3f8bd3a52e11e4af76580ad573ff0b78f9ae230782636ebd2e8628ed2c87303e

Analysis

max time kernel
118s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 21:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f8bd3a52e11e4af76580ad573ff0b78f9ae230782636ebd2e8628ed2c87303e.exe
Size

400KB
MD5

1c56cfa2920ee005d189b3971da2034a
SHA1

1e9d7d13b98125b474bc2fb63cf121e3125f0e00
SHA256

3f8bd3a52e11e4af76580ad573ff0b78f9ae230782636ebd2e8628ed2c87303e
SHA512

66d623288bfc26d2b08fab0e6bbd0b33fb171e4f34888d428ed2ef8c0a0d74b5bd010755fb6cf78561f9c501040b1c84abe251c8591c7cc95fa276ac463e00ac
SSDEEP

6144:XGtpjwJojvl8ZVoBqvl8ZV4U/vlfl+9DvlEZV4U/vlf0DrBqvl8ZV1:opMojvUgqvQ6IvYvc6IveDVqvQ/

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Febgea32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbqlfkmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckpjfm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dahode32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Faihkbci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djpnohej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dpjflb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eodlho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iikhfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nepgjaeg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgioqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcmgfbhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bganhm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cagobalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Clqnjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpjjod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abkjdnoa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Conclk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kemhff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olmeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icplcpgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfolbmje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdmpcdfm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlgmpogj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edihepnm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcmabg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ncianepl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdcpcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkfkfohj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldohebqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfankifm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnneknob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpenfjad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pnihcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajneip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imfdff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kipkhdeq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Belebq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icgqggce.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgdbkohf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkdggmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dllmfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Goiojk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncfdie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdqgmmjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpocjdld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onklabip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dadeieea.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhcnke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbdgfa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nebdoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icljbg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icplcpgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpeiioac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqpnombl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbjcolha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dcopbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqkocpod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oqihnn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qcgffqei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcdimopp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahkobekf.exe

Executes dropped EXE 64 IoCs

pid	Process
804	Commqb32.exe
872	Clqnjf32.exe
1960	Coojfa32.exe
1080	Camfbm32.exe
3672	Cidncj32.exe
2140	Clckpf32.exe
2884	Coagla32.exe
724	Ccmclp32.exe
3772	Cekohk32.exe
1884	Digkijmd.exe
2424	Dlegeemh.exe
3632	Dpacfd32.exe
2616	Dcopbp32.exe
1460	Dabpnlkp.exe
4236	Diihojkb.exe
984	Dhlhjf32.exe
3416	Dpcpkc32.exe
1808	Dofpgqji.exe
1732	Dadlclim.exe
3348	Dephckaf.exe
3084	Djlddi32.exe
3480	Dljqpd32.exe
1856	Dpemacql.exe
4196	Dohmlp32.exe
5024	Dcdimopp.exe
396	Dagiil32.exe
4088	Djnaji32.exe
2308	Dhqaefng.exe
3048	Dllmfd32.exe
2904	Dphifcoi.exe
3520	Dokjbp32.exe
4508	Dcfebonm.exe
2260	Dfdbojmq.exe
1240	Djpnohej.exe
1488	Dhcnke32.exe
860	Dlojkddn.exe
4544	Dpjflb32.exe
1468	Dchbhn32.exe
4804	Dakbckbe.exe
3168	Efgodj32.exe
2176	Ejbkehcg.exe
5004	Ehekqe32.exe
3152	Elagacbk.exe
3276	Epmcab32.exe
1580	Eoocmoao.exe
4616	Ebnoikqb.exe
3012	Efikji32.exe
516	Ejegjh32.exe
4420	Ehhgfdho.exe
4488	Elccfc32.exe
4928	Epopgbia.exe
3692	Eflhoigi.exe
4360	Ejgdpg32.exe
2068	Ehjdldfl.exe
3644	Eleplc32.exe
4596	Eodlho32.exe
2608	Ecphimfb.exe
3924	Ebbidj32.exe
4556	Efneehef.exe
4120	Ejjqeg32.exe
3936	Ehlaaddj.exe
4324	Eofinnkf.exe
1976	Efpajh32.exe
1220	Ehonfc32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Fopldmcl.exe	Fqmlhpla.exe
File opened for modification	C:\Windows\SysWOW64\Lkdggmlj.exe	Lcmofolg.exe
File created	C:\Windows\SysWOW64\Fiknll32.dll	Febgea32.exe
File opened for modification	C:\Windows\SysWOW64\Pjhlml32.exe	Pgioqq32.exe
File created	C:\Windows\SysWOW64\Dldpkoil.exe	Dekhneap.exe
File opened for modification	C:\Windows\SysWOW64\Hmjdjgjo.exe	Hioiji32.exe
File opened for modification	C:\Windows\SysWOW64\Pfolbmje.exe	Pcppfaka.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Cbgbgj32.exe	Ckpjfm32.exe
File created	C:\Windows\SysWOW64\Jcinbcgc.dll	Ifefimom.exe
File created	C:\Windows\SysWOW64\Pgioqq32.exe	Pdkcde32.exe
File created	C:\Windows\SysWOW64\Fojhkmkj.dll	Lmbmibhb.exe
File created	C:\Windows\SysWOW64\Aahamf32.dll	Acocaf32.exe
File created	C:\Windows\SysWOW64\Aeopki32.exe	Abpcon32.exe
File opened for modification	C:\Windows\SysWOW64\Gicinj32.exe	Gdhmnlcj.exe
File created	C:\Windows\SysWOW64\Jjbedgde.dll	Jefbfgig.exe
File opened for modification	C:\Windows\SysWOW64\Mpoefk32.exe	Mmpijp32.exe
File created	C:\Windows\SysWOW64\Boepel32.exe	Blfdia32.exe
File created	C:\Windows\SysWOW64\Oapgek32.dll	Conclk32.exe
File created	C:\Windows\SysWOW64\Fhjfhl32.exe	Flceckoj.exe
File created	C:\Windows\SysWOW64\Empblm32.dll	Ncianepl.exe
File opened for modification	C:\Windows\SysWOW64\Bjddphlq.exe	Bfhhoi32.exe
File opened for modification	C:\Windows\SysWOW64\Aegikj32.exe	Qbimoo32.exe
File created	C:\Windows\SysWOW64\Dkoggkjo.exe	Dhpjkojk.exe
File created	C:\Windows\SysWOW64\Gbbkaako.exe	Gcojed32.exe
File opened for modification	C:\Windows\SysWOW64\Kfmepi32.exe	Kpbmco32.exe
File opened for modification	C:\Windows\SysWOW64\Efgodj32.exe	Dakbckbe.exe
File created	C:\Windows\SysWOW64\Eqbmje32.dll	Laopdgcg.exe
File created	C:\Windows\SysWOW64\Ncldnkae.exe	Nqmhbpba.exe
File created	C:\Windows\SysWOW64\Gebgohck.dll	Leihbeib.exe
File opened for modification	C:\Windows\SysWOW64\Cidncj32.exe	Camfbm32.exe
File opened for modification	C:\Windows\SysWOW64\Mcmabg32.exe	Mpoefk32.exe
File opened for modification	C:\Windows\SysWOW64\Lilanioo.exe	Lgneampk.exe
File created	C:\Windows\SysWOW64\Cknpkhch.dll	Nkqpjidj.exe
File opened for modification	C:\Windows\SysWOW64\Bhaebcen.exe	Bahmfj32.exe
File opened for modification	C:\Windows\SysWOW64\Ehgqln32.exe	Eeidoc32.exe
File created	C:\Windows\SysWOW64\Jfjdddho.dll	Dfdbojmq.exe
File created	C:\Windows\SysWOW64\Kpmfddnf.exe	Kmnjhioc.exe
File created	C:\Windows\SysWOW64\Cdicgd32.dll	Okolkg32.exe
File opened for modification	C:\Windows\SysWOW64\Qnkdhpjn.exe	Qkmhlekj.exe
File created	C:\Windows\SysWOW64\Agffge32.exe	Aegikj32.exe
File created	C:\Windows\SysWOW64\Agocgbni.dll	Mlhbal32.exe
File created	C:\Windows\SysWOW64\Bgcknmop.exe	Bchomn32.exe
File created	C:\Windows\SysWOW64\Fqkocpod.exe	Ficgacna.exe
File opened for modification	C:\Windows\SysWOW64\Gogbdl32.exe	Gmhfhp32.exe
File created	C:\Windows\SysWOW64\Kpjjod32.exe	Kmlnbi32.exe
File created	C:\Windows\SysWOW64\Ioeeep32.dll	Abbpem32.exe
File created	C:\Windows\SysWOW64\Fcnopdeh.dll	Ffimfqgm.exe
File opened for modification	C:\Windows\SysWOW64\Dohmlp32.exe	Dpemacql.exe
File opened for modification	C:\Windows\SysWOW64\Gcidfi32.exe	Gqkhjn32.exe
File opened for modification	C:\Windows\SysWOW64\Ncnadk32.exe	Nbmelbid.exe
File created	C:\Windows\SysWOW64\Lfifebhe.dll	Pqpnombl.exe
File created	C:\Windows\SysWOW64\Bhfonc32.exe	Behbag32.exe
File created	C:\Windows\SysWOW64\Fkmchi32.exe	Ehnglm32.exe
File created	C:\Windows\SysWOW64\Glccbn32.dll	Iicbehnq.exe
File created	C:\Windows\SysWOW64\Qgppolie.dll	Ofeilobp.exe
File created	C:\Windows\SysWOW64\Omlami32.dll	Dpcpkc32.exe
File created	C:\Windows\SysWOW64\Dfdbojmq.exe	Dcfebonm.exe
File created	C:\Windows\SysWOW64\Chkede32.dll	Eoocmoao.exe
File created	C:\Windows\SysWOW64\Mmpfpdoi.dll	Ijaida32.exe
File created	C:\Windows\SysWOW64\Lpocjdld.exe	Lalcng32.exe
File created	C:\Windows\SysWOW64\Mgdjapoo.dll	Icnpmp32.exe
File created	C:\Windows\SysWOW64\Flakmgga.dll	Icplcpgo.exe
File opened for modification	C:\Windows\SysWOW64\Lmccchkn.exe	Lkdggmlj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
14288	8	WerFault.exe	703

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Efpajh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qcldhk32.dll"	Mcnhmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgkjhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkmlea32.dll"	Qcgffqei.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bagflcje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Efikji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emhmioko.dll"	Gqikdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iefioj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngcgcjnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akalojih.dll"	Cbgbgj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbanme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hmklen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jihdea32.dll"	Edihepnm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Klljnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajgblndm.dll"	Kgphpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glgmkm32.dll"	Nfjjppmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Joamagmq.dll"	Kmlnbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anmjcieo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Okolkg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmfhig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmbmibhb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odpjcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Okjbpglo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bblckl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlednamo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ejegjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Milgab32.dll"	Kdcijcke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqoieqhe.dll"	Ekemhj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Peeafpaf.dll"	Gogbdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lknjmkdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pkjlge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnaijinl.dll"	Gbdgfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ampkqqjm.dll"	Epopgbia.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmqmma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjhfnccl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Icgjmapi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmiciaaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nodfmh32.dll"	Mdhdajea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acocaf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gbdgfa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jmhale32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmdina32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgghhlhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npckna32.dll"	Mgnnhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dceohhja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eifbkgjd.dll"	Jfoiokfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fakdpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Flqimk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mmpijp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmbocjjm.dll"	Gbgkfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Haidklda.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijnlbk32.dll"	Cahfmgoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mcgdgamg.dll"	Cefoce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iclnemml.dll"	Aegikj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ooojbbid.dll"	Acqimo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhbgqohi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khchklef.dll"	Jmpgldhg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oneklm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dljqpd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcpkbc32.dll"	Kmjqmi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pagdol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qkmhlekj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Digkijmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajneip32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 804	4404	3f8bd3a52e11e4af76580ad573ff0b78f9ae230782636ebd2e8628ed2c87303e.exe	85
PID 4404 wrote to memory of 804	4404	3f8bd3a52e11e4af76580ad573ff0b78f9ae230782636ebd2e8628ed2c87303e.exe	85
PID 4404 wrote to memory of 804	4404	3f8bd3a52e11e4af76580ad573ff0b78f9ae230782636ebd2e8628ed2c87303e.exe	85
PID 804 wrote to memory of 872	804	Commqb32.exe	86
PID 804 wrote to memory of 872	804	Commqb32.exe	86
PID 804 wrote to memory of 872	804	Commqb32.exe	86
PID 872 wrote to memory of 1960	872	Clqnjf32.exe	87
PID 872 wrote to memory of 1960	872	Clqnjf32.exe	87
PID 872 wrote to memory of 1960	872	Clqnjf32.exe	87
PID 1960 wrote to memory of 1080	1960	Coojfa32.exe	88
PID 1960 wrote to memory of 1080	1960	Coojfa32.exe	88
PID 1960 wrote to memory of 1080	1960	Coojfa32.exe	88
PID 1080 wrote to memory of 3672	1080	Camfbm32.exe	89
PID 1080 wrote to memory of 3672	1080	Camfbm32.exe	89
PID 1080 wrote to memory of 3672	1080	Camfbm32.exe	89
PID 3672 wrote to memory of 2140	3672	Cidncj32.exe	90
PID 3672 wrote to memory of 2140	3672	Cidncj32.exe	90
PID 3672 wrote to memory of 2140	3672	Cidncj32.exe	90
PID 2140 wrote to memory of 2884	2140	Clckpf32.exe	91
PID 2140 wrote to memory of 2884	2140	Clckpf32.exe	91
PID 2140 wrote to memory of 2884	2140	Clckpf32.exe	91
PID 2884 wrote to memory of 724	2884	Coagla32.exe	92
PID 2884 wrote to memory of 724	2884	Coagla32.exe	92
PID 2884 wrote to memory of 724	2884	Coagla32.exe	92
PID 724 wrote to memory of 3772	724	Ccmclp32.exe	93
PID 724 wrote to memory of 3772	724	Ccmclp32.exe	93
PID 724 wrote to memory of 3772	724	Ccmclp32.exe	93
PID 3772 wrote to memory of 1884	3772	Cekohk32.exe	94
PID 3772 wrote to memory of 1884	3772	Cekohk32.exe	94
PID 3772 wrote to memory of 1884	3772	Cekohk32.exe	94
PID 1884 wrote to memory of 2424	1884	Digkijmd.exe	95
PID 1884 wrote to memory of 2424	1884	Digkijmd.exe	95
PID 1884 wrote to memory of 2424	1884	Digkijmd.exe	95
PID 2424 wrote to memory of 3632	2424	Dlegeemh.exe	96
PID 2424 wrote to memory of 3632	2424	Dlegeemh.exe	96
PID 2424 wrote to memory of 3632	2424	Dlegeemh.exe	96
PID 3632 wrote to memory of 2616	3632	Dpacfd32.exe	97
PID 3632 wrote to memory of 2616	3632	Dpacfd32.exe	97
PID 3632 wrote to memory of 2616	3632	Dpacfd32.exe	97
PID 2616 wrote to memory of 1460	2616	Dcopbp32.exe	98
PID 2616 wrote to memory of 1460	2616	Dcopbp32.exe	98
PID 2616 wrote to memory of 1460	2616	Dcopbp32.exe	98
PID 1460 wrote to memory of 4236	1460	Dabpnlkp.exe	99
PID 1460 wrote to memory of 4236	1460	Dabpnlkp.exe	99
PID 1460 wrote to memory of 4236	1460	Dabpnlkp.exe	99
PID 4236 wrote to memory of 984	4236	Diihojkb.exe	100
PID 4236 wrote to memory of 984	4236	Diihojkb.exe	100
PID 4236 wrote to memory of 984	4236	Diihojkb.exe	100
PID 984 wrote to memory of 3416	984	Dhlhjf32.exe	101
PID 984 wrote to memory of 3416	984	Dhlhjf32.exe	101
PID 984 wrote to memory of 3416	984	Dhlhjf32.exe	101
PID 3416 wrote to memory of 1808	3416	Dpcpkc32.exe	102
PID 3416 wrote to memory of 1808	3416	Dpcpkc32.exe	102
PID 3416 wrote to memory of 1808	3416	Dpcpkc32.exe	102
PID 1808 wrote to memory of 1732	1808	Dofpgqji.exe	103
PID 1808 wrote to memory of 1732	1808	Dofpgqji.exe	103
PID 1808 wrote to memory of 1732	1808	Dofpgqji.exe	103
PID 1732 wrote to memory of 3348	1732	Dadlclim.exe	104
PID 1732 wrote to memory of 3348	1732	Dadlclim.exe	104
PID 1732 wrote to memory of 3348	1732	Dadlclim.exe	104
PID 3348 wrote to memory of 3084	3348	Dephckaf.exe	105
PID 3348 wrote to memory of 3084	3348	Dephckaf.exe	105
PID 3348 wrote to memory of 3084	3348	Dephckaf.exe	105
PID 3084 wrote to memory of 3480	3084	Djlddi32.exe	106

C:\Users\Admin\AppData\Local\Temp\3f8bd3a52e11e4af76580ad573ff0b78f9ae230782636ebd2e8628ed2c87303e.exe
"C:\Users\Admin\AppData\Local\Temp\3f8bd3a52e11e4af76580ad573ff0b78f9ae230782636ebd2e8628ed2c87303e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Windows\SysWOW64\Commqb32.exe
  C:\Windows\system32\Commqb32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:804
- - C:\Windows\SysWOW64\Clqnjf32.exe
    C:\Windows\system32\Clqnjf32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\Windows\SysWOW64\Coojfa32.exe
      C:\Windows\system32\Coojfa32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1960
    - - C:\Windows\SysWOW64\Camfbm32.exe
        
        C:\Windows\system32\Camfbm32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1080
      - C:\Windows\SysWOW64\Cidncj32.exe
        
        C:\Windows\system32\Cidncj32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3672
        
        C:\Windows\SysWOW64\Clckpf32.exe
        
        C:\Windows\system32\Clckpf32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2140
        
        C:\Windows\SysWOW64\Coagla32.exe
        
        C:\Windows\system32\Coagla32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Windows\SysWOW64\Ccmclp32.exe
        
        C:\Windows\system32\Ccmclp32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:724
        
        C:\Windows\SysWOW64\Cekohk32.exe
        
        C:\Windows\system32\Cekohk32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3772
        
        C:\Windows\SysWOW64\Digkijmd.exe
        
        C:\Windows\system32\Digkijmd.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1884
        
        C:\Windows\SysWOW64\Dlegeemh.exe
        
        C:\Windows\system32\Dlegeemh.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Dpacfd32.exe
        
        C:\Windows\system32\Dpacfd32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3632
        
        C:\Windows\SysWOW64\Dcopbp32.exe
        
        C:\Windows\system32\Dcopbp32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2616
        
        C:\Windows\SysWOW64\Dabpnlkp.exe
        
        C:\Windows\system32\Dabpnlkp.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1460
        
        C:\Windows\SysWOW64\Diihojkb.exe
        
        C:\Windows\system32\Diihojkb.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4236
        
        C:\Windows\SysWOW64\Dhlhjf32.exe
        
        C:\Windows\system32\Dhlhjf32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:984
        
        C:\Windows\SysWOW64\Dpcpkc32.exe
        
        C:\Windows\system32\Dpcpkc32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3416
        
        C:\Windows\SysWOW64\Dofpgqji.exe
        
        C:\Windows\system32\Dofpgqji.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1808
        
        C:\Windows\SysWOW64\Dadlclim.exe
        
        C:\Windows\system32\Dadlclim.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1732
        
        C:\Windows\SysWOW64\Dephckaf.exe
        
        C:\Windows\system32\Dephckaf.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3348
        
        C:\Windows\SysWOW64\Djlddi32.exe
        
        C:\Windows\system32\Djlddi32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3084
        
        C:\Windows\SysWOW64\Dljqpd32.exe
        
        C:\Windows\system32\Dljqpd32.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3480
        
        C:\Windows\SysWOW64\Dpemacql.exe
        
        C:\Windows\system32\Dpemacql.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1856
        
        C:\Windows\SysWOW64\Dohmlp32.exe
        
        C:\Windows\system32\Dohmlp32.exe
        25⤵
        Executes dropped EXE
        
        PID:4196
        
        C:\Windows\SysWOW64\Dcdimopp.exe
        
        C:\Windows\system32\Dcdimopp.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5024
        
        C:\Windows\SysWOW64\Dagiil32.exe
        
        C:\Windows\system32\Dagiil32.exe
        27⤵
        Executes dropped EXE
        
        PID:396
        
        C:\Windows\SysWOW64\Djnaji32.exe
        
        C:\Windows\system32\Djnaji32.exe
        28⤵
        Executes dropped EXE
        
        PID:4088
        
        C:\Windows\SysWOW64\Dhqaefng.exe
        
        C:\Windows\system32\Dhqaefng.exe
        29⤵
        Executes dropped EXE
        
        PID:2308
        
        C:\Windows\SysWOW64\Dllmfd32.exe
        
        C:\Windows\system32\Dllmfd32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3048
        
        C:\Windows\SysWOW64\Dphifcoi.exe
        
        C:\Windows\system32\Dphifcoi.exe
        31⤵
        Executes dropped EXE
        
        PID:2904
        
        C:\Windows\SysWOW64\Dokjbp32.exe
        
        C:\Windows\system32\Dokjbp32.exe
        32⤵
        Executes dropped EXE
        
        PID:3520
        
        C:\Windows\SysWOW64\Dcfebonm.exe
        
        C:\Windows\system32\Dcfebonm.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4508
        
        C:\Windows\SysWOW64\Dfdbojmq.exe
        
        C:\Windows\system32\Dfdbojmq.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2260
        
        C:\Windows\SysWOW64\Djpnohej.exe
        
        C:\Windows\system32\Djpnohej.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1240
        
        C:\Windows\SysWOW64\Dhcnke32.exe
        
        C:\Windows\system32\Dhcnke32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1488
        
        C:\Windows\SysWOW64\Dlojkddn.exe
        
        C:\Windows\system32\Dlojkddn.exe
        37⤵
        Executes dropped EXE
        
        PID:860
        
        C:\Windows\SysWOW64\Dpjflb32.exe
        
        C:\Windows\system32\Dpjflb32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4544
        
        C:\Windows\SysWOW64\Dchbhn32.exe
        
        C:\Windows\system32\Dchbhn32.exe
        39⤵
        Executes dropped EXE
        
        PID:1468
        
        C:\Windows\SysWOW64\Dakbckbe.exe
        
        C:\Windows\system32\Dakbckbe.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4804
        
        C:\Windows\SysWOW64\Efgodj32.exe
        
        C:\Windows\system32\Efgodj32.exe
        41⤵
        Executes dropped EXE
        
        PID:3168
        
        C:\Windows\SysWOW64\Ejbkehcg.exe
        
        C:\Windows\system32\Ejbkehcg.exe
        42⤵
        Executes dropped EXE
        
        PID:2176
        
        C:\Windows\SysWOW64\Ehekqe32.exe
        
        C:\Windows\system32\Ehekqe32.exe
        43⤵
        Executes dropped EXE
        
        PID:5004
        
        C:\Windows\SysWOW64\Elagacbk.exe
        
        C:\Windows\system32\Elagacbk.exe
        44⤵
        Executes dropped EXE
        
        PID:3152
        
        C:\Windows\SysWOW64\Epmcab32.exe
        
        C:\Windows\system32\Epmcab32.exe
        45⤵
        Executes dropped EXE
        
        PID:3276
        
        C:\Windows\SysWOW64\Eoocmoao.exe
        
        C:\Windows\system32\Eoocmoao.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1580
        
        C:\Windows\SysWOW64\Ebnoikqb.exe
        
        C:\Windows\system32\Ebnoikqb.exe
        47⤵
        Executes dropped EXE
        
        PID:4616
        
        C:\Windows\SysWOW64\Efikji32.exe
        
        C:\Windows\system32\Efikji32.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3012
        
        C:\Windows\SysWOW64\Ejegjh32.exe
        
        C:\Windows\system32\Ejegjh32.exe
        49⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:516
        
        C:\Windows\SysWOW64\Ehhgfdho.exe
        
        C:\Windows\system32\Ehhgfdho.exe
        50⤵
        Executes dropped EXE
        
        PID:4420
        
        C:\Windows\SysWOW64\Elccfc32.exe
        
        C:\Windows\system32\Elccfc32.exe
        51⤵
        Executes dropped EXE
        
        PID:4488
        
        C:\Windows\SysWOW64\Epopgbia.exe
        
        C:\Windows\system32\Epopgbia.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4928
        
        C:\Windows\SysWOW64\Eflhoigi.exe
        
        C:\Windows\system32\Eflhoigi.exe
        53⤵
        Executes dropped EXE
        
        PID:3692
        
        C:\Windows\SysWOW64\Ejgdpg32.exe
        
        C:\Windows\system32\Ejgdpg32.exe
        54⤵
        Executes dropped EXE
        
        PID:4360
        
        C:\Windows\SysWOW64\Ehjdldfl.exe
        
        C:\Windows\system32\Ehjdldfl.exe
        55⤵
        Executes dropped EXE
        
        PID:2068
        
        C:\Windows\SysWOW64\Eleplc32.exe
        
        C:\Windows\system32\Eleplc32.exe
        56⤵
        Executes dropped EXE
        
        PID:3644
        
        C:\Windows\SysWOW64\Eodlho32.exe
        
        C:\Windows\system32\Eodlho32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4596
        
        C:\Windows\SysWOW64\Ecphimfb.exe
        
        C:\Windows\system32\Ecphimfb.exe
        58⤵
        Executes dropped EXE
        
        PID:2608
        
        C:\Windows\SysWOW64\Ebbidj32.exe
        
        C:\Windows\system32\Ebbidj32.exe
        59⤵
        Executes dropped EXE
        
        PID:3924
        
        C:\Windows\SysWOW64\Efneehef.exe
        
        C:\Windows\system32\Efneehef.exe
        60⤵
        Executes dropped EXE
        
        PID:4556
        
        C:\Windows\SysWOW64\Ejjqeg32.exe
        
        C:\Windows\system32\Ejjqeg32.exe
        61⤵
        Executes dropped EXE
        
        PID:4120
        
        C:\Windows\SysWOW64\Ehlaaddj.exe
        
        C:\Windows\system32\Ehlaaddj.exe
        62⤵
        Executes dropped EXE
        
        PID:3936
        
        C:\Windows\SysWOW64\Eofinnkf.exe
        
        C:\Windows\system32\Eofinnkf.exe
        63⤵
        Executes dropped EXE
        
        PID:4324
        
        C:\Windows\SysWOW64\Efpajh32.exe
        
        C:\Windows\system32\Efpajh32.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1976
        
        C:\Windows\SysWOW64\Ehonfc32.exe
        
        C:\Windows\system32\Ehonfc32.exe
        65⤵
        Executes dropped EXE
        
        PID:1220
        
        C:\Windows\SysWOW64\Emjjgbjp.exe
        
        C:\Windows\system32\Emjjgbjp.exe
        66⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\Eqfeha32.exe
        
        C:\Windows\system32\Eqfeha32.exe
        67⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\Ffbnph32.exe
        
        C:\Windows\system32\Ffbnph32.exe
        68⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\Fmmfmbhn.exe
        
        C:\Windows\system32\Fmmfmbhn.exe
        69⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Fbioei32.exe
        
        C:\Windows\system32\Fbioei32.exe
        70⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\Ficgacna.exe
        
        C:\Windows\system32\Ficgacna.exe
        71⤵
        Drops file in System32 directory
        
        PID:4788
        
        C:\Windows\SysWOW64\Fqkocpod.exe
        
        C:\Windows\system32\Fqkocpod.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2392
        
        C:\Windows\SysWOW64\Fbllkh32.exe
        
        C:\Windows\system32\Fbllkh32.exe
        73⤵
        
        PID:3476
        
        C:\Windows\SysWOW64\Fjcclf32.exe
        
        C:\Windows\system32\Fjcclf32.exe
        74⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\Fqmlhpla.exe
        
        C:\Windows\system32\Fqmlhpla.exe
        75⤵
        Drops file in System32 directory
        
        PID:4268
        
        C:\Windows\SysWOW64\Fopldmcl.exe
        
        C:\Windows\system32\Fopldmcl.exe
        76⤵
        
        PID:1184
        
        C:\Windows\SysWOW64\Ffjdqg32.exe
        
        C:\Windows\system32\Ffjdqg32.exe
        77⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\Fqohnp32.exe
        
        C:\Windows\system32\Fqohnp32.exe
        78⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\Fbqefhpm.exe
        
        C:\Windows\system32\Fbqefhpm.exe
        79⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\Fflaff32.exe
        
        C:\Windows\system32\Fflaff32.exe
        80⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\Fijmbb32.exe
        
        C:\Windows\system32\Fijmbb32.exe
        81⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\Fqaeco32.exe
        
        C:\Windows\system32\Fqaeco32.exe
        82⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\Gbcakg32.exe
        
        C:\Windows\system32\Gbcakg32.exe
        83⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\Gfnnlffc.exe
        
        C:\Windows\system32\Gfnnlffc.exe
        84⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\Gmhfhp32.exe
        
        C:\Windows\system32\Gmhfhp32.exe
        85⤵
        Drops file in System32 directory
        
        PID:3776
        
        C:\Windows\SysWOW64\Gogbdl32.exe
        
        C:\Windows\system32\Gogbdl32.exe
        86⤵
        Modifies registry class
        
        PID:1216
        
        C:\Windows\SysWOW64\Gfqjafdq.exe
        
        C:\Windows\system32\Gfqjafdq.exe
        87⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\Giofnacd.exe
        
        C:\Windows\system32\Giofnacd.exe
        88⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\Goiojk32.exe
        
        C:\Windows\system32\Goiojk32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2368
        
        C:\Windows\SysWOW64\Gbgkfg32.exe
        
        C:\Windows\system32\Gbgkfg32.exe
        90⤵
        Modifies registry class
        
        PID:464
        
        C:\Windows\SysWOW64\Gqikdn32.exe
        
        C:\Windows\system32\Gqikdn32.exe
        91⤵
        Modifies registry class
        
        PID:3196
        
        C:\Windows\SysWOW64\Gcggpj32.exe
        
        C:\Windows\system32\Gcggpj32.exe
        92⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Gfedle32.exe
        
        C:\Windows\system32\Gfedle32.exe
        93⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\Gidphq32.exe
        
        C:\Windows\system32\Gidphq32.exe
        94⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Gqkhjn32.exe
        
        C:\Windows\system32\Gqkhjn32.exe
        95⤵
        Drops file in System32 directory
        
        PID:5184
        
        C:\Windows\SysWOW64\Gcidfi32.exe
        
        C:\Windows\system32\Gcidfi32.exe
        96⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Gfhqbe32.exe
        
        C:\Windows\system32\Gfhqbe32.exe
        97⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Gmaioo32.exe
        
        C:\Windows\system32\Gmaioo32.exe
        98⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Gppekj32.exe
        
        C:\Windows\system32\Gppekj32.exe
        99⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Hclakimb.exe
        
        C:\Windows\system32\Hclakimb.exe
        100⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Hjfihc32.exe
        
        C:\Windows\system32\Hjfihc32.exe
        101⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Hihicplj.exe
        
        C:\Windows\system32\Hihicplj.exe
        102⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Hbanme32.exe
        
        C:\Windows\system32\Hbanme32.exe
        103⤵
        Modifies registry class
        
        PID:5516
        
        C:\Windows\SysWOW64\Hjhfnccl.exe
        
        C:\Windows\system32\Hjhfnccl.exe
        104⤵
        Modifies registry class
        
        PID:5552
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        105⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Hpenfjad.exe
        
        C:\Windows\system32\Hpenfjad.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5632
        
        C:\Windows\SysWOW64\Hfofbd32.exe
        
        C:\Windows\system32\Hfofbd32.exe
        107⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Hadkpm32.exe
        
        C:\Windows\system32\Hadkpm32.exe
        108⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Hfachc32.exe
        
        C:\Windows\system32\Hfachc32.exe
        109⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Hmklen32.exe
        
        C:\Windows\system32\Hmklen32.exe
        110⤵
        Modifies registry class
        
        PID:5804
        
        C:\Windows\SysWOW64\Hpihai32.exe
        
        C:\Windows\system32\Hpihai32.exe
        111⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Hfcpncdk.exe
        
        C:\Windows\system32\Hfcpncdk.exe
        112⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Hibljoco.exe
        
        C:\Windows\system32\Hibljoco.exe
        113⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Haidklda.exe
        
        C:\Windows\system32\Haidklda.exe
        114⤵
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Icgqggce.exe
        
        C:\Windows\system32\Icgqggce.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6024
        
        C:\Windows\SysWOW64\Ibjqcd32.exe
        
        C:\Windows\system32\Ibjqcd32.exe
        116⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Ijaida32.exe
        
        C:\Windows\system32\Ijaida32.exe
        117⤵
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Impepm32.exe
        
        C:\Windows\system32\Impepm32.exe
        118⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\Ipnalhii.exe
        
        C:\Windows\system32\Ipnalhii.exe
        119⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Ifhiib32.exe
        
        C:\Windows\system32\Ifhiib32.exe
        120⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Imbaemhc.exe
        
        C:\Windows\system32\Imbaemhc.exe
        121⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5372
        
        C:\Windows\SysWOW64\Ijfboafl.exe
        
        C:\Windows\system32\Ijfboafl.exe
        123⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Iapjlk32.exe
        
        C:\Windows\system32\Iapjlk32.exe
        124⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Ifmcdblq.exe
        
        C:\Windows\system32\Ifmcdblq.exe
        125⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Ijhodq32.exe
        
        C:\Windows\system32\Ijhodq32.exe
        126⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Ipegmg32.exe
        
        C:\Windows\system32\Ipegmg32.exe
        127⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Ifopiajn.exe
        
        C:\Windows\system32\Ifopiajn.exe
        128⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Iinlemia.exe
        
        C:\Windows\system32\Iinlemia.exe
        129⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Jaedgjjd.exe
        
        C:\Windows\system32\Jaedgjjd.exe
        130⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Jdcpcf32.exe
        
        C:\Windows\system32\Jdcpcf32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6048
        
        C:\Windows\SysWOW64\Jfaloa32.exe
        
        C:\Windows\system32\Jfaloa32.exe
        132⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Jjmhppqd.exe
        
        C:\Windows\system32\Jjmhppqd.exe
        133⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Jagqlj32.exe
        
        C:\Windows\system32\Jagqlj32.exe
        134⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Jdemhe32.exe
        
        C:\Windows\system32\Jdemhe32.exe
        135⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Jfdida32.exe
        
        C:\Windows\system32\Jfdida32.exe
        136⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Jibeql32.exe
        
        C:\Windows\system32\Jibeql32.exe
        137⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Jaimbj32.exe
        
        C:\Windows\system32\Jaimbj32.exe
        138⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Jplmmfmi.exe
        
        C:\Windows\system32\Jplmmfmi.exe
        139⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Jdhine32.exe
        
        C:\Windows\system32\Jdhine32.exe
        140⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Jfffjqdf.exe
        
        C:\Windows\system32\Jfffjqdf.exe
        141⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Jjbako32.exe
        
        C:\Windows\system32\Jjbako32.exe
        142⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Jmpngk32.exe
        
        C:\Windows\system32\Jmpngk32.exe
        143⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Jpojcf32.exe
        
        C:\Windows\system32\Jpojcf32.exe
        144⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Jdjfcecp.exe
        
        C:\Windows\system32\Jdjfcecp.exe
        145⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        146⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Jigollag.exe
        
        C:\Windows\system32\Jigollag.exe
        147⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Jpaghf32.exe
        
        C:\Windows\system32\Jpaghf32.exe
        148⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Jbocea32.exe
        
        C:\Windows\system32\Jbocea32.exe
        149⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Jkfkfohj.exe
        
        C:\Windows\system32\Jkfkfohj.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:672
        
        C:\Windows\SysWOW64\Jiikak32.exe
        
        C:\Windows\system32\Jiikak32.exe
        151⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Kaqcbi32.exe
        
        C:\Windows\system32\Kaqcbi32.exe
        152⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Kdopod32.exe
        
        C:\Windows\system32\Kdopod32.exe
        153⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Kkihknfg.exe
        
        C:\Windows\system32\Kkihknfg.exe
        154⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Kilhgk32.exe
        
        C:\Windows\system32\Kilhgk32.exe
        155⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Kpepcedo.exe
        
        C:\Windows\system32\Kpepcedo.exe
        156⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Kdaldd32.exe
        
        C:\Windows\system32\Kdaldd32.exe
        157⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Kgphpo32.exe
        
        C:\Windows\system32\Kgphpo32.exe
        158⤵
        Modifies registry class
        
        PID:6416
        
        C:\Windows\SysWOW64\Kmjqmi32.exe
        
        C:\Windows\system32\Kmjqmi32.exe
        159⤵
        Modifies registry class
        
        PID:6460
        
        C:\Windows\SysWOW64\Kdcijcke.exe
        
        C:\Windows\system32\Kdcijcke.exe
        160⤵
        Modifies registry class
        
        PID:6496
        
        C:\Windows\SysWOW64\Kgbefoji.exe
        
        C:\Windows\system32\Kgbefoji.exe
        161⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Kknafn32.exe
        
        C:\Windows\system32\Kknafn32.exe
        162⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Kmlnbi32.exe
        
        C:\Windows\system32\Kmlnbi32.exe
        163⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6620
        
        C:\Windows\SysWOW64\Kpjjod32.exe
        
        C:\Windows\system32\Kpjjod32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6664
        
        C:\Windows\SysWOW64\Kcifkp32.exe
        
        C:\Windows\system32\Kcifkp32.exe
        165⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Kgdbkohf.exe
        
        C:\Windows\system32\Kgdbkohf.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6748
        
        C:\Windows\SysWOW64\Kmnjhioc.exe
        
        C:\Windows\system32\Kmnjhioc.exe
        167⤵
        Drops file in System32 directory
        
        PID:6792
        
        C:\Windows\SysWOW64\Kpmfddnf.exe
        
        C:\Windows\system32\Kpmfddnf.exe
        168⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Kckbqpnj.exe
        
        C:\Windows\system32\Kckbqpnj.exe
        169⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Lmqgnhmp.exe
        
        C:\Windows\system32\Lmqgnhmp.exe
        170⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Lalcng32.exe
        
        C:\Windows\system32\Lalcng32.exe
        171⤵
        Drops file in System32 directory
        
        PID:6964
        
        C:\Windows\SysWOW64\Lpocjdld.exe
        
        C:\Windows\system32\Lpocjdld.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7000
        
        C:\Windows\SysWOW64\Lcmofolg.exe
        
        C:\Windows\system32\Lcmofolg.exe
        173⤵
        Drops file in System32 directory
        
        PID:7044
        
        C:\Windows\SysWOW64\Lkdggmlj.exe
        
        C:\Windows\system32\Lkdggmlj.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7084
        
        C:\Windows\SysWOW64\Lmccchkn.exe
        
        C:\Windows\system32\Lmccchkn.exe
        175⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Laopdgcg.exe
        
        C:\Windows\system32\Laopdgcg.exe
        176⤵
        Drops file in System32 directory
        
        PID:6156
        
        C:\Windows\SysWOW64\Ldmlpbbj.exe
        
        C:\Windows\system32\Ldmlpbbj.exe
        177⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Lgkhlnbn.exe
        
        C:\Windows\system32\Lgkhlnbn.exe
        178⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Lkgdml32.exe
        
        C:\Windows\system32\Lkgdml32.exe
        179⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Lnepih32.exe
        
        C:\Windows\system32\Lnepih32.exe
        180⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Laalifad.exe
        
        C:\Windows\system32\Laalifad.exe
        181⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Ldohebqh.exe
        
        C:\Windows\system32\Ldohebqh.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6564
        
        C:\Windows\SysWOW64\Lgneampk.exe
        
        C:\Windows\system32\Lgneampk.exe
        183⤵
        Drops file in System32 directory
        
        PID:6652
        
        C:\Windows\SysWOW64\Lilanioo.exe
        
        C:\Windows\system32\Lilanioo.exe
        184⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Lpfijcfl.exe
        
        C:\Windows\system32\Lpfijcfl.exe
        185⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Lcdegnep.exe
        
        C:\Windows\system32\Lcdegnep.exe
        186⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Lklnhlfb.exe
        
        C:\Windows\system32\Lklnhlfb.exe
        187⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Lnjjdgee.exe
        
        C:\Windows\system32\Lnjjdgee.exe
        188⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Lddbqa32.exe
        
        C:\Windows\system32\Lddbqa32.exe
        189⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Lknjmkdo.exe
        
        C:\Windows\system32\Lknjmkdo.exe
        190⤵
        Modifies registry class
        
        PID:7152
        
        C:\Windows\SysWOW64\Mpkbebbf.exe
        
        C:\Windows\system32\Mpkbebbf.exe
        191⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Mdfofakp.exe
        
        C:\Windows\system32\Mdfofakp.exe
        192⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Mgekbljc.exe
        
        C:\Windows\system32\Mgekbljc.exe
        193⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Mkpgck32.exe
        
        C:\Windows\system32\Mkpgck32.exe
        194⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        195⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Mnocof32.exe
        
        C:\Windows\system32\Mnocof32.exe
        196⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Mgghhlhq.exe
        
        C:\Windows\system32\Mgghhlhq.exe
        197⤵
        Modifies registry class
        
        PID:6952
        
        C:\Windows\SysWOW64\Mjeddggd.exe
        
        C:\Windows\system32\Mjeddggd.exe
        198⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Mamleegg.exe
        
        C:\Windows\system32\Mamleegg.exe
        199⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Mcnhmm32.exe
        
        C:\Windows\system32\Mcnhmm32.exe
        200⤵
        Modifies registry class
        
        PID:6356
        
        C:\Windows\SysWOW64\Mkepnjng.exe
        
        C:\Windows\system32\Mkepnjng.exe
        201⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Mncmjfmk.exe
        
        C:\Windows\system32\Mncmjfmk.exe
        202⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Mpaifalo.exe
        
        C:\Windows\system32\Mpaifalo.exe
        203⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Mdmegp32.exe
        
        C:\Windows\system32\Mdmegp32.exe
        204⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Mcpebmkb.exe
        
        C:\Windows\system32\Mcpebmkb.exe
        205⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Mjjmog32.exe
        
        C:\Windows\system32\Mjjmog32.exe
        206⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Maaepd32.exe
        
        C:\Windows\system32\Maaepd32.exe
        207⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Mdpalp32.exe
        
        C:\Windows\system32\Mdpalp32.exe
        208⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Mgnnhk32.exe
        
        C:\Windows\system32\Mgnnhk32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6852
        
        C:\Windows\SysWOW64\Nqfbaq32.exe
        
        C:\Windows\system32\Nqfbaq32.exe
        210⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Nceonl32.exe
        
        C:\Windows\system32\Nceonl32.exe
        211⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Nafokcol.exe
        
        C:\Windows\system32\Nafokcol.exe
        212⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Nqiogp32.exe
        
        C:\Windows\system32\Nqiogp32.exe
        213⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Ngcgcjnc.exe
        
        C:\Windows\system32\Ngcgcjnc.exe
        214⤵
        Modifies registry class
        
        PID:7276
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        215⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Nbhkac32.exe
        
        C:\Windows\system32\Nbhkac32.exe
        216⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Nqklmpdd.exe
        
        C:\Windows\system32\Nqklmpdd.exe
        217⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Ncihikcg.exe
        
        C:\Windows\system32\Ncihikcg.exe
        218⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Nkqpjidj.exe
        
        C:\Windows\system32\Nkqpjidj.exe
        219⤵
        Drops file in System32 directory
        
        PID:7488
        
        C:\Windows\SysWOW64\Nnolfdcn.exe
        
        C:\Windows\system32\Nnolfdcn.exe
        220⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Nqmhbpba.exe
        
        C:\Windows\system32\Nqmhbpba.exe
        221⤵
        Drops file in System32 directory
        
        PID:7576
        
        C:\Windows\SysWOW64\Ncldnkae.exe
        
        C:\Windows\system32\Ncldnkae.exe
        222⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Nggqoj32.exe
        
        C:\Windows\system32\Nggqoj32.exe
        223⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Nbmelbid.exe
        
        C:\Windows\system32\Nbmelbid.exe
        224⤵
        Drops file in System32 directory
        
        PID:7708
        
        C:\Windows\SysWOW64\Ncnadk32.exe
        
        C:\Windows\system32\Ncnadk32.exe
        225⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Ojhiqefo.exe
        
        C:\Windows\system32\Ojhiqefo.exe
        226⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Odnnnnfe.exe
        
        C:\Windows\system32\Odnnnnfe.exe
        227⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Okhfjh32.exe
        
        C:\Windows\system32\Okhfjh32.exe
        228⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Obangb32.exe
        
        C:\Windows\system32\Obangb32.exe
        229⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Odpjcm32.exe
        
        C:\Windows\system32\Odpjcm32.exe
        230⤵
        Modifies registry class
        
        PID:7988
        
        C:\Windows\SysWOW64\Ogogoi32.exe
        
        C:\Windows\system32\Ogogoi32.exe
        231⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        232⤵
        Modifies registry class
        
        PID:8076
        
        C:\Windows\SysWOW64\Onholckc.exe
        
        C:\Windows\system32\Onholckc.exe
        233⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Oqgkhnjf.exe
        
        C:\Windows\system32\Oqgkhnjf.exe
        234⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Ocegdjij.exe
        
        C:\Windows\system32\Ocegdjij.exe
        235⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Ojopad32.exe
        
        C:\Windows\system32\Ojopad32.exe
        236⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Onklabip.exe
        
        C:\Windows\system32\Onklabip.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7304
        
        C:\Windows\SysWOW64\Oqihnn32.exe
        
        C:\Windows\system32\Oqihnn32.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7392
        
        C:\Windows\SysWOW64\Ocgdji32.exe
        
        C:\Windows\system32\Ocgdji32.exe
        239⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Okolkg32.exe
        
        C:\Windows\system32\Okolkg32.exe
        240⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7520
        
        C:\Windows\SysWOW64\Onmhgb32.exe
        
        C:\Windows\system32\Onmhgb32.exe
        241⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Oqkdcn32.exe
        
        C:\Windows\system32\Oqkdcn32.exe
        242⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        243⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Pjdilcla.exe
        
        C:\Windows\system32\Pjdilcla.exe
        244⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Pnpemb32.exe
        
        C:\Windows\system32\Pnpemb32.exe
        245⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Pqnaim32.exe
        
        C:\Windows\system32\Pqnaim32.exe
        246⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Peimil32.exe
        
        C:\Windows\system32\Peimil32.exe
        247⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Pjffbc32.exe
        
        C:\Windows\system32\Pjffbc32.exe
        248⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Pqpnombl.exe
        
        C:\Windows\system32\Pqpnombl.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8184
        
        C:\Windows\SysWOW64\Pkfblfab.exe
        
        C:\Windows\system32\Pkfblfab.exe
        250⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Pjhbgb32.exe
        
        C:\Windows\system32\Pjhbgb32.exe
        251⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Pbpjhp32.exe
        
        C:\Windows\system32\Pbpjhp32.exe
        252⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Pengdk32.exe
        
        C:\Windows\system32\Pengdk32.exe
        253⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Pkhoae32.exe
        
        C:\Windows\system32\Pkhoae32.exe
        254⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Pbbgnpgl.exe
        
        C:\Windows\system32\Pbbgnpgl.exe
        255⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Peqcjkfp.exe
        
        C:\Windows\system32\Peqcjkfp.exe
        256⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Pcccfh32.exe
        
        C:\Windows\system32\Pcccfh32.exe
        257⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Pkjlge32.exe
        
        C:\Windows\system32\Pkjlge32.exe
        258⤵
        Modifies registry class
        
        PID:6348
        
        C:\Windows\SysWOW64\Pnihcq32.exe
        
        C:\Windows\system32\Pnihcq32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7368
        
        C:\Windows\SysWOW64\Pagdol32.exe
        
        C:\Windows\system32\Pagdol32.exe
        260⤵
        Modifies registry class
        
        PID:7616
        
        C:\Windows\SysWOW64\Qecppkdm.exe
        
        C:\Windows\system32\Qecppkdm.exe
        261⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Qgallfcq.exe
        
        C:\Windows\system32\Qgallfcq.exe
        262⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Qkmhlekj.exe
        
        C:\Windows\system32\Qkmhlekj.exe
        263⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7312
        
        C:\Windows\SysWOW64\Qnkdhpjn.exe
        
        C:\Windows\system32\Qnkdhpjn.exe
        264⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Qbgqio32.exe
        
        C:\Windows\system32\Qbgqio32.exe
        265⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Qeemej32.exe
        
        C:\Windows\system32\Qeemej32.exe
        266⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Qgciaf32.exe
        
        C:\Windows\system32\Qgciaf32.exe
        267⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Qjbena32.exe
        
        C:\Windows\system32\Qjbena32.exe
        268⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Qbimoo32.exe
        
        C:\Windows\system32\Qbimoo32.exe
        269⤵
        Drops file in System32 directory
        
        PID:8316
        
        C:\Windows\SysWOW64\Aegikj32.exe
        
        C:\Windows\system32\Aegikj32.exe
        270⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8380
        
        C:\Windows\SysWOW64\Agffge32.exe
        
        C:\Windows\system32\Agffge32.exe
        271⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Alabgd32.exe
        
        C:\Windows\system32\Alabgd32.exe
        272⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Abkjdnoa.exe
        
        C:\Windows\system32\Abkjdnoa.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8544
        
        C:\Windows\SysWOW64\Aanjpk32.exe
        
        C:\Windows\system32\Aanjpk32.exe
        274⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Acmflf32.exe
        
        C:\Windows\system32\Acmflf32.exe
        275⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Ajfoiqll.exe
        
        C:\Windows\system32\Ajfoiqll.exe
        276⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Aaqgek32.exe
        
        C:\Windows\system32\Aaqgek32.exe
        277⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        278⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8764
        
        C:\Windows\SysWOW64\Ahkobekf.exe
        
        C:\Windows\system32\Ahkobekf.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8804
        
        C:\Windows\SysWOW64\Abpcon32.exe
        
        C:\Windows\system32\Abpcon32.exe
        280⤵
        Drops file in System32 directory
        
        PID:8852
        
        C:\Windows\SysWOW64\Aeopki32.exe
        
        C:\Windows\system32\Aeopki32.exe
        281⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        282⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        283⤵
        Drops file in System32 directory
        
        PID:8980
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        284⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Ajneip32.exe
        
        C:\Windows\system32\Ajneip32.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9076
        
        C:\Windows\SysWOW64\Aniajnnn.exe
        
        C:\Windows\system32\Aniajnnn.exe
        286⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Bahmfj32.exe
        
        C:\Windows\system32\Bahmfj32.exe
        287⤵
        Drops file in System32 directory
        
        PID:9160
        
        C:\Windows\SysWOW64\Bhaebcen.exe
        
        C:\Windows\system32\Bhaebcen.exe
        288⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Blmacb32.exe
        
        C:\Windows\system32\Blmacb32.exe
        289⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Bbgipldd.exe
        
        C:\Windows\system32\Bbgipldd.exe
        290⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        291⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Bdhfhe32.exe
        
        C:\Windows\system32\Bdhfhe32.exe
        292⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Bnnjen32.exe
        
        C:\Windows\system32\Bnnjen32.exe
        293⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Bbifelba.exe
        
        C:\Windows\system32\Bbifelba.exe
        294⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Behbag32.exe
        
        C:\Windows\system32\Behbag32.exe
        295⤵
        Drops file in System32 directory
        
        PID:8720
        
        C:\Windows\SysWOW64\Bhfonc32.exe
        
        C:\Windows\system32\Bhfonc32.exe
        296⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        297⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Bopgjmhe.exe
        
        C:\Windows\system32\Bopgjmhe.exe
        298⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Bblckl32.exe
        
        C:\Windows\system32\Bblckl32.exe
        299⤵
        Modifies registry class
        
        PID:8968
        
        C:\Windows\SysWOW64\Bejogg32.exe
        
        C:\Windows\system32\Bejogg32.exe
        300⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Bdmpcdfm.exe
        
        C:\Windows\system32\Bdmpcdfm.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9060
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        302⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Bjghpn32.exe
        
        C:\Windows\system32\Bjghpn32.exe
        303⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        304⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Baaplhef.exe
        
        C:\Windows\system32\Baaplhef.exe
        305⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Bdolhc32.exe
        
        C:\Windows\system32\Bdolhc32.exe
        306⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        307⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Blfdia32.exe
        
        C:\Windows\system32\Blfdia32.exe
        308⤵
        Drops file in System32 directory
        
        PID:8776
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        309⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Cbqlfkmi.exe
        
        C:\Windows\system32\Cbqlfkmi.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9012
        
        C:\Windows\SysWOW64\Ceoibflm.exe
        
        C:\Windows\system32\Ceoibflm.exe
        311⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Chmeobkq.exe
        
        C:\Windows\system32\Chmeobkq.exe
        312⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        313⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Cbcilkjg.exe
        
        C:\Windows\system32\Cbcilkjg.exe
        314⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Ceaehfjj.exe
        
        C:\Windows\system32\Ceaehfjj.exe
        315⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Clkndpag.exe
        
        C:\Windows\system32\Clkndpag.exe
        316⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\Cahfmgoo.exe
        
        C:\Windows\system32\Cahfmgoo.exe
        317⤵
        Modifies registry class
        
        PID:9068
        
        C:\Windows\SysWOW64\Cdfbibnb.exe
        
        C:\Windows\system32\Cdfbibnb.exe
        318⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Ckpjfm32.exe
        
        C:\Windows\system32\Ckpjfm32.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8664
        
        C:\Windows\SysWOW64\Cbgbgj32.exe
        
        C:\Windows\system32\Cbgbgj32.exe
        320⤵
        Modifies registry class
        
        PID:8924
        
        C:\Windows\SysWOW64\Cefoce32.exe
        
        C:\Windows\system32\Cefoce32.exe
        321⤵
        Modifies registry class
        
        PID:6972
        
        C:\Windows\SysWOW64\Chdkoa32.exe
        
        C:\Windows\system32\Chdkoa32.exe
        322⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Clpgpp32.exe
        
        C:\Windows\system32\Clpgpp32.exe
        323⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4612
        
        C:\Windows\SysWOW64\Camphf32.exe
        
        C:\Windows\system32\Camphf32.exe
        325⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        326⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Cdkldb32.exe
        
        C:\Windows\system32\Cdkldb32.exe
        327⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        328⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        329⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Daolnf32.exe
        
        C:\Windows\system32\Daolnf32.exe
        330⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        331⤵
        Drops file in System32 directory
        
        PID:9484
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        332⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Dboigi32.exe
        
        C:\Windows\system32\Dboigi32.exe
        333⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Demecd32.exe
        
        C:\Windows\system32\Demecd32.exe
        334⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Dhkapp32.exe
        
        C:\Windows\system32\Dhkapp32.exe
        335⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Dlgmpogj.exe
        
        C:\Windows\system32\Dlgmpogj.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9720
        
        C:\Windows\SysWOW64\Dkjmlk32.exe
        
        C:\Windows\system32\Dkjmlk32.exe
        337⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Dbaemi32.exe
        
        C:\Windows\system32\Dbaemi32.exe
        338⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Dadeieea.exe
        
        C:\Windows\system32\Dadeieea.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9840
        
        C:\Windows\SysWOW64\Ddbbeade.exe
        
        C:\Windows\system32\Ddbbeade.exe
        340⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Dhnnep32.exe
        
        C:\Windows\system32\Dhnnep32.exe
        341⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Dkljak32.exe
        
        C:\Windows\system32\Dkljak32.exe
        342⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Dohfbj32.exe
        
        C:\Windows\system32\Dohfbj32.exe
        343⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Dccbbhld.exe
        
        C:\Windows\system32\Dccbbhld.exe
        344⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Deanodkh.exe
        
        C:\Windows\system32\Deanodkh.exe
        345⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Dhpjkojk.exe
        
        C:\Windows\system32\Dhpjkojk.exe
        346⤵
        Drops file in System32 directory
        
        PID:10160
        
        C:\Windows\SysWOW64\Dkoggkjo.exe
        
        C:\Windows\system32\Dkoggkjo.exe
        347⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Dceohhja.exe
        
        C:\Windows\system32\Dceohhja.exe
        348⤵
        Modifies registry class
        
        PID:8752
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        349⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9268
        
        C:\Windows\SysWOW64\Dhbgqohi.exe
        
        C:\Windows\system32\Dhbgqohi.exe
        350⤵
        Modifies registry class
        
        PID:9340
        
        C:\Windows\SysWOW64\Ekacmjgl.exe
        
        C:\Windows\system32\Ekacmjgl.exe
        351⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Eaklidoi.exe
        
        C:\Windows\system32\Eaklidoi.exe
        352⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Edihepnm.exe
        
        C:\Windows\system32\Edihepnm.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9548
        
        C:\Windows\SysWOW64\Elppfmoo.exe
        
        C:\Windows\system32\Elppfmoo.exe
        354⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Ecjhcg32.exe
        
        C:\Windows\system32\Ecjhcg32.exe
        355⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Eeidoc32.exe
        
        C:\Windows\system32\Eeidoc32.exe
        356⤵
        Drops file in System32 directory
        
        PID:9744
        
        C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        357⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Ekemhj32.exe
        
        C:\Windows\system32\Ekemhj32.exe
        358⤵
        Modifies registry class
        
        PID:9888
        
        C:\Windows\SysWOW64\Eoaihhlp.exe
        
        C:\Windows\system32\Eoaihhlp.exe
        359⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Ecmeig32.exe
        
        C:\Windows\system32\Ecmeig32.exe
        360⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Eapedd32.exe
        
        C:\Windows\system32\Eapedd32.exe
        361⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Ednaqo32.exe
        
        C:\Windows\system32\Ednaqo32.exe
        362⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        363⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Eocenh32.exe
        
        C:\Windows\system32\Eocenh32.exe
        364⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Eabbjc32.exe
        
        C:\Windows\system32\Eabbjc32.exe
        365⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Edpnfo32.exe
        
        C:\Windows\system32\Edpnfo32.exe
        366⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        367⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Eofbch32.exe
        
        C:\Windows\system32\Eofbch32.exe
        368⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Eadopc32.exe
        
        C:\Windows\system32\Eadopc32.exe
        369⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        370⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        371⤵
        Drops file in System32 directory
        
        PID:10044
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        372⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Febgea32.exe
        
        C:\Windows\system32\Febgea32.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9368
        
        C:\Windows\SysWOW64\Fllpbldb.exe
        
        C:\Windows\system32\Fllpbldb.exe
        374⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Fcfhof32.exe
        
        C:\Windows\system32\Fcfhof32.exe
        375⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Faihkbci.exe
        
        C:\Windows\system32\Faihkbci.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9864
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        377⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Fhcpgmjf.exe
        
        C:\Windows\system32\Fhcpgmjf.exe
        378⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Fomhdg32.exe
        
        C:\Windows\system32\Fomhdg32.exe
        379⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Fakdpb32.exe
        
        C:\Windows\system32\Fakdpb32.exe
        380⤵
        Modifies registry class
        
        PID:9808
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        381⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Flqimk32.exe
        
        C:\Windows\system32\Flqimk32.exe
        382⤵
        Modifies registry class
        
        PID:9516
        
        C:\Windows\SysWOW64\Fooeif32.exe
        
        C:\Windows\system32\Fooeif32.exe
        383⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Ffimfqgm.exe
        
        C:\Windows\system32\Ffimfqgm.exe
        384⤵
        Drops file in System32 directory
        
        PID:9520
        
        C:\Windows\SysWOW64\Flceckoj.exe
        
        C:\Windows\system32\Flceckoj.exe
        385⤵
        Drops file in System32 directory
        
        PID:9596
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        386⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        387⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        388⤵
        Drops file in System32 directory
        
        PID:10364
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        389⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        390⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10444
        
        C:\Windows\SysWOW64\Glhonj32.exe
        
        C:\Windows\system32\Glhonj32.exe
        391⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        392⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Gbdgfa32.exe
        
        C:\Windows\system32\Gbdgfa32.exe
        393⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10580
        
        C:\Windows\SysWOW64\Gfpcgpae.exe
        
        C:\Windows\system32\Gfpcgpae.exe
        394⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Gdcdbl32.exe
        
        C:\Windows\system32\Gdcdbl32.exe
        395⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        396⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        397⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Gfbploob.exe
        
        C:\Windows\system32\Gfbploob.exe
        398⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Gmlhii32.exe
        
        C:\Windows\system32\Gmlhii32.exe
        399⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        400⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        401⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        402⤵
        Drops file in System32 directory
        
        PID:10972
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        403⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        404⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        405⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Gfgjgo32.exe
        
        C:\Windows\system32\Gfgjgo32.exe
        406⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        407⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        408⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        409⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        410⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        411⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        412⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        413⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10520
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        415⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        416⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Hbbdholl.exe
        
        C:\Windows\system32\Hbbdholl.exe
        417⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Heapdjlp.exe
        
        C:\Windows\system32\Heapdjlp.exe
        418⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        419⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        420⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Hfqlnm32.exe
        
        C:\Windows\system32\Hfqlnm32.exe
        421⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Hioiji32.exe
        
        C:\Windows\system32\Hioiji32.exe
        422⤵
        Drops file in System32 directory
        
        PID:11104
        
        C:\Windows\SysWOW64\Hmjdjgjo.exe
        
        C:\Windows\system32\Hmjdjgjo.exe
        423⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Hoiafcic.exe
        
        C:\Windows\system32\Hoiafcic.exe
        424⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Iefioj32.exe
        
        C:\Windows\system32\Iefioj32.exe
        425⤵
        Modifies registry class
        
        PID:10252
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        426⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        427⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        428⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        429⤵
        Modifies registry class
        
        PID:10728
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        430⤵
        Drops file in System32 directory
        
        PID:10804
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        431⤵
        Drops file in System32 directory
        
        PID:10952
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        432⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        433⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        434⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        435⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        436⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        437⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        438⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        439⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        440⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        441⤵
        Drops file in System32 directory
        
        PID:10528
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        442⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        443⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        444⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10508
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        445⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11044
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        446⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10756
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        447⤵
        Modifies registry class
        
        PID:10356
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        448⤵
        Modifies registry class
        
        PID:10740
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        449⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Jedeph32.exe
        
        C:\Windows\system32\Jedeph32.exe
        450⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        451⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        452⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        453⤵
        Drops file in System32 directory
        
        PID:11476
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        454⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        455⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        456⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11600
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        457⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        458⤵
        Modifies registry class
        
        PID:11704
        
        C:\Windows\SysWOW64\Jblpek32.exe
        
        C:\Windows\system32\Jblpek32.exe
        459⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        460⤵
        Modifies registry class
        
        PID:11820
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        461⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        462⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11904
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        463⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        464⤵
        Drops file in System32 directory
        
        PID:11988
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        465⤵
        
        PID:12032
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        466⤵
        
        PID:12076
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        467⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12112
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        468⤵
        
        PID:12152
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        469⤵
        
        PID:12196
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        470⤵
        Modifies registry class
        
        PID:12240
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        471⤵
        
        PID:12276
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        472⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11296
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        473⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11376
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        474⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        475⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        476⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        477⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        478⤵
        Drops file in System32 directory
        
        PID:11744
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        479⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        480⤵
        
        PID:11896
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        481⤵
        
        PID:11956
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        482⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12024
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        483⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        484⤵
        Modifies registry class
        
        PID:12144
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        485⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        486⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        487⤵
        
        PID:11344
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        488⤵
        
        PID:11464
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        489⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\Lebkhc32.exe
        
        C:\Windows\system32\Lebkhc32.exe
        490⤵
        
        PID:11720
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        491⤵
        Modifies registry class
        
        PID:11804
        
        C:\Windows\SysWOW64\Lllcen32.exe
        
        C:\Windows\system32\Lllcen32.exe
        492⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Lphoelqn.exe
        
        C:\Windows\system32\Lphoelqn.exe
        493⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\Mbfkbhpa.exe
        
        C:\Windows\system32\Mbfkbhpa.exe
        494⤵
        
        PID:12140
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        495⤵
        
        PID:12268
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        496⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        497⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        498⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        499⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        500⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        501⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        502⤵
        Modifies registry class
        
        PID:11664
        
        C:\Windows\SysWOW64\Meiaib32.exe
        
        C:\Windows\system32\Meiaib32.exe
        503⤵
        
        PID:12000
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        504⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12260
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        505⤵
        Drops file in System32 directory
        
        PID:11940
        
        C:\Windows\SysWOW64\Mcmabg32.exe
        
        C:\Windows\system32\Mcmabg32.exe
        506⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11336
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        507⤵
        
        PID:12284
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        508⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        509⤵
        
        PID:12328
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        510⤵
        Modifies registry class
        
        PID:12368
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        511⤵
        
        PID:12404
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        512⤵
        Drops file in System32 directory
        
        PID:12448
        
        C:\Windows\SysWOW64\Ngmgne32.exe
        
        C:\Windows\system32\Ngmgne32.exe
        513⤵
        
        PID:12488
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        514⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12532
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        515⤵
        
        PID:12568
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        516⤵
        
        PID:12620
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        517⤵
        
        PID:12668
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        518⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12708
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        519⤵
        
        PID:12748
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        520⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12784
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        521⤵
        
        PID:12820
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        522⤵
        
        PID:12852
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        523⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12892
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        524⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12932
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        525⤵
        Modifies registry class
        
        PID:12968
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        526⤵
        
        PID:13004
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        527⤵
        
        PID:13036
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        528⤵
        
        PID:13076
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        529⤵
        
        PID:13116
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        530⤵
        
        PID:13160
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        531⤵
        Modifies registry class
        
        PID:13196
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        532⤵
        
        PID:13232
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        533⤵
        
        PID:13264
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        534⤵
        
        PID:13304
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        535⤵
        
        PID:12308
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        536⤵
        
        PID:12380
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        537⤵
        
        PID:12412
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        538⤵
        
        PID:12512
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        539⤵
        
        PID:12604
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        540⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12648
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        541⤵
        
        PID:12768
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        542⤵
        
        PID:12888
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        543⤵
        Drops file in System32 directory
        
        PID:12940
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        544⤵
        
        PID:13024
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        545⤵
        
        PID:13108
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        546⤵
        
        PID:13184
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        547⤵
        
        PID:13248
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        548⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        549⤵
        
        PID:12352
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        550⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        551⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        552⤵
        
        PID:12816
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        553⤵
        Drops file in System32 directory
        
        PID:12916
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        554⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:13104
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        555⤵
        
        PID:13240
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        556⤵
        Modifies registry class
        
        PID:12336
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        557⤵
        
        PID:12472
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        558⤵
        Drops file in System32 directory
        
        PID:12844
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        559⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13132
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        560⤵
        
        PID:13300
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        561⤵
        
        PID:12664
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        562⤵
        
        PID:13224
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        563⤵
        
        PID:12772
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        564⤵
        
        PID:12272
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        565⤵
        
        PID:13324
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        566⤵
        
        PID:13364
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        567⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:13404
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        568⤵
        Modifies registry class
        
        PID:13440
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        569⤵
        
        PID:13476
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        570⤵
        
        PID:13512
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        571⤵
        
        PID:13548
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        572⤵
        
        PID:13584
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        573⤵
        
        PID:13620
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        574⤵
        
        PID:13656
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        575⤵
        Modifies registry class
        
        PID:13692
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        576⤵
        
        PID:13728
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        577⤵
        
        PID:13764
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        578⤵
        Modifies registry class
        
        PID:13800
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        579⤵
        
        PID:13836
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        580⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13872
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        581⤵
        
        PID:13908
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        582⤵
        Drops file in System32 directory
        
        PID:13944
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        583⤵
        
        PID:13984
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        584⤵
        
        PID:14020
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        585⤵
        
        PID:14064
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        586⤵
        Drops file in System32 directory
        
        PID:14100
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        587⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14136
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        588⤵
        
        PID:14172
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        589⤵
        
        PID:14208
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        590⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14244
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        591⤵
        
        PID:14280
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        592⤵
        
        PID:14316
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        593⤵
        
        PID:13332
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        594⤵
        
        PID:13392
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        595⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13468
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        596⤵
        
        PID:13544
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        597⤵
        
        PID:13592
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        598⤵
        Modifies registry class
        
        PID:13604
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        599⤵
        
        PID:13724
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        600⤵
        
        PID:13808
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        601⤵
        
        PID:13868
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        602⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        603⤵
        Drops file in System32 directory
        
        PID:7352
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        604⤵
        
        PID:13928
        
        C:\Windows\SysWOW64\Ddakjkqi.exe
        
        C:\Windows\system32\Ddakjkqi.exe
        605⤵
        
        PID:13964
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        606⤵
        
        PID:14048
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        607⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        608⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Dmllipeg.exe
        
        C:\Windows\system32\Dmllipeg.exe
        609⤵
        
        PID:8
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 408
        610⤵
        Program crash
        
        PID:14288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 8 -ip 8
1⤵
PID:14236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abbpem32.exe

Filesize
400KB

MD5
c679ed6b5539fc39bf2e051c544e718c

SHA1
2144e384a7b1fff209395818988e8860838958a8

SHA256
547c16bfc900678b46ed8c4d73cab8a1ee873813b34038f7b31441314ac5522c

SHA512
61a99d9be63740015410f50e8acc8ff11ecb0e49969705e38da32caa36c914fb7220bb716f604d6f1c2bcf1a1bc6a8152b8b08659a4ad99c82e5b9751456436b

Download Submit
C:\Windows\SysWOW64\Abpcon32.exe

Filesize
400KB

MD5
3f3b0978c7e82dc5a31fcf458bcf3a45

SHA1
d5219587f5f8e8ff754fe2eb38dce102e20d3a30

SHA256
62a89e4ebaa4bc7b614e2494164e5d24d37eb62f247a118bdd61ba510e93a24a

SHA512
50cddbba22287170e1b9a80fd0cf5db8617baa6d801555f6a53c6768f2be5b55d51d38f0aa37e650eb45afbd50c5126b0eb8cbf2f6dfc42573f8237392bb3c47

Download Submit
C:\Windows\SysWOW64\Aegikj32.exe

Filesize
400KB

MD5
4aeef48ab1a714fa6c34e57b430e508c

SHA1
eb23a7c6950047813a13d4d7630ec0b7901e4ffd

SHA256
4382e790132b1a58fdf9f77b9ade7f875cca147761b37e2a6f07ae2fd823f173

SHA512
4452aee06ddba997006e2c9433e5b3019d0924f5a33c2d5a245ecc67e7de92706b6bb7472462b786fd445df1330e2506e46c52c123e92a8ff7c1f5b6e220c738

Download Submit
C:\Windows\SysWOW64\Afhohlbj.exe

Filesize
400KB

MD5
21039b1df3897d1e5807d035b433f099

SHA1
2b0b3034a28b5789b28253a8958bd5090a8f2eba

SHA256
e44a31c43cb527ef75ece5b6d4f6b5845dba8320fbc8ed265c8612e196e88148

SHA512
b5152f3cfdbd11a0ee03b82e3809f2dff5749d8a8d34e5569a287f8430608f04eb2767cd983c7c32ec262232cac3d9d22608ef107c95bc64d5131bf38dbd54a8

Download Submit
C:\Windows\SysWOW64\Afmhck32.exe

Filesize
400KB

MD5
64558b2aa9f56d8ac4a61c78c00b6c03

SHA1
00d235e5cbdabd60bdf6deb9b2c62a8f021900b5

SHA256
ea47b542a9e5447b6f1f4e8da0565ce1e9184548f62b7cfb6304ab1e11784036

SHA512
aaa5a8b8cdc5b5b235434547a2a3579be9c0dce6a24e152014d110117737f2656eb0c553cb52ca75c0150b25cbaec2439cc42995ec01a826e6512fd2f47b0875

Download Submit
C:\Windows\SysWOW64\Bagflcje.exe

Filesize
400KB

MD5
c06e4875ee093a2b8d3d19b957df15cc

SHA1
773de16e17e5f60a1235ee430c75e9872eb49284

SHA256
640f86ce8e56621b0c02fd28c17fefedce8547fa77141802f1e373882496f1ac

SHA512
c5e4c66d678d25086a76763ee786669cbe07a2063f2bb2545f0d44923e0c85c2f58cc06ddcf8e90c167b8b24cd1e6e550d364736bf9b71249ddc226702e24ab7

Download Submit
C:\Windows\SysWOW64\Bganhm32.exe

Filesize
400KB

MD5
6c5f6f9d1d34bc7f028e062726cee7dc

SHA1
cd7b3066803a6a114199260229d95a2968b1aa2c

SHA256
42b637fe21d6798dc69490c66d62efa322257fa76e1c1ba6f16e773a2b477d97

SHA512
23cff7604b057f67649d06b5b96f5502e136883826ec6259443a2a6a864c28ca3436b2b7c50b2aa3d6a1f6b462e8c07f8d08b7074ee117c9bca0365dc62dba38

Download Submit
C:\Windows\SysWOW64\Bgcknmop.exe

Filesize
400KB

MD5
e57bf737cf8bf569d95ea709acf90a9a

SHA1
b190df9064172939f1e4ade35218243e44a83a88

SHA256
e44da256860baa00886b26cbdf936dfa73054fdfbeafb290b30dca5a858b968e

SHA512
57e4beac5cae34f0bb11ee3aec2bd5f272df5c082930a54b4c8328dcb69bcfcc07fed63846fcbe87da1b988b2c85f3178f16eecd3b245bfa309207d793c0ac01

Download Submit
C:\Windows\SysWOW64\Bnpppgdj.exe

Filesize
400KB

MD5
dc17a2fc1375b4c505a3d73a0c7a5c43

SHA1
9ee1a0102a180c882079bdf31d9bef9bb703e16f

SHA256
974d6085d10e48768557019ad95775182c1a2f3952adf78c42fa21979ce1b755

SHA512
ae7fd520ddcdaa8279b20574990c9d2b1695fe4f49ca34dce654605f8239bc4350e117bac91bb911d73271484ee1c9b86d609cc8f1fda80017afb55a2fb1dfc6

Download Submit
C:\Windows\SysWOW64\Camfbm32.exe

Filesize
400KB

MD5
8f38f1621f699a44d20c6258cf28fb14

SHA1
e214ef521e5c5ed7558b1a44d8db024f26e1dfd5

SHA256
02785373ccd184de7e752e41b43eafc124a9d2de42cdc86761102f526811cb0c

SHA512
11a0fcb5b52086ef163d200cfe06be802e068127f99d55f11d1783cfa8e7936322995d5f32d495215d218f2aad983acf6a5b5ea0e672909170d1c49b5f4eda67

Download Submit
C:\Windows\SysWOW64\Ccmclp32.exe

Filesize
400KB

MD5
48259446eb6b0336dc68942de44473b0

SHA1
c7a45d541e352bcbe9661258e59bbb24b230b7fc

SHA256
0053323c14102a8d6fdc5dd882a8a35f44ae309b912ffbf4d1abf64151c539df

SHA512
a55de709b83707f750d81f2d0f8a7d2a1d2d3e65ac41700eaf585cfedd2b8209321d843a76d9a3fcfc40b8589efcaae39865d0d5be64416e86e2a638297186eb

Download Submit
C:\Windows\SysWOW64\Cekohk32.exe

Filesize
400KB

MD5
ffc7170ba3f56d0f1a7c91c514fc9a42

SHA1
b75ca9364d6a77393b0662a1a1e3691a99b348f8

SHA256
ca8832d3d7913de5c2323f8e3974fb7bd276bebbe371a7c4c7b94ab7009ce81e

SHA512
832931ae090566fa6866120b737507d0ae127dc21e9a53b3c49494b6640acef2e8e240cac6810c2af6163007954ab7b40854c1700bd1bd7a304319310f3e7733

Download Submit
C:\Windows\SysWOW64\Cfdhkhjj.exe

Filesize
400KB

MD5
3a5304c31d0b5186610a98204ec34620

SHA1
dbfaa465b5bee1930ed857e463fd88438e1ef2a5

SHA256
28491af41a78cb66243714585db0515da44f18733e3cee4423d6ac39e2feda49

SHA512
10fda4a89b540225e34075d7602412b29088245c24f202fd581f560516ad7306891c321400c76b88d953acb028cd5ca9eb2b871765787a44df187c62d7caa909

Download Submit
C:\Windows\SysWOW64\Chjaol32.exe

Filesize
400KB

MD5
4e36705f8ac6ad46cbce609be9bfa9cd

SHA1
4a820acae263ddb4333a17b5bb3c2ac0f1792477

SHA256
d96b202b0a54488718f3326686ad036ca6add5c83613c7e585e448a09dd694b4

SHA512
33de78dd8c778a5617e652b4f1ad40af7833d8ba987a9a6f29e52b90413be89053d26fd10820e5f2b818f530d85976d25be01081b5c40d9f85f9e4f0bae29232

Download Submit
C:\Windows\SysWOW64\Cidncj32.exe

Filesize
400KB

MD5
964c6748d9c3674b94a52f791e1267fb

SHA1
e1ff3d3deb0c40f47a4e569eb4d21c60e363498b

SHA256
5bf837e3278d4a2cfade679ca185cd89c2a10cc5e798b81fb8cf568777b80413

SHA512
0fc039d9ffd8158d00c3224f491aba9f8a620d6443aa7e4ba9b40b5bace35e9d146e9f78f8882b350a9edf992a39ac57d2f081028a23ea3d105112e782730404

Download Submit
C:\Windows\SysWOW64\Clckpf32.exe

Filesize
400KB

MD5
1053b846f8ce8d9b63a7f1843277825b

SHA1
bf8c13e390265044a059e3d871d1e3e4888e8149

SHA256
939b73203a60b8ade2278d0854018780686040f0e48ec740ce1ffb0be5592923

SHA512
1c2f017b7efa07f9d98b1d7f2bd3f6ba10f82a4e319df42f3b41c9cd0b7cfa50eed4cb13951b740ef69c51ac8d81e482f6b9429b2e80aa5b31731d7b4b301344

Download Submit
C:\Windows\SysWOW64\Clqnjf32.exe

Filesize
400KB

MD5
2f576fff1c0ad43d86ab6014fb8b1a30

SHA1
b8bab4d24d81d252f3b8da7f4fffc7ba6ef4128e

SHA256
041c979a4e04bbc46a5caca135c238fc800c58de9dbfebcd981c0d03ac08ff19

SHA512
a2165d4bafaf9357a963cdde4e15bae875375f3cd37d1cf4fad1c247070a10397b1239fbea94ef2c2e8cec5188eb898f51ae3d2e0d3fdcdc135fdef6c4d0cb49

Download Submit
C:\Windows\SysWOW64\Cmiflbel.exe

Filesize
400KB

MD5
fc2065b1e72bd553315d916c1b56e754

SHA1
ede44413812800795be1ac8b4f88ad97a8c7ff82

SHA256
7dbc7beea4d7988c16350a806a8e8e964760f6f367a1080ec6a9809b21a0d9af

SHA512
2b85c4ae8deed66de46465f83396da07320791c852cdf846330ec1dd676772129e792b37b406fcb3aa726a8b9be523ec6eaa191ececd153c4b1dfa10cd31b01e

Download Submit
C:\Windows\SysWOW64\Coagla32.exe

Filesize
400KB

MD5
1e1b8f0b3ff1f38b4c1f9bfac429b9d1

SHA1
5ed3872a51fe3ce579d557d202f4d58e6595d104

SHA256
f6bc83f7a307d9cb345921abe367af95a356be0743f038bbef255b7fb198f508

SHA512
dec063565a2d78e9faddc3be83f46fbc8cf45afe83698f9ce9bc123d07b9c025e473a96636706165e2a8e19e7d6344222c90a14c93b37dd0d7e1ee5bdbdb87b4

Download Submit
C:\Windows\SysWOW64\Commqb32.exe

Filesize
400KB

MD5
9c793a78ad2bb04afd761c883bc46485

SHA1
d4ca43e95fe4b397faded84167c4ba2147b27b13

SHA256
a60182ed57fd136a0f7279b423e9d06a47ec8fb4752c4075ea1d55b3a412cb80

SHA512
86616b08611a23f85b96db70f7c44eef54304cc3c3df43df95a379420edee584621197d92f2a8cd6184f98ebd075577043486baf0f244dbd034b656bf2a8551e

Download Submit
C:\Windows\SysWOW64\Coojfa32.exe

Filesize
400KB

MD5
61cfedfbefeda9ec1fa5bbce9d08672b

SHA1
9ca9ac8508ab1bb6e71f60ba3204191261c0752d

SHA256
97b7d2985c93fadb82f24bbe016b3f62e8cc64fae0cfb3cff80229ebd8c79105

SHA512
8785c662059aa03671b76db2c13664979534392fa4c3a847399feb0ac8f9c39e3509f4a6fbb3f7b2709d219323cd1b88295f222516d2a9b3992a2496e19ed0da

Download Submit
C:\Windows\SysWOW64\Dabpnlkp.exe

Filesize
400KB

MD5
0f18a51a4bba39678cff4bf5241a7ee2

SHA1
1f255dffcc581a29d636303812345fe99f80061c

SHA256
bd63293352225a5358e597a2e73fee852fabbc564ad93c0af4d9314a3a0e4b1a

SHA512
73c8eeaad7fde7daec06c55fb23da757f1079ada74a5d77f3e7c18c83103e6dd701b70b2c22b5419c201ea640d7c6078c362e34d7abfc8c4506464b389fb678b

Download Submit
C:\Windows\SysWOW64\Dadlclim.exe

Filesize
400KB

MD5
5ad048736e38614a3d5e24523fa3bab7

SHA1
2768ab66ef9f526a75408ba6608132e2e748b441

SHA256
6e1d8d686916223a4a600d127e88e2bdba2ec18faa2f0b07ec8e99dd6ff3056c

SHA512
6f20eb2fd53af493db25554212cac724f9f1b49be9c64098c389035d55f9b480710cca013a7313180782846dfacfd05cfdeb8301879a298f052adb5f971a899b

Download Submit
C:\Windows\SysWOW64\Dagiil32.exe

Filesize
400KB

MD5
1b56cafb8d2963de8a3d3bd60583d960

SHA1
5053b138ce077f02d47afd39967aab18ca45c069

SHA256
d10b55834edbf9b1e4e989b98771d6d073fee887e757a5750224eebf096ea317

SHA512
e1fb36a7f39ba4380bcd99047fbb303b9da2f7ce97dd3a777ddcef8cda4036ecf5324325a8f5e8c074be236efbc3aff0c7820d0547470d536a1f26c954b1d481

Download Submit
C:\Windows\SysWOW64\Dcdimopp.exe

Filesize
400KB

MD5
129bbba6c0c500473b7cb9a50612e081

SHA1
16fa1f3dd83258af2a855accd510ddb17c700294

SHA256
0b2d15188ac3c1a15a8e4397d4994c98f399332d5d4a3668bc4f1b89588d201a

SHA512
b5fae32c14cd95c87cbd34f9c2db829648fb27f2b81297db29ec135a8cb22cfd7513266ae61f6a21f62397955a779ccf744436722181822910a3d615d7b588e3

Download Submit
C:\Windows\SysWOW64\Dcfebonm.exe

Filesize
400KB

MD5
a99f2e2e8f51117d30eb3b9dc12b6097

SHA1
574aed5122e425c2e5810ef03dc2141b5547c41f

SHA256
0b145a8769a345281d7860ff2bacdca85995e965bd1c3f3f14740b9e4ad91c7f

SHA512
408a6985d33376c4b00fc97984fac0e1e93143e03c829851a70256f7adb8725987b722fff200a42720d52c64f0d000f1c6f0e8af6839ba1dc910e1d7f84d6d9c

Download Submit
C:\Windows\SysWOW64\Dcopbp32.exe

Filesize
400KB

MD5
89bd520e0cc81b845ae02d419d2ff341

SHA1
028dda72473468452c742e6c86ee04185c38118a

SHA256
b30d2d99cd4a9b29e89248fdff75d67166dae7da8e0df5cc11b8c4b0937adfdd

SHA512
bdb5b9a680725ad4764d83db6823344918a1234508c5f2143e68f497ee7bdd180c682b2461fe725344cca9d70c57d1384622f84d847d3e2e35f6e581147f164a

Download Submit
C:\Windows\SysWOW64\Dephckaf.exe

Filesize
400KB

MD5
5ef3fe84bafce9a4b0f2e4d3c132a3c6

SHA1
8a986d4168399eeffeec18e786d87a1ae7f8a00e

SHA256
ada9f49503bca8ed29f4b3cbf1f679d814df6bcbbb2a6f8ecc01bad36517678a

SHA512
149b561ff7795da5491f6f18c5f527f785f2ae8aa646e78c7defbb7beb48c7a068d409ef3adf897fd331a9c21bc3b01d3be9da6f802bdfa6e2246cb831d9f38b

Download Submit
C:\Windows\SysWOW64\Dhlhjf32.exe

Filesize
400KB

MD5
815778ba0e63a2d430b3c0d353563c3e

SHA1
2cfeea29dd877072aba101ae00c3cc7c84f401e4

SHA256
6b1c1b4754da8da6311d4e618a777034282e85a569b73afbe9bb031a4d88cd65

SHA512
05f0872349622224e47eea1c81751b1d0d5cad4c1e087f964026f231a2c43c3903d3724309a786b7a5ff68f1f8b4ba3be5ee352c2646088bfc4f23a988e19941

Download Submit
C:\Windows\SysWOW64\Dhqaefng.exe

Filesize
400KB

MD5
b3504d264d26d48de50adb42a34838fb

SHA1
46316ae9a7475b12ab007188731c46c7f7d22e77

SHA256
607df7df6ffa31ecc5fda0ab687fd889801fbeee9b0a52cea6e1fc22939ee73b

SHA512
d815d102c87242be5a08adf8fde559bbd0267f567b93ee3eb01ecc58a73f6c61b4f75e0ca78705074ab94e9110d554e01df7955ce8671a198c98c06f632ef144

Download Submit
C:\Windows\SysWOW64\Digkijmd.exe

Filesize
400KB

MD5
6ae3f51fe4acf6bb35e6b10fcb2718dd

SHA1
54b07ac933258e381c9c71ad8a9d5c49bf6b635d

SHA256
f445b7c693ef3585ac964444b9460b227e0ca691da6b1c3342f671d0a5d4253f

SHA512
9b691b5d9f8e40ea7475dd4fd50c3d128627622330b7a71aaee082b08cf70792aa3ae05c994301aebbd4833cb83081d235f55d0ac7a791ca7fd2bbc8d5ed3a4b

Download Submit
C:\Windows\SysWOW64\Diihojkb.exe

Filesize
400KB

MD5
fb6d46876450e7ab5d79833820b4c169

SHA1
1d958276d48b0b10adf142089b50cc786ead3122

SHA256
ce5331e63d22e23cdde202f62f1ec3d4e1c09aef2f21d9d6b1d4ac353f2b927d

SHA512
7d459330958ab2e77ee9f5cae0ff61aa314b0e364dac40f6de7f1b64cab2edcddd5f8c14614c2e5cef5c0e59475bdbb0469bb38e6c62a74ea777bfebb74c13c2

Download Submit
C:\Windows\SysWOW64\Djgjlelk.exe

Filesize
400KB

MD5
bc4a022b22dba3207eb598464333d7f7

SHA1
a969d72b620670185a7c9224cd8edf31e352dffa

SHA256
28f8dd3a0d22de269464e46b843283d4d2fdb96248445fd96446bf25ed238f6e

SHA512
94259a2bfa632aaf861b162947265fbf15565f8083f52027abe9afb674114cde2971213505dd74292d4497c85956f2d0fdbc791d92f0211311aaa5938300034e

Download Submit
C:\Windows\SysWOW64\Djlddi32.exe

Filesize
400KB

MD5
ee63ffe41409f1776278473e4c2f25f4

SHA1
699dbe35d75e12de25093748a2bf78b29d110bf3

SHA256
1c053ee820b2033481a88ece9f0265bdae4298d4cdcbc56d921131ae771adf63

SHA512
bb69fe1e81d3acddc72da29f20393d80bd87243c4d7f3de771c7fed0cb8b085adc085895fb77e9cc826597aaffd6526e78708c6f694b16096b73f6e532eec0ad

Download Submit
C:\Windows\SysWOW64\Djnaji32.exe

Filesize
400KB

MD5
2771ab741ac3a77b2508eb6e49e8e181

SHA1
a817850d860070ff6d35444a3af08d214f5beaa1

SHA256
57e2715cd7cdef1bb67223d6af62e4f45d8866697bdbe39fe6e8c4de1d33a0f9

SHA512
af99cf420bad9a9c22c64ab96ce6f36dfdc32772d1cb48861e9f2788eb3f1315ca7c1199371b31a05c98f5274cae0434a38faa8243f90c1be33e7686165b229f

Download Submit
C:\Windows\SysWOW64\Dlegeemh.exe

Filesize
400KB

MD5
98edcb09f35d7b3e2efcd1ebe60ba930

SHA1
8a53a150e180b40e653653427b7e515e9209ceec

SHA256
c558e933f6a009c38319d632aba9621da60e3f07a8f788ff49a446574301739e

SHA512
d2ccacfe37458990a983301b57d2fd6545294a445170b94e5f4b749f5b6e02cebde2bab4bc17d684a8aef9976fdca8bbde668d9d2ea7d3aea1ecd0ccfc244a0b

Download Submit
C:\Windows\SysWOW64\Dljqpd32.exe

Filesize
400KB

MD5
4fc41e687054d0c39478df8fd7a1fb1e

SHA1
219d9178e9dc666cbc1da113614d74907b3a95bc

SHA256
cc52c3b909b9f43727b02ee6eaa31ec89eb93e2991114274808aa084d9201aa4

SHA512
909976c31226f6d4236d4d8eee3abea105c80abce01ce399884da001f8e23dab6f2cf62cdbb9568cb2edc7c269299a23678094af7bda3ea7a15c44a915d8c7b5

Download Submit
C:\Windows\SysWOW64\Dllmfd32.exe

Filesize
400KB

MD5
c59e050aa23ed12155d628143884f32a

SHA1
8cea472e1a853bd9728b8878d70829add5ae89b2

SHA256
67b1f2b762a615f700511e696538df4e99aad953ffd530706862265143cceb7f

SHA512
92ae04abaa0f0135ace20ba3dc7d56f726d07b717724fa80de189068680a6e2c88a606d3f283fc560a97fb228c42660a8cb80c26020203205c3215c291917f4a

Download Submit
C:\Windows\SysWOW64\Dofpgqji.exe

Filesize
400KB

MD5
e19aaf8f611263d124ac729a94944847

SHA1
4ab164f099a03e5118a857829263ae7df5a42e87

SHA256
e14237f2d613c400182ee87f1d4b456bae7521949455fdb5e0e0d8785ba397f7

SHA512
51cb76e99795320c7d4497e836d61ce95e41d6536b49322a0315481353e7b92843c6acf27514eb3fb970572945aa3fce9d422cbc7068ab8925ff74529e17d627

Download Submit
C:\Windows\SysWOW64\Dohmlp32.exe

Filesize
400KB

MD5
3f94ebadc0ea5792e8dbecb2ac5561fa

SHA1
f0e9d18bdbb614af316c6d8b54259b131a02ca65

SHA256
c98c07de2abd70a86047d92630ccb12a762774941fa7542c5e492d59e04d7ee9

SHA512
1cf979b16986a5c8143104de1ab338c4ca4c5187ccd55d7b3722708500e0342a6675361d16c34ef79ede61929138880cd82862da4eafac907b98133f38e8708a

Download Submit
C:\Windows\SysWOW64\Dokjbp32.exe

Filesize
400KB

MD5
8c9081ea7c2f741165d4edbe4ceb3a19

SHA1
435bc22f170da4542fedac22c411b0558b7997a5

SHA256
411eaff785a630025a5cdf4a00a01cd763bb052842088aaadeff207ce3bf8282

SHA512
83c4c904a935247e295e4ff1d85d885862113ec5ebb073658020f54c58f3fffb7081c69ababcd9ae2b2fa168a913d79ea0fa44dda1fc53fa8dfc94d964220344

Download Submit
C:\Windows\SysWOW64\Dpacfd32.exe

Filesize
400KB

MD5
8d950b4e9d34d1405ebf0731a00ab4b4

SHA1
5d36f42fb45449325ffaadff8b2d97eb32ef91dd

SHA256
c93c2d265db7de89a7bcdd27d37cd2cf8e4370227d083dae86e2819755c7a167

SHA512
d20bee9b774765ddd78bfb0d83bb00caf57e9edf611e4ab14a2b91bdf27ac0234e53f8e4b220c6d1651a920e642c18dea7cd7a2bf5a6e54f93f025ed6d31139f

Download Submit
C:\Windows\SysWOW64\Dpcpkc32.exe

Filesize
400KB

MD5
0cfd8dffbe537022a8eb95efd5859ece

SHA1
8457a8a0ff8091133162efe746771388b3a7e06d

SHA256
30bfa77f8867ab8f4206e3fa21fa555bf69613c9bf7dd8946f64fa66c2bd66cb

SHA512
baac559a1c53a497a1f38c2271a1c222db36f3337d5873d9eb6ec44e28f61af735b1069b20a2867d3205378cae23e379ebf790343f7b72545db58552e49a0502

Download Submit
C:\Windows\SysWOW64\Dpemacql.exe

Filesize
400KB

MD5
b2f057211ae188cb81bcab779a187091

SHA1
166437ddfa6656d4c8a62a0049efb75656ff14f6

SHA256
fe48dd0b1caca77af829a5b3774b9c1e5f0437c0f87d51964e39d8d88baef351

SHA512
a0853af9ef274b7488728582428735b4a51dc9f1e27995fe4b15b4d3686127fea1126a8e1630e05147b971e215b1de7d475e5ef5070e6f08cb1c541afed8e31c

Download Submit
C:\Windows\SysWOW64\Dphifcoi.exe

Filesize
400KB

MD5
772eb5f8201fa803686d8fa807b06e50

SHA1
e64763adf368a81a82b5e3c1f9bb88e428f8df21

SHA256
cfd547f5077979240f01f6df7b20193a7024b6ae104a552c500ffff939910d3e

SHA512
447333ae696a14315039dd753af13bf4c2324a4b8736d9b705e451420600e425dfdd24393a37f4c6e91e6e6432b09d8053b37c5440528502ed964088bb6dd0fc

Download Submit
C:\Windows\SysWOW64\Gicinj32.exe

Filesize
400KB

MD5
6ffc4241aca71fda60f50fef0bade0b8

SHA1
9889bb336e3863e507c1455deeb0ace20e5911fc

SHA256
85f5b0cb6d3871027f5dda2137445c384d0f1c9707fc06e5368aa054ced43495

SHA512
67814625d5418f5bdb009a29b4e27c36dbe6ea90a1122c3f8bc414a386e12d230570571867f3186167527872d4691fce31e233602d0ea9745bf881752f9eb78e

Download Submit
C:\Windows\SysWOW64\Imakkfdg.exe

Filesize
400KB

MD5
fed2583088a4c2d692a971b777ab0b4f

SHA1
76baa3b2d2271d0bc88183b45ea02ecdb36f8885

SHA256
1fc7dadb108cc19f9de21803238dfb937c89490510f57dabc7fc8b719ac73901

SHA512
e45f26ba3f6f5e6d849d00a7a7db631ddc14208f70944b2691cb2589d9a2cfd1f72bc501703a1be91fb902949828035ef00fd8ae9331915497c7c1cb57eadef9

Download Submit
C:\Windows\SysWOW64\Kfmepi32.exe

Filesize
384KB

MD5
62a421ceaf3db849d3cf5a981fdabc71

SHA1
0a6b0e4207cb6d7b6e06e70cdb0c6480d5026729

SHA256
1cf8b2cc3ca0b3b4410dcceadef56925d8d4d72ed0e83b2b80f6fd6e24f11806

SHA512
62f0849f8bfa235e22b8d10112e4fffe632c06767170450ff726ef25d9ec1527aad52fbed0866a4844f60e1689a610a0d385449aa32787a3e3a7608659a24393

Download Submit
C:\Windows\SysWOW64\Kilhgk32.exe

Filesize
400KB

MD5
3251845a1d4cbe48e9cfceb218919f07

SHA1
eeb7da8ce5e3b2a4c9f8031906ef867ec439e565

SHA256
6f50860696f6e91f0e9c15b62dc65a8e424c3bd785f4f7ca46de248ef4c356f0

SHA512
5758f64af45bdf7dc73ad8193e8da83a02c4dd8149e4eb0c29152e34f3cce120ff3bf5caf8635822de061268d018bc2bdfd2fe9630ec6044d00c168f8cf5866f

Download Submit
C:\Windows\SysWOW64\Lepncd32.exe

Filesize
400KB

MD5
a87da1aa4d350b291ae683c493873916

SHA1
3d13bd33501af86588fba490a3310d4a9f0a22fa

SHA256
edd58ef4cd3b8a338e78d131a6b9f0805af222b3e83452b84cd274c45443f5a7

SHA512
d337bb896b4632b7eeabd3caf2d6e3cc65a04b99d602b3dee6154e3bcb507ae2e3e9dd7cd0ab342c0929a1016fe3b04e7904848b5824fcaab0ac9c5ba1678a76

Download Submit
C:\Windows\SysWOW64\Lpqiemge.exe

Filesize
400KB

MD5
849bd71fbe2b71f560c1185c97b1d1de

SHA1
6429a2f5c7be9ee41ce59cc48ea2d70902029f35

SHA256
1ffcb446f8f05d12dd9f3c6db3d5f55293d7f16d8e8516ae89d6f3813f30975b

SHA512
10106acfdfa2e13b2b7b93a82a69f69346edbc84df5faf6addc28c1cca71d825dc6acb96f75af4c9e2402da2f79cea6ce1f295f0daceba5f2c16d8ff7cfce4d9

Download Submit
C:\Windows\SysWOW64\Mdfofakp.exe

Filesize
400KB

MD5
1145369064c99ac16a565f2372068336

SHA1
95109063541cafa86aa120c3f7056372d980d634

SHA256
6417f33eddd214108bb8d2531f387d4adcdff1519dec9f5775e0ad3922162dc0

SHA512
dc795bc55d4708fc7dc228e78e5a51981db39dcca071302f1934790dcb328f5a5ef9a38e5b59ae11e93e8c928a12ec225bf3f2d17cc1139635d832c655d1d5c2

Download Submit
C:\Windows\SysWOW64\Mmbfpp32.exe

Filesize
400KB

MD5
6fb4414447b4c90a70419bef62afd4c4

SHA1
9bf35b55fcf21adef61c86d975d0786a2f26e2f3

SHA256
16ab4c370b6b54664e8129b8962aa4fd558ed8b40ef039c74b27d4c99b3e2026

SHA512
1524c7860d05553293f405890d46e5b9bf1d4a23f936441a952c7f1cb9680c2294c5c676acc4b1d4f3132a1d6bdf276adead331580c05d11576356dfe5eb93bc

Download Submit
C:\Windows\SysWOW64\Ncianepl.exe

Filesize
400KB

MD5
a95d0e4d54ce577c55aeec10d1e10492

SHA1
864e424741ba306c1a831ad4b25402ac7f750703

SHA256
ff14bc67a41bf24e9eb04c4451799d7445c05de7227d777aa84b9d0b6f2b69fe

SHA512
314da9b6d8cf7024caf34c403b2cc4a1e50606b5cc411dc556149748ce5a0fd6847add83351acac3279496244736484e28adbe57f88b404f5efb5f5f790ce91f

Download Submit
C:\Windows\SysWOW64\Obangb32.exe

Filesize
400KB

MD5
ff173203d8489989acf7b2281279fa1c

SHA1
a3eba02d239d37bd9055cb8a191f1d39acae146c

SHA256
a30a54eea5bdd2dc8bd2e87f65b2e40b5601d5baca545bc8a27870471d3072a6

SHA512
4287c53513e5eadc202c4225eb8c19c0dbc6f089e3cf46942de51b64b4203fcd7747352f48d070fd2bb1642bbb7bce678e36ebcbe442238407cc434db33a2443

Download Submit
C:\Windows\SysWOW64\Ogpmjb32.exe

Filesize
400KB

MD5
5971efec46d3448aed302077f76bf0bf

SHA1
94a4c07aead9de0c3180d1d2e79c6e939f79c65e

SHA256
7939c786e57dbca7a315e87ecf99c4e304d1cd80fee35ef4cf10210596cccd87

SHA512
ce6a4122398138b9ca4815ec938c7b4e2dcd1779f927069fd41f597a7cbc739a69b1c8ea5b4aa59a86cca35675e64631e9d892eccf4cd6091ebeb817ba2e05c9

Download Submit
C:\Windows\SysWOW64\Pengdk32.exe

Filesize
400KB

MD5
b91059620ebd6012fa9a71ba4c69869f

SHA1
44a2046b0efc85e16e0407193fcd0e7128f02c4b

SHA256
7fe752f3453651583a0df525ebb0fb2d56814a9055b35e6ba88d9e23483e23b9

SHA512
bb1dc98ec7d810f29b4dbcad6ab4879ca9e724cc2ee5b507567139ca724ffc768ecbce1d63413dd6870d349d012dd61dd3843df63086777ddf9e8e99c1148523

Download Submit
C:\Windows\SysWOW64\Pgioqq32.exe

Filesize
400KB

MD5
e5757ee42c59d953e2528ace4cc709b7

SHA1
32da7c369629e4d746715e842239f8cf9f09ab36

SHA256
22a0c2b45452fe94808fc95cf1ca35912a95a623e35f00ab30659287becb5ba3

SHA512
45af9a72db12d29a09571860d338dc24bc7817247378b63e4a58f4d64ba4fd19ff09859c5e8380e8e0efb9dce687b4b46b1e9d683a5410ba7a0917a310b848a6

Download Submit
C:\Windows\SysWOW64\Pjffbc32.exe

Filesize
400KB

MD5
ea6e9d4177b61bed9bc9063f41b04544

SHA1
496afe966bd0d59e63dfd0382cde0b45d4b53e74

SHA256
8fb47e556e7178f483bbfff20c726a72639b784b3fe3047d5c0fd214ccb48be9

SHA512
d46474b6e45e7528c9efa4204da4a5f93b24156acfd50d4c705b8b11e56c7a3f0c52db61cf58df951fe161bdf7e31b4be691998451ab0c0addf435ad68ddc0ff

Download Submit
C:\Windows\SysWOW64\Pnakhkol.exe

Filesize
400KB

MD5
f2bbf4ef1ad20f091da31b19e0360dad

SHA1
410b3d8d83ea92ed79d7a7234563c433aaae7bd2

SHA256
de190076a8d54b87ca2766de8370cba4cea33fcee17da3e58082e294fbe1b7be

SHA512
42e59dec0dc8a684b2ad3d0896dacc1e25fd515faef375f51c7676f58963b3dcaf8b2781316e65e88c5ab9672d0ce5daa7d277de41b81d2685d5b68833daa336

Download Submit
memory/8-3826-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/396-430-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/516-487-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/724-542-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/804-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/860-455-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/872-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/984-405-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1080-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1220-536-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1240-448-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1460-393-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1468-457-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1488-449-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1580-479-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1732-413-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1808-412-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1856-422-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1884-384-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1960-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2068-503-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2140-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2176-465-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2260-442-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2308-432-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2424-385-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2608-511-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2616-391-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2884-377-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2904-439-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3012-485-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3048-433-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3084-419-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3152-472-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3168-459-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3276-477-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3348-414-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3416-410-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3480-421-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3520-440-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3632-390-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3644-504-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3672-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3692-496-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3772-378-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3924-517-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3936-535-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4088-431-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4120-529-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4196-427-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4236-399-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4360-497-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4404-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4404-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4420-491-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4488-493-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4508-441-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4544-456-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4556-523-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4596-509-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4616-480-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4804-458-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4928-495-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5004-471-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5024-429-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/7956-3828-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads