6721c52a5d65da9d9be5bcf6123f8b0ddfa433907cea1b623535da96173523c9

Analysis

max time kernel
140s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20-04-2024 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6721c52a5d65da9d9be5bcf6123f8b0ddfa433907cea1b623535da96173523c9.exe
Size

104KB
MD5

9d09f328992cdd807660473d5a701a93
SHA1

202afdc839858851952699a77f819a15300483d3
SHA256

6721c52a5d65da9d9be5bcf6123f8b0ddfa433907cea1b623535da96173523c9
SHA512

2dd10bc3b9abb02fb2456308aabf1ae18f26e45a04b8c4a9213e0cb9b56452fad9720eef0050defe2100285f450f8ba7ab33835df276b90c38f373bdaa6b0ec6
SSDEEP

3072:4DdPZsdsyyHwSi9vAPKJpdm08r3kremwc/gHq/e:0Wd/yQTJAPQ8r3/fc/A

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjpeepnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbdmpqcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ekemhj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imdgqfbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blpechop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hcedaheh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bhikcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdfbibnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipnjab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jaedgjjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jpaghf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aabmqd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnhmng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Icnpmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Echknh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afmhck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjddphlq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqhbmqqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lphoelqn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlcifmbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnjlpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Andqdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aglemn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkkcge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipdqba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdcbom32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgbnmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckedalaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hoiafcic.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjmoibog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Icjmmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfngap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chbedh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hcnnaikp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bblckl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Echknh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blennh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ejbkehcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccjfgphj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjolnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Beglgani.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahhblemi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gdhmnlcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlefklpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aahdqp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcpapkgp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hmdedo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhkhibmc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aojhdd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gqkhjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ckpjfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Abemjmgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bblckl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qloebdig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Anpncp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fjqgff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jmkdlkph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncbknfed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bclhhnca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dokjbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nqpego32.exe

Executes dropped EXE 64 IoCs

pid	Process
1300	Aimoln32.exe
3688	Alkkhi32.exe
3764	Aojhdd32.exe
4200	Aahdqp32.exe
4520	Ahblmjhj.exe
3160	Bpidngil.exe
2124	Bakqfp32.exe
2692	Befmfngc.exe
2152	Blpechop.exe
5080	Booaodnd.exe
4540	Bammlomg.exe
4624	Bidemmnj.exe
4144	Blbaihmn.exe
4648	Bbljeb32.exe
4088	Bekfan32.exe
4072	Blennh32.exe
404	Bpqjofcd.exe
1424	Bemcgmak.exe
2924	Bpcgdfaa.exe
4324	Bbacqape.exe
1792	Bikkml32.exe
3928	Cpedjf32.exe
4908	Cccpfa32.exe
2284	Ceblbm32.exe
1292	Chphoh32.exe
4408	Cojqkbdf.exe
2996	Caimgncj.exe
1980	Chbedh32.exe
3268	Cpjmee32.exe
4576	Chebighd.exe
3932	Ccjfgphj.exe
3568	Clckpf32.exe
1744	Coagla32.exe
432	Ccmclp32.exe
736	Dhjkdg32.exe
1716	Dlegeemh.exe
1684	Dcopbp32.exe
1144	Denlnk32.exe
4804	Dhlhjf32.exe
5044	Dofpgqji.exe
4980	Dadlclim.exe
3192	Djlddi32.exe
2204	Dljqpd32.exe
4672	Debeijoc.exe
2036	Dhqaefng.exe
4884	Dllmfd32.exe
3308	Dokjbp32.exe
316	Daifnk32.exe
1596	Djpnohej.exe
3328	Dlojkddn.exe
2884	Domfgpca.exe
4976	Ejbkehcg.exe
2076	Elagacbk.exe
3840	Efikji32.exe
1048	Eoapbo32.exe
4880	Eflhoigi.exe
4204	Ehjdldfl.exe
688	Eqalmafo.exe
4064	Ecphimfb.exe
3244	Ejjqeg32.exe
4920	Ebeejijj.exe
3800	Ejlmkgkl.exe
2724	Emjjgbjp.exe
5060	Eoifcnid.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Kpmfddnf.exe	Kcifkp32.exe
File opened for modification	C:\Windows\SysWOW64\Mcnhmm32.exe	Mkbchk32.exe
File opened for modification	C:\Windows\SysWOW64\Iffmccbi.exe	Icgqggce.exe
File opened for modification	C:\Windows\SysWOW64\Gjapmdid.exe	Gcggpj32.exe
File created	C:\Windows\SysWOW64\Eagncfoj.dll	Hclakimb.exe
File created	C:\Windows\SysWOW64\Jkfkfohj.exe	Jbocea32.exe
File opened for modification	C:\Windows\SysWOW64\Alkkhi32.exe	Aimoln32.exe
File created	C:\Windows\SysWOW64\Kmihaj32.dll	Ejlmkgkl.exe
File created	C:\Windows\SysWOW64\Qkmhlekj.exe	Pbddcoei.exe
File created	C:\Windows\SysWOW64\Mipaiqmd.dll	Qloebdig.exe
File created	C:\Windows\SysWOW64\Jqqjmnii.dll	Eflhoigi.exe
File created	C:\Windows\SysWOW64\Odgqdlnj.exe	Oqkdcn32.exe
File opened for modification	C:\Windows\SysWOW64\Mgnnhk32.exe	Mpdelajl.exe
File created	C:\Windows\SysWOW64\Hjhfnccl.exe	Hcnnaikp.exe
File created	C:\Windows\SysWOW64\Maaepd32.exe	Mkgmcjld.exe
File created	C:\Windows\SysWOW64\Ckpjfm32.exe	Clnjjpod.exe
File created	C:\Windows\SysWOW64\Fqqlehck.dll	Helfik32.exe
File opened for modification	C:\Windows\SysWOW64\Ognpebpj.exe	Opdghh32.exe
File created	C:\Windows\SysWOW64\Emjjgbjp.exe	Ejlmkgkl.exe
File created	C:\Windows\SysWOW64\Ipenkiei.dll	Ddbbeade.exe
File created	C:\Windows\SysWOW64\Gbledndp.dll	Imihfl32.exe
File created	C:\Windows\SysWOW64\Mdemcacc.dll	Lgkhlnbn.exe
File created	C:\Windows\SysWOW64\Pgioqq32.exe	Pdkcde32.exe
File created	C:\Windows\SysWOW64\Apignbdf.dll	Fbpnkama.exe
File created	C:\Windows\SysWOW64\Nmpmkplp.dll	Jcefno32.exe
File opened for modification	C:\Windows\SysWOW64\Mdmnlj32.exe	Mlefklpj.exe
File opened for modification	C:\Windows\SysWOW64\Njciko32.exe	Ncianepl.exe
File created	C:\Windows\SysWOW64\Hpnkaj32.dll	Dopigd32.exe
File created	C:\Windows\SysWOW64\Bkankc32.dll	Mnocof32.exe
File created	C:\Windows\SysWOW64\Bpcgdfaa.exe	Bemcgmak.exe
File created	C:\Windows\SysWOW64\Gcggpj32.exe	Gmmocpjk.exe
File created	C:\Windows\SysWOW64\Gjapmdid.exe	Gcggpj32.exe
File created	C:\Windows\SysWOW64\Ibooqjdb.dll	Hjjbcbqj.exe
File created	C:\Windows\SysWOW64\Nnmopdep.exe	Nkncdifl.exe
File created	C:\Windows\SysWOW64\Cpnfbohh.dll	Pndohaqe.exe
File opened for modification	C:\Windows\SysWOW64\Anbkio32.exe	Ahhblemi.exe
File created	C:\Windows\SysWOW64\Booaodnd.exe	Blpechop.exe
File opened for modification	C:\Windows\SysWOW64\Jblpek32.exe	Jlbgha32.exe
File created	C:\Windows\SysWOW64\Ceaehfjj.exe	Cdainc32.exe
File created	C:\Windows\SysWOW64\Lpfijcfl.exe	Lnhmng32.exe
File created	C:\Windows\SysWOW64\Ekipni32.dll	Mpaifalo.exe
File created	C:\Windows\SysWOW64\Dllfkn32.exe	Dhpjkojk.exe
File created	C:\Windows\SysWOW64\Dhmgki32.exe	Ddakjkqi.exe
File created	C:\Windows\SysWOW64\Jkageheh.dll	Hadkpm32.exe
File opened for modification	C:\Windows\SysWOW64\Iikopmkd.exe	Idofhfmm.exe
File opened for modification	C:\Windows\SysWOW64\Pjmlbbdg.exe	Pkjlge32.exe
File opened for modification	C:\Windows\SysWOW64\Foabofnn.exe	Fhgjblfq.exe
File opened for modification	C:\Windows\SysWOW64\Ofqpqo32.exe	Ognpebpj.exe
File created	C:\Windows\SysWOW64\Cjbpaf32.exe	Ceehho32.exe
File opened for modification	C:\Windows\SysWOW64\Ccjfgphj.exe	Chebighd.exe
File created	C:\Windows\SysWOW64\Bekfan32.exe	Bbljeb32.exe
File created	C:\Windows\SysWOW64\Dedkdcie.exe	Dceohhja.exe
File opened for modification	C:\Windows\SysWOW64\Gcimkc32.exe	Gkaejf32.exe
File created	C:\Windows\SysWOW64\Iefioj32.exe	Hfcicmqp.exe
File created	C:\Windows\SysWOW64\Cjpckf32.exe	Cdfkolkf.exe
File created	C:\Windows\SysWOW64\Ahblmjhj.exe	Aahdqp32.exe
File created	C:\Windows\SysWOW64\Cecbmf32.exe	Cbefaj32.exe
File created	C:\Windows\SysWOW64\Lfhdlh32.exe	Lpnlpnih.exe
File created	C:\Windows\SysWOW64\Cojlbcgp.dll	Lpnlpnih.exe
File created	C:\Windows\SysWOW64\Hfggmg32.dll	Bjddphlq.exe
File created	C:\Windows\SysWOW64\Lcoppd32.dll	Ojjffddl.exe
File created	C:\Windows\SysWOW64\Qceiaa32.exe	Qqfmde32.exe
File opened for modification	C:\Windows\SysWOW64\Kgmlkp32.exe	Jiikak32.exe
File created	C:\Windows\SysWOW64\Fkgoikdb.dll	Ipbdmaah.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
13940	13860	WerFault.exe	688

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hjmoibog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ocegdjij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bhkhibmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaekmb32.dll"	Deoaid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ickchq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chfgkj32.dll"	Nilcjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ojoign32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pgnilpah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Anbkio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Blbknaib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eghpcp32.dll"	Mcmabg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cojqkbdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojigmkeg.dll"	Djpnohej.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eemnjbaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fkopnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phkjck32.dll"	Lingibiq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jijjfldq.dll"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hionfema.dll"	Haggelfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olpppj32.dll"	Hckjacjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oadacmff.dll"	Olfobjbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ibmmhdhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Maaepd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mpdelajl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gbgdlq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jocbigff.dll"	Pnakhkol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Coagla32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nddkgonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpjljp32.dll"	Jfhbppbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Abemjmgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deeiam32.dll"	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmhnkg32.dll"	Bmpcfdmg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Icgqggce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcoppd32.dll"	Ojjffddl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddbbeade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jedeph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jlednamo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jfeopj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qfcfml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aabmqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ccjfgphj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhoilahe.dll"	Jmbdbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfihel32.dll"	Belebq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jmpngk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jmbdbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbnkjc32.dll"	Kbaipkbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpmdoo32.dll"	Aclpap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlklhm32.dll"	Amddjegd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Afoeiklb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Onklabip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmnjlc32.dll"	Ahhblemi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kpeiioac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bfabnjjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eqalmafo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Panjjlqo.dll"	Qajadlja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnchkk32.dll"	Iemppiab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ickfifmb.dll"	Agglboim.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Andqdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdqjac32.dll"	Cnffqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbopfj32.dll"	Debeijoc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Clpgpp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ekcpbj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppgjkamf.dll"	Emjjgbjp.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 1300	1844	6721c52a5d65da9d9be5bcf6123f8b0ddfa433907cea1b623535da96173523c9.exe	86
PID 1844 wrote to memory of 1300	1844	6721c52a5d65da9d9be5bcf6123f8b0ddfa433907cea1b623535da96173523c9.exe	86
PID 1844 wrote to memory of 1300	1844	6721c52a5d65da9d9be5bcf6123f8b0ddfa433907cea1b623535da96173523c9.exe	86
PID 1300 wrote to memory of 3688	1300	Aimoln32.exe	87
PID 1300 wrote to memory of 3688	1300	Aimoln32.exe	87
PID 1300 wrote to memory of 3688	1300	Aimoln32.exe	87
PID 3688 wrote to memory of 3764	3688	Alkkhi32.exe	88
PID 3688 wrote to memory of 3764	3688	Alkkhi32.exe	88
PID 3688 wrote to memory of 3764	3688	Alkkhi32.exe	88
PID 3764 wrote to memory of 4200	3764	Aojhdd32.exe	89
PID 3764 wrote to memory of 4200	3764	Aojhdd32.exe	89
PID 3764 wrote to memory of 4200	3764	Aojhdd32.exe	89
PID 4200 wrote to memory of 4520	4200	Aahdqp32.exe	90
PID 4200 wrote to memory of 4520	4200	Aahdqp32.exe	90
PID 4200 wrote to memory of 4520	4200	Aahdqp32.exe	90
PID 4520 wrote to memory of 3160	4520	Ahblmjhj.exe	91
PID 4520 wrote to memory of 3160	4520	Ahblmjhj.exe	91
PID 4520 wrote to memory of 3160	4520	Ahblmjhj.exe	91
PID 3160 wrote to memory of 2124	3160	Bpidngil.exe	92
PID 3160 wrote to memory of 2124	3160	Bpidngil.exe	92
PID 3160 wrote to memory of 2124	3160	Bpidngil.exe	92
PID 2124 wrote to memory of 2692	2124	Bakqfp32.exe	93
PID 2124 wrote to memory of 2692	2124	Bakqfp32.exe	93
PID 2124 wrote to memory of 2692	2124	Bakqfp32.exe	93
PID 2692 wrote to memory of 2152	2692	Befmfngc.exe	94
PID 2692 wrote to memory of 2152	2692	Befmfngc.exe	94
PID 2692 wrote to memory of 2152	2692	Befmfngc.exe	94
PID 2152 wrote to memory of 5080	2152	Blpechop.exe	95
PID 2152 wrote to memory of 5080	2152	Blpechop.exe	95
PID 2152 wrote to memory of 5080	2152	Blpechop.exe	95
PID 5080 wrote to memory of 4540	5080	Booaodnd.exe	96
PID 5080 wrote to memory of 4540	5080	Booaodnd.exe	96
PID 5080 wrote to memory of 4540	5080	Booaodnd.exe	96
PID 4540 wrote to memory of 4624	4540	Bammlomg.exe	97
PID 4540 wrote to memory of 4624	4540	Bammlomg.exe	97
PID 4540 wrote to memory of 4624	4540	Bammlomg.exe	97
PID 4624 wrote to memory of 4144	4624	Bidemmnj.exe	99
PID 4624 wrote to memory of 4144	4624	Bidemmnj.exe	99
PID 4624 wrote to memory of 4144	4624	Bidemmnj.exe	99
PID 4144 wrote to memory of 4648	4144	Blbaihmn.exe	100
PID 4144 wrote to memory of 4648	4144	Blbaihmn.exe	100
PID 4144 wrote to memory of 4648	4144	Blbaihmn.exe	100
PID 4648 wrote to memory of 4088	4648	Bbljeb32.exe	101
PID 4648 wrote to memory of 4088	4648	Bbljeb32.exe	101
PID 4648 wrote to memory of 4088	4648	Bbljeb32.exe	101
PID 4088 wrote to memory of 4072	4088	Bekfan32.exe	102
PID 4088 wrote to memory of 4072	4088	Bekfan32.exe	102
PID 4088 wrote to memory of 4072	4088	Bekfan32.exe	102
PID 4072 wrote to memory of 404	4072	Blennh32.exe	103
PID 4072 wrote to memory of 404	4072	Blennh32.exe	103
PID 4072 wrote to memory of 404	4072	Blennh32.exe	103
PID 404 wrote to memory of 1424	404	Bpqjofcd.exe	104
PID 404 wrote to memory of 1424	404	Bpqjofcd.exe	104
PID 404 wrote to memory of 1424	404	Bpqjofcd.exe	104
PID 1424 wrote to memory of 2924	1424	Bemcgmak.exe	105
PID 1424 wrote to memory of 2924	1424	Bemcgmak.exe	105
PID 1424 wrote to memory of 2924	1424	Bemcgmak.exe	105
PID 2924 wrote to memory of 4324	2924	Bpcgdfaa.exe	106
PID 2924 wrote to memory of 4324	2924	Bpcgdfaa.exe	106
PID 2924 wrote to memory of 4324	2924	Bpcgdfaa.exe	106
PID 4324 wrote to memory of 1792	4324	Bbacqape.exe	107
PID 4324 wrote to memory of 1792	4324	Bbacqape.exe	107
PID 4324 wrote to memory of 1792	4324	Bbacqape.exe	107
PID 1792 wrote to memory of 3928	1792	Bikkml32.exe	109

C:\Users\Admin\AppData\Local\Temp\6721c52a5d65da9d9be5bcf6123f8b0ddfa433907cea1b623535da96173523c9.exe
"C:\Users\Admin\AppData\Local\Temp\6721c52a5d65da9d9be5bcf6123f8b0ddfa433907cea1b623535da96173523c9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\SysWOW64\Aimoln32.exe
  C:\Windows\system32\Aimoln32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\SysWOW64\Alkkhi32.exe
    C:\Windows\system32\Alkkhi32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3688
  - - C:\Windows\SysWOW64\Aojhdd32.exe
      C:\Windows\system32\Aojhdd32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3764
    - - C:\Windows\SysWOW64\Aahdqp32.exe
        
        C:\Windows\system32\Aahdqp32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4200
      - C:\Windows\SysWOW64\Ahblmjhj.exe
        
        C:\Windows\system32\Ahblmjhj.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4520
        
        C:\Windows\SysWOW64\Bpidngil.exe
        
        C:\Windows\system32\Bpidngil.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3160
        
        C:\Windows\SysWOW64\Bakqfp32.exe
        
        C:\Windows\system32\Bakqfp32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2124
        
        C:\Windows\SysWOW64\Befmfngc.exe
        
        C:\Windows\system32\Befmfngc.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2692
        
        C:\Windows\SysWOW64\Blpechop.exe
        
        C:\Windows\system32\Blpechop.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Windows\SysWOW64\Booaodnd.exe
        
        C:\Windows\system32\Booaodnd.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\SysWOW64\Bammlomg.exe
        
        C:\Windows\system32\Bammlomg.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4540
        
        C:\Windows\SysWOW64\Bidemmnj.exe
        
        C:\Windows\system32\Bidemmnj.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4624
        
        C:\Windows\SysWOW64\Blbaihmn.exe
        
        C:\Windows\system32\Blbaihmn.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4144
        
        C:\Windows\SysWOW64\Bbljeb32.exe
        
        C:\Windows\system32\Bbljeb32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Windows\SysWOW64\Bekfan32.exe
        
        C:\Windows\system32\Bekfan32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Windows\SysWOW64\Blennh32.exe
        
        C:\Windows\system32\Blennh32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4072
        
        C:\Windows\SysWOW64\Bpqjofcd.exe
        
        C:\Windows\system32\Bpqjofcd.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:404
        
        C:\Windows\SysWOW64\Bemcgmak.exe
        
        C:\Windows\system32\Bemcgmak.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1424
        
        C:\Windows\SysWOW64\Bpcgdfaa.exe
        
        C:\Windows\system32\Bpcgdfaa.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Windows\SysWOW64\Bbacqape.exe
        
        C:\Windows\system32\Bbacqape.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4324
        
        C:\Windows\SysWOW64\Bikkml32.exe
        
        C:\Windows\system32\Bikkml32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\SysWOW64\Cpedjf32.exe
        
        C:\Windows\system32\Cpedjf32.exe
        23⤵
        Executes dropped EXE
        
        PID:3928
        
        C:\Windows\SysWOW64\Cccpfa32.exe
        
        C:\Windows\system32\Cccpfa32.exe
        24⤵
        Executes dropped EXE
        
        PID:4908
        
        C:\Windows\SysWOW64\Ceblbm32.exe
        
        C:\Windows\system32\Ceblbm32.exe
        25⤵
        Executes dropped EXE
        
        PID:2284
        
        C:\Windows\SysWOW64\Chphoh32.exe
        
        C:\Windows\system32\Chphoh32.exe
        26⤵
        Executes dropped EXE
        
        PID:1292
        
        C:\Windows\SysWOW64\Cojqkbdf.exe
        
        C:\Windows\system32\Cojqkbdf.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4408
        
        C:\Windows\SysWOW64\Caimgncj.exe
        
        C:\Windows\system32\Caimgncj.exe
        28⤵
        Executes dropped EXE
        
        PID:2996
        
        C:\Windows\SysWOW64\Chbedh32.exe
        
        C:\Windows\system32\Chbedh32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1980
        
        C:\Windows\SysWOW64\Cpjmee32.exe
        
        C:\Windows\system32\Cpjmee32.exe
        30⤵
        Executes dropped EXE
        
        PID:3268
        
        C:\Windows\SysWOW64\Chebighd.exe
        
        C:\Windows\system32\Chebighd.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4576
        
        C:\Windows\SysWOW64\Ccjfgphj.exe
        
        C:\Windows\system32\Ccjfgphj.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3932
        
        C:\Windows\SysWOW64\Clckpf32.exe
        
        C:\Windows\system32\Clckpf32.exe
        33⤵
        Executes dropped EXE
        
        PID:3568
        
        C:\Windows\SysWOW64\Coagla32.exe
        
        C:\Windows\system32\Coagla32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1744
        
        C:\Windows\SysWOW64\Ccmclp32.exe
        
        C:\Windows\system32\Ccmclp32.exe
        35⤵
        Executes dropped EXE
        
        PID:432
        
        C:\Windows\SysWOW64\Dhjkdg32.exe
        
        C:\Windows\system32\Dhjkdg32.exe
        36⤵
        Executes dropped EXE
        
        PID:736
        
        C:\Windows\SysWOW64\Dlegeemh.exe
        
        C:\Windows\system32\Dlegeemh.exe
        37⤵
        Executes dropped EXE
        
        PID:1716
        
        C:\Windows\SysWOW64\Dcopbp32.exe
        
        C:\Windows\system32\Dcopbp32.exe
        38⤵
        Executes dropped EXE
        
        PID:1684
        
        C:\Windows\SysWOW64\Denlnk32.exe
        
        C:\Windows\system32\Denlnk32.exe
        39⤵
        Executes dropped EXE
        
        PID:1144
        
        C:\Windows\SysWOW64\Dhlhjf32.exe
        
        C:\Windows\system32\Dhlhjf32.exe
        40⤵
        Executes dropped EXE
        
        PID:4804
        
        C:\Windows\SysWOW64\Dofpgqji.exe
        
        C:\Windows\system32\Dofpgqji.exe
        41⤵
        Executes dropped EXE
        
        PID:5044
        
        C:\Windows\SysWOW64\Dadlclim.exe
        
        C:\Windows\system32\Dadlclim.exe
        42⤵
        Executes dropped EXE
        
        PID:4980
        
        C:\Windows\SysWOW64\Djlddi32.exe
        
        C:\Windows\system32\Djlddi32.exe
        43⤵
        Executes dropped EXE
        
        PID:3192
        
        C:\Windows\SysWOW64\Dljqpd32.exe
        
        C:\Windows\system32\Dljqpd32.exe
        44⤵
        Executes dropped EXE
        
        PID:2204
        
        C:\Windows\SysWOW64\Debeijoc.exe
        
        C:\Windows\system32\Debeijoc.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4672
        
        C:\Windows\SysWOW64\Dhqaefng.exe
        
        C:\Windows\system32\Dhqaefng.exe
        46⤵
        Executes dropped EXE
        
        PID:2036
        
        C:\Windows\SysWOW64\Dllmfd32.exe
        
        C:\Windows\system32\Dllmfd32.exe
        47⤵
        Executes dropped EXE
        
        PID:4884
        
        C:\Windows\SysWOW64\Dokjbp32.exe
        
        C:\Windows\system32\Dokjbp32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3308
        
        C:\Windows\SysWOW64\Daifnk32.exe
        
        C:\Windows\system32\Daifnk32.exe
        49⤵
        Executes dropped EXE
        
        PID:316
        
        C:\Windows\SysWOW64\Djpnohej.exe
        
        C:\Windows\system32\Djpnohej.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1596
        
        C:\Windows\SysWOW64\Dlojkddn.exe
        
        C:\Windows\system32\Dlojkddn.exe
        51⤵
        Executes dropped EXE
        
        PID:3328
        
        C:\Windows\SysWOW64\Domfgpca.exe
        
        C:\Windows\system32\Domfgpca.exe
        52⤵
        Executes dropped EXE
        
        PID:2884
        
        C:\Windows\SysWOW64\Ejbkehcg.exe
        
        C:\Windows\system32\Ejbkehcg.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4976
        
        C:\Windows\SysWOW64\Elagacbk.exe
        
        C:\Windows\system32\Elagacbk.exe
        54⤵
        Executes dropped EXE
        
        PID:2076
        
        C:\Windows\SysWOW64\Efikji32.exe
        
        C:\Windows\system32\Efikji32.exe
        55⤵
        Executes dropped EXE
        
        PID:3840
        
        C:\Windows\SysWOW64\Eoapbo32.exe
        
        C:\Windows\system32\Eoapbo32.exe
        56⤵
        Executes dropped EXE
        
        PID:1048
        
        C:\Windows\SysWOW64\Eflhoigi.exe
        
        C:\Windows\system32\Eflhoigi.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4880
        
        C:\Windows\SysWOW64\Ehjdldfl.exe
        
        C:\Windows\system32\Ehjdldfl.exe
        58⤵
        Executes dropped EXE
        
        PID:4204
        
        C:\Windows\SysWOW64\Eqalmafo.exe
        
        C:\Windows\system32\Eqalmafo.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:688
        
        C:\Windows\SysWOW64\Ecphimfb.exe
        
        C:\Windows\system32\Ecphimfb.exe
        60⤵
        Executes dropped EXE
        
        PID:4064
        
        C:\Windows\SysWOW64\Ejjqeg32.exe
        
        C:\Windows\system32\Ejjqeg32.exe
        61⤵
        Executes dropped EXE
        
        PID:3244
        
        C:\Windows\SysWOW64\Ebeejijj.exe
        
        C:\Windows\system32\Ebeejijj.exe
        62⤵
        Executes dropped EXE
        
        PID:4920
        
        C:\Windows\SysWOW64\Ejlmkgkl.exe
        
        C:\Windows\system32\Ejlmkgkl.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3800
        
        C:\Windows\SysWOW64\Emjjgbjp.exe
        
        C:\Windows\system32\Emjjgbjp.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2724
        
        C:\Windows\SysWOW64\Eoifcnid.exe
        
        C:\Windows\system32\Eoifcnid.exe
        65⤵
        Executes dropped EXE
        
        PID:5060
        
        C:\Windows\SysWOW64\Fbgbpihg.exe
        
        C:\Windows\system32\Fbgbpihg.exe
        66⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\Fhajlc32.exe
        
        C:\Windows\system32\Fhajlc32.exe
        67⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\Fqhbmqqg.exe
        
        C:\Windows\system32\Fqhbmqqg.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:208
        
        C:\Windows\SysWOW64\Fokbim32.exe
        
        C:\Windows\system32\Fokbim32.exe
        69⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\Fjqgff32.exe
        
        C:\Windows\system32\Fjqgff32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3400
        
        C:\Windows\SysWOW64\Fqkocpod.exe
        
        C:\Windows\system32\Fqkocpod.exe
        71⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\Ffggkgmk.exe
        
        C:\Windows\system32\Ffggkgmk.exe
        72⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\Fqmlhpla.exe
        
        C:\Windows\system32\Fqmlhpla.exe
        73⤵
        
        PID:384
        
        C:\Windows\SysWOW64\Ffjdqg32.exe
        
        C:\Windows\system32\Ffjdqg32.exe
        74⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\Fjepaecb.exe
        
        C:\Windows\system32\Fjepaecb.exe
        75⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\Fmclmabe.exe
        
        C:\Windows\system32\Fmclmabe.exe
        76⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Fqohnp32.exe
        
        C:\Windows\system32\Fqohnp32.exe
        77⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Fcnejk32.exe
        
        C:\Windows\system32\Fcnejk32.exe
        78⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Fflaff32.exe
        
        C:\Windows\system32\Fflaff32.exe
        79⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Fjhmgeao.exe
        
        C:\Windows\system32\Fjhmgeao.exe
        80⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Fmficqpc.exe
        
        C:\Windows\system32\Fmficqpc.exe
        81⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Gcpapkgp.exe
        
        C:\Windows\system32\Gcpapkgp.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5404
        
        C:\Windows\SysWOW64\Gjjjle32.exe
        
        C:\Windows\system32\Gjjjle32.exe
        83⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Gogbdl32.exe
        
        C:\Windows\system32\Gogbdl32.exe
        84⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Gcbnejem.exe
        
        C:\Windows\system32\Gcbnejem.exe
        85⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Gjlfbd32.exe
        
        C:\Windows\system32\Gjlfbd32.exe
        86⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Giofnacd.exe
        
        C:\Windows\system32\Giofnacd.exe
        87⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Gqfooodg.exe
        
        C:\Windows\system32\Gqfooodg.exe
        88⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Gbgkfg32.exe
        
        C:\Windows\system32\Gbgkfg32.exe
        89⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Giacca32.exe
        
        C:\Windows\system32\Giacca32.exe
        90⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Gmmocpjk.exe
        
        C:\Windows\system32\Gmmocpjk.exe
        91⤵
        Drops file in System32 directory
        
        PID:5848
        
        C:\Windows\SysWOW64\Gcggpj32.exe
        
        C:\Windows\system32\Gcggpj32.exe
        92⤵
        Drops file in System32 directory
        
        PID:5888
        
        C:\Windows\SysWOW64\Gjapmdid.exe
        
        C:\Windows\system32\Gjapmdid.exe
        93⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5976
        
        C:\Windows\SysWOW64\Gbldaffp.exe
        
        C:\Windows\system32\Gbldaffp.exe
        95⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        96⤵
        Drops file in System32 directory
        
        PID:6068
        
        C:\Windows\SysWOW64\Hboagf32.exe
        
        C:\Windows\system32\Hboagf32.exe
        97⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Hjfihc32.exe
        
        C:\Windows\system32\Hjfihc32.exe
        98⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\Hmdedo32.exe
        
        C:\Windows\system32\Hmdedo32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5140
        
        C:\Windows\SysWOW64\Hcnnaikp.exe
        
        C:\Windows\system32\Hcnnaikp.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5256
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        101⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        102⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Hpenfjad.exe
        
        C:\Windows\system32\Hpenfjad.exe
        103⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Hcqjfh32.exe
        
        C:\Windows\system32\Hcqjfh32.exe
        104⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Hfofbd32.exe
        
        C:\Windows\system32\Hfofbd32.exe
        105⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Hjjbcbqj.exe
        
        C:\Windows\system32\Hjjbcbqj.exe
        106⤵
        Drops file in System32 directory
        
        PID:5716
        
        C:\Windows\SysWOW64\Himcoo32.exe
        
        C:\Windows\system32\Himcoo32.exe
        107⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Hadkpm32.exe
        
        C:\Windows\system32\Hadkpm32.exe
        108⤵
        Drops file in System32 directory
        
        PID:5860
        
        C:\Windows\SysWOW64\Hccglh32.exe
        
        C:\Windows\system32\Hccglh32.exe
        109⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Hjmoibog.exe
        
        C:\Windows\system32\Hjmoibog.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6000
        
        C:\Windows\SysWOW64\Hippdo32.exe
        
        C:\Windows\system32\Hippdo32.exe
        111⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Haggelfd.exe
        
        C:\Windows\system32\Haggelfd.exe
        112⤵
        Modifies registry class
        
        PID:6124
        
        C:\Windows\SysWOW64\Hcedaheh.exe
        
        C:\Windows\system32\Hcedaheh.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5192
        
        C:\Windows\SysWOW64\Hjolnb32.exe
        
        C:\Windows\system32\Hjolnb32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5236
        
        C:\Windows\SysWOW64\Hibljoco.exe
        
        C:\Windows\system32\Hibljoco.exe
        115⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Haidklda.exe
        
        C:\Windows\system32\Haidklda.exe
        116⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        117⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5636
        
        C:\Windows\SysWOW64\Iffmccbi.exe
        
        C:\Windows\system32\Iffmccbi.exe
        118⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Iidipnal.exe
        
        C:\Windows\system32\Iidipnal.exe
        119⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Icjmmg32.exe
        
        C:\Windows\system32\Icjmmg32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5972
        
        C:\Windows\SysWOW64\Ibmmhdhm.exe
        
        C:\Windows\system32\Ibmmhdhm.exe
        121⤵
        Modifies registry class
        
        PID:6012
        
        C:\Windows\SysWOW64\Ijdeiaio.exe
        
        C:\Windows\system32\Ijdeiaio.exe
        122⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        123⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Iannfk32.exe
        
        C:\Windows\system32\Iannfk32.exe
        124⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        125⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        126⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Imdnklfp.exe
        
        C:\Windows\system32\Imdnklfp.exe
        127⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Idofhfmm.exe
        
        C:\Windows\system32\Idofhfmm.exe
        128⤵
        Drops file in System32 directory
        
        PID:5356
        
        C:\Windows\SysWOW64\Iikopmkd.exe
        
        C:\Windows\system32\Iikopmkd.exe
        129⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Imgkql32.exe
        
        C:\Windows\system32\Imgkql32.exe
        130⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Ipegmg32.exe
        
        C:\Windows\system32\Ipegmg32.exe
        131⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        132⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Ijkljp32.exe
        
        C:\Windows\system32\Ijkljp32.exe
        133⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Imihfl32.exe
        
        C:\Windows\system32\Imihfl32.exe
        134⤵
        Drops file in System32 directory
        
        PID:5492
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5532
        
        C:\Windows\SysWOW64\Jdcpcf32.exe
        
        C:\Windows\system32\Jdcpcf32.exe
        136⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Jfaloa32.exe
        
        C:\Windows\system32\Jfaloa32.exe
        137⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Jmkdlkph.exe
        
        C:\Windows\system32\Jmkdlkph.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6232
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        139⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Jbhmdbnp.exe
        
        C:\Windows\system32\Jbhmdbnp.exe
        140⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Jjpeepnb.exe
        
        C:\Windows\system32\Jjpeepnb.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6356
        
        C:\Windows\SysWOW64\Jmnaakne.exe
        
        C:\Windows\system32\Jmnaakne.exe
        142⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Jplmmfmi.exe
        
        C:\Windows\system32\Jplmmfmi.exe
        143⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Jbkjjblm.exe
        
        C:\Windows\system32\Jbkjjblm.exe
        144⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Jidbflcj.exe
        
        C:\Windows\system32\Jidbflcj.exe
        145⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        146⤵
        Modifies registry class
        
        PID:6580
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        147⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Jfhbppbc.exe
        
        C:\Windows\system32\Jfhbppbc.exe
        148⤵
        Modifies registry class
        
        PID:6664
        
        C:\Windows\SysWOW64\Jmbklj32.exe
        
        C:\Windows\system32\Jmbklj32.exe
        149⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6748
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        151⤵
        Drops file in System32 directory
        
        PID:6804
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        152⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Jiikak32.exe
        
        C:\Windows\system32\Jiikak32.exe
        153⤵
        Drops file in System32 directory
        
        PID:6896
        
        C:\Windows\SysWOW64\Kgmlkp32.exe
        
        C:\Windows\system32\Kgmlkp32.exe
        154⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Kmgdgjek.exe
        
        C:\Windows\system32\Kmgdgjek.exe
        155⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Kbdmpqcb.exe
        
        C:\Windows\system32\Kbdmpqcb.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7032
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        157⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Kinemkko.exe
        
        C:\Windows\system32\Kinemkko.exe
        158⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Kaemnhla.exe
        
        C:\Windows\system32\Kaemnhla.exe
        159⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        160⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Kipabjil.exe
        
        C:\Windows\system32\Kipabjil.exe
        161⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        162⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        163⤵
        Drops file in System32 directory
        
        PID:6372
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        164⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        165⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Kkbkamnl.exe
        
        C:\Windows\system32\Kkbkamnl.exe
        166⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        167⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        168⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Ldkojb32.exe
        
        C:\Windows\system32\Ldkojb32.exe
        169⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        170⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        171⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        172⤵
        Drops file in System32 directory
        
        PID:7016
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        173⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        174⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Lcbiao32.exe
        
        C:\Windows\system32\Lcbiao32.exe
        175⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        176⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Lnhmng32.exe
        
        C:\Windows\system32\Lnhmng32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6412
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        178⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        179⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        180⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Ljnnch32.exe
        
        C:\Windows\system32\Ljnnch32.exe
        181⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Lphfpbdi.exe
        
        C:\Windows\system32\Lphfpbdi.exe
        182⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Lgbnmm32.exe
        
        C:\Windows\system32\Lgbnmm32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7056
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        184⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Mciobn32.exe
        
        C:\Windows\system32\Mciobn32.exe
        185⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        186⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        187⤵
        Drops file in System32 directory
        
        PID:6692
        
        C:\Windows\SysWOW64\Mpmokb32.exe
        
        C:\Windows\system32\Mpmokb32.exe
        188⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        189⤵
        Modifies registry class
        
        PID:7076
        
        C:\Windows\SysWOW64\Mkbchk32.exe
        
        C:\Windows\system32\Mkbchk32.exe
        190⤵
        Drops file in System32 directory
        
        PID:6324
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        191⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        192⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        193⤵
        Drops file in System32 directory
        
        PID:6428
        
        C:\Windows\SysWOW64\Mkgmcjld.exe
        
        C:\Windows\system32\Mkgmcjld.exe
        194⤵
        Drops file in System32 directory
        
        PID:6888
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        195⤵
        Modifies registry class
        
        PID:7160
        
        C:\Windows\SysWOW64\Mpdelajl.exe
        
        C:\Windows\system32\Mpdelajl.exe
        196⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6424
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        197⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Njljefql.exe
        
        C:\Windows\system32\Njljefql.exe
        198⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Nacbfdao.exe
        
        C:\Windows\system32\Nacbfdao.exe
        199⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Ndbnboqb.exe
        
        C:\Windows\system32\Ndbnboqb.exe
        200⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        201⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Ngpjnkpf.exe
        
        C:\Windows\system32\Ngpjnkpf.exe
        202⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Njogjfoj.exe
        
        C:\Windows\system32\Njogjfoj.exe
        203⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        204⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Nddkgonp.exe
        
        C:\Windows\system32\Nddkgonp.exe
        205⤵
        Modifies registry class
        
        PID:7468
        
        C:\Windows\SysWOW64\Ncgkcl32.exe
        
        C:\Windows\system32\Ncgkcl32.exe
        206⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Nkncdifl.exe
        
        C:\Windows\system32\Nkncdifl.exe
        207⤵
        Drops file in System32 directory
        
        PID:7556
        
        C:\Windows\SysWOW64\Nnmopdep.exe
        
        C:\Windows\system32\Nnmopdep.exe
        208⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        209⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Ngedij32.exe
        
        C:\Windows\system32\Ngedij32.exe
        210⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        211⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        212⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        213⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Nnaikd32.exe
        
        C:\Windows\system32\Nnaikd32.exe
        214⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Nqpego32.exe
        
        C:\Windows\system32\Nqpego32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7884
        
        C:\Windows\SysWOW64\Ndkahnhh.exe
        
        C:\Windows\system32\Ndkahnhh.exe
        216⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Ogjmdigk.exe
        
        C:\Windows\system32\Ogjmdigk.exe
        217⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Ondeac32.exe
        
        C:\Windows\system32\Ondeac32.exe
        218⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Oqbamo32.exe
        
        C:\Windows\system32\Oqbamo32.exe
        219⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        220⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Ojjffddl.exe
        
        C:\Windows\system32\Ojjffddl.exe
        221⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8136
        
        C:\Windows\SysWOW64\Oqdoboli.exe
        
        C:\Windows\system32\Oqdoboli.exe
        222⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Ogogoi32.exe
        
        C:\Windows\system32\Ogogoi32.exe
        223⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        224⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        225⤵
        Modifies registry class
        
        PID:7292
        
        C:\Windows\SysWOW64\Ogaceh32.exe
        
        C:\Windows\system32\Ogaceh32.exe
        226⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        227⤵
        Modifies registry class
        
        PID:7452
        
        C:\Windows\SysWOW64\Odednmpm.exe
        
        C:\Windows\system32\Odednmpm.exe
        228⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Ogcpjhoq.exe
        
        C:\Windows\system32\Ogcpjhoq.exe
        229⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Obidhaog.exe
        
        C:\Windows\system32\Obidhaog.exe
        230⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Oqkdcn32.exe
        
        C:\Windows\system32\Oqkdcn32.exe
        231⤵
        Drops file in System32 directory
        
        PID:7732
        
        C:\Windows\SysWOW64\Odgqdlnj.exe
        
        C:\Windows\system32\Odgqdlnj.exe
        232⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Pcjapi32.exe
        
        C:\Windows\system32\Pcjapi32.exe
        233⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        234⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        235⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Pbkamqmd.exe
        
        C:\Windows\system32\Pbkamqmd.exe
        236⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        237⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Pclneicb.exe
        
        C:\Windows\system32\Pclneicb.exe
        238⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Pkceffcd.exe
        
        C:\Windows\system32\Pkceffcd.exe
        239⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Pjffbc32.exe
        
        C:\Windows\system32\Pjffbc32.exe
        240⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Pnbbbabh.exe
        
        C:\Windows\system32\Pnbbbabh.exe
        241⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Pcojkhap.exe
        
        C:\Windows\system32\Pcojkhap.exe
        242⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        243⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Pndohaqe.exe
        
        C:\Windows\system32\Pndohaqe.exe
        244⤵
        Drops file in System32 directory
        
        PID:7968
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        245⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        246⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        247⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        248⤵
        Drops file in System32 directory
        
        PID:7540
        
        C:\Windows\SysWOW64\Pjmlbbdg.exe
        
        C:\Windows\system32\Pjmlbbdg.exe
        249⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Pbddcoei.exe
        
        C:\Windows\system32\Pbddcoei.exe
        250⤵
        Drops file in System32 directory
        
        PID:7952
        
        C:\Windows\SysWOW64\Qkmhlekj.exe
        
        C:\Windows\system32\Qkmhlekj.exe
        251⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Qjpiha32.exe
        
        C:\Windows\system32\Qjpiha32.exe
        252⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Qajadlja.exe
        
        C:\Windows\system32\Qajadlja.exe
        253⤵
        Modifies registry class
        
        PID:7636
        
        C:\Windows\SysWOW64\Qchmagie.exe
        
        C:\Windows\system32\Qchmagie.exe
        254⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        255⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Qloebdig.exe
        
        C:\Windows\system32\Qloebdig.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7668
        
        C:\Windows\SysWOW64\Qnnanphk.exe
        
        C:\Windows\system32\Qnnanphk.exe
        257⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Qalnjkgo.exe
        
        C:\Windows\system32\Qalnjkgo.exe
        258⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1920
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        260⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        261⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Ahhblemi.exe
        
        C:\Windows\system32\Ahhblemi.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8280
        
        C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        263⤵
        Modifies registry class
        
        PID:8328
        
        C:\Windows\SysWOW64\Aelcfilb.exe
        
        C:\Windows\system32\Aelcfilb.exe
        264⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        265⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        266⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        267⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        268⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Aealah32.exe
        
        C:\Windows\system32\Aealah32.exe
        269⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Alkdnboj.exe
        
        C:\Windows\system32\Alkdnboj.exe
        270⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Abemjmgg.exe
        
        C:\Windows\system32\Abemjmgg.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8696
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        272⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Becifhfj.exe
        
        C:\Windows\system32\Becifhfj.exe
        273⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        274⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Bnlnon32.exe
        
        C:\Windows\system32\Bnlnon32.exe
        275⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Bajjli32.exe
        
        C:\Windows\system32\Bajjli32.exe
        276⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        277⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Blbknaib.exe
        
        C:\Windows\system32\Blbknaib.exe
        278⤵
        Modifies registry class
        
        PID:9000
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        279⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9072
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9120
        
        C:\Windows\SysWOW64\Bldgdago.exe
        
        C:\Windows\system32\Bldgdago.exe
        282⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        283⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Bbnpqk32.exe
        
        C:\Windows\system32\Bbnpqk32.exe
        284⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8312
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        286⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Cdainc32.exe
        
        C:\Windows\system32\Cdainc32.exe
        287⤵
        Drops file in System32 directory
        
        PID:8440
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        288⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        289⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Cbefaj32.exe
        
        C:\Windows\system32\Cbefaj32.exe
        290⤵
        Drops file in System32 directory
        
        PID:8652
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        291⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8800
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        293⤵
        Drops file in System32 directory
        
        PID:8856
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8944
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        295⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        296⤵
        Modifies registry class
        
        PID:9080
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        297⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        298⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Ckedalaj.exe
        
        C:\Windows\system32\Ckedalaj.exe
        299⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8268
        
        C:\Windows\SysWOW64\Dbllbibl.exe
        
        C:\Windows\system32\Dbllbibl.exe
        300⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        301⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Dkgqfl32.exe
        
        C:\Windows\system32\Dkgqfl32.exe
        302⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        303⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        304⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        305⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Deoaid32.exe
        
        C:\Windows\system32\Deoaid32.exe
        306⤵
        Modifies registry class
        
        PID:9048
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        307⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9188
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        308⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        309⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Dafbne32.exe
        
        C:\Windows\system32\Dafbne32.exe
        310⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        311⤵
        Drops file in System32 directory
        
        PID:8888
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        312⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        313⤵
        Drops file in System32 directory
        
        PID:8376
        
        C:\Windows\SysWOW64\Dedkdcie.exe
        
        C:\Windows\system32\Dedkdcie.exe
        314⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        315⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Echknh32.exe
        
        C:\Windows\system32\Echknh32.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9192
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        317⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        318⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Ekcpbj32.exe
        
        C:\Windows\system32\Ekcpbj32.exe
        319⤵
        Modifies registry class
        
        PID:8288
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        320⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        321⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9336
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        323⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        324⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Eekaebcm.exe
        
        C:\Windows\system32\Eekaebcm.exe
        325⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        326⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        327⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        328⤵
        Modifies registry class
        
        PID:9576
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        329⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        330⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        331⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Fljcmlfd.exe
        
        C:\Windows\system32\Fljcmlfd.exe
        332⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Fafkecel.exe
        
        C:\Windows\system32\Fafkecel.exe
        333⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        334⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Fkopnh32.exe
        
        C:\Windows\system32\Fkopnh32.exe
        335⤵
        Modifies registry class
        
        PID:9860
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        336⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Ffddka32.exe
        
        C:\Windows\system32\Ffddka32.exe
        337⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        338⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        339⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        340⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        341⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        342⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Fdlnbm32.exe
        
        C:\Windows\system32\Fdlnbm32.exe
        343⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Fhgjblfq.exe
        
        C:\Windows\system32\Fhgjblfq.exe
        344⤵
        Drops file in System32 directory
        
        PID:8260
        
        C:\Windows\SysWOW64\Foabofnn.exe
        
        C:\Windows\system32\Foabofnn.exe
        345⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Fbpnkama.exe
        
        C:\Windows\system32\Fbpnkama.exe
        346⤵
        Drops file in System32 directory
        
        PID:9388
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        347⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Glebhjlg.exe
        
        C:\Windows\system32\Glebhjlg.exe
        348⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Gfngap32.exe
        
        C:\Windows\system32\Gfngap32.exe
        349⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9608
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        350⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        351⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        352⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        353⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        354⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        355⤵
        Modifies registry class
        
        PID:10048
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        356⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        357⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9364
        
        C:\Windows\SysWOW64\Gmoeoidl.exe
        
        C:\Windows\system32\Gmoeoidl.exe
        359⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        360⤵
        Drops file in System32 directory
        
        PID:9624
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        361⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        362⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Gdjjckag.exe
        
        C:\Windows\system32\Gdjjckag.exe
        363⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        364⤵
        Modifies registry class
        
        PID:9324
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        365⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        366⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        367⤵
        Drops file in System32 directory
        
        PID:9868
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        368⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        369⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        370⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        371⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        372⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Hcpclbfa.exe
        
        C:\Windows\system32\Hcpclbfa.exe
        373⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        374⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        375⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        376⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        377⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        378⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        379⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        380⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10492
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        381⤵
        Drops file in System32 directory
        
        PID:10556
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        382⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        383⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        384⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        385⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        386⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        387⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10800
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        388⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        389⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        390⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        391⤵
        Modifies registry class
        
        PID:10964
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        392⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        393⤵
        Modifies registry class
        
        PID:11048
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        394⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11088
        
        C:\Windows\SysWOW64\Ipbdmaah.exe
        
        C:\Windows\system32\Ipbdmaah.exe
        395⤵
        Drops file in System32 directory
        
        PID:11128
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        396⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11164
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        397⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        398⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Ipdqba32.exe
        
        C:\Windows\system32\Ipdqba32.exe
        399⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10268
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        400⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        401⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Jcbihpel.exe
        
        C:\Windows\system32\Jcbihpel.exe
        402⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        403⤵
        Modifies registry class
        
        PID:10576
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        404⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        405⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        406⤵
        Drops file in System32 directory
        
        PID:10744
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        407⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        408⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        409⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        410⤵
        Modifies registry class
        
        PID:11044
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        411⤵
        Drops file in System32 directory
        
        PID:11136
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        412⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        413⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        414⤵
        Modifies registry class
        
        PID:10316
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        415⤵
        Modifies registry class
        
        PID:10356
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        416⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        417⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        418⤵
        Modifies registry class
        
        PID:10824
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        419⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        420⤵
        Modifies registry class
        
        PID:11000
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        421⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        422⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        423⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        424⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        425⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10708
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        426⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        427⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        428⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        429⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        430⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        431⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        432⤵
        Drops file in System32 directory
        
        PID:10548
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        433⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        434⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        435⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        436⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        437⤵
        
        PID:11316
        
        C:\Windows\SysWOW64\Lpcfkm32.exe
        
        C:\Windows\system32\Lpcfkm32.exe
        438⤵
        
        PID:11368
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        439⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        440⤵
        
        PID:11472
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        441⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        442⤵
        
        PID:11556
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        443⤵
        Modifies registry class
        
        PID:11600
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        444⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11636
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        445⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        446⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        447⤵
        
        PID:11764
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        448⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        449⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        450⤵
        
        PID:11884
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        451⤵
        
        PID:11928
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        452⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        453⤵
        
        PID:12008
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        454⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12052
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        455⤵
        Modifies registry class
        
        PID:12092
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        456⤵
        
        PID:12136
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        457⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Mlefklpj.exe
        
        C:\Windows\system32\Mlefklpj.exe
        458⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12212
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        459⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        460⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        461⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        462⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        463⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11504
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        464⤵
        Modifies registry class
        
        PID:11532
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        465⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        466⤵
        
        PID:11732
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        467⤵
        
        PID:11748
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        468⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11836
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        469⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        470⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\Nloiakho.exe
        
        C:\Windows\system32\Nloiakho.exe
        471⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        472⤵
        
        PID:12080
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        473⤵
        Drops file in System32 directory
        
        PID:12184
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        474⤵
        
        PID:12248
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        475⤵
        
        PID:12272
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        476⤵
        
        PID:11408
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        477⤵
        
        PID:11460
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        478⤵
        
        PID:11624
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        479⤵
        
        PID:11772
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        480⤵
        
        PID:11892
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        481⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        482⤵
        Modifies registry class
        
        PID:12100
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        483⤵
        
        PID:12200
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        484⤵
        
        PID:12280
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        485⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        486⤵
        
        PID:11620
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        487⤵
        Drops file in System32 directory
        
        PID:11828
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        488⤵
        Drops file in System32 directory
        
        PID:12072
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        489⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        490⤵
        
        PID:11416
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        491⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        492⤵
        Modifies registry class
        
        PID:12000
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        493⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        494⤵
        
        PID:12116
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        495⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        496⤵
        
        PID:12160
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        497⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        498⤵
        
        PID:12328
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        499⤵
        
        PID:12376
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        500⤵
        
        PID:12412
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        501⤵
        Modifies registry class
        
        PID:12448
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        502⤵
        
        PID:12496
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        503⤵
        Drops file in System32 directory
        
        PID:12536
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        504⤵
        Modifies registry class
        
        PID:12580
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        505⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        506⤵
        
        PID:12660
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        507⤵
        
        PID:12700
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        508⤵
        
        PID:12756
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        509⤵
        
        PID:12800
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        510⤵
        Modifies registry class
        
        PID:12848
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        511⤵
        
        PID:12888
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        512⤵
        
        PID:12928
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        513⤵
        Drops file in System32 directory
        
        PID:12972
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        514⤵
        
        PID:13024
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        515⤵
        
        PID:13060
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        516⤵
        Modifies registry class
        
        PID:13096
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        517⤵
        
        PID:13136
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        518⤵
        
        PID:13172
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        519⤵
        
        PID:13208
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        520⤵
        
        PID:13248
        
        C:\Windows\SysWOW64\Ajanck32.exe
        
        C:\Windows\system32\Ajanck32.exe
        521⤵
        
        PID:13284
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        522⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10928
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        523⤵
        
        PID:12384
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        524⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        525⤵
        Modifies registry class
        
        PID:12564
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        526⤵
        
        PID:12608
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        527⤵
        
        PID:12668
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        528⤵
        
        PID:12732
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        529⤵
        Modifies registry class
        
        PID:12796
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        530⤵
        Modifies registry class
        
        PID:12840
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        531⤵
        
        PID:12900
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        532⤵
        
        PID:12980
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        533⤵
        Modifies registry class
        
        PID:13044
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        534⤵
        
        PID:13128
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        535⤵
        
        PID:13180
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        536⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13280
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        537⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:13308
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        538⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12440
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        539⤵
        
        PID:12592
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        540⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12684
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        541⤵
        Modifies registry class
        
        PID:12808
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        542⤵
        
        PID:12912
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        543⤵
        
        PID:13052
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        544⤵
        
        PID:13160
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        545⤵
        Modifies registry class
        
        PID:13272
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        546⤵
        
        PID:12488
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        547⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        548⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        549⤵
        
        PID:13080
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        550⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13304
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        551⤵
        
        PID:12648
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        552⤵
        
        PID:12964
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        553⤵
        Modifies registry class
        
        PID:12360
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        554⤵
        Modifies registry class
        
        PID:12836
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        555⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12896
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        556⤵
        
        PID:13324
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        557⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:13360
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        558⤵
        
        PID:13396
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        559⤵
        
        PID:13436
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        560⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13472
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        561⤵
        
        PID:13508
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        562⤵
        
        PID:13544
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        563⤵
        
        PID:13580
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        564⤵
        Modifies registry class
        
        PID:13616
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        565⤵
        
        PID:13652
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        566⤵
        
        PID:13688
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        567⤵
        
        PID:13724
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        568⤵
        
        PID:13760
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        569⤵
        
        PID:13796
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        570⤵
        Modifies registry class
        
        PID:13832
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        571⤵
        
        PID:13872
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        572⤵
        
        PID:13908
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        573⤵
        Drops file in System32 directory
        
        PID:13944
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        574⤵
        
        PID:13980
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        575⤵
        
        PID:14016
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        576⤵
        Drops file in System32 directory
        
        PID:14052
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        577⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14088
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        578⤵
        
        PID:14124
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        579⤵
        
        PID:14160
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        580⤵
        
        PID:14196
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        581⤵
        Drops file in System32 directory
        
        PID:14232
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        582⤵
        
        PID:14268
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        583⤵
        
        PID:14304
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        584⤵
        
        PID:13320
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        585⤵
        
        PID:13380
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        586⤵
        
        PID:13444
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        587⤵
        Drops file in System32 directory
        
        PID:13504
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        588⤵
        
        PID:13568
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        589⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13644
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        590⤵
        
        PID:13732
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        591⤵
        
        PID:13780
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        592⤵
        
        PID:13860
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13860 -s 420
        593⤵
        Program crash
        
        PID:13940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 13860 -ip 13860
1⤵
PID:13900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aabmqd32.exe

Filesize
104KB

MD5
e6cb01c39726d7e9f2e7d20cca57fff8

SHA1
952e2acd4dcd5ac4e67abd7c5cd6db359e19cbeb

SHA256
369611737357ecdb77997a437dfa2cf0f5cdaaa4626a936605ac0fd6e470c39a

SHA512
43c9e4930ade981314ed1d233b1194c48e325b615ac0d8dc0b463f1b7c825eaa3c793a1f6944da1ff00b0fae8b4bdc5e8220cdc8ce28164b5a7fb1f3965c44b9

Download Submit
C:\Windows\SysWOW64\Aahdqp32.exe

Filesize
104KB

MD5
20d70e136d922bfe81d3fa12d4e9e439

SHA1
c3a5a374a55c6713dcb2496ffa8743aad1ce31d0

SHA256
9ee846cab03fa6482c454d99512c69d1e110eec7129216c5e1ec345770fd730b

SHA512
f4ad2d6d48bafab4b76f7ede631aa480881801408961cf306c943ddd6f9bd187b6fec910a3089ee24b688de6199d78d7dde88185d9424d11403acef5d5710fbb

Download Submit
C:\Windows\SysWOW64\Afhohlbj.exe

Filesize
104KB

MD5
464a34a36b200ba76d6c47464caed32f

SHA1
266a71c5810cfdcae430b75e6f33803d62f6af80

SHA256
8c551c3f2818eee006c968edec7d9920850f906d6d55611beaa8b8961e588358

SHA512
2e714df0c22c691434120edcc4fdf7a0494488fbb15271fd26ddbfbe0bf747a9be071d1b64a8cb68d5ba44b53b632c2807c14581967608be30e12d907f55298d

Download Submit
C:\Windows\SysWOW64\Ahblmjhj.exe

Filesize
104KB

MD5
e429e61c3b1f73b525d13285525a1cc5

SHA1
efec1052644a4b5f6cce64cd05103e59c305957c

SHA256
e7c320f2e4d67594774bcba721543779fe8ed913caaa39bfef9a5d16ca066c33

SHA512
3e75cc6e9e6484ac379d8765e77cb3af4cc9bcf369595190c3a67be9ad18896d8e730e506985d804dc0401d11bc61ce876feb5bf31ae9264bc25da6c785c0070

Download Submit
C:\Windows\SysWOW64\Aimoln32.exe

Filesize
104KB

MD5
c6562730c08ff730d6732015334c4aef

SHA1
c0c7e965f91e87c9eac060cf8adca3e669704c2a

SHA256
1e6168a32ae76a94f45cd4aab1a9e7b95fff82cfc80c4b6013d240124cf98b8c

SHA512
54e5a743e04066b6c57f6a1509542c853cc4612e07fb31cfae169730c94bea84930e9de6e43f8fe4e46e2762154f29faa3c704ed69f12c8e9f5a83467da14cdb

Download Submit
C:\Windows\SysWOW64\Alkkhi32.exe

Filesize
104KB

MD5
03e0acce09b789b4bdb06d1d37537af1

SHA1
a82ce6495e36faf6a0ce57f0e8aa6d9312968b64

SHA256
671fbb743906f15a3578772db93f6ac1f280ab35534621bf204be773b7796fae

SHA512
ecb7b11e610957442e7182453b4ee44f73807880fefc88de78b98e02137effd88df0a4039316ef230c7dff9460e5d6dfab2937c60eea085400f3dcda38fe1d44

Download Submit
C:\Windows\SysWOW64\Aojhdd32.exe

Filesize
104KB

MD5
b512a324a10acc88402abab5b5e60ea2

SHA1
9eea3ca660949d6942a99fd670fd4c00b733b268

SHA256
49c394ff8996c68a77c64795e43b6dec104a22d4bd9a8edc8e78214c4513a409

SHA512
d038c93d77a0a8c0e838249a24d61556d997f2e4ac25446706963a83fe34a328eabe9b771a0ead66a76ed4d0775317fe98b88c3c0191b42dc1c2b275dd2d0448

Download Submit
C:\Windows\SysWOW64\Bakqfp32.exe

Filesize
104KB

MD5
87df9ce3d73caee4b65cfa25643da64d

SHA1
a9f965623903267ff6e08fa8bf7a6b1233edd9c8

SHA256
5adfc1941e819c6110851b45a1b6330edd4b08bc4cacbdadf689e8b2066b92a8

SHA512
8f402cd9b4f3ccf0df923528ec336d8276101e2620dc7ea034ec9e475a33b2e36b8856b1962950e8b31f79d92bf51c2a1db93da43dff67b961556f0fdd188f77

Download Submit
C:\Windows\SysWOW64\Bammlomg.exe

Filesize
104KB

MD5
17168c493da8486c2cbffbd2d32146a7

SHA1
209098adb578b6701658b5f07bd89d6f78e68a74

SHA256
c946bbca0a1b126ecec4e3f764246bd703c0ad9f8dd180d885516e75a7c1d612

SHA512
7ccb2571c094c3cfbc44255c7a383f070b68c0eed071b761292afc07598421255985d957897467f2dcdb06f589f5217450e1545bcdb5dce6bf40303289a1bb0c

Download Submit
C:\Windows\SysWOW64\Bbacqape.exe

Filesize
104KB

MD5
bde4bc9e949cbd9c0f5dc98f8f0991b3

SHA1
f78429c1aaacfc9073907fdd12a033845d5523cf

SHA256
c6309f36cad974fd8d8204d2074da1f56391f033d3d795db310795a48a6b5d38

SHA512
635530cfa77e48a007ad96f9aa0a9e5dc30944755a02f0386ff2f0a7fcc1e44c30b414eac8a40b5ae360e6ca66266d4267cd0909dc596c4dbbcf99e457cbf95b

Download Submit
C:\Windows\SysWOW64\Bbljeb32.exe

Filesize
104KB

MD5
73576bbaa88db8286935ceecfbe37748

SHA1
038f773ec5b7b49e00f8fae64614872cba181345

SHA256
708f3434fb49aba70dfb9395587095037a628cb091ab743b4c70bdd3d4924ddd

SHA512
c93335f652f42b027744b11e482ab3d4e29b12f37625128fb289723c7a7a679d11c0499a3e2b85d6718f6a5a8babc482b2849adc9c4d897f95ecd16d5247e435

Download Submit
C:\Windows\SysWOW64\Befmfngc.exe

Filesize
104KB

MD5
1a10c2bc43817eaba50e476c5eae0130

SHA1
22382dc276bb8e2ce3c36102c3e5917bdfaa6782

SHA256
db628439150cec2549d4d0624ed0e3fc1b61112fbb5d6887b54ecd42eea580ee

SHA512
c9dd59b9db09a1cd20e1596524ac518b6b78319c60fbde8b2e08ef5ca23b2e72dda7bb501137fa6b1ce80af5ffe210b31e4afa678db0ed1dc93bc8c6085fe7a9

Download Submit
C:\Windows\SysWOW64\Bekfan32.exe

Filesize
104KB

MD5
65e0237bdbc4f3970d108cd2f23bedf6

SHA1
5f0331e826a312c11fb3bb9f29605c179b093f44

SHA256
f8b350ad5661a1ad6104199c8ed7c012b3bac20acfac729254f6bc3e1af6588f

SHA512
bbad95f71e94f2f13065efebf4de97f4d7b9e159d3e36ed628904cfaf529f8131adcf83d382202ae263951bc5e7f86533fb2b8e701d3a0a6af9149c576ed8058

Download Submit
C:\Windows\SysWOW64\Bemcgmak.exe

Filesize
104KB

MD5
da9112f24759decbb4382ec04116b771

SHA1
0d4d397309cdf274b88637d3fea91757e5945ba5

SHA256
2c33c3b84dc905cc4bd0478172a0db26cb55e5c44f22d4aa548122e38328e413

SHA512
a0ca7bd1aab4dab697fbc20a45f617eeec00cc66b9a4d35ab91c3d59c57f3de310402b113372797d27b578f6efb35c8fb8c99a83c15138fd3da1792d64aa3473

Download Submit
C:\Windows\SysWOW64\Bgcknmop.exe

Filesize
104KB

MD5
6ee15fbbdf7719d5caba40ddd2c8cc6f

SHA1
1737bfbd298b3a336409ea3e696f4e52643ec245

SHA256
94ee7eca8dd3573b1f853fde494a641f6fcdf0a26384ad838127dd988171df25

SHA512
16e797d291278f053e4616a93204398c58fa0b5ab32dd44fbd4a04cbab400d0188bc5319b0d1f8f3845f77b86f4f5e3e96b3db19a01612a4f50e883d95af5c14

Download Submit
C:\Windows\SysWOW64\Bidemmnj.exe

Filesize
104KB

MD5
6237a9fb6b686369c8e5fcb6a9e07c8f

SHA1
000a4595e881b11633841a359fa535e50633055d

SHA256
24fe3507622cf725816fa9e62347d9055b7b97a5422f809e11cd2e2f7879cc82

SHA512
c4de0dbec3729275e35454cc0aa31be916af2b6c251ff8d922db897bba542458efa34b3acf89e744063458cd2b32d0469b75712695e543d45972f5728859cdf3

Download Submit
C:\Windows\SysWOW64\Bikkml32.exe

Filesize
104KB

MD5
986c4cc52fd06ef575b77ead04a3167e

SHA1
7464abea670152e338681354532724a4efb6520c

SHA256
f65f58246b86e47060729b386463cb67d19971f708f4f0353aa1ac71abf9ee24

SHA512
b908d73ebcded81f541751bdcb179666d21947672be87550d8ef6c2e34938b21592e9c14118608f201a5c6bba542b613fa09f6d70910153d3fd8cfe82c304c68

Download Submit
C:\Windows\SysWOW64\Bjddphlq.exe

Filesize
104KB

MD5
a0b6b02518d9cef99dffd843171c91b9

SHA1
8d89874a79344fc3eb189646e10b0906a06f9269

SHA256
4502cc04d9b73fae61064c92cf8f9464cd235236885ce968d033de9d06f0d79e

SHA512
7f58cb0e1b92f81725c4475ead85c3fc6d43aabf9972450ad3ff4e31a0e866300ed90ec14d435bec192bf0910665577abcd9cabac242401975248b369720d08d

Download Submit
C:\Windows\SysWOW64\Bjmnoi32.exe

Filesize
104KB

MD5
daba019d621fffb7fa4f7c330ba6cf55

SHA1
f98e549fdc6064e875a9235eecfbd8fdafbcdd94

SHA256
5d9e0c6f056fc9a00a3cafddcdd6f48b09ee13bee56d57d39f5281b8b04b34a8

SHA512
c3290e33f0909e9c02d8adeb1b21f5bd13f5a0bc7efdacc8b07e36284e0803e23699f1fe3b0076179306e738bb344ece145a0b3a6465a265607c3e8f5a9b66c2

Download Submit
C:\Windows\SysWOW64\Blbaihmn.exe

Filesize
104KB

MD5
8effb04a48ad77c445d4d7375b6d3378

SHA1
85ce68e2e79f55d6c185cdf5b147b985c7038517

SHA256
ecda75423aa9b6b184276d8d5d94c47124102b2ea09c72b40eba925b5758543d

SHA512
ce204f86dad2813a00a227908940d1d72cb9e2edf76756b36d8b93fb781f6321f8b7698a07886311f170e072f4679538d6e24102d13381e73a620b90cdc397cc

Download Submit
C:\Windows\SysWOW64\Blbknaib.exe

Filesize
104KB

MD5
706fe3589031375de33f61907ec81633

SHA1
306917d59f0930e63c8787b3b1e9dee1aa70d620

SHA256
1e7d1c7dd4fd3c1a21afeac02b7333222ed8b1dab45eacb81eb850bcd90360c6

SHA512
1326b66d8571cba2caf82eb3cbe5e92b9dcd383798d05657a7ff1054beeeda0f27128f790b719b4d2700285279fe5e3e6b78c512d09c51d2514778b0d9d8ad77

Download Submit
C:\Windows\SysWOW64\Blennh32.exe

Filesize
104KB

MD5
b66633e60e65bc709ca977bb7cf4ab2d

SHA1
9991ca528d660d507d67076d8e386fa08a6e980f

SHA256
15be8643c4950fb4ca8f5ae1113356340de9b51521c748fedec9ecbcc9a25c42

SHA512
14c624784e52e268c2bb3a54f7092e4ef347917ecfa8a69c87d650352df84c9ef50e3c5a47af9382ee3a1058905a1d98120bb1832e7157167dab4275ca37af15

Download Submit
C:\Windows\SysWOW64\Blpechop.exe

Filesize
104KB

MD5
735ed275e7ae691919536aaea50ade0c

SHA1
acdcc05a6072ddc0dfe281b0dd3d12abfd401c56

SHA256
b8eecd163490864ec588e347ebb13558cf5ea4f0c4adac5455e16ab53fdd547c

SHA512
2ebbe32798ea1b86683852927207475fe2fd1ec76a5ac662c5a76aa97c30697fb0e5ff2d48a1c35f35e609291f3c96a9bed3b618701f613ca89395aa715c933e

Download Submit
C:\Windows\SysWOW64\Booaodnd.exe

Filesize
104KB

MD5
f1fe865a62eeab561d009a054f390e6e

SHA1
4a4f97a75fa006d45a6052dfbe22255d105580fb

SHA256
bdd19f3afec4eaee372696c90f3250b3bade44dfe5a226278a03ab79cce7e36d

SHA512
e63ba18f92a2b435349871aa6755e3a139624ce8dd43bcc51de1194f764bc43d0a754c79d651592696b0038359ef3d5ff613408a6170f20a70c912bda74f6ad4

Download Submit
C:\Windows\SysWOW64\Bpcgdfaa.exe

Filesize
104KB

MD5
16fa1fe1fd3ee21863843c15e2cc55e7

SHA1
8bdf45131b40b52a51f48b92f5f73f04d77cc336

SHA256
0c329da1e6898bda2e0e501528975721beba7dd10c151b2d79adbcf30e9781b2

SHA512
d09f0930588d265a735a921c3d3cceecb16e47da209af8ca3ff7b459e0f302771853979f40f7e6fc097c2faed2fb25393eb042b53ac7671ce6df41beb61c408d

Download Submit
C:\Windows\SysWOW64\Bpidngil.exe

Filesize
104KB

MD5
aa754aa51b27bf23a9f3916b9690a35d

SHA1
c87f3b52adfa2f5b6a80395b16b07c780170cd65

SHA256
12abb9210304ba82d9e1ff5730d57c40925dab06736fb0d19a07334a384b96f4

SHA512
e9074f7ced52f46337301d71435cc29f07d7083073df09888f44ba6f05388c5f626278cb636692bc8d352a557151d3e0d8ff187ee95e8faa64a8858eed539cc7

Download Submit
C:\Windows\SysWOW64\Bpqjofcd.exe

Filesize
104KB

MD5
e78fbd913f5e78e59ab743ff196a9748

SHA1
589985a6673af22ef0366001159b36a0ad42fda4

SHA256
f8b83917248dfb1796f2a7514f7d339b4d9e873c4ea6b363dc52c175b7740032

SHA512
9d6a44a83961b812a7e9f22abaad35c82786ae7e1c5d85f3ac80f335ca166e02105f0565fc7c27f5941544f20dd36fa1fbe46e350262d9551c90a9e8db889f1e

Download Submit
C:\Windows\SysWOW64\Caimgncj.exe

Filesize
104KB

MD5
9cea2bac3ff27824a68162a13af23eee

SHA1
039f43c23ec0adaf1b3587f7cd799aacc1c96c9f

SHA256
dc6128f5cb81f815a2795bc9d775f62d3a3ac66902b7bfd6c8bd5600248574d6

SHA512
105ed1465bac5b09445d5ba66da75a7ebf2a5c2469aecdb31e35709da14c0717eb1d40f37ab5a29e5e6d993bc5687aa98c4c6333b6323fdbff4897b30af2c0ce

Download Submit
C:\Windows\SysWOW64\Cccpfa32.exe

Filesize
104KB

MD5
92f4706dd26fd1d1e60fb0cfc1bac69f

SHA1
a4c6e093dd9aa28a4525ff6b938122f143099c5a

SHA256
fb980ff14b6fbb49d683d221ada7d2379805199ee9fe362fec82caeed21aabb2

SHA512
d26677bd4f23e4f6b1911cdb07a4f5b9c5b121301d9e08588906063bdb420af05df0dd94ec49cbe048cc6385cb4d032b6f8c17ce558cf5af7a84004a64647244

Download Submit
C:\Windows\SysWOW64\Ccjfgphj.exe

Filesize
104KB

MD5
20cdd0c0230ea2b9a4080355bbe0048a

SHA1
ffe7b13bad0d235d77a6fbb6c764cb947c22b6d4

SHA256
7002c3ed2f2b8dff4d14b4664ac721931528452c3dfd3ce00a4d4c6dce99d9bc

SHA512
58ade665bad82d5c5734a661541150092671ef4d5ef14c3a3eba5f3ea5398db5835f3badb4be5faab6f15e6796e0301187bde282fe59e56dbfb308edf4389f45

Download Submit
C:\Windows\SysWOW64\Cdainc32.exe

Filesize
104KB

MD5
7a2e3721e37deaf39c8030fb2f6e7fc0

SHA1
3933f32f8c20c99f3f43dfe39ea24b70f1444bee

SHA256
b437511d9b8c33c0a834ecf6ee81fe278095b5e8a4415033a097d5e9b269bf16

SHA512
2104f1179ad6234f1fcebc56ea7975a1c0d8ef388589f51f789dacb57c3c6dd18afff078520d72359c6d7422596dfdce14935623a33439fc2326fdf4ff5947a0

Download Submit
C:\Windows\SysWOW64\Ceblbm32.exe

Filesize
104KB

MD5
6a36073d5654b425a5bed801d761800e

SHA1
ca9f8e410ff7e74d0f346c984d5ca0bfcde64233

SHA256
6f7561815ac7d0f542ef1acc50a84202385c27d4b282f36e8ba18a8e2a9444b9

SHA512
3133c6ede02ef5d8cfb2e3e121ad4757c10f64c433354afde28da7f5cd0389ae284fb36493bba54c2b0780217fc6aae5949e180c962bed9106527c2012b94da4

Download Submit
C:\Windows\SysWOW64\Chbedh32.exe

Filesize
104KB

MD5
d85c5a7dfe84ff9fb73cad27bfa7512e

SHA1
8f7dad5c226e5186c5080afe687093f3ce96088d

SHA256
f7d3aa1714e4cbd09334277f40e70ea7f3b8f2efe54c211ba609f5c4891ba84a

SHA512
d13850a8fd3070f81d1c4b2232d90bef8e45066bf50cd1ec902744fab2cfc229f19ae63667b5224657612ecc7ef1bab595f07b527409c753d873d58d8414e3ef

Download Submit
C:\Windows\SysWOW64\Chebighd.exe

Filesize
104KB

MD5
f522121dc81c135b4dc2c9872f3d3d28

SHA1
549813d25185f8ec5b1ff23a52e7acc7bb041a83

SHA256
ab628de9db6479a914a1987330aaeaed80f1c602f8c24a49644c78031871c43b

SHA512
25df5509c8464a70cde1b7655fe175f80cf95bd4f38b4b469ee52b8d066e963640bfc496119b296fe50b4db0721a2e0c96acc0efb1cae5989af93010634df7ab

Download Submit
C:\Windows\SysWOW64\Chphoh32.exe

Filesize
104KB

MD5
13ac2f27f426bd551f5306e0c314332b

SHA1
b37087ef6a3fd5bbf2def33c1568df4f4a319e72

SHA256
85c2186ca9d1db6747a30ec1ce4fa10c8faa505823d00cbbe5c32e1cec7ec963

SHA512
1a7bd1c7268fb0af606801c36359a858dd88c6e6b5d55802aa060f1138c941973b9bfd8f82fa3c20eb4097b97f4db4faf8a1c01f2840a9172ac1d07789bfa10f

Download Submit
C:\Windows\SysWOW64\Cjpckf32.exe

Filesize
104KB

MD5
9442151b94f814add13db7943816cda6

SHA1
93bcb410f5f4931276c406f1abe1c432dfa03c70

SHA256
e0f922aae3174f074d4f4e103ccff92acb6677fbb263d4a177151d4c025db40d

SHA512
283e376309def4295cdfad660b88127d53e72d655339cb42c87138534e13ef61a6215a8a9bdba0bbbb047f146c24ee28825327deb2ebf4e50b61ba747e254938

Download Submit
C:\Windows\SysWOW64\Clckpf32.exe

Filesize
104KB

MD5
fbe5482ab8c7b8677dcce7b2dbdcaaf2

SHA1
5ec7fb736e21ab8d54dbf025f7f81c224c3b1690

SHA256
0b4708dbece3dca79ecb46e32623c81da7aed7570d1146a36739df1f8d2bee59

SHA512
d104176babed4bee7da206a88de654ecd33e17a889d504379ca34079731fa9fe4c34cadda682b59e8586781360d04dfb8f2d4ae7da7086a3d2ceb3a1c6d8ffc4

Download Submit
C:\Windows\SysWOW64\Cojqkbdf.exe

Filesize
104KB

MD5
85589b1cf71a478cc787ed9373c04ff8

SHA1
fa71d594446f2ac6af564222acdbee0c420ba56a

SHA256
cbc6c7b38687c5700c05c944806e35b941dfa543b517e4ff91c268a96eedfa9b

SHA512
4a9b07fd0517c7d1e6d23ffb76f38c3ecde5e957e3f62054966507a6a60c996ff8fe04152d987b00b6413da6e13a3f6efb5a1949d8b4b13076fc369d6537cd2f

Download Submit
C:\Windows\SysWOW64\Cojqkbdf.exe

Filesize
104KB

MD5
a0a35908bb5b1f5a46030ae54ab65cc5

SHA1
1e05f20db9002ac689eb2eca2f32dfa258a393ea

SHA256
a4bbd47e1442381682fe1ccafa2c60205b6b40de5c7a1d7aec0457ed4a93539f

SHA512
cde454b7dd45ae694170bbc33a9ae285ec269f4853320604f9402ec7853c63ebbe8fa474706178b2dad75a1448bb4e5543c019bf348d81c71301eedbb5296f40

Download Submit
C:\Windows\SysWOW64\Cpedjf32.exe

Filesize
104KB

MD5
abaa88c98236386c4dddcb5487c84a78

SHA1
21e8eb8e4d589ed74e6ad74c57ca3ac9122f3fd7

SHA256
653967f6ec02b2f1d1e0612a61e2e976ca6628d816f4d1ba307696ac18ab915d

SHA512
e0ef1191f29447ec6dea59f9bb6c12aa96f4be960bd83210db84815f545a42a232f93fbb2b21562261354ca4927af9b8f8596dbaad60d91055007068504b43fc

Download Submit
C:\Windows\SysWOW64\Cpjmee32.exe

Filesize
104KB

MD5
f158e2b062c7cc44f53b0ea36a5e00b1

SHA1
2b1124b6d2d00bf2f846b632cba4a6edb1ed1950

SHA256
23d5455652c8e2059b05379ebf03b7cb619605bc544007ab5531fbc94c32c1d6

SHA512
8bd26f5a5a66f9b51a9d5b0282967c1417384ce4248257bae09eb3c6f5a9ed61b1f0d55a2b350c2d9f5a80138a153dbbb97b860e9623479b04e7e4f9fc1fe651

Download Submit
C:\Windows\SysWOW64\Daqbip32.exe

Filesize
104KB

MD5
9b05a13844c781516d4ba6e0269374ce

SHA1
110b445ae4f679024586db214a9cfcf0066c2eb8

SHA256
c087acaadcf6c8afcc4f025d807a57ffa963ce8c48d66a31788cbb533fd14c1e

SHA512
88a4716a5174ec2cf00e217ff738b1cfbd9b95404ec981596e987073b91fc5e73947fac65d8b9cef7f575f8f7ba0fb0d205d1d1669a915de4f2aa797130fc3ab

Download Submit
C:\Windows\SysWOW64\Dceohhja.exe

Filesize
104KB

MD5
9ea369912b6f6fb72a9a0402da3899ad

SHA1
7647a87cdce8b619abfabbb7261f8c72ba45f943

SHA256
e57c76218c6e27b0d056ad47b354f74977858bc354664d476b3a7dc888929e28

SHA512
d26a768bd5ec7142437605374e5304ddc737d9e9077060bdd85833b309e32fc546463952b267a1ffda37f6ac28ddd963c5e57e51bde65302f27b23f495c5b174

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
104KB

MD5
a4e0c3bd444f888ca1692d9831ac8d34

SHA1
e72bcac624d2151ce3471a09c727d99af0106949

SHA256
dd1c3c34f15550b9e779a67389214b3304f04c3ce43dcbc369b750180c6c1b8c

SHA512
8bbbe7e83db77dc6f1ad0dceaed71d1893a3f7a74cf6e9063e019455a7d1ab483e2e27fc23d1ef730b2191d8a4d848e73cfedb2d1a8a752f8e60ffda80b59042

Download Submit
C:\Windows\SysWOW64\Ebeejijj.exe

Filesize
104KB

MD5
60a025579c20c55916c6bb4923d0002d

SHA1
0e1bc087f4301fb3347c324cf60177d73cbd4aa9

SHA256
361ec9116e8444c9b5c6412d29e7ef936f8d3f884053ac279aed2472ef5d4a59

SHA512
c4802b5379e1cc051481637e054eae78a5ebda59ee1a43a9e824610efee609d50285b6b466cfcad141b31d194ddd5ec9887868b5de9e93aec0daec1d5120c0fb

Download Submit
C:\Windows\SysWOW64\Efikji32.exe

Filesize
104KB

MD5
130445572bf4f401b554523a2554a409

SHA1
dc3c21a067ae9bf2f86b50413813888767bd17e7

SHA256
6235215e5ee1773d3a1b29c403bfac2674f5fdb0d6f77155ecbc6fe3c012130a

SHA512
93ccdbb9bc7e4b07fe0e0440cf320855721310b26af39a0f9c20bf552aeebc165c4f681597cd31dcfe1d4441638c0f2d20f3b342df84530a9011cb63f699057e

Download Submit
C:\Windows\SysWOW64\Faqcbg32.dll

Filesize
7KB

MD5
ded535277862275560825b98d6278630

SHA1
85315740478708c3d99b0aa899addc35834d5111

SHA256
039a5ac618a9058173ea4f35ce5762a1eed5ce26e0be149551c28000ef8c0f1b

SHA512
6a074506c143ef5248e020438021b6570e8fd56138a3008bea84fc2c4e345b8ebce07b6fb54294e9edb88b50f52801c0e0d5fcacf4c4e5f4e2dd36ab5ba713e0

Download Submit
C:\Windows\SysWOW64\Fbgbpihg.exe

Filesize
104KB

MD5
0f2e3644791e738c436dcc888a938e0d

SHA1
935afe0b3e3f51f3ee3344f344b361c0c54a0801

SHA256
a324ba92fa531fd1478573f0e5bf00b1939795f04a7b8c42530d8101f56a117b

SHA512
9e205c3162773157e9ce4315f064a5b5051606382ea2898432e2a66495a59875ae3d28b7ea80ab3561ed9c4aed133b5f8c615e83a8711bd8a30a2c1e756aad2e

Download Submit
C:\Windows\SysWOW64\Gdhmnlcj.exe

Filesize
104KB

MD5
a6790a33eab32dbe2a20f8894c6cc971

SHA1
df964d5f5024e1e3105ca5d819b40617232fbeba

SHA256
c894651ebdce40fd9bc98e975e012dc66d3cdf96b25713021ad6ddca583c40f5

SHA512
49d29c4a95e90eedd444a0e978f163b7f665cf8e0cff7a6d171f2f9ea52c2fd8337c304271a068e098a684ec837eec296318cc85725c7b38cb3d2fb854297f9c

Download Submit
C:\Windows\SysWOW64\Jbhmdbnp.exe

Filesize
104KB

MD5
4cfeef3f2f16ae7ded7a539d5a7c8e3a

SHA1
905818310eed11aa7f17bfc7ddb23129f49fa055

SHA256
2d68c972e58db85cb49e824e6a7ea5390b2ae9cd0167c47f8cb80ea364ae2488

SHA512
53819a97375ce356286f30d77f35b4b249bc5911c53e7396d1dfb55537319b671796dd0c8b54fceb6ec0c721e64867b62da618ebd14b854077fe4aec392a0c9e

Download Submit
C:\Windows\SysWOW64\Kdgljmcd.exe

Filesize
104KB

MD5
8b54a8684f768fd5831ce89a6ec81c9b

SHA1
92dcc13ae9835350f2cae96282bcb2ce4f1187d4

SHA256
34c48ebb2811cd2cf02f83adc894cb590fe7eb5e6a9c6b7d669656c7215d9869

SHA512
e095b9510f4275b40d0865670d8a5fa06c4bbee3be7e7a36b68f04afe5dfcf2dc63139e3ff12478803c7b0340b7a559621397488d921683c8c45b82367957b56

Download Submit
C:\Windows\SysWOW64\Laalifad.exe

Filesize
64KB

MD5
4f3b21401a46e1f616128e82c456d005

SHA1
153294300aeaa5b84d8e5e59c5f0ee214f984d61

SHA256
9e8a257c5c9f339cd6ef7b8664558c984e8e968f0e22660e4c8c4a2ba80700cb

SHA512
c46d153a473193f8ef99a67cc243230bcd57436a16e741f738720ba3371531acca46c48ecd344f545784e4fd77fb8ebab45679fdcb7562b3af4ca4cdd6a40be3

Download Submit
C:\Windows\SysWOW64\Lingibiq.exe

Filesize
104KB

MD5
b11b74eee0818adaf1f90042998d181b

SHA1
ba7e9f10247cd83546a892a5c141245fd72335e7

SHA256
13ff076d82c7eeddde5dc2da87da7c7044cf1dae01abe0dfa9f12bcaf5f3c785

SHA512
15a999bad13687bec99b6962511e7eb0e33de4da3e0b935480767415cfe76a28ef10e38204565971f2fafd1574336247ad5f83da206460c7dd7d53b9075b6a62

Download Submit
C:\Windows\SysWOW64\Mcnhmm32.exe

Filesize
104KB

MD5
020e7b5bca1671b58f3dbd3bfe7209f0

SHA1
3167b71e23e54bfafe3f72ffc2c15f3c3e5ecfe5

SHA256
8b4eb79aead2e080fd8d26564000f1481b8144f27d11c4e979498941b2342e84

SHA512
e6a38ea30448a06a0d63556b31195bf8987f2a9c2fb265ec046761c236575aaf1189a82837ab1ad55d68b284469e34d4f00114b58c86e826b094a81fdd54e67e

Download Submit
C:\Windows\SysWOW64\Megdccmb.exe

Filesize
104KB

MD5
347287328239038c4cae590d15821b0e

SHA1
f0abb47efba5da9b5d5e16fef51c62bbfc970d8a

SHA256
eb757e19cc2efa2e523d3f98a085f89d90e917ca1c4328e129e5cbd93173f742

SHA512
fa3989da26ab772fca17e357f24c939a2a1fb87a3bc2a285af9a154f780d8966140b39a1592a8e7cc9e8b982bb877cc41210e1c808c9c413f00384348bc55f32

Download Submit
C:\Windows\SysWOW64\Mpkbebbf.exe

Filesize
104KB

MD5
66baa455af9e6ca1ed6c10843819d23d

SHA1
7cb8ae1e8d8b2392ec9c5f033b2c94beb1ba485a

SHA256
f63482d30bfbe9057ec703263594710f5c467cfd925d88cc5fb31cf226be09fb

SHA512
53ee28f5785a2a202f51e4fdcef917bed83bd1f88bf8af2aec4031c1a3ab2bbdb8687916c9cc3f5be369cbeefc48a196327a447011fb499552a299a1e09fbe88

Download Submit
C:\Windows\SysWOW64\Odapnf32.exe

Filesize
104KB

MD5
cb465e172ac36566bbbcdf69bbca2f91

SHA1
767659f472469b1f4e8a287169b201e4d3969b2b

SHA256
860d39293c08c7382a65412aac637e449e1148c9c47ae038404b936ebf54503f

SHA512
254f10e7fb12bcfe893a1c9ec16b296e9154162f03648f525080f18c65c3f98a1c22bdc211caa588e9938508b8d7bfc2509ff781475a3739c0249faad2a49a1e

Download Submit
C:\Windows\SysWOW64\Odednmpm.exe

Filesize
104KB

MD5
aca9ba3e0404a7eeff165de827559d54

SHA1
91ad2323f18c51e1cf7617e6d3c535e9c83dea25

SHA256
1dfff81bdc893a0027abe9ede12a29c1a3bf10107c2f7122a45d5e37cc3eaf6e

SHA512
dd0863697b84086d558da66c4286ab6154a401b6e513f9bcdb15e6cb5b067133d9cd189cb1e0484df5c8a87450fb57e7d643d81a8295cf940bdcf96dad8d34e9

Download Submit
C:\Windows\SysWOW64\Qgcbgo32.exe

Filesize
104KB

MD5
4e07c1b09c8d2b967d76a97ec0e948d7

SHA1
93ff6c87b0d733ec987f27fb154a3a17c770e854

SHA256
e7e645714306026c2bbf60c35744cf675b08938604e5c81486fbb6fa11656c27

SHA512
24d1e950ed589a8c75441fe9ce0e90a9a273edc4e7a1efaba6b0717869ebb704a34818aeb19dae376688f39b275e7b0bbd19b60df57b76a1467203709212dffb

Download Submit
memory/316-352-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/404-135-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/432-268-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/688-412-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/736-278-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1048-398-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1144-292-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1292-200-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1300-8-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1424-143-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1596-358-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1684-286-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1716-280-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1744-266-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1792-168-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1844-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1980-228-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2036-334-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2076-382-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2124-60-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2152-72-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2204-326-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2284-192-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2692-64-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2724-442-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2884-370-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2924-156-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2996-215-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3160-47-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3192-321-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3244-424-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3268-231-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3308-346-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3328-364-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3568-261-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3688-16-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3764-23-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3800-436-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3840-388-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3928-176-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3932-247-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4064-418-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4072-128-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4088-120-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4144-103-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4200-36-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4204-406-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4324-160-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4408-208-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4520-42-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4540-88-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4576-244-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4624-95-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4648-112-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4672-332-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4804-298-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4880-404-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4884-340-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4908-184-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4920-430-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4976-376-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4980-314-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5044-308-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5080-82-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads