32049645ebbdc1f256cd673ca528615965c906dd016182e88dc3379acac0aaf8

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
30-12-2023 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c663cbc48c884e063640c98502b441e1.exe
Size

64KB
MD5

c663cbc48c884e063640c98502b441e1
SHA1

fcea36b618f748205891053ab00587012acbd0cc
SHA256

32049645ebbdc1f256cd673ca528615965c906dd016182e88dc3379acac0aaf8
SHA512

5b28709e91192efa69a77f9a9fdf2ad64eab1e9c4eb3fa9bd2d7dbb412e5e2c5e3a80ce314148251f75813eab78bebb602c61f4a878caeb040ca459a90f09eda
SSDEEP

768:NCPSj6VqzwUrW8kT8u+6XuAuvS2gRGgS5AamWTuwxG2p/1H5wk/XdnhYakM8heW:wPBcS8kYu+fAR2+Y2KTuw02Ll1AMCeW

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Palbgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edemkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gikkfqmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogekbb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adfgdpmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khiofk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Process not Found
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llgjjnlj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggilil32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afnnnd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekonpckp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egaejeej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjlgdc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nahgoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oepifi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmkkmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhahaiec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekajec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jikoopij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfkkqmiq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqcejcha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcpnhl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hhfedm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdcjlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jpkphjeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dcjnoece.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agdcpkll.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emhldnkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkbmqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mokmdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fniihmpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Haodle32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imgicgca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hlambk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aefjii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hgoeep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmnhcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgiiiidd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Conanfli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkjnfkma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgfdmlcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Embkoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bckkca32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhokljge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfgklkoc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmgjgcgo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	BackgroundTaskHost.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fehfljca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Falcae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Anobgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jllhpkfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbjlfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acilajpk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfhadc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkaobnio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dokgdkeh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nceefd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akdilipp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kocgbend.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lidmhmnp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olehhc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmpfbk32.exe

Executes dropped EXE 64 IoCs

pid	Process
2664	Kfjhkjle.exe
2032	Kpbmco32.exe
3632	Kfmepi32.exe
4864	Kmfmmcbo.exe
1856	Kbceejpf.exe
4844	Kmijbcpl.exe
1792	Kdcbom32.exe
4476	Kedoge32.exe
1680	Klngdpdd.exe
4716	Kfckahdj.exe
1832	Kibgmdcn.exe
2872	Kplpjn32.exe
1896	Lbjlfi32.exe
4220	Lmppcbjd.exe
1388	Lpnlpnih.exe
4168	Ldleel32.exe
2536	Lenamdem.exe
1428	Llgjjnlj.exe
4200	Ldoaklml.exe
1040	Lgmngglp.exe
1448	Lmgfda32.exe
3848	Lpebpm32.exe
4204	Lgokmgjm.exe
2012	Lmiciaaj.exe
5056	Lphoelqn.exe
844	Miemjaci.exe
3108	Migjoaaf.exe
2116	Mlefklpj.exe
1212	Mdmnlj32.exe
4460	Menjdbgj.exe
4532	Mnebeogl.exe
1456	Ndokbi32.exe
852	Ngmgne32.exe
1000	Nilcjp32.exe
2856	Nljofl32.exe
3504	Ndaggimg.exe
256	Ngpccdlj.exe
1128	Nebdoa32.exe
3332	Nnjlpo32.exe
3488	Nphhmj32.exe
1452	Ngbpidjh.exe
3040	Njqmepik.exe
2996	Nloiakho.exe
3724	Ndfqbhia.exe
4152	Ngdmod32.exe
3172	Njciko32.exe
1800	Npmagine.exe
2232	Nfjjppmm.exe
2348	Njefqo32.exe
4652	Oponmilc.exe
1316	Ogifjcdp.exe
1620	Olfobjbg.exe
4272	Ocpgod32.exe
5084	Ofnckp32.exe
4084	Oneklm32.exe
3296	Opdghh32.exe
3560	Odocigqg.exe
3012	Ofqpqo32.exe
4676	Onjegled.exe
3548	Oddmdf32.exe
5036	Ocgmpccl.exe
1584	Ofeilobp.exe
1756	Pnlaml32.exe
4560	Pdfjifjo.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Bnoddcef.exe	Bgelgi32.exe
File created	C:\Windows\SysWOW64\Hjfhhm32.dll	Cjinkg32.exe
File created	C:\Windows\SysWOW64\Jleqgfim.dll	Ieliebnf.exe
File opened for modification	C:\Windows\SysWOW64\Poaqemao.exe	Phhhhc32.exe
File created	C:\Windows\SysWOW64\Bqfoamfj.exe	Bjlgdc32.exe
File opened for modification	C:\Windows\SysWOW64\Bclang32.exe	Bmbiamhi.exe
File created	C:\Windows\SysWOW64\Dpphjp32.exe	Difpmfna.exe
File created	C:\Windows\SysWOW64\Leifdf32.dll	Anobgl32.exe
File created	C:\Windows\SysWOW64\Jedccfqg.exe	Jokkgl32.exe
File created	C:\Windows\SysWOW64\Ghnllm32.dll	Nmcpoedn.exe
File opened for modification	C:\Windows\SysWOW64\Igjeanmj.exe	Ieliebnf.exe
File created	C:\Windows\SysWOW64\Jiglnf32.exe	Jcmdaljn.exe
File opened for modification	C:\Windows\SysWOW64\Bpcgpihi.exe	Bmdkcnie.exe
File created	C:\Windows\SysWOW64\Gochjpho.exe	Ghipne32.exe
File created	C:\Windows\SysWOW64\Ihejacdm.dll	Kggcnoic.exe
File created	C:\Windows\SysWOW64\Dhclmp32.exe	Dnmhpg32.exe
File created	C:\Windows\SysWOW64\Opbean32.exe	Omdieb32.exe
File created	C:\Windows\SysWOW64\Olqjha32.dll	Amkhmoap.exe
File created	C:\Windows\SysWOW64\Khokadah.dll	Bbfmgd32.exe
File created	C:\Windows\SysWOW64\Mlkonq32.dll	Fhofmq32.exe
File created	C:\Windows\SysWOW64\Fpmehf32.dll	Pcjiff32.exe
File created	C:\Windows\SysWOW64\Lfojfj32.dll	Hbihjifh.exe
File created	C:\Windows\SysWOW64\Aalmimfd.exe	Aidehpea.exe
File created	C:\Windows\SysWOW64\Diphbb32.dll	Dgbdlf32.exe
File opened for modification	C:\Windows\SysWOW64\Lhijijbg.exe	Lnqeqd32.exe
File created	C:\Windows\SysWOW64\Jlfpdh32.exe	Igigla32.exe
File created	C:\Windows\SysWOW64\Adkqoohc.exe	Apodoq32.exe
File created	C:\Windows\SysWOW64\Ljgmjm32.dll	Opbean32.exe
File created	C:\Windows\SysWOW64\Hninbj32.exe	Hgoeep32.exe
File created	C:\Windows\SysWOW64\Oclkgccf.exe	Ombcji32.exe
File opened for modification	C:\Windows\SysWOW64\Gaamlecg.exe	Gijekg32.exe
File created	C:\Windows\SysWOW64\Nglhld32.exe	Nmfcok32.exe
File created	C:\Windows\SysWOW64\Ocaebc32.exe	Opeiadfg.exe
File opened for modification	C:\Windows\SysWOW64\Qfkqjmdg.exe	Pdmdnadc.exe
File opened for modification	C:\Windows\SysWOW64\Ndaggimg.exe	Nljofl32.exe
File created	C:\Windows\SysWOW64\Dcjnoece.exe	Dakacjdb.exe
File created	C:\Windows\SysWOW64\Lplhdc32.dll	Mpoefk32.exe
File created	C:\Windows\SysWOW64\Qfdngj32.dll	Hkbmqb32.exe
File created	C:\Windows\SysWOW64\Cmbgdl32.exe	Ckdkhq32.exe
File opened for modification	C:\Windows\SysWOW64\Nlnbgddc.exe	Nedjjj32.exe
File created	C:\Windows\SysWOW64\Edhjghdk.dll	Chglab32.exe
File created	C:\Windows\SysWOW64\Mmmncpmp.dll	Ieccbbkn.exe
File opened for modification	C:\Windows\SysWOW64\Lcmodajm.exe	Llcghg32.exe
File created	C:\Windows\SysWOW64\Kqjkhbpd.dll	Djdflp32.exe
File created	C:\Windows\SysWOW64\Pfogpg32.dll	Edemkd32.exe
File created	C:\Windows\SysWOW64\Pjcmhh32.dll	Dmhand32.exe
File created	C:\Windows\SysWOW64\Jddnfd32.exe	Jnjejjgh.exe
File opened for modification	C:\Windows\SysWOW64\Kofdhd32.exe	Kpccmhdg.exe
File created	C:\Windows\SysWOW64\Begndj32.dll	Process not Found
File created	C:\Windows\SysWOW64\Anobgl32.exe	Akqfkp32.exe
File opened for modification	C:\Windows\SysWOW64\Illfdc32.exe	Iohejo32.exe
File opened for modification	C:\Windows\SysWOW64\Lqkqhm32.exe	Ljqhkckn.exe
File created	C:\Windows\SysWOW64\Hpahkbdh.dll	Enkmfolf.exe
File created	C:\Windows\SysWOW64\Ccegac32.dll	Hnibokbd.exe
File created	C:\Windows\SysWOW64\Eeccjdie.dll	Kpcjgnhb.exe
File created	C:\Windows\SysWOW64\Dhbebj32.exe	Dojqjdbl.exe
File opened for modification	C:\Windows\SysWOW64\Eghkjdoa.exe	Edionhpn.exe
File opened for modification	C:\Windows\SysWOW64\Pidlqb32.exe	Pfepdg32.exe
File created	C:\Windows\SysWOW64\Nenqea32.dll	Nljofl32.exe
File created	C:\Windows\SysWOW64\Fgcodk32.dll	Khiofk32.exe
File created	C:\Windows\SysWOW64\Pqbdjfln.exe	Pncgmkmj.exe
File opened for modification	C:\Windows\SysWOW64\Lfealaol.exe	Lpkiph32.exe
File created	C:\Windows\SysWOW64\Fhofmq32.exe	Fdcjlb32.exe
File created	C:\Windows\SysWOW64\Bdgged32.exe	Bahkih32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11652	11340	Process not Found	1176

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pclgkb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bqfoamfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Achgjc32.dll"	Jnhpoamf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acilajpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jclhkbae.dll"	Njefqo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eignmpke.dll"	Inbqhhfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lhdqnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iphioh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Napjdpcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qdoacabq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgifbhid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pidlqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ogifjcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kaafjamj.dll"	Emhldnkj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gaadfkgc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hdlpneli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eehnaq32.dll"	Bnoddcef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deaiemli.dll"	Pidlqb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oponmilc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dikpbl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cihclh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nhgaocmg.dll"	Kfckahdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdijbplg.dll"	Hninbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjmmpa32.dll"	Hehdfdek.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Doaneiop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecfjqmbc.dll"	Nciopppp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kplqhmfl.dll"	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jecofa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fhofmq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhclmp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jokkgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lhenai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpkdfd32.dll"	Omfekbdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdkcde32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iqipio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odcfhh32.dll"	Giinpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qmmnjfnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dafppp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmkdjo32.dll"	Nfjola32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgcodk32.dll"	Khiofk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgjamboa.dll"	Iohejo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnbjkgmg.dll"	Jgmjmjnb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojajin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekajec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Process not Found
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oidofh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofkhpmpa.dll"	Njhgbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcclncbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpagaf32.dll"	Piapkbeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmijbcpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Enfckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Coppbe32.dll"	Hahokfag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmeafpab.dll"	Pomgjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Obnkfijp.dll"	Gadqlkep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmmanjof.dll"	Pocpfphe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpijjo32.dll"	Jgdhgmep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcdciiec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gebgohck.dll"	Lbjlfi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ppikbm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pqcjepfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Plmmif32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lindkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ljgmjm32.dll"	Opbean32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 2664	1404	c663cbc48c884e063640c98502b441e1.exe	88
PID 1404 wrote to memory of 2664	1404	c663cbc48c884e063640c98502b441e1.exe	88
PID 1404 wrote to memory of 2664	1404	c663cbc48c884e063640c98502b441e1.exe	88
PID 2664 wrote to memory of 2032	2664	Kfjhkjle.exe	89
PID 2664 wrote to memory of 2032	2664	Kfjhkjle.exe	89
PID 2664 wrote to memory of 2032	2664	Kfjhkjle.exe	89
PID 2032 wrote to memory of 3632	2032	Kpbmco32.exe	90
PID 2032 wrote to memory of 3632	2032	Kpbmco32.exe	90
PID 2032 wrote to memory of 3632	2032	Kpbmco32.exe	90
PID 3632 wrote to memory of 4864	3632	Kfmepi32.exe	91
PID 3632 wrote to memory of 4864	3632	Kfmepi32.exe	91
PID 3632 wrote to memory of 4864	3632	Kfmepi32.exe	91
PID 4864 wrote to memory of 1856	4864	Kmfmmcbo.exe	92
PID 4864 wrote to memory of 1856	4864	Kmfmmcbo.exe	92
PID 4864 wrote to memory of 1856	4864	Kmfmmcbo.exe	92
PID 1856 wrote to memory of 4844	1856	Kbceejpf.exe	230
PID 1856 wrote to memory of 4844	1856	Kbceejpf.exe	230
PID 1856 wrote to memory of 4844	1856	Kbceejpf.exe	230
PID 4844 wrote to memory of 1792	4844	Kmijbcpl.exe	229
PID 4844 wrote to memory of 1792	4844	Kmijbcpl.exe	229
PID 4844 wrote to memory of 1792	4844	Kmijbcpl.exe	229
PID 1792 wrote to memory of 4476	1792	Kdcbom32.exe	93
PID 1792 wrote to memory of 4476	1792	Kdcbom32.exe	93
PID 1792 wrote to memory of 4476	1792	Kdcbom32.exe	93
PID 4476 wrote to memory of 1680	4476	Kedoge32.exe	228
PID 4476 wrote to memory of 1680	4476	Kedoge32.exe	228
PID 4476 wrote to memory of 1680	4476	Kedoge32.exe	228
PID 1680 wrote to memory of 4716	1680	Klngdpdd.exe	94
PID 1680 wrote to memory of 4716	1680	Klngdpdd.exe	94
PID 1680 wrote to memory of 4716	1680	Klngdpdd.exe	94
PID 4716 wrote to memory of 1832	4716	Kfckahdj.exe	226
PID 4716 wrote to memory of 1832	4716	Kfckahdj.exe	226
PID 4716 wrote to memory of 1832	4716	Kfckahdj.exe	226
PID 1832 wrote to memory of 2872	1832	Kibgmdcn.exe	225
PID 1832 wrote to memory of 2872	1832	Kibgmdcn.exe	225
PID 1832 wrote to memory of 2872	1832	Kibgmdcn.exe	225
PID 2872 wrote to memory of 1896	2872	Kplpjn32.exe	95
PID 2872 wrote to memory of 1896	2872	Kplpjn32.exe	95
PID 2872 wrote to memory of 1896	2872	Kplpjn32.exe	95
PID 1896 wrote to memory of 4220	1896	Lbjlfi32.exe	224
PID 1896 wrote to memory of 4220	1896	Lbjlfi32.exe	224
PID 1896 wrote to memory of 4220	1896	Lbjlfi32.exe	224
PID 4220 wrote to memory of 1388	4220	Lmppcbjd.exe	223
PID 4220 wrote to memory of 1388	4220	Lmppcbjd.exe	223
PID 4220 wrote to memory of 1388	4220	Lmppcbjd.exe	223
PID 1388 wrote to memory of 4168	1388	Lpnlpnih.exe	221
PID 1388 wrote to memory of 4168	1388	Lpnlpnih.exe	221
PID 1388 wrote to memory of 4168	1388	Lpnlpnih.exe	221
PID 4168 wrote to memory of 2536	4168	Ldleel32.exe	220
PID 4168 wrote to memory of 2536	4168	Ldleel32.exe	220
PID 4168 wrote to memory of 2536	4168	Ldleel32.exe	220
PID 2536 wrote to memory of 1428	2536	Lenamdem.exe	96
PID 2536 wrote to memory of 1428	2536	Lenamdem.exe	96
PID 2536 wrote to memory of 1428	2536	Lenamdem.exe	96
PID 1428 wrote to memory of 4200	1428	Llgjjnlj.exe	219
PID 1428 wrote to memory of 4200	1428	Llgjjnlj.exe	219
PID 1428 wrote to memory of 4200	1428	Llgjjnlj.exe	219
PID 4200 wrote to memory of 1040	4200	Ldoaklml.exe	218
PID 4200 wrote to memory of 1040	4200	Ldoaklml.exe	218
PID 4200 wrote to memory of 1040	4200	Ldoaklml.exe	218
PID 1040 wrote to memory of 1448	1040	Lgmngglp.exe	217
PID 1040 wrote to memory of 1448	1040	Lgmngglp.exe	217
PID 1040 wrote to memory of 1448	1040	Lgmngglp.exe	217
PID 1448 wrote to memory of 3848	1448	Lmgfda32.exe	97

C:\Users\Admin\AppData\Local\Temp\c663cbc48c884e063640c98502b441e1.exe
"C:\Users\Admin\AppData\Local\Temp\c663cbc48c884e063640c98502b441e1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\Kfjhkjle.exe
  C:\Windows\system32\Kfjhkjle.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\SysWOW64\Kpbmco32.exe
    C:\Windows\system32\Kpbmco32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Windows\SysWOW64\Kfmepi32.exe
      C:\Windows\system32\Kfmepi32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3632
    - - C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4864
      - C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4844

C:\Windows\SysWOW64\Kedoge32.exe
C:\Windows\system32\Kedoge32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\SysWOW64\Klngdpdd.exe
  C:\Windows\system32\Klngdpdd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1680

C:\Windows\SysWOW64\Kfckahdj.exe
C:\Windows\system32\Kfckahdj.exe
1⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\SysWOW64\Kibgmdcn.exe
  C:\Windows\system32\Kibgmdcn.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1832

C:\Windows\SysWOW64\Lbjlfi32.exe
C:\Windows\system32\Lbjlfi32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Windows\SysWOW64\Lmppcbjd.exe
  C:\Windows\system32\Lmppcbjd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4220

C:\Windows\SysWOW64\Llgjjnlj.exe
C:\Windows\system32\Llgjjnlj.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Windows\SysWOW64\Ldoaklml.exe
  C:\Windows\system32\Ldoaklml.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4200

C:\Windows\SysWOW64\Lpebpm32.exe
C:\Windows\system32\Lpebpm32.exe
1⤵
- Executes dropped EXE
PID:3848
- C:\Windows\SysWOW64\Lgokmgjm.exe
  C:\Windows\system32\Lgokmgjm.exe
  2⤵
  - Executes dropped EXE
  PID:4204
- - C:\Windows\SysWOW64\Lmiciaaj.exe
    C:\Windows\system32\Lmiciaaj.exe
    3⤵
    - Executes dropped EXE
    PID:2012
  - - C:\Windows\SysWOW64\Lphoelqn.exe
      C:\Windows\system32\Lphoelqn.exe
      4⤵
      Executes dropped EXE
      PID:5056

C:\Windows\SysWOW64\Miemjaci.exe
C:\Windows\system32\Miemjaci.exe
1⤵
- Executes dropped EXE
PID:844
- C:\Windows\SysWOW64\Mpoefk32.exe
  C:\Windows\system32\Mpoefk32.exe
  2⤵
  - Drops file in System32 directory
  PID:2964
- - C:\Windows\SysWOW64\Migjoaaf.exe
    C:\Windows\system32\Migjoaaf.exe
    3⤵
    - Executes dropped EXE
    PID:3108

C:\Windows\SysWOW64\Mlefklpj.exe
C:\Windows\system32\Mlefklpj.exe
1⤵
- Executes dropped EXE
PID:2116
- C:\Windows\SysWOW64\Mdmnlj32.exe
  C:\Windows\system32\Mdmnlj32.exe
  2⤵
  - Executes dropped EXE
  PID:1212

C:\Windows\SysWOW64\Ngpccdlj.exe
C:\Windows\system32\Ngpccdlj.exe
1⤵
- Executes dropped EXE
PID:256
- C:\Windows\SysWOW64\Nebdoa32.exe
  C:\Windows\system32\Nebdoa32.exe
  2⤵
  - Executes dropped EXE
  PID:1128
- - C:\Windows\SysWOW64\Nnjlpo32.exe
    C:\Windows\system32\Nnjlpo32.exe
    3⤵
    - Executes dropped EXE
    PID:3332

C:\Windows\SysWOW64\Nphhmj32.exe
C:\Windows\system32\Nphhmj32.exe
1⤵
- Executes dropped EXE
PID:3488
- C:\Windows\SysWOW64\Ngbpidjh.exe
  C:\Windows\system32\Ngbpidjh.exe
  2⤵
  - Executes dropped EXE
  PID:1452
- - C:\Windows\SysWOW64\Njqmepik.exe
    C:\Windows\system32\Njqmepik.exe
    3⤵
    - Executes dropped EXE
    PID:3040

C:\Windows\SysWOW64\Nloiakho.exe
C:\Windows\system32\Nloiakho.exe
1⤵
- Executes dropped EXE
PID:2996
- C:\Windows\SysWOW64\Ndfqbhia.exe
  C:\Windows\system32\Ndfqbhia.exe
  2⤵
  - Executes dropped EXE
  PID:3724
- - C:\Windows\SysWOW64\Ngdmod32.exe
    C:\Windows\system32\Ngdmod32.exe
    3⤵
    - Executes dropped EXE
    PID:4152

C:\Windows\SysWOW64\Njciko32.exe
C:\Windows\system32\Njciko32.exe
1⤵
- Executes dropped EXE
PID:3172
- C:\Windows\SysWOW64\Npmagine.exe
  C:\Windows\system32\Npmagine.exe
  2⤵
  - Executes dropped EXE
  PID:1800

C:\Windows\SysWOW64\Nfjjppmm.exe
C:\Windows\system32\Nfjjppmm.exe
1⤵
- Executes dropped EXE
PID:2232
- C:\Windows\SysWOW64\Njefqo32.exe
  C:\Windows\system32\Njefqo32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:2348

C:\Windows\SysWOW64\Oponmilc.exe
C:\Windows\system32\Oponmilc.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:4652
- C:\Windows\SysWOW64\Ogifjcdp.exe
  C:\Windows\system32\Ogifjcdp.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:1316
- - C:\Windows\SysWOW64\Olfobjbg.exe
    C:\Windows\system32\Olfobjbg.exe
    3⤵
    - Executes dropped EXE
    PID:1620
  - - C:\Windows\SysWOW64\Ocpgod32.exe
      C:\Windows\system32\Ocpgod32.exe
      4⤵
      Executes dropped EXE
      PID:4272
    - - C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        5⤵
        Executes dropped EXE
        
        PID:5084

C:\Windows\SysWOW64\Oneklm32.exe
C:\Windows\system32\Oneklm32.exe
1⤵
- Executes dropped EXE
PID:4084
- C:\Windows\SysWOW64\Opdghh32.exe
  C:\Windows\system32\Opdghh32.exe
  2⤵
  - Executes dropped EXE
  PID:3296
- - C:\Windows\SysWOW64\Odocigqg.exe
    C:\Windows\system32\Odocigqg.exe
    3⤵
    - Executes dropped EXE
    PID:3560
  - - C:\Windows\SysWOW64\Ofqpqo32.exe
      C:\Windows\system32\Ofqpqo32.exe
      4⤵
      Executes dropped EXE
      PID:3012

C:\Windows\SysWOW64\Onjegled.exe
C:\Windows\system32\Onjegled.exe
1⤵
- Executes dropped EXE
PID:4676
- C:\Windows\SysWOW64\Oddmdf32.exe
  C:\Windows\system32\Oddmdf32.exe
  2⤵
  - Executes dropped EXE
  PID:3548

C:\Windows\SysWOW64\Ofeilobp.exe
C:\Windows\system32\Ofeilobp.exe
1⤵
- Executes dropped EXE
PID:1584
- C:\Windows\SysWOW64\Pnlaml32.exe
  C:\Windows\system32\Pnlaml32.exe
  2⤵
  - Executes dropped EXE
  PID:1756
- - C:\Windows\SysWOW64\Pdfjifjo.exe
    C:\Windows\system32\Pdfjifjo.exe
    3⤵
    - Executes dropped EXE
    PID:4560

C:\Windows\SysWOW64\Pfhfan32.exe
C:\Windows\system32\Pfhfan32.exe
1⤵
PID:4948
- C:\Windows\SysWOW64\Pmannhhj.exe
  C:\Windows\system32\Pmannhhj.exe
  2⤵
  PID:380
- - C:\Windows\SysWOW64\Pclgkb32.exe
    C:\Windows\system32\Pclgkb32.exe
    3⤵
    - Modifies registry class
    PID:5144
  - - C:\Windows\SysWOW64\Pfjcgn32.exe
      C:\Windows\system32\Pfjcgn32.exe
      4⤵
      PID:5208
    - - C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        5⤵
        
        PID:5248
      - C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        6⤵
        Modifies registry class
        
        PID:5288

C:\Windows\SysWOW64\Pflplnlg.exe
C:\Windows\system32\Pflplnlg.exe
1⤵
PID:5328
- C:\Windows\SysWOW64\Pncgmkmj.exe
  C:\Windows\system32\Pncgmkmj.exe
  2⤵
  - Drops file in System32 directory
  PID:5368
- - C:\Windows\SysWOW64\Pqbdjfln.exe
    C:\Windows\system32\Pqbdjfln.exe
    3⤵
    PID:5404
  - - C:\Windows\SysWOW64\Pcppfaka.exe
      C:\Windows\system32\Pcppfaka.exe
      4⤵
      PID:5448
    - - C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        5⤵
        
        PID:5488

C:\Windows\SysWOW64\Pmidog32.exe
C:\Windows\system32\Pmidog32.exe
1⤵
PID:5528
- C:\Windows\SysWOW64\Pdpmpdbd.exe
  C:\Windows\system32\Pdpmpdbd.exe
  2⤵
  PID:5568
- - C:\Windows\SysWOW64\Pfaigm32.exe
    C:\Windows\system32\Pfaigm32.exe
    3⤵
    PID:5608

C:\Windows\SysWOW64\Qnhahj32.exe
C:\Windows\system32\Qnhahj32.exe
1⤵
PID:5644
- C:\Windows\SysWOW64\Qqfmde32.exe
  C:\Windows\system32\Qqfmde32.exe
  2⤵
  PID:5692
- - C:\Windows\SysWOW64\Qceiaa32.exe
    C:\Windows\system32\Qceiaa32.exe
    3⤵
    PID:5732

C:\Windows\SysWOW64\Qfcfml32.exe
C:\Windows\system32\Qfcfml32.exe
1⤵
PID:5772
- C:\Windows\SysWOW64\Qnjnnj32.exe
  C:\Windows\system32\Qnjnnj32.exe
  2⤵
  PID:5812
- - C:\Windows\SysWOW64\Qmmnjfnl.exe
    C:\Windows\system32\Qmmnjfnl.exe
    3⤵
    - Modifies registry class
    PID:5864

C:\Windows\SysWOW64\Qcgffqei.exe
C:\Windows\system32\Qcgffqei.exe
1⤵
PID:5912
- C:\Windows\SysWOW64\Qffbbldm.exe
  C:\Windows\system32\Qffbbldm.exe
  2⤵
  PID:5952
- - C:\Windows\SysWOW64\Anmjcieo.exe
    C:\Windows\system32\Anmjcieo.exe
    3⤵
    PID:6000

C:\Windows\SysWOW64\Aqkgpedc.exe
C:\Windows\system32\Aqkgpedc.exe
1⤵
PID:6044
- C:\Windows\SysWOW64\Acjclpcf.exe
  C:\Windows\system32\Acjclpcf.exe
  2⤵
  PID:6084

C:\Windows\SysWOW64\Ageolo32.exe
C:\Windows\system32\Ageolo32.exe
1⤵
PID:6128
- C:\Windows\SysWOW64\Ajckij32.exe
  C:\Windows\system32\Ajckij32.exe
  2⤵
  PID:5192
- - C:\Windows\SysWOW64\Ambgef32.exe
    C:\Windows\system32\Ambgef32.exe
    3⤵
    PID:376

C:\Windows\SysWOW64\Aeiofcji.exe
C:\Windows\system32\Aeiofcji.exe
1⤵
PID:5284
- C:\Windows\SysWOW64\Aclpap32.exe
  C:\Windows\system32\Aclpap32.exe
  2⤵
  PID:5364

C:\Windows\SysWOW64\Afjlnk32.exe
C:\Windows\system32\Afjlnk32.exe
1⤵
PID:5444
- C:\Windows\SysWOW64\Anadoi32.exe
  C:\Windows\system32\Anadoi32.exe
  2⤵
  PID:5516
- - C:\Windows\SysWOW64\Agjhgngj.exe
    C:\Windows\system32\Agjhgngj.exe
    3⤵
    PID:3604
  - - C:\Windows\SysWOW64\Anfmjhmd.exe
      C:\Windows\system32\Anfmjhmd.exe
      4⤵
      PID:5636

C:\Windows\SysWOW64\Accfbokl.exe
C:\Windows\system32\Accfbokl.exe
1⤵
PID:5728
- C:\Windows\SysWOW64\Bfabnjjp.exe
  C:\Windows\system32\Bfabnjjp.exe
  2⤵
  PID:5760
- - C:\Windows\SysWOW64\Bcebhoii.exe
    C:\Windows\system32\Bcebhoii.exe
    3⤵
    PID:5840

C:\Windows\SysWOW64\Bjokdipf.exe
C:\Windows\system32\Bjokdipf.exe
1⤵
PID:5892
- C:\Windows\SysWOW64\Bmngqdpj.exe
  C:\Windows\system32\Bmngqdpj.exe
  2⤵
  PID:5992

C:\Windows\SysWOW64\Bgcknmop.exe
C:\Windows\system32\Bgcknmop.exe
1⤵
PID:6112
- C:\Windows\SysWOW64\Bjagjhnc.exe
  C:\Windows\system32\Bjagjhnc.exe
  2⤵
  PID:5188

C:\Windows\SysWOW64\Baicac32.exe
C:\Windows\system32\Baicac32.exe
1⤵
PID:6028

C:\Windows\SysWOW64\Bmpcfdmg.exe
C:\Windows\system32\Bmpcfdmg.exe
1⤵
PID:5348
- C:\Windows\SysWOW64\Bcjlcn32.exe
  C:\Windows\system32\Bcjlcn32.exe
  2⤵
  PID:5436
- - C:\Windows\SysWOW64\Bfhhoi32.exe
    C:\Windows\system32\Bfhhoi32.exe
    3⤵
    PID:5512
  - - C:\Windows\SysWOW64\Bmbplc32.exe
      C:\Windows\system32\Bmbplc32.exe
      4⤵
      PID:856
    - - C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        5⤵
        
        PID:2656

C:\Windows\SysWOW64\Bjfaeh32.exe
C:\Windows\system32\Bjfaeh32.exe
1⤵
PID:5796
- C:\Windows\SysWOW64\Bmemac32.exe
  C:\Windows\system32\Bmemac32.exe
  2⤵
  PID:5900
- - C:\Windows\SysWOW64\Belebq32.exe
    C:\Windows\system32\Belebq32.exe
    3⤵
    PID:6092

C:\Windows\SysWOW64\Chjaol32.exe
C:\Windows\system32\Chjaol32.exe
1⤵
PID:5176
- C:\Windows\SysWOW64\Cjinkg32.exe
  C:\Windows\system32\Cjinkg32.exe
  2⤵
  - Drops file in System32 directory
  PID:5356

C:\Windows\SysWOW64\Cmgjgcgo.exe
C:\Windows\system32\Cmgjgcgo.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:5496
- C:\Windows\SysWOW64\Cenahpha.exe
  C:\Windows\system32\Cenahpha.exe
  2⤵
  PID:4688
- - C:\Windows\SysWOW64\Chmndlge.exe
    C:\Windows\system32\Chmndlge.exe
    3⤵
    PID:2160
  - - C:\Windows\SysWOW64\Cfpnph32.exe
      C:\Windows\system32\Cfpnph32.exe
      4⤵
      PID:5592

C:\Windows\SysWOW64\Cmiflbel.exe
C:\Windows\system32\Cmiflbel.exe
1⤵
PID:5984
- C:\Windows\SysWOW64\Caebma32.exe
  C:\Windows\system32\Caebma32.exe
  2⤵
  PID:5140

C:\Windows\SysWOW64\Cdcoim32.exe
C:\Windows\system32\Cdcoim32.exe
1⤵
PID:4828
- C:\Windows\SysWOW64\Cjmgfgdf.exe
  C:\Windows\system32\Cjmgfgdf.exe
  2⤵
  PID:3696
- - C:\Windows\SysWOW64\Cmlcbbcj.exe
    C:\Windows\system32\Cmlcbbcj.exe
    3⤵
    PID:5780
  - - C:\Windows\SysWOW64\Cdfkolkf.exe
      C:\Windows\system32\Cdfkolkf.exe
      4⤵
      PID:4072

C:\Windows\SysWOW64\Cfdhkhjj.exe
C:\Windows\system32\Cfdhkhjj.exe
1⤵
PID:5324
- C:\Windows\SysWOW64\Cmnpgb32.exe
  C:\Windows\system32\Cmnpgb32.exe
  2⤵
  PID:5596
- - C:\Windows\SysWOW64\Ceehho32.exe
    C:\Windows\system32\Ceehho32.exe
    3⤵
    PID:5940

C:\Windows\SysWOW64\Chcddk32.exe
C:\Windows\system32\Chcddk32.exe
1⤵
PID:5508
- C:\Windows\SysWOW64\Cjbpaf32.exe
  C:\Windows\system32\Cjbpaf32.exe
  2⤵
  PID:6020
- - C:\Windows\SysWOW64\Cnnlaehj.exe
    C:\Windows\system32\Cnnlaehj.exe
    3⤵
    PID:5548

C:\Windows\SysWOW64\Calhnpgn.exe
C:\Windows\system32\Calhnpgn.exe
1⤵
PID:1096
- C:\Windows\SysWOW64\Ddjejl32.exe
  C:\Windows\system32\Ddjejl32.exe
  2⤵
  PID:5576

C:\Windows\SysWOW64\Dhfajjoj.exe
C:\Windows\system32\Dhfajjoj.exe
1⤵
PID:6180
- C:\Windows\SysWOW64\Djdmffnn.exe
  C:\Windows\system32\Djdmffnn.exe
  2⤵
  PID:6228
- - C:\Windows\SysWOW64\Dopigd32.exe
    C:\Windows\system32\Dopigd32.exe
    3⤵
    PID:6268
  - - C:\Windows\SysWOW64\Dejacond.exe
      C:\Windows\system32\Dejacond.exe
      4⤵
      PID:6312
    - - C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        5⤵
        
        PID:6356
      - C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        6⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        7⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        8⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        9⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        10⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        11⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        12⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        13⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        14⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        15⤵
        Drops file in System32 directory
        
        PID:6852
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        16⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Eecdjmfi.exe
        
        C:\Windows\system32\Eecdjmfi.exe
        17⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Egdqae32.exe
        
        C:\Windows\system32\Egdqae32.exe
        18⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Emoinpcd.exe
        
        C:\Windows\system32\Emoinpcd.exe
        19⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Eefaomcg.exe
        
        C:\Windows\system32\Eefaomcg.exe
        20⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Eggmge32.exe
        
        C:\Windows\system32\Eggmge32.exe
        21⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Eonehbjg.exe
        
        C:\Windows\system32\Eonehbjg.exe
        22⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Eehnem32.exe
        
        C:\Windows\system32\Eehnem32.exe
        23⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Ehfjah32.exe
        
        C:\Windows\system32\Ehfjah32.exe
        24⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Eopbnbhd.exe
        
        C:\Windows\system32\Eopbnbhd.exe
        25⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Ehiffh32.exe
        
        C:\Windows\system32\Ehiffh32.exe
        26⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Eobocb32.exe
        
        C:\Windows\system32\Eobocb32.exe
        27⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Eaakpm32.exe
        
        C:\Windows\system32\Eaakpm32.exe
        28⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Edpgli32.exe
        
        C:\Windows\system32\Edpgli32.exe
        29⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Ekiohclf.exe
        
        C:\Windows\system32\Ekiohclf.exe
        30⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Emhldnkj.exe
        
        C:\Windows\system32\Emhldnkj.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6976
        
        C:\Windows\SysWOW64\Fhmpagkp.exe
        
        C:\Windows\system32\Fhmpagkp.exe
        32⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Fkqeib32.exe
        
        C:\Windows\system32\Fkqeib32.exe
        33⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Fajnfl32.exe
        
        C:\Windows\system32\Fajnfl32.exe
        34⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Fggfnc32.exe
        
        C:\Windows\system32\Fggfnc32.exe
        35⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Fonnop32.exe
        
        C:\Windows\system32\Fonnop32.exe
        36⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Fehfljca.exe
        
        C:\Windows\system32\Fehfljca.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6248
        
        C:\Windows\SysWOW64\Fhgbhfbe.exe
        
        C:\Windows\system32\Fhgbhfbe.exe
        38⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Fkeodaai.exe
        
        C:\Windows\system32\Fkeodaai.exe
        39⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Gekcaj32.exe
        
        C:\Windows\system32\Gekcaj32.exe
        40⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Ghipne32.exe
        
        C:\Windows\system32\Ghipne32.exe
        41⤵
        Drops file in System32 directory
        
        PID:6864
        
        C:\Windows\SysWOW64\Gochjpho.exe
        
        C:\Windows\system32\Gochjpho.exe
        42⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Gaadfkgc.exe
        
        C:\Windows\system32\Gaadfkgc.exe
        43⤵
        Modifies registry class
        
        PID:6376
        
        C:\Windows\SysWOW64\Gdppbfff.exe
        
        C:\Windows\system32\Gdppbfff.exe
        44⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Gkjhoq32.exe
        
        C:\Windows\system32\Gkjhoq32.exe
        45⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Goedpofl.exe
        
        C:\Windows\system32\Goedpofl.exe
        46⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Gadqlkep.exe
        
        C:\Windows\system32\Gadqlkep.exe
        47⤵
        Modifies registry class
        
        PID:6340
        
        C:\Windows\SysWOW64\Ghniielm.exe
        
        C:\Windows\system32\Ghniielm.exe
        48⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Gafmaj32.exe
        
        C:\Windows\system32\Gafmaj32.exe
        49⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Gfdfgiid.exe
        
        C:\Windows\system32\Gfdfgiid.exe
        50⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Goljqnpd.exe
        
        C:\Windows\system32\Goljqnpd.exe
        51⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Hheoid32.exe
        
        C:\Windows\system32\Hheoid32.exe
        52⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Hghoeqmp.exe
        
        C:\Windows\system32\Hghoeqmp.exe
        53⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Hdlpneli.exe
        
        C:\Windows\system32\Hdlpneli.exe
        54⤵
        Modifies registry class
        
        PID:7260
        
        C:\Windows\SysWOW64\Hgjljpkm.exe
        
        C:\Windows\system32\Hgjljpkm.exe
        55⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Hoadkn32.exe
        
        C:\Windows\system32\Hoadkn32.exe
        56⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Hocqam32.exe
        
        C:\Windows\system32\Hocqam32.exe
        57⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Hgoeep32.exe
        
        C:\Windows\system32\Hgoeep32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7420
        
        C:\Windows\SysWOW64\Hninbj32.exe
        
        C:\Windows\system32\Hninbj32.exe
        59⤵
        Modifies registry class
        
        PID:7460
        
        C:\Windows\SysWOW64\Hfpecg32.exe
        
        C:\Windows\system32\Hfpecg32.exe
        60⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Hgabkoee.exe
        
        C:\Windows\system32\Hgabkoee.exe
        61⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Iohjlmeg.exe
        
        C:\Windows\system32\Iohjlmeg.exe
        62⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Ifbbig32.exe
        
        C:\Windows\system32\Ifbbig32.exe
        63⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Iokgal32.exe
        
        C:\Windows\system32\Iokgal32.exe
        64⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Ifdonfka.exe
        
        C:\Windows\system32\Ifdonfka.exe
        65⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Igfkfo32.exe
        
        C:\Windows\system32\Igfkfo32.exe
        66⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Ikaggmii.exe
        
        C:\Windows\system32\Ikaggmii.exe
        67⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Inbqhhfj.exe
        
        C:\Windows\system32\Inbqhhfj.exe
        68⤵
        Modifies registry class
        
        PID:7832
        
        C:\Windows\SysWOW64\Ieliebnf.exe
        
        C:\Windows\system32\Ieliebnf.exe
        69⤵
        Drops file in System32 directory
        
        PID:7888
        
        C:\Windows\SysWOW64\Igjeanmj.exe
        
        C:\Windows\system32\Igjeanmj.exe
        70⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Ibpiogmp.exe
        
        C:\Windows\system32\Ibpiogmp.exe
        71⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Ienekbld.exe
        
        C:\Windows\system32\Ienekbld.exe
        72⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Jkhngl32.exe
        
        C:\Windows\system32\Jkhngl32.exe
        73⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Jngjch32.exe
        
        C:\Windows\system32\Jngjch32.exe
        74⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Jilnqqbj.exe
        
        C:\Windows\system32\Jilnqqbj.exe
        75⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Jkkjmlan.exe
        
        C:\Windows\system32\Jkkjmlan.exe
        76⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Jecofa32.exe
        
        C:\Windows\system32\Jecofa32.exe
        77⤵
        Modifies registry class
        
        PID:7204
        
        C:\Windows\SysWOW64\Jgakbm32.exe
        
        C:\Windows\system32\Jgakbm32.exe
        78⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Jnkcogno.exe
        
        C:\Windows\system32\Jnkcogno.exe
        79⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\Jfbkpd32.exe
        
        C:\Windows\system32\Jfbkpd32.exe
        80⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Jgdhgmep.exe
        
        C:\Windows\system32\Jgdhgmep.exe
        81⤵
        Modifies registry class
        
        PID:7496
        
        C:\Windows\SysWOW64\Jpkphjeb.exe
        
        C:\Windows\system32\Jpkphjeb.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7552
        
        C:\Windows\SysWOW64\Jicdap32.exe
        
        C:\Windows\system32\Jicdap32.exe
        83⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Jgfdmlcm.exe
        
        C:\Windows\system32\Jgfdmlcm.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7708
        
        C:\Windows\SysWOW64\Jnpmjf32.exe
        
        C:\Windows\system32\Jnpmjf32.exe
        85⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Jejefqaf.exe
        
        C:\Windows\system32\Jejefqaf.exe
        86⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Kldmckic.exe
        
        C:\Windows\system32\Kldmckic.exe
        87⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Kngcje32.exe
        
        C:\Windows\system32\Kngcje32.exe
        88⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Klkcdj32.exe
        
        C:\Windows\system32\Klkcdj32.exe
        89⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Knippe32.exe
        
        C:\Windows\system32\Knippe32.exe
        90⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Knlleepl.exe
        
        C:\Windows\system32\Knlleepl.exe
        91⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Kefdbo32.exe
        
        C:\Windows\system32\Kefdbo32.exe
        92⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Lhdqnj32.exe
        
        C:\Windows\system32\Lhdqnj32.exe
        93⤵
        Modifies registry class
        
        PID:3688
        
        C:\Windows\SysWOW64\Lpkiph32.exe
        
        C:\Windows\system32\Lpkiph32.exe
        94⤵
        Drops file in System32 directory
        
        PID:7492
        
        C:\Windows\SysWOW64\Lfealaol.exe
        
        C:\Windows\system32\Lfealaol.exe
        95⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Lidmhmnp.exe
        
        C:\Windows\system32\Lidmhmnp.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7660
        
        C:\Windows\SysWOW64\Lnqeqd32.exe
        
        C:\Windows\system32\Lnqeqd32.exe
        97⤵
        Drops file in System32 directory
        
        PID:7784
        
        C:\Windows\SysWOW64\Lhijijbg.exe
        
        C:\Windows\system32\Lhijijbg.exe
        98⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Lppbkgcj.exe
        
        C:\Windows\system32\Lppbkgcj.exe
        99⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Llgcph32.exe
        
        C:\Windows\system32\Llgcph32.exe
        100⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Lbqklb32.exe
        
        C:\Windows\system32\Lbqklb32.exe
        101⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Likcilhh.exe
        
        C:\Windows\system32\Likcilhh.exe
        102⤵
        
        PID:2720
        
        C:\Windows\SysWOW64\Lpekef32.exe
        
        C:\Windows\system32\Lpekef32.exe
        103⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Leadnm32.exe
        
        C:\Windows\system32\Leadnm32.exe
        104⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Mlklkgei.exe
        
        C:\Windows\system32\Mlklkgei.exe
        105⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Mfaqhp32.exe
        
        C:\Windows\system32\Mfaqhp32.exe
        106⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Mpieqeko.exe
        
        C:\Windows\system32\Mpieqeko.exe
        107⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Mbhamajc.exe
        
        C:\Windows\system32\Mbhamajc.exe
        108⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Mlpeff32.exe
        
        C:\Windows\system32\Mlpeff32.exe
        109⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Moobbb32.exe
        
        C:\Windows\system32\Moobbb32.exe
        110⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Mehjol32.exe
        
        C:\Windows\system32\Mehjol32.exe
        111⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Mlbbkfoq.exe
        
        C:\Windows\system32\Mlbbkfoq.exe
        112⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Npchgdcd.exe
        
        C:\Windows\system32\Npchgdcd.exe
        113⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Niklpj32.exe
        
        C:\Windows\system32\Niklpj32.exe
        114⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\Ngomin32.exe
        
        C:\Windows\system32\Ngomin32.exe
        115⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\Nhpiafnm.exe
        
        C:\Windows\system32\Nhpiafnm.exe
        116⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\Nojanpej.exe
        
        C:\Windows\system32\Nojanpej.exe
        117⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\Nedjjj32.exe
        
        C:\Windows\system32\Nedjjj32.exe
        118⤵
        Drops file in System32 directory
        
        PID:4432
        
        C:\Windows\SysWOW64\Nlnbgddc.exe
        
        C:\Windows\system32\Nlnbgddc.exe
        119⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\Nomncpcg.exe
        
        C:\Windows\system32\Nomncpcg.exe
        120⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\Ngdfdmdi.exe
        
        C:\Windows\system32\Ngdfdmdi.exe
        121⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\Nibbqicm.exe
        
        C:\Windows\system32\Nibbqicm.exe
        122⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\Nplkmckj.exe
        
        C:\Windows\system32\Nplkmckj.exe
        123⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Ogfcjm32.exe
        
        C:\Windows\system32\Ogfcjm32.exe
        124⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Oidofh32.exe
        
        C:\Windows\system32\Oidofh32.exe
        125⤵
        Modifies registry class
        
        PID:8324
        
        C:\Windows\SysWOW64\Opogbbig.exe
        
        C:\Windows\system32\Opogbbig.exe
        126⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Ocmconhk.exe
        
        C:\Windows\system32\Ocmconhk.exe
        127⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Oigllh32.exe
        
        C:\Windows\system32\Oigllh32.exe
        128⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Olehhc32.exe
        
        C:\Windows\system32\Olehhc32.exe
        129⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8516
        
        C:\Windows\SysWOW64\Ohlimd32.exe
        
        C:\Windows\system32\Ohlimd32.exe
        130⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Oepifi32.exe
        
        C:\Windows\system32\Oepifi32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8628
        
        C:\Windows\SysWOW64\Oljaccjf.exe
        
        C:\Windows\system32\Oljaccjf.exe
        132⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Ojnblg32.exe
        
        C:\Windows\system32\Ojnblg32.exe
        133⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Ophjiaql.exe
        
        C:\Windows\system32\Ophjiaql.exe
        134⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Phcomcng.exe
        
        C:\Windows\system32\Phcomcng.exe
        135⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Pomgjn32.exe
        
        C:\Windows\system32\Pomgjn32.exe
        136⤵
        Modifies registry class
        
        PID:8852
        
        C:\Windows\SysWOW64\Pgdokkfg.exe
        
        C:\Windows\system32\Pgdokkfg.exe
        137⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Pjbkgfej.exe
        
        C:\Windows\system32\Pjbkgfej.exe
        138⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Phelcc32.exe
        
        C:\Windows\system32\Phelcc32.exe
        139⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Ppmcdq32.exe
        
        C:\Windows\system32\Ppmcdq32.exe
        140⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Pckppl32.exe
        
        C:\Windows\system32\Pckppl32.exe
        141⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Phhhhc32.exe
        
        C:\Windows\system32\Phhhhc32.exe
        142⤵
        Drops file in System32 directory
        
        PID:9128
        
        C:\Windows\SysWOW64\Poaqemao.exe
        
        C:\Windows\system32\Poaqemao.exe
        143⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Pcmlfl32.exe
        
        C:\Windows\system32\Pcmlfl32.exe
        144⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Pflibgil.exe
        
        C:\Windows\system32\Pflibgil.exe
        145⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Phjenbhp.exe
        
        C:\Windows\system32\Phjenbhp.exe
        146⤵
        
        PID:8376

C:\Windows\SysWOW64\Bhhdil32.exe
C:\Windows\system32\Bhhdil32.exe
1⤵
PID:5628

C:\Windows\SysWOW64\Ocgmpccl.exe
C:\Windows\system32\Ocgmpccl.exe
1⤵
- Executes dropped EXE
PID:5036

C:\Windows\SysWOW64\Ndaggimg.exe
C:\Windows\system32\Ndaggimg.exe
1⤵
- Executes dropped EXE
PID:3504

C:\Windows\SysWOW64\Nljofl32.exe
C:\Windows\system32\Nljofl32.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2856

C:\Windows\SysWOW64\Nilcjp32.exe
C:\Windows\system32\Nilcjp32.exe
1⤵
- Executes dropped EXE
PID:1000

C:\Windows\SysWOW64\Ngmgne32.exe
C:\Windows\system32\Ngmgne32.exe
1⤵
- Executes dropped EXE
PID:852

C:\Windows\SysWOW64\Ndokbi32.exe
C:\Windows\system32\Ndokbi32.exe
1⤵
- Executes dropped EXE
PID:1456

C:\Windows\SysWOW64\Mnebeogl.exe
C:\Windows\system32\Mnebeogl.exe
1⤵
- Executes dropped EXE
PID:4532

C:\Windows\SysWOW64\Menjdbgj.exe
C:\Windows\system32\Menjdbgj.exe
1⤵
- Executes dropped EXE
PID:4460

C:\Windows\SysWOW64\Lmgfda32.exe
C:\Windows\system32\Lmgfda32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\SysWOW64\Lgmngglp.exe
C:\Windows\system32\Lgmngglp.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040

C:\Windows\SysWOW64\Lenamdem.exe
C:\Windows\system32\Lenamdem.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536

C:\Windows\SysWOW64\Ldleel32.exe
C:\Windows\system32\Ldleel32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168

C:\Windows\SysWOW64\Lpnlpnih.exe
C:\Windows\system32\Lpnlpnih.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\Kplpjn32.exe
C:\Windows\system32\Kplpjn32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2872

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4948

C:\Windows\SysWOW64\Kdcbom32.exe
C:\Windows\system32\Kdcbom32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792

C:\Windows\SysWOW64\Ppamophb.exe
C:\Windows\system32\Ppamophb.exe
1⤵
PID:8444
- C:\Windows\SysWOW64\Pgkelj32.exe
  C:\Windows\system32\Pgkelj32.exe
  2⤵
  PID:8512
- - C:\Windows\SysWOW64\Pqcjepfo.exe
    C:\Windows\system32\Pqcjepfo.exe
    3⤵
    - Modifies registry class
    PID:8620
  - - C:\Windows\SysWOW64\Qcbfakec.exe
      C:\Windows\system32\Qcbfakec.exe
      4⤵
      PID:8684
    - - C:\Windows\SysWOW64\Qfpbmfdf.exe
        
        C:\Windows\system32\Qfpbmfdf.exe
        5⤵
        
        PID:8740
      - C:\Windows\SysWOW64\Qjlnnemp.exe
        
        C:\Windows\system32\Qjlnnemp.exe
        6⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Qqffjo32.exe
        
        C:\Windows\system32\Qqffjo32.exe
        7⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Qcdbfk32.exe
        
        C:\Windows\system32\Qcdbfk32.exe
        8⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Qhakoa32.exe
        
        C:\Windows\system32\Qhakoa32.exe
        9⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Aokcklid.exe
        
        C:\Windows\system32\Aokcklid.exe
        10⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Amodep32.exe
        
        C:\Windows\system32\Amodep32.exe
        11⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Aqkpeopg.exe
        
        C:\Windows\system32\Aqkpeopg.exe
        12⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Acilajpk.exe
        
        C:\Windows\system32\Acilajpk.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8440
        
        C:\Windows\SysWOW64\Afghneoo.exe
        
        C:\Windows\system32\Afghneoo.exe
        14⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Aopmfk32.exe
        
        C:\Windows\system32\Aopmfk32.exe
        15⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Afnnnd32.exe
        
        C:\Windows\system32\Afnnnd32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8748
        
        C:\Windows\SysWOW64\Aimkjp32.exe
        
        C:\Windows\system32\Aimkjp32.exe
        17⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Bqdblmhl.exe
        
        C:\Windows\system32\Bqdblmhl.exe
        18⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Bgnkhg32.exe
        
        C:\Windows\system32\Bgnkhg32.exe
        19⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Bjlgdc32.exe
        
        C:\Windows\system32\Bjlgdc32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8276
        
        C:\Windows\SysWOW64\Bqfoamfj.exe
        
        C:\Windows\system32\Bqfoamfj.exe
        21⤵
        Modifies registry class
        
        PID:8420
        
        C:\Windows\SysWOW64\Bgpgng32.exe
        
        C:\Windows\system32\Bgpgng32.exe
        22⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Bgbdcgld.exe
        
        C:\Windows\system32\Bgbdcgld.exe
        23⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Bmomlnjk.exe
        
        C:\Windows\system32\Bmomlnjk.exe
        24⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Bfhadc32.exe
        
        C:\Windows\system32\Bfhadc32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8204
        
        C:\Windows\SysWOW64\Bmbiamhi.exe
        
        C:\Windows\system32\Bmbiamhi.exe
        26⤵
        Drops file in System32 directory
        
        PID:3584
        
        C:\Windows\SysWOW64\Bclang32.exe
        
        C:\Windows\system32\Bclang32.exe
        27⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Bfjnjcni.exe
        
        C:\Windows\system32\Bfjnjcni.exe
        28⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Bjfjka32.exe
        
        C:\Windows\system32\Bjfjka32.exe
        29⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\Cpbbch32.exe
        
        C:\Windows\system32\Cpbbch32.exe
        30⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Cflkpblf.exe
        
        C:\Windows\system32\Cflkpblf.exe
        31⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Cmfclm32.exe
        
        C:\Windows\system32\Cmfclm32.exe
        32⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Cpeohh32.exe
        
        C:\Windows\system32\Cpeohh32.exe
        33⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Cfogeb32.exe
        
        C:\Windows\system32\Cfogeb32.exe
        34⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Cmipblaq.exe
        
        C:\Windows\system32\Cmipblaq.exe
        35⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Caghhk32.exe
        
        C:\Windows\system32\Caghhk32.exe
        36⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Cceddf32.exe
        
        C:\Windows\system32\Cceddf32.exe
        37⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Cjomap32.exe
        
        C:\Windows\system32\Cjomap32.exe
        38⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Ccgajfeh.exe
        
        C:\Windows\system32\Ccgajfeh.exe
        39⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Cffmfadl.exe
        
        C:\Windows\system32\Cffmfadl.exe
        40⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Dmpfbk32.exe
        
        C:\Windows\system32\Dmpfbk32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9528
        
        C:\Windows\SysWOW64\Dakacjdb.exe
        
        C:\Windows\system32\Dakacjdb.exe
        42⤵
        Drops file in System32 directory
        
        PID:9564
        
        C:\Windows\SysWOW64\Dcjnoece.exe
        
        C:\Windows\system32\Dcjnoece.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9604
        
        C:\Windows\SysWOW64\Djdflp32.exe
        
        C:\Windows\system32\Djdflp32.exe
        44⤵
        Drops file in System32 directory
        
        PID:9652
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        45⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Dannij32.exe
        
        C:\Windows\system32\Dannij32.exe
        46⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Djfcaohp.exe
        
        C:\Windows\system32\Djfcaohp.exe
        47⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Dapkni32.exe
        
        C:\Windows\system32\Dapkni32.exe
        48⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Dcogje32.exe
        
        C:\Windows\system32\Dcogje32.exe
        49⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Dikpbl32.exe
        
        C:\Windows\system32\Dikpbl32.exe
        50⤵
        Modifies registry class
        
        PID:9928
        
        C:\Windows\SysWOW64\Dabhdinj.exe
        
        C:\Windows\system32\Dabhdinj.exe
        51⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Dfoplpla.exe
        
        C:\Windows\system32\Dfoplpla.exe
        52⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Dmihij32.exe
        
        C:\Windows\system32\Dmihij32.exe
        53⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Dhomfc32.exe
        
        C:\Windows\system32\Dhomfc32.exe
        54⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Djmibn32.exe
        
        C:\Windows\system32\Djmibn32.exe
        55⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Emlenj32.exe
        
        C:\Windows\system32\Emlenj32.exe
        56⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Edemkd32.exe
        
        C:\Windows\system32\Edemkd32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10232
        
        C:\Windows\SysWOW64\Empoiimf.exe
        
        C:\Windows\system32\Empoiimf.exe
        58⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Epokedmj.exe
        
        C:\Windows\system32\Epokedmj.exe
        59⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Embkoi32.exe
        
        C:\Windows\system32\Embkoi32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9388
        
        C:\Windows\SysWOW64\Eiildjag.exe
        
        C:\Windows\system32\Eiildjag.exe
        61⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Fmgejhgn.exe
        
        C:\Windows\system32\Fmgejhgn.exe
        62⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Fdamgb32.exe
        
        C:\Windows\system32\Fdamgb32.exe
        63⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        64⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Fmjaphek.exe
        
        C:\Windows\system32\Fmjaphek.exe
        65⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Fdcjlb32.exe
        
        C:\Windows\system32\Fdcjlb32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9760
        
        C:\Windows\SysWOW64\Fhofmq32.exe
        
        C:\Windows\system32\Fhofmq32.exe
        67⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9824
        
        C:\Windows\SysWOW64\Fpjjac32.exe
        
        C:\Windows\system32\Fpjjac32.exe
        68⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Fajgkfio.exe
        
        C:\Windows\system32\Fajgkfio.exe
        69⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Fpmggb32.exe
        
        C:\Windows\system32\Fpmggb32.exe
        70⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Fhdohp32.exe
        
        C:\Windows\system32\Fhdohp32.exe
        71⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Falcae32.exe
        
        C:\Windows\system32\Falcae32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10092
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        73⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Ggilil32.exe
        
        C:\Windows\system32\Ggilil32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10212
        
        C:\Windows\SysWOW64\Gkdhjknm.exe
        
        C:\Windows\system32\Gkdhjknm.exe
        75⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        76⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Gpaqbbld.exe
        
        C:\Windows\system32\Gpaqbbld.exe
        77⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Ghhhcomg.exe
        
        C:\Windows\system32\Ghhhcomg.exe
        78⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Gijekg32.exe
        
        C:\Windows\system32\Gijekg32.exe
        79⤵
        Drops file in System32 directory
        
        PID:9680
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        80⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Gdoihpbk.exe
        
        C:\Windows\system32\Gdoihpbk.exe
        81⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Gkiaej32.exe
        
        C:\Windows\system32\Gkiaej32.exe
        82⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Hhfedm32.exe
        
        C:\Windows\system32\Hhfedm32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10000
        
        C:\Windows\SysWOW64\Hjlkge32.exe
        
        C:\Windows\system32\Hjlkge32.exe
        84⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Iqipio32.exe
        
        C:\Windows\system32\Iqipio32.exe
        85⤵
        Modifies registry class
        
        PID:9284
        
        C:\Windows\SysWOW64\Ihphkl32.exe
        
        C:\Windows\system32\Ihphkl32.exe
        86⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Inomhbeq.exe
        
        C:\Windows\system32\Inomhbeq.exe
        87⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Idkbkl32.exe
        
        C:\Windows\system32\Idkbkl32.exe
        88⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        89⤵
        Modifies registry class
        
        PID:9868
        
        C:\Windows\SysWOW64\Kbpkkn32.exe
        
        C:\Windows\system32\Kbpkkn32.exe
        90⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        91⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        92⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        93⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        94⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Milidebi.exe
        
        C:\Windows\system32\Milidebi.exe
        95⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Mlbkap32.exe
        
        C:\Windows\system32\Mlbkap32.exe
        96⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Nhkikq32.exe
        
        C:\Windows\system32\Nhkikq32.exe
        97⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        98⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\Nahgoe32.exe
        
        C:\Windows\system32\Nahgoe32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6536
        
        C:\Windows\SysWOW64\Nhbolp32.exe
        
        C:\Windows\system32\Nhbolp32.exe
        100⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Nhdlao32.exe
        
        C:\Windows\system32\Nhdlao32.exe
        101⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        102⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        103⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Ooejohhq.exe
        
        C:\Windows\system32\Ooejohhq.exe
        104⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Oklkdi32.exe
        
        C:\Windows\system32\Oklkdi32.exe
        105⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        106⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\Pahpfc32.exe
        
        C:\Windows\system32\Pahpfc32.exe
        107⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Piphgq32.exe
        
        C:\Windows\system32\Piphgq32.exe
        108⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Pcjiff32.exe
        
        C:\Windows\system32\Pcjiff32.exe
        109⤵
        Drops file in System32 directory
        
        PID:10556
        
        C:\Windows\SysWOW64\Pcmeke32.exe
        
        C:\Windows\system32\Pcmeke32.exe
        110⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Pifnhpmi.exe
        
        C:\Windows\system32\Pifnhpmi.exe
        111⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        112⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Qkjgegae.exe
        
        C:\Windows\system32\Qkjgegae.exe
        113⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Allpejfe.exe
        
        C:\Windows\system32\Allpejfe.exe
        114⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Aojlaeei.exe
        
        C:\Windows\system32\Aojlaeei.exe
        115⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        116⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Acmobchj.exe
        
        C:\Windows\system32\Acmobchj.exe
        117⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\Acokhc32.exe
        
        C:\Windows\system32\Acokhc32.exe
        118⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        119⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Bhoqeibl.exe
        
        C:\Windows\system32\Bhoqeibl.exe
        120⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Bhcjqinf.exe
        
        C:\Windows\system32\Bhcjqinf.exe
        121⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Bkafmd32.exe
        
        C:\Windows\system32\Bkafmd32.exe
        122⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Bfgjjm32.exe
        
        C:\Windows\system32\Bfgjjm32.exe
        123⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        124⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Bckkca32.exe
        
        C:\Windows\system32\Bckkca32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11236
        
        C:\Windows\SysWOW64\Bbnkonbd.exe
        
        C:\Windows\system32\Bbnkonbd.exe
        126⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        127⤵
        Modifies registry class
        
        PID:10308
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        128⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        129⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        130⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Coknoaic.exe
        
        C:\Windows\system32\Coknoaic.exe
        131⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Dkbocbog.exe
        
        C:\Windows\system32\Dkbocbog.exe
        132⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        133⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        134⤵
        Drops file in System32 directory
        
        PID:10844
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        135⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        136⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        137⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        138⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        139⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Dmhand32.exe
        
        C:\Windows\system32\Dmhand32.exe
        140⤵
        Drops file in System32 directory
        
        PID:10252
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        141⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        142⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        143⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        144⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        145⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        146⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        147⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        148⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        149⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        150⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        151⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        152⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        153⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        154⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Fjohde32.exe
        
        C:\Windows\system32\Fjohde32.exe
        155⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        156⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Fbjmhh32.exe
        
        C:\Windows\system32\Fbjmhh32.exe
        157⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        158⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        159⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        160⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        161⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        162⤵
        Modifies registry class
        
        PID:11268
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        163⤵
        
        PID:11316
        
        C:\Windows\SysWOW64\Gdobnj32.exe
        
        C:\Windows\system32\Gdobnj32.exe
        164⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Gfmojenc.exe
        
        C:\Windows\system32\Gfmojenc.exe
        165⤵
        
        PID:11408
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11452
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        167⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        168⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        169⤵
        
        PID:11584
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        170⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        171⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        172⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11764
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        174⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11844
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        176⤵
        
        PID:11892
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        177⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        178⤵
        
        PID:11984
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        179⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        180⤵
        Modifies registry class
        
        PID:12072
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        181⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        182⤵
        
        PID:12168
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        183⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        184⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        185⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        186⤵
        Drops file in System32 directory
        
        PID:11292
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        187⤵
        
        PID:11376
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        188⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        189⤵
        
        PID:11532
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        190⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        191⤵
        Drops file in System32 directory
        
        PID:11676
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        192⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        193⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        194⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        195⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        196⤵
        Drops file in System32 directory
        
        PID:12016
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        197⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        198⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12244
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1380
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        201⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        202⤵
        
        PID:11464
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        203⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        204⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11776
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        206⤵
        
        PID:11908
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        207⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        208⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        209⤵
        
        PID:752
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        210⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        211⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        212⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        213⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        214⤵
        Modifies registry class
        
        PID:3860
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        215⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        216⤵
        
        PID:12200
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        217⤵
        
        PID:12272
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        218⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        219⤵
        
        PID:11420
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11568
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        221⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        222⤵
        
        PID:640
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11840
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        224⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        225⤵
        Modifies registry class
        
        PID:1248
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        226⤵
        
        PID:4000
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        227⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        228⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        229⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3288
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        231⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        232⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        233⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        234⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        235⤵
        
        PID:11400
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        236⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        237⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        238⤵
        Modifies registry class
        
        PID:616
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        239⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        240⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        241⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        242⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        243⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        244⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        245⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        246⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        247⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        248⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        249⤵
        Drops file in System32 directory
        
        PID:5260
        
        C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12020
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2204
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        252⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        253⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        254⤵
        
        PID:720
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        255⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        256⤵
        
        PID:12196
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        257⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        258⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        259⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        260⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        261⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        262⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        263⤵
        
        PID:11876
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        264⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        265⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        266⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        267⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        268⤵
        Drops file in System32 directory
        
        PID:5236
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        269⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5488
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        271⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        272⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        273⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        274⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        275⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        276⤵
        Drops file in System32 directory
        
        PID:5104
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        277⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        278⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        279⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        280⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        281⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        282⤵
        
        PID:844
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        283⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        284⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        285⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        286⤵
        
        PID:11460
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        287⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11712
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        289⤵
        Drops file in System32 directory
        
        PID:5836
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        290⤵
        Modifies registry class
        
        PID:2100
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        291⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        292⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        293⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        294⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        295⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        296⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        297⤵
        Modifies registry class
        
        PID:5392
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        298⤵
        
        PID:848
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        299⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        300⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        301⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        302⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        303⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        304⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        305⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        306⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        307⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        308⤵
        
        PID:984
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        309⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        310⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        311⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        312⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        313⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        314⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        315⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        316⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5884
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        318⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5292
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        319⤵
        
        PID:816
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        320⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        321⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        322⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        323⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        324⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        325⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        326⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        327⤵
        
        PID:420
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        328⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        329⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        330⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        331⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        332⤵
        Drops file in System32 directory
        
        PID:5264
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        333⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        334⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        335⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        336⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        337⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        338⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        339⤵
        Modifies registry class
        
        PID:5524
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        340⤵
        
        PID:224
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        341⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        342⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        343⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        344⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        345⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        346⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        347⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7076
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        348⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        349⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        350⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        351⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        352⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        353⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        354⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        355⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        356⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7304
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        358⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        359⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        360⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        361⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        362⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        363⤵
        Drops file in System32 directory
        
        PID:7856
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        364⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        365⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        366⤵
        Modifies registry class
        
        PID:4152
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        367⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        368⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        369⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        370⤵
        Drops file in System32 directory
        
        PID:8164
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        371⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        372⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        373⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        374⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        375⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        376⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        377⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        378⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        379⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        380⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        381⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        382⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        383⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        384⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        385⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        386⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        387⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7292
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        389⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        390⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        391⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        392⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        393⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        394⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        395⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        396⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        397⤵
        Modifies registry class
        
        PID:7420
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        398⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        399⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        400⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        401⤵
        Modifies registry class
        
        PID:6232
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        402⤵
        Drops file in System32 directory
        
        PID:7984
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        403⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        404⤵
        
        PID:308
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        405⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        406⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        407⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        408⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        409⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7800
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        411⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        412⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        413⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        414⤵
        Modifies registry class
        
        PID:7720
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        415⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        416⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        417⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        418⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6340
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        419⤵
        Drops file in System32 directory
        
        PID:7440
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        420⤵
        
        PID:708
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        421⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        422⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        423⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        424⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        425⤵
        Drops file in System32 directory
        
        PID:6140
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        426⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        427⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        428⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        429⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        430⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        431⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        432⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        433⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        434⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        435⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        436⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        437⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        438⤵
        
        PID:8448

C:\Windows\SysWOW64\Pdmdnadc.exe
C:\Windows\system32\Pdmdnadc.exe
1⤵
- Drops file in System32 directory
PID:3104
- C:\Windows\SysWOW64\Qfkqjmdg.exe
  C:\Windows\system32\Qfkqjmdg.exe
  2⤵
  PID:908
- - C:\Windows\SysWOW64\Qmeigg32.exe
    C:\Windows\system32\Qmeigg32.exe
    3⤵
    PID:7996
  - - C:\Windows\SysWOW64\Qaqegecm.exe
      C:\Windows\system32\Qaqegecm.exe
      4⤵
      PID:6652
    - - C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        5⤵
        Modifies registry class
        
        PID:8116
      - C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        6⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        7⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        8⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        9⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        10⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        11⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        12⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        13⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        14⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        15⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7544
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5560
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        18⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        19⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        20⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        21⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        22⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        23⤵
        Drops file in System32 directory
        
        PID:8548
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        24⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8704
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        26⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        27⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        28⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        29⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        30⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        31⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        32⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        33⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        34⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        35⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        36⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        37⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        38⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        39⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        40⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        41⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        42⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        43⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        44⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        45⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        46⤵
        Drops file in System32 directory
        
        PID:8544
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        47⤵
        Modifies registry class
        
        PID:2896
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        48⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        49⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5244
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        51⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        52⤵
        Modifies registry class
        
        PID:2480
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        53⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        54⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        55⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        56⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        57⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        58⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        59⤵
        Modifies registry class
        
        PID:2708
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        60⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        61⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        62⤵
        Drops file in System32 directory
        
        PID:8860
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        63⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        64⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        65⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Dkcndeen.exe
        
        C:\Windows\system32\Dkcndeen.exe
        66⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Damfao32.exe
        
        C:\Windows\system32\Damfao32.exe
        67⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        68⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        69⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        70⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        71⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        72⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        73⤵
        Modifies registry class
        
        PID:8272
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        74⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        75⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Ekjded32.exe
        
        C:\Windows\system32\Ekjded32.exe
        76⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        77⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9000
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        79⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        80⤵
        Drops file in System32 directory
        
        PID:8436
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        81⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        82⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9944
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        84⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        85⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        86⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7896
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        88⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        89⤵
        Drops file in System32 directory
        
        PID:9656
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        90⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        91⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Fqppci32.exe
        
        C:\Windows\system32\Fqppci32.exe
        92⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Fkfcqb32.exe
        
        C:\Windows\system32\Fkfcqb32.exe
        93⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        94⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        95⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        96⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        97⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        98⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        99⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10108
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        101⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Fganqbgg.exe
        
        C:\Windows\system32\Fganqbgg.exe
        102⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        103⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        104⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        105⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        106⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        107⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        108⤵
        
        PID:256
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        109⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        110⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Gbkkik32.exe
        
        C:\Windows\system32\Gbkkik32.exe
        111⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        112⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        113⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        114⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        115⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        116⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        117⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        118⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        119⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        120⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        121⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        122⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        123⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        124⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        125⤵
        Drops file in System32 directory
        
        PID:8480
        
        C:\Windows\SysWOW64\Hahokfag.exe
        
        C:\Windows\system32\Hahokfag.exe
        126⤵
        Modifies registry class
        
        PID:9528
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        127⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        128⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        129⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        130⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        131⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        132⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Hbihjifh.exe
        
        C:\Windows\system32\Hbihjifh.exe
        133⤵
        Drops file in System32 directory
        
        PID:5316
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        134⤵
        Modifies registry class
        
        PID:7108
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        135⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9540
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        137⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        138⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        139⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        140⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        141⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        142⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Ibqnkh32.exe
        
        C:\Windows\system32\Ibqnkh32.exe
        143⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        144⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Ieojgc32.exe
        
        C:\Windows\system32\Ieojgc32.exe
        145⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        146⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        147⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        148⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        149⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        150⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        151⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        152⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        153⤵
        
        PID:12328
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        154⤵
        Drops file in System32 directory
        
        PID:12368
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        155⤵
        
        PID:12412
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        156⤵
        
        PID:12460
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        157⤵
        
        PID:12500
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        158⤵
        
        PID:12536
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        159⤵
        
        PID:12576
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        160⤵
        
        PID:12620
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        161⤵
        
        PID:12656
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        162⤵
        
        PID:12700
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        163⤵
        
        PID:12740
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        164⤵
        
        PID:12784
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        165⤵
        
        PID:12824
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12860
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        167⤵
        
        PID:12896
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        168⤵
        
        PID:12932
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13032
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        170⤵
        
        PID:13072
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        171⤵
        
        PID:13120
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        172⤵
        
        PID:13164
        
        C:\Windows\SysWOW64\Kifojnol.exe
        
        C:\Windows\system32\Kifojnol.exe
        173⤵
        
        PID:13200
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:13240
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        175⤵
        
        PID:13280
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8360
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        177⤵
        
        PID:12312
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        178⤵
        
        PID:12364
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        179⤵
        
        PID:12396
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        180⤵
        Drops file in System32 directory
        
        PID:12480
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        181⤵
        
        PID:12528
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        182⤵
        
        PID:12556
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        183⤵
        
        PID:12612
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        184⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        185⤵
        Modifies registry class
        
        PID:9384
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        186⤵
        
        PID:12764
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        187⤵
        Modifies registry class
        
        PID:12832
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        188⤵
        
        PID:12892
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        189⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        190⤵
        
        PID:13028
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        191⤵
        
        PID:13060
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        192⤵
        
        PID:13112
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        193⤵
        
        PID:13196
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        194⤵
        Modifies registry class
        
        PID:13268
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        195⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        196⤵
        
        PID:12352
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        197⤵
        Drops file in System32 directory
        
        PID:12448
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        198⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5688
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        200⤵
        
        PID:12608
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        201⤵
        
        PID:12664
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        202⤵
        
        PID:676
        
        C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        203⤵
        
        PID:12808
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        204⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        205⤵
        
        PID:13108
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        206⤵
        
        PID:13248
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        207⤵
        
        PID:12324
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        208⤵
        
        PID:12668
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        209⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        210⤵
        
        PID:12680
        
        C:\Windows\SysWOW64\Mcfbkpab.exe
        
        C:\Windows\system32\Mcfbkpab.exe
        211⤵
        
        PID:12812
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        212⤵
        
        PID:13056
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        213⤵
        
        PID:13188
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        214⤵
        
        PID:13308
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        215⤵
        Modifies registry class
        
        PID:12980
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:920
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        217⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        218⤵
        
        PID:13304
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        219⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        220⤵
        Drops file in System32 directory
        
        PID:7352
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        221⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        222⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        223⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        224⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        225⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        226⤵
        
        PID:12940
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8032
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        228⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        229⤵
        
        PID:12508
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        230⤵
        
        PID:12924
        
        C:\Windows\SysWOW64\Obgohklm.exe
        
        C:\Windows\system32\Obgohklm.exe
        231⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        232⤵
        
        PID:13360
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        233⤵
        
        PID:13396
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        234⤵
        
        PID:13432
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        235⤵
        
        PID:13472
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        236⤵
        
        PID:13516
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        237⤵
        Drops file in System32 directory
        
        PID:13552
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        238⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:13592
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        239⤵
        
        PID:13628
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        240⤵
        
        PID:13668
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        241⤵
        Modifies registry class
        
        PID:13704
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        242⤵
        
        PID:13744
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13784
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        244⤵
        
        PID:13832
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        245⤵
        
        PID:13868
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        246⤵
        
        PID:13916
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        247⤵
        
        PID:13956
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        248⤵
        
        PID:13992
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        249⤵
        
        PID:14028
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        250⤵
        
        PID:14068
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        251⤵
        
        PID:14112
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        252⤵
        Modifies registry class
        
        PID:14148
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        253⤵
        
        PID:14184
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        254⤵
        Modifies registry class
        
        PID:14224
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        255⤵
        
        PID:14264
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        256⤵
        
        PID:14300
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        257⤵
        Drops file in System32 directory
        
        PID:9424
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        258⤵
        Modifies registry class
        
        PID:13352
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        259⤵
        
        PID:13388

C:\Windows\SysWOW64\Pciqnk32.exe
C:\Windows\system32\Pciqnk32.exe
1⤵
PID:10296
- C:\Windows\SysWOW64\Pfhmjf32.exe
  C:\Windows\system32\Pfhmjf32.exe
  2⤵
  PID:10316
- - C:\Windows\SysWOW64\Pmbegqjk.exe
    C:\Windows\system32\Pmbegqjk.exe
    3⤵
    PID:9980
  - - C:\Windows\SysWOW64\Qclmck32.exe
      C:\Windows\system32\Qclmck32.exe
      4⤵
      PID:13588
    - - C:\Windows\SysWOW64\Qjffpe32.exe
        
        C:\Windows\system32\Qjffpe32.exe
        5⤵
        
        PID:13636
      - C:\Windows\SysWOW64\Qiiflaoo.exe
        
        C:\Windows\system32\Qiiflaoo.exe
        6⤵
        
        PID:13696
        
        C:\Windows\SysWOW64\Qcnjijoe.exe
        
        C:\Windows\system32\Qcnjijoe.exe
        7⤵
        
        PID:13740
        
        C:\Windows\SysWOW64\Qjhbfd32.exe
        
        C:\Windows\system32\Qjhbfd32.exe
        8⤵
        
        PID:13828
        
        C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        9⤵
        
        PID:13852
        
        C:\Windows\SysWOW64\Abcgjg32.exe
        
        C:\Windows\system32\Abcgjg32.exe
        10⤵
        
        PID:13924
        
        C:\Windows\SysWOW64\Aadghn32.exe
        
        C:\Windows\system32\Aadghn32.exe
        11⤵
        
        PID:13980
        
        C:\Windows\SysWOW64\Apggckbf.exe
        
        C:\Windows\system32\Apggckbf.exe
        12⤵
        
        PID:14020
        
        C:\Windows\SysWOW64\Acccdj32.exe
        
        C:\Windows\system32\Acccdj32.exe
        13⤵
        
        PID:14048
        
        C:\Windows\SysWOW64\Amkhmoap.exe
        
        C:\Windows\system32\Amkhmoap.exe
        14⤵
        Drops file in System32 directory
        
        PID:14156
        
        C:\Windows\SysWOW64\Adepji32.exe
        
        C:\Windows\system32\Adepji32.exe
        15⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Aibibp32.exe
        
        C:\Windows\system32\Aibibp32.exe
        16⤵
        
        PID:14252
        
        C:\Windows\SysWOW64\Aplaoj32.exe
        
        C:\Windows\system32\Aplaoj32.exe
        17⤵
        
        PID:14332
        
        C:\Windows\SysWOW64\Aidehpea.exe
        
        C:\Windows\system32\Aidehpea.exe
        18⤵
        Drops file in System32 directory
        
        PID:13320
        
        C:\Windows\SysWOW64\Aalmimfd.exe
        
        C:\Windows\system32\Aalmimfd.exe
        19⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Abmjqe32.exe
        
        C:\Windows\system32\Abmjqe32.exe
        20⤵
        
        PID:13480
        
        C:\Windows\SysWOW64\Bigbmpco.exe
        
        C:\Windows\system32\Bigbmpco.exe
        21⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Banjnm32.exe
        
        C:\Windows\system32\Banjnm32.exe
        22⤵
        
        PID:13616
        
        C:\Windows\SysWOW64\Bboffejp.exe
        
        C:\Windows\system32\Bboffejp.exe
        23⤵
        
        PID:13652
        
        C:\Windows\SysWOW64\Bjfogbjb.exe
        
        C:\Windows\system32\Bjfogbjb.exe
        24⤵
        
        PID:13768
        
        C:\Windows\SysWOW64\Bmdkcnie.exe
        
        C:\Windows\system32\Bmdkcnie.exe
        25⤵
        Drops file in System32 directory
        
        PID:10560
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        26⤵
        
        PID:13900
        
        C:\Windows\SysWOW64\Bdocph32.exe
        
        C:\Windows\system32\Bdocph32.exe
        27⤵
        
        PID:14008
        
        C:\Windows\SysWOW64\Bfmolc32.exe
        
        C:\Windows\system32\Bfmolc32.exe
        28⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Bmggingc.exe
        
        C:\Windows\system32\Bmggingc.exe
        29⤵
        
        PID:14144
        
        C:\Windows\SysWOW64\Bdapehop.exe
        
        C:\Windows\system32\Bdapehop.exe
        30⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Binhnomg.exe
        
        C:\Windows\system32\Binhnomg.exe
        31⤵
        
        PID:14108
        
        C:\Windows\SysWOW64\Bphqji32.exe
        
        C:\Windows\system32\Bphqji32.exe
        32⤵
        
        PID:14324
        
        C:\Windows\SysWOW64\Bbfmgd32.exe
        
        C:\Windows\system32\Bbfmgd32.exe
        33⤵
        Drops file in System32 directory
        
        PID:10956
        
        C:\Windows\SysWOW64\Bkmeha32.exe
        
        C:\Windows\system32\Bkmeha32.exe
        34⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Bipecnkd.exe
        
        C:\Windows\system32\Bipecnkd.exe
        35⤵
        
        PID:13572
        
        C:\Windows\SysWOW64\Bagmdllg.exe
        
        C:\Windows\system32\Bagmdllg.exe
        36⤵
        
        PID:13712
        
        C:\Windows\SysWOW64\Bdeiqgkj.exe
        
        C:\Windows\system32\Bdeiqgkj.exe
        37⤵
        
        PID:13776
        
        C:\Windows\SysWOW64\Cpljehpo.exe
        
        C:\Windows\system32\Cpljehpo.exe
        38⤵
        
        PID:14036
        
        C:\Windows\SysWOW64\Ckdkhq32.exe
        
        C:\Windows\system32\Ckdkhq32.exe
        39⤵
        Drops file in System32 directory
        
        PID:14012
        
        C:\Windows\SysWOW64\Cmbgdl32.exe
        
        C:\Windows\system32\Cmbgdl32.exe
        40⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Cpacqg32.exe
        
        C:\Windows\system32\Cpacqg32.exe
        41⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Ckggnp32.exe
        
        C:\Windows\system32\Ckggnp32.exe
        42⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Cmedjl32.exe
        
        C:\Windows\system32\Cmedjl32.exe
        43⤵
        
        PID:10944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Amfobp32.exe

Filesize
64KB

MD5
ec7587c66058f23abb90bd4c06d55295

SHA1
c142024ab10eee3659876645898020dc50415b84

SHA256
1584f5f10d81ec9aeaffdeabcd1cd0b683e03f564aab2a53a3909481270bfaeb

SHA512
827f6e5b1b96b7d292a943b4b2973da20cc97def8cfd4652721c1fd821a96a91cfc629fe41ca0dddf69994fafd93ec9247064fdea3374a622b63ccdb266f59be

Download Submit
C:\Windows\SysWOW64\Cpljehpo.exe

Filesize
64KB

MD5
5a611770e64ed87bdf2ab035efa5324b

SHA1
e9635efda878265cede5f7226f5fcbe97ca97d63

SHA256
2d42eb83bb6db8dc6b2c41ac9889206d11d2042678fc9529a109f6bae2373d0b

SHA512
0daf89f798e46381f3c25175332084a23dea764ff64559b3d3a3b41a6206279b95b6753b8602c7e20fa98951bb928a0bbf743fad48fa749265e98c15300091b9

Download Submit
C:\Windows\SysWOW64\Damfao32.exe

Filesize
64KB

MD5
324b9738e203fef39b2268ed9dd02258

SHA1
ea50d5e046d299e6caaa405f150ed7689091e3bf

SHA256
e60f663f97061de15be2a20fcf2b32bd00cee423d10dfbe3c7e9d2a35addfa7d

SHA512
b75395c2d2e5fa83164bb799554b14151bfec1d4b37642f26ffa2b414c821606804adf23d056dd3e397dda2288572f0a749aeef7ce4fb8af2cbad7f2826f1c0a

Download Submit
C:\Windows\SysWOW64\Dnngpj32.exe

Filesize
64KB

MD5
3c099db5d96f0e1f5c3e5e3ebfa6fb81

SHA1
d8c06562535590e137e12cf3393fc7db19dd5f1b

SHA256
02a036b34578a231ce82f9b1a66410e8281991fc027a1700611e08ad0062a3f9

SHA512
e086a0f337506eb256a38cba0ddff6cd02f648da1476c20115e7636ca40c64deff0756e57a548c94b021ab22650b9dbf34df02f86725280fc9e75db828fc9fd8

Download Submit
C:\Windows\SysWOW64\Eojiqb32.exe

Filesize
64KB

MD5
12b7ca0d32f12c9294a670c9eda71406

SHA1
af00117b97a920c05075dfc75ff05513520a7025

SHA256
3f0bf14925507897122f2e010dd87f51512cb82c9e1f942e03e484f055689798

SHA512
44370d56f4a0c35b30ffd7040a188392664a91b1d0f4340999cac7766e6e486882d3fb7594e59b038c8a8537f526fa0ea4bad5d1735bbc5322fdb2443a62e3c4

Download Submit
C:\Windows\SysWOW64\Epokedmj.exe

Filesize
64KB

MD5
ec12b27cf13f49c1263b260cdab86cbd

SHA1
ee15bfb85547b3a8ba2d54c47b2eb8d9c24d5693

SHA256
b6ba06f86c51d175ef434094a2d80828850f7ee80d972af775a2d440846946a7

SHA512
6c62d672fe3eec85bbb726e01347c89700960834a338a344eb1040165a7d9693aaacc50917a6a60feea97441648f2239d783f58e707cdf3932888ea30c86004e

Download Submit
C:\Windows\SysWOW64\Flqdlnde.exe

Filesize
64KB

MD5
faf0de14661e1f628af7559546ba0a6a

SHA1
f1f8aac4696a47599f1a5d42c0e49aceb097f7ba

SHA256
513243d4743f453d88baa65b53803ee953d0f3c38480a71bb3cbf17996f79dfe

SHA512
4151ea2e4ac6dd79930d30124f210fc801ceb6e41f469da01d30334fabda205965787981a60db5a2be80acdef599ccd5dec77ee738080f3a525310899522c2c7

Download Submit
C:\Windows\SysWOW64\Fmpqfq32.exe

Filesize
64KB

MD5
3895a16c578d8f9d57815fcda3a39739

SHA1
fad1ac27cd24ab7fd51a1c0122d3e3ba108bb51d

SHA256
75b4ee7f9f992e012c2900d799e1a4112002d67790fd0c5c7db287a80f3974e1

SHA512
ea9c3de8a9a88ab2757187d87b3059b25707d14ed1a1f1d45c2c0b64084a8840c1b964aab825b9f7db7e1ff3cf9a65d63338ec3aa6196d3d8cc672da5221964a

Download Submit
C:\Windows\SysWOW64\Ghipne32.exe

Filesize
64KB

MD5
e7b2830af3540d078e4d9d3d4d4931a4

SHA1
7f3176f890ff99d1c28d4174457d79071822ed7e

SHA256
0b23c09e325a27f6cf511fc206d48f5439f011047f2e0be70afb30152263986e

SHA512
17735ffa1d89b30f5139d28508bd37670270cb34d8d5e09491e573a76f8cbba82365ded7e7fb1b63d6b5ec4e098b47dbb315bc0aa7d3893d6ec61cc1b5e6028e

Download Submit
C:\Windows\SysWOW64\Hghoeqmp.exe

Filesize
64KB

MD5
53637fb3d4a36e2f60d2f8660f87207b

SHA1
c0f6bcd0f06048ffa761589b6c05b459b807c38e

SHA256
7184cd172b9f6bd51c70c690f52a82994fa974fd9cc4a168e6abc01090281a2b

SHA512
e8a69cac77500ffb1472045f37e911b7ff9f3dd255205238335689486f0240dbb8c243fc8daef60b8b37a009ed599158a8afee3e07213477fb63cd62c0a624fc

Download Submit
C:\Windows\SysWOW64\Idkbkl32.exe

Filesize
64KB

MD5
43465917017d75fec22cf7f87d03badb

SHA1
7bb05e28e9f482a47f2cb236467a5fa42764de9b

SHA256
1bc5928d4b87777e4bb060b78150f61db4fea77321ed6dbe980f1b86d6b2285c

SHA512
ca61bfb9c63df8e5b46f4532962e58a5489dc5fce87cc61205b26940e19d02ec613e3d020383d41009f8d0964dedf3ee0411c22ee1a3e2848d8a7822cb89f6ed

Download Submit
C:\Windows\SysWOW64\Kbceejpf.exe

Filesize
64KB

MD5
a7389e31b2e946c48f2c3b75bc98db17

SHA1
746d19c79fc8bba9153ed3376d572dc7280de8c3

SHA256
2b57c1abd5900edaefb5f74e88f03ceda7bcce8a5e65d793dc1011a0a34325aa

SHA512
d6ee73880527b0da50eaf780c352ad82407f64f178d0da26d7ff68aea1a9988e6bf6c40509eff665d24b502ec9f76f94f48715327fab83111ca2eb45d20ec6b3

Download Submit
C:\Windows\SysWOW64\Kdcbom32.exe

Filesize
64KB

MD5
3c8eff7a3e3045e9b7d8e4a0de6068d2

SHA1
1879ec46c021fa9abbc42467be1cc68bb3323da2

SHA256
7ef00fb812404b2693681764a785dceb9f6a0987d11b5cb625857b96fa731c2d

SHA512
4389d25bce39890078702a7fb7ff3bc289e5e768508cb0afb7dd6f661a884f9da382bcb2b36c16b97d20326d6a9caef154813e6d0eb7056ad860ea0fc6eed89f

Download Submit
C:\Windows\SysWOW64\Kedoge32.exe

Filesize
64KB

MD5
11dfb47edb89b6f7b7a0e0e9eb09790f

SHA1
6ccd6ec30b04f6b4867880cad05fae31725f51f1

SHA256
1edb9e0fe41ceabe8c4f68b877b8dfd984bbc7d818d5d7231c12755afe39aa43

SHA512
4873f54c2a7b3688b6a0d25f921092204d33dbf2c7df8fe62c9b380d2d7d2b86a55cf3ad3beb94ba57f644cbfffc55fb3c63909543ddd0e53afc319bf8f09040

Download Submit
C:\Windows\SysWOW64\Kfckahdj.exe

Filesize
64KB

MD5
011d5ccee9deb101f67a6512b8921925

SHA1
3784c7130fd2d86e8f4f2cccbc74fbe78abd4011

SHA256
8240784027d580652011aece2095492fe5fe92d76ea3a9cfde4506ec8f3b394e

SHA512
fb00aad31b4cc2974b23c2e48587f2667d5cb14190066c84a6b6d4a6abc3efcca3fc5052e3fc0ceea4abd9302b06cd69b56e8b7880749f9ec6e58812f1c0ca73

Download Submit
C:\Windows\SysWOW64\Kfjhkjle.exe

Filesize
64KB

MD5
384d04cdb9b0ca62e62dd0c10b34deab

SHA1
2518ddc1ce2b47bb84959ab413ea8c5dafbaca85

SHA256
3758529ce70044470ce58e5742a3da552c165afdfd1d9d8fda4375dd5e3175f9

SHA512
71ab0e0483b41dc08e5e2ec329d09d0491c7a9bb0922dd6437edfae69cba1126dd93839a96f21593918a4335a7d85a83ccc9c83d55ba9cd12cc3d58ec1c3d62e

Download Submit
C:\Windows\SysWOW64\Kfmepi32.exe

Filesize
64KB

MD5
ed302a945c6e8edc250edf2436b7ceb2

SHA1
5ddffb6d9c4f1bcf6c6bd72330d56d3ea5f71e78

SHA256
4ac7445603f1876a55d414ad19a72934076a5eb47386ea7e19befc29a9999195

SHA512
27d7c1480ab8795ac12f89204606c97d2a2531c12c2552d4528058bb4b28f6471f4ecdadb3a9096f2581c170c4cea3591b7d0d08464a645253c39e2f6c1c0a0f

Download Submit
C:\Windows\SysWOW64\Kibgmdcn.exe

Filesize
64KB

MD5
5c8a83fd04f58c47fcf13d84666ac007

SHA1
885c68c2ebe6449f686a7f301188b857cd787b10

SHA256
98ea8e4e6173d987388d86364853a95624f7387f833b25e80545811affcdc4de

SHA512
1f9aa2fb324ee4bf7df783f76d03de9fd514da8681c1485dc94a7b0c09672b71e4a5db1704dc57bb80bad3acdc5baa1ac6f857286e0925d56ada5f924d241158

Download Submit
C:\Windows\SysWOW64\Klngdpdd.exe

Filesize
64KB

MD5
864f015fa5395cc228578dd64a1a9230

SHA1
70ef461c997178ffe268edfae2f49090e9236ca7

SHA256
5a307fb13803ce43fd0d8292d2248118a14e126b2945c7fd7a32f0ab5ee2744f

SHA512
3e270621e10542738aa46c61e3c816991e5ffa42d1ef480dea5fb392a8b9f3c5443a8d260e57607d40b4069c160051e1c7f855efdbbf85efdd8d1ed947cb4c42

Download Submit
C:\Windows\SysWOW64\Kmfmmcbo.exe

Filesize
64KB

MD5
786d7c3a649361ec3d88668fa96e149d

SHA1
d4bff21ecd621b867c6c0e8c76d1cbdbe706da40

SHA256
f36a599ba31e8b26346b484acd3b884b00407dd3c81e6748a3f7696a6e076292

SHA512
a3f577bea19fb7d60d6971409f5d2823e8bf97b6bebf188ae50212fc1bb2910b242b2e3517c8ef5d20624f4748330f0aa867b6dd1670344164832db8705bad42

Download Submit
C:\Windows\SysWOW64\Kmijbcpl.exe

Filesize
64KB

MD5
3b0923d7c6868dd3ebdb3987d2016e57

SHA1
ced12b959b1a8f09d0928f10a697f77699447cc7

SHA256
6a622ecc13062907f47af56f4eb6b09334cc3fc5d009a194b64a744deff61e02

SHA512
c1adae9abbc7697645030848cdbe7f46a749d948ccc7d1fc27feab6656988cd1281dc0fa40668e2290a6886c696f67120aaa7108b4dcee8bee16514fda861525

Download Submit
C:\Windows\SysWOW64\Kpbmco32.exe

Filesize
64KB

MD5
8140804d1576609ee7e7dff8c222558d

SHA1
9ac613ce85f3a71e5abdf9af91bff8dd81d09901

SHA256
f65a8a3a1ddc84a8e22ae8d539108af4be4c5d16f5890d65a7ee3f09880da436

SHA512
eaf18d70ca17243ff829afaadfff54210794a4b04335c41ba3991b47e60b47f53e9e961d06b6cb9963b45809d64a04a7c37afcbbdf8bac457c7032a13aa4991f

Download Submit
C:\Windows\SysWOW64\Kplpjn32.exe

Filesize
64KB

MD5
174649fcf3dc7ff432ad96161aeb525b

SHA1
5d00bce990cfca488f9d9a69209cecd6a88655a1

SHA256
b7bf6dad36310c8da1df89bb4cb9d9e307d65858a9f96fc460c48977ffb6b310

SHA512
d8175cfa88f6b9c32dbae0a537cf642ccd8989dd2e210b823d3d22f9dff34ccb9c7a2278c09c507784eddea9bd46ff7d2c102c2a778b7bea9d33205c0ed763a8

Download Submit
C:\Windows\SysWOW64\Laiipofp.exe

Filesize
64KB

MD5
9503e0ea5025f10227b55ab46345d997

SHA1
37db86b67511624110fb6ccfba3ec76ef2a65a94

SHA256
096c31ebc0878a7047fbf01dc2db53293a9696ec4cdeacf17cc015e0f5504e8a

SHA512
ae3962c9f4ab5de26eb24458a545c3a82f93f2628e8212c5b5d9272baff3e79b78f1b1371b2fd58c1782bb9669c3ecf9e0afb06aee5991abfcb00e1cd47d1bf3

Download Submit
C:\Windows\SysWOW64\Lbjlfi32.exe

Filesize
64KB

MD5
3637f803f8774b2a6a71581e4651eeb5

SHA1
acbd4cbae0859ff001981fa450e720ee23720789

SHA256
c921647c2c15c54f1ed6e1ad52f97d7010898432b445047b67607797fa2d2dc4

SHA512
54f46fe4214d1d292c97550779540a2e27b1ca06405b4962919246f15d3aaf80f19aa22f70d4f632b2fce4fece6e47214b7b15f2cf7b2edf876f0ffa0f761188

Download Submit
C:\Windows\SysWOW64\Lcdciiec.exe

Filesize
64KB

MD5
5f950369b3cdbbdd6288f67a157ef57c

SHA1
05b87c0bc39cb8b19b19ba5c952b1ddf21217cd5

SHA256
856ed69efaa0d83a34daa2220a211749688507831774da12b84445870f802931

SHA512
974c88a680bcd2d2a25bac30a9587bf9b9cd8f61760519887d1fc3da5cd29264294740a437ccc2de9729a74ca2aa8fcc2c0bf5ee50e1e9269c77bd5d482942ab

Download Submit
C:\Windows\SysWOW64\Ldleel32.exe

Filesize
64KB

MD5
2c40d0001659e573c2234fae9a9145a0

SHA1
0450245d3864e463a90387a4b91c6d401ec5f948

SHA256
c3c197d48a9631b551f93180e97fc7972d7678bce953af67869f3aff9f197d94

SHA512
0e7146ac7a1f17b6041b2830839aee95bcf979ec94a7e2be5cba82945c3aee5634bef218135400dda2bb23aa09f15a0e2db22a771cecfbd272df05a8170f3067

Download Submit
C:\Windows\SysWOW64\Lenamdem.exe

Filesize
64KB

MD5
3a88c1895738359aafdef94894390f8b

SHA1
51f819b5bd0310cd0f579b9f23c89a6faa5575b9

SHA256
c659ac83bc02648d13e2915954ba8f92b12772eff336e17f969eb42ce22c1d59

SHA512
94272eaffdd0cee563e78d0d7d064a0f79fb66937e8f4055e5887509b038faaef80eab46bd3fe6437a3bfe465e3864ed074c29fd871757ad99eea8799396aa16

Download Submit
C:\Windows\SysWOW64\Lgmngglp.exe

Filesize
64KB

MD5
7cc748c0f82317d0f7d5fc12d92c7e4d

SHA1
d9805a47c7711b773b5c0743e372f13dfc535af4

SHA256
303f39b5488db03e3a7e05876afe37aeff88f415a6f8b8428311cb7a2e1ae228

SHA512
319f95d40d1b892f3b67aa70ae7c7223921313c540aefd9878fca27666d76bd427f7ff662e8af37a45fe345baee61c8c5cc99f820d595f2873f0a154a7559b8f

Download Submit
C:\Windows\SysWOW64\Llcghg32.exe

Filesize
64KB

MD5
5a0ea52344300e8ec7000dd184001545

SHA1
ce75c9339d0a064ea79e056ace584c210b5d4e99

SHA256
137ccd3163a7d8597f24571d6ee86e5c3c635eda37b3dab812071a7b352d5316

SHA512
ee9c08c37b171a56427499a707c2859b5e92798c2ff7c9883ed797be3d22ad11804080a6408ee6dfa26bebe2bcdf4c0ee7a17596e534b8385ecee8f4d7589f2c

Download Submit
C:\Windows\SysWOW64\Llgjjnlj.exe

Filesize
64KB

MD5
1e36672dad4967336f99aaaa83fb1fbf

SHA1
f65b3630eab3c2b549957ee811983fbda8ec8c0a

SHA256
5ae6fead357e0a55fa96f563a0d9adb2ccaa2da084e34653d923f0af16efd516

SHA512
7a6642f19ba901c1734a5727ed6fa215f962a08850e5abca77266063e5d5111db7bbb4f33ea3b4205c417fa2bfb619154b106ba887051496bc49400f4a1db610

Download Submit
C:\Windows\SysWOW64\Lmgfda32.exe

Filesize
64KB

MD5
0760608ff35b517743926adb76bb8897

SHA1
fa820b4c544fb216fd4435d0ac6403568db9e449

SHA256
03bc264fe47068e1219174049cb1cb467e8b743e07aa1a1f493f1bfbdf3e9d02

SHA512
aba5a9538360cb11097b97b83f1f706e4c95afec61e0d25cf1b7baef9c76a4d5deb43c2edf49d519559c8fb54085d0cd082bf50cd2f07033872bb938e152adbd

Download Submit
C:\Windows\SysWOW64\Lmppcbjd.exe

Filesize
64KB

MD5
5d13ad844c814be44c942b558808b20c

SHA1
55683be3e526825fdad00763545c44e42b6479ab

SHA256
aa4e809db7757e93aa78b464e32d58c681f4cbebbf0c08af8819fdb487b48ade

SHA512
9119d84a8ab95c60f05a48da996409fcff280947479078b22adf8791c9795dc7e9f91af103bb79b92998b51669906c417739b18c41cf1de598106ee481052c3e

Download Submit
C:\Windows\SysWOW64\Lpebpm32.exe

Filesize
64KB

MD5
7c22a2819529d23a641116e7c2852895

SHA1
25df54be953e373f85695b9006970e085013e0e2

SHA256
33791aa24e75a05575f3230c00a52b92cb605a4c2c8f481debc9c2bc34cbe8b9

SHA512
131ad1724f7a5ade7a7980db92b0e736e929777838df8fd334bd9ba18261b79e5285895f54338b373f23051dba0f842dca6db31861c9f12aca253c71fc9cc8ab

Download Submit
C:\Windows\SysWOW64\Lphoelqn.exe

Filesize
64KB

MD5
e5d5872edaadb756a3df06809ab040d4

SHA1
00e40d90b3df27edad121d1cc8b519d064aa6380

SHA256
86a21d047545415812a1225ef494b4c09e25d414282244caa83d8e19384f5d20

SHA512
5d6423e429729bf58e939ae34a8fbe9e249cfa451895acba6ebed7ca6664c21a23772702ffab98de5309eae96f7cdfdb3cbbcd648b9b51aa3ffb1b5fcd9d8c29

Download Submit
C:\Windows\SysWOW64\Lpnlpnih.exe

Filesize
64KB

MD5
cfbaf3e550d957e86344460234936c3c

SHA1
4e6d2e160434dfb79714b8f45eeabe9e304d088c

SHA256
248629497e016d5938491a60b26febe67de2e8ba79c443f24d9bf67540836a75

SHA512
14a0c885575999e942c2b382a89cea17f9b1a964c6891f34d4a03cedfe0a66e4d261cd0ec3addb3704354b13101823e6bdcb6a43351aa8bb4ea8c98b78bfec5c

Download Submit
C:\Windows\SysWOW64\Lqmmmmph.exe

Filesize
64KB

MD5
749be5af673d542d99bc158f08f69949

SHA1
46f9f53b4602d2ce7824fc23f7639a6cf98bfe9b

SHA256
989082cba33a128104059b93d18854c0ab5fe64be04a47c1ab5af75861f26cce

SHA512
eeac771cdf382241d8e75c58bac9e3dc47ff1171807159c690704b8afa8f56eed6ef17d55157873b26b9548f3987c8e9fd7b3980dd51fac51f9b600faeafb9cc

Download Submit
C:\Windows\SysWOW64\Mdmnlj32.exe

Filesize
64KB

MD5
07b94aae5e9b007c7c3713d9313be39e

SHA1
83d06e944931fcd453899880a0920a45dfbb6859

SHA256
f0f0d4018026d6a8dd9b1dfac855e03682c8425319dee45c86daf2b095ce71fa

SHA512
cb84ebf0edf0441c450be3f480fe132d71af51d306462fd67ed4e69429543720152ed010e9cfcd705f0087b9972082316f7c386598bd7ed2af48c5573d39f475

Download Submit
C:\Windows\SysWOW64\Menjdbgj.exe

Filesize
64KB

MD5
40f60b30a1db118ecad7b21bd2ef18cd

SHA1
6993e28547f8581c584523e71a54217a4a6311d5

SHA256
9ae7ca0469f8dcf97faab9aadc565647d6ef0e3b7e07dde0a0a3f38fd073eedc

SHA512
18a9dae1f4a423dc4f235f05fdff2db15f9b1f803b7e6d1b69deb056e7b4175226bc95afba0dd6e966fd539b3dea57416f7e9ee971c55dccedb9500909388a7f

Download Submit
C:\Windows\SysWOW64\Miemjaci.exe

Filesize
64KB

MD5
0a50fd6910f0a8b7ca4c1cc76c9afc1f

SHA1
2b6dc584e6bf823a36ac1134d84e9ba3f46c5d82

SHA256
4a8c19af3768d3f9fff3f618e23c25c5ebe3eba8701fc68c82d77ff70da06b76

SHA512
772011c644f5fd60d9d6409e89e102364db02a565fdfc8adbb08af5e7a5c577c4035d34603e5e80dcc2184b34675f570cd2f4162fcbd1e6bbfb01923c87819e1

Download Submit
C:\Windows\SysWOW64\Migjoaaf.exe

Filesize
64KB

MD5
60af23455bd6abd67eada3a5b2b16afd

SHA1
480022f011adeb97100bb8c30c37ee3a2f3f4e66

SHA256
82df5dc3249787fb7a2edc135f20b148b0ee86cfee164ce9889a1ee8e08f7642

SHA512
739251cbaba3f880deff5e7b67a5136b0f6495592184a3777260c458baed7b936431888e29f00a2b6868d60d081ef0f4ce2c5f13b9837c1fe82793f4ea1b9e67

Download Submit
C:\Windows\SysWOW64\Mlefklpj.exe

Filesize
64KB

MD5
992e0010ae346aa2ebb8f81cf13e1713

SHA1
14bd41e57fe1652765d67525a2fc9d1c4b3c762f

SHA256
1f7056c31695d502fc7ecd89eb0977e72e9981ea0580b50d4e8caa0f7bacd530

SHA512
148fce40b06b2e8280ce4a4a0360b8e767d2bcb0eea3e27b5836e1b4e3fc76b54b72633de51cab06998ec0e2ca83562bd04c77338e4a1c513f1867ab36adb955

Download Submit
C:\Windows\SysWOW64\Mnebeogl.exe

Filesize
64KB

MD5
e5b5bb66f77a5a2cc449df8c4c181fae

SHA1
453e764ad5c0dfa858aad344be040111b176e02b

SHA256
df51a63637ed9642ec8f62ba8c620f867c559cbc427256cb2f5b0fd4bd55fa86

SHA512
94b355cd5c93d50c80f4609ad2d925f062510fdfb665b1b31ba9caa98a21ffc914a0a9285d7357599053b7efe1459c98b00d89adb5e2e2b42625573472303465

Download Submit
C:\Windows\SysWOW64\Ndokbi32.exe

Filesize
64KB

MD5
d372d0503ed08f9d388a357a12e36d12

SHA1
33666678023d5a615d8109d827805783cc27d609

SHA256
ec85589a3fbb97e8cf1e04702c63601bca2f5f4f11e143b51ba197d0c6563b6d

SHA512
f0bcee9c41d6f5df364660ea2389bc146b79e1b28c88c732ea3cccc93da0422e5784acf0a50d4626539f282c02f60926becfd313732a851bd33f39fa8e74e1af

Download Submit
C:\Windows\SysWOW64\Nebdoa32.exe

Filesize
64KB

MD5
6250f065e116e65b9ddd15cef0fcd5be

SHA1
22afa0e31bf97368d64ec2810b922810cedcf17f

SHA256
6f46872ec1df51efe9c21461381a86745234e4e22dad1832340b9873dc4e946f

SHA512
60953a26f98126cf2ffe7349284fb40865ffd1bed91226f8d748c69fcc7a2d4fbae057e296ca45009b28a6ca86325df04342aec59ba30f907cd3b5049035cb98

Download Submit
C:\Windows\SysWOW64\Ngmgne32.exe

Filesize
64KB

MD5
311958d4b37b9bd3e93440d8667bf4fe

SHA1
9aadeea2e91c208610e0d6549129e24471455f9c

SHA256
cd862d8a75c96e4d512850a2feeaec202fb32642d9e262bdaba5e7abe49e3904

SHA512
706131844bed79b04d37f86504755c57c1fcac4c3552f5038062a6a3d2047b57219336b3ee0d599da08f06cb5e09b8e745f28b4132d2edbf97e5c15f723cf7ba

Download Submit
C:\Windows\SysWOW64\Nhokljge.exe

Filesize
64KB

MD5
a32a7063eda81dafad64c56788016853

SHA1
63325f036f48a20c21e4e698bb380f1e4f307853

SHA256
164361c14028beed0402def3e6ee7f5efb7e1d2ca9fcb6186ff07bd617a50441

SHA512
8cc1a9c4548cc8ce785f94442f25df04a2efb6d6a00a279ffcb8f9fc65ed4cadf82f0faa1377e134bd9bcdcff908c0e2412af451f3b5d485811b57509b8c9291

Download Submit
C:\Windows\SysWOW64\Piphgq32.exe

Filesize
64KB

MD5
7c9f0cecbb62eb31665d5f3746d50432

SHA1
6c82636d46de1ab124c0ef21cf4036a73ffd35cf

SHA256
87e791c8f245bad0dab57f29fc9dc975bd47ea01ec967196ada663fb9c830f10

SHA512
048f2570fd0e909851fa3dd230182f86edf67778aa59ac49f33245d9a04598cde51693414b9eb9f75cb499256c7e0b7f53088199a31152bfbaabd600087d5c1d

Download Submit
C:\Windows\SysWOW64\Qclmck32.exe

Filesize
64KB

MD5
14073b0fe35d980daaa5352366cfa4f9

SHA1
f14179370454b8bab22f99a7e6d917516fb508b2

SHA256
d51476cd27dac29e5e64a7436f881039c1421a21015e4e773665dfd05a222abb

SHA512
e8f82e3dddaefec00a06e5f1c5037d8428b154240b2c4f31a222098a7fcc61b360d8799e57f571f39be0edb6c30fc1d3afca548996a4d842ac6a3b8ef677cb9b

Download Submit
memory/256-289-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/844-209-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/852-265-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1000-274-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1040-166-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1128-295-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1212-234-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1316-373-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1388-122-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1404-85-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1404-0-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1404-1-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1428-146-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1448-174-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1452-313-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1456-258-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1620-383-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1680-72-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1792-57-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1800-353-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1832-90-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1856-40-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/1896-106-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2012-194-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2032-17-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2116-226-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2232-359-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2348-361-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2536-137-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2664-9-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2856-281-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2872-98-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2964-210-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2996-329-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3012-419-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3040-319-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3108-218-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3172-347-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3296-403-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3332-301-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3488-307-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3504-283-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3548-427-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3560-410-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3632-25-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3724-331-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/3848-178-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4084-402-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4152-337-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4168-134-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4200-154-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4204-186-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4220-114-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4272-389-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4460-242-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4476-65-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4532-250-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4652-371-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4676-425-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4716-86-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4844-48-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/4864-33-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/5056-201-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/5084-395-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads