        119⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5688
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        121⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5904
        
        C:\Windows\SysWOW64\Jiikak32.exe
        
        C:\Windows\system32\Jiikak32.exe
        123⤵
        Modifies registry class
        
        PID:6084
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5164
        
        C:\Windows\SysWOW64\Kpccnefa.exe
        
        C:\Windows\system32\Kpccnefa.exe
        125⤵
        Modifies registry class
        
        PID:5380
        
        C:\Windows\SysWOW64\Kgmlkp32.exe
        
        C:\Windows\system32\Kgmlkp32.exe
        126⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        127⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Kacphh32.exe
        
        C:\Windows\system32\Kacphh32.exe
        128⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        129⤵
        Drops file in System32 directory
        
        PID:5152
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        130⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5744
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        132⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5460
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        134⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        135⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Kkpnlm32.exe
        
        C:\Windows\system32\Kkpnlm32.exe
        136⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        137⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Kdhbec32.exe
        
        C:\Windows\system32\Kdhbec32.exe
        138⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        139⤵
        Drops file in System32 directory
        
        PID:6248
        
        C:\Windows\SysWOW64\Lgikfn32.exe
        
        C:\Windows\system32\Lgikfn32.exe
        140⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6292
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        141⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        142⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Lpappc32.exe
        
        C:\Windows\system32\Lpappc32.exe
        143⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        144⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        145⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        146⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Lpcmec32.exe
        
        C:\Windows\system32\Lpcmec32.exe
        147⤵
        Modifies registry class
        
        PID:6584
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        148⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        149⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        150⤵
        Drops file in System32 directory
        
        PID:6716
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        151⤵
        Modifies registry class
        
        PID:6760
        
        C:\Windows\SysWOW64\Laefdf32.exe
        
        C:\Windows\system32\Laefdf32.exe
        152⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        153⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Mnlfigcc.exe
        
        C:\Windows\system32\Mnlfigcc.exe
        154⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Mahbje32.exe
        
        C:\Windows\system32\Mahbje32.exe
        155⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        156⤵
        Modifies registry class
        
        PID:6988
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        157⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Majopeii.exe
        
        C:\Windows\system32\Majopeii.exe
        158⤵
        Modifies registry class
        
        PID:7068
        
        C:\Windows\SysWOW64\Mdiklqhm.exe
        
        C:\Windows\system32\Mdiklqhm.exe
        159⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        160⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        161⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Mpolqa32.exe
        
        C:\Windows\system32\Mpolqa32.exe
        162⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6236
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        163⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        164⤵
        Modifies registry class
        
        PID:6408
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        165⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        166⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Mglack32.exe
        
        C:\Windows\system32\Mglack32.exe
        167⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        168⤵
        Drops file in System32 directory
        
        PID:6648
        
        C:\Windows\SysWOW64\Mnfipekh.exe
        
        C:\Windows\system32\Mnfipekh.exe
        169⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        170⤵
        Drops file in System32 directory
        
        PID:6788
        
        C:\Windows\SysWOW64\Mcbahlip.exe
        
        C:\Windows\system32\Mcbahlip.exe
        171⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        172⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        173⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        174⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Nklfoi32.exe
        
        C:\Windows\system32\Nklfoi32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7112
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        176⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        177⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6364
        
        C:\Windows\SysWOW64\Ndghmo32.exe
        
        C:\Windows\system32\Ndghmo32.exe
        179⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        180⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Njcpee32.exe
        
        C:\Windows\system32\Njcpee32.exe
        181⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        182⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Njfmke32.exe
        
        C:\Windows\system32\Njfmke32.exe
        183⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        184⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Ndkahnhh.exe
        
        C:\Windows\system32\Ndkahnhh.exe
        185⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        186⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        187⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Ocqnij32.exe
        
        C:\Windows\system32\Ocqnij32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6576
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        189⤵
        Modifies registry class
        
        PID:6784
        
        C:\Windows\SysWOW64\Onfbfc32.exe
        
        C:\Windows\system32\Onfbfc32.exe
        190⤵
        Drops file in System32 directory
        
        PID:6860
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        191⤵
        Modifies registry class
        
        PID:7100
        
        C:\Windows\SysWOW64\Odpjcm32.exe
        
        C:\Windows\system32\Odpjcm32.exe
        192⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        193⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6892
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        195⤵
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Oqgkhnjf.exe
        
        C:\Windows\system32\Oqgkhnjf.exe
        196⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        197⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Ogaceh32.exe
        
        C:\Windows\system32\Ogaceh32.exe
        198⤵
        Drops file in System32 directory
        
        PID:6228
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        199⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        200⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Ojalgcnd.exe
        
        C:\Windows\system32\Ojalgcnd.exe
        201⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        202⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        203⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        204⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        205⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        206⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        207⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Peljol32.exe
        
        C:\Windows\system32\Peljol32.exe
        208⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Pgjfkg32.exe
        
        C:\Windows\system32\Pgjfkg32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7592
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        210⤵
        Modifies registry class
        
        PID:7636
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        211⤵
        Modifies registry class
        
        PID:7676
        
        C:\Windows\SysWOW64\Pabkdmpi.exe
        
        C:\Windows\system32\Pabkdmpi.exe
        212⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        213⤵
        Drops file in System32 directory
        
        PID:7764
        
        C:\Windows\SysWOW64\Pgmcqggf.exe
        
        C:\Windows\system32\Pgmcqggf.exe
        214⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Pnfkma32.exe
        
        C:\Windows\system32\Pnfkma32.exe
        215⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        216⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        217⤵
        Modifies registry class
        
        PID:7932
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        218⤵
        Drops file in System32 directory
        
        PID:7972
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        219⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8060
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        221⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8148
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        223⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Ajdbcano.exe
        
        C:\Windows\system32\Ajdbcano.exe
        224⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        225⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        226⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        227⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        228⤵
        Modifies registry class
        
        PID:7504
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        229⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        230⤵
        Drops file in System32 directory
        
        PID:7632
        
        C:\Windows\SysWOW64\Alfkbc32.exe
        
        C:\Windows\system32\Alfkbc32.exe
        231⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        232⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7840
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7968
        
        C:\Windows\SysWOW64\Alhhhcal.exe
        
        C:\Windows\system32\Alhhhcal.exe
        235⤵
        Drops file in System32 directory
        
        PID:7960
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        236⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\Aaepqjpd.exe
        
        C:\Windows\system32\Aaepqjpd.exe
        237⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        238⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        239⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        240⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        241⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Becifhfj.exe
        
        C:\Windows\system32\Becifhfj.exe
        242⤵
        Drops file in System32 directory
        
        PID:7412
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        243⤵
        Modifies registry class
        
        PID:7456
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        244⤵
        Drops file in System32 directory
        
        PID:7584
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        245⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7812
        
        C:\Windows\SysWOW64\Blpnib32.exe
        
        C:\Windows\system32\Blpnib32.exe
        247⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        248⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Bdkcmdhp.exe
        
        C:\Windows\system32\Bdkcmdhp.exe
        249⤵
        Modifies registry class
        
        PID:4932
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        250⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        251⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        252⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        253⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        254⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        255⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        256⤵
        Modifies registry class
        
        PID:4164
        
        C:\Windows\SysWOW64\Bemlmgnp.exe
        
        C:\Windows\system32\Bemlmgnp.exe
        257⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        258⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Bkidenlg.exe
        
        C:\Windows\system32\Bkidenlg.exe
        259⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        260⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        261⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        262⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Cogmkl32.exe
        
        C:\Windows\system32\Cogmkl32.exe
        263⤵
        Drops file in System32 directory
        
        PID:6928
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        264⤵
        Modifies registry class
        
        PID:7728
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        265⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Chpada32.exe
        
        C:\Windows\system32\Chpada32.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7240
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        267⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        268⤵
        Drops file in System32 directory
        
        PID:8276
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        269⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Chbnia32.exe
        
        C:\Windows\system32\Chbnia32.exe
        270⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        271⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8452
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        273⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Cbjoljdo.exe
        
        C:\Windows\system32\Cbjoljdo.exe
        274⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Chghdqbf.exe
        
        C:\Windows\system32\Chghdqbf.exe
        275⤵
        Drops file in System32 directory
        
        PID:8576
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        276⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Ddmhja32.exe
        
        C:\Windows\system32\Ddmhja32.exe
        277⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        278⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        279⤵
        Modifies registry class
        
        PID:8752
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        280⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        281⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        282⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        283⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        284⤵
        Modifies registry class
        
        PID:8980
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        285⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        286⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        287⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        288⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        289⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Dlncan32.exe
        
        C:\Windows\system32\Dlncan32.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8232
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        291⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Eefhjc32.exe
        
        C:\Windows\system32\Eefhjc32.exe
        292⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        293⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        294⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        295⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Edkdkplj.exe
        
        C:\Windows\system32\Edkdkplj.exe
        296⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        297⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        298⤵
        Drops file in System32 directory
        
        PID:8784
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        299⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Ehimanbq.exe
        
        C:\Windows\system32\Ehimanbq.exe
        300⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        301⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        302⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9056
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        303⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        304⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Ecandfpd.exe
        
        C:\Windows\system32\Ecandfpd.exe
        305⤵
        Modifies registry class
        
        PID:8264
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        306⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        307⤵
        Modifies registry class
        
        PID:8484
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        308⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8696
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        310⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8792
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        311⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        312⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        313⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        314⤵
        Modifies registry class
        
        PID:8224
        
        C:\Windows\SysWOW64\Fchddejl.exe
        
        C:\Windows\system32\Fchddejl.exe
        315⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        316⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        317⤵
        Modifies registry class
        
        PID:8692
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        318⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        319⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        320⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        321⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        322⤵
        Drops file in System32 directory
        
        PID:8524
        
        C:\Windows\SysWOW64\Fcmnpe32.exe
        
        C:\Windows\system32\Fcmnpe32.exe
        323⤵
        Modifies registry class
        
        PID:8884
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9176
        
        C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        325⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        326⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        327⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        328⤵
        Drops file in System32 directory
        
        PID:8420
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        329⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        330⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        331⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        332⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9336
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        333⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        334⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        335⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        336⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        337⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        338⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        339⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Gfembo32.exe
        
        C:\Windows\system32\Gfembo32.exe
        340⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        341⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        342⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        343⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        344⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        345⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        346⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        347⤵
        Drops file in System32 directory
        
        PID:9968
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        348⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        349⤵
        Drops file in System32 directory
        
        PID:10052
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        350⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        351⤵
        Modifies registry class
        
        PID:10144
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        352⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        353⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        354⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        355⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        356⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        357⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        358⤵
        Drops file in System32 directory
        
        PID:9516
        
        C:\Windows\SysWOW64\Hbgmcnhf.exe
        
        C:\Windows\system32\Hbgmcnhf.exe
        359⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        360⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        361⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        362⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        363⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        364⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        365⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        366⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        367⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        368⤵
        Modifies registry class
        
        PID:10188
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        369⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8964
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        370⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        371⤵
        Drops file in System32 directory
        
        PID:9412
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        372⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        373⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        374⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        375⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        376⤵
        Drops file in System32 directory
        
        PID:9952
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        377⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10168
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        379⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        380⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        381⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        382⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        383⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        384⤵
        Drops file in System32 directory
        
        PID:10140
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        385⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        386⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9540
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        387⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10220
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        389⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        390⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        391⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        392⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        393⤵
        Modifies registry class
        
        PID:10252
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        394⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        395⤵
        Modifies registry class
        
        PID:10336
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        396⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        397⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        398⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        399⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        400⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        401⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        402⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        403⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10672
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        404⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        405⤵
        Modifies registry class
        
        PID:10752
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        406⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Kedoge32.exe
        
        C:\Windows\system32\Kedoge32.exe
        407⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        408⤵
        Drops file in System32 directory
        
        PID:10876
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        409⤵
        Drops file in System32 directory
        
        PID:10916
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        410⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        411⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        412⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        413⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        414⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        415⤵
        Drops file in System32 directory
        
        PID:11160
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        416⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        417⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        418⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        419⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        420⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        421⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        422⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        423⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10564
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        424⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10660
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        425⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10728
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        426⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        427⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        428⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        429⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        430⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        431⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        432⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        433⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        434⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        435⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        436⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        437⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        438⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10768
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        439⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        440⤵
        Modifies registry class
        
        PID:11016
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        441⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        442⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        443⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        444⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        445⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        446⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        447⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        448⤵
        Modifies registry class
        
        PID:11244
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        449⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        450⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        451⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        452⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        453⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        454⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10396
        
        C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        455⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        456⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11268
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        457⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        458⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        459⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11388
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        460⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        461⤵
        
        PID:11476
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        462⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        463⤵
        Drops file in System32 directory
        
        PID:11556
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        464⤵
        Drops file in System32 directory
        
        PID:11592
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        465⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        466⤵
        Drops file in System32 directory
        
        PID:11676
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        467⤵
        Drops file in System32 directory
        
        PID:11716
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        468⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        469⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11796
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        470⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        471⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        472⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        473⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        474⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        475⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        476⤵
        
        PID:12096
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12132
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        478⤵
        Modifies registry class
        
        PID:12176
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        479⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        480⤵
        
        PID:12264
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        481⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        482⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11356
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        483⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11404
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        484⤵
        
        PID:11460
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        485⤵
        
        PID:11540
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        486⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11620
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        487⤵
        
        PID:11684
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        488⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        489⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11816
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        490⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        491⤵
        
        PID:11964
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        492⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        493⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12080
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        494⤵
        Drops file in System32 directory
        
        PID:12164
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        495⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        496⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        497⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        498⤵
        
        PID:11464
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        499⤵
        Drops file in System32 directory
        
        PID:11600
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        500⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        501⤵
        
        PID:11808
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        502⤵
        
        PID:11920
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        503⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        504⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        505⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12236
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        506⤵
        Drops file in System32 directory
        
        PID:11340
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        507⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11532
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        508⤵
        
        PID:11688
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        509⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        510⤵
        Modifies registry class
        
        PID:11856
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        511⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        512⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11456
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        513⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        514⤵
        
        PID:11992
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        515⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        516⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        517⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        518⤵
        Drops file in System32 directory
        
        PID:12064
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        519⤵
        
        PID:11336
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        520⤵
        
        PID:12316
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        521⤵
        
        PID:12364
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        522⤵
        
        PID:12404
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        523⤵
        
        PID:12440
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        524⤵
        
        PID:12492
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        525⤵
        Modifies registry class
        
        PID:12528
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        526⤵
        Modifies registry class
        
        PID:12568
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        527⤵
        
        PID:12604
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        528⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        529⤵
        
        PID:12676
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        530⤵
        
        PID:12712
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        531⤵
        
        PID:12748
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        532⤵
        Modifies registry class
        
        PID:12784
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        533⤵
        
        PID:12820
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        534⤵
        Drops file in System32 directory
        
        PID:12856
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        535⤵
        Drops file in System32 directory
        
        PID:12892
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        536⤵
        
        PID:12928
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        537⤵
        
        PID:12964
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        538⤵
        
        PID:13000
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        539⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13036
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        540⤵
        
        PID:13072
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        541⤵
        Drops file in System32 directory
        
        PID:13108
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        542⤵
        
        PID:13144
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        543⤵
        
        PID:13180
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        544⤵
        
        PID:13216
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        545⤵
        
        PID:13252
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        546⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13292
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        547⤵
        
        PID:11864
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        548⤵
        
        PID:12332
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        549⤵
        Drops file in System32 directory
        
        PID:12396
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        550⤵
        
        PID:12456
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        551⤵
        
        PID:12516
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        552⤵
        
        PID:12592
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        553⤵
        Modifies registry class
        
        PID:12648
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        554⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12704
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        555⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12772
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        556⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12864
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        557⤵
        Modifies registry class
        
        PID:12912
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        558⤵
        
        PID:12980
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        559⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13044
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        560⤵
        
        PID:13100
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        561⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13168
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        562⤵
        
        PID:13248
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        563⤵
        Modifies registry class
        
        PID:13288
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        564⤵
        
        PID:12324
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        565⤵
        
        PID:12436
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        566⤵
        
        PID:12560
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        567⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        568⤵
        Modifies registry class
        
        PID:12780
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        569⤵
        
        PID:12924
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        570⤵
        
        PID:13028
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        571⤵
        
        PID:13140
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        572⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        573⤵
        
        PID:12372
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        574⤵
        
        PID:12588
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        575⤵
        
        PID:12768
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        576⤵
        
        PID:13020
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        577⤵
        
        PID:13244
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        578⤵
        Drops file in System32 directory
        
        PID:12488
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        579⤵
        
        PID:12972
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        580⤵
        Drops file in System32 directory
        
        PID:13280
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        581⤵
        Modifies registry class
        
        PID:12632
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        582⤵
        
        PID:12816
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        583⤵
        
        PID:13320
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        584⤵
        
        PID:13356
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        585⤵
        
        PID:13392
        
        C:\Windows\SysWOW64\Dobfld32.exe
        
        C:\Windows\system32\Dobfld32.exe
        586⤵
        
        PID:13428
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        587⤵
        
        PID:13464
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        588⤵
        
        PID:13500
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        589⤵
        
        PID:13536
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        590⤵
        
        PID:13572
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        591⤵
        
        PID:13608
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        592⤵
        
        PID:13644
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        593⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13680
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        594⤵
        
        PID:13716
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        595⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13752
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        596⤵
        
        PID:13792
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        597⤵
        
        PID:13828
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        598⤵
        Drops file in System32 directory
        
        PID:13864
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        599⤵
        
        PID:13900
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        600⤵
        Drops file in System32 directory
        
        PID:13940
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        601⤵
        
        PID:13980
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        602⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14024
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        603⤵
        
        PID:14072
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14072 -s 236
        604⤵
        Program crash
        
        PID:14116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 14072 -ip 14072
1⤵
PID:14092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Agoabn32.exe

Filesize
71KB

MD5
24cc3dd881fcc7b2ed19541300dd4b13

SHA1
50931ec6f01bcbb974169e11910143781dbdddcc

SHA256
91b1e3dda345f2bd6c71ea9473dfe9f4ec46a558a1806b9b2155915a1a9b1af2

SHA512
2d28917429636a4598f4cc9a45abdf88e5795ab4de3081d1c8e4d03d8a7585a8105f4071c56bb4295197f9a309c67c171ec5546b6ed8e46eb6b2a25d5c2d8241

Download Submit
C:\Windows\SysWOW64\Bagflcje.exe

Filesize
71KB

MD5
ffa033d74d9d0cb5c64a19055df5df32

SHA1
85037ebe7fb6091b5aecca82c52d873be2bfabbf

SHA256
9a9f79d03d7ab92eaa1222a08362f3f2de4df8d15badef3c67825ffdbe5b435f

SHA512
dc8f6a93aee63941fb54ded3ff9f2e8980b5a9c0e4e2abfea44f3046c1a07366ab327d17113b99743bc364d3554a3b202f3641dfd17b6eb3b0b3f8bea1711692

Download Submit
C:\Windows\SysWOW64\Bamagp32.dll

Filesize
7KB

MD5
240c167706a9bcbaede405ce924979aa

SHA1
ae96a777b796dc948e0e6a7a0178e8f2cb766606

SHA256
bf5167f12eed3d8e85e1e6304470395cace50475faa71031adb62c302accc4ce

SHA512
2036af1d3555b1a350ef695d0dc8550aa161e7371420b50651ae4a32d90fe1d68500ab4c569c5be99003460a582e9e181aaed6ef66aa1f612a7b608f4c02e819

Download Submit
C:\Windows\SysWOW64\Capchmmb.exe

Filesize
71KB

MD5
6c57d2bc7a729e928b8f1d2a56fafc11

SHA1
fc5ebab6b34b0edb5e34f55e5ef5e539392afea6

SHA256
18c4b7320bb772584ecab686259d46d27405eb1714ca6a8bc20bffa2949754d1

SHA512
1c401c412868c323aea3062501e6b251872164d3032db77062f37716cee5b86227a7adfde3fa9247a8249763c7dee1603ece5ab2ab251dae9985bee4f610790d

Download Submit
C:\Windows\SysWOW64\Cmnpgb32.exe

Filesize
71KB

MD5
b5902bda17fbf159491f1da8ad8e0ba4

SHA1
06bae14970aeb99e181b0d6619b62c010c167940

SHA256
b35239c62b7377fb5f17ed29fb968dd712906f46ec975098f6642dd8c3339b58

SHA512
81553efd189bb02f58137273acf7aa0c74dffc6595de4e7d595e77bace7a3c8d2df6f4b23c147a5dc93a17c60267f986330054192c3bb9ff23c3c5e0d53ec7f6

Download Submit
C:\Windows\SysWOW64\Coagla32.exe

Filesize
71KB

MD5
6419d1534d9b435eb10a2762a2160c7d

SHA1
a9287a43ea2b6e5308c7b743d88bda16902f25ef

SHA256
257684c21458d75838d93a81b4ba0ed527c273444e4060fb11e4ddc355cbefd0

SHA512
88f0339ab5d2b7be48495475b61d0dba3356cf57337d96e0881a8ed75a09756e741dd18060e0c8ed8dcd62a937281e226a2acee9890e1452b876a2ba4f7b639c

Download Submit
C:\Windows\SysWOW64\Dabpnlkp.exe

Filesize
71KB

MD5
9978f26e19b200481e4c7c405134139d

SHA1
726994758d71feac1e0671bde87c6c81a90eec2b

SHA256
c01f18a72493328482f5260a5afbdfe01120afd657ba1cdee308b85893497522

SHA512
87e6f63b030f0b6a1bc340385f97e75d193c13dabc31657fbdae8eddf007ed977d8f7a530c5292c5391547931c6d6e19bd4e39a5feeac54942d516dcc8827c18

Download Submit
C:\Windows\SysWOW64\Dakbckbe.exe

Filesize
71KB

MD5
d74ea41e90f04b311ef582f0e0725caa

SHA1
41d2106a6b8f509b9f2f895409afed2663302481

SHA256
2eb674381e646525529ad0cc9566cfd7aa9b4f6281146c4756137203ddc6610b

SHA512
912989fe60515bb22e0dd3ae4de9ff253bfeaa4f24772bc6af8dd42fdc4cc0c306a6a8e7e568fb3aec08c65fb748d587be8785d769be437719f6e9acae9a8019

Download Submit
C:\Windows\SysWOW64\Dcalgo32.exe

Filesize
71KB

MD5
528b6554c25bb5fb31942d2fc7dbed16

SHA1
5f99fd11b20fd25b53eac50d03bd60d435ba95e8

SHA256
cee6372397c4bcdc7d28573881baae5922d65e0ef07f3907a291d13d8be314ec

SHA512
bdeea79472b9b1b1f25dd7589ec6e048cc4c04c45a9be54089371e72ca3534ddac846aafb09bc3c49249c4ec8d30aae6b6777e8649274b1cc901471ce42d71ba

Download Submit
C:\Windows\SysWOW64\Dcdimopp.exe

Filesize
71KB

MD5
5bdcc2786972ccf5d28a223721fb26f0

SHA1
f6fb19cd9cf05cf41eec57731d082673cac4cc1f

SHA256
54ddfd560362015206249e1be8189891e96a1bd01649f7b122017d9e1e2c3f2c

SHA512
fbffda0e913714b690ff3dcf3add924465c2b30830940c0cbbfca8495b072dc6a1deb5f513cd8d062c28b8ae77dc01fe1ef1d8af70809d6fd376a614cab8cfcf

Download Submit
C:\Windows\SysWOW64\Dcfebonm.exe

Filesize
71KB

MD5
e821131c78134a9cf1dbf31bf67562c7

SHA1
a61830c29a8d7a7db465a98962302b5778608d1b

SHA256
e35bf5608ccdbbbbc5c9c7755868781f6b4021649fe0e449b8b92c9a9fdb79dc

SHA512
be3e7d96388fb80ab40cd69f190d6ee6700dd70ef0efe91cba7e749371ce6dc1c24bb18e46da091154c985598936de49e7378498294bace67611c4ee571d4b5f

Download Submit
C:\Windows\SysWOW64\Debeijoc.exe

Filesize
71KB

MD5
fce87cd2afb79d8c577d50705cc0f639

SHA1
20fbbdc4ce671cf1eb813913b00b236092418ea0

SHA256
e168f1c7e0200a5f83e473419100cee5efe7bc6efd902cd444fa4bbdb5a08184

SHA512
eb6a8e6889ef2439e7d073de783177e737cefb8d24384a45972ce73da24b25539a7b0369d3cdd9a0b301bd59761acdf82a21ad2e0d0a8afb9da306a1f84d5ec3

Download Submit
C:\Windows\SysWOW64\Deokon32.exe

Filesize
71KB

MD5
fdc766edde550e0950693ecdbeb90d82

SHA1
eeff6bfb5760d170fdd20d6a2aaa045df47770c0

SHA256
2611f4a95e91ac75ac5f3ed71ef0118b45ab34699aa96840e11c34865acc4e9c

SHA512
2534f6b86846887b57e1a90e963818ce9f19f018142a8e7273fa08e4c9664efc766397ad5c0e36fb67d7160091bf0604723be341548c0a8e2fdbbb8b0ecc032e

Download Submit
C:\Windows\SysWOW64\Dfdbojmq.exe

Filesize
71KB

MD5
3c9023bc2227943bd0bab05c80675658

SHA1
a0f21f4bae84a8f2a781b9ba0f0d181e2fa18098

SHA256
3e513a751d34dd851ba32333e77a5e695663d489c1f9cac725b30cb865748838

SHA512
f5ae832327a6966cbc35e51179ffb4ea6b5b3ac3f155f9b5ec5a56aa7653c3104cc22e76131812d08e4e70669d1c984ac65d30573fad90e0caf0a7c481d64f0f

Download Submit
C:\Windows\SysWOW64\Dhcnke32.exe

Filesize
71KB

MD5
82e854adeebdf9955dccb834e08cd2b9

SHA1
1e8a6d379176772ee7cb6fccc709894973b05379

SHA256
00358a0012a7e9d6eda4a4802fd36207645b352c977ca96f871ecb7d91d26bfe

SHA512
5bb9d0733c4286d5039f26591ef884115287212a45ffe11f6bdbff6d172706d8724636524f5e956139fc87d7abb555aa913f81ec73e14e1e2f4a45c424b45df9

Download Submit
C:\Windows\SysWOW64\Dhkjej32.exe

Filesize
71KB

MD5
b7bb25df0724af7fbfe5f087364cc84d

SHA1
5857adaeda1dcdac55c92d27965302aa64dcf17d

SHA256
fc69035534b6671b6eb2775e9a8ddb34b6f7496247e6b21b779db1ff15595071

SHA512
d8183c48cff458f4f3e96fa5e67e9950ed0d4071e80a0041453286fef5955015b2114419cd855e517cd685dc8178b920be138b48663d43630a00563cab309c3e

Download Submit
C:\Windows\SysWOW64\Dhnepfpj.exe

Filesize
71KB

MD5
e40e5603d6aecd0ea8e8a35eba7cbeee

SHA1
619e3e653882f6a288d309435f67ba0aec2cb808

SHA256
660068189c19ddb761eeeacbb4ac4a243c5857aceaa912fa16503a475cd8b424

SHA512
2a447a156c535b70c2d2213a078633d0ba75db2223fb11507d3b46329b04ca35b1556a095f57718f9edf18b0060529abe690732079de5b259d74bf73d4fc04bb

Download Submit
C:\Windows\SysWOW64\Dhqaefng.exe

Filesize
71KB

MD5
e6f42291cfec83761cecafd910b3a86f

SHA1
81cecf92e1e0efcefeca2a519dd41024623d2f0e

SHA256
b334abddd24aa4c1dbaa09a9e9859369933750612267960d4fad93d47697f271

SHA512
18c391ef0caa37b3132bdeb23206dd6a40eae08343f76869281cda6e7e18e29ace806dee931001d9ff29950264d1309ca48614de967761db6a314978e42b745f

Download Submit
C:\Windows\SysWOW64\Digkijmd.exe

Filesize
71KB

MD5
aa22eab65c5c734a039a830076f37b17

SHA1
ae511d7780ea6426412e399dfb1450ddfb26aae0

SHA256
a9557e0f8220e120e5eac18c6f9eb0aa4707b9782dca959739447716e61dce1a

SHA512
602b4417a874ea09fad5d9b8698953684ffbc26605e190e01090debf27c2d553efd46536679e0db6c09ddcbf7e96d24982e33af668e0619f7fd7f29d9db7c106

Download Submit
C:\Windows\SysWOW64\Diihojkb.exe

Filesize
71KB

MD5
75c92864173c5ab36d79058bc2e78c60

SHA1
0a3dc01fbbfc1f3bdc319cd4da436f04c4b8c9ff

SHA256
9e9a546a9b94409d81a9ed1106f36683c117d3b9da887442a2dbf5a89dc374bd

SHA512
689a5d90ece3e14f6ff91125a31abfab59711b378b8d2169f0cc83c1a7669925b19ba45ac603d2a306f791fc6609d57aa1952ef356384df1f7d791ed2e95f9fc

Download Submit
C:\Windows\SysWOW64\Djdmffnn.exe

Filesize
71KB

MD5
2dcfd2bfe988c1a37f4e973a5ac7ecaa

SHA1
693fe0c5900841933f6a45595a877c571f35be1a

SHA256
9db11bd234cb6c2b0dd2a85813802a962b9c4e652d3aa102d59d49b8458190a5

SHA512
3201c727c3831c7a56848e86b3668d0f06d30f924bad5332133afc3f7289b87327bb1dfd68957c47e484581d1877acb775e001294e6d30c49234cfb81bafe69e

Download Submit
C:\Windows\SysWOW64\Djlddi32.exe

Filesize
71KB

MD5
d102e96b66c092df15f38d6058b87402

SHA1
c3dd587285f2904ac906280da6e2a4296dbbada1

SHA256
dc8e94ae7ce049bc3dd6cd73b185afd213a5f47ece7fd36c62afc26d053567d2

SHA512
63a13961fae80a9f74a603710827ccb92dfefd15902c30754d2d944143972239598dbba77d9ee858baa4b7c49ceebd1b50b498e6d317363b54450cd493acfc1a

Download Submit
C:\Windows\SysWOW64\Dlegeemh.exe

Filesize
71KB

MD5
648b31becc92c9fb344524d50fb721ac

SHA1
26319a8c2e34c8a948d4caf2824eee78eaac37e4

SHA256
ea7698e7a3da158905cecd90104637b2ba4d2e0f9a4f67b6d2e075f1b5b81623

SHA512
8ff0a7fd050c398162f71a3a156930e4caf493d9930a0f11b1b0d5ed42a596610308ef4c4da243967122aee7bb039ecbe61f2f23776cd12ced1e7d5045bac688

Download Submit
C:\Windows\SysWOW64\Dlgdkeje.exe

Filesize
71KB

MD5
de54bc4aff44b353d3b71523e3cf9c06

SHA1
1d4429726519ab51f143988b0a4e143629139c6e

SHA256
681ee5334a80c9c7bc52370c8b7fe1f1f5d445aa64c0f5ce352299432e96d4e6

SHA512
7a41343b660f86f500111bec79d08a818361823e249528e006b10eddbd275e266f1494c1914c941d0eb3b29594cb9637ba856da0b4445bca4839bffd59ccbb14

Download Submit
C:\Windows\SysWOW64\Dlojkddn.exe

Filesize
71KB

MD5
fce1a10fc2258ac19fd8498bdbc095da

SHA1
7ce98d17b38c939ad2ee9f6e4889f42831929cb7

SHA256
772afb6684b91ad809eeb107196df2afb108e10fabade0384ccf8d7564b0eb04

SHA512
61adb0fa9c9377e3e4bc708e0ff0432b9110462b6e0ee5e6ffab4ca515a70b416828d40329644752b1fff53d62fcc62739751fd6cb9e866e9e9c58280ca07463

Download Submit
C:\Windows\SysWOW64\Doccaall.exe

Filesize
71KB

MD5
bcd5bbce58b67e6db162ac3a2a89c447

SHA1
080f3a7aee9fb1d3e3fa35a003a4120c142639bc

SHA256
5bd68b0fcd7ff3eba7d65c68bfb33630ae35820849775ca76a988a3b63ee2c82

SHA512
8d404f22385236981cab49e6c8c85db0ea5cda9113b7d9d01da02a1b3b5e845940c88ad26b370a30e8546e00ca0825c318a1b8c69f33377d8c6f3a4407285b30

Download Submit
C:\Windows\SysWOW64\Dofpgqji.exe

Filesize
71KB

MD5
2bd25160d7c1e8a1f1c72c1859e45d83

SHA1
212064bd8756acf226be738d82c47dbe03052092

SHA256
c62383c921de7a1a8de825c3d5de333d31df8781e28e578437a81aa8c5fc643e

SHA512
3e48a0bcb7b85bc441ed94ca55349d85ab20f6f35606f099982a37c593f87f6cfd4ef52217ebb2721a26c5063da8a29909a86832a6060f89394cb191378ada14

Download Submit
C:\Windows\SysWOW64\Dohmlp32.exe

Filesize
71KB

MD5
ed2a0bc76001bd0085fc4dd35fc13e79

SHA1
f9a63963a528827b89ac7127457198795b1f829e

SHA256
ea8d9aa24996f09be1af882b6a96eda57f77a693a565a5365da7b977df9cb027

SHA512
049f897b323760ab0f0bd9e3c7c741dd9949fb082753486af75a1304d5f8f967bf8c4c1d946e3ee23357f2821c3f03c4e80df3eb8d1cf44e9c61189a6031f3ea

Download Submit
C:\Windows\SysWOW64\Domfgpca.exe

Filesize
71KB

MD5
5f4c3bc9b30b94b2e96b853bd9ad2f7e

SHA1
435848acaa4544870670f852aed469dd13118bc9

SHA256
f227bdfeecc277d1ec46473d24a9f7a13115900bed5cf98af1636f97a50b11a1

SHA512
78d57abd82933f8de0f2c75f3f038f7af436990818fc7ce07fea1b6e30596b79e6650ece5dc74d493e6e634c994fed695ddd0272b2de79106b0670be105a775b

Download Submit
C:\Windows\SysWOW64\Dphifcoi.exe

Filesize
71KB

MD5
951c95322da8f75f91c0c978d905b81b

SHA1
d692f70e0de8de86a6cfddc2a933d7cbb1896e18

SHA256
c4546fdb609665821aa4a0569c80238a6287f651bdd0709724099343cf1942fd

SHA512
322968aa527332caeab26f1926ac782c48170521691831ed688f7e5f52c94b18ed09db80a5095a4fb5e1b1baba600e412c176c9103ab00e575f44784695cf4c2

Download Submit
C:\Windows\SysWOW64\Ebnoikqb.exe

Filesize
71KB

MD5
23a962b780902a5818b0ea1107bd7c4c

SHA1
69f026ade82695d394f9d2528639964f0f517882

SHA256
0138f9c86d612c0707e205467e797c17bd9c9cd193437ee0d3a62c6b902931bd

SHA512
a2ca443f38417a690fa81559e595e5d36b515edff99b8c825e023c74b81254c8c60cdff00df704ebd07ee8ffcb19aa05d9113015c0d3d715d959c382596c8e93

Download Submit
C:\Windows\SysWOW64\Ebploj32.exe

Filesize
71KB

MD5
3009737be7e652d44f99872bf486bd20

SHA1
ab2c6f1a648b90b0a69e7210f410603e44576095

SHA256
3f0fe833d6d52f6e8be86081b0b5302bd31b6971fe559e0f5748cdb04ba14e0e

SHA512
b414a341c35b45b8d300703779870639481885d2d3bb64f919ed5f0e7c9416d944cf1acfb2024ddb494cac7ca747c97e4a920cc9b7fa23a497761b5914f7aeaf

Download Submit
C:\Windows\SysWOW64\Ecmlcmhe.exe

Filesize
71KB

MD5
91bf07227e7fab3e251942c5f59a83e7

SHA1
2b1cb588a052989be77fbc4d6d741f424402ee33

SHA256
6255c92a38eb5203f4ceae8e71eb9f95c2dfdb5d165b6e880e711d12a3bac722

SHA512
d7f5a6b3b55bd5166ece628e9a7210e4b55b1b6e5de1e00b821ec3a3010b8d9c0a4960f56991c96f93bbbce14ef0dbe1dc744c926e934169659b1a48d85b042e

Download Submit
C:\Windows\SysWOW64\Efikji32.exe

Filesize
71KB

MD5
dc82db5982d181dccca7c68c1a89526a

SHA1
d88484d2a04fe22caedf306e81f31473f9abb5fe

SHA256
e341e2b55b2fe261dae8322401c688fddb1a218e885817430e1b89c6bb012b8e

SHA512
97e55738f97e4847162be5a966af9ecdd3aad4d18410c39db87f5b63f8fd809cdf700a2b87d3816a9c8adcc2c56c69712efa174fe90b1305ee8c0f6131fbe3be

Download Submit
C:\Windows\SysWOW64\Ehhgfdho.exe

Filesize
71KB

MD5
d89b6acf12177d92482940dfe15bacea

SHA1
b272f4c280b74bff0f63ab4b05eab341da6f7ef5

SHA256
16922f49e95c693688501a2206a85cc06c931f7f2d118d03b5d31238726a1d3c

SHA512
1eadf6f7366cc1d8a993c2cfa34475a7405f5ff80c5da3368e0d1678bb8ca0cf76985d3033e09faf971a8fe4bb546647839a2386f335a5d2e2093e95ae9b496e

Download Submit
C:\Windows\SysWOW64\Ejbkehcg.exe

Filesize
71KB

MD5
0fd968eed8e9e76f9aa145614e721065

SHA1
ae040f596c700957a8f2294dcd8f1d736559ccbf

SHA256
b7b1a00ad8d59593b6263ddb9ce4c235b3c8dbb18c19cfd38aa9bd0467d42482

SHA512
b186973d8b55a83248a9f5c39834c59c54a2255811bd4d2c0d02ae1f49c1e19fcaed015d5f2574f0b1ade791279aaf70a6f07679c03f7d3fc483f32d64667b85

Download Submit
C:\Windows\SysWOW64\Ejgdpg32.exe

Filesize
71KB

MD5
0251c4c1ed5735edde8b5216a4ed48e4

SHA1
0ebeb513616cccf504893960149ba360eb0d36e7

SHA256
3fd5b62a83afb117bd32ae6b81ea5a6a831d4ed63fb30b7f2c59b81dac49c916

SHA512
a5082453e46610da12bfbd808032ea304bcb40e477c94c70f9194da22118bc49b97bccbaa8d47f9bee587a755940df9ec558f4f99546729fb3adf2274a6fa8a3

Download Submit
C:\Windows\SysWOW64\Elagacbk.exe

Filesize
71KB

MD5
63c7374620ca20204749dbc3817741b5

SHA1
f40a77a711f58cddf432e58814a1cf99d05cef7e

SHA256
b8558a9afd44da3d87d4b389fcbe797f98df625d85b19f71c3d898ff1cd8a7ff

SHA512
73c1c2c10d43c0e85155468b0ebf31d960cfca886b2120b81c3c983c435decead8d3975bdb3233ffa65c73afd80ebcfcad111bafd1751699e9fc50218b2b7aef

Download Submit
C:\Windows\SysWOW64\Eodlho32.exe

Filesize
71KB

MD5
b23a7f81ab231b3aee4a86c6b5a35e95

SHA1
442dbf459d363b8e115f4dd4f1e60b8bd73e220c

SHA256
bb4f1d7bd2e22b3f7d6dc79154ea0fb4596f280ae9664391ae99f5a0914adfcc

SHA512
5d9147c1c3573b69b7956f2c5f90a6caa95a6ee4331c1b76ce683e2f239c447ee4a866b66d9f21918ef58d07ee6ff2c31c60c809cb947b4ac65f981d1eb6e4d5

Download Submit
C:\Windows\SysWOW64\Eoocmoao.exe

Filesize
71KB

MD5
4c24f6fe6f8e2137e41718cac5a18f0c

SHA1
3d151bb2179746eaf8be76cc77ac476d99e70a4d

SHA256
22147efbec86e723f37b92cf49f336a12066201604f550bcd8d514f253172d98

SHA512
cb3acd406adde61989b6773da69c61ee64996d0ca5994553b0276b1159cb636fc2c01b3106ec37966c3e9213e5ab9936b7fa6858897da406ebd868999febbf9f

Download Submit
C:\Windows\SysWOW64\Imakkfdg.exe

Filesize
64KB

MD5
a50ec6d6021de48491372396b6171686

SHA1
6d73878097d28bca738ddd2e4f5b7f5ea37d3e95

SHA256
9dec5244f852a57926b8beff23a42be4754bc2363c52382528c2492f24c2ce1b

SHA512
b92c2bd00f2d38a255aa2c533346285f8939018b11bb028dada4223326b6eb9e4d019f9e340b6932416ebd91c70e4037c7fdcfa6c64ca6ae79164a8398f7f66f

Download Submit
C:\Windows\SysWOW64\Kebbafoj.exe

Filesize
71KB

MD5
4e01e8066c27506e80fc75c618c2638f

SHA1
278244ae21a1e9808b7c40d9e56a8f154266220d

SHA256
b7218b4e454eb5a1017c76fdebef066369d7460731269d0a98af44ba4a33b30f

SHA512
59c4039d0bf0cb5780bab7880a73ee4f260a3d14f0ec55d6a6e8c24b63c51dfdc50f08b679d5bcd936f9f8257fdc4f4a1fe710803dc0008b3075f8cb0ae9a7d5

Download Submit
C:\Windows\SysWOW64\Ndidbn32.exe

Filesize
71KB

MD5
e8048a1c3df7f86018366076a958539b

SHA1
0009114c8048ee99d833f4b7a56b747e73d65bb4

SHA256
9c2b10f02e59f5b7f73c4201024246ea26376e21845987808d73ddb37fbd40cb

SHA512
09614f666d7f244739ca0dd3d3667c583b3b37870d6f4e5982f170be430e2dbb0dc854a1e8037bd74dc114a4ade8d9c67d8660af8bf1a23436f9224c620b39dd

Download Submit
memory/420-401-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/512-317-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1044-417-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1112-228-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1180-128-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1256-256-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1264-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1592-188-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1628-212-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1632-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1652-88-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1772-345-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1816-297-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1884-192-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1920-120-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1932-96-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2084-76-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2204-52-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2216-152-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2224-383-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2276-200-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2284-305-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2384-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2636-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2640-353-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2680-281-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2732-371-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2856-172-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2904-407-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3036-393-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3044-287-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3064-232-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3084-231-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3152-263-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3176-248-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3192-31-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3228-329-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3296-377-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3336-112-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3368-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3668-431-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3704-395-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3752-216-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3840-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3860-437-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3880-136-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4004-365-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4068-359-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4120-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4224-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4300-239-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4540-311-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4576-68-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4660-419-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4708-352-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4808-269-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4888-323-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4944-429-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4976-176-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4996-104-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5028-160-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5068-340-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5104-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5112-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/13900-3856-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/13940-3854-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/13980-3853-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/14024-3851-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/14072-3850-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads