4b7116138770e1232d76b212e3fcf05d1fcd6e6c4b171156e1ac2820501eb5f3

Analysis

max time kernel
155s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19/12/2023, 10:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0aaf84187c78a0204a05a9cf5a31b1c5.exe
Size

448KB
MD5

0aaf84187c78a0204a05a9cf5a31b1c5
SHA1

b1707604fc2d85c72d0bf74dbceee2af728b14d7
SHA256

4b7116138770e1232d76b212e3fcf05d1fcd6e6c4b171156e1ac2820501eb5f3
SHA512

97799b6df9d4eb1c31f3313153ee261fa801833af1db56a22522c3df487aaf0d304d92a05cf25b2f93b6ffd12ce8db4e9f1a2d48a114bfccf0a2bf5c70758e1a
SSDEEP

6144:iRSwGYf3QVqFRY4PpU3QVqF4y4wLv8EYdKLI+q7RS3QVqFRY4PpU3QVqF:ZaQVcQQVhyzIEWUT9QVcQQV

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcpjnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpagbk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdffiinp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbfoeiei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adapqk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojefjd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aegbji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akjnnpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Inejlibi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcboan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipqnknld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikhghi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kceoppmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmefiakh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lohggm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aojljkkf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgglnb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebdlkdlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gjnlha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fanbll32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgmlde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gibhihko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adiknkco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnndhi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iodaikfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fjnjjlog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdcplkoe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpjjkh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkmdoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmojep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iohlcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fpagdj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icoodj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhnidi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpcnceab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgpllm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Koekpi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgphje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahofidlb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bafgdfim.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajjjjghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnhlgc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnimia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Niqnli32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifjfhh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjehflie.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cclagm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eennefib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpqedfne.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkkemble.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmlbij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ecphbckp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddmhcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dffmogji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkihgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmpdbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ghmkol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Komhfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpfonnab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eipigqop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpagdj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acheqi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njjdae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qhddgofo.exe

Executes dropped EXE 64 IoCs

pid	Process
4344	Pmjhlklg.exe
468	Acdioc32.exe
2520	Bcnleb32.exe
1012	Cmpcdfll.exe
3848	Clgmkbna.exe
1260	Eennefib.exe
3128	Eegqldqg.exe
1120	Fpoaom32.exe
3368	Ffnglc32.exe
2360	Gjnlha32.exe
1736	Gfemmb32.exe
3528	Gckjlf32.exe
4392	Hfamia32.exe
1828	Hnokjm32.exe
3456	Igneda32.exe
4636	Jcoioabf.exe
4916	Kceoppmo.exe
732	Ldanloba.exe
4200	Laeoec32.exe
2280	Mgbpdgap.exe
5068	Ohbfeh32.exe
4384	Poagma32.exe
1696	Pfmlok32.exe
3248	Akjnnpcf.exe
2760	Ceehcc32.exe
5012	Deagoa32.exe
852	Didjqoae.exe
4532	Elnehifk.exe
1524	Fgcjea32.exe
1832	Fikihlmj.exe
1804	Gegchl32.exe
2224	Glqkefff.exe
3548	Hpaqqdjj.exe
2964	Hfniikha.exe
4444	Hhehkepj.exe
2500	Ijjnpg32.exe
1744	Jcihjl32.exe
400	Jmamba32.exe
3608	Jcnbekok.exe
1060	Kimgba32.exe
3780	Kjopbd32.exe
5076	Ljffccjh.exe
3800	Lglcag32.exe
2812	Mfomda32.exe
4084	Naqqmieo.exe
3208	Okpkgm32.exe
4764	Paomog32.exe
3784	Qjcdih32.exe
4940	Qhddgofo.exe
1772	Ajjjjghg.exe
4192	Anjpeelk.exe
2372	Bkcjjhgp.exe
4900	Bndblcdq.exe
320	Cnhlgc32.exe
1660	Dabhomea.exe
2920	Dagajlal.exe
2184	Ehhpge32.exe
1620	Ehmibdol.exe
1652	Fiheheka.exe
4816	Ghpooanf.exe
2020	Gojgkl32.exe
496	Hembndee.exe
3320	Iameid32.exe
2148	Ihgnfnjl.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ijjnpg32.exe	Hhehkepj.exe
File opened for modification	C:\Windows\SysWOW64\Okpkgm32.exe	Naqqmieo.exe
File created	C:\Windows\SysWOW64\Fpfmgq32.dll	Gijmlh32.exe
File created	C:\Windows\SysWOW64\Qeaepc32.dll	Ebdlkdlp.exe
File created	C:\Windows\SysWOW64\Pmdgahkj.dll	Egjobl32.exe
File created	C:\Windows\SysWOW64\Bidefbcg.exe	Bhblfpng.exe
File created	C:\Windows\SysWOW64\Bjaqih32.exe	Bjodch32.exe
File created	C:\Windows\SysWOW64\Ofpfmaai.dll	Lddgghfo.exe
File opened for modification	C:\Windows\SysWOW64\Fkihgb32.exe	Fdopkhfk.exe
File created	C:\Windows\SysWOW64\Ljkldp32.dll	Lnjnjn32.exe
File created	C:\Windows\SysWOW64\Imieblgl.exe	Igomeb32.exe
File created	C:\Windows\SysWOW64\Iameid32.exe	Hembndee.exe
File created	C:\Windows\SysWOW64\Olhlaoea.exe	Ofncde32.exe
File created	C:\Windows\SysWOW64\Gabfqkan.dll	Kimgad32.exe
File created	C:\Windows\SysWOW64\Lljked32.exe	Ljloii32.exe
File created	C:\Windows\SysWOW64\Bpjkbcbe.exe	Aohbbqme.exe
File created	C:\Windows\SysWOW64\Iponfm32.dll	Bimkde32.exe
File created	C:\Windows\SysWOW64\Lnadkmhj.exe	Lgglnb32.exe
File created	C:\Windows\SysWOW64\Mjnfnn32.dll	Mgceqh32.exe
File created	C:\Windows\SysWOW64\Gikdep32.exe	Gldgflba.exe
File created	C:\Windows\SysWOW64\Bhjgdplo.exe	Akffjkme.exe
File created	C:\Windows\SysWOW64\Ijoahfmh.dll	Knoonphp.exe
File created	C:\Windows\SysWOW64\Kgopbj32.exe	Kglcmk32.exe
File created	C:\Windows\SysWOW64\Cakghn32.exe	Cfdgcmqd.exe
File opened for modification	C:\Windows\SysWOW64\Domdcpib.exe	Dnmhim32.exe
File created	C:\Windows\SysWOW64\Hnokjm32.exe	Hfamia32.exe
File created	C:\Windows\SysWOW64\Nmeikqpi.dll	Heohinog.exe
File created	C:\Windows\SysWOW64\Fdqcaihb.dll	Lkgkqh32.exe
File created	C:\Windows\SysWOW64\Ckgmjh32.dll	Jookdcie.exe
File created	C:\Windows\SysWOW64\Plgpjhnf.exe	Pfjgbapo.exe
File created	C:\Windows\SysWOW64\Dccpdooi.dll	Ckaffjbg.exe
File opened for modification	C:\Windows\SysWOW64\Elbhde32.exe	Ejaklmpd.exe
File created	C:\Windows\SysWOW64\Ebgpkj32.exe	Ekmhnpfl.exe
File created	C:\Windows\SysWOW64\Hbeece32.exe	Hlkmfkli.exe
File opened for modification	C:\Windows\SysWOW64\Bobalm32.exe	Bhhiocdg.exe
File opened for modification	C:\Windows\SysWOW64\Falmabki.exe	Fchlhnlo.exe
File opened for modification	C:\Windows\SysWOW64\Iodaikfl.exe	Ifipmo32.exe
File opened for modification	C:\Windows\SysWOW64\Ecgcpc32.exe	Emmkci32.exe
File created	C:\Windows\SysWOW64\Amaegbgd.dll	Jikojcaa.exe
File created	C:\Windows\SysWOW64\Inmmfl32.dll	Ehbgjenf.exe
File opened for modification	C:\Windows\SysWOW64\Qjjhla32.exe	Pdmpck32.exe
File created	C:\Windows\SysWOW64\Oopnio32.dll	Lbnnphhk.exe
File opened for modification	C:\Windows\SysWOW64\Nbadmege.exe	Nlglpkpi.exe
File created	C:\Windows\SysWOW64\Klnkoc32.exe	Klgend32.exe
File opened for modification	C:\Windows\SysWOW64\Bpjkbcbe.exe	Aohbbqme.exe
File created	C:\Windows\SysWOW64\Gbenjm32.exe	Gmhfbf32.exe
File opened for modification	C:\Windows\SysWOW64\Kelkkpae.exe	Knabne32.exe
File created	C:\Windows\SysWOW64\Oakbonkb.exe	Ojommdfh.exe
File created	C:\Windows\SysWOW64\Lpipoahh.dll	Eennefib.exe
File opened for modification	C:\Windows\SysWOW64\Kgphje32.exe	Kabpan32.exe
File opened for modification	C:\Windows\SysWOW64\Ebgpkj32.exe	Ekmhnpfl.exe
File created	C:\Windows\SysWOW64\Oddeop32.dll	Dgqqnjea.exe
File created	C:\Windows\SysWOW64\Caadnc32.dll	Mgoboake.exe
File created	C:\Windows\SysWOW64\Mfnojh32.exe	Modgnn32.exe
File created	C:\Windows\SysWOW64\Hhbnqi32.exe	Hmlicp32.exe
File opened for modification	C:\Windows\SysWOW64\Pkaijl32.exe	Ojopki32.exe
File opened for modification	C:\Windows\SysWOW64\Cellfm32.exe	Ckghid32.exe
File created	C:\Windows\SysWOW64\Fjnjjlog.exe	Ecphbckp.exe
File created	C:\Windows\SysWOW64\Nnojad32.exe	Ngeaej32.exe
File opened for modification	C:\Windows\SysWOW64\Phjdggoj.exe	Omdpio32.exe
File created	C:\Windows\SysWOW64\Gibeidka.dll	Afpjoaeo.exe
File opened for modification	C:\Windows\SysWOW64\Kceoppmo.exe	Jcoioabf.exe
File opened for modification	C:\Windows\SysWOW64\Omdnbd32.exe	Ndliin32.exe
File created	C:\Windows\SysWOW64\Lajmmc32.exe	Kolaqh32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aggean32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfeahffl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcihjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phhjdncl.dll"	Lcdjba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnealfkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oqakln32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnanpfdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nehekq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lajmmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dccpdooi.dll"	Ckaffjbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jklkea32.dll"	Kqbdej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojmbll32.dll"	Boipfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iegheo32.dll"	Fmikoggm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eecfjhpp.dll"	Hcmbnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oklegcdn.dll"	Cahdhhep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnhlgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjgljffm.dll"	Icfnjcec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Keadnlmk.dll"	Kpdbhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aobieq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fpeapilo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Akpojpic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qpolahdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnblfkcj.dll"	Omhpcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipqnknld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpdbhn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjpaec32.dll"	Kjhlipla.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmgmonma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ehmibdol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhoncm32.dll"	Lgibjj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjhfgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Npabeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nekfnbbc.dll"	Ceehcc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dkgqpaed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dffmogji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebgpkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkeehp32.dll"	Dcjfpfnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djmcgllb.dll"	Aklmjfad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlmlbdad.dll"	Aohbbqme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iempingp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Igomeb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pomgcc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aklmjfad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mllabgnk.dll"	Ekkkip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ehmibdol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nndnocba.dll"	Fjoadbbc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnnank32.dll"	Ojopki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqbfnnhd.dll"	Oggjni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdqkap32.dll"	Hfodnd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omdpio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oqmhlego.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckcaap32.dll"	Pebfen32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjmkhkff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhllpk32.dll"	Adiknkco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kiikkada.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hdhemn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbeece32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngeaej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Poagma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbgibgpf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcnbekok.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfjgbapo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cikomogf.dll"	Gaadpqmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dapeapja.dll"	Cpglgmfa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljffccjh.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 4344	1332	0aaf84187c78a0204a05a9cf5a31b1c5.exe	94
PID 1332 wrote to memory of 4344	1332	0aaf84187c78a0204a05a9cf5a31b1c5.exe	94
PID 1332 wrote to memory of 4344	1332	0aaf84187c78a0204a05a9cf5a31b1c5.exe	94
PID 4344 wrote to memory of 468	4344	Pmjhlklg.exe	95
PID 4344 wrote to memory of 468	4344	Pmjhlklg.exe	95
PID 4344 wrote to memory of 468	4344	Pmjhlklg.exe	95
PID 468 wrote to memory of 2520	468	Acdioc32.exe	96
PID 468 wrote to memory of 2520	468	Acdioc32.exe	96
PID 468 wrote to memory of 2520	468	Acdioc32.exe	96
PID 2520 wrote to memory of 1012	2520	Bcnleb32.exe	97
PID 2520 wrote to memory of 1012	2520	Bcnleb32.exe	97
PID 2520 wrote to memory of 1012	2520	Bcnleb32.exe	97
PID 1012 wrote to memory of 3848	1012	Cmpcdfll.exe	98
PID 1012 wrote to memory of 3848	1012	Cmpcdfll.exe	98
PID 1012 wrote to memory of 3848	1012	Cmpcdfll.exe	98
PID 3848 wrote to memory of 1260	3848	Clgmkbna.exe	99
PID 3848 wrote to memory of 1260	3848	Clgmkbna.exe	99
PID 3848 wrote to memory of 1260	3848	Clgmkbna.exe	99
PID 1260 wrote to memory of 3128	1260	Eennefib.exe	100
PID 1260 wrote to memory of 3128	1260	Eennefib.exe	100
PID 1260 wrote to memory of 3128	1260	Eennefib.exe	100
PID 3128 wrote to memory of 1120	3128	Eegqldqg.exe	101
PID 3128 wrote to memory of 1120	3128	Eegqldqg.exe	101
PID 3128 wrote to memory of 1120	3128	Eegqldqg.exe	101
PID 1120 wrote to memory of 3368	1120	Fpoaom32.exe	102
PID 1120 wrote to memory of 3368	1120	Fpoaom32.exe	102
PID 1120 wrote to memory of 3368	1120	Fpoaom32.exe	102
PID 3368 wrote to memory of 2360	3368	Ffnglc32.exe	103
PID 3368 wrote to memory of 2360	3368	Ffnglc32.exe	103
PID 3368 wrote to memory of 2360	3368	Ffnglc32.exe	103
PID 2360 wrote to memory of 1736	2360	Gjnlha32.exe	104
PID 2360 wrote to memory of 1736	2360	Gjnlha32.exe	104
PID 2360 wrote to memory of 1736	2360	Gjnlha32.exe	104
PID 1736 wrote to memory of 3528	1736	Gfemmb32.exe	105
PID 1736 wrote to memory of 3528	1736	Gfemmb32.exe	105
PID 1736 wrote to memory of 3528	1736	Gfemmb32.exe	105
PID 3528 wrote to memory of 4392	3528	Gckjlf32.exe	106
PID 3528 wrote to memory of 4392	3528	Gckjlf32.exe	106
PID 3528 wrote to memory of 4392	3528	Gckjlf32.exe	106
PID 4392 wrote to memory of 1828	4392	Hfamia32.exe	107
PID 4392 wrote to memory of 1828	4392	Hfamia32.exe	107
PID 4392 wrote to memory of 1828	4392	Hfamia32.exe	107
PID 1828 wrote to memory of 3456	1828	Hnokjm32.exe	108
PID 1828 wrote to memory of 3456	1828	Hnokjm32.exe	108
PID 1828 wrote to memory of 3456	1828	Hnokjm32.exe	108
PID 3456 wrote to memory of 4636	3456	Igneda32.exe	109
PID 3456 wrote to memory of 4636	3456	Igneda32.exe	109
PID 3456 wrote to memory of 4636	3456	Igneda32.exe	109
PID 4636 wrote to memory of 4916	4636	Jcoioabf.exe	110
PID 4636 wrote to memory of 4916	4636	Jcoioabf.exe	110
PID 4636 wrote to memory of 4916	4636	Jcoioabf.exe	110
PID 4916 wrote to memory of 732	4916	Kceoppmo.exe	111
PID 4916 wrote to memory of 732	4916	Kceoppmo.exe	111
PID 4916 wrote to memory of 732	4916	Kceoppmo.exe	111
PID 732 wrote to memory of 4200	732	Ldanloba.exe	112
PID 732 wrote to memory of 4200	732	Ldanloba.exe	112
PID 732 wrote to memory of 4200	732	Ldanloba.exe	112
PID 4200 wrote to memory of 2280	4200	Laeoec32.exe	113
PID 4200 wrote to memory of 2280	4200	Laeoec32.exe	113
PID 4200 wrote to memory of 2280	4200	Laeoec32.exe	113
PID 2280 wrote to memory of 5068	2280	Mgbpdgap.exe	114
PID 2280 wrote to memory of 5068	2280	Mgbpdgap.exe	114
PID 2280 wrote to memory of 5068	2280	Mgbpdgap.exe	114
PID 5068 wrote to memory of 4384	5068	Ohbfeh32.exe	115

C:\Users\Admin\AppData\Local\Temp\0aaf84187c78a0204a05a9cf5a31b1c5.exe
"C:\Users\Admin\AppData\Local\Temp\0aaf84187c78a0204a05a9cf5a31b1c5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\SysWOW64\Pmjhlklg.exe
  C:\Windows\system32\Pmjhlklg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\SysWOW64\Acdioc32.exe
    C:\Windows\system32\Acdioc32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:468
  - - C:\Windows\SysWOW64\Bcnleb32.exe
      C:\Windows\system32\Bcnleb32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2520
    - - C:\Windows\SysWOW64\Cmpcdfll.exe
        
        C:\Windows\system32\Cmpcdfll.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1012
      - C:\Windows\SysWOW64\Clgmkbna.exe
        
        C:\Windows\system32\Clgmkbna.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3848
        
        C:\Windows\SysWOW64\Eennefib.exe
        
        C:\Windows\system32\Eennefib.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1260
        
        C:\Windows\SysWOW64\Eegqldqg.exe
        
        C:\Windows\system32\Eegqldqg.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3128
        
        C:\Windows\SysWOW64\Fpoaom32.exe
        
        C:\Windows\system32\Fpoaom32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1120
        
        C:\Windows\SysWOW64\Ffnglc32.exe
        
        C:\Windows\system32\Ffnglc32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3368
        
        C:\Windows\SysWOW64\Gjnlha32.exe
        
        C:\Windows\system32\Gjnlha32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2360
        
        C:\Windows\SysWOW64\Gfemmb32.exe
        
        C:\Windows\system32\Gfemmb32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1736
        
        C:\Windows\SysWOW64\Gckjlf32.exe
        
        C:\Windows\system32\Gckjlf32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3528
        
        C:\Windows\SysWOW64\Hfamia32.exe
        
        C:\Windows\system32\Hfamia32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4392
        
        C:\Windows\SysWOW64\Hnokjm32.exe
        
        C:\Windows\system32\Hnokjm32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1828
        
        C:\Windows\SysWOW64\Igneda32.exe
        
        C:\Windows\system32\Igneda32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\SysWOW64\Jcoioabf.exe
        
        C:\Windows\system32\Jcoioabf.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4636
        
        C:\Windows\SysWOW64\Kceoppmo.exe
        
        C:\Windows\system32\Kceoppmo.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Windows\SysWOW64\Ldanloba.exe
        
        C:\Windows\system32\Ldanloba.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:732
        
        C:\Windows\SysWOW64\Laeoec32.exe
        
        C:\Windows\system32\Laeoec32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4200
        
        C:\Windows\SysWOW64\Mgbpdgap.exe
        
        C:\Windows\system32\Mgbpdgap.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2280
        
        C:\Windows\SysWOW64\Ohbfeh32.exe
        
        C:\Windows\system32\Ohbfeh32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Windows\SysWOW64\Poagma32.exe
        
        C:\Windows\system32\Poagma32.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4384
        
        C:\Windows\SysWOW64\Pfmlok32.exe
        
        C:\Windows\system32\Pfmlok32.exe
        24⤵
        Executes dropped EXE
        
        PID:1696
        
        C:\Windows\SysWOW64\Akjnnpcf.exe
        
        C:\Windows\system32\Akjnnpcf.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3248
        
        C:\Windows\SysWOW64\Ceehcc32.exe
        
        C:\Windows\system32\Ceehcc32.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2760
        
        C:\Windows\SysWOW64\Deagoa32.exe
        
        C:\Windows\system32\Deagoa32.exe
        27⤵
        Executes dropped EXE
        
        PID:5012
        
        C:\Windows\SysWOW64\Didjqoae.exe
        
        C:\Windows\system32\Didjqoae.exe
        28⤵
        Executes dropped EXE
        
        PID:852
        
        C:\Windows\SysWOW64\Elnehifk.exe
        
        C:\Windows\system32\Elnehifk.exe
        29⤵
        Executes dropped EXE
        
        PID:4532
        
        C:\Windows\SysWOW64\Fgcjea32.exe
        
        C:\Windows\system32\Fgcjea32.exe
        30⤵
        Executes dropped EXE
        
        PID:1524
        
        C:\Windows\SysWOW64\Fikihlmj.exe
        
        C:\Windows\system32\Fikihlmj.exe
        31⤵
        Executes dropped EXE
        
        PID:1832
        
        C:\Windows\SysWOW64\Gegchl32.exe
        
        C:\Windows\system32\Gegchl32.exe
        32⤵
        Executes dropped EXE
        
        PID:1804
        
        C:\Windows\SysWOW64\Glqkefff.exe
        
        C:\Windows\system32\Glqkefff.exe
        33⤵
        Executes dropped EXE
        
        PID:2224
        
        C:\Windows\SysWOW64\Hpaqqdjj.exe
        
        C:\Windows\system32\Hpaqqdjj.exe
        34⤵
        Executes dropped EXE
        
        PID:3548
        
        C:\Windows\SysWOW64\Hfniikha.exe
        
        C:\Windows\system32\Hfniikha.exe
        35⤵
        Executes dropped EXE
        
        PID:2964
        
        C:\Windows\SysWOW64\Hhehkepj.exe
        
        C:\Windows\system32\Hhehkepj.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4444
        
        C:\Windows\SysWOW64\Ijjnpg32.exe
        
        C:\Windows\system32\Ijjnpg32.exe
        37⤵
        Executes dropped EXE
        
        PID:2500
        
        C:\Windows\SysWOW64\Jcihjl32.exe
        
        C:\Windows\system32\Jcihjl32.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1744
        
        C:\Windows\SysWOW64\Jmamba32.exe
        
        C:\Windows\system32\Jmamba32.exe
        39⤵
        Executes dropped EXE
        
        PID:400
        
        C:\Windows\SysWOW64\Jcnbekok.exe
        
        C:\Windows\system32\Jcnbekok.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3608
        
        C:\Windows\SysWOW64\Kimgba32.exe
        
        C:\Windows\system32\Kimgba32.exe
        41⤵
        Executes dropped EXE
        
        PID:1060
        
        C:\Windows\SysWOW64\Kjopbd32.exe
        
        C:\Windows\system32\Kjopbd32.exe
        42⤵
        Executes dropped EXE
        
        PID:3780
        
        C:\Windows\SysWOW64\Ljffccjh.exe
        
        C:\Windows\system32\Ljffccjh.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5076
        
        C:\Windows\SysWOW64\Lglcag32.exe
        
        C:\Windows\system32\Lglcag32.exe
        44⤵
        Executes dropped EXE
        
        PID:3800
        
        C:\Windows\SysWOW64\Mfomda32.exe
        
        C:\Windows\system32\Mfomda32.exe
        45⤵
        Executes dropped EXE
        
        PID:2812
        
        C:\Windows\SysWOW64\Naqqmieo.exe
        
        C:\Windows\system32\Naqqmieo.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4084
        
        C:\Windows\SysWOW64\Okpkgm32.exe
        
        C:\Windows\system32\Okpkgm32.exe
        47⤵
        Executes dropped EXE
        
        PID:3208
        
        C:\Windows\SysWOW64\Paomog32.exe
        
        C:\Windows\system32\Paomog32.exe
        48⤵
        Executes dropped EXE
        
        PID:4764
        
        C:\Windows\SysWOW64\Qjcdih32.exe
        
        C:\Windows\system32\Qjcdih32.exe
        49⤵
        Executes dropped EXE
        
        PID:3784
        
        C:\Windows\SysWOW64\Qhddgofo.exe
        
        C:\Windows\system32\Qhddgofo.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4940
        
        C:\Windows\SysWOW64\Ajjjjghg.exe
        
        C:\Windows\system32\Ajjjjghg.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1772
        
        C:\Windows\SysWOW64\Anjpeelk.exe
        
        C:\Windows\system32\Anjpeelk.exe
        52⤵
        Executes dropped EXE
        
        PID:4192
        
        C:\Windows\SysWOW64\Bkcjjhgp.exe
        
        C:\Windows\system32\Bkcjjhgp.exe
        53⤵
        Executes dropped EXE
        
        PID:2372
        
        C:\Windows\SysWOW64\Bndblcdq.exe
        
        C:\Windows\system32\Bndblcdq.exe
        54⤵
        Executes dropped EXE
        
        PID:4900
        
        C:\Windows\SysWOW64\Cnhlgc32.exe
        
        C:\Windows\system32\Cnhlgc32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:320
        
        C:\Windows\SysWOW64\Dabhomea.exe
        
        C:\Windows\system32\Dabhomea.exe
        56⤵
        Executes dropped EXE
        
        PID:1660
        
        C:\Windows\SysWOW64\Dagajlal.exe
        
        C:\Windows\system32\Dagajlal.exe
        57⤵
        Executes dropped EXE
        
        PID:2920
        
        C:\Windows\SysWOW64\Ehhpge32.exe
        
        C:\Windows\system32\Ehhpge32.exe
        58⤵
        Executes dropped EXE
        
        PID:2184
        
        C:\Windows\SysWOW64\Ehmibdol.exe
        
        C:\Windows\system32\Ehmibdol.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1620
        
        C:\Windows\SysWOW64\Fiheheka.exe
        
        C:\Windows\system32\Fiheheka.exe
        60⤵
        Executes dropped EXE
        
        PID:1652
        
        C:\Windows\SysWOW64\Ghpooanf.exe
        
        C:\Windows\system32\Ghpooanf.exe
        61⤵
        Executes dropped EXE
        
        PID:4816
        
        C:\Windows\SysWOW64\Gojgkl32.exe
        
        C:\Windows\system32\Gojgkl32.exe
        62⤵
        Executes dropped EXE
        
        PID:2020
        
        C:\Windows\SysWOW64\Hembndee.exe
        
        C:\Windows\system32\Hembndee.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:496
        
        C:\Windows\SysWOW64\Iameid32.exe
        
        C:\Windows\system32\Iameid32.exe
        64⤵
        Executes dropped EXE
        
        PID:3320
        
        C:\Windows\SysWOW64\Ihgnfnjl.exe
        
        C:\Windows\system32\Ihgnfnjl.exe
        65⤵
        Executes dropped EXE
        
        PID:2148
        
        C:\Windows\SysWOW64\Ikejbjip.exe
        
        C:\Windows\system32\Ikejbjip.exe
        66⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\Ieknpb32.exe
        
        C:\Windows\system32\Ieknpb32.exe
        67⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\Ikhghi32.exe
        
        C:\Windows\system32\Ikhghi32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1240
        
        C:\Windows\SysWOW64\Iohlcg32.exe
        
        C:\Windows\system32\Iohlcg32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4560
        
        C:\Windows\SysWOW64\Jbghpc32.exe
        
        C:\Windows\system32\Jbghpc32.exe
        70⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\Jhqqlmba.exe
        
        C:\Windows\system32\Jhqqlmba.exe
        71⤵
        
        PID:868
        
        C:\Windows\SysWOW64\Kcikfcab.exe
        
        C:\Windows\system32\Kcikfcab.exe
        72⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\Lcdjba32.exe
        
        C:\Windows\system32\Lcdjba32.exe
        73⤵
        Modifies registry class
        
        PID:1140
        
        C:\Windows\SysWOW64\Ljoboloa.exe
        
        C:\Windows\system32\Ljoboloa.exe
        74⤵
        
        PID:700
        
        C:\Windows\SysWOW64\Miflehaf.exe
        
        C:\Windows\system32\Miflehaf.exe
        75⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\Mikepg32.exe
        
        C:\Windows\system32\Mikepg32.exe
        76⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\Mcpjnp32.exe
        
        C:\Windows\system32\Mcpjnp32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1180
        
        C:\Windows\SysWOW64\Ncecioib.exe
        
        C:\Windows\system32\Ncecioib.exe
        78⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Njceqili.exe
        
        C:\Windows\system32\Njceqili.exe
        79⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\Ndliin32.exe
        
        C:\Windows\system32\Ndliin32.exe
        80⤵
        Drops file in System32 directory
        
        PID:1780
        
        C:\Windows\SysWOW64\Omdnbd32.exe
        
        C:\Windows\system32\Omdnbd32.exe
        81⤵
        
        PID:656
        
        C:\Windows\SysWOW64\Ofmbkipk.exe
        
        C:\Windows\system32\Ofmbkipk.exe
        82⤵
        
        PID:472
        
        C:\Windows\SysWOW64\Oljkcpnb.exe
        
        C:\Windows\system32\Oljkcpnb.exe
        83⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Opgciodi.exe
        
        C:\Windows\system32\Opgciodi.exe
        84⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\Ojmgggdo.exe
        
        C:\Windows\system32\Ojmgggdo.exe
        85⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\Olndnp32.exe
        
        C:\Windows\system32\Olndnp32.exe
        86⤵
        
        PID:352
        
        C:\Windows\SysWOW64\Oibdhd32.exe
        
        C:\Windows\system32\Oibdhd32.exe
        87⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\Pmpmnb32.exe
        
        C:\Windows\system32\Pmpmnb32.exe
        88⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\Pmefiakh.exe
        
        C:\Windows\system32\Pmefiakh.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2472
        
        C:\Windows\SysWOW64\Qlajkm32.exe
        
        C:\Windows\system32\Qlajkm32.exe
        90⤵
        
        PID:644
        
        C:\Windows\SysWOW64\Akbjidbf.exe
        
        C:\Windows\system32\Akbjidbf.exe
        91⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\Akkmocjl.exe
        
        C:\Windows\system32\Akkmocjl.exe
        92⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\Bkepeaaa.exe
        
        C:\Windows\system32\Bkepeaaa.exe
        93⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Ccbaoc32.exe
        
        C:\Windows\system32\Ccbaoc32.exe
        94⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Cmmbmiag.exe
        
        C:\Windows\system32\Cmmbmiag.exe
        95⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Cjabgm32.exe
        
        C:\Windows\system32\Cjabgm32.exe
        96⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Dmfecgim.exe
        
        C:\Windows\system32\Dmfecgim.exe
        97⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Djalnkbo.exe
        
        C:\Windows\system32\Djalnkbo.exe
        98⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Fchlhnlo.exe
        
        C:\Windows\system32\Fchlhnlo.exe
        99⤵
        Drops file in System32 directory
        
        PID:5448
        
        C:\Windows\SysWOW64\Falmabki.exe
        
        C:\Windows\system32\Falmabki.exe
        100⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Fhjoilop.exe
        
        C:\Windows\system32\Fhjoilop.exe
        101⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Gmggac32.exe
        
        C:\Windows\system32\Gmggac32.exe
        102⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Ghmkol32.exe
        
        C:\Windows\system32\Ghmkol32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5668
        
        C:\Windows\SysWOW64\Galfhpmf.exe
        
        C:\Windows\system32\Galfhpmf.exe
        104⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Glajeiml.exe
        
        C:\Windows\system32\Glajeiml.exe
        105⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Hopfadlp.exe
        
        C:\Windows\system32\Hopfadlp.exe
        106⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Hldgkiki.exe
        
        C:\Windows\system32\Hldgkiki.exe
        107⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Helkdnaj.exe
        
        C:\Windows\system32\Helkdnaj.exe
        108⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Heohinog.exe
        
        C:\Windows\system32\Heohinog.exe
        109⤵
        Drops file in System32 directory
        
        PID:5964
        
        C:\Windows\SysWOW64\Hlkmlhea.exe
        
        C:\Windows\system32\Hlkmlhea.exe
        110⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Hmlicp32.exe
        
        C:\Windows\system32\Hmlicp32.exe
        111⤵
        Drops file in System32 directory
        
        PID:6052
        
        C:\Windows\SysWOW64\Hhbnqi32.exe
        
        C:\Windows\system32\Hhbnqi32.exe
        112⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Imofip32.exe
        
        C:\Windows\system32\Imofip32.exe
        113⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\Jolodqcp.exe
        
        C:\Windows\system32\Jolodqcp.exe
        114⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Jekpljgg.exe
        
        C:\Windows\system32\Jekpljgg.exe
        115⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Klgend32.exe
        
        C:\Windows\system32\Klgend32.exe
        116⤵
        Drops file in System32 directory
        
        PID:4452
        
        C:\Windows\SysWOW64\Klnkoc32.exe
        
        C:\Windows\system32\Klnkoc32.exe
        117⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Kffphhmj.exe
        
        C:\Windows\system32\Kffphhmj.exe
        118⤵
        
        PID:1268
        
        C:\Windows\SysWOW64\Lhgiic32.exe
        
        C:\Windows\system32\Lhgiic32.exe
        119⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Lilbdcfe.exe
        
        C:\Windows\system32\Lilbdcfe.exe
        120⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Lohggm32.exe
        
        C:\Windows\system32\Lohggm32.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5552
        
        C:\Windows\SysWOW64\Mmlhpaji.exe
        
        C:\Windows\system32\Mmlhpaji.exe
        122⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Mnndhi32.exe
        
        C:\Windows\system32\Mnndhi32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5648
        
        C:\Windows\SysWOW64\Mbnjcg32.exe
        
        C:\Windows\system32\Mbnjcg32.exe
        124⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Mndjhhjp.exe
        
        C:\Windows\system32\Mndjhhjp.exe
        125⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Mkhkblii.exe
        
        C:\Windows\system32\Mkhkblii.exe
        126⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Nfchjddj.exe
        
        C:\Windows\system32\Nfchjddj.exe
        127⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Nnnmogae.exe
        
        C:\Windows\system32\Nnnmogae.exe
        128⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Nehekq32.exe
        
        C:\Windows\system32\Nehekq32.exe
        129⤵
        Modifies registry class
        
        PID:6000
        
        C:\Windows\SysWOW64\Olfgcj32.exe
        
        C:\Windows\system32\Olfgcj32.exe
        130⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Obcled32.exe
        
        C:\Windows\system32\Obcled32.exe
        131⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\Omhpcm32.exe
        
        C:\Windows\system32\Omhpcm32.exe
        132⤵
        Modifies registry class
        
        PID:3216
        
        C:\Windows\SysWOW64\Omkmhlpf.exe
        
        C:\Windows\system32\Omkmhlpf.exe
        133⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\Ponfed32.exe
        
        C:\Windows\system32\Ponfed32.exe
        134⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Pidjcm32.exe
        
        C:\Windows\system32\Pidjcm32.exe
        135⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\Pblolb32.exe
        
        C:\Windows\system32\Pblolb32.exe
        136⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Pfjgbapo.exe
        
        C:\Windows\system32\Pfjgbapo.exe
        137⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5352
        
        C:\Windows\SysWOW64\Plgpjhnf.exe
        
        C:\Windows\system32\Plgpjhnf.exe
        138⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Pfmdgq32.exe
        
        C:\Windows\system32\Pfmdgq32.exe
        139⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\Pmfldkei.exe
        
        C:\Windows\system32\Pmfldkei.exe
        140⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\Pfoamp32.exe
        
        C:\Windows\system32\Pfoamp32.exe
        141⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Pmiijjcf.exe
        
        C:\Windows\system32\Pmiijjcf.exe
        142⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Qojeabie.exe
        
        C:\Windows\system32\Qojeabie.exe
        143⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Qednnm32.exe
        
        C:\Windows\system32\Qednnm32.exe
        144⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Qpibke32.exe
        
        C:\Windows\system32\Qpibke32.exe
        145⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Qfcjhphd.exe
        
        C:\Windows\system32\Qfcjhphd.exe
        146⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Aploae32.exe
        
        C:\Windows\system32\Aploae32.exe
        147⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Aoalba32.exe
        
        C:\Windows\system32\Aoalba32.exe
        148⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Acaanp32.exe
        
        C:\Windows\system32\Acaanp32.exe
        149⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\Aohbbqme.exe
        
        C:\Windows\system32\Aohbbqme.exe
        150⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:832
        
        C:\Windows\SysWOW64\Bpjkbcbe.exe
        
        C:\Windows\system32\Bpjkbcbe.exe
        151⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Bckddn32.exe
        
        C:\Windows\system32\Bckddn32.exe
        152⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\Cnealfkf.exe
        
        C:\Windows\system32\Cnealfkf.exe
        153⤵
        Modifies registry class
        
        PID:5424
        
        C:\Windows\SysWOW64\Cjlbag32.exe
        
        C:\Windows\system32\Cjlbag32.exe
        154⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Cohkinob.exe
        
        C:\Windows\system32\Cohkinob.exe
        155⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\Cokgonmp.exe
        
        C:\Windows\system32\Cokgonmp.exe
        156⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Cnndbecl.exe
        
        C:\Windows\system32\Cnndbecl.exe
        157⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Cfiiggpg.exe
        
        C:\Windows\system32\Cfiiggpg.exe
        158⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Dqajjp32.exe
        
        C:\Windows\system32\Dqajjp32.exe
        159⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Dnhgidka.exe
        
        C:\Windows\system32\Dnhgidka.exe
        160⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\Dgplai32.exe
        
        C:\Windows\system32\Dgplai32.exe
        161⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Ejaecdnc.exe
        
        C:\Windows\system32\Ejaecdnc.exe
        162⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\Eopjakkg.exe
        
        C:\Windows\system32\Eopjakkg.exe
        163⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\Efjbne32.exe
        
        C:\Windows\system32\Efjbne32.exe
        164⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\Fjldocde.exe
        
        C:\Windows\system32\Fjldocde.exe
        165⤵
        
        PID:1696
        
        C:\Windows\SysWOW64\Fjoadbbc.exe
        
        C:\Windows\system32\Fjoadbbc.exe
        166⤵
        Modifies registry class
        
        PID:5932
        
        C:\Windows\SysWOW64\Fanbll32.exe
        
        C:\Windows\system32\Fanbll32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3820
        
        C:\Windows\SysWOW64\Gfmhjb32.exe
        
        C:\Windows\system32\Gfmhjb32.exe
        168⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Gagebknp.exe
        
        C:\Windows\system32\Gagebknp.exe
        169⤵
        
        PID:3224
        
        C:\Windows\SysWOW64\Habeni32.exe
        
        C:\Windows\system32\Habeni32.exe
        170⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\Hdaajd32.exe
        
        C:\Windows\system32\Hdaajd32.exe
        171⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\Hmifcjif.exe
        
        C:\Windows\system32\Hmifcjif.exe
        172⤵
        
        PID:408
        
        C:\Windows\SysWOW64\Hmlbij32.exe
        
        C:\Windows\system32\Hmlbij32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3684
        
        C:\Windows\SysWOW64\Ifipmo32.exe
        
        C:\Windows\system32\Ifipmo32.exe
        174⤵
        Drops file in System32 directory
        
        PID:4200
        
        C:\Windows\SysWOW64\Iodaikfl.exe
        
        C:\Windows\system32\Iodaikfl.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2236
        
        C:\Windows\SysWOW64\Koekpi32.exe
        
        C:\Windows\system32\Koekpi32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2352
        
        C:\Windows\SysWOW64\Kolaqh32.exe
        
        C:\Windows\system32\Kolaqh32.exe
        177⤵
        Drops file in System32 directory
        
        PID:2380
        
        C:\Windows\SysWOW64\Lajmmc32.exe
        
        C:\Windows\system32\Lajmmc32.exe
        178⤵
        Modifies registry class
        
        PID:1368
        
        C:\Windows\SysWOW64\Lggeej32.exe
        
        C:\Windows\system32\Lggeej32.exe
        179⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\Lonnfg32.exe
        
        C:\Windows\system32\Lonnfg32.exe
        180⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\Lgibjj32.exe
        
        C:\Windows\system32\Lgibjj32.exe
        181⤵
        Modifies registry class
        
        PID:4444
        
        C:\Windows\SysWOW64\Ldnbdnlc.exe
        
        C:\Windows\system32\Ldnbdnlc.exe
        182⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\Lkgkqh32.exe
        
        C:\Windows\system32\Lkgkqh32.exe
        183⤵
        Drops file in System32 directory
        
        PID:5024
        
        C:\Windows\SysWOW64\Lqdcio32.exe
        
        C:\Windows\system32\Lqdcio32.exe
        184⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\Loecgfjf.exe
        
        C:\Windows\system32\Loecgfjf.exe
        185⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Lhnhplpg.exe
        
        C:\Windows\system32\Lhnhplpg.exe
        186⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Mnjqhcno.exe
        
        C:\Windows\system32\Mnjqhcno.exe
        187⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\Mgceqh32.exe
        
        C:\Windows\system32\Mgceqh32.exe
        188⤵
        Drops file in System32 directory
        
        PID:1548
        
        C:\Windows\SysWOW64\Mkangg32.exe
        
        C:\Windows\system32\Mkangg32.exe
        189⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Mggolhaj.exe
        
        C:\Windows\system32\Mggolhaj.exe
        190⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\Mbmbiqqp.exe
        
        C:\Windows\system32\Mbmbiqqp.exe
        191⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\Mbpoop32.exe
        
        C:\Windows\system32\Mbpoop32.exe
        192⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\Nildajdg.exe
        
        C:\Windows\system32\Nildajdg.exe
        193⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\Nnimia32.exe
        
        C:\Windows\system32\Nnimia32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1120
        
        C:\Windows\SysWOW64\Nkmmbe32.exe
        
        C:\Windows\system32\Nkmmbe32.exe
        195⤵
        
        PID:380
        
        C:\Windows\SysWOW64\Niqnli32.exe
        
        C:\Windows\system32\Niqnli32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2068
        
        C:\Windows\SysWOW64\Nqnofkkj.exe
        
        C:\Windows\system32\Nqnofkkj.exe
        197⤵
        
        PID:3640
        
        C:\Windows\SysWOW64\Oelhljaq.exe
        
        C:\Windows\system32\Oelhljaq.exe
        198⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Ooalibaf.exe
        
        C:\Windows\system32\Ooalibaf.exe
        199⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Okhmnc32.exe
        
        C:\Windows\system32\Okhmnc32.exe
        200⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\Obbekn32.exe
        
        C:\Windows\system32\Obbekn32.exe
        201⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Ogoncd32.exe
        
        C:\Windows\system32\Ogoncd32.exe
        202⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\Obdbqm32.exe
        
        C:\Windows\system32\Obdbqm32.exe
        203⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Olmficce.exe
        
        C:\Windows\system32\Olmficce.exe
        204⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\Panhmi32.exe
        
        C:\Windows\system32\Panhmi32.exe
        205⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\Pijiif32.exe
        
        C:\Windows\system32\Pijiif32.exe
        206⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\Qbekgknb.exe
        
        C:\Windows\system32\Qbekgknb.exe
        207⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\Qiocde32.exe
        
        C:\Windows\system32\Qiocde32.exe
        208⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\Qnlkllcf.exe
        
        C:\Windows\system32\Qnlkllcf.exe
        209⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Aefcif32.exe
        
        C:\Windows\system32\Aefcif32.exe
        210⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Alplfpbp.exe
        
        C:\Windows\system32\Alplfpbp.exe
        211⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Aaldngqg.exe
        
        C:\Windows\system32\Aaldngqg.exe
        212⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Bafgdfim.exe
        
        C:\Windows\system32\Bafgdfim.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6364
        
        C:\Windows\SysWOW64\Bhppap32.exe
        
        C:\Windows\system32\Bhppap32.exe
        214⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Bahdje32.exe
        
        C:\Windows\system32\Bahdje32.exe
        215⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Bhblfpng.exe
        
        C:\Windows\system32\Bhblfpng.exe
        216⤵
        Drops file in System32 directory
        
        PID:6544
        
        C:\Windows\SysWOW64\Bidefbcg.exe
        
        C:\Windows\system32\Bidefbcg.exe
        217⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Bppjhl32.exe
        
        C:\Windows\system32\Bppjhl32.exe
        218⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Dcjfpfnh.exe
        
        C:\Windows\system32\Dcjfpfnh.exe
        219⤵
        Modifies registry class
        
        PID:6728
        
        C:\Windows\SysWOW64\Dadlmanj.exe
        
        C:\Windows\system32\Dadlmanj.exe
        220⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Dpemjifi.exe
        
        C:\Windows\system32\Dpemjifi.exe
        221⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Dagiba32.exe
        
        C:\Windows\system32\Dagiba32.exe
        222⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Dllmoj32.exe
        
        C:\Windows\system32\Dllmoj32.exe
        223⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Ecfeldcj.exe
        
        C:\Windows\system32\Ecfeldcj.exe
        224⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Ehjdejkj.exe
        
        C:\Windows\system32\Ehjdejkj.exe
        225⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Ecphbckp.exe
        
        C:\Windows\system32\Ecphbckp.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7068
        
        C:\Windows\SysWOW64\Fjnjjlog.exe
        
        C:\Windows\system32\Fjnjjlog.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7104
        
        C:\Windows\SysWOW64\Fcfocb32.exe
        
        C:\Windows\system32\Fcfocb32.exe
        228⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Gijmlh32.exe
        
        C:\Windows\system32\Gijmlh32.exe
        229⤵
        Drops file in System32 directory
        
        PID:6168
        
        C:\Windows\SysWOW64\Gmhfbf32.exe
        
        C:\Windows\system32\Gmhfbf32.exe
        230⤵
        Drops file in System32 directory
        
        PID:6260
        
        C:\Windows\SysWOW64\Gbenjm32.exe
        
        C:\Windows\system32\Gbenjm32.exe
        231⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Gjocaj32.exe
        
        C:\Windows\system32\Gjocaj32.exe
        232⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\Hjhfgi32.exe
        
        C:\Windows\system32\Hjhfgi32.exe
        233⤵
        Modifies registry class
        
        PID:6444
        
        C:\Windows\SysWOW64\Hbcklkee.exe
        
        C:\Windows\system32\Hbcklkee.exe
        234⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\Ipihkobl.exe
        
        C:\Windows\system32\Ipihkobl.exe
        235⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Ijcecgnl.exe
        
        C:\Windows\system32\Ijcecgnl.exe
        236⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Ipqnknld.exe
        
        C:\Windows\system32\Ipqnknld.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1456
        
        C:\Windows\SysWOW64\Ifjfhh32.exe
        
        C:\Windows\system32\Ifjfhh32.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6716
        
        C:\Windows\SysWOW64\Idnfal32.exe
        
        C:\Windows\system32\Idnfal32.exe
        239⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\Jikojcaa.exe
        
        C:\Windows\system32\Jikojcaa.exe
        240⤵
        Drops file in System32 directory
        
        PID:6764
        
        C:\Windows\SysWOW64\Jjklcf32.exe
        
        C:\Windows\system32\Jjklcf32.exe
        241⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Jdcplkoe.exe
        
        C:\Windows\system32\Jdcplkoe.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6916
        
        C:\Windows\SysWOW64\Jjmhie32.exe
        
        C:\Windows\system32\Jjmhie32.exe
        243⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Jidbpa32.exe
        
        C:\Windows\system32\Jidbpa32.exe
        244⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Jbmfig32.exe
        
        C:\Windows\system32\Jbmfig32.exe
        245⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Kpagbk32.exe
        
        C:\Windows\system32\Kpagbk32.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2860
        
        C:\Windows\SysWOW64\Kiikkada.exe
        
        C:\Windows\system32\Kiikkada.exe
        247⤵
        Modifies registry class
        
        PID:2292
        
        C:\Windows\SysWOW64\Kgmlde32.exe
        
        C:\Windows\system32\Kgmlde32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6308
        
        C:\Windows\SysWOW64\Kabpan32.exe
        
        C:\Windows\system32\Kabpan32.exe
        249⤵
        Drops file in System32 directory
        
        PID:6356
        
        C:\Windows\SysWOW64\Kgphje32.exe
        
        C:\Windows\system32\Kgphje32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1652
        
        C:\Windows\SysWOW64\Kmiqfoie.exe
        
        C:\Windows\system32\Kmiqfoie.exe
        251⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Kcfiof32.exe
        
        C:\Windows\system32\Kcfiof32.exe
        252⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Kdffiinp.exe
        
        C:\Windows\system32\Kdffiinp.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6524
        
        C:\Windows\SysWOW64\Lmnjan32.exe
        
        C:\Windows\system32\Lmnjan32.exe
        254⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\Lkbkkbdj.exe
        
        C:\Windows\system32\Lkbkkbdj.exe
        255⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Lgikpc32.exe
        
        C:\Windows\system32\Lgikpc32.exe
        256⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Lgnekcei.exe
        
        C:\Windows\system32\Lgnekcei.exe
        257⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\Lpfidh32.exe
        
        C:\Windows\system32\Lpfidh32.exe
        258⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Nbfoeiei.exe
        
        C:\Windows\system32\Nbfoeiei.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6892
        
        C:\Windows\SysWOW64\Nkqpcnig.exe
        
        C:\Windows\system32\Nkqpcnig.exe
        260⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Oqmhlego.exe
        
        C:\Windows\system32\Oqmhlego.exe
        261⤵
        Modifies registry class
        
        PID:7028
        
        C:\Windows\SysWOW64\Obanqgkl.exe
        
        C:\Windows\system32\Obanqgkl.exe
        262⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Oqgkadod.exe
        
        C:\Windows\system32\Oqgkadod.exe
        263⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\Ojopki32.exe
        
        C:\Windows\system32\Ojopki32.exe
        264⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1076
        
        C:\Windows\SysWOW64\Pkaijl32.exe
        
        C:\Windows\system32\Pkaijl32.exe
        265⤵
        
        PID:3168
        
        C:\Windows\SysWOW64\Pkebekgo.exe
        
        C:\Windows\system32\Pkebekgo.exe
        266⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Aaianaoo.exe
        
        C:\Windows\system32\Aaianaoo.exe
        267⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Acmfel32.exe
        
        C:\Windows\system32\Acmfel32.exe
        268⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\Adapqk32.exe
        
        C:\Windows\system32\Adapqk32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4956
        
        C:\Windows\SysWOW64\Bjkhme32.exe
        
        C:\Windows\system32\Bjkhme32.exe
        270⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\Bbgiibja.exe
        
        C:\Windows\system32\Bbgiibja.exe
        271⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Bdhfaj32.exe
        
        C:\Windows\system32\Bdhfaj32.exe
        272⤵
        
        PID:1912
        
        C:\Windows\SysWOW64\Bdkbgj32.exe
        
        C:\Windows\system32\Bdkbgj32.exe
        273⤵
        
        PID:212
        
        C:\Windows\SysWOW64\Bjdkcd32.exe
        
        C:\Windows\system32\Bjdkcd32.exe
        274⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Ckghid32.exe
        
        C:\Windows\system32\Ckghid32.exe
        275⤵
        Drops file in System32 directory
        
        PID:7024
        
        C:\Windows\SysWOW64\Cellfm32.exe
        
        C:\Windows\system32\Cellfm32.exe
        276⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Clfdcgkj.exe
        
        C:\Windows\system32\Clfdcgkj.exe
        277⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\Ceoillaj.exe
        
        C:\Windows\system32\Ceoillaj.exe
        278⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Cliahf32.exe
        
        C:\Windows\system32\Cliahf32.exe
        279⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Cddemi32.exe
        
        C:\Windows\system32\Cddemi32.exe
        280⤵
        
        PID:3700
        
        C:\Windows\SysWOW64\Dhfhnfhc.exe
        
        C:\Windows\system32\Dhfhnfhc.exe
        281⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\Dbllkohi.exe
        
        C:\Windows\system32\Dbllkohi.exe
        282⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Ddmhcg32.exe
        
        C:\Windows\system32\Ddmhcg32.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4992
        
        C:\Windows\SysWOW64\Dkgqpaed.exe
        
        C:\Windows\system32\Dkgqpaed.exe
        284⤵
        Modifies registry class
        
        PID:1216
        
        C:\Windows\SysWOW64\Ddpeigle.exe
        
        C:\Windows\system32\Ddpeigle.exe
        285⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\Dlgmjdlg.exe
        
        C:\Windows\system32\Dlgmjdlg.exe
        286⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\Dcaefo32.exe
        
        C:\Windows\system32\Dcaefo32.exe
        287⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Ehbgjenf.exe
        
        C:\Windows\system32\Ehbgjenf.exe
        288⤵
        Drops file in System32 directory
        
        PID:6828
        
        C:\Windows\SysWOW64\Echkgnnl.exe
        
        C:\Windows\system32\Echkgnnl.exe
        289⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Fchdnkpi.exe
        
        C:\Windows\system32\Fchdnkpi.exe
        290⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Ghjfaa32.exe
        
        C:\Windows\system32\Ghjfaa32.exe
        291⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\Gbbkjgpl.exe
        
        C:\Windows\system32\Gbbkjgpl.exe
        292⤵
        
        PID:656
        
        C:\Windows\SysWOW64\Gcddjiel.exe
        
        C:\Windows\system32\Gcddjiel.exe
        293⤵
        
        PID:5064
        
        C:\Windows\SysWOW64\Iempingp.exe
        
        C:\Windows\system32\Iempingp.exe
        294⤵
        Modifies registry class
        
        PID:6576
        
        C:\Windows\SysWOW64\Jcnpgf32.exe
        
        C:\Windows\system32\Jcnpgf32.exe
        295⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\Jlkaahjg.exe
        
        C:\Windows\system32\Jlkaahjg.exe
        296⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Jfaenqjm.exe
        
        C:\Windows\system32\Jfaenqjm.exe
        297⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Kfjhdobb.exe
        
        C:\Windows\system32\Kfjhdobb.exe
        298⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Podcnh32.exe
        
        C:\Windows\system32\Podcnh32.exe
        244⤵
        
        PID:1560

C:\Windows\SysWOW64\Megdmhbp.exe
C:\Windows\system32\Megdmhbp.exe
1⤵
PID:5408
- C:\Windows\SysWOW64\Mlqljb32.exe
  C:\Windows\system32\Mlqljb32.exe
  2⤵
  PID:7132
- - C:\Windows\SysWOW64\Midmcgif.exe
    C:\Windows\system32\Midmcgif.exe
    3⤵
    PID:1868
  - - C:\Windows\SysWOW64\Meknhh32.exe
      C:\Windows\system32\Meknhh32.exe
      4⤵
      PID:6428
    - - C:\Windows\SysWOW64\Npabeq32.exe
        
        C:\Windows\system32\Npabeq32.exe
        5⤵
        Modifies registry class
        
        PID:6508
      - C:\Windows\SysWOW64\Ngkjbkem.exe
        
        C:\Windows\system32\Ngkjbkem.exe
        6⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Nlhbja32.exe
        
        C:\Windows\system32\Nlhbja32.exe
        7⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Nljopa32.exe
        
        C:\Windows\system32\Nljopa32.exe
        8⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\Olaeqp32.exe
        
        C:\Windows\system32\Olaeqp32.exe
        9⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Oggjni32.exe
        
        C:\Windows\system32\Oggjni32.exe
        10⤵
        Modifies registry class
        
        PID:6532
        
        C:\Windows\SysWOW64\Ojefjd32.exe
        
        C:\Windows\system32\Ojefjd32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:944
        
        C:\Windows\SysWOW64\Ocmjcjad.exe
        
        C:\Windows\system32\Ocmjcjad.exe
        12⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\Oqakln32.exe
        
        C:\Windows\system32\Oqakln32.exe
        13⤵
        Modifies registry class
        
        PID:3124
        
        C:\Windows\SysWOW64\Ofncde32.exe
        
        C:\Windows\system32\Ofncde32.exe
        14⤵
        Drops file in System32 directory
        
        PID:5300
        
        C:\Windows\SysWOW64\Olhlaoea.exe
        
        C:\Windows\system32\Olhlaoea.exe
        15⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Ognpoheh.exe
        
        C:\Windows\system32\Ognpoheh.exe
        16⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Omjhgoco.exe
        
        C:\Windows\system32\Omjhgoco.exe
        17⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Pggbdgmm.exe
        
        C:\Windows\system32\Pggbdgmm.exe
        18⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Pnakaa32.exe
        
        C:\Windows\system32\Pnakaa32.exe
        19⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Pflpfcbe.exe
        
        C:\Windows\system32\Pflpfcbe.exe
        20⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\Pdmpck32.exe
        
        C:\Windows\system32\Pdmpck32.exe
        21⤵
        Drops file in System32 directory
        
        PID:5916
        
        C:\Windows\SysWOW64\Qjjhla32.exe
        
        C:\Windows\system32\Qjjhla32.exe
        22⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Qfaiabnp.exe
        
        C:\Windows\system32\Qfaiabnp.exe
        23⤵
        
        PID:776
        
        C:\Windows\SysWOW64\Aceijg32.exe
        
        C:\Windows\system32\Aceijg32.exe
        24⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Aqijdk32.exe
        
        C:\Windows\system32\Aqijdk32.exe
        25⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Aegbji32.exe
        
        C:\Windows\system32\Aegbji32.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5768
        
        C:\Windows\SysWOW64\Ajckbp32.exe
        
        C:\Windows\system32\Ajckbp32.exe
        27⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\Aclpkffa.exe
        
        C:\Windows\system32\Aclpkffa.exe
        28⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Ajfhhp32.exe
        
        C:\Windows\system32\Ajfhhp32.exe
        29⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Bccfleqi.exe
        
        C:\Windows\system32\Bccfleqi.exe
        30⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\Bffkcp32.exe
        
        C:\Windows\system32\Bffkcp32.exe
        31⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Balpph32.exe
        
        C:\Windows\system32\Balpph32.exe
        32⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\Bhehmbbj.exe
        
        C:\Windows\system32\Bhehmbbj.exe
        33⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\Cfdhdn32.exe
        
        C:\Windows\system32\Cfdhdn32.exe
        34⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Gaadpqmp.exe
        
        C:\Windows\system32\Gaadpqmp.exe
        35⤵
        Modifies registry class
        
        PID:5880
        
        C:\Windows\SysWOW64\Ifihckmi.exe
        
        C:\Windows\system32\Ifihckmi.exe
        36⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\Jpffgp32.exe
        
        C:\Windows\system32\Jpffgp32.exe
        37⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Jgakkb32.exe
        
        C:\Windows\system32\Jgakkb32.exe
        38⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Jnkchmdl.exe
        
        C:\Windows\system32\Jnkchmdl.exe
        39⤵
        
        PID:3044
        
        C:\Windows\SysWOW64\Jeekeg32.exe
        
        C:\Windows\system32\Jeekeg32.exe
        40⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\Jgdhab32.exe
        
        C:\Windows\system32\Jgdhab32.exe
        41⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Kehhjfif.exe
        
        C:\Windows\system32\Kehhjfif.exe
        42⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Knpmcl32.exe
        
        C:\Windows\system32\Knpmcl32.exe
        43⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Khhalafg.exe
        
        C:\Windows\system32\Khhalafg.exe
        44⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Kbneij32.exe
        
        C:\Windows\system32\Kbneij32.exe
        45⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Keonke32.exe
        
        C:\Windows\system32\Keonke32.exe
        46⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Kpdbhn32.exe
        
        C:\Windows\system32\Kpdbhn32.exe
        47⤵
        Modifies registry class
        
        PID:5692
        
        C:\Windows\SysWOW64\Kimgad32.exe
        
        C:\Windows\system32\Kimgad32.exe
        48⤵
        Drops file in System32 directory
        
        PID:184
        
        C:\Windows\SysWOW64\Kpfonnab.exe
        
        C:\Windows\system32\Kpfonnab.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5904
        
        C:\Windows\SysWOW64\Liaqlcep.exe
        
        C:\Windows\system32\Liaqlcep.exe
        50⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Lbnnphhk.exe
        
        C:\Windows\system32\Lbnnphhk.exe
        51⤵
        Drops file in System32 directory
        
        PID:5740
        
        C:\Windows\SysWOW64\Moglkikl.exe
        
        C:\Windows\system32\Moglkikl.exe
        52⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\Nlglpkpi.exe
        
        C:\Windows\system32\Nlglpkpi.exe
        53⤵
        Drops file in System32 directory
        
        PID:828
        
        C:\Windows\SysWOW64\Nbadmege.exe
        
        C:\Windows\system32\Nbadmege.exe
        54⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Niklip32.exe
        
        C:\Windows\system32\Niklip32.exe
        55⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Nohdaf32.exe
        
        C:\Windows\system32\Nohdaf32.exe
        56⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\Nllekk32.exe
        
        C:\Windows\system32\Nllekk32.exe
        57⤵
        
        PID:3684
        
        C:\Windows\SysWOW64\Ncfmhecp.exe
        
        C:\Windows\system32\Ncfmhecp.exe
        58⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Pebfen32.exe
        
        C:\Windows\system32\Pebfen32.exe
        59⤵
        Modifies registry class
        
        PID:5228
        
        C:\Windows\SysWOW64\Pomgcc32.exe
        
        C:\Windows\system32\Pomgcc32.exe
        60⤵
        Modifies registry class
        
        PID:5704
        
        C:\Windows\SysWOW64\Pfgopnbo.exe
        
        C:\Windows\system32\Pfgopnbo.exe
        61⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\Pckpja32.exe
        
        C:\Windows\system32\Pckpja32.exe
        62⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\Pjehflie.exe
        
        C:\Windows\system32\Pjehflie.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1828
        
        C:\Windows\SysWOW64\Aggean32.exe
        
        C:\Windows\system32\Aggean32.exe
        64⤵
        Modifies registry class
        
        PID:3548
        
        C:\Windows\SysWOW64\Aihaifam.exe
        
        C:\Windows\system32\Aihaifam.exe
        65⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Aobieq32.exe
        
        C:\Windows\system32\Aobieq32.exe
        66⤵
        Modifies registry class
        
        PID:1468
        
        C:\Windows\SysWOW64\Bijnnf32.exe
        
        C:\Windows\system32\Bijnnf32.exe
        67⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\Bcpblo32.exe
        
        C:\Windows\system32\Bcpblo32.exe
        68⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\Bimkde32.exe
        
        C:\Windows\system32\Bimkde32.exe
        69⤵
        Drops file in System32 directory
        
        PID:3776
        
        C:\Windows\SysWOW64\Bcboan32.exe
        
        C:\Windows\system32\Bcboan32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5772
        
        C:\Windows\SysWOW64\Biogieke.exe
        
        C:\Windows\system32\Biogieke.exe
        71⤵
        
        PID:936
        
        C:\Windows\SysWOW64\Boipfp32.exe
        
        C:\Windows\system32\Boipfp32.exe
        72⤵
        Modifies registry class
        
        PID:5756
        
        C:\Windows\SysWOW64\Bjodch32.exe
        
        C:\Windows\system32\Bjodch32.exe
        73⤵
        Drops file in System32 directory
        
        PID:2524
        
        C:\Windows\SysWOW64\Bjaqih32.exe
        
        C:\Windows\system32\Bjaqih32.exe
        74⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\Bciebm32.exe
        
        C:\Windows\system32\Bciebm32.exe
        75⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Cmaikcmf.exe
        
        C:\Windows\system32\Cmaikcmf.exe
        76⤵
        
        PID:568
        
        C:\Windows\SysWOW64\Cclagm32.exe
        
        C:\Windows\system32\Cclagm32.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5396
        
        C:\Windows\SysWOW64\Cjejdglp.exe
        
        C:\Windows\system32\Cjejdglp.exe
        78⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Cgijnk32.exe
        
        C:\Windows\system32\Cgijnk32.exe
        79⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Cabofaaj.exe
        
        C:\Windows\system32\Cabofaaj.exe
        80⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\Cfogohpa.exe
        
        C:\Windows\system32\Cfogohpa.exe
        81⤵
        
        PID:380
        
        C:\Windows\SysWOW64\Cpglgmfa.exe
        
        C:\Windows\system32\Cpglgmfa.exe
        82⤵
        Modifies registry class
        
        PID:1044
        
        C:\Windows\SysWOW64\Cfaddg32.exe
        
        C:\Windows\system32\Cfaddg32.exe
        83⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Cafhap32.exe
        
        C:\Windows\system32\Cafhap32.exe
        84⤵
        
        PID:552
        
        C:\Windows\SysWOW64\Dgqqnjea.exe
        
        C:\Windows\system32\Dgqqnjea.exe
        85⤵
        Drops file in System32 directory
        
        PID:5068
        
        C:\Windows\SysWOW64\Daiegp32.exe
        
        C:\Windows\system32\Daiegp32.exe
        86⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Dffmogji.exe
        
        C:\Windows\system32\Dffmogji.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4532
        
        C:\Windows\SysWOW64\Dmpfla32.exe
        
        C:\Windows\system32\Dmpfla32.exe
        88⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\Eipigqop.exe
        
        C:\Windows\system32\Eipigqop.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6160
        
        C:\Windows\SysWOW64\Ejofacfb.exe
        
        C:\Windows\system32\Ejofacfb.exe
        90⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\Ejabgcdp.exe
        
        C:\Windows\system32\Ejabgcdp.exe
        91⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\Ehecpgbi.exe
        
        C:\Windows\system32\Ehecpgbi.exe
        92⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Eigohp32.exe
        
        C:\Windows\system32\Eigohp32.exe
        93⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Fpagdj32.exe
        
        C:\Windows\system32\Fpagdj32.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1600
        
        C:\Windows\SysWOW64\Fkflbb32.exe
        
        C:\Windows\system32\Fkflbb32.exe
        95⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\Fdopkhfk.exe
        
        C:\Windows\system32\Fdopkhfk.exe
        96⤵
        Drops file in System32 directory
        
        PID:4528
        
        C:\Windows\SysWOW64\Fkihgb32.exe
        
        C:\Windows\system32\Fkihgb32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1376
        
        C:\Windows\SysWOW64\Fpeapilo.exe
        
        C:\Windows\system32\Fpeapilo.exe
        98⤵
        Modifies registry class
        
        PID:5888
        
        C:\Windows\SysWOW64\Fkkemble.exe
        
        C:\Windows\system32\Fkkemble.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3652
        
        C:\Windows\SysWOW64\Fdcjfg32.exe
        
        C:\Windows\system32\Fdcjfg32.exe
        100⤵
        
        PID:796
        
        C:\Windows\SysWOW64\Fkmbbajb.exe
        
        C:\Windows\system32\Fkmbbajb.exe
        101⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\Fpjjkh32.exe
        
        C:\Windows\system32\Fpjjkh32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6384
        
        C:\Windows\SysWOW64\Fgdbgbof.exe
        
        C:\Windows\system32\Fgdbgbof.exe
        103⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Gdhcagnp.exe
        
        C:\Windows\system32\Gdhcagnp.exe
        104⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\Gkbkna32.exe
        
        C:\Windows\system32\Gkbkna32.exe
        105⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\Inejlibi.exe
        
        C:\Windows\system32\Inejlibi.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5244
        
        C:\Windows\SysWOW64\Iacbbh32.exe
        
        C:\Windows\system32\Iacbbh32.exe
        107⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Igpkjo32.exe
        
        C:\Windows\system32\Igpkjo32.exe
        108⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\Iddlccfp.exe
        
        C:\Windows\system32\Iddlccfp.exe
        109⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\Jkejalge.exe
        
        C:\Windows\system32\Jkejalge.exe
        110⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Jbobnf32.exe
        
        C:\Windows\system32\Jbobnf32.exe
        111⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\Jgngkmkf.exe
        
        C:\Windows\system32\Jgngkmkf.exe
        112⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\Jnhphg32.exe
        
        C:\Windows\system32\Jnhphg32.exe
        113⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\Jhndepbi.exe
        
        C:\Windows\system32\Jhndepbi.exe
        114⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\Jipqkopf.exe
        
        C:\Windows\system32\Jipqkopf.exe
        115⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Kbkaiddd.exe
        
        C:\Windows\system32\Kbkaiddd.exe
        116⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Kghjakbl.exe
        
        C:\Windows\system32\Kghjakbl.exe
        117⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Knabne32.exe
        
        C:\Windows\system32\Knabne32.exe
        118⤵
        Drops file in System32 directory
        
        PID:2384
        
        C:\Windows\SysWOW64\Kelkkpae.exe
        
        C:\Windows\system32\Kelkkpae.exe
        119⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Kndodehf.exe
        
        C:\Windows\system32\Kndodehf.exe
        120⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Kglcmk32.exe
        
        C:\Windows\system32\Kglcmk32.exe
        121⤵
        Drops file in System32 directory
        
        PID:3964
        
        C:\Windows\SysWOW64\Kgopbj32.exe
        
        C:\Windows\system32\Kgopbj32.exe
        122⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Lgamhjja.exe
        
        C:\Windows\system32\Lgamhjja.exe
        123⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Legjgn32.exe
        
        C:\Windows\system32\Legjgn32.exe
        124⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Lejgln32.exe
        
        C:\Windows\system32\Lejgln32.exe
        125⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\Mhjpnibf.exe
        
        C:\Windows\system32\Mhjpnibf.exe
        126⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\Magnbnea.exe
        
        C:\Windows\system32\Magnbnea.exe
        127⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\Mbgjlq32.exe
        
        C:\Windows\system32\Mbgjlq32.exe
        128⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Mjbopcip.exe
        
        C:\Windows\system32\Mjbopcip.exe
        129⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\Mbigapjb.exe
        
        C:\Windows\system32\Mbigapjb.exe
        130⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Acclejeb.exe
        
        C:\Windows\system32\Acclejeb.exe
        131⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Aebhaede.exe
        
        C:\Windows\system32\Aebhaede.exe
        132⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\Allpnplb.exe
        
        C:\Windows\system32\Allpnplb.exe
        133⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\Aojljkkf.exe
        
        C:\Windows\system32\Aojljkkf.exe
        134⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3200
        
        C:\Windows\SysWOW64\Afddge32.exe
        
        C:\Windows\system32\Afddge32.exe
        135⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Acheqi32.exe
        
        C:\Windows\system32\Acheqi32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6268
        
        C:\Windows\SysWOW64\Ahenip32.exe
        
        C:\Windows\system32\Ahenip32.exe
        137⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Aoofej32.exe
        
        C:\Windows\system32\Aoofej32.exe
        138⤵
        
        PID:416
        
        C:\Windows\SysWOW64\Ajdjcc32.exe
        
        C:\Windows\system32\Ajdjcc32.exe
        139⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Akffjkme.exe
        
        C:\Windows\system32\Akffjkme.exe
        140⤵
        Drops file in System32 directory
        
        PID:5224
        
        C:\Windows\SysWOW64\Bhjgdplo.exe
        
        C:\Windows\system32\Bhjgdplo.exe
        141⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\Bocoqj32.exe
        
        C:\Windows\system32\Bocoqj32.exe
        142⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\Bkjpek32.exe
        
        C:\Windows\system32\Bkjpek32.exe
        143⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Bcahgh32.exe
        
        C:\Windows\system32\Bcahgh32.exe
        144⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\Bkmmkj32.exe
        
        C:\Windows\system32\Bkmmkj32.exe
        145⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Ckaffjbg.exe
        
        C:\Windows\system32\Ckaffjbg.exe
        146⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4360
        
        C:\Windows\SysWOW64\Cbkncd32.exe
        
        C:\Windows\system32\Cbkncd32.exe
        147⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\Ciefpn32.exe
        
        C:\Windows\system32\Ciefpn32.exe
        148⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Cihcen32.exe
        
        C:\Windows\system32\Cihcen32.exe
        149⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Cbphncfo.exe
        
        C:\Windows\system32\Cbphncfo.exe
        150⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Cjgpoq32.exe
        
        C:\Windows\system32\Cjgpoq32.exe
        151⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\Codhgg32.exe
        
        C:\Windows\system32\Codhgg32.exe
        152⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\Cilmpmki.exe
        
        C:\Windows\system32\Cilmpmki.exe
        153⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Cfqmjajc.exe
        
        C:\Windows\system32\Cfqmjajc.exe
        154⤵
        
        PID:388
        
        C:\Windows\SysWOW64\Djnfppqi.exe
        
        C:\Windows\system32\Djnfppqi.exe
        155⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\Dmooak32.exe
        
        C:\Windows\system32\Dmooak32.exe
        156⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Djelqo32.exe
        
        C:\Windows\system32\Djelqo32.exe
        157⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Dlfhhgpp.exe
        
        C:\Windows\system32\Dlfhhgpp.exe
        158⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Dcnqid32.exe
        
        C:\Windows\system32\Dcnqid32.exe
        159⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\Ejjelnfl.exe
        
        C:\Windows\system32\Ejjelnfl.exe
        160⤵
        
        PID:3168
        
        C:\Windows\SysWOW64\Epgndedc.exe
        
        C:\Windows\system32\Epgndedc.exe
        161⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Ebggep32.exe
        
        C:\Windows\system32\Ebggep32.exe
        162⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Emmkci32.exe
        
        C:\Windows\system32\Emmkci32.exe
        163⤵
        Drops file in System32 directory
        
        PID:6884
        
        C:\Windows\SysWOW64\Ecgcpc32.exe
        
        C:\Windows\system32\Ecgcpc32.exe
        164⤵
        
        PID:3636
        
        C:\Windows\SysWOW64\Ejaklmpd.exe
        
        C:\Windows\system32\Ejaklmpd.exe
        165⤵
        Drops file in System32 directory
        
        PID:2096
        
        C:\Windows\SysWOW64\Elbhde32.exe
        
        C:\Windows\system32\Elbhde32.exe
        166⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\Fmbdnhme.exe
        
        C:\Windows\system32\Fmbdnhme.exe
        167⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Ffjignde.exe
        
        C:\Windows\system32\Ffjignde.exe
        168⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\Fihecici.exe
        
        C:\Windows\system32\Fihecici.exe
        169⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\Fpbmpc32.exe
        
        C:\Windows\system32\Fpbmpc32.exe
        170⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Fpejec32.exe
        
        C:\Windows\system32\Fpejec32.exe
        171⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Fmikoggm.exe
        
        C:\Windows\system32\Fmikoggm.exe
        172⤵
        Modifies registry class
        
        PID:4848
        
        C:\Windows\SysWOW64\Fdccka32.exe
        
        C:\Windows\system32\Fdccka32.exe
        173⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Fjmkhkff.exe
        
        C:\Windows\system32\Fjmkhkff.exe
        174⤵
        Modifies registry class
        
        PID:1180
        
        C:\Windows\SysWOW64\Flngpc32.exe
        
        C:\Windows\system32\Flngpc32.exe
        175⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Ffclml32.exe
        
        C:\Windows\system32\Ffclml32.exe
        176⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\Gibhihko.exe
        
        C:\Windows\system32\Gibhihko.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5900
        
        C:\Windows\SysWOW64\Gbjlbm32.exe
        
        C:\Windows\system32\Gbjlbm32.exe
        178⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\Gkfnnjnl.exe
        
        C:\Windows\system32\Gkfnnjnl.exe
        179⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\Glgjfb32.exe
        
        C:\Windows\system32\Glgjfb32.exe
        180⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Gbcohl32.exe
        
        C:\Windows\system32\Gbcohl32.exe
        181⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\Hphpap32.exe
        
        C:\Windows\system32\Hphpap32.exe
        182⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\Hkmdoi32.exe
        
        C:\Windows\system32\Hkmdoi32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1292
        
        C:\Windows\SysWOW64\Hgdedj32.exe
        
        C:\Windows\system32\Hgdedj32.exe
        184⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\Hmnmqdee.exe
        
        C:\Windows\system32\Hmnmqdee.exe
        185⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Hdhemn32.exe
        
        C:\Windows\system32\Hdhemn32.exe
        186⤵
        Modifies registry class
        
        PID:320
        
        C:\Windows\SysWOW64\Hienee32.exe
        
        C:\Windows\system32\Hienee32.exe
        187⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Hlcjaq32.exe
        
        C:\Windows\system32\Hlcjaq32.exe
        188⤵
        
        PID:4156
        
        C:\Windows\SysWOW64\Hcmbnk32.exe
        
        C:\Windows\system32\Hcmbnk32.exe
        189⤵
        Modifies registry class
        
        PID:700
        
        C:\Windows\SysWOW64\Hkdjph32.exe
        
        C:\Windows\system32\Hkdjph32.exe
        190⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Hlefgphj.exe
        
        C:\Windows\system32\Hlefgphj.exe
        191⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Icoodj32.exe
        
        C:\Windows\system32\Icoodj32.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6200
        
        C:\Windows\SysWOW64\Iiigqdfd.exe
        
        C:\Windows\system32\Iiigqdfd.exe
        193⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\Idoknmfj.exe
        
        C:\Windows\system32\Idoknmfj.exe
        194⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Idahcm32.exe
        
        C:\Windows\system32\Idahcm32.exe
        195⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Idceim32.exe
        
        C:\Windows\system32\Idceim32.exe
        196⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Jlhlcnge.exe
        
        C:\Windows\system32\Jlhlcnge.exe
        197⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Jkimae32.exe
        
        C:\Windows\system32\Jkimae32.exe
        198⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Jljiimeb.exe
        
        C:\Windows\system32\Jljiimeb.exe
        199⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\Jjoibadl.exe
        
        C:\Windows\system32\Jjoibadl.exe
        200⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Kddnpj32.exe
        
        C:\Windows\system32\Kddnpj32.exe
        201⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Knoonphp.exe
        
        C:\Windows\system32\Knoonphp.exe
        202⤵
        Drops file in System32 directory
        
        PID:4664
        
        C:\Windows\SysWOW64\Kjepcqnd.exe
        
        C:\Windows\system32\Kjepcqnd.exe
        203⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Kjhlipla.exe
        
        C:\Windows\system32\Kjhlipla.exe
        204⤵
        Modifies registry class
        
        PID:780
        
        C:\Windows\SysWOW64\Kqbdej32.exe
        
        C:\Windows\system32\Kqbdej32.exe
        205⤵
        Modifies registry class
        
        PID:6852
        
        C:\Windows\SysWOW64\Lnjnjn32.exe
        
        C:\Windows\system32\Lnjnjn32.exe
        206⤵
        Drops file in System32 directory
        
        PID:2056
        
        C:\Windows\SysWOW64\Lddgghfo.exe
        
        C:\Windows\system32\Lddgghfo.exe
        207⤵
        Drops file in System32 directory
        
        PID:3436
        
        C:\Windows\SysWOW64\Lknocb32.exe
        
        C:\Windows\system32\Lknocb32.exe
        208⤵
        
        PID:2548
        
        C:\Windows\SysWOW64\Lcjchd32.exe
        
        C:\Windows\system32\Lcjchd32.exe
        209⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\Lqndahiq.exe
        
        C:\Windows\system32\Lqndahiq.exe
        210⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\Lgglnb32.exe
        
        C:\Windows\system32\Lgglnb32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1520
        
        C:\Windows\SysWOW64\Lnadkmhj.exe
        
        C:\Windows\system32\Lnadkmhj.exe
        212⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Mekmgg32.exe
        
        C:\Windows\system32\Mekmgg32.exe
        213⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Mkeeda32.exe
        
        C:\Windows\system32\Mkeeda32.exe
        214⤵
        
        PID:1472
        
        C:\Windows\SysWOW64\Mndapl32.exe
        
        C:\Windows\system32\Mndapl32.exe
        215⤵
        
        PID:3292
        
        C:\Windows\SysWOW64\Mcqjhc32.exe
        
        C:\Windows\system32\Mcqjhc32.exe
        216⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Madjbg32.exe
        
        C:\Windows\system32\Madjbg32.exe
        217⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\Mgoboake.exe
        
        C:\Windows\system32\Mgoboake.exe
        218⤵
        Drops file in System32 directory
        
        PID:6856
        
        C:\Windows\SysWOW64\Mmkkgh32.exe
        
        C:\Windows\system32\Mmkkgh32.exe
        219⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Mceccbpj.exe
        
        C:\Windows\system32\Mceccbpj.exe
        220⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Mnkgakpp.exe
        
        C:\Windows\system32\Mnkgakpp.exe
        221⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Nmpdbh32.exe
        
        C:\Windows\system32\Nmpdbh32.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7012

C:\Windows\SysWOW64\Plhcglil.exe
C:\Windows\system32\Plhcglil.exe
1⤵
PID:5148
- C:\Windows\SysWOW64\Pdfeandd.exe
  C:\Windows\system32\Pdfeandd.exe
  2⤵
  PID:6924
- - C:\Windows\SysWOW64\Poliog32.exe
    C:\Windows\system32\Poliog32.exe
    3⤵
    PID:1956
  - - C:\Windows\SysWOW64\Pehnaqid.exe
      C:\Windows\system32\Pehnaqid.exe
      4⤵
      PID:6980
    - - C:\Windows\SysWOW64\Qopbjf32.exe
        
        C:\Windows\system32\Qopbjf32.exe
        5⤵
        
        PID:4520
      - C:\Windows\SysWOW64\Qdmkbmnl.exe
        
        C:\Windows\system32\Qdmkbmnl.exe
        6⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\Qldccjno.exe
        
        C:\Windows\system32\Qldccjno.exe
        7⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\Qaalkamf.exe
        
        C:\Windows\system32\Qaalkamf.exe
        8⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Ahkdhk32.exe
        
        C:\Windows\system32\Ahkdhk32.exe
        9⤵
        
        PID:660
        
        C:\Windows\SysWOW64\Aachaa32.exe
        
        C:\Windows\system32\Aachaa32.exe
        10⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\Aklmjfad.exe
        
        C:\Windows\system32\Aklmjfad.exe
        11⤵
        Modifies registry class
        
        PID:3124
        
        C:\Windows\SysWOW64\Anmfkane.exe
        
        C:\Windows\system32\Anmfkane.exe
        12⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Adfnhlfa.exe
        
        C:\Windows\system32\Adfnhlfa.exe
        13⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\Anobaa32.exe
        
        C:\Windows\system32\Anobaa32.exe
        14⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\Adiknkco.exe
        
        C:\Windows\system32\Adiknkco.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5572
        
        C:\Windows\SysWOW64\Alpboida.exe
        
        C:\Windows\system32\Alpboida.exe
        16⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Anaofa32.exe
        
        C:\Windows\system32\Anaofa32.exe
        17⤵
        
        PID:5484

C:\Windows\SysWOW64\Blbodh32.exe
C:\Windows\system32\Blbodh32.exe
1⤵
PID:4300
- C:\Windows\SysWOW64\Baohmo32.exe
  C:\Windows\system32\Baohmo32.exe
  2⤵
  PID:5052
- - C:\Windows\SysWOW64\Bkgleegf.exe
    C:\Windows\system32\Bkgleegf.exe
    3⤵
    PID:868
  - - C:\Windows\SysWOW64\Bhkmoifp.exe
      C:\Windows\system32\Bhkmoifp.exe
      4⤵
      PID:5808
    - - C:\Windows\SysWOW64\Badaholq.exe
        
        C:\Windows\system32\Badaholq.exe
        5⤵
        
        PID:5800
      - C:\Windows\SysWOW64\Bhnidi32.exe
        
        C:\Windows\system32\Bhnidi32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5848
        
        C:\Windows\SysWOW64\Beajnm32.exe
        
        C:\Windows\system32\Beajnm32.exe
        7⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\Bojogb32.exe
        
        C:\Windows\system32\Bojogb32.exe
        8⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Cfdgcmqd.exe
        
        C:\Windows\system32\Cfdgcmqd.exe
        9⤵
        Drops file in System32 directory
        
        PID:5496
        
        C:\Windows\SysWOW64\Cakghn32.exe
        
        C:\Windows\system32\Cakghn32.exe
        10⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Chepehne.exe
        
        C:\Windows\system32\Chepehne.exe
        11⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\Cfipol32.exe
        
        C:\Windows\system32\Cfipol32.exe
        12⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\Cfkmdl32.exe
        
        C:\Windows\system32\Cfkmdl32.exe
        13⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Cbbnim32.exe
        
        C:\Windows\system32\Cbbnim32.exe
        14⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Cdpjeh32.exe
        
        C:\Windows\system32\Cdpjeh32.exe
        15⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Cninnnfe.exe
        
        C:\Windows\system32\Cninnnfe.exe
        16⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\Dnkkcmdb.exe
        
        C:\Windows\system32\Dnkkcmdb.exe
        17⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Dhqoaf32.exe
        
        C:\Windows\system32\Dhqoaf32.exe
        18⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Dnmhim32.exe
        
        C:\Windows\system32\Dnmhim32.exe
        19⤵
        Drops file in System32 directory
        
        PID:5064
        
        C:\Windows\SysWOW64\Domdcpib.exe
        
        C:\Windows\system32\Domdcpib.exe
        20⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Dooaip32.exe
        
        C:\Windows\system32\Dooaip32.exe
        21⤵
        
        PID:420
        
        C:\Windows\SysWOW64\Deliaf32.exe
        
        C:\Windows\system32\Deliaf32.exe
        22⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Dkfanqmd.exe
        
        C:\Windows\system32\Dkfanqmd.exe
        23⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Ebpjjk32.exe
        
        C:\Windows\system32\Ebpjjk32.exe
        24⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Eijbge32.exe
        
        C:\Windows\system32\Eijbge32.exe
        25⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Eeqclfaa.exe
        
        C:\Windows\system32\Eeqclfaa.exe
        26⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\Ekkkip32.exe
        
        C:\Windows\system32\Ekkkip32.exe
        27⤵
        Modifies registry class
        
        PID:5388
        
        C:\Windows\SysWOW64\Enigek32.exe
        
        C:\Windows\system32\Enigek32.exe
        28⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Ekmhnpfl.exe
        
        C:\Windows\system32\Ekmhnpfl.exe
        29⤵
        Drops file in System32 directory
        
        PID:5596
        
        C:\Windows\SysWOW64\Ebgpkj32.exe
        
        C:\Windows\system32\Ebgpkj32.exe
        30⤵
        Modifies registry class
        
        PID:4872
        
        C:\Windows\SysWOW64\Ekoddodi.exe
        
        C:\Windows\system32\Ekoddodi.exe
        31⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Eehime32.exe
        
        C:\Windows\system32\Eehime32.exe
        32⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Ekaaio32.exe
        
        C:\Windows\system32\Ekaaio32.exe
        33⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Fblifijc.exe
        
        C:\Windows\system32\Fblifijc.exe
        34⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Fppjpmim.exe
        
        C:\Windows\system32\Fppjpmim.exe
        35⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Fnegqjne.exe
        
        C:\Windows\system32\Fnegqjne.exe
        36⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Fijknbmk.exe
        
        C:\Windows\system32\Fijknbmk.exe
        37⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Fpdckm32.exe
        
        C:\Windows\system32\Fpdckm32.exe
        38⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Flkdpnjl.exe
        
        C:\Windows\system32\Flkdpnjl.exe
        39⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Ffqhmf32.exe
        
        C:\Windows\system32\Ffqhmf32.exe
        40⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Flmqem32.exe
        
        C:\Windows\system32\Flmqem32.exe
        41⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Gbgibgpf.exe
        
        C:\Windows\system32\Gbgibgpf.exe
        42⤵
        Modifies registry class
        
        PID:7656
        
        C:\Windows\SysWOW64\Gpkiklop.exe
        
        C:\Windows\system32\Gpkiklop.exe
        43⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Gfeahffl.exe
        
        C:\Windows\system32\Gfeahffl.exe
        44⤵
        Modifies registry class
        
        PID:7744
        
        C:\Windows\SysWOW64\Gmojep32.exe
        
        C:\Windows\system32\Gmojep32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7796
        
        C:\Windows\SysWOW64\Gnqflhcg.exe
        
        C:\Windows\system32\Gnqflhcg.exe
        46⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Gejoib32.exe
        
        C:\Windows\system32\Gejoib32.exe
        47⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Gldgflba.exe
        
        C:\Windows\system32\Gldgflba.exe
        48⤵
        Drops file in System32 directory
        
        PID:7928
        
        C:\Windows\SysWOW64\Gikdep32.exe
        
        C:\Windows\system32\Gikdep32.exe
        49⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Hpdlajfe.exe
        
        C:\Windows\system32\Hpdlajfe.exe
        50⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Hfodnd32.exe
        
        C:\Windows\system32\Hfodnd32.exe
        51⤵
        Modifies registry class
        
        PID:8056
        
        C:\Windows\SysWOW64\Hlkmfkli.exe
        
        C:\Windows\system32\Hlkmfkli.exe
        52⤵
        Drops file in System32 directory
        
        PID:8092
        
        C:\Windows\SysWOW64\Hbeece32.exe
        
        C:\Windows\system32\Hbeece32.exe
        53⤵
        Modifies registry class
        
        PID:8132
        
        C:\Windows\SysWOW64\Hpiemj32.exe
        
        C:\Windows\system32\Hpiemj32.exe
        54⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Hfcnicjl.exe
        
        C:\Windows\system32\Hfcnicjl.exe
        55⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Hiajeoip.exe
        
        C:\Windows\system32\Hiajeoip.exe
        56⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Hplbbipm.exe
        
        C:\Windows\system32\Hplbbipm.exe
        57⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Hidgko32.exe
        
        C:\Windows\system32\Hidgko32.exe
        58⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Hpnohinj.exe
        
        C:\Windows\system32\Hpnohinj.exe
        59⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Hfhgdc32.exe
        
        C:\Windows\system32\Hfhgdc32.exe
        60⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Imbpam32.exe
        
        C:\Windows\system32\Imbpam32.exe
        61⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Iocliecb.exe
        
        C:\Windows\system32\Iocliecb.exe
        62⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\Iemdep32.exe
        
        C:\Windows\system32\Iemdep32.exe
        63⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Iikmlnae.exe
        
        C:\Windows\system32\Iikmlnae.exe
        64⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Ipeehhhb.exe
        
        C:\Windows\system32\Ipeehhhb.exe
        65⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Igomeb32.exe
        
        C:\Windows\system32\Igomeb32.exe
        66⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7864
        
        C:\Windows\SysWOW64\Imieblgl.exe
        
        C:\Windows\system32\Imieblgl.exe
        67⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Icfnjcec.exe
        
        C:\Windows\system32\Icfnjcec.exe
        68⤵
        Modifies registry class
        
        PID:7980
        
        C:\Windows\SysWOW64\Imkbglei.exe
        
        C:\Windows\system32\Imkbglei.exe
        69⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Iomood32.exe
        
        C:\Windows\system32\Iomood32.exe
        70⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Iefgln32.exe
        
        C:\Windows\system32\Iefgln32.exe
        71⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Jlqohhja.exe
        
        C:\Windows\system32\Jlqohhja.exe
        72⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Jookdcie.exe
        
        C:\Windows\system32\Jookdcie.exe
        73⤵
        Drops file in System32 directory
        
        PID:7332
        
        C:\Windows\SysWOW64\Jeidan32.exe
        
        C:\Windows\system32\Jeidan32.exe
        74⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Jpnhof32.exe
        
        C:\Windows\system32\Jpnhof32.exe
        75⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Jekqgnno.exe
        
        C:\Windows\system32\Jekqgnno.exe
        76⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Jpqedfne.exe
        
        C:\Windows\system32\Jpqedfne.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7720
        
        C:\Windows\SysWOW64\Jgkmap32.exe
        
        C:\Windows\system32\Jgkmap32.exe
        78⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Jgmjfpco.exe
        
        C:\Windows\system32\Jgmjfpco.exe
        79⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Jljbogaf.exe
        
        C:\Windows\system32\Jljbogaf.exe
        80⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Jgoflpal.exe
        
        C:\Windows\system32\Jgoflpal.exe
        81⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\Knioij32.exe
        
        C:\Windows\system32\Knioij32.exe
        82⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Kphkee32.exe
        
        C:\Windows\system32\Kphkee32.exe
        83⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Kgacaopj.exe
        
        C:\Windows\system32\Kgacaopj.exe
        84⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Knlknigf.exe
        
        C:\Windows\system32\Knlknigf.exe
        85⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Komhfa32.exe
        
        C:\Windows\system32\Komhfa32.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5760
        
        C:\Windows\SysWOW64\Klahof32.exe
        
        C:\Windows\system32\Klahof32.exe
        87⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Kfimhkbo.exe
        
        C:\Windows\system32\Kfimhkbo.exe
        88⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Kjgenjhe.exe
        
        C:\Windows\system32\Kjgenjhe.exe
        89⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Kodnfqgm.exe
        
        C:\Windows\system32\Kodnfqgm.exe
        90⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Lfnfck32.exe
        
        C:\Windows\system32\Lfnfck32.exe
        91⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Lofklp32.exe
        
        C:\Windows\system32\Lofklp32.exe
        92⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Ljloii32.exe
        
        C:\Windows\system32\Ljloii32.exe
        93⤵
        Drops file in System32 directory
        
        PID:8064
        
        C:\Windows\SysWOW64\Lljked32.exe
        
        C:\Windows\system32\Lljked32.exe
        94⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\Lfgiii32.exe
        
        C:\Windows\system32\Lfgiii32.exe
        95⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Lmaafcml.exe
        
        C:\Windows\system32\Lmaafcml.exe
        96⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Mggecl32.exe
        
        C:\Windows\system32\Mggecl32.exe
        97⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Mnanpfdo.exe
        
        C:\Windows\system32\Mnanpfdo.exe
        98⤵
        Modifies registry class
        
        PID:2520
        
        C:\Windows\SysWOW64\Mncjffbl.exe
        
        C:\Windows\system32\Mncjffbl.exe
        99⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Modgnn32.exe
        
        C:\Windows\system32\Modgnn32.exe
        100⤵
        Drops file in System32 directory
        
        PID:1720
        
        C:\Windows\SysWOW64\Mfnojh32.exe
        
        C:\Windows\system32\Mfnojh32.exe
        101⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Mogccnfg.exe
        
        C:\Windows\system32\Mogccnfg.exe
        102⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\Mfqlph32.exe
        
        C:\Windows\system32\Mfqlph32.exe
        103⤵
        
        PID:3752
        
        C:\Windows\SysWOW64\Mqfpma32.exe
        
        C:\Windows\system32\Mqfpma32.exe
        104⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Mnjqfeld.exe
        
        C:\Windows\system32\Mnjqfeld.exe
        105⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Ncgiolkk.exe
        
        C:\Windows\system32\Ncgiolkk.exe
        106⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Njaakf32.exe
        
        C:\Windows\system32\Njaakf32.exe
        107⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Nqkihpie.exe
        
        C:\Windows\system32\Nqkihpie.exe
        108⤵
        
        PID:116
        
        C:\Windows\SysWOW64\Ngeaej32.exe
        
        C:\Windows\system32\Ngeaej32.exe
        109⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5904
        
        C:\Windows\SysWOW64\Nnojad32.exe
        
        C:\Windows\system32\Nnojad32.exe
        110⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Nppfimnm.exe
        
        C:\Windows\system32\Nppfimnm.exe
        111⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Njekfenc.exe
        
        C:\Windows\system32\Njekfenc.exe
        112⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\Nabpiocm.exe
        
        C:\Windows\system32\Nabpiocm.exe
        113⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Njjdae32.exe
        
        C:\Windows\system32\Njjdae32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5784
        
        C:\Windows\SysWOW64\Ocbhjjqn.exe
        
        C:\Windows\system32\Ocbhjjqn.exe
        115⤵
        
        PID:184
        
        C:\Windows\SysWOW64\Ojommdfh.exe
        
        C:\Windows\system32\Ojommdfh.exe
        116⤵
        Drops file in System32 directory
        
        PID:2576
        
        C:\Windows\SysWOW64\Oakbonkb.exe
        
        C:\Windows\system32\Oakbonkb.exe
        117⤵
        
        PID:684
        
        C:\Windows\SysWOW64\Ojcghc32.exe
        
        C:\Windows\system32\Ojcghc32.exe
        118⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\Oanodnip.exe
        
        C:\Windows\system32\Oanodnip.exe
        119⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\Omdpio32.exe
        
        C:\Windows\system32\Omdpio32.exe
        120⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:828
        
        C:\Windows\SysWOW64\Phjdggoj.exe
        
        C:\Windows\system32\Phjdggoj.exe
        121⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Pmgmonma.exe
        
        C:\Windows\system32\Pmgmonma.exe
        122⤵
        Modifies registry class
        
        PID:8236
        
        C:\Windows\SysWOW64\Pdqelh32.exe
        
        C:\Windows\system32\Pdqelh32.exe
        123⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Pjkmhblk.exe
        
        C:\Windows\system32\Pjkmhblk.exe
        124⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Ppgeqijb.exe
        
        C:\Windows\system32\Ppgeqijb.exe
        125⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Pjmjnb32.exe
        
        C:\Windows\system32\Pjmjnb32.exe
        126⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Pdenghpi.exe
        
        C:\Windows\system32\Pdenghpi.exe
        127⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Pjofcb32.exe
        
        C:\Windows\system32\Pjofcb32.exe
        128⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Paioplob.exe
        
        C:\Windows\system32\Paioplob.exe
        129⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Qpolahdj.exe
        
        C:\Windows\system32\Qpolahdj.exe
        130⤵
        Modifies registry class
        
        PID:8596
        
        C:\Windows\SysWOW64\Qdldgg32.exe
        
        C:\Windows\system32\Qdldgg32.exe
        131⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Apcemh32.exe
        
        C:\Windows\system32\Apcemh32.exe
        132⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Aodejohd.exe
        
        C:\Windows\system32\Aodejohd.exe
        133⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Apeabg32.exe
        
        C:\Windows\system32\Apeabg32.exe
        134⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Afpjoaeo.exe
        
        C:\Windows\system32\Afpjoaeo.exe
        135⤵
        Drops file in System32 directory
        
        PID:8832
        
        C:\Windows\SysWOW64\Amibklml.exe
        
        C:\Windows\system32\Amibklml.exe
        136⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Ahofidlb.exe
        
        C:\Windows\system32\Ahofidlb.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8928
        
        C:\Windows\SysWOW64\Akmbepke.exe
        
        C:\Windows\system32\Akmbepke.exe
        138⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Apjkmgjm.exe
        
        C:\Windows\system32\Apjkmgjm.exe
        139⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Akpojpic.exe
        
        C:\Windows\system32\Akpojpic.exe
        140⤵
        Modifies registry class
        
        PID:9056
        
        C:\Windows\SysWOW64\Amnlfk32.exe
        
        C:\Windows\system32\Amnlfk32.exe
        141⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Ahdpdd32.exe
        
        C:\Windows\system32\Ahdpdd32.exe
        142⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Bmqhlk32.exe
        
        C:\Windows\system32\Bmqhlk32.exe
        143⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Bdjqienq.exe
        
        C:\Windows\system32\Bdjqienq.exe
        144⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Banabi32.exe
        
        C:\Windows\system32\Banabi32.exe
        145⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Bhhiocdg.exe
        
        C:\Windows\system32\Bhhiocdg.exe
        146⤵
        Drops file in System32 directory
        
        PID:8340
        
        C:\Windows\SysWOW64\Bobalm32.exe
        
        C:\Windows\system32\Bobalm32.exe
        147⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Bpcnceab.exe
        
        C:\Windows\system32\Bpcnceab.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8464
        
        C:\Windows\SysWOW64\Bngnmjql.exe
        
        C:\Windows\system32\Bngnmjql.exe
        149⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Bgpceogl.exe
        
        C:\Windows\system32\Bgpceogl.exe
        150⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Cknlln32.exe
        
        C:\Windows\system32\Cknlln32.exe
        151⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Cahdhhep.exe
        
        C:\Windows\system32\Cahdhhep.exe
        152⤵
        Modifies registry class
        
        PID:8672
        
        C:\Windows\SysWOW64\Coldbl32.exe
        
        C:\Windows\system32\Coldbl32.exe
        153⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Chdikajj.exe
        
        C:\Windows\system32\Chdikajj.exe
        154⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Cponodge.exe
        
        C:\Windows\system32\Cponodge.exe
        155⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Cncnhh32.exe
        
        C:\Windows\system32\Cncnhh32.exe
        156⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Caagofme.exe
        
        C:\Windows\system32\Caagofme.exe
        157⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Chkokq32.exe
        
        C:\Windows\system32\Chkokq32.exe
        158⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Dgpllm32.exe
        
        C:\Windows\system32\Dgpllm32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9164
        
        C:\Windows\SysWOW64\Dqipeboj.exe
        
        C:\Windows\system32\Dqipeboj.exe
        160⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\Dhphfppl.exe
        
        C:\Windows\system32\Dhphfppl.exe
        161⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Dqpffaib.exe
        
        C:\Windows\system32\Dqpffaib.exe
        162⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Egjobl32.exe
        
        C:\Windows\system32\Egjobl32.exe
        163⤵
        Drops file in System32 directory
        
        PID:8520
        
        C:\Windows\SysWOW64\Ednolp32.exe
        
        C:\Windows\system32\Ednolp32.exe
        164⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Ekggijge.exe
        
        C:\Windows\system32\Ekggijge.exe
        165⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\Ebapednb.exe
        
        C:\Windows\system32\Ebapednb.exe
        166⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Edplapnf.exe
        
        C:\Windows\system32\Edplapnf.exe
        167⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\Ekjdnj32.exe
        
        C:\Windows\system32\Ekjdnj32.exe
        168⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\Ebdlkdlp.exe
        
        C:\Windows\system32\Ebdlkdlp.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2536
        
        C:\Windows\SysWOW64\Egqeckkg.exe
        
        C:\Windows\system32\Egqeckkg.exe
        170⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\Enkmpe32.exe
        
        C:\Windows\system32\Enkmpe32.exe
        171⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Eqiilp32.exe
        
        C:\Windows\system32\Eqiilp32.exe
        172⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Eojijg32.exe
        
        C:\Windows\system32\Eojijg32.exe
        173⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Fkajoiok.exe
        
        C:\Windows\system32\Fkajoiok.exe
        174⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Fbkblb32.exe
        
        C:\Windows\system32\Fbkblb32.exe
        175⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Fghkdjdo.exe
        
        C:\Windows\system32\Fghkdjdo.exe
        176⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\Fnacqc32.exe
        
        C:\Windows\system32\Fnacqc32.exe
        177⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Felkmnci.exe
        
        C:\Windows\system32\Felkmnci.exe
        178⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\Fkfcjh32.exe
        
        C:\Windows\system32\Fkfcjh32.exe
        179⤵
        
        PID:832
        
        C:\Windows\SysWOW64\Fnfmlchf.exe
        
        C:\Windows\system32\Fnfmlchf.exe
        180⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Fepehm32.exe
        
        C:\Windows\system32\Fepehm32.exe
        181⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Fagenneg.exe
        
        C:\Windows\system32\Fagenneg.exe
        182⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Gganjh32.exe
        
        C:\Windows\system32\Gganjh32.exe
        183⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\Gaibcn32.exe
        
        C:\Windows\system32\Gaibcn32.exe
        184⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Gkofpf32.exe
        
        C:\Windows\system32\Gkofpf32.exe
        185⤵
        
        PID:8692

C:\Windows\SysWOW64\Galoin32.exe
C:\Windows\system32\Galoin32.exe
1⤵
PID:8724
- C:\Windows\SysWOW64\Giecojpb.exe
  C:\Windows\system32\Giecojpb.exe
  2⤵
  PID:2524
- - C:\Windows\SysWOW64\Ggjqqg32.exe
    C:\Windows\system32\Ggjqqg32.exe
    3⤵
    PID:5304
  - - C:\Windows\SysWOW64\Henajkcc.exe
      C:\Windows\system32\Henajkcc.exe
      4⤵
      PID:9048
    - - C:\Windows\SysWOW64\Hlhife32.exe
        
        C:\Windows\system32\Hlhife32.exe
        5⤵
        
        PID:9080
      - C:\Windows\SysWOW64\Hiljpi32.exe
        
        C:\Windows\system32\Hiljpi32.exe
        6⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\Khgbjqng.exe
        
        C:\Windows\system32\Khgbjqng.exe
        7⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Lpqgqn32.exe
        
        C:\Windows\system32\Lpqgqn32.exe
        8⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Llggeobk.exe
        
        C:\Windows\system32\Llggeobk.exe
        9⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\Lljdkn32.exe
        
        C:\Windows\system32\Lljdkn32.exe
        10⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Lpjjgl32.exe
        
        C:\Windows\system32\Lpjjgl32.exe
        11⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Lfgboc32.exe
        
        C:\Windows\system32\Lfgboc32.exe
        12⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Mplfll32.exe
        
        C:\Windows\system32\Mplfll32.exe
        13⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\Mjdkeaij.exe
        
        C:\Windows\system32\Mjdkeaij.exe
        14⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\Moacnh32.exe
        
        C:\Windows\system32\Moacnh32.exe
        15⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Mhjhfnma.exe
        
        C:\Windows\system32\Mhjhfnma.exe
        16⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\Mofmhhcl.exe
        
        C:\Windows\system32\Mofmhhcl.exe
        17⤵
        
        PID:892
        
        C:\Windows\SysWOW64\Mfpeeb32.exe
        
        C:\Windows\system32\Mfpeeb32.exe
        18⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Mljmblae.exe
        
        C:\Windows\system32\Mljmblae.exe
        19⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Mohingqi.exe
        
        C:\Windows\system32\Mohingqi.exe
        20⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\Mfbaka32.exe
        
        C:\Windows\system32\Mfbaka32.exe
        21⤵
        
        PID:3888
        
        C:\Windows\SysWOW64\Nlljglpc.exe
        
        C:\Windows\system32\Nlljglpc.exe
        22⤵
        
        PID:3476
        
        C:\Windows\SysWOW64\Nbibpb32.exe
        
        C:\Windows\system32\Nbibpb32.exe
        23⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\Nmofmk32.exe
        
        C:\Windows\system32\Nmofmk32.exe
        24⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\Njbgfp32.exe
        
        C:\Windows\system32\Njbgfp32.exe
        25⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Nqmocjdf.exe
        
        C:\Windows\system32\Nqmocjdf.exe
        26⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Nfihkq32.exe
        
        C:\Windows\system32\Nfihkq32.exe
        27⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\Ncmhee32.exe
        
        C:\Windows\system32\Ncmhee32.exe
        28⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Njgqaohd.exe
        
        C:\Windows\system32\Njgqaohd.exe
        29⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\Ncpejd32.exe
        
        C:\Windows\system32\Ncpejd32.exe
        30⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Oilmckml.exe
        
        C:\Windows\system32\Oilmckml.exe
        31⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Oqcedino.exe
        
        C:\Windows\system32\Oqcedino.exe
        32⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Ofqnlplf.exe
        
        C:\Windows\system32\Ofqnlplf.exe
        33⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Omjfij32.exe
        
        C:\Windows\system32\Omjfij32.exe
        34⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Ocdnedkp.exe
        
        C:\Windows\system32\Ocdnedkp.exe
        35⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\Ojnfbnbl.exe
        
        C:\Windows\system32\Ojnfbnbl.exe
        36⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Oqhooh32.exe
        
        C:\Windows\system32\Oqhooh32.exe
        37⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\Obikgppg.exe
        
        C:\Windows\system32\Obikgppg.exe
        38⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Oicccj32.exe
        
        C:\Windows\system32\Oicccj32.exe
        39⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Opnlpdoa.exe
        
        C:\Windows\system32\Opnlpdoa.exe
        40⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Oifpijea.exe
        
        C:\Windows\system32\Oifpijea.exe
        41⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Opphed32.exe
        
        C:\Windows\system32\Opphed32.exe
        42⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\Pjemcm32.exe
        
        C:\Windows\system32\Pjemcm32.exe
        43⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\Pmdioh32.exe
        
        C:\Windows\system32\Pmdioh32.exe
        44⤵
        
        PID:532
        
        C:\Windows\SysWOW64\Pcnalbce.exe
        
        C:\Windows\system32\Pcnalbce.exe
        45⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Pjhihm32.exe
        
        C:\Windows\system32\Pjhihm32.exe
        46⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Pfojmn32.exe
        
        C:\Windows\system32\Pfojmn32.exe
        47⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Padnkf32.exe
        
        C:\Windows\system32\Padnkf32.exe
        48⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Piocoi32.exe
        
        C:\Windows\system32\Piocoi32.exe
        49⤵
        
        PID:1268
        
        C:\Windows\SysWOW64\Ppiklc32.exe
        
        C:\Windows\system32\Ppiklc32.exe
        50⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Pfcchmlq.exe
        
        C:\Windows\system32\Pfcchmlq.exe
        51⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Pmmleg32.exe
        
        C:\Windows\system32\Pmmleg32.exe
        52⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Qfepnmjn.exe
        
        C:\Windows\system32\Qfepnmjn.exe
        53⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Qmphkg32.exe
        
        C:\Windows\system32\Qmphkg32.exe
        54⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\Qciqga32.exe
        
        C:\Windows\system32\Qciqga32.exe
        55⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Qmbepfoh.exe
        
        C:\Windows\system32\Qmbepfoh.exe
        56⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Abonimmp.exe
        
        C:\Windows\system32\Abonimmp.exe
        57⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Aiifeg32.exe
        
        C:\Windows\system32\Aiifeg32.exe
        58⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Apbnbali.exe
        
        C:\Windows\system32\Apbnbali.exe
        59⤵
        
        PID:436
        
        C:\Windows\SysWOW64\Abajnm32.exe
        
        C:\Windows\system32\Abajnm32.exe
        60⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Aikbkgcj.exe
        
        C:\Windows\system32\Aikbkgcj.exe
        61⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\Apekha32.exe
        
        C:\Windows\system32\Apekha32.exe
        62⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\Aimoqgqg.exe
        
        C:\Windows\system32\Aimoqgqg.exe
        63⤵
        
        PID:2600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2600 -ip 2600
1⤵
PID:7072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acdioc32.exe

Filesize
448KB

MD5
1bc1b9f2d6df810882dd4b1938756665

SHA1
aa590bc747adeeeca3cd7287762a6fdca149b8e0

SHA256
aa2dea0d158b5a045d45dc679a5580b44fc934de9b7024acf29d5de9ea7bda94

SHA512
f1f535cfdfac6f953c1842787cda1f26fc744e7cc555d4f92268ea4f2d124c5f95d2edbbcc9a6d1b2f17c42de18bba73223cae25fb843fb6bcde0073053192ed

Download Submit
C:\Windows\SysWOW64\Akjnnpcf.exe

Filesize
448KB

MD5
df0ceeb827fed133ed1cbc47d077ecee

SHA1
e7f9ad6e273c5b7af04992054e2973fb3b22ea20

SHA256
10011a2070794df85984aa8a2244796b8580b7a4c9d5d472bd263fbcf855305d

SHA512
ff8eac4aa4747030e764a0f61273ec55f0ff864b7e2352b49f0a030ffef36ff044a9aecf8e218b381034567231f3fa7cefedd171ab40931295282a52b6589ae2

Download Submit
C:\Windows\SysWOW64\Bcnleb32.exe

Filesize
448KB

MD5
4f4f3217f695e64650efa11f4d5396f3

SHA1
ce8946e26b778ac34202547f7e2114c3c1ef9d4a

SHA256
b31d4590c0188c1c891c45d2ad0a3ecc2f117e49d2a4f774c58793fe72f18c13

SHA512
54bdaf907e8d1062f370228cfbdae3a1cbcea72ab9897ded5f4d4f3d99818bd1df1fee03b91d7c0d2c39ada82e71f000799cc8b722c51478114a185dc069f2b3

Download Submit
C:\Windows\SysWOW64\Bppjhl32.exe

Filesize
448KB

MD5
30bcb805ef254ad0c238533715b040a0

SHA1
457f15849f796baefaac77bfff73465c67a64e56

SHA256
4457c26dee6f67991c4cce45572e8c4a84c0bf162565a1f06808e35cf4bba0b5

SHA512
f425cb01097069289a88b2ac316ac3235a3e38a5b1f6272f027ad1b2dfae1823dcf90de3fb23b77cc81deaefbeea88d2d36bba4a7e64f89da993e75544fd4c39

Download Submit
C:\Windows\SysWOW64\Ceehcc32.exe

Filesize
448KB

MD5
0402a3619ed5f7bdacb18d184b9b3400

SHA1
c67a902b9a0349fae860cb59dfd9142b457b99f7

SHA256
df6456ca7ce6e08a4d56fcfc5c28eaf9d12fcf94b9a579618ff8661af528b21b

SHA512
1fb77a0cdcad69981b31d315826c52e99e8e672e90b4f9e5d6f673f4500dcd1474c3745e4dfe850a64cefc62a72510ce31b2a9d9f79b9b8e7f944305255cd1e0

Download Submit
C:\Windows\SysWOW64\Clgmkbna.exe

Filesize
448KB

MD5
383d7adc6e1d26759e3329cfcd9c4c6b

SHA1
6d80e8dc808d8310eb5bf12bf4f84a6a6cc1077e

SHA256
23247e67d17d8bf0d8ed3073ee43055ffbbe8974452b68c00282e14d2c3053f7

SHA512
99b02266cb9ec4974f7d5a9bc9f697a156e4fed6edb6fd8cecf126e8d95b6f1750e4edbd5669abfa0bcb251df44a9aa058c99f5383293164b9708716e0421647

Download Submit
C:\Windows\SysWOW64\Cmpcdfll.exe

Filesize
448KB

MD5
6412f4501a955020bd8c1078a267defd

SHA1
34f512233744defa77e6acaaf09b1c3abba0773d

SHA256
d204d03bd822ca3465105143e3d1834ec13733bbde55682bcb58ed4dcc215d06

SHA512
f181401a6d6aba20d94d5ffd1f0bf316ca83d6529697c691e6b32f18dae808728e4f3ea08717652a24e0362275d86c14ca89f9c39e27c758b3257373c082c2f1

Download Submit
C:\Windows\SysWOW64\Dagajlal.exe

Filesize
448KB

MD5
694b0c83646b310be4103a3c3af365cb

SHA1
3e9495c1e7179e1fd2a761118b3cd9665baabe3f

SHA256
ef742e8504980a18b62b891bb8043d5b6363710c33eae689bf874f4ca5cf13e2

SHA512
3ecd991659fef7dd2d3178ededd0cdd0f35cfbdd107f1b5721269114f3e490c213542740fb733d9f249f995640feb52c88fd3e1a43f749277b94eb6eaf71ed3c

Download Submit
C:\Windows\SysWOW64\Deagoa32.exe

Filesize
448KB

MD5
d5239cd273f978b2edc35107dbc50460

SHA1
2ae7188d6e6baf72d30f9fb188b615557a0de349

SHA256
e99eb3ebac8f5409552311af750e63e30a5c8b5f1f604c31c865618155739704

SHA512
f5c5203a5693ba3ec6b48c5a2b9bd7f5db399877f5da2af8a925a50eb7781a11d613b766132c7ba3ce3a4a1e0813044e29b2e34e52c4ae490381722322234b4b

Download Submit
C:\Windows\SysWOW64\Didjqoae.exe

Filesize
448KB

MD5
eff698a44b6ff8a06277689547988d4e

SHA1
02c7b7738665629f8d59ea326c70fdad9fbbffab

SHA256
af3f9c4654ff36355b0faddef6500875d263c373efc0b990990ff525ba012a99

SHA512
324f40173712e7d8f9cd8a330e23d29bac2eeb7ed91cfb79ebc4c3800d0a562dd93aede3a853dd482b42fdcd380c0046d63b1b26d5b9776c4aedcdf292e047e4

Download Submit
C:\Windows\SysWOW64\Eegqldqg.exe

Filesize
448KB

MD5
8c76b7a26b5340c2a3cec82c73336806

SHA1
ce9bce639001b37ccf637ef0cc15c9cf501b37af

SHA256
ed5114ab6d30a85f5466f8a0d8ca8bc019e623dc2957718bae060c3dfd2fe198

SHA512
41f86aa04445f10ff1b3b326c923c9a6df0ac5e2c827679caa993017c094b9d1d2528aff645d86edcad17c293609ffe6b198652419272124a1b5320e777417a1

Download Submit
C:\Windows\SysWOW64\Eennefib.exe

Filesize
448KB

MD5
dcf4301c7815449b515198365e53b67c

SHA1
23cba6717384999206c5f26494797a2cefae2631

SHA256
3906880628a4680447d53addd273066542542db835a0918bd051a52221b52951

SHA512
62e977874ca408cb9a565e45e1fb4510892cb41d01102a2faeadccc5d1c293f0a981da67b1a4bd835e9dca79701e6c581fac02bc632ad6cae131171c8711369f

Download Submit
C:\Windows\SysWOW64\Elnehifk.exe

Filesize
448KB

MD5
46e090108b7aaa6bab4c62bb9f35d471

SHA1
cec5dd124a6134e1d79680cec8b100c3ec2ae960

SHA256
6a59310f57d58ff4e16324147058c28ba13ce11b6fec67fa131e2b38fd0e62ba

SHA512
93aeecaf85a7e827187efc6b01f01e04830771f38432247c01b0fb6654613ab62e2e592a9407c30121c60daf47cc8e6326f176d1661e61edcdbf42f4e9080089

Download Submit
C:\Windows\SysWOW64\Ffnglc32.exe

Filesize
448KB

MD5
b4de77d1c75ef09a93e1cb21e349ceb3

SHA1
a3cdf24b3480394e7d2965d7b4f52eab0d943e00

SHA256
a7025caea0e88feeeab60cbda185bbf056110f444d9b503f35c283e52abaf196

SHA512
39ec4ad6cd265bf33cc9986f4d36cc1a2795e48fc7eff9ae6cf9dc57e5bed5cc9884f4546347abfe9944f98d683655bc9c51c787494242e2258ebc42f19c851c

Download Submit
C:\Windows\SysWOW64\Fgcjea32.exe

Filesize
448KB

MD5
b9aac619c924f8f36e292cfeaa5dae14

SHA1
ae879166476006e1d8cdeeb4619c49deccbf1fac

SHA256
45e83e283d920149d44f76dde6e29b426bbfd092813ab448594a26818774e112

SHA512
90f58faae7ad86b4e7b97369677f502f025ff289b5a2e48e8f4f5de9f92ad6afbdcf99a1d250292e2ddb5c484c181671fa84011fde4bc4568841aee53b67d874

Download Submit
C:\Windows\SysWOW64\Fikihlmj.exe

Filesize
448KB

MD5
d71d686a26d464475d1174067b7acf32

SHA1
017ff2b6b94b2877eec4bcf8192990f0a712403d

SHA256
6774c8ec732df09c8e858b47bfff6a7b37469b76bbafae91936586ef5a758b55

SHA512
cb893294dfc894d30c3488599eba8bb92ffd1866ad3c30983d8e254a8ab12dedaa3339ec04e7d1e78c4ab06d6ed9e116f4cc4c387829a6a0fb1eb3d6d650f919

Download Submit
C:\Windows\SysWOW64\Fjoadbbc.exe

Filesize
448KB

MD5
c6069aadb433f1c996c52bfb5b04fc49

SHA1
cb350aa08c77a458f2cb9a6003e8c5084913b59d

SHA256
254ebc227fd9d7da535a413afafd16224c55ef04fde215f88d2be00d35574033

SHA512
1931d63dff7386b5dd90d72635d672f2ae9c3c13166a996a0aea1b787c0a3f6dd9b2ccc1e4c2229af0c5174afc024fe8b785bd3a8a66c163f25e866d70bb5c69

Download Submit
C:\Windows\SysWOW64\Fpoaom32.exe

Filesize
448KB

MD5
851ec4e6138fcae9df1cf40a07ec9641

SHA1
0f5477aed86dac0b1593b7a09a9c65ffce021a4f

SHA256
f5317baccc0022956908a38240f491fb21ef310d0dbab097c81da02d346d2962

SHA512
59217bdf0bfc6cd99daca15ff19614c7ab251459b70ee84523000a008fef026643edbe688c3061cf48389e445d445903479a31a4552c14968cc4be4febb78702

Download Submit
C:\Windows\SysWOW64\Gckjlf32.exe

Filesize
448KB

MD5
ea582edd174398fde0bc6e0cead3d91c

SHA1
7065163b73af473294cd0285b76fa99d680a5072

SHA256
3217a1c73d564e76660d7bdbd730c2bc729a82c0d8a1ce913da21ebc7959d599

SHA512
33072e8c78c942db7aaa356e65e0b21b5da03221e4bc559ac8733f4a76e78f65cde5e58668592e4400957c322858d329b545accc52a5448cffe4112d94a28074

Download Submit
C:\Windows\SysWOW64\Gegchl32.exe

Filesize
448KB

MD5
c5d64303ccc255acd8df02740f6e5c45

SHA1
92f0885dd19df038a320f6bebda312d5c70e8e62

SHA256
76b1b9b28c49d418c6a825acb0ccbef66a87f94f29f37bf9cd51983f459cf113

SHA512
65c7f187a0e127f490029fe11a403c0f3c84c44c90a5f2ca1bf556deb4b9b4c913b4dc3bbd3c20e815f1e2c639da6b4a378136a1b015d1799f009b28105e430c

Download Submit
C:\Windows\SysWOW64\Gfemmb32.exe

Filesize
103KB

MD5
b6d3b3b7271b1443b5e229a308b24e83

SHA1
0315627f8a5dbda501d2224100c80e69bd64721e

SHA256
71aadcba4f195b495d747dba3709778e5e8b86707ac4403198059062251dc2a0

SHA512
14b5120b9ae36562a4efd7f4d3de88433b15746a2ef53e6b95bfc3ce589f63f9d29d315f706bc680e6061bf4f9cc1cf11965750c43cb02669ef5ac4fb912dba2

Download Submit
C:\Windows\SysWOW64\Gfemmb32.exe

Filesize
448KB

MD5
7fe344d8907d6fd4095659be3b6d900b

SHA1
e6fd58de608543e78ef2f613e3791152f9d8c484

SHA256
af19b02f977a5472c315c51279a1ed5ca3f077f57b96dd9bdea2def15914647a

SHA512
99315eef69dabfdb9fa2511c45517cd088936f6fbdde8bb31a0e04199856d3aefadc93a748e83c293967028a1e263b3f7a6a56c951928786885c618bcd79498c

Download Submit
C:\Windows\SysWOW64\Gjnlha32.exe

Filesize
448KB

MD5
58206d5ddfcc396fc06ccab7561db74a

SHA1
031af9a54b999b8cdce8b312d0aad82b24eea8e4

SHA256
cd40acaaebe81233e98ff902d7d72d7816a9fef874da58f2a06a2fb9b4e22cb3

SHA512
14922251ac8e0cac6c4b86fe313aee7ab97314b1aa0c04d9116b6d808bf451ae347939d37dc73b71629820ea839f90c4d2639e1b9aa5525cc945c4c7d77a4545

Download Submit
C:\Windows\SysWOW64\Glqkefff.exe

Filesize
448KB

MD5
90f11779ba6b308261e37678f4d32bf4

SHA1
fdfdd3fab0a0dcb23b96fbd0bef72c09cc5c120c

SHA256
3c68d4586a05a570d119c16f61b0530e16f358238940154a4888ec5ab8048527

SHA512
bec2e190131dc3b0d4950aaf2ddc3eba6c2077724d021ec32b5bd203bec2e87f6463de8299a84e7410289cbeb363523477e73edc54d29204d3ebf890299cc0be

Download Submit
C:\Windows\SysWOW64\Hfamia32.exe

Filesize
448KB

MD5
b7c7b5f6c391e5d3fa7dff378b2e875d

SHA1
af48f2d1660d9a9f4783a53b795835e9d3af4fef

SHA256
2c21dc9e8ab8da2e928744903daadaa538377fe65a4f348efc0d04c78682a35e

SHA512
ff73573fab0ce95cf29d6af36e7e6a799364d022de7e257ea420a251fbd1d22932ed2987815f256e930be67d66538875cb604198806579ed073f4b0a05abecc5

Download Submit
C:\Windows\SysWOW64\Hnokjm32.exe

Filesize
448KB

MD5
7ffdebcbf8f3f91106691882a1464fec

SHA1
d25ba98473ae8cc1d1171ba82e74220e9acdd4c8

SHA256
990492553a3efc79541577338a3e4aaf343686b1f87616ec874ddb43d323bbc6

SHA512
1547a4642d1c1210d41e02acd282db57a8c9f0c6b07281c5c618e42b4e81f5b4b7ccd7865f74a3d657ed593a8dd3ae11718425578baa43790e4d17129003ff9b

Download Submit
C:\Windows\SysWOW64\Igneda32.exe

Filesize
448KB

MD5
e8085f938eb138911c2a97ace8d46800

SHA1
1b5e5e6bbd146443196b548346497c08231e2835

SHA256
cefddb0a6f289ec3c0fd545b955aa2a9cb42d074d195554b142fa1caf3cfe956

SHA512
52cb0299c588c351ba1f1c9661eed96a35bae32e4a3079e3c4933d8e8770fe49ea0d8bd80d3f2e53cf2022c70804b5bdc667fd89b7f2076abb576e507db41515

Download Submit
C:\Windows\SysWOW64\Ikhghi32.exe

Filesize
448KB

MD5
208e187215b5a12afe2691af7cf53343

SHA1
cb20b236f99c6469558c67771deaf4dbcb890f7c

SHA256
c90baf0e4517e350113de168c63cb16bf531ff5de20525c3eb3ee9c4a0de6eff

SHA512
84950451903c2353f6ff64e1d34960132a0903b7748a58802708c72cd48da30ca4ed8b601ce28ce3fe7f8f328afbc14118d500e8d90a37af0d5a48ca3ff5ff8b

Download Submit
C:\Windows\SysWOW64\Jcihjl32.exe

Filesize
448KB

MD5
4d20a62d61c9b7ba94c830ebfc90e6a1

SHA1
add82317ab71974359051d5c3948c50c98e9319b

SHA256
9d1142ec52c7ca0dfd012d7ef616fcf3f60d198ea0853e454b4b5219219f58bb

SHA512
497c03edbc0d2fce0ee2827c24d851484758bfe128bf1bbcab442262a8546ccffaa178112979f88ab61b73dbefd2e65157202635a3bcc00cd0a6fa1a257b2399

Download Submit
C:\Windows\SysWOW64\Jcoioabf.exe

Filesize
448KB

MD5
9554c817ced16d3cfc5dda017db38cd6

SHA1
dae4083a66123fdfffa8bf48bbf04a05e744f798

SHA256
5eaa3e83b7aebf3d50d7c43533fd5df4e4c12ab7b87b0a3481977546aa5b0118

SHA512
a1a0ba9742976b371a350fe9eb5092206fb555688ca1ee851736735cf40f6b55037c8fb8e7d15e0eaf6207b920269942222fcb2ec40c8589bdeefcd76e28612a

Download Submit
C:\Windows\SysWOW64\Kceoppmo.exe

Filesize
448KB

MD5
7b5abf9c9996129f39efd83a82fdff89

SHA1
247a3d11c410f47d325d68aa64250d04fd403787

SHA256
012ec54986ec63f7d1613b1613b058a59cce2807204ca58cf04b4e53e6cd71d0

SHA512
4a5f55309497fd56f62cca0ee88595dc2b55ac534e0d03b8631bb15ec820a2d1a268b37d09cdb2eb3db36a7cc47cc1487c372ee18911eaf8171682dbb05aafb1

Download Submit
C:\Windows\SysWOW64\Kjopbd32.exe

Filesize
448KB

MD5
9909ab69ad6ecbb339e3ddff8f6b73dc

SHA1
e352d3d4bcbb9e549371b5839c313a788369835c

SHA256
b5e72bf0d772e4920b2dae2aca50d2021a2c0b2c142e04e56ae500b9a1544483

SHA512
3812ae7dfbe84f1918cd86a284f385a0d9dac2ce83a037a28ae2bc74a4ed62683fecdacbeceb47b617ff0e168fd53e337864c5860325b4c9fbfe8958a740f07d

Download Submit
C:\Windows\SysWOW64\Laeoec32.exe

Filesize
448KB

MD5
cc1583a1a904c1ba0ba5b8a5aa5e259f

SHA1
49de13bc7cb40a13d5744c39b9a134ce03da7dff

SHA256
17f769f45ed6a5d65eb2118c53b828f5a117d0075551771d5777ca62858323c1

SHA512
b24c0a9a3a461a22238170b23086d9b3830a8f60e79c1c7f3a167c957b32d6ca61a6b21b5eea697cebf1801a31b00834b4b593d2bfc46ebb4a539cac1828328f

Download Submit
C:\Windows\SysWOW64\Ldanloba.exe

Filesize
448KB

MD5
8579e7fc59923cc95ad9c2356aeb8ac0

SHA1
3d9549101fb9d584aa19ef4143c7aa5cf9a11dd2

SHA256
c7a56eadb654ad9ac974f441409d6ebf1978b36c351970aee9fa004c43967b77

SHA512
c28e42e0f982acc5628c07f97616c3b217cf2d819bdad47c5607e8b254c4a49f1ad44b2e92cf599aeaba6eb532b2e0d2680b219119fe451676794a134652595d

Download Submit
C:\Windows\SysWOW64\Lhgiic32.exe

Filesize
448KB

MD5
e332226a612dfa8e2aca09eaeb6506b3

SHA1
00692fa9b9fe521360612e18a77b036dbf928185

SHA256
e44eafd2b1c42de2b29db52deaf6669403fcaf177ef05b19d2dedaa1acfc7819

SHA512
a91389e47adcadc087ac7e3a45db42f151f96dc3ed42c6f1c23f7368730354d365333837fe77aae950fbb324c6da0e6cf651dbe41e3c0b80e8aec9473f3bd237

Download Submit
C:\Windows\SysWOW64\Lmnjan32.exe

Filesize
448KB

MD5
3ee62ac8f2cf80986067014c1252d3d1

SHA1
d20f6dfb591b109dfc71fed3e8fe65afd104b288

SHA256
cf5bd5add10180f3cf4e3d29837d479729bdbabae876819f4cdfbdef619ad087

SHA512
9ba84bab64d5d7ff3fb0426bf3e731a95940293bb48807be63695d90cb7c86e896056ba391f7617d8b103c8ba489c7f028411f79708c669d9bdb913622526d21

Download Submit
C:\Windows\SysWOW64\Mgbpdgap.exe

Filesize
448KB

MD5
d765c8e1343ed29b04d0f5b962482520

SHA1
b53b4ad01d57e80e7c3d0b24354b231672cc22fe

SHA256
18e343005a13dd9192010b647ab9ce36e919baf993ecb24b74e98ca0787b6d72

SHA512
4df2f6306400c00a8c5a1895084aee26ff38ca93d7fd5d8b76caa85fce4df5b38577291b7b41961ba24e0064ecf23ce0f12a3486587258183ef1407be8e2a400

Download Submit
C:\Windows\SysWOW64\Naqqmieo.exe

Filesize
448KB

MD5
52600cc4a4f0f65497fff455adc5e3e1

SHA1
f031802719e10097bdb57ec64ba28354d0dea74d

SHA256
aa75a7a0eb5291d86b4697befb1fb5a4faaab362cd265f2b9ad43e3f7ff7b174

SHA512
eaf083cc3b06f5b9aebb137ed7d352d593bfb97c7c9a469c20874d786feba9e01eb72dbaebeb46c0cafe93065b32525e6fbf752f1962551734e312843ac84908

Download Submit
C:\Windows\SysWOW64\Ohbfeh32.exe

Filesize
448KB

MD5
5c7ebd713c6f4599d89236e347db7093

SHA1
a0416aa98c6937080713eab036a3f290136ef6e8

SHA256
62f706c2e6d452094f5906c0527d8c84c4da62ee6fff113ef5d78f6a395a94f1

SHA512
d7ac263b1bf0e3526b9ef991097ae2094b5a578c18334ef0ae0de52ab0954426e3a797f923ce578decb46bb3dbfd88152ca2ce39a8254d77275e8eb1475fb063

Download Submit
C:\Windows\SysWOW64\Opgciodi.exe

Filesize
448KB

MD5
7890427308584d8ed8427f38353de9cd

SHA1
daa26d04bfb76d11ba5282c76ff307532a3a1a98

SHA256
03454e1a5aff5784ea5482fd96024cff88039938efc4ad18caefc2679f886f40

SHA512
e34aa843b5de5704b1b566f7424182b1c20491be48920a5539149950f7693b251e16e7d5613e867a585e2f0442830cb56afe967d8267c02a12f4b1d24d116031

Download Submit
C:\Windows\SysWOW64\Pfmlok32.exe

Filesize
448KB

MD5
22c0d72a0282b8cce5cd90211f1ffa57

SHA1
add8eeb80099d20408295d7b4a3857190a9a659d

SHA256
807face3851803566ed2ad170fc9607b8a02869e16f3e6199932bc33740faafc

SHA512
239e61bf576d2ed7ff12e936d9acd09a00bea74a9d495a29eda7a31527f62ac762241486c7eed170164a39dada971362005d04a939a413635740a90bcd2a07d8

Download Submit
C:\Windows\SysWOW64\Pmefiakh.exe

Filesize
448KB

MD5
ef1b86656ec4953eefadbc5283026c0d

SHA1
85eca7efb234ed0e6828dbd235549bb8d522e329

SHA256
c789c07a53150ccce2f54e255b21cf1eadad8f107432f8adad300b6234803d24

SHA512
0549d53f41d60a19082ad7b45a417621834bbefdd7d7b4a500f1f1fce94b3f8f5885c4185d78440f48b585666c1b37ed66eb0ea4c824e2ba3a11d04850de6326

Download Submit
C:\Windows\SysWOW64\Pmjhlklg.exe

Filesize
448KB

MD5
16a9f0453abf09077280686a1043c542

SHA1
2a2b191d969451cd6b863ac7d82d35693839a91b

SHA256
13cf396f8307dce661da83d76e0ef2a77816253514b3fc77fc5685c301bb3a46

SHA512
dbca126ccfaa42098fb5334f19477f4fe73b51f5b3e5a31c2bda0674d25e81ff3fe3ee4da7d91cdcd5c4acb1f40f603eaa85d24781bebf3b04ede7a8749d134f

Download Submit
C:\Windows\SysWOW64\Poagma32.exe

Filesize
448KB

MD5
04415748cce586f096503ca44a0a3a79

SHA1
5eacc8d56eb09c7701c077ae621a73a7b8faae0e

SHA256
d0a744174901007cb2cd4ab6f97aaafee03bd1a9e57c841e038693cc70dcc09c

SHA512
c13ed0e37c5fc2a6c56298a0653aaa9fcb844c083f9edb3457a9b786036cc9288a6aa61142719be539f332e7d394a80717711b8e8265e79c4b4354b549bbd2ba

Download Submit
memory/320-426-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/400-311-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/468-17-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/468-201-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/732-338-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/732-148-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/852-237-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1012-33-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1012-206-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1060-324-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1120-242-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1120-65-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1260-50-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1260-229-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1332-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1332-81-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1332-2-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1332-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1524-249-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1620-459-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1652-467-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1660-428-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1696-188-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1696-386-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1736-90-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1736-255-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1744-305-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1772-393-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1804-267-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1828-114-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1828-291-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1832-262-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2020-478-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2184-442-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2224-680-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2224-270-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2280-358-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2280-164-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2360-87-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2372-406-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2500-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2520-30-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2760-212-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2812-352-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2920-440-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2964-285-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3128-57-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3128-239-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3208-371-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3248-203-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3368-73-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3368-244-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3456-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3456-122-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3528-277-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3528-98-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3548-282-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3608-322-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3780-330-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3784-379-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3800-349-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3848-42-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3848-223-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4084-363-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4192-404-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4200-155-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4200-345-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4344-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4344-195-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4384-366-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4384-179-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4392-106-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4392-284-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4444-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4532-238-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4636-317-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4636-130-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4764-373-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4816-468-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4900-416-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4916-138-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4916-335-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4940-391-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5012-435-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5012-215-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5068-171-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5068-365-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5076-343-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads