dc6f3cb095aa9d210ecd947de06cc37ca2560a6352b01ac4dd39fcce6d08b810

Analysis

max time kernel
150s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2022, 04:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc6f3cb095aa9d210ecd947de06cc37ca2560a6352b01ac4dd39fcce6d08b810.exe
Size

92KB
MD5

0c1f1b0f375f44a85243be6a2fec0cc0
SHA1

f093d230047c2581976351281046234a9769989f
SHA256

dc6f3cb095aa9d210ecd947de06cc37ca2560a6352b01ac4dd39fcce6d08b810
SHA512

49248578114805a5f74d81b64dcaf9c5284ab52382a115bbdc97288fc96e886616d0bc37f25ff29862349a06f9846bb739fc0a88ecd41ed9ec8b2abe25958e56
SSDEEP

1536:VWESaBvKzyvyKrd+e5Ct8JmorxFazBg3jLV3BGnMPJKEsztuJO:TTrd+e5Ct8IVEjLlBRh1sN

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Canocm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgehfkop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eiloco32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjcikejg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icefib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iedbcebd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhddgofo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jidinqpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeffgkkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Clgmkbna.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gheodg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nhfoocaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abdoqd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckhecmcf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkklbh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcnleb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dbijinfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkdhjknm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jidinqpb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fncibg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjfdfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Homcbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmbfiokn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebnddn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hjmodffo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jbncbpqd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qkdohg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qajlje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajmgof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfbbdj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Meoggpmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfhadc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hildmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnbnhedj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Digehphc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgnbdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndpjnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ggnedlao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdcmnfop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cebdcmhh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Haoimcgg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlkepaam.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekkkoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Emeffcid.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdjnolfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcoioabf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcabej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fpckjlje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fooclapd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lakfeodm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljdkll32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfpell32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dickplko.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlgjhp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adpogp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajmgof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iedbcebd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnoefagj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngifef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anfmeldl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eihcln32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icpecm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbbgicnd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmddihfj.exe

Executes dropped EXE 64 IoCs

pid	Process
4836	Mfjcnold.exe
1308	Ohnebd32.exe
4764	Pfgogh32.exe
1328	Pfnegggi.exe
392	Qlmgopjq.exe
5088	Afjeceml.exe
4324	Afnnnd32.exe
1556	Boipmj32.exe
2308	Bfhadc32.exe
1540	Bfjnjcni.exe
4052	Cjhfpa32.exe
3532	Cglgjeci.exe
2096	Cmniml32.exe
2556	Diffglam.exe
4448	Dapkni32.exe
980	Dabhdinj.exe
3864	Dpgeee32.exe
4500	Epagkd32.exe
1144	Filiii32.exe
2652	Fdcjlb32.exe
2740	Fhabbp32.exe
4116	Fpodlbng.exe
1660	Gkdhjknm.exe
2448	Ggnedlao.exe
4948	Gddbcp32.exe
464	Gdfoio32.exe
4084	Haoimcgg.exe
312	Idghpmnp.exe
3568	Lankbigo.exe
5008	Lhmmjbkf.exe
688	Mlkepaam.exe
2060	Malgcg32.exe
3712	Oondnini.exe
1868	Ohiemobf.exe
3800	Okjnnj32.exe
4944	Pcjiff32.exe
1072	Pidabppl.exe
4996	Pkenjh32.exe
4952	Pocfpf32.exe
4244	Pemomqcn.exe
4540	Qkmdkgob.exe
3296	Aomifecf.exe
1368	Bkkple32.exe
4400	Bbgeno32.exe
3852	Bfendmoc.exe
2452	Bhcjqinf.exe
1992	Bkafmd32.exe
1888	Cjecpkcg.exe
1860	Dpnkdq32.exe
4700	Dfgcakon.exe
4744	Dkdliame.exe
3056	Dflmlj32.exe
4848	Emmkiclm.exe
4768	Fpbmfn32.exe
2492	Ffobhg32.exe
2500	Fdepgkgj.exe
1500	Fbjmhh32.exe
3388	Fideeaco.exe
5028	Gigaka32.exe
776	Glgjlm32.exe
4076	Hpjmnjqn.exe
4420	Hienlpel.exe
4008	Hdjbiheb.exe
4072	Hkfglb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Cjhfpa32.exe	Bfjnjcni.exe
File created	C:\Windows\SysWOW64\Lnohlgep.exe	Lmmolepp.exe
File created	C:\Windows\SysWOW64\Hejjanpm.exe	Hjdedepg.exe
File created	C:\Windows\SysWOW64\Eldafjjc.dll	Cibkohef.exe
File opened for modification	C:\Windows\SysWOW64\Diffglam.exe	Cmniml32.exe
File created	C:\Windows\SysWOW64\Ipoheakj.exe	Impliekg.exe
File opened for modification	C:\Windows\SysWOW64\Knpmhh32.exe	Khfdlnab.exe
File created	C:\Windows\SysWOW64\Qidpon32.dll	Njgqhicg.exe
File created	C:\Windows\SysWOW64\Bnpdlbon.dll	Mhppik32.exe
File created	C:\Windows\SysWOW64\Bjmgcibf.dll	Ggafgo32.exe
File created	C:\Windows\SysWOW64\Odcfdc32.exe	Omjnhiiq.exe
File created	C:\Windows\SysWOW64\Fbbicl32.exe	Fooclapd.exe
File created	C:\Windows\SysWOW64\Nnimkcjf.dll	Fkgillpj.exe
File created	C:\Windows\SysWOW64\Kkacdofa.dll	Oloipmfd.exe
File created	C:\Windows\SysWOW64\Jjakkmpk.exe	Jgcooaah.exe
File created	C:\Windows\SysWOW64\Eapccljk.dll	Dhdmfljb.exe
File created	C:\Windows\SysWOW64\Plhllf32.dll	Pgbkgmao.exe
File created	C:\Windows\SysWOW64\Bbpolb32.exe	Bjhgke32.exe
File created	C:\Windows\SysWOW64\Jjbjlpga.exe	Jomeoggk.exe
File created	C:\Windows\SysWOW64\Hpoejj32.dll	Ofjqihnn.exe
File opened for modification	C:\Windows\SysWOW64\Ecgodpgb.exe	Ecdbop32.exe
File created	C:\Windows\SysWOW64\Eijbed32.dll	Ndpjnq32.exe
File opened for modification	C:\Windows\SysWOW64\Dbhlikpf.exe	Dllffa32.exe
File created	C:\Windows\SysWOW64\Mnailf32.dll	Odfcjc32.exe
File created	C:\Windows\SysWOW64\Bhblllfo.exe	Bpkdjofm.exe
File created	C:\Windows\SysWOW64\Lilphejh.dll	Emeffcid.exe
File created	C:\Windows\SysWOW64\Gakmni32.dll	Mknlef32.exe
File created	C:\Windows\SysWOW64\Fepbfj32.dll	Mfkcibdl.exe
File created	C:\Windows\SysWOW64\Bfjebllk.dll	Capkim32.exe
File opened for modification	C:\Windows\SysWOW64\Qfmmplad.exe	Pdenmbkk.exe
File created	C:\Windows\SysWOW64\Mcaipa32.exe	Mlhqcgnk.exe
File created	C:\Windows\SysWOW64\Pokanf32.exe	Pmmeak32.exe
File created	C:\Windows\SysWOW64\Dlnlak32.exe	Decdeama.exe
File created	C:\Windows\SysWOW64\Ngcdji32.dll	Dlbfmjqi.exe
File created	C:\Windows\SysWOW64\Bbbqbl32.dll	Nggjog32.exe
File opened for modification	C:\Windows\SysWOW64\Fqfojblo.exe	Fjmfmh32.exe
File created	C:\Windows\SysWOW64\Gkhbbi32.exe	Gcqjal32.exe
File created	C:\Windows\SysWOW64\Ailabddb.exe	Anfmeldl.exe
File created	C:\Windows\SysWOW64\Ogqmee32.exe	Nemchn32.exe
File created	C:\Windows\SysWOW64\Fhnichde.exe	Fcaqka32.exe
File created	C:\Windows\SysWOW64\Gkqhpmkg.exe	Gahcgg32.exe
File opened for modification	C:\Windows\SysWOW64\Qhmqdemc.exe	Pknqoc32.exe
File opened for modification	C:\Windows\SysWOW64\Jejbhk32.exe	Ijmhkchl.exe
File created	C:\Windows\SysWOW64\Qifbll32.exe	Pokanf32.exe
File opened for modification	C:\Windows\SysWOW64\Cemeoh32.exe	Cidgdg32.exe
File created	C:\Windows\SysWOW64\Flfbcndo.exe	Fgijkgeh.exe
File created	C:\Windows\SysWOW64\Icfhqeeg.dll	Opopdd32.exe
File created	C:\Windows\SysWOW64\Cboeco32.dll	Fefedmil.exe
File created	C:\Windows\SysWOW64\Cgogbi32.dll	Lplfcf32.exe
File opened for modification	C:\Windows\SysWOW64\Ijkled32.exe	Igmoih32.exe
File created	C:\Windows\SysWOW64\Pifkigic.dll	Pndhhnda.exe
File created	C:\Windows\SysWOW64\Ginenk32.exe	Gccmaack.exe
File created	C:\Windows\SysWOW64\Afplbhim.dll	Hllcfnhm.exe
File created	C:\Windows\SysWOW64\Pognhd32.dll	Lhmmjbkf.exe
File created	C:\Windows\SysWOW64\Gigaka32.exe	Fideeaco.exe
File opened for modification	C:\Windows\SysWOW64\Jidinqpb.exe	Iamamcop.exe
File opened for modification	C:\Windows\SysWOW64\Kfhnme32.exe	Kakednfj.exe
File created	C:\Windows\SysWOW64\Aklciimh.exe	Ahngmnnd.exe
File opened for modification	C:\Windows\SysWOW64\Mjdbda32.exe	Mdjjgggk.exe
File created	C:\Windows\SysWOW64\Cnglpdin.dll	Ahgamo32.exe
File created	C:\Windows\SysWOW64\Ioeiam32.dll	Dllffa32.exe
File created	C:\Windows\SysWOW64\Aepeonfe.dll	Nemchn32.exe
File created	C:\Windows\SysWOW64\Hcfcmnce.exe	Hhaope32.exe
File created	C:\Windows\SysWOW64\Kgiamm32.dll	Omjnhiiq.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
6680	6552	WerFault.exe	830
6700	6552	WerFault.exe	830

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acffllhk.dll"	Pjcikejg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Abjmkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aknbkjfh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhcdcbcl.dll"	Cnboma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Flpkcbqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dipnio32.dll"	Ikhghi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kcikfcab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjhgac32.dll"	Pkenjh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkjckkcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihbdmc32.dll"	Pokanf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bkkple32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnfdcegm.dll"	Glgjlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jjgkab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfdaao32.dll"	Hcfcmnce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnohlgep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjmodffo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qjeaog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aafemk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qihoak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pifkigic.dll"	Pndhhnda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kfhnme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibpgqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkkfal32.dll"	Mhhjhlqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnchgmkg.dll"	Kbedaand.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndmgnkja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kaipdbpa.dll"	Oknnanhj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lnohlgep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leeigm32.dll"	Qbajeg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nooikj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cieoen32.dll"	Amkabind.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpngef32.dll"	Dbcbnlcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fffcpnjo.dll"	Hgpibdam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qjcdih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eihlahjd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljleil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnbnhedj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mapppn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdbbfadn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njjdho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dpgeee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Maaekg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Debnjgcp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dnienqbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iadpjifl.dll"	Lcdjba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dahcld32.dll"	Imkbnf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oikjkc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogqmee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ihmnldib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddmlgm32.dll"	Bdgehobe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgnbdh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jjakkmpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmbniiil.dll"	Mpchbhjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mmiealgc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hommhi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmmokgne.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mfjcnold.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qfmmplad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjlpbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fhiphi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Homcbo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fcpkph32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmjcdd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohdlpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Opopdd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 4836	3824	dc6f3cb095aa9d210ecd947de06cc37ca2560a6352b01ac4dd39fcce6d08b810.exe	78
PID 3824 wrote to memory of 4836	3824	dc6f3cb095aa9d210ecd947de06cc37ca2560a6352b01ac4dd39fcce6d08b810.exe	78
PID 3824 wrote to memory of 4836	3824	dc6f3cb095aa9d210ecd947de06cc37ca2560a6352b01ac4dd39fcce6d08b810.exe	78
PID 4836 wrote to memory of 1308	4836	Mfjcnold.exe	79
PID 4836 wrote to memory of 1308	4836	Mfjcnold.exe	79
PID 4836 wrote to memory of 1308	4836	Mfjcnold.exe	79
PID 1308 wrote to memory of 4764	1308	Ohnebd32.exe	80
PID 1308 wrote to memory of 4764	1308	Ohnebd32.exe	80
PID 1308 wrote to memory of 4764	1308	Ohnebd32.exe	80
PID 4764 wrote to memory of 1328	4764	Pfgogh32.exe	81
PID 4764 wrote to memory of 1328	4764	Pfgogh32.exe	81
PID 4764 wrote to memory of 1328	4764	Pfgogh32.exe	81
PID 1328 wrote to memory of 392	1328	Pfnegggi.exe	82
PID 1328 wrote to memory of 392	1328	Pfnegggi.exe	82
PID 1328 wrote to memory of 392	1328	Pfnegggi.exe	82
PID 392 wrote to memory of 5088	392	Qlmgopjq.exe	83
PID 392 wrote to memory of 5088	392	Qlmgopjq.exe	83
PID 392 wrote to memory of 5088	392	Qlmgopjq.exe	83
PID 5088 wrote to memory of 4324	5088	Afjeceml.exe	84
PID 5088 wrote to memory of 4324	5088	Afjeceml.exe	84
PID 5088 wrote to memory of 4324	5088	Afjeceml.exe	84
PID 4324 wrote to memory of 1556	4324	Afnnnd32.exe	85
PID 4324 wrote to memory of 1556	4324	Afnnnd32.exe	85
PID 4324 wrote to memory of 1556	4324	Afnnnd32.exe	85
PID 1556 wrote to memory of 2308	1556	Boipmj32.exe	86
PID 1556 wrote to memory of 2308	1556	Boipmj32.exe	86
PID 1556 wrote to memory of 2308	1556	Boipmj32.exe	86
PID 2308 wrote to memory of 1540	2308	Bfhadc32.exe	87
PID 2308 wrote to memory of 1540	2308	Bfhadc32.exe	87
PID 2308 wrote to memory of 1540	2308	Bfhadc32.exe	87
PID 1540 wrote to memory of 4052	1540	Bfjnjcni.exe	88
PID 1540 wrote to memory of 4052	1540	Bfjnjcni.exe	88
PID 1540 wrote to memory of 4052	1540	Bfjnjcni.exe	88
PID 4052 wrote to memory of 3532	4052	Cjhfpa32.exe	89
PID 4052 wrote to memory of 3532	4052	Cjhfpa32.exe	89
PID 4052 wrote to memory of 3532	4052	Cjhfpa32.exe	89
PID 3532 wrote to memory of 2096	3532	Cglgjeci.exe	90
PID 3532 wrote to memory of 2096	3532	Cglgjeci.exe	90
PID 3532 wrote to memory of 2096	3532	Cglgjeci.exe	90
PID 2096 wrote to memory of 2556	2096	Cmniml32.exe	91
PID 2096 wrote to memory of 2556	2096	Cmniml32.exe	91
PID 2096 wrote to memory of 2556	2096	Cmniml32.exe	91
PID 2556 wrote to memory of 4448	2556	Diffglam.exe	92
PID 2556 wrote to memory of 4448	2556	Diffglam.exe	92
PID 2556 wrote to memory of 4448	2556	Diffglam.exe	92
PID 4448 wrote to memory of 980	4448	Dapkni32.exe	93
PID 4448 wrote to memory of 980	4448	Dapkni32.exe	93
PID 4448 wrote to memory of 980	4448	Dapkni32.exe	93
PID 980 wrote to memory of 3864	980	Dabhdinj.exe	94
PID 980 wrote to memory of 3864	980	Dabhdinj.exe	94
PID 980 wrote to memory of 3864	980	Dabhdinj.exe	94
PID 3864 wrote to memory of 4500	3864	Dpgeee32.exe	95
PID 3864 wrote to memory of 4500	3864	Dpgeee32.exe	95
PID 3864 wrote to memory of 4500	3864	Dpgeee32.exe	95
PID 4500 wrote to memory of 1144	4500	Epagkd32.exe	96
PID 4500 wrote to memory of 1144	4500	Epagkd32.exe	96
PID 4500 wrote to memory of 1144	4500	Epagkd32.exe	96
PID 1144 wrote to memory of 2652	1144	Filiii32.exe	97
PID 1144 wrote to memory of 2652	1144	Filiii32.exe	97
PID 1144 wrote to memory of 2652	1144	Filiii32.exe	97
PID 2652 wrote to memory of 2740	2652	Fdcjlb32.exe	98
PID 2652 wrote to memory of 2740	2652	Fdcjlb32.exe	98
PID 2652 wrote to memory of 2740	2652	Fdcjlb32.exe	98
PID 2740 wrote to memory of 4116	2740	Fhabbp32.exe	99

C:\Users\Admin\AppData\Local\Temp\dc6f3cb095aa9d210ecd947de06cc37ca2560a6352b01ac4dd39fcce6d08b810.exe
"C:\Users\Admin\AppData\Local\Temp\dc6f3cb095aa9d210ecd947de06cc37ca2560a6352b01ac4dd39fcce6d08b810.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Windows\SysWOW64\Mfjcnold.exe
  C:\Windows\system32\Mfjcnold.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\SysWOW64\Ohnebd32.exe
    C:\Windows\system32\Ohnebd32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1308
  - - C:\Windows\SysWOW64\Pfgogh32.exe
      C:\Windows\system32\Pfgogh32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4764
    - - C:\Windows\SysWOW64\Pfnegggi.exe
        
        C:\Windows\system32\Pfnegggi.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1328
      - C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:392
        
        C:\Windows\SysWOW64\Afjeceml.exe
        
        C:\Windows\system32\Afjeceml.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5088
        
        C:\Windows\SysWOW64\Afnnnd32.exe
        
        C:\Windows\system32\Afnnnd32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4324
        
        C:\Windows\SysWOW64\Boipmj32.exe
        
        C:\Windows\system32\Boipmj32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1556
        
        C:\Windows\SysWOW64\Bfhadc32.exe
        
        C:\Windows\system32\Bfhadc32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2308
        
        C:\Windows\SysWOW64\Bfjnjcni.exe
        
        C:\Windows\system32\Bfjnjcni.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1540
        
        C:\Windows\SysWOW64\Cjhfpa32.exe
        
        C:\Windows\system32\Cjhfpa32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4052
        
        C:\Windows\SysWOW64\Cglgjeci.exe
        
        C:\Windows\system32\Cglgjeci.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3532
        
        C:\Windows\SysWOW64\Cmniml32.exe
        
        C:\Windows\system32\Cmniml32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2096
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2556
        
        C:\Windows\SysWOW64\Dapkni32.exe
        
        C:\Windows\system32\Dapkni32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4448
        
        C:\Windows\SysWOW64\Dabhdinj.exe
        
        C:\Windows\system32\Dabhdinj.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:980
        
        C:\Windows\SysWOW64\Dpgeee32.exe
        
        C:\Windows\system32\Dpgeee32.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3864
        
        C:\Windows\SysWOW64\Epagkd32.exe
        
        C:\Windows\system32\Epagkd32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4500
        
        C:\Windows\SysWOW64\Filiii32.exe
        
        C:\Windows\system32\Filiii32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1144
        
        C:\Windows\SysWOW64\Fdcjlb32.exe
        
        C:\Windows\system32\Fdcjlb32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2652
        
        C:\Windows\SysWOW64\Fhabbp32.exe
        
        C:\Windows\system32\Fhabbp32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2740
        
        C:\Windows\SysWOW64\Fpodlbng.exe
        
        C:\Windows\system32\Fpodlbng.exe
        23⤵
        Executes dropped EXE
        
        PID:4116
        
        C:\Windows\SysWOW64\Gkdhjknm.exe
        
        C:\Windows\system32\Gkdhjknm.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1660
        
        C:\Windows\SysWOW64\Ggnedlao.exe
        
        C:\Windows\system32\Ggnedlao.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2448
        
        C:\Windows\SysWOW64\Gddbcp32.exe
        
        C:\Windows\system32\Gddbcp32.exe
        26⤵
        Executes dropped EXE
        
        PID:4948
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        27⤵
        Executes dropped EXE
        
        PID:464
        
        C:\Windows\SysWOW64\Haoimcgg.exe
        
        C:\Windows\system32\Haoimcgg.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4084
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        29⤵
        Executes dropped EXE
        
        PID:312
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        30⤵
        Executes dropped EXE
        
        PID:3568
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5008
        
        C:\Windows\SysWOW64\Mlkepaam.exe
        
        C:\Windows\system32\Mlkepaam.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:688
        
        C:\Windows\SysWOW64\Malgcg32.exe
        
        C:\Windows\system32\Malgcg32.exe
        33⤵
        Executes dropped EXE
        
        PID:2060
        
        C:\Windows\SysWOW64\Oondnini.exe
        
        C:\Windows\system32\Oondnini.exe
        34⤵
        Executes dropped EXE
        
        PID:3712
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        35⤵
        Executes dropped EXE
        
        PID:1868
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        36⤵
        Executes dropped EXE
        
        PID:3800
        
        C:\Windows\SysWOW64\Pcjiff32.exe
        
        C:\Windows\system32\Pcjiff32.exe
        37⤵
        Executes dropped EXE
        
        PID:4944
        
        C:\Windows\SysWOW64\Pidabppl.exe
        
        C:\Windows\system32\Pidabppl.exe
        38⤵
        Executes dropped EXE
        
        PID:1072
        
        C:\Windows\SysWOW64\Pkenjh32.exe
        
        C:\Windows\system32\Pkenjh32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4996
        
        C:\Windows\SysWOW64\Pocfpf32.exe
        
        C:\Windows\system32\Pocfpf32.exe
        40⤵
        Executes dropped EXE
        
        PID:4952
        
        C:\Windows\SysWOW64\Pemomqcn.exe
        
        C:\Windows\system32\Pemomqcn.exe
        41⤵
        Executes dropped EXE
        
        PID:4244
        
        C:\Windows\SysWOW64\Qkmdkgob.exe
        
        C:\Windows\system32\Qkmdkgob.exe
        42⤵
        Executes dropped EXE
        
        PID:4540
        
        C:\Windows\SysWOW64\Aomifecf.exe
        
        C:\Windows\system32\Aomifecf.exe
        43⤵
        Executes dropped EXE
        
        PID:3296
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1368
        
        C:\Windows\SysWOW64\Bbgeno32.exe
        
        C:\Windows\system32\Bbgeno32.exe
        45⤵
        Executes dropped EXE
        
        PID:4400
        
        C:\Windows\SysWOW64\Bfendmoc.exe
        
        C:\Windows\system32\Bfendmoc.exe
        46⤵
        Executes dropped EXE
        
        PID:3852
        
        C:\Windows\SysWOW64\Bhcjqinf.exe
        
        C:\Windows\system32\Bhcjqinf.exe
        47⤵
        Executes dropped EXE
        
        PID:2452
        
        C:\Windows\SysWOW64\Bkafmd32.exe
        
        C:\Windows\system32\Bkafmd32.exe
        48⤵
        Executes dropped EXE
        
        PID:1992
        
        C:\Windows\SysWOW64\Cjecpkcg.exe
        
        C:\Windows\system32\Cjecpkcg.exe
        49⤵
        Executes dropped EXE
        
        PID:1888
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        50⤵
        Executes dropped EXE
        
        PID:1860
        
        C:\Windows\SysWOW64\Dfgcakon.exe
        
        C:\Windows\system32\Dfgcakon.exe
        51⤵
        Executes dropped EXE
        
        PID:4700
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        52⤵
        Executes dropped EXE
        
        PID:4744
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        53⤵
        Executes dropped EXE
        
        PID:3056
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        54⤵
        Executes dropped EXE
        
        PID:4848
        
        C:\Windows\SysWOW64\Fpbmfn32.exe
        
        C:\Windows\system32\Fpbmfn32.exe
        55⤵
        Executes dropped EXE
        
        PID:4768
        
        C:\Windows\SysWOW64\Ffobhg32.exe
        
        C:\Windows\system32\Ffobhg32.exe
        56⤵
        Executes dropped EXE
        
        PID:2492
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        57⤵
        Executes dropped EXE
        
        PID:2500
        
        C:\Windows\SysWOW64\Fbjmhh32.exe
        
        C:\Windows\system32\Fbjmhh32.exe
        58⤵
        Executes dropped EXE
        
        PID:1500
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3388
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        60⤵
        Executes dropped EXE
        
        PID:5028
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:776
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        62⤵
        Executes dropped EXE
        
        PID:4076
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        63⤵
        Executes dropped EXE
        
        PID:4420
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        64⤵
        Executes dropped EXE
        
        PID:4008
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        65⤵
        Executes dropped EXE
        
        PID:4072
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4548
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        67⤵
        
        PID:528
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        68⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        69⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        70⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        71⤵
        Drops file in System32 directory
        
        PID:2972
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        72⤵
        Modifies registry class
        
        PID:1412
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        73⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        74⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        75⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        76⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        77⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        78⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3408
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        80⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3608
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        82⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        83⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        84⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        85⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        86⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        87⤵
        
        PID:1152
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        88⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        89⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        90⤵
        Drops file in System32 directory
        
        PID:1788
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        91⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        92⤵
        Modifies registry class
        
        PID:2676
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        93⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        94⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        95⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        96⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        97⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        98⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        99⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        100⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        101⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        102⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        103⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2348
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        105⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        106⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        107⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4832
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4596
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1696
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        111⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        112⤵
        Drops file in System32 directory
        
        PID:112
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        113⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        114⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        115⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        116⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        117⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        118⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        119⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        120⤵
        
        PID:1792
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        121⤵
        
        PID:4024
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        122⤵
        Modifies registry class
        
        PID:344
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        123⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        124⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        125⤵
        Drops file in System32 directory
        
        PID:2468
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        126⤵
        
        PID:784
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        127⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        128⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        129⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        130⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        131⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        132⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        133⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        134⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        135⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        136⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        137⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        138⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        139⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        140⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5412
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        142⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        143⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        144⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        145⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        146⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        147⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        148⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        149⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        150⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        151⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        152⤵
        Modifies registry class
        
        PID:5628
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        153⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        154⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        155⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        156⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        157⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        158⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        159⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        160⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        161⤵
        Drops file in System32 directory
        
        PID:5836
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        162⤵
        Modifies registry class
        
        PID:5852
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        163⤵
        Modifies registry class
        
        PID:5872
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        164⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        165⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        166⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        167⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        168⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        169⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        170⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        171⤵
        Drops file in System32 directory
        
        PID:6012
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        172⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        173⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        174⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        175⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        176⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        177⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        178⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        179⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        180⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        181⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        182⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5684
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        184⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        185⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        186⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        187⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        188⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        189⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        190⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        191⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        192⤵
        Drops file in System32 directory
        
        PID:4136
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2108
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        194⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        195⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        196⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3544
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        198⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        199⤵
        Drops file in System32 directory
        
        PID:720
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        200⤵
        
        PID:3532
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5480
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        202⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        203⤵
        Modifies registry class
        
        PID:4456
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        204⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        205⤵
        Drops file in System32 directory
        
        PID:1800
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        206⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4500
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        208⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        209⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\Nmaciefp.exe
        
        C:\Windows\system32\Nmaciefp.exe
        210⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        211⤵
        
        PID:368
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        212⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        213⤵
        Drops file in System32 directory
        
        PID:1404
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        214⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        215⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        216⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        217⤵
        Drops file in System32 directory
        
        PID:4444
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        218⤵
        
        PID:852
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        219⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        220⤵
        Modifies registry class
        
        PID:952
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        221⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        222⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        223⤵
        
        PID:740
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        224⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        225⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        226⤵
        
        PID:824
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1112
        
        C:\Windows\SysWOW64\Qamago32.exe
        
        C:\Windows\system32\Qamago32.exe
        228⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\Qbajeg32.exe
        
        C:\Windows\system32\Qbajeg32.exe
        229⤵
        Modifies registry class
        
        PID:4588
        
        C:\Windows\SysWOW64\Qikbaaml.exe
        
        C:\Windows\system32\Qikbaaml.exe
        230⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\Acccdj32.exe
        
        C:\Windows\system32\Acccdj32.exe
        231⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\Abjmkf32.exe
        
        C:\Windows\system32\Abjmkf32.exe
        232⤵
        Modifies registry class
        
        PID:3792
        
        C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        233⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Bfkbfd32.exe
        
        C:\Windows\system32\Bfkbfd32.exe
        234⤵
        
        PID:2732
        
        C:\Windows\SysWOW64\Bkkhbb32.exe
        
        C:\Windows\system32\Bkkhbb32.exe
        235⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\Bbfmgd32.exe
        
        C:\Windows\system32\Bbfmgd32.exe
        236⤵
        
        PID:2680
        
        C:\Windows\SysWOW64\Ckdkhq32.exe
        
        C:\Windows\system32\Ckdkhq32.exe
        237⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Cmbgdl32.exe
        
        C:\Windows\system32\Cmbgdl32.exe
        238⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\Cpacqg32.exe
        
        C:\Windows\system32\Cpacqg32.exe
        239⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\Cgklmacf.exe
        
        C:\Windows\system32\Cgklmacf.exe
        240⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Ciihjmcj.exe
        
        C:\Windows\system32\Ciihjmcj.exe
        241⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Cpcpfg32.exe
        
        C:\Windows\system32\Cpcpfg32.exe
        242⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Ccblbb32.exe
        
        C:\Windows\system32\Ccblbb32.exe
        243⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Dpjfgf32.exe
        
        C:\Windows\system32\Dpjfgf32.exe
        244⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Dgdncplk.exe
        
        C:\Windows\system32\Dgdncplk.exe
        245⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Dickplko.exe
        
        C:\Windows\system32\Dickplko.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6252
        
        C:\Windows\SysWOW64\Dajbaika.exe
        
        C:\Windows\system32\Dajbaika.exe
        247⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Epdime32.exe
        
        C:\Windows\system32\Epdime32.exe
        248⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Ejlnfjbd.exe
        
        C:\Windows\system32\Ejlnfjbd.exe
        249⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Eaceghcg.exe
        
        C:\Windows\system32\Eaceghcg.exe
        250⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Ecdbop32.exe
        
        C:\Windows\system32\Ecdbop32.exe
        251⤵
        Drops file in System32 directory
        
        PID:6376
        
        C:\Windows\SysWOW64\Ecgodpgb.exe
        
        C:\Windows\system32\Ecgodpgb.exe
        252⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Ejagaj32.exe
        
        C:\Windows\system32\Ejagaj32.exe
        253⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Ejccgi32.exe
        
        C:\Windows\system32\Ejccgi32.exe
        254⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Eqmlccdi.exe
        
        C:\Windows\system32\Eqmlccdi.exe
        255⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Fkemfl32.exe
        
        C:\Windows\system32\Fkemfl32.exe
        256⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Fncibg32.exe
        
        C:\Windows\system32\Fncibg32.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6480
        
        C:\Windows\SysWOW64\Fdmaoahm.exe
        
        C:\Windows\system32\Fdmaoahm.exe
        258⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Fkgillpj.exe
        
        C:\Windows\system32\Fkgillpj.exe
        259⤵
        Drops file in System32 directory
        
        PID:6524
        
        C:\Windows\SysWOW64\Fnffhgon.exe
        
        C:\Windows\system32\Fnffhgon.exe
        260⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Fdpnda32.exe
        
        C:\Windows\system32\Fdpnda32.exe
        261⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        262⤵
        Drops file in System32 directory
        
        PID:6588
        
        C:\Windows\SysWOW64\Fqfojblo.exe
        
        C:\Windows\system32\Fqfojblo.exe
        263⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Gcghkm32.exe
        
        C:\Windows\system32\Gcghkm32.exe
        264⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Gjaphgpl.exe
        
        C:\Windows\system32\Gjaphgpl.exe
        265⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Gbhhieao.exe
        
        C:\Windows\system32\Gbhhieao.exe
        266⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Gdgdeppb.exe
        
        C:\Windows\system32\Gdgdeppb.exe
        267⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Ggepalof.exe
        
        C:\Windows\system32\Ggepalof.exe
        268⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Gcqjal32.exe
        
        C:\Windows\system32\Gcqjal32.exe
        269⤵
        Drops file in System32 directory
        
        PID:6700
        
        C:\Windows\SysWOW64\Gkhbbi32.exe
        
        C:\Windows\system32\Gkhbbi32.exe
        270⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Hjmodffo.exe
        
        C:\Windows\system32\Hjmodffo.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6732
        
        C:\Windows\SysWOW64\Hqghqpnl.exe
        
        C:\Windows\system32\Hqghqpnl.exe
        272⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Hcedmkmp.exe
        
        C:\Windows\system32\Hcedmkmp.exe
        273⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Hkmlnimb.exe
        
        C:\Windows\system32\Hkmlnimb.exe
        274⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Hgeihiac.exe
        
        C:\Windows\system32\Hgeihiac.exe
        275⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Hjdedepg.exe
        
        C:\Windows\system32\Hjdedepg.exe
        276⤵
        Drops file in System32 directory
        
        PID:6880
        
        C:\Windows\SysWOW64\Hejjanpm.exe
        
        C:\Windows\system32\Hejjanpm.exe
        277⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Ibpgqa32.exe
        
        C:\Windows\system32\Ibpgqa32.exe
        278⤵
        Modifies registry class
        
        PID:6912
        
        C:\Windows\SysWOW64\Igmoih32.exe
        
        C:\Windows\system32\Igmoih32.exe
        279⤵
        Drops file in System32 directory
        
        PID:6928
        
        C:\Windows\SysWOW64\Ijkled32.exe
        
        C:\Windows\system32\Ijkled32.exe
        280⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Ijmhkchl.exe
        
        C:\Windows\system32\Ijmhkchl.exe
        281⤵
        Drops file in System32 directory
        
        PID:6992
        
        C:\Windows\SysWOW64\Jejbhk32.exe
        
        C:\Windows\system32\Jejbhk32.exe
        282⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Jjgkab32.exe
        
        C:\Windows\system32\Jjgkab32.exe
        283⤵
        Modifies registry class
        
        PID:7024
        
        C:\Windows\SysWOW64\Jbncbpqd.exe
        
        C:\Windows\system32\Jbncbpqd.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7040
        
        C:\Windows\SysWOW64\Jdopjh32.exe
        
        C:\Windows\system32\Jdopjh32.exe
        285⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Jlfhke32.exe
        
        C:\Windows\system32\Jlfhke32.exe
        286⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Jnedgq32.exe
        
        C:\Windows\system32\Jnedgq32.exe
        287⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Keceoj32.exe
        
        C:\Windows\system32\Keceoj32.exe
        288⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Lacijjgi.exe
        
        C:\Windows\system32\Lacijjgi.exe
        289⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Maaekg32.exe
        
        C:\Windows\system32\Maaekg32.exe
        290⤵
        Modifies registry class
        
        PID:7164
        
        C:\Windows\SysWOW64\Mdpagc32.exe
        
        C:\Windows\system32\Mdpagc32.exe
        291⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Mlgjhp32.exe
        
        C:\Windows\system32\Mlgjhp32.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3976
        
        C:\Windows\SysWOW64\Mcabej32.exe
        
        C:\Windows\system32\Mcabej32.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6292
        
        C:\Windows\SysWOW64\Mddkbbfg.exe
        
        C:\Windows\system32\Mddkbbfg.exe
        294⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Mllccpfj.exe
        
        C:\Windows\system32\Mllccpfj.exe
        295⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\Mcfkpjng.exe
        
        C:\Windows\system32\Mcfkpjng.exe
        296⤵
        
        PID:3124
        
        C:\Windows\SysWOW64\Medglemj.exe
        
        C:\Windows\system32\Medglemj.exe
        297⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\Nlnpio32.exe
        
        C:\Windows\system32\Nlnpio32.exe
        298⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\Nchhfild.exe
        
        C:\Windows\system32\Nchhfild.exe
        299⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Nefdbekh.exe
        
        C:\Windows\system32\Nefdbekh.exe
        300⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Nlqloo32.exe
        
        C:\Windows\system32\Nlqloo32.exe
        301⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\Nooikj32.exe
        
        C:\Windows\system32\Nooikj32.exe
        302⤵
        Modifies registry class
        
        PID:676
        
        C:\Windows\SysWOW64\Nfiagd32.exe
        
        C:\Windows\system32\Nfiagd32.exe
        303⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\Nlcidopb.exe
        
        C:\Windows\system32\Nlcidopb.exe
        304⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\Noaeqjpe.exe
        
        C:\Windows\system32\Noaeqjpe.exe
        305⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\Nfknmd32.exe
        
        C:\Windows\system32\Nfknmd32.exe
        306⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\Nbbnbemf.exe
        
        C:\Windows\system32\Nbbnbemf.exe
        307⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\Ndpjnq32.exe
        
        C:\Windows\system32\Ndpjnq32.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2632
        
        C:\Windows\SysWOW64\Nkjckkcg.exe
        
        C:\Windows\system32\Nkjckkcg.exe
        309⤵
        Modifies registry class
        
        PID:6796
        
        C:\Windows\SysWOW64\Ncaklhdi.exe
        
        C:\Windows\system32\Ncaklhdi.exe
        310⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Odbgdp32.exe
        
        C:\Windows\system32\Odbgdp32.exe
        311⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Oljoen32.exe
        
        C:\Windows\system32\Oljoen32.exe
        312⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\Oloipmfd.exe
        
        C:\Windows\system32\Oloipmfd.exe
        313⤵
        Drops file in System32 directory
        
        PID:4008
        
        C:\Windows\SysWOW64\Oomelheh.exe
        
        C:\Windows\system32\Oomelheh.exe
        314⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Ofgmib32.exe
        
        C:\Windows\system32\Ofgmib32.exe
        315⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Okceaikl.exe
        
        C:\Windows\system32\Okceaikl.exe
        316⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Ocknbglo.exe
        
        C:\Windows\system32\Ocknbglo.exe
        317⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Odljjo32.exe
        
        C:\Windows\system32\Odljjo32.exe
        318⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\Okfbgiij.exe
        
        C:\Windows\system32\Okfbgiij.exe
        319⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\Pbbgicnd.exe
        
        C:\Windows\system32\Pbbgicnd.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2708
        
        C:\Windows\SysWOW64\Pilpfm32.exe
        
        C:\Windows\system32\Pilpfm32.exe
        321⤵
        
        PID:764
        
        C:\Windows\SysWOW64\Pkklbh32.exe
        
        C:\Windows\system32\Pkklbh32.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4484
        
        C:\Windows\SysWOW64\Pcbdcf32.exe
        
        C:\Windows\system32\Pcbdcf32.exe
        323⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\Pecpknke.exe
        
        C:\Windows\system32\Pecpknke.exe
        324⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\Pmjhlklg.exe
        
        C:\Windows\system32\Pmjhlklg.exe
        325⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Poidhg32.exe
        
        C:\Windows\system32\Poidhg32.exe
        326⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Pfbmdabh.exe
        
        C:\Windows\system32\Pfbmdabh.exe
        327⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\Pmmeak32.exe
        
        C:\Windows\system32\Pmmeak32.exe
        328⤵
        Drops file in System32 directory
        
        PID:4296
        
        C:\Windows\SysWOW64\Pokanf32.exe
        
        C:\Windows\system32\Pokanf32.exe
        329⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4472
        
        C:\Windows\SysWOW64\Qifbll32.exe
        
        C:\Windows\system32\Qifbll32.exe
        330⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\Qkdohg32.exe
        
        C:\Windows\system32\Qkdohg32.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3328
        
        C:\Windows\SysWOW64\Qbngeadf.exe
        
        C:\Windows\system32\Qbngeadf.exe
        332⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Qihoak32.exe
        
        C:\Windows\system32\Qihoak32.exe
        333⤵
        Modifies registry class
        
        PID:4668
        
        C:\Windows\SysWOW64\Alkeifga.exe
        
        C:\Windows\system32\Alkeifga.exe
        334⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\Acbmjcgd.exe
        
        C:\Windows\system32\Acbmjcgd.exe
        335⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\Aecialmb.exe
        
        C:\Windows\system32\Aecialmb.exe
        336⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\Amkabind.exe
        
        C:\Windows\system32\Amkabind.exe
        337⤵
        Modifies registry class
        
        PID:5000
        
        C:\Windows\SysWOW64\Acdioc32.exe
        
        C:\Windows\system32\Acdioc32.exe
        338⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Aeffgkkp.exe
        
        C:\Windows\system32\Aeffgkkp.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:776
        
        C:\Windows\SysWOW64\Bejobk32.exe
        
        C:\Windows\system32\Bejobk32.exe
        340⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\Bmagch32.exe
        
        C:\Windows\system32\Bmagch32.exe
        341⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\Bppcpc32.exe
        
        C:\Windows\system32\Bppcpc32.exe
        342⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Bfjllnnm.exe
        
        C:\Windows\system32\Bfjllnnm.exe
        343⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\Bemlhj32.exe
        
        C:\Windows\system32\Bemlhj32.exe
        344⤵
        
        PID:560
        
        C:\Windows\SysWOW64\Bmddihfj.exe
        
        C:\Windows\system32\Bmddihfj.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4468
        
        C:\Windows\SysWOW64\Bcnleb32.exe
        
        C:\Windows\system32\Bcnleb32.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1808
        
        C:\Windows\SysWOW64\Bmimdg32.exe
        
        C:\Windows\system32\Bmimdg32.exe
        347⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\Bpgjpb32.exe
        
        C:\Windows\system32\Bpgjpb32.exe
        348⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Blnjecfl.exe
        
        C:\Windows\system32\Blnjecfl.exe
        349⤵
        
        PID:3760

C:\Windows\SysWOW64\Cfcoblfb.exe
C:\Windows\system32\Cfcoblfb.exe
1⤵
PID:3964
- C:\Windows\SysWOW64\Cibkohef.exe
  C:\Windows\system32\Cibkohef.exe
  2⤵
  - Drops file in System32 directory
  PID:4824
- - C:\Windows\SysWOW64\Clpgkcdj.exe
    C:\Windows\system32\Clpgkcdj.exe
    3⤵
    PID:7188
  - - C:\Windows\SysWOW64\Cffkhl32.exe
      C:\Windows\system32\Cffkhl32.exe
      4⤵
      PID:7208
    - - C:\Windows\SysWOW64\Cidgdg32.exe
        
        C:\Windows\system32\Cidgdg32.exe
        5⤵
        Drops file in System32 directory
        
        PID:7240
      - C:\Windows\SysWOW64\Cemeoh32.exe
        
        C:\Windows\system32\Cemeoh32.exe
        6⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Clgmkbna.exe
        
        C:\Windows\system32\Clgmkbna.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7272
        
        C:\Windows\SysWOW64\Cdnelpod.exe
        
        C:\Windows\system32\Cdnelpod.exe
        8⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Cepadh32.exe
        
        C:\Windows\system32\Cepadh32.exe
        9⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Dpefaq32.exe
        
        C:\Windows\system32\Dpefaq32.exe
        10⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Dbcbnlcl.exe
        
        C:\Windows\system32\Dbcbnlcl.exe
        11⤵
        Modifies registry class
        
        PID:7336
        
        C:\Windows\SysWOW64\Debnjgcp.exe
        
        C:\Windows\system32\Debnjgcp.exe
        12⤵
        Modifies registry class
        
        PID:7352
        
        C:\Windows\SysWOW64\Dllffa32.exe
        
        C:\Windows\system32\Dllffa32.exe
        13⤵
        Drops file in System32 directory
        
        PID:7368
        
        C:\Windows\SysWOW64\Dbhlikpf.exe
        
        C:\Windows\system32\Dbhlikpf.exe
        14⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Dlqpaafg.exe
        
        C:\Windows\system32\Dlqpaafg.exe
        15⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Dgfdojfm.exe
        
        C:\Windows\system32\Dgfdojfm.exe
        16⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Dmplkd32.exe
        
        C:\Windows\system32\Dmplkd32.exe
        17⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Dpoiho32.exe
        
        C:\Windows\system32\Dpoiho32.exe
        18⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Dghadidj.exe
        
        C:\Windows\system32\Dghadidj.exe
        19⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Dmbiackg.exe
        
        C:\Windows\system32\Dmbiackg.exe
        20⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Epaemojk.exe
        
        C:\Windows\system32\Epaemojk.exe
        21⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Eennefib.exe
        
        C:\Windows\system32\Eennefib.exe
        22⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Emeffcid.exe
        
        C:\Windows\system32\Emeffcid.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7596
        
        C:\Windows\SysWOW64\Edoncm32.exe
        
        C:\Windows\system32\Edoncm32.exe
        24⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Eepkkefp.exe
        
        C:\Windows\system32\Eepkkefp.exe
        25⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Eljchpnl.exe
        
        C:\Windows\system32\Eljchpnl.exe
        26⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Edakimoo.exe
        
        C:\Windows\system32\Edakimoo.exe
        27⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Egpgehnb.exe
        
        C:\Windows\system32\Egpgehnb.exe
        28⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Emioab32.exe
        
        C:\Windows\system32\Emioab32.exe
        29⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Ephlnn32.exe
        
        C:\Windows\system32\Ephlnn32.exe
        30⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Eeddfe32.exe
        
        C:\Windows\system32\Eeddfe32.exe
        31⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Ecidpiad.exe
        
        C:\Windows\system32\Ecidpiad.exe
        32⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Flaiho32.exe
        
        C:\Windows\system32\Flaiho32.exe
        33⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Fckaeioa.exe
        
        C:\Windows\system32\Fckaeioa.exe
        34⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Feimadoe.exe
        
        C:\Windows\system32\Feimadoe.exe
        35⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Flcfnn32.exe
        
        C:\Windows\system32\Flcfnn32.exe
        36⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Fdjnolfd.exe
        
        C:\Windows\system32\Fdjnolfd.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7908
        
        C:\Windows\SysWOW64\Fgijkgeh.exe
        
        C:\Windows\system32\Fgijkgeh.exe
        38⤵
        Drops file in System32 directory
        
        PID:7924
        
        C:\Windows\SysWOW64\Flfbcndo.exe
        
        C:\Windows\system32\Flfbcndo.exe
        39⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Fcpkph32.exe
        
        C:\Windows\system32\Fcpkph32.exe
        40⤵
        Modifies registry class
        
        PID:7956
        
        C:\Windows\SysWOW64\Fjjcmbci.exe
        
        C:\Windows\system32\Fjjcmbci.exe
        41⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Fpckjlje.exe
        
        C:\Windows\system32\Fpckjlje.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7996
        
        C:\Windows\SysWOW64\Fgncff32.exe
        
        C:\Windows\system32\Fgncff32.exe
        43⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Fjlpbb32.exe
        
        C:\Windows\system32\Fjlpbb32.exe
        44⤵
        Modifies registry class
        
        PID:8028
        
        C:\Windows\SysWOW64\Fpfholhc.exe
        
        C:\Windows\system32\Fpfholhc.exe
        45⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Fcddkggf.exe
        
        C:\Windows\system32\Fcddkggf.exe
        46⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Gjnlha32.exe
        
        C:\Windows\system32\Gjnlha32.exe
        47⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Gphddlfp.exe
        
        C:\Windows\system32\Gphddlfp.exe
        48⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Ggbmafnm.exe
        
        C:\Windows\system32\Ggbmafnm.exe
        49⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Gjqinamq.exe
        
        C:\Windows\system32\Gjqinamq.exe
        50⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Gloejmld.exe
        
        C:\Windows\system32\Gloejmld.exe
        51⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Gdfmkjlg.exe
        
        C:\Windows\system32\Gdfmkjlg.exe
        52⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Gjcfcakn.exe
        
        C:\Windows\system32\Gjcfcakn.exe
        53⤵
        
        PID:1224
        
        C:\Windows\SysWOW64\Gqmnpk32.exe
        
        C:\Windows\system32\Gqmnpk32.exe
        54⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\Gggfme32.exe
        
        C:\Windows\system32\Gggfme32.exe
        55⤵
        
        PID:552
        
        C:\Windows\SysWOW64\Hdppaidl.exe
        
        C:\Windows\system32\Hdppaidl.exe
        56⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\Hgnlmdcp.exe
        
        C:\Windows\system32\Hgnlmdcp.exe
        57⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Hnhdjn32.exe
        
        C:\Windows\system32\Hnhdjn32.exe
        58⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Hdbmfhbi.exe
        
        C:\Windows\system32\Hdbmfhbi.exe
        59⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Hgpibdam.exe
        
        C:\Windows\system32\Hgpibdam.exe
        60⤵
        Modifies registry class
        
        PID:7800
        
        C:\Windows\SysWOW64\Hdicggla.exe
        
        C:\Windows\system32\Hdicggla.exe
        61⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Iqpclh32.exe
        
        C:\Windows\system32\Iqpclh32.exe
        62⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Icqmncof.exe
        
        C:\Windows\system32\Icqmncof.exe
        63⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\Icefib32.exe
        
        C:\Windows\system32\Icefib32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2760
        
        C:\Windows\SysWOW64\Ifcben32.exe
        
        C:\Windows\system32\Ifcben32.exe
        65⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\Inkjfk32.exe
        
        C:\Windows\system32\Inkjfk32.exe
        66⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Iedbcebd.exe
        
        C:\Windows\system32\Iedbcebd.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1604
        
        C:\Windows\SysWOW64\Jgcooaah.exe
        
        C:\Windows\system32\Jgcooaah.exe
        68⤵
        Drops file in System32 directory
        
        PID:3672
        
        C:\Windows\SysWOW64\Jjakkmpk.exe
        
        C:\Windows\system32\Jjakkmpk.exe
        69⤵
        Modifies registry class
        
        PID:2316
        
        C:\Windows\SysWOW64\Jmpgghoo.exe
        
        C:\Windows\system32\Jmpgghoo.exe
        70⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\Jjfdfl32.exe
        
        C:\Windows\system32\Jjfdfl32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3764
        
        C:\Windows\SysWOW64\Japmcfcc.exe
        
        C:\Windows\system32\Japmcfcc.exe
        72⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\Jcoioabf.exe
        
        C:\Windows\system32\Jcoioabf.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4004
        
        C:\Windows\SysWOW64\Jfmekm32.exe
        
        C:\Windows\system32\Jfmekm32.exe
        74⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\Jmgmhgig.exe
        
        C:\Windows\system32\Jmgmhgig.exe
        75⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\Jcaeea32.exe
        
        C:\Windows\system32\Jcaeea32.exe
        76⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\Jfoaam32.exe
        
        C:\Windows\system32\Jfoaam32.exe
        77⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\Keghocao.exe
        
        C:\Windows\system32\Keghocao.exe
        78⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Khfdlnab.exe
        
        C:\Windows\system32\Khfdlnab.exe
        79⤵
        Drops file in System32 directory
        
        PID:1792
        
        C:\Windows\SysWOW64\Knpmhh32.exe
        
        C:\Windows\system32\Knpmhh32.exe
        80⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Kejeebpl.exe
        
        C:\Windows\system32\Kejeebpl.exe
        81⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Kfkamk32.exe
        
        C:\Windows\system32\Kfkamk32.exe
        82⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\Knbinhfl.exe
        
        C:\Windows\system32\Knbinhfl.exe
        83⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\Kaqejcep.exe
        
        C:\Windows\system32\Kaqejcep.exe
        84⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Lacbpccn.exe
        
        C:\Windows\system32\Lacbpccn.exe
        85⤵
        
        PID:784
        
        C:\Windows\SysWOW64\Lmjcdd32.exe
        
        C:\Windows\system32\Lmjcdd32.exe
        86⤵
        Modifies registry class
        
        PID:5152
        
        C:\Windows\SysWOW64\Leqkeajd.exe
        
        C:\Windows\system32\Leqkeajd.exe
        87⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Lfbgmj32.exe
        
        C:\Windows\system32\Lfbgmj32.exe
        88⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\Loiong32.exe
        
        C:\Windows\system32\Loiong32.exe
        89⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Lechkaga.exe
        
        C:\Windows\system32\Lechkaga.exe
        90⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Maoakaip.exe
        
        C:\Windows\system32\Maoakaip.exe
        91⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Mhhjhlqm.exe
        
        C:\Windows\system32\Mhhjhlqm.exe
        92⤵
        Modifies registry class
        
        PID:5424
        
        C:\Windows\SysWOW64\Mkicjgnn.exe
        
        C:\Windows\system32\Mkicjgnn.exe
        93⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Meoggpmd.exe
        
        C:\Windows\system32\Meoggpmd.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5332
        
        C:\Windows\SysWOW64\Mhmcck32.exe
        
        C:\Windows\system32\Mhmcck32.exe
        95⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Moglpedd.exe
        
        C:\Windows\system32\Moglpedd.exe
        96⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Meadlo32.exe
        
        C:\Windows\system32\Meadlo32.exe
        97⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Mhppik32.exe
        
        C:\Windows\system32\Mhppik32.exe
        98⤵
        Drops file in System32 directory
        
        PID:5200
        
        C:\Windows\SysWOW64\Mknlef32.exe
        
        C:\Windows\system32\Mknlef32.exe
        99⤵
        Drops file in System32 directory
        
        PID:4920
        
        C:\Windows\SysWOW64\Nmlhaa32.exe
        
        C:\Windows\system32\Nmlhaa32.exe
        100⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Ndfanlpi.exe
        
        C:\Windows\system32\Ndfanlpi.exe
        101⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Ngemjg32.exe
        
        C:\Windows\system32\Ngemjg32.exe
        102⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Nnoefagj.exe
        
        C:\Windows\system32\Nnoefagj.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5460
        
        C:\Windows\SysWOW64\Nefmgogl.exe
        
        C:\Windows\system32\Nefmgogl.exe
        104⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Nggjog32.exe
        
        C:\Windows\system32\Nggjog32.exe
        105⤵
        Drops file in System32 directory
        
        PID:5592
        
        C:\Windows\SysWOW64\Nonbqd32.exe
        
        C:\Windows\system32\Nonbqd32.exe
        106⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Namnmp32.exe
        
        C:\Windows\system32\Namnmp32.exe
        107⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Ndkjik32.exe
        
        C:\Windows\system32\Ndkjik32.exe
        108⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Ngifef32.exe
        
        C:\Windows\system32\Ngifef32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8244
        
        C:\Windows\SysWOW64\Nncoaq32.exe
        
        C:\Windows\system32\Nncoaq32.exe
        110⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Ndmgnkja.exe
        
        C:\Windows\system32\Ndmgnkja.exe
        111⤵
        Modifies registry class
        
        PID:8276
        
        C:\Windows\SysWOW64\Nglcjfie.exe
        
        C:\Windows\system32\Nglcjfie.exe
        112⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Nnfkgp32.exe
        
        C:\Windows\system32\Nnfkgp32.exe
        113⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Nemchn32.exe
        
        C:\Windows\system32\Nemchn32.exe
        114⤵
        Drops file in System32 directory
        
        PID:8420
        
        C:\Windows\SysWOW64\Ogqmee32.exe
        
        C:\Windows\system32\Ogqmee32.exe
        115⤵
        Modifies registry class
        
        PID:8436
        
        C:\Windows\SysWOW64\Oogdfc32.exe
        
        C:\Windows\system32\Oogdfc32.exe
        116⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Oeamcmmo.exe
        
        C:\Windows\system32\Oeamcmmo.exe
        117⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Ogcike32.exe
        
        C:\Windows\system32\Ogcike32.exe
        118⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Oediim32.exe
        
        C:\Windows\system32\Oediim32.exe
        119⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Ohbfeh32.exe
        
        C:\Windows\system32\Ohbfeh32.exe
        120⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Oolnabal.exe
        
        C:\Windows\system32\Oolnabal.exe
        121⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Oggbfdog.exe
        
        C:\Windows\system32\Oggbfdog.exe
        122⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Onakco32.exe
        
        C:\Windows\system32\Onakco32.exe
        123⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Ofhcdlgg.exe
        
        C:\Windows\system32\Ofhcdlgg.exe
        124⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Ogjpld32.exe
        
        C:\Windows\system32\Ogjpld32.exe
        125⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Pndhhnda.exe
        
        C:\Windows\system32\Pndhhnda.exe
        126⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8672
        
        C:\Windows\SysWOW64\Phneqf32.exe
        
        C:\Windows\system32\Phneqf32.exe
        127⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Pnknim32.exe
        
        C:\Windows\system32\Pnknim32.exe
        128⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Pgeogb32.exe
        
        C:\Windows\system32\Pgeogb32.exe
        129⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Qnpgdmjd.exe
        
        C:\Windows\system32\Qnpgdmjd.exe
        130⤵
        
        PID:8828

C:\Windows\SysWOW64\Qdipag32.exe
C:\Windows\system32\Qdipag32.exe
1⤵
PID:8844
- C:\Windows\SysWOW64\Qoocnpag.exe
  C:\Windows\system32\Qoocnpag.exe
  2⤵
  PID:8872
- - C:\Windows\SysWOW64\Andqol32.exe
    C:\Windows\system32\Andqol32.exe
    3⤵
    PID:8904
  - - C:\Windows\SysWOW64\Anfmeldl.exe
      C:\Windows\system32\Anfmeldl.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Drops file in System32 directory
      PID:8928
    - - C:\Windows\SysWOW64\Ailabddb.exe
        
        C:\Windows\system32\Ailabddb.exe
        5⤵
        
        PID:8948
      - C:\Windows\SysWOW64\Afpbkicl.exe
        
        C:\Windows\system32\Afpbkicl.exe
        6⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Aohfdnil.exe
        
        C:\Windows\system32\Aohfdnil.exe
        7⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Aeeomegd.exe
        
        C:\Windows\system32\Aeeomegd.exe
        8⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Aokcjngj.exe
        
        C:\Windows\system32\Aokcjngj.exe
        9⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Afdkfh32.exe
        
        C:\Windows\system32\Afdkfh32.exe
        10⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Bejhhd32.exe
        
        C:\Windows\system32\Bejhhd32.exe
        11⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Bkhjpn32.exe
        
        C:\Windows\system32\Bkhjpn32.exe
        12⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Bbbblhnc.exe
        
        C:\Windows\system32\Bbbblhnc.exe
        13⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Bgokdomj.exe
        
        C:\Windows\system32\Bgokdomj.exe
        14⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Becknc32.exe
        
        C:\Windows\system32\Becknc32.exe
        15⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Cpipkl32.exe
        
        C:\Windows\system32\Cpipkl32.exe
        16⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Ceehcc32.exe
        
        C:\Windows\system32\Ceehcc32.exe
        17⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Cpklql32.exe
        
        C:\Windows\system32\Cpklql32.exe
        18⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Cehdib32.exe
        
        C:\Windows\system32\Cehdib32.exe
        19⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Chfaenfb.exe
        
        C:\Windows\system32\Chfaenfb.exe
        20⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Cblebgfh.exe
        
        C:\Windows\system32\Cblebgfh.exe
        21⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Cnebmgjj.exe
        
        C:\Windows\system32\Cnebmgjj.exe
        22⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Dhmgfm32.exe
        
        C:\Windows\system32\Dhmgfm32.exe
        23⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Deagoa32.exe
        
        C:\Windows\system32\Deagoa32.exe
        24⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Dpglmjoj.exe
        
        C:\Windows\system32\Dpglmjoj.exe
        25⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Decdeama.exe
        
        C:\Windows\system32\Decdeama.exe
        26⤵
        Drops file in System32 directory
        
        PID:8412
        
        C:\Windows\SysWOW64\Dlnlak32.exe
        
        C:\Windows\system32\Dlnlak32.exe
        27⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Dhdmfljb.exe
        
        C:\Windows\system32\Dhdmfljb.exe
        28⤵
        Drops file in System32 directory
        
        PID:5616
        
        C:\Windows\SysWOW64\Donecfao.exe
        
        C:\Windows\system32\Donecfao.exe
        29⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Dehnpp32.exe
        
        C:\Windows\system32\Dehnpp32.exe
        30⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Dlbfmjqi.exe
        
        C:\Windows\system32\Dlbfmjqi.exe
        31⤵
        Drops file in System32 directory
        
        PID:5756
        
        C:\Windows\SysWOW64\Eihcln32.exe
        
        C:\Windows\system32\Eihcln32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8604
        
        C:\Windows\SysWOW64\Eoekde32.exe
        
        C:\Windows\system32\Eoekde32.exe
        33⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Elilmi32.exe
        
        C:\Windows\system32\Elilmi32.exe
        34⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Eohhie32.exe
        
        C:\Windows\system32\Eohhie32.exe
        35⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Eeaqfo32.exe
        
        C:\Windows\system32\Eeaqfo32.exe
        36⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Ellicihn.exe
        
        C:\Windows\system32\Ellicihn.exe
        37⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Ebeapc32.exe
        
        C:\Windows\system32\Ebeapc32.exe
        38⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Eipilmgh.exe
        
        C:\Windows\system32\Eipilmgh.exe
        39⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Eoladdeo.exe
        
        C:\Windows\system32\Eoladdeo.exe
        40⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Fibfbm32.exe
        
        C:\Windows\system32\Fibfbm32.exe
        41⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Foonjd32.exe
        
        C:\Windows\system32\Foonjd32.exe
        42⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\Feifgnki.exe
        
        C:\Windows\system32\Feifgnki.exe
        43⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Fpnkdfko.exe
        
        C:\Windows\system32\Fpnkdfko.exe
        44⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Fghcqq32.exe
        
        C:\Windows\system32\Fghcqq32.exe
        45⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Fhiphi32.exe
        
        C:\Windows\system32\Fhiphi32.exe
        46⤵
        Modifies registry class
        
        PID:9180
        
        C:\Windows\SysWOW64\Fcodfa32.exe
        
        C:\Windows\system32\Fcodfa32.exe
        47⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Fempbm32.exe
        
        C:\Windows\system32\Fempbm32.exe
        48⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Flghognq.exe
        
        C:\Windows\system32\Flghognq.exe
        49⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\Fcaqka32.exe
        
        C:\Windows\system32\Fcaqka32.exe
        50⤵
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Fhnichde.exe
        
        C:\Windows\system32\Fhnichde.exe
        51⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Gccmaack.exe
        
        C:\Windows\system32\Gccmaack.exe
        52⤵
        Drops file in System32 directory
        
        PID:1732
        
        C:\Windows\SysWOW64\Ginenk32.exe
        
        C:\Windows\system32\Ginenk32.exe
        53⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Gpgnjebd.exe
        
        C:\Windows\system32\Gpgnjebd.exe
        54⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Ggafgo32.exe
        
        C:\Windows\system32\Ggafgo32.exe
        55⤵
        Drops file in System32 directory
        
        PID:6096
        
        C:\Windows\SysWOW64\Ghcbohpp.exe
        
        C:\Windows\system32\Ghcbohpp.exe
        56⤵
        
        PID:1036
        
        C:\Windows\SysWOW64\Gheodg32.exe
        
        C:\Windows\system32\Gheodg32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:956
        
        C:\Windows\SysWOW64\Geipnl32.exe
        
        C:\Windows\system32\Geipnl32.exe
        58⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Goadfa32.exe
        
        C:\Windows\system32\Goadfa32.exe
        59⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Geklckkd.exe
        
        C:\Windows\system32\Geklckkd.exe
        60⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Hpaqqdjj.exe
        
        C:\Windows\system32\Hpaqqdjj.exe
        61⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Hfniikha.exe
        
        C:\Windows\system32\Hfniikha.exe
        62⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Hofmaq32.exe
        
        C:\Windows\system32\Hofmaq32.exe
        63⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Hjlaoioh.exe
        
        C:\Windows\system32\Hjlaoioh.exe
        64⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Hohjgpmo.exe
        
        C:\Windows\system32\Hohjgpmo.exe
        65⤵
        
        PID:2720
        
        C:\Windows\SysWOW64\Hfbbdj32.exe
        
        C:\Windows\system32\Hfbbdj32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4248
        
        C:\Windows\SysWOW64\Hhaope32.exe
        
        C:\Windows\system32\Hhaope32.exe
        67⤵
        Drops file in System32 directory
        
        PID:9168
        
        C:\Windows\SysWOW64\Hcfcmnce.exe
        
        C:\Windows\system32\Hcfcmnce.exe
        68⤵
        Modifies registry class
        
        PID:4392
        
        C:\Windows\SysWOW64\Hhckeeam.exe
        
        C:\Windows\system32\Hhckeeam.exe
        69⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Homcbo32.exe
        
        C:\Windows\system32\Homcbo32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2112
        
        C:\Windows\SysWOW64\Hjbhph32.exe
        
        C:\Windows\system32\Hjbhph32.exe
        71⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Icklhnop.exe
        
        C:\Windows\system32\Icklhnop.exe
        72⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Imcqacfq.exe
        
        C:\Windows\system32\Imcqacfq.exe
        73⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\Igieoleg.exe
        
        C:\Windows\system32\Igieoleg.exe
        74⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\Imfmgcdn.exe
        
        C:\Windows\system32\Imfmgcdn.exe
        75⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Icpecm32.exe
        
        C:\Windows\system32\Icpecm32.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9240
        
        C:\Windows\SysWOW64\Ihmnldib.exe
        
        C:\Windows\system32\Ihmnldib.exe
        77⤵
        Modifies registry class
        
        PID:9268
        
        C:\Windows\SysWOW64\Ioffhn32.exe
        
        C:\Windows\system32\Ioffhn32.exe
        78⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Ijlkfg32.exe
        
        C:\Windows\system32\Ijlkfg32.exe
        79⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Jonlimkg.exe
        
        C:\Windows\system32\Jonlimkg.exe
        80⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Jmamba32.exe
        
        C:\Windows\system32\Jmamba32.exe
        81⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Jihngboe.exe
        
        C:\Windows\system32\Jihngboe.exe
        82⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Jqofippg.exe
        
        C:\Windows\system32\Jqofippg.exe
        83⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Jflnafno.exe
        
        C:\Windows\system32\Jflnafno.exe
        84⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Jmffnq32.exe
        
        C:\Windows\system32\Jmffnq32.exe
        85⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Jglkkiea.exe
        
        C:\Windows\system32\Jglkkiea.exe
        86⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Kimgba32.exe
        
        C:\Windows\system32\Kimgba32.exe
        87⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Kpgoolbl.exe
        
        C:\Windows\system32\Kpgoolbl.exe
        88⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Kjlcmdbb.exe
        
        C:\Windows\system32\Kjlcmdbb.exe
        89⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Kaflio32.exe
        
        C:\Windows\system32\Kaflio32.exe
        90⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Kgqdfi32.exe
        
        C:\Windows\system32\Kgqdfi32.exe
        91⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Kiaqnagj.exe
        
        C:\Windows\system32\Kiaqnagj.exe
        92⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Kakednfj.exe
        
        C:\Windows\system32\Kakednfj.exe
        93⤵
        Drops file in System32 directory
        
        PID:9580
        
        C:\Windows\SysWOW64\Kfhnme32.exe
        
        C:\Windows\system32\Kfhnme32.exe
        94⤵
        Modifies registry class
        
        PID:9596
        
        C:\Windows\SysWOW64\Kmbfiokn.exe
        
        C:\Windows\system32\Kmbfiokn.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9616
        
        C:\Windows\SysWOW64\Kppbejka.exe
        
        C:\Windows\system32\Kppbejka.exe
        96⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Lcqgahoe.exe
        
        C:\Windows\system32\Lcqgahoe.exe
        97⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Ladhkmno.exe
        
        C:\Windows\system32\Ladhkmno.exe
        98⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Lhopgg32.exe
        
        C:\Windows\system32\Lhopgg32.exe
        99⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Ljmmcbdp.exe
        
        C:\Windows\system32\Ljmmcbdp.exe
        100⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Lpjelibg.exe
        
        C:\Windows\system32\Lpjelibg.exe
        101⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Lhammfci.exe
        
        C:\Windows\system32\Lhammfci.exe
        102⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Libido32.exe
        
        C:\Windows\system32\Libido32.exe
        103⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Laiafl32.exe
        
        C:\Windows\system32\Laiafl32.exe
        104⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Lhcjbfag.exe
        
        C:\Windows\system32\Lhcjbfag.exe
        105⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Midfjnge.exe
        
        C:\Windows\system32\Midfjnge.exe
        106⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Mdjjgggk.exe
        
        C:\Windows\system32\Mdjjgggk.exe
        107⤵
        Drops file in System32 directory
        
        PID:9872
        
        C:\Windows\SysWOW64\Mjdbda32.exe
        
        C:\Windows\system32\Mjdbda32.exe
        108⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Mmbopm32.exe
        
        C:\Windows\system32\Mmbopm32.exe
        109⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Mdlgmgdh.exe
        
        C:\Windows\system32\Mdlgmgdh.exe
        110⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Mfkcibdl.exe
        
        C:\Windows\system32\Mfkcibdl.exe
        111⤵
        Drops file in System32 directory
        
        PID:9936
        
        C:\Windows\SysWOW64\Mpchbhjl.exe
        
        C:\Windows\system32\Mpchbhjl.exe
        112⤵
        Modifies registry class
        
        PID:9992
        
        C:\Windows\SysWOW64\Mmiealgc.exe
        
        C:\Windows\system32\Mmiealgc.exe
        113⤵
        Modifies registry class
        
        PID:10008
        
        C:\Windows\SysWOW64\Mdcmnfop.exe
        
        C:\Windows\system32\Mdcmnfop.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10032
        
        C:\Windows\SysWOW64\Njmejp32.exe
        
        C:\Windows\system32\Njmejp32.exe
        115⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Nmlafk32.exe
        
        C:\Windows\system32\Nmlafk32.exe
        116⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Ndejcemn.exe
        
        C:\Windows\system32\Ndejcemn.exe
        117⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Nkpbpp32.exe
        
        C:\Windows\system32\Nkpbpp32.exe
        118⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Najjmjkg.exe
        
        C:\Windows\system32\Najjmjkg.exe
        119⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Nhfoocaa.exe
        
        C:\Windows\system32\Nhfoocaa.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10164
        
        C:\Windows\SysWOW64\Nandhi32.exe
        
        C:\Windows\system32\Nandhi32.exe
        121⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Nhhldc32.exe
        
        C:\Windows\system32\Nhhldc32.exe
        122⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Nkghqo32.exe
        
        C:\Windows\system32\Nkghqo32.exe
        123⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Naqqmieo.exe
        
        C:\Windows\system32\Naqqmieo.exe
        124⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Ohkijc32.exe
        
        C:\Windows\system32\Ohkijc32.exe
        125⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Oileakbj.exe
        
        C:\Windows\system32\Oileakbj.exe
        126⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\Opfnne32.exe
        
        C:\Windows\system32\Opfnne32.exe
        127⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Okkalnjm.exe
        
        C:\Windows\system32\Okkalnjm.exe
        128⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Omjnhiiq.exe
        
        C:\Windows\system32\Omjnhiiq.exe
        129⤵
        Drops file in System32 directory
        
        PID:4316
        
        C:\Windows\SysWOW64\Odcfdc32.exe
        
        C:\Windows\system32\Odcfdc32.exe
        130⤵
        
        PID:1928
        
        C:\Windows\SysWOW64\Oknnanhj.exe
        
        C:\Windows\system32\Oknnanhj.exe
        131⤵
        Modifies registry class
        
        PID:4324
        
        C:\Windows\SysWOW64\Omlkmign.exe
        
        C:\Windows\system32\Omlkmign.exe
        132⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\Odfcjc32.exe
        
        C:\Windows\system32\Odfcjc32.exe
        133⤵
        Drops file in System32 directory
        
        PID:9512
        
        C:\Windows\SysWOW64\Ogdofo32.exe
        
        C:\Windows\system32\Ogdofo32.exe
        134⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Oajccgmd.exe
        
        C:\Windows\system32\Oajccgmd.exe
        135⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Ohdlpa32.exe
        
        C:\Windows\system32\Ohdlpa32.exe
        136⤵
        Modifies registry class
        
        PID:9588
        
        C:\Windows\SysWOW64\Oiehhjjp.exe
        
        C:\Windows\system32\Oiehhjjp.exe
        137⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Opopdd32.exe
        
        C:\Windows\system32\Opopdd32.exe
        138⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6044
        
        C:\Windows\SysWOW64\Pgihanii.exe
        
        C:\Windows\system32\Pgihanii.exe
        139⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Pncanhaf.exe
        
        C:\Windows\system32\Pncanhaf.exe
        140⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Ppamjcpj.exe
        
        C:\Windows\system32\Ppamjcpj.exe
        141⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\Pkgaglpp.exe
        
        C:\Windows\system32\Pkgaglpp.exe
        142⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\Paaidf32.exe
        
        C:\Windows\system32\Paaidf32.exe
        143⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\Pgnblm32.exe
        
        C:\Windows\system32\Pgnblm32.exe
        144⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Pdbbfadn.exe
        
        C:\Windows\system32\Pdbbfadn.exe
        145⤵
        Modifies registry class
        
        PID:1688
        
        C:\Windows\SysWOW64\Pjoknhbe.exe
        
        C:\Windows\system32\Pjoknhbe.exe
        146⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\Pphckb32.exe
        
        C:\Windows\system32\Pphckb32.exe
        147⤵
        
        PID:720
        
        C:\Windows\SysWOW64\Pgbkgmao.exe
        
        C:\Windows\system32\Pgbkgmao.exe
        148⤵
        Drops file in System32 directory
        
        PID:5496
        
        C:\Windows\SysWOW64\Pjahchpb.exe
        
        C:\Windows\system32\Pjahchpb.exe
        149⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Qdflaa32.exe
        
        C:\Windows\system32\Qdflaa32.exe
        150⤵
        
        PID:10000

C:\Windows\SysWOW64\Qgehml32.exe
C:\Windows\system32\Qgehml32.exe
1⤵
PID:10020
- C:\Windows\SysWOW64\Qjcdih32.exe
  C:\Windows\system32\Qjcdih32.exe
  2⤵
  - Modifies registry class
  PID:4456
- - C:\Windows\SysWOW64\Qajlje32.exe
    C:\Windows\system32\Qajlje32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:4948
  - - C:\Windows\SysWOW64\Qhddgofo.exe
      C:\Windows\system32\Qhddgofo.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:10104
    - - C:\Windows\SysWOW64\Qjeaog32.exe
        
        C:\Windows\system32\Qjeaog32.exe
        5⤵
        Modifies registry class
        
        PID:6028
      - C:\Windows\SysWOW64\Ahgamo32.exe
        
        C:\Windows\system32\Ahgamo32.exe
        6⤵
        Drops file in System32 directory
        
        PID:1100
        
        C:\Windows\SysWOW64\Aaofedkl.exe
        
        C:\Windows\system32\Aaofedkl.exe
        7⤵
        
        PID:488
        
        C:\Windows\SysWOW64\Adnbapjp.exe
        
        C:\Windows\system32\Adnbapjp.exe
        8⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\Akgjnj32.exe
        
        C:\Windows\system32\Akgjnj32.exe
        9⤵
        
        PID:368
        
        C:\Windows\SysWOW64\Ababkdij.exe
        
        C:\Windows\system32\Ababkdij.exe
        10⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\Adpogp32.exe
        
        C:\Windows\system32\Adpogp32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1272
        
        C:\Windows\SysWOW64\Ajmgof32.exe
        
        C:\Windows\system32\Ajmgof32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4880
        
        C:\Windows\SysWOW64\Abdoqd32.exe
        
        C:\Windows\system32\Abdoqd32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5084
        
        C:\Windows\SysWOW64\Ahngmnnd.exe
        
        C:\Windows\system32\Ahngmnnd.exe
        14⤵
        Drops file in System32 directory
        
        PID:9684
        
        C:\Windows\SysWOW64\Aklciimh.exe
        
        C:\Windows\system32\Aklciimh.exe
        15⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\Anjpeelk.exe
        
        C:\Windows\system32\Anjpeelk.exe
        16⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\Addhbo32.exe
        
        C:\Windows\system32\Addhbo32.exe
        17⤵
        
        PID:312
        
        C:\Windows\SysWOW64\Akopoi32.exe
        
        C:\Windows\system32\Akopoi32.exe
        18⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\Bbhhlccb.exe
        
        C:\Windows\system32\Bbhhlccb.exe
        19⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\Bdgehobe.exe
        
        C:\Windows\system32\Bdgehobe.exe
        20⤵
        Modifies registry class
        
        PID:852
        
        C:\Windows\SysWOW64\Bqnemp32.exe
        
        C:\Windows\system32\Bqnemp32.exe
        21⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\Bggnijof.exe
        
        C:\Windows\system32\Bggnijof.exe
        22⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\Bjfjee32.exe
        
        C:\Windows\system32\Bjfjee32.exe
        23⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Bbmbgb32.exe
        
        C:\Windows\system32\Bbmbgb32.exe
        24⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Bhgjcmfi.exe
        
        C:\Windows\system32\Bhgjcmfi.exe
        25⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\Bjhgke32.exe
        
        C:\Windows\system32\Bjhgke32.exe
        26⤵
        Drops file in System32 directory
        
        PID:2556
        
        C:\Windows\SysWOW64\Bbpolb32.exe
        
        C:\Windows\system32\Bbpolb32.exe
        27⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\Biigildg.exe
        
        C:\Windows\system32\Biigildg.exe
        28⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\Bjkcqdje.exe
        
        C:\Windows\system32\Bjkcqdje.exe
        29⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Bqdlmo32.exe
        
        C:\Windows\system32\Bqdlmo32.exe
        30⤵
        
        PID:824
        
        C:\Windows\SysWOW64\Bgodjiio.exe
        
        C:\Windows\system32\Bgodjiio.exe
        31⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\Cnhlgc32.exe
        
        C:\Windows\system32\Cnhlgc32.exe
        32⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\Cebdcmhh.exe
        
        C:\Windows\system32\Cebdcmhh.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:652
        
        C:\Windows\SysWOW64\Ckmmpg32.exe
        
        C:\Windows\system32\Ckmmpg32.exe
        34⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\Cbfema32.exe
        
        C:\Windows\system32\Cbfema32.exe
        35⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\Cnmebblf.exe
        
        C:\Windows\system32\Cnmebblf.exe
        36⤵
        
        PID:1104

C:\Windows\SysWOW64\Calbnnkj.exe
C:\Windows\system32\Calbnnkj.exe
1⤵
PID:4968
- C:\Windows\SysWOW64\Ckafkfkp.exe
  C:\Windows\system32\Ckafkfkp.exe
  2⤵
  PID:4996
- - C:\Windows\SysWOW64\Canocm32.exe
    C:\Windows\system32\Canocm32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:2732
  - - C:\Windows\SysWOW64\Ciefek32.exe
      C:\Windows\system32\Ciefek32.exe
      4⤵
      PID:6180
    - - C:\Windows\SysWOW64\Cnboma32.exe
        
        C:\Windows\system32\Cnboma32.exe
        5⤵
        Modifies registry class
        
        PID:4988
      - C:\Windows\SysWOW64\Capkim32.exe
        
        C:\Windows\system32\Capkim32.exe
        6⤵
        Drops file in System32 directory
        
        PID:10260
        
        C:\Windows\SysWOW64\Cgjcfgoa.exe
        
        C:\Windows\system32\Cgjcfgoa.exe
        7⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Dndlba32.exe
        
        C:\Windows\system32\Dndlba32.exe
        8⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Dgmpkg32.exe
        
        C:\Windows\system32\Dgmpkg32.exe
        9⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Dbbdip32.exe
        
        C:\Windows\system32\Dbbdip32.exe
        10⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\Dilmeida.exe
        
        C:\Windows\system32\Dilmeida.exe
        11⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Dnienqbi.exe
        
        C:\Windows\system32\Dnienqbi.exe
        12⤵
        Modifies registry class
        
        PID:10456
        
        C:\Windows\SysWOW64\Dbijinfl.exe
        
        C:\Windows\system32\Dbijinfl.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10472
        
        C:\Windows\SysWOW64\Dicbfhni.exe
        
        C:\Windows\system32\Dicbfhni.exe
        14⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Elaobdmm.exe
        
        C:\Windows\system32\Elaobdmm.exe
        15⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Eblgon32.exe
        
        C:\Windows\system32\Eblgon32.exe
        16⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\Eieplhlf.exe
        
        C:\Windows\system32\Eieplhlf.exe
        17⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Ejglcq32.exe
        
        C:\Windows\system32\Ejglcq32.exe
        18⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Ebnddn32.exe
        
        C:\Windows\system32\Ebnddn32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10568
        
        C:\Windows\SysWOW64\Eihlahjd.exe
        
        C:\Windows\system32\Eihlahjd.exe
        20⤵
        Modifies registry class
        
        PID:10584
        
        C:\Windows\SysWOW64\Ejiiippb.exe
        
        C:\Windows\system32\Ejiiippb.exe
        21⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Ebpqjmpd.exe
        
        C:\Windows\system32\Ebpqjmpd.exe
        22⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Eijigg32.exe
        
        C:\Windows\system32\Eijigg32.exe
        23⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Fajgfiag.exe
        
        C:\Windows\system32\Fajgfiag.exe
        24⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Flpkcbqm.exe
        
        C:\Windows\system32\Flpkcbqm.exe
        25⤵
        Modifies registry class
        
        PID:10676
        
        C:\Windows\SysWOW64\Falcli32.exe
        
        C:\Windows\system32\Falcli32.exe
        26⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Flbhia32.exe
        
        C:\Windows\system32\Flbhia32.exe
        27⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\Flgadake.exe
        
        C:\Windows\system32\Flgadake.exe
        28⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Gklnem32.exe
        
        C:\Windows\system32\Gklnem32.exe
        29⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\Geabbfoc.exe
        
        C:\Windows\system32\Geabbfoc.exe
        30⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Glkkop32.exe
        
        C:\Windows\system32\Glkkop32.exe
        31⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Gahcgg32.exe
        
        C:\Windows\system32\Gahcgg32.exe
        32⤵
        Drops file in System32 directory
        
        PID:10908
        
        C:\Windows\SysWOW64\Gkqhpmkg.exe
        
        C:\Windows\system32\Gkqhpmkg.exe
        33⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Geflne32.exe
        
        C:\Windows\system32\Geflne32.exe
        34⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Gkcdfl32.exe
        
        C:\Windows\system32\Gkcdfl32.exe
        35⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Gehice32.exe
        
        C:\Windows\system32\Gehice32.exe
        36⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Goamlkpk.exe
        
        C:\Windows\system32\Goamlkpk.exe
        37⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Hifaic32.exe
        
        C:\Windows\system32\Hifaic32.exe
        38⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Hocjaj32.exe
        
        C:\Windows\system32\Hocjaj32.exe
        39⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Hhlnjpdi.exe
        
        C:\Windows\system32\Hhlnjpdi.exe
        40⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Hoefgj32.exe
        
        C:\Windows\system32\Hoefgj32.exe
        41⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Hikkdc32.exe
        
        C:\Windows\system32\Hikkdc32.exe
        42⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Hafpiehg.exe
        
        C:\Windows\system32\Hafpiehg.exe
        43⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Hllcfnhm.exe
        
        C:\Windows\system32\Hllcfnhm.exe
        44⤵
        Drops file in System32 directory
        
        PID:11112
        
        C:\Windows\SysWOW64\Hcflch32.exe
        
        C:\Windows\system32\Hcflch32.exe
        45⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Hipdpbgf.exe
        
        C:\Windows\system32\Hipdpbgf.exe
        46⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Hommhi32.exe
        
        C:\Windows\system32\Hommhi32.exe
        47⤵
        Modifies registry class
        
        PID:11176
        
        C:\Windows\SysWOW64\Iefedcmk.exe
        
        C:\Windows\system32\Iefedcmk.exe
        48⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Iheaqolo.exe
        
        C:\Windows\system32\Iheaqolo.exe
        49⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Iooimi32.exe
        
        C:\Windows\system32\Iooimi32.exe
        50⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Iameid32.exe
        
        C:\Windows\system32\Iameid32.exe
        51⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Ihgnfnjl.exe
        
        C:\Windows\system32\Ihgnfnjl.exe
        52⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Ioafchai.exe
        
        C:\Windows\system32\Ioafchai.exe
        53⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Ijgjpaao.exe
        
        C:\Windows\system32\Ijgjpaao.exe
        54⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\Ikhghi32.exe
        
        C:\Windows\system32\Ikhghi32.exe
        55⤵
        Modifies registry class
        
        PID:6248
        
        C:\Windows\SysWOW64\Icakofel.exe
        
        C:\Windows\system32\Icakofel.exe
        56⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Ijkdkq32.exe
        
        C:\Windows\system32\Ijkdkq32.exe
        57⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\Ikmpcicg.exe
        
        C:\Windows\system32\Ikmpcicg.exe
        58⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Jhqqlmba.exe
        
        C:\Windows\system32\Jhqqlmba.exe
        59⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Jcfejfag.exe
        
        C:\Windows\system32\Jcfejfag.exe
        60⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Jhcmbm32.exe
        
        C:\Windows\system32\Jhcmbm32.exe
        61⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Jomeoggk.exe
        
        C:\Windows\system32\Jomeoggk.exe
        62⤵
        Drops file in System32 directory
        
        PID:6336
        
        C:\Windows\SysWOW64\Jjbjlpga.exe
        
        C:\Windows\system32\Jjbjlpga.exe
        63⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Jhjcbljf.exe
        
        C:\Windows\system32\Jhjcbljf.exe
        64⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Jodlof32.exe
        
        C:\Windows\system32\Jodlof32.exe
        65⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Kfndlphp.exe
        
        C:\Windows\system32\Kfndlphp.exe
        66⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Kilphk32.exe
        
        C:\Windows\system32\Kilphk32.exe
        67⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Kkkldg32.exe
        
        C:\Windows\system32\Kkkldg32.exe
        68⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Kbedaand.exe
        
        C:\Windows\system32\Kbedaand.exe
        69⤵
        Modifies registry class
        
        PID:6452
        
        C:\Windows\SysWOW64\Kiomnk32.exe
        
        C:\Windows\system32\Kiomnk32.exe
        70⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Kfbmgo32.exe
        
        C:\Windows\system32\Kfbmgo32.exe
        71⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Kmmedi32.exe
        
        C:\Windows\system32\Kmmedi32.exe
        72⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Kcfnqccd.exe
        
        C:\Windows\system32\Kcfnqccd.exe
        73⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Kjqfmn32.exe
        
        C:\Windows\system32\Kjqfmn32.exe
        74⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Kcikfcab.exe
        
        C:\Windows\system32\Kcikfcab.exe
        75⤵
        Modifies registry class
        
        PID:6444
        
        C:\Windows\SysWOW64\Ljleil32.exe
        
        C:\Windows\system32\Ljleil32.exe
        76⤵
        Modifies registry class
        
        PID:10824
        
        C:\Windows\SysWOW64\Llmbqdfb.exe
        
        C:\Windows\system32\Llmbqdfb.exe
        77⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Lcdjba32.exe
        
        C:\Windows\system32\Lcdjba32.exe
        78⤵
        Modifies registry class
        
        PID:6472
        
        C:\Windows\SysWOW64\Lfcfnm32.exe
        
        C:\Windows\system32\Lfcfnm32.exe
        79⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Lmmokgne.exe
        
        C:\Windows\system32\Lmmokgne.exe
        80⤵
        Modifies registry class
        
        PID:6508
        
        C:\Windows\SysWOW64\Mbldhn32.exe
        
        C:\Windows\system32\Mbldhn32.exe
        81⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6552 -s 400
        82⤵
        Program crash
        
        PID:6680
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6552 -s 400
        82⤵
        Program crash
        
        PID:6700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6552 -ip 6552
1⤵
PID:6740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afjeceml.exe

Filesize
92KB

MD5
0408d8b56367373462b1209f6ed1c39d

SHA1
7e45d47138f14835fa8601ce8bb0873c63cd2007

SHA256
c81f2862c8329ad6182e935c3751f25e41f9f45dd818848d361e11f57d9e72ab

SHA512
7336cb961d561d6794b29c1fd5deac7ffbf36f6ab65a0f1dc8bb3d94b9ec2987138f243ab1be21e590d11d33ac929821ebde2a37eca4fb4d03ff73667ab510ec

Download Submit
C:\Windows\SysWOW64\Afjeceml.exe

Filesize
92KB

MD5
0408d8b56367373462b1209f6ed1c39d

SHA1
7e45d47138f14835fa8601ce8bb0873c63cd2007

SHA256
c81f2862c8329ad6182e935c3751f25e41f9f45dd818848d361e11f57d9e72ab

SHA512
7336cb961d561d6794b29c1fd5deac7ffbf36f6ab65a0f1dc8bb3d94b9ec2987138f243ab1be21e590d11d33ac929821ebde2a37eca4fb4d03ff73667ab510ec

Download Submit
C:\Windows\SysWOW64\Afnnnd32.exe

Filesize
92KB

MD5
fa2aab059d2073c426a4d32958c9d3a5

SHA1
1354b8fe64fc3c6cfbebafaff5e0086c746a4021

SHA256
32b7e3fbbea20b1a104fa2921add4c90f5a1126826d6e598fe3c79361f1873de

SHA512
a89239b31e29a1fcc9048de399d91bc135a6802e1ab8343b87e8032953df75045518c36169bca07ea080452b22c00f7897e1b761930e9c3ad70cf0ac64628f12

Download Submit
C:\Windows\SysWOW64\Afnnnd32.exe

Filesize
92KB

MD5
fa2aab059d2073c426a4d32958c9d3a5

SHA1
1354b8fe64fc3c6cfbebafaff5e0086c746a4021

SHA256
32b7e3fbbea20b1a104fa2921add4c90f5a1126826d6e598fe3c79361f1873de

SHA512
a89239b31e29a1fcc9048de399d91bc135a6802e1ab8343b87e8032953df75045518c36169bca07ea080452b22c00f7897e1b761930e9c3ad70cf0ac64628f12

Download Submit
C:\Windows\SysWOW64\Bfhadc32.exe

Filesize
92KB

MD5
2f1c42d8e491be837ac39c41500e61c5

SHA1
9e28d048f8b2cb268ecda2f7358cef92f57e211d

SHA256
07d82c38b6b3fe979f40bb5e1d13a3783df190a25ef6672cc048de27e3804ffb

SHA512
6fc38c93d16ddf205da41396273f1b588f7b1d753a8282ad359fc80a1e0125d6546fa9ae6bc0ead9febaf547f24279d3409a0e6c0d7fa931751f19554325212e

Download Submit
C:\Windows\SysWOW64\Bfhadc32.exe

Filesize
92KB

MD5
2f1c42d8e491be837ac39c41500e61c5

SHA1
9e28d048f8b2cb268ecda2f7358cef92f57e211d

SHA256
07d82c38b6b3fe979f40bb5e1d13a3783df190a25ef6672cc048de27e3804ffb

SHA512
6fc38c93d16ddf205da41396273f1b588f7b1d753a8282ad359fc80a1e0125d6546fa9ae6bc0ead9febaf547f24279d3409a0e6c0d7fa931751f19554325212e

Download Submit
C:\Windows\SysWOW64\Bfjnjcni.exe

Filesize
92KB

MD5
cd41cd455362df724b96122586d5331d

SHA1
ac65598d779522d0909bbc4cc4ad2ef16315391f

SHA256
4764dcb5c438fbee6c684d5a260dd50567fab4d9ccc3e81c8ad1d4b8105035b4

SHA512
5f1bb24988ab669ba32af8990a4a29350b2b7f93d59e67d0ad471263c119a8f007d9b8ca772195f82b5fff5c4b523e7a67ce71c5ef6d7883ff2b28cfc67481ed

Download Submit
C:\Windows\SysWOW64\Bfjnjcni.exe

Filesize
92KB

MD5
cd41cd455362df724b96122586d5331d

SHA1
ac65598d779522d0909bbc4cc4ad2ef16315391f

SHA256
4764dcb5c438fbee6c684d5a260dd50567fab4d9ccc3e81c8ad1d4b8105035b4

SHA512
5f1bb24988ab669ba32af8990a4a29350b2b7f93d59e67d0ad471263c119a8f007d9b8ca772195f82b5fff5c4b523e7a67ce71c5ef6d7883ff2b28cfc67481ed

Download Submit
C:\Windows\SysWOW64\Boipmj32.exe

Filesize
92KB

MD5
6156090c47886c1edbcec6057d7c43af

SHA1
08e22de563fa53df8540d989c0ca32cab44f2bf1

SHA256
99f545e4c25072fa2b2d913d04032253698332247a2635bc097ec318b89bdae8

SHA512
3f71d080c0cca0fbf2d7f05c9876daaf3d7c0e34d11f2179b997284b83221c6bd9938ce3c4997f46642b1cd86d663ae9cb5d67f5b87a8e192e946ea68fe75579

Download Submit
C:\Windows\SysWOW64\Boipmj32.exe

Filesize
92KB

MD5
6156090c47886c1edbcec6057d7c43af

SHA1
08e22de563fa53df8540d989c0ca32cab44f2bf1

SHA256
99f545e4c25072fa2b2d913d04032253698332247a2635bc097ec318b89bdae8

SHA512
3f71d080c0cca0fbf2d7f05c9876daaf3d7c0e34d11f2179b997284b83221c6bd9938ce3c4997f46642b1cd86d663ae9cb5d67f5b87a8e192e946ea68fe75579

Download Submit
C:\Windows\SysWOW64\Cglgjeci.exe

Filesize
92KB

MD5
edb012a21f895cc39070357974017861

SHA1
4f1632d078afd224738df460add19ce5d2ab0a6c

SHA256
75ed51b3e59a66e72746008386a13e17b539d9ad80926764ee21eb9f4e00d327

SHA512
03393915b6152f7b8bf9f7426568b83da2bb02bae1d9fa673e66180f5ac5b0ea24df5a29997fde0eb1bdf711cf21399a9e47d0dbd536639e254f18fb163a8c2c

Download Submit
C:\Windows\SysWOW64\Cglgjeci.exe

Filesize
92KB

MD5
edb012a21f895cc39070357974017861

SHA1
4f1632d078afd224738df460add19ce5d2ab0a6c

SHA256
75ed51b3e59a66e72746008386a13e17b539d9ad80926764ee21eb9f4e00d327

SHA512
03393915b6152f7b8bf9f7426568b83da2bb02bae1d9fa673e66180f5ac5b0ea24df5a29997fde0eb1bdf711cf21399a9e47d0dbd536639e254f18fb163a8c2c

Download Submit
C:\Windows\SysWOW64\Cjhfpa32.exe

Filesize
92KB

MD5
8ca96b3356aa99a322af7e2ce589711e

SHA1
98f0d310253e85ac88b504b90545854cf22a0273

SHA256
6bbe913f5ff87069fa4504e8cbb9108a64a4e6ec24c50cc90993172c2af26a36

SHA512
fa8ec6423aed6be3e71dc62bb30ba0a79f609c5dec8e0923a20c383c3cdb6d75a6ceb97806aa34bb618b6e8fc8c89a837ed5b84675021d43ae232ecb06578836

Download Submit
C:\Windows\SysWOW64\Cjhfpa32.exe

Filesize
92KB

MD5
8ca96b3356aa99a322af7e2ce589711e

SHA1
98f0d310253e85ac88b504b90545854cf22a0273

SHA256
6bbe913f5ff87069fa4504e8cbb9108a64a4e6ec24c50cc90993172c2af26a36

SHA512
fa8ec6423aed6be3e71dc62bb30ba0a79f609c5dec8e0923a20c383c3cdb6d75a6ceb97806aa34bb618b6e8fc8c89a837ed5b84675021d43ae232ecb06578836

Download Submit
C:\Windows\SysWOW64\Cmniml32.exe

Filesize
92KB

MD5
8dfe96f5429a217fbaf1ef079dc19f4f

SHA1
f1ca0a4dd34c240681a4de177c9f4330412d8b03

SHA256
09ffffcbb4c48278073d049f1d1ae71f447b385ddff317d2dfd248563fc341e7

SHA512
d4624105431f599c9977ef3bece82f771f3899fa8ae75c21dc0afdc870ee864af4c113a76e04772495b4e9f96ba0f56c989441d6966597d53bba4b64a8306b13

Download Submit
C:\Windows\SysWOW64\Cmniml32.exe

Filesize
92KB

MD5
8dfe96f5429a217fbaf1ef079dc19f4f

SHA1
f1ca0a4dd34c240681a4de177c9f4330412d8b03

SHA256
09ffffcbb4c48278073d049f1d1ae71f447b385ddff317d2dfd248563fc341e7

SHA512
d4624105431f599c9977ef3bece82f771f3899fa8ae75c21dc0afdc870ee864af4c113a76e04772495b4e9f96ba0f56c989441d6966597d53bba4b64a8306b13

Download Submit
C:\Windows\SysWOW64\Dabhdinj.exe

Filesize
92KB

MD5
616124b98c1dddd7a6ee41f0bbbe05a3

SHA1
601a4a6409ec44e132ff6b4092d497a7ee1ea8b9

SHA256
14d8c68f098fc64fa1eaf5421ff3fd55a16bd4697dd4a713af063183fd919921

SHA512
a446e89704a5c61eafa2b4b709dd6089b7f5ae44acafd93da10be0aa9b17f81c35b4df6219e63957e131647445cbfd1fae2401b80ec0a844e810d20cd2af3d4a

Download Submit
C:\Windows\SysWOW64\Dabhdinj.exe

Filesize
92KB

MD5
616124b98c1dddd7a6ee41f0bbbe05a3

SHA1
601a4a6409ec44e132ff6b4092d497a7ee1ea8b9

SHA256
14d8c68f098fc64fa1eaf5421ff3fd55a16bd4697dd4a713af063183fd919921

SHA512
a446e89704a5c61eafa2b4b709dd6089b7f5ae44acafd93da10be0aa9b17f81c35b4df6219e63957e131647445cbfd1fae2401b80ec0a844e810d20cd2af3d4a

Download Submit
C:\Windows\SysWOW64\Dapkni32.exe

Filesize
92KB

MD5
833ec6ebb7be68105e5a41be9897feb8

SHA1
906156aa261b74346481794167339c94667eff53

SHA256
0d107a7b6ad517e20a7a4b5e0b7770c6f082ee6e206ba3598dffd9f41a346700

SHA512
8ba020a1aeed4a79530e2c8b56e4e76f39cc0db9c7bd7a8d3df24823504b8d417f1565e698ea37b663b5bd0b7ab143df32b908449b8a63f5cc4e117a0ca433cc

Download Submit
C:\Windows\SysWOW64\Dapkni32.exe

Filesize
92KB

MD5
833ec6ebb7be68105e5a41be9897feb8

SHA1
906156aa261b74346481794167339c94667eff53

SHA256
0d107a7b6ad517e20a7a4b5e0b7770c6f082ee6e206ba3598dffd9f41a346700

SHA512
8ba020a1aeed4a79530e2c8b56e4e76f39cc0db9c7bd7a8d3df24823504b8d417f1565e698ea37b663b5bd0b7ab143df32b908449b8a63f5cc4e117a0ca433cc

Download Submit
C:\Windows\SysWOW64\Diffglam.exe

Filesize
92KB

MD5
f6bf55554a5d346f7721d5a722ba817d

SHA1
7c8ec6e5cc7020eed3e6c1fe00c25a2595465c5b

SHA256
9eb71a63728cbe2add58a34401ed22a99b25a29d89bf94ba39feec5e0206dadb

SHA512
4e93b4135ca3666505aa2ccf3a42bc230af3f5943bd6a9d386910dff03fec57c54d0c2c3cfbb61e43328b76fac47443489d0f2bd3b2de2965f59b3ae4a5ed9b8

Download Submit
C:\Windows\SysWOW64\Diffglam.exe

Filesize
92KB

MD5
f6bf55554a5d346f7721d5a722ba817d

SHA1
7c8ec6e5cc7020eed3e6c1fe00c25a2595465c5b

SHA256
9eb71a63728cbe2add58a34401ed22a99b25a29d89bf94ba39feec5e0206dadb

SHA512
4e93b4135ca3666505aa2ccf3a42bc230af3f5943bd6a9d386910dff03fec57c54d0c2c3cfbb61e43328b76fac47443489d0f2bd3b2de2965f59b3ae4a5ed9b8

Download Submit
C:\Windows\SysWOW64\Dpgeee32.exe

Filesize
92KB

MD5
89fbe812c7af60365a216e8accfb52e2

SHA1
0907d650a95b4ad29beeb24379532f6578269e25

SHA256
a20ba9b119319a5a952cf1a4429694980d4f9038b8b644c975ea0272231d9fac

SHA512
4a4e7f3bf721ee3b676a61180db404a8647147bb92cd3bbde73d865cc41f9bdf70e61bf666a87853fbf81385497387dcbf00409b3ae2e1d033f0c1680f0e790a

Download Submit
C:\Windows\SysWOW64\Dpgeee32.exe

Filesize
92KB

MD5
89fbe812c7af60365a216e8accfb52e2

SHA1
0907d650a95b4ad29beeb24379532f6578269e25

SHA256
a20ba9b119319a5a952cf1a4429694980d4f9038b8b644c975ea0272231d9fac

SHA512
4a4e7f3bf721ee3b676a61180db404a8647147bb92cd3bbde73d865cc41f9bdf70e61bf666a87853fbf81385497387dcbf00409b3ae2e1d033f0c1680f0e790a

Download Submit
C:\Windows\SysWOW64\Epagkd32.exe

Filesize
92KB

MD5
b8a349373305ec062798a361b1954869

SHA1
6639703b4fb97770560c2fe5eaff02bde0f88626

SHA256
a4240a062e27fb55ff87baa40d7217da551bb995827604254143ad5867c90784

SHA512
9c71e4366fbc554551439ebc89d5faccd1b24931b5aaa84f345005f225a2608c9634a519f919994dc0b8336ce778cdd46a0d86f60f7c14609faed4e806592860

Download Submit
C:\Windows\SysWOW64\Epagkd32.exe

Filesize
92KB

MD5
b8a349373305ec062798a361b1954869

SHA1
6639703b4fb97770560c2fe5eaff02bde0f88626

SHA256
a4240a062e27fb55ff87baa40d7217da551bb995827604254143ad5867c90784

SHA512
9c71e4366fbc554551439ebc89d5faccd1b24931b5aaa84f345005f225a2608c9634a519f919994dc0b8336ce778cdd46a0d86f60f7c14609faed4e806592860

Download Submit
C:\Windows\SysWOW64\Fdcjlb32.exe

Filesize
92KB

MD5
d1ac0bf5b8179cd38516c9b3135abee1

SHA1
b24d330f93844033d8e35084c29bd5825c409604

SHA256
76b3e8a1f812482a0dc636a7019f9189002a0c2bdad7b480b7d78ec9baef423a

SHA512
3bf4d2f0e50f2cdf0e39b08fda1f452d30b4133880c9a45f44d1eee2bdc6bdbb4ee206e22994491236cf3b4d699c1017b749ce534e928c1e81767aa2084a7092

Download Submit
C:\Windows\SysWOW64\Fdcjlb32.exe

Filesize
92KB

MD5
d1ac0bf5b8179cd38516c9b3135abee1

SHA1
b24d330f93844033d8e35084c29bd5825c409604

SHA256
76b3e8a1f812482a0dc636a7019f9189002a0c2bdad7b480b7d78ec9baef423a

SHA512
3bf4d2f0e50f2cdf0e39b08fda1f452d30b4133880c9a45f44d1eee2bdc6bdbb4ee206e22994491236cf3b4d699c1017b749ce534e928c1e81767aa2084a7092

Download Submit
C:\Windows\SysWOW64\Fhabbp32.exe

Filesize
92KB

MD5
a3ce29074ca082a8a5904e08d5baa9a3

SHA1
cbc885cc6aa7f6c9670546707f4cc1eb6de33694

SHA256
c3fbd5f7217b81cc3891ee596b96dd8fc5a703cf3f98d999c9e25c334c38e379

SHA512
fa1cb8999639ae808a5720f543f44bc61aaf10074d04e052d6f86b8778173ef329a5a9a16a5ececf75a734b9def8e1176e97ac67d03462f76001e2d4c5dea59a

Download Submit
C:\Windows\SysWOW64\Fhabbp32.exe

Filesize
92KB

MD5
a3ce29074ca082a8a5904e08d5baa9a3

SHA1
cbc885cc6aa7f6c9670546707f4cc1eb6de33694

SHA256
c3fbd5f7217b81cc3891ee596b96dd8fc5a703cf3f98d999c9e25c334c38e379

SHA512
fa1cb8999639ae808a5720f543f44bc61aaf10074d04e052d6f86b8778173ef329a5a9a16a5ececf75a734b9def8e1176e97ac67d03462f76001e2d4c5dea59a

Download Submit
C:\Windows\SysWOW64\Filiii32.exe

Filesize
92KB

MD5
814fd6bfc71bf490ca6c2742dba17602

SHA1
5524885bc61f164b64ff3cac0a7e303db2303bf6

SHA256
5d9a82e49aa18f8d7530c11ac5c7fcb7d06787c8a2f31146478d57b7d226058c

SHA512
5a1a413e9e7b3aae489f68f1430d5a316aee9c7865f3737059a60865d64ebfc41ca734234cff4c9c9e1b8ce5910ed1b05a40492ed6f779bf552bef4d3bba72d5

Download Submit
C:\Windows\SysWOW64\Filiii32.exe

Filesize
92KB

MD5
814fd6bfc71bf490ca6c2742dba17602

SHA1
5524885bc61f164b64ff3cac0a7e303db2303bf6

SHA256
5d9a82e49aa18f8d7530c11ac5c7fcb7d06787c8a2f31146478d57b7d226058c

SHA512
5a1a413e9e7b3aae489f68f1430d5a316aee9c7865f3737059a60865d64ebfc41ca734234cff4c9c9e1b8ce5910ed1b05a40492ed6f779bf552bef4d3bba72d5

Download Submit
C:\Windows\SysWOW64\Fpodlbng.exe

Filesize
92KB

MD5
499c7a5d0744adcd6c742700753b89d8

SHA1
3c65d915ddf02f3bacb4b0fffd4500a3fc4af48f

SHA256
9f7cccc11e83f9456629de5fb06ab9b94d3d9582a27655499b252cc470142f16

SHA512
db8ca6e4c6d371a7499a0131fd9f50b255194326739e7c8d9a7e37c1c86e2a21a7e072301cf76e64de287e82188e77f1c217e70a55ca318dc009a33b09ef1ed2

Download Submit
C:\Windows\SysWOW64\Fpodlbng.exe

Filesize
92KB

MD5
499c7a5d0744adcd6c742700753b89d8

SHA1
3c65d915ddf02f3bacb4b0fffd4500a3fc4af48f

SHA256
9f7cccc11e83f9456629de5fb06ab9b94d3d9582a27655499b252cc470142f16

SHA512
db8ca6e4c6d371a7499a0131fd9f50b255194326739e7c8d9a7e37c1c86e2a21a7e072301cf76e64de287e82188e77f1c217e70a55ca318dc009a33b09ef1ed2

Download Submit
C:\Windows\SysWOW64\Gddbcp32.exe

Filesize
92KB

MD5
3fb0c2e2b5ad742070a29cee8b5f4e9a

SHA1
c6f30088816adc86be0dae804f7f4487abda8694

SHA256
6f82361814de75f9c095566ea100cf10b151d7d275cc4a64d308555c48415804

SHA512
79fe14cc7f3188895bbf8a31a07a8dd8c96fff9c8c4b2f4baa22f0c40070d271ec0efd4224c5340486ce0572c7d21d1e9b7ee6bb59f9809c7ed729d1a60ac195

Download Submit
C:\Windows\SysWOW64\Gddbcp32.exe

Filesize
92KB

MD5
3fb0c2e2b5ad742070a29cee8b5f4e9a

SHA1
c6f30088816adc86be0dae804f7f4487abda8694

SHA256
6f82361814de75f9c095566ea100cf10b151d7d275cc4a64d308555c48415804

SHA512
79fe14cc7f3188895bbf8a31a07a8dd8c96fff9c8c4b2f4baa22f0c40070d271ec0efd4224c5340486ce0572c7d21d1e9b7ee6bb59f9809c7ed729d1a60ac195

Download Submit
C:\Windows\SysWOW64\Gdfoio32.exe

Filesize
92KB

MD5
d992ddd78159b33c5ad8d2cb30fe5557

SHA1
f30cf786f40fe67507bf3c777b1b7ab66683b4de

SHA256
2794927633d5ff19c262fa4b76182a1c4ea9f501b8fbfdb7b9644c314274ef43

SHA512
a88f1aed0ec3a28df7e88cb2189ffc25a7db1e2be79c9ff7432f64d0376aa76463f3de51cd3aecf9d58e5086e3b151d02a813faf8955b46b7532510aac61601a

Download Submit
C:\Windows\SysWOW64\Gdfoio32.exe

Filesize
92KB

MD5
d992ddd78159b33c5ad8d2cb30fe5557

SHA1
f30cf786f40fe67507bf3c777b1b7ab66683b4de

SHA256
2794927633d5ff19c262fa4b76182a1c4ea9f501b8fbfdb7b9644c314274ef43

SHA512
a88f1aed0ec3a28df7e88cb2189ffc25a7db1e2be79c9ff7432f64d0376aa76463f3de51cd3aecf9d58e5086e3b151d02a813faf8955b46b7532510aac61601a

Download Submit
C:\Windows\SysWOW64\Ggnedlao.exe

Filesize
92KB

MD5
7d37a56aa276d9cbb37246937afe7a5a

SHA1
237d2ad13b3704b07d75096e31ad0c9549548ee1

SHA256
0f79d0ff21fd37b41a70c85eb2846de36a0cedeaff8db362e0a39c6ebaf987fc

SHA512
268c611c16095094659070327be6ebb4472e2e945ad3aec01a193748d465cbb6f74216984c1b1197d20e77ae07627d1b495eb1133f0ace923d0344a52fb05d62

Download Submit
C:\Windows\SysWOW64\Ggnedlao.exe

Filesize
92KB

MD5
7d37a56aa276d9cbb37246937afe7a5a

SHA1
237d2ad13b3704b07d75096e31ad0c9549548ee1

SHA256
0f79d0ff21fd37b41a70c85eb2846de36a0cedeaff8db362e0a39c6ebaf987fc

SHA512
268c611c16095094659070327be6ebb4472e2e945ad3aec01a193748d465cbb6f74216984c1b1197d20e77ae07627d1b495eb1133f0ace923d0344a52fb05d62

Download Submit
C:\Windows\SysWOW64\Gkdhjknm.exe

Filesize
92KB

MD5
aabcf9129b027176ceb2eff0e98b6166

SHA1
411e65b79046b9b70c48431bb138dd8f5b0d6d4e

SHA256
7e94b5ee2b92f0f004298dc837560209d8b6f6f33c4d42ede22b12f14ea0cb37

SHA512
5fe80b5f7ee74de38138a06b1887a755843f764e77c4e797767e5ce04f98986c49221f4efbd4c4e2365abe658f84197277552301d27962354e70d2636696d2f7

Download Submit
C:\Windows\SysWOW64\Gkdhjknm.exe

Filesize
92KB

MD5
aabcf9129b027176ceb2eff0e98b6166

SHA1
411e65b79046b9b70c48431bb138dd8f5b0d6d4e

SHA256
7e94b5ee2b92f0f004298dc837560209d8b6f6f33c4d42ede22b12f14ea0cb37

SHA512
5fe80b5f7ee74de38138a06b1887a755843f764e77c4e797767e5ce04f98986c49221f4efbd4c4e2365abe658f84197277552301d27962354e70d2636696d2f7

Download Submit
C:\Windows\SysWOW64\Haoimcgg.exe

Filesize
92KB

MD5
7a9a7e0f375ed7a4799f17c2370dba6f

SHA1
c3da10563ea72d14bc6378a8ec380d2ce693efbd

SHA256
c2a0940cfd549e24b1867504f6e6786ef6bcc6e8c926c4128563af4d0540d9cb

SHA512
d93acec6dc7ddb877441b0e75eb3d1c401bd852a34c186c601cdd040349848796553a87ebad65e2200dcc482e52e044b5f3c06616818bbe1c50c8aa6d17b22e9

Download Submit
C:\Windows\SysWOW64\Haoimcgg.exe

Filesize
92KB

MD5
7a9a7e0f375ed7a4799f17c2370dba6f

SHA1
c3da10563ea72d14bc6378a8ec380d2ce693efbd

SHA256
c2a0940cfd549e24b1867504f6e6786ef6bcc6e8c926c4128563af4d0540d9cb

SHA512
d93acec6dc7ddb877441b0e75eb3d1c401bd852a34c186c601cdd040349848796553a87ebad65e2200dcc482e52e044b5f3c06616818bbe1c50c8aa6d17b22e9

Download Submit
C:\Windows\SysWOW64\Idghpmnp.exe

Filesize
92KB

MD5
cc1cd1ca03f67463d9d7be275d70a988

SHA1
eff3682bd256fd530a1e1a3016970327024df292

SHA256
49ca90fc9188feb7ddb516cf0fe2d261cc10bb25b7ed1cda76b6e770b0b4abd5

SHA512
5a6ce4c19acff4f43afbea33bf6bfd1823a123a993389b13703f6a4b4dc1ef5ec978f3ef2a7ca844dae7b4106aaa4f0b2a6dad994ddbb9b61e034502a0314dcd

Download Submit
C:\Windows\SysWOW64\Idghpmnp.exe

Filesize
92KB

MD5
cc1cd1ca03f67463d9d7be275d70a988

SHA1
eff3682bd256fd530a1e1a3016970327024df292

SHA256
49ca90fc9188feb7ddb516cf0fe2d261cc10bb25b7ed1cda76b6e770b0b4abd5

SHA512
5a6ce4c19acff4f43afbea33bf6bfd1823a123a993389b13703f6a4b4dc1ef5ec978f3ef2a7ca844dae7b4106aaa4f0b2a6dad994ddbb9b61e034502a0314dcd

Download Submit
C:\Windows\SysWOW64\Lankbigo.exe

Filesize
92KB

MD5
e2c324e2135d8ee83f4ea802e05e478c

SHA1
801097671ed1ff451ec6be2eec56c0f51ac8753b

SHA256
3bf7e2d6678cbb3e7b589842e27843b0adf7befa5e07a71d149f993db2f58327

SHA512
fb74bd59c20ec41d1a92aafc875e17517580725cab1969d5d74caf306a748c65e0c5f3ecbd966446081b4b311bd56d2e95726144bb5e57380314479441267b2f

Download Submit
C:\Windows\SysWOW64\Lankbigo.exe

Filesize
92KB

MD5
e2c324e2135d8ee83f4ea802e05e478c

SHA1
801097671ed1ff451ec6be2eec56c0f51ac8753b

SHA256
3bf7e2d6678cbb3e7b589842e27843b0adf7befa5e07a71d149f993db2f58327

SHA512
fb74bd59c20ec41d1a92aafc875e17517580725cab1969d5d74caf306a748c65e0c5f3ecbd966446081b4b311bd56d2e95726144bb5e57380314479441267b2f

Download Submit
C:\Windows\SysWOW64\Lhmmjbkf.exe

Filesize
92KB

MD5
e810bafb53b700cfc293c8ef032d7ffb

SHA1
4d06c431899a5961b5a7edfb210a5faa482c58bb

SHA256
eef20232a3c2928d415657a29aca2f4ede2e27e85aa3924ce68014c1961aaf19

SHA512
9e5f3ea0ae9762bcd93d0f2f2f2502bfcff28c607bb6d8ba3043ac13bd0e5e4aaa7e0012814903091981696cb3a2f75130cbee724321bd4f1355b63e7ed0b0b4

Download Submit
C:\Windows\SysWOW64\Lhmmjbkf.exe

Filesize
92KB

MD5
e810bafb53b700cfc293c8ef032d7ffb

SHA1
4d06c431899a5961b5a7edfb210a5faa482c58bb

SHA256
eef20232a3c2928d415657a29aca2f4ede2e27e85aa3924ce68014c1961aaf19

SHA512
9e5f3ea0ae9762bcd93d0f2f2f2502bfcff28c607bb6d8ba3043ac13bd0e5e4aaa7e0012814903091981696cb3a2f75130cbee724321bd4f1355b63e7ed0b0b4

Download Submit
C:\Windows\SysWOW64\Malgcg32.exe

Filesize
92KB

MD5
aeae04a1380629fdc95c7208d0ca0f5c

SHA1
f6f2883307517a66e9d9815ec8b53445ebb5c861

SHA256
fcfa94f2af8e2abc22ac83e21dcd94501f7ee409519dda3bf78e0df2e4672c16

SHA512
5a88cdbf374beca17040d0592a20859959143114505f220117efe493633bbe40fe784e9a30f54d1dbf6159063dc02453eee377fd0a9c67152973018e9f4985bb

Download Submit
C:\Windows\SysWOW64\Malgcg32.exe

Filesize
92KB

MD5
aeae04a1380629fdc95c7208d0ca0f5c

SHA1
f6f2883307517a66e9d9815ec8b53445ebb5c861

SHA256
fcfa94f2af8e2abc22ac83e21dcd94501f7ee409519dda3bf78e0df2e4672c16

SHA512
5a88cdbf374beca17040d0592a20859959143114505f220117efe493633bbe40fe784e9a30f54d1dbf6159063dc02453eee377fd0a9c67152973018e9f4985bb

Download Submit
C:\Windows\SysWOW64\Mfjcnold.exe

Filesize
92KB

MD5
93a85fee490a6f74b32856a1473fe915

SHA1
1ae03f842109c6e3a7d57c23168482f1750184f9

SHA256
69cfe6a617d8deceab93a5774f4c5bffe4a2088284ab2809efc038940fa89e49

SHA512
3b8331a688ba839318a800800efb5e7035c6f32d17decf22165d2ea02e409932138f90ee3280d959f2bd2920bb6d14c9b4143b561f0e954651bcc664f6ad0bc9

Download Submit
C:\Windows\SysWOW64\Mfjcnold.exe

Filesize
92KB

MD5
93a85fee490a6f74b32856a1473fe915

SHA1
1ae03f842109c6e3a7d57c23168482f1750184f9

SHA256
69cfe6a617d8deceab93a5774f4c5bffe4a2088284ab2809efc038940fa89e49

SHA512
3b8331a688ba839318a800800efb5e7035c6f32d17decf22165d2ea02e409932138f90ee3280d959f2bd2920bb6d14c9b4143b561f0e954651bcc664f6ad0bc9

Download Submit
C:\Windows\SysWOW64\Mlkepaam.exe

Filesize
92KB

MD5
b96206dee5f14dae13522ee9fcd48066

SHA1
d20d8f90d11c85b9d9bde064f3230483029626f5

SHA256
e73e836c7a313717805a96d73389c5510ec33e8b67073b81b0c1e09b4db73c51

SHA512
dc71fe1d0b416a20cdfd4b01c8f3b45187f36a86c3c3bf71b1e1d4752356caeeb79d6df6793ea3a54fc322dd2496a34053d33f0561df053c5d99382068f47e68

Download Submit
C:\Windows\SysWOW64\Mlkepaam.exe

Filesize
92KB

MD5
b96206dee5f14dae13522ee9fcd48066

SHA1
d20d8f90d11c85b9d9bde064f3230483029626f5

SHA256
e73e836c7a313717805a96d73389c5510ec33e8b67073b81b0c1e09b4db73c51

SHA512
dc71fe1d0b416a20cdfd4b01c8f3b45187f36a86c3c3bf71b1e1d4752356caeeb79d6df6793ea3a54fc322dd2496a34053d33f0561df053c5d99382068f47e68

Download Submit
C:\Windows\SysWOW64\Ohnebd32.exe

Filesize
92KB

MD5
70d98dd0f50337462a3c6849931d6e41

SHA1
7c1ff3ad5b2f2859d3b04a8b41ae2ead78ce07ad

SHA256
60855e667d21a45a211217e79f3ed424459bd0b366413ff29c31016b1eb300db

SHA512
373091a9a83b1d4541b521a5b3e15faa83ac36c5726fe632c2e1c1d038ae3c814a274e11f1c994e464f90918f52a93263ae5c3b9ac6717242527e128a1bd99fe

Download Submit
C:\Windows\SysWOW64\Ohnebd32.exe

Filesize
92KB

MD5
70d98dd0f50337462a3c6849931d6e41

SHA1
7c1ff3ad5b2f2859d3b04a8b41ae2ead78ce07ad

SHA256
60855e667d21a45a211217e79f3ed424459bd0b366413ff29c31016b1eb300db

SHA512
373091a9a83b1d4541b521a5b3e15faa83ac36c5726fe632c2e1c1d038ae3c814a274e11f1c994e464f90918f52a93263ae5c3b9ac6717242527e128a1bd99fe

Download Submit
C:\Windows\SysWOW64\Pfgogh32.exe

Filesize
92KB

MD5
6895efb7dff12f1c8b0797607505ce36

SHA1
0699cd48f11aae476cb31f90389ca75550b4d8ae

SHA256
eacd5b58e5c84cacc4da25e8cb0b69c9026e3ffda2745afde6dabe2fa525ccd4

SHA512
aaa16f444a0a6b4bc85b30e9c0d3da4a2e3ecba300b52a48b683b5e1236eec63036101779f42d4e845dbb7c5a7e9ea2b3e0ed32934973699665f9ff769f9f588

Download Submit
C:\Windows\SysWOW64\Pfgogh32.exe

Filesize
92KB

MD5
6895efb7dff12f1c8b0797607505ce36

SHA1
0699cd48f11aae476cb31f90389ca75550b4d8ae

SHA256
eacd5b58e5c84cacc4da25e8cb0b69c9026e3ffda2745afde6dabe2fa525ccd4

SHA512
aaa16f444a0a6b4bc85b30e9c0d3da4a2e3ecba300b52a48b683b5e1236eec63036101779f42d4e845dbb7c5a7e9ea2b3e0ed32934973699665f9ff769f9f588

Download Submit
C:\Windows\SysWOW64\Pfnegggi.exe

Filesize
92KB

MD5
180471e319e3387ac0237c597419209e

SHA1
a387f0de2df5f6b2aba20f4625ec6fe9fb8bb575

SHA256
44257101724e42cf8426e474b72ac3ef15887189243831db94007c09c7b04b42

SHA512
f500e38b15b9564a67df995d50ab2ec50e70d3fa6bc3d203c45356448fdfd27a56a5b3754f327d70070d4eec0a0d8c5de47e51b03f041063c774021ed84eaaa3

Download Submit
C:\Windows\SysWOW64\Pfnegggi.exe

Filesize
92KB

MD5
180471e319e3387ac0237c597419209e

SHA1
a387f0de2df5f6b2aba20f4625ec6fe9fb8bb575

SHA256
44257101724e42cf8426e474b72ac3ef15887189243831db94007c09c7b04b42

SHA512
f500e38b15b9564a67df995d50ab2ec50e70d3fa6bc3d203c45356448fdfd27a56a5b3754f327d70070d4eec0a0d8c5de47e51b03f041063c774021ed84eaaa3

Download Submit
C:\Windows\SysWOW64\Qlmgopjq.exe

Filesize
92KB

MD5
174ea710f70d5cd3d83e33cb74e7cf72

SHA1
6b75c2a685069d4d4f8090128506cfe350f40da2

SHA256
2ab2af0201e4095e7c4b7b0b62ff0ceefe310f0820544fed27ddc024fb51d587

SHA512
621abf757d6a294e749e0f1675dda21621b128bec5bbe711d692ac1bcf0af2e1975a9dde8a202d57dec74e8d3e85f687d1e2d399f965fd77427920c55979b67d

Download Submit
C:\Windows\SysWOW64\Qlmgopjq.exe

Filesize
92KB

MD5
174ea710f70d5cd3d83e33cb74e7cf72

SHA1
6b75c2a685069d4d4f8090128506cfe350f40da2

SHA256
2ab2af0201e4095e7c4b7b0b62ff0ceefe310f0820544fed27ddc024fb51d587

SHA512
621abf757d6a294e749e0f1675dda21621b128bec5bbe711d692ac1bcf0af2e1975a9dde8a202d57dec74e8d3e85f687d1e2d399f965fd77427920c55979b67d

Download Submit
memory/312-244-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/392-152-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/464-236-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/688-256-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/776-318-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/980-196-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1072-274-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1144-218-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1308-140-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1328-151-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1368-286-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1500-315-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1540-176-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1556-173-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1660-233-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1860-296-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1868-264-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1888-295-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1992-290-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2060-262-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2096-193-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2308-175-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2448-234-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2452-289-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2492-306-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2500-314-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2556-194-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2652-219-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2740-221-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3056-303-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3296-285-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3388-316-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3532-192-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3568-254-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3712-263-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3800-272-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3824-132-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3852-288-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3864-215-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4008-323-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4052-178-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4076-319-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4084-240-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4116-223-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4244-277-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4324-172-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4400-287-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4420-320-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4448-195-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4500-216-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4540-278-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4700-297-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4744-298-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4764-150-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4768-305-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4836-139-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4848-304-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4944-273-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4948-235-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4952-276-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4996-275-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5008-255-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5028-317-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5088-171-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download