13dd22ce8defefb2869aa30168d125967eba8aef7dfaad1e34026751a7f45d7e

Analysis

max time kernel
166s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02-01-2024 15:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c15787f5eaacab13759555dad047ac95.exe
Size

93KB
MD5

c15787f5eaacab13759555dad047ac95
SHA1

f58e3110ebe72481ffd9cb08506967dc269d1a63
SHA256

13dd22ce8defefb2869aa30168d125967eba8aef7dfaad1e34026751a7f45d7e
SHA512

cdea78383e24efea5e4232e3bcff9cb98fc62eb98973fe70258da26ad6f73497770f6e560cac371bca85a6004955b91d28df9f726a6d2d31e122d98952413c1e
SSDEEP

1536:6+uE/ZlhPkxAEBtL0mggP+QaHjGd7BxRv8CIUCMzPmJysA3TPjiwg58:6+uEPhP4AEBGmFaHadtxRv7Pr3Y58

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jhapmphg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ibhlmgdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dooaip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aadgadai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddhofjpb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqfeag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghkebd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hddbmedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dflmep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ibnlbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nnmdfknm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ecmebm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jgjekc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjfoqhpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjodff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Agfpoqog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kpgdjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lplaaiqd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Foekbg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dldlbgbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Komhfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lcocmi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qgalelin.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkjfloeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mndapl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhjbjp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgokdomj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ojcidelf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oampdkbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Boeelcmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Inpclnnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kmfhelke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcqjhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gaqhdmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmqhlk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gplged32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddbbngjb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hheoci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pamikh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bijncb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gclimi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gajibq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kefiheqf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njploeoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfqgjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hddbmedc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnlhhi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gmjcgb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdcnpd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iophnl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilfhfh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Loedajao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mhdgqh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Geohdago.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kckqlpck.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckgnbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nchhooaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okkalnjm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Onekeb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbhjqp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gpodfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hbakiina.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkllgnco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbpboj32.exe

Executes dropped EXE 64 IoCs

pid	Process
3288	Jfmekm32.exe
4340	Mklpof32.exe
4420	Namnmp32.exe
3476	Oafacn32.exe
2684	Ofhcdlgg.exe
3420	Pklamb32.exe
3504	Abdfkj32.exe
3672	Bgfhnpde.exe
2404	Bbklli32.exe
3584	Bijncb32.exe
4744	Bgokdomj.exe
2484	Clpppmqn.exe
3272	Cpbbak32.exe
3424	Dbckcf32.exe
1356	Dlbfmjqi.exe
696	Eldbbjof.exe
2496	Epiaig32.exe
2832	Fgjpfqpi.exe
2652	Gplged32.exe
736	Gjdknjep.exe
2320	Geklckkd.exe
3484	Hcipcnac.exe
4112	Hladlc32.exe
1084	Ifnbph32.exe
1828	Jqklnp32.exe
3496	Kgngqico.exe
3228	Lhammfci.exe
3768	Lplaaiqd.exe
1956	Npjnbg32.exe
1116	Nhcbidcd.exe
2568	Okkalnjm.exe
3580	Phiekaql.exe
3368	Pknghk32.exe
2836	Adkelplc.exe
4144	Ajmgof32.exe
4780	Biigildg.exe
3364	Bbbkbbkg.exe
2632	Cicjokll.exe
816	Dlhlleeh.exe
3324	Ebejem32.exe
4288	Fhbbmc32.exe
4180	Glinjqhb.exe
2760	Gclimi32.exe
2700	Hhiaepfl.exe
1032	Hojpbigq.exe
1756	Iofpnhmc.exe
4544	Ijkdkq32.exe
2200	Jkcfch32.exe
1392	Limioiia.exe
5080	Nbmmoklg.exe
1600	Nfjeej32.exe
3104	Ofdhlh32.exe
4636	Anjikoip.exe
1552	Bjhpqn32.exe
1332	Bqahmhpi.exe
4312	Cddjofbj.exe
408	Faiplcmk.exe
3356	Genobp32.exe
4392	Gmjcgb32.exe
440	Gajibq32.exe
436	Hdokok32.exe
1672	Hmhphqoe.exe
4540	Hhmdeink.exe
3816	Ionbcb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Kgdpgo32.exe	Komhfa32.exe
File created	C:\Windows\SysWOW64\Kolakkii.exe	Khbioa32.exe
File created	C:\Windows\SysWOW64\Pjhihm32.exe	Pqoepgca.exe
File created	C:\Windows\SysWOW64\Bminokil.exe	Babmjj32.exe
File created	C:\Windows\SysWOW64\Bhnqoo32.exe	Ahpdnaci.exe
File opened for modification	C:\Windows\SysWOW64\Dbckcf32.exe	Cpbbak32.exe
File created	C:\Windows\SysWOW64\Gfomfo32.exe	Gkjhif32.exe
File created	C:\Windows\SysWOW64\Mhbaaa32.dll	Phfjmlhh.exe
File opened for modification	C:\Windows\SysWOW64\Ednajepe.exe	Ecmebm32.exe
File created	C:\Windows\SysWOW64\Mkekhacb.dll	Lfqgjh32.exe
File created	C:\Windows\SysWOW64\Qgmnmagm.dll	Pllggbje.exe
File created	C:\Windows\SysWOW64\Dhdgih32.dll	Lohqgj32.exe
File created	C:\Windows\SysWOW64\Cpbbak32.exe	Clpppmqn.exe
File created	C:\Windows\SysWOW64\Kffkpkqi.dll	Gpgihh32.exe
File created	C:\Windows\SysWOW64\Jlcnnhjo.dll	Njploeoi.exe
File opened for modification	C:\Windows\SysWOW64\Ghiogkfp.exe	Goqkne32.exe
File created	C:\Windows\SysWOW64\Ghmbhd32.exe	Gacjkjgb.exe
File created	C:\Windows\SysWOW64\Ljibdifc.exe	Kcpjgo32.exe
File created	C:\Windows\SysWOW64\Kmijliej.exe	Kikafjoc.exe
File opened for modification	C:\Windows\SysWOW64\Mfkkjbnn.exe	Laiiie32.exe
File opened for modification	C:\Windows\SysWOW64\Hhmdeink.exe	Hmhphqoe.exe
File opened for modification	C:\Windows\SysWOW64\Ikndpm32.exe	Iddlccfp.exe
File created	C:\Windows\SysWOW64\Kllibo32.dll	Jqhaolli.exe
File opened for modification	C:\Windows\SysWOW64\Dlbfmjqi.exe	Dbckcf32.exe
File created	C:\Windows\SysWOW64\Gnfhob32.exe	Ghiogkfp.exe
File created	C:\Windows\SysWOW64\Idfaolpb.exe	Ijqmacpl.exe
File created	C:\Windows\SysWOW64\Mdhanfoi.dll	Jjeflc32.exe
File created	C:\Windows\SysWOW64\Blagpcop.dll	Edknjonl.exe
File created	C:\Windows\SysWOW64\Nnpncc32.dll	Fipkch32.exe
File created	C:\Windows\SysWOW64\Njhglelp.exe	Nqkihpie.exe
File opened for modification	C:\Windows\SysWOW64\Hladlc32.exe	Hcipcnac.exe
File created	C:\Windows\SysWOW64\Dlnjek32.dll	Hbkgfode.exe
File created	C:\Windows\SysWOW64\Jpbjophf.exe	Jemfbgiq.exe
File created	C:\Windows\SysWOW64\Negbbgbj.dll	Oqkkdh32.exe
File opened for modification	C:\Windows\SysWOW64\Abpcdfha.exe	Aihoka32.exe
File created	C:\Windows\SysWOW64\Odejmglm.dll	Ipaeedpp.exe
File opened for modification	C:\Windows\SysWOW64\Ckaffjbg.exe	Bhnqoo32.exe
File created	C:\Windows\SysWOW64\Ofiima32.dll	Jidpblik.exe
File created	C:\Windows\SysWOW64\Bmeagjbo.exe	Bgkijp32.exe
File created	C:\Windows\SysWOW64\Pgcpdn32.exe	Pbfglg32.exe
File opened for modification	C:\Windows\SysWOW64\Iophnl32.exe	Hdcnpd32.exe
File created	C:\Windows\SysWOW64\Fakhaa32.dll	Hdlphjaf.exe
File opened for modification	C:\Windows\SysWOW64\Kbgfad32.exe	Kkpnqf32.exe
File opened for modification	C:\Windows\SysWOW64\Bhohfj32.exe	Anbkbe32.exe
File created	C:\Windows\SysWOW64\Pfpbkj32.dll	Ocgbej32.exe
File created	C:\Windows\SysWOW64\Onaokmmm.dll	Jpbjophf.exe
File created	C:\Windows\SysWOW64\Befkma32.dll	Nkmmbe32.exe
File created	C:\Windows\SysWOW64\Pnjbbemd.dll	Oefpoi32.exe
File created	C:\Windows\SysWOW64\Mlajbe32.dll	Jnelha32.exe
File created	C:\Windows\SysWOW64\Mgeekolf.dll	Lcocmi32.exe
File created	C:\Windows\SysWOW64\Eehdii32.exe	Elpppcdl.exe
File created	C:\Windows\SysWOW64\Ojigbcoh.dll	Boeelcmm.exe
File created	C:\Windows\SysWOW64\Fhgkhi32.dll	Gjmmfq32.exe
File created	C:\Windows\SysWOW64\Dnhdkgcp.dll	Fbeeco32.exe
File opened for modification	C:\Windows\SysWOW64\Fbiooolb.exe	Fqfeag32.exe
File created	C:\Windows\SysWOW64\Nkodld32.dll	Pbgghn32.exe
File opened for modification	C:\Windows\SysWOW64\Aadgadai.exe	Afocdkac.exe
File created	C:\Windows\SysWOW64\Hijohoki.exe	Hoakpi32.exe
File created	C:\Windows\SysWOW64\Bakobdbb.dll	Agfpoqog.exe
File created	C:\Windows\SysWOW64\Liikiccg.exe	Lcocmi32.exe
File opened for modification	C:\Windows\SysWOW64\Omalii32.exe	Oblhlpne.exe
File created	C:\Windows\SysWOW64\Dkgqpaed.exe	Ddmhcg32.exe
File created	C:\Windows\SysWOW64\Kbebdpca.exe	Kmijliej.exe
File created	C:\Windows\SysWOW64\Fcpadd32.exe	Edaamihh.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bogapc32.dll"	Mfkkjbnn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fhljpcfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bnffai32.dll"	Gonnhf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ibhlmgdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gbcngk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kikafjoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eaedbq32.dll"	Fbecgned.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eecpaeoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdoidcjk.dll"	Pbfglg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qjfmda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoebkabl.dll"	Cdfbbhdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ajckbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Offoebpp.dll"	Dnmhim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iemkjd32.dll"	Jfnbnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gggmqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fakhaa32.dll"	Hdlphjaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qdmkbmnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jgkmap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccnheqff.dll"	Aijlqq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fhbbmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hboaql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jcbibeki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nljgfn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mqojlbcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npimoech.dll"	Joqapmcf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Omhicj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pklamb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jncapf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cohdoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pknghk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nmgjbg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Njploeoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gehfepio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cgiflnoa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dahmoefm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jclaea32.dll"	Gnmlbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iglhfkab.dll"	Chagiqhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lfqgjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Emphhhoh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jqklnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgfceo32.dll"	Kinefp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Onekeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eimegk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Empbjk32.dll"	Alioloje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bemqcngl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Okmpjpfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Opqopj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkcnplhg.dll"	Afocdkac.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kkpnqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjljlijg.dll"	Aiifeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aofemaog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aojepe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Phcgmffo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kepdfo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Beomhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjodgmlo.dll"	Bllbkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kcpjgo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kkmapc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ddbbngjb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gehfepio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nchihe32.dll"	Cfbcfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bekfcj32.dll"	Qgalelin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Phfjmlhh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hoadecal.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 3288	2664	c15787f5eaacab13759555dad047ac95.exe	94
PID 2664 wrote to memory of 3288	2664	c15787f5eaacab13759555dad047ac95.exe	94
PID 2664 wrote to memory of 3288	2664	c15787f5eaacab13759555dad047ac95.exe	94
PID 3288 wrote to memory of 4340	3288	Jfmekm32.exe	95
PID 3288 wrote to memory of 4340	3288	Jfmekm32.exe	95
PID 3288 wrote to memory of 4340	3288	Jfmekm32.exe	95
PID 4340 wrote to memory of 4420	4340	Mklpof32.exe	96
PID 4340 wrote to memory of 4420	4340	Mklpof32.exe	96
PID 4340 wrote to memory of 4420	4340	Mklpof32.exe	96
PID 4420 wrote to memory of 3476	4420	Namnmp32.exe	97
PID 4420 wrote to memory of 3476	4420	Namnmp32.exe	97
PID 4420 wrote to memory of 3476	4420	Namnmp32.exe	97
PID 3476 wrote to memory of 2684	3476	Oafacn32.exe	98
PID 3476 wrote to memory of 2684	3476	Oafacn32.exe	98
PID 3476 wrote to memory of 2684	3476	Oafacn32.exe	98
PID 2684 wrote to memory of 3420	2684	Ofhcdlgg.exe	99
PID 2684 wrote to memory of 3420	2684	Ofhcdlgg.exe	99
PID 2684 wrote to memory of 3420	2684	Ofhcdlgg.exe	99
PID 3420 wrote to memory of 3504	3420	Pklamb32.exe	100
PID 3420 wrote to memory of 3504	3420	Pklamb32.exe	100
PID 3420 wrote to memory of 3504	3420	Pklamb32.exe	100
PID 3504 wrote to memory of 3672	3504	Abdfkj32.exe	101
PID 3504 wrote to memory of 3672	3504	Abdfkj32.exe	101
PID 3504 wrote to memory of 3672	3504	Abdfkj32.exe	101
PID 3672 wrote to memory of 2404	3672	Bgfhnpde.exe	102
PID 3672 wrote to memory of 2404	3672	Bgfhnpde.exe	102
PID 3672 wrote to memory of 2404	3672	Bgfhnpde.exe	102
PID 2404 wrote to memory of 3584	2404	Bbklli32.exe	103
PID 2404 wrote to memory of 3584	2404	Bbklli32.exe	103
PID 2404 wrote to memory of 3584	2404	Bbklli32.exe	103
PID 3584 wrote to memory of 4744	3584	Bijncb32.exe	104
PID 3584 wrote to memory of 4744	3584	Bijncb32.exe	104
PID 3584 wrote to memory of 4744	3584	Bijncb32.exe	104
PID 4744 wrote to memory of 2484	4744	Bgokdomj.exe	105
PID 4744 wrote to memory of 2484	4744	Bgokdomj.exe	105
PID 4744 wrote to memory of 2484	4744	Bgokdomj.exe	105
PID 2484 wrote to memory of 3272	2484	Clpppmqn.exe	106
PID 2484 wrote to memory of 3272	2484	Clpppmqn.exe	106
PID 2484 wrote to memory of 3272	2484	Clpppmqn.exe	106
PID 3272 wrote to memory of 3424	3272	Cpbbak32.exe	107
PID 3272 wrote to memory of 3424	3272	Cpbbak32.exe	107
PID 3272 wrote to memory of 3424	3272	Cpbbak32.exe	107
PID 3424 wrote to memory of 1356	3424	Dbckcf32.exe	108
PID 3424 wrote to memory of 1356	3424	Dbckcf32.exe	108
PID 3424 wrote to memory of 1356	3424	Dbckcf32.exe	108
PID 1356 wrote to memory of 696	1356	Dlbfmjqi.exe	109
PID 1356 wrote to memory of 696	1356	Dlbfmjqi.exe	109
PID 1356 wrote to memory of 696	1356	Dlbfmjqi.exe	109
PID 696 wrote to memory of 2496	696	Eldbbjof.exe	110
PID 696 wrote to memory of 2496	696	Eldbbjof.exe	110
PID 696 wrote to memory of 2496	696	Eldbbjof.exe	110
PID 2496 wrote to memory of 2832	2496	Epiaig32.exe	111
PID 2496 wrote to memory of 2832	2496	Epiaig32.exe	111
PID 2496 wrote to memory of 2832	2496	Epiaig32.exe	111
PID 2832 wrote to memory of 2652	2832	Fgjpfqpi.exe	112
PID 2832 wrote to memory of 2652	2832	Fgjpfqpi.exe	112
PID 2832 wrote to memory of 2652	2832	Fgjpfqpi.exe	112
PID 2652 wrote to memory of 736	2652	Gplged32.exe	113
PID 2652 wrote to memory of 736	2652	Gplged32.exe	113
PID 2652 wrote to memory of 736	2652	Gplged32.exe	113
PID 736 wrote to memory of 2320	736	Gjdknjep.exe	114
PID 736 wrote to memory of 2320	736	Gjdknjep.exe	114
PID 736 wrote to memory of 2320	736	Gjdknjep.exe	114
PID 2320 wrote to memory of 3484	2320	Geklckkd.exe	115

C:\Users\Admin\AppData\Local\Temp\c15787f5eaacab13759555dad047ac95.exe
"C:\Users\Admin\AppData\Local\Temp\c15787f5eaacab13759555dad047ac95.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\Jfmekm32.exe
  C:\Windows\system32\Jfmekm32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Windows\SysWOW64\Mklpof32.exe
    C:\Windows\system32\Mklpof32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4340
  - - C:\Windows\SysWOW64\Namnmp32.exe
      C:\Windows\system32\Namnmp32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4420
    - - C:\Windows\SysWOW64\Oafacn32.exe
        
        C:\Windows\system32\Oafacn32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3476
      - C:\Windows\SysWOW64\Ofhcdlgg.exe
        
        C:\Windows\system32\Ofhcdlgg.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2684
        
        C:\Windows\SysWOW64\Pklamb32.exe
        
        C:\Windows\system32\Pklamb32.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3420
        
        C:\Windows\SysWOW64\Abdfkj32.exe
        
        C:\Windows\system32\Abdfkj32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3504
        
        C:\Windows\SysWOW64\Bgfhnpde.exe
        
        C:\Windows\system32\Bgfhnpde.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3672
        
        C:\Windows\SysWOW64\Bbklli32.exe
        
        C:\Windows\system32\Bbklli32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Windows\SysWOW64\Bijncb32.exe
        
        C:\Windows\system32\Bijncb32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3584
        
        C:\Windows\SysWOW64\Bgokdomj.exe
        
        C:\Windows\system32\Bgokdomj.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4744
        
        C:\Windows\SysWOW64\Clpppmqn.exe
        
        C:\Windows\system32\Clpppmqn.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Windows\SysWOW64\Cpbbak32.exe
        
        C:\Windows\system32\Cpbbak32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3272
        
        C:\Windows\SysWOW64\Dbckcf32.exe
        
        C:\Windows\system32\Dbckcf32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3424
        
        C:\Windows\SysWOW64\Dlbfmjqi.exe
        
        C:\Windows\system32\Dlbfmjqi.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1356
        
        C:\Windows\SysWOW64\Eldbbjof.exe
        
        C:\Windows\system32\Eldbbjof.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:696
        
        C:\Windows\SysWOW64\Epiaig32.exe
        
        C:\Windows\system32\Epiaig32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2496
        
        C:\Windows\SysWOW64\Fgjpfqpi.exe
        
        C:\Windows\system32\Fgjpfqpi.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\SysWOW64\Gplged32.exe
        
        C:\Windows\system32\Gplged32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2652
        
        C:\Windows\SysWOW64\Gjdknjep.exe
        
        C:\Windows\system32\Gjdknjep.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:736
        
        C:\Windows\SysWOW64\Geklckkd.exe
        
        C:\Windows\system32\Geklckkd.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2320
        
        C:\Windows\SysWOW64\Hcipcnac.exe
        
        C:\Windows\system32\Hcipcnac.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3484
        
        C:\Windows\SysWOW64\Hladlc32.exe
        
        C:\Windows\system32\Hladlc32.exe
        24⤵
        Executes dropped EXE
        
        PID:4112
        
        C:\Windows\SysWOW64\Ifnbph32.exe
        
        C:\Windows\system32\Ifnbph32.exe
        25⤵
        Executes dropped EXE
        
        PID:1084
        
        C:\Windows\SysWOW64\Jqklnp32.exe
        
        C:\Windows\system32\Jqklnp32.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1828
        
        C:\Windows\SysWOW64\Kgngqico.exe
        
        C:\Windows\system32\Kgngqico.exe
        27⤵
        Executes dropped EXE
        
        PID:3496
        
        C:\Windows\SysWOW64\Lhammfci.exe
        
        C:\Windows\system32\Lhammfci.exe
        28⤵
        Executes dropped EXE
        
        PID:3228
        
        C:\Windows\SysWOW64\Lplaaiqd.exe
        
        C:\Windows\system32\Lplaaiqd.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3768
        
        C:\Windows\SysWOW64\Npjnbg32.exe
        
        C:\Windows\system32\Npjnbg32.exe
        30⤵
        Executes dropped EXE
        
        PID:1956
        
        C:\Windows\SysWOW64\Nhcbidcd.exe
        
        C:\Windows\system32\Nhcbidcd.exe
        31⤵
        Executes dropped EXE
        
        PID:1116
        
        C:\Windows\SysWOW64\Okkalnjm.exe
        
        C:\Windows\system32\Okkalnjm.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2568
        
        C:\Windows\SysWOW64\Phiekaql.exe
        
        C:\Windows\system32\Phiekaql.exe
        33⤵
        Executes dropped EXE
        
        PID:3580
        
        C:\Windows\SysWOW64\Pknghk32.exe
        
        C:\Windows\system32\Pknghk32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3368
        
        C:\Windows\SysWOW64\Adkelplc.exe
        
        C:\Windows\system32\Adkelplc.exe
        35⤵
        Executes dropped EXE
        
        PID:2836
        
        C:\Windows\SysWOW64\Ajmgof32.exe
        
        C:\Windows\system32\Ajmgof32.exe
        36⤵
        Executes dropped EXE
        
        PID:4144
        
        C:\Windows\SysWOW64\Biigildg.exe
        
        C:\Windows\system32\Biigildg.exe
        37⤵
        Executes dropped EXE
        
        PID:4780
        
        C:\Windows\SysWOW64\Bbbkbbkg.exe
        
        C:\Windows\system32\Bbbkbbkg.exe
        38⤵
        Executes dropped EXE
        
        PID:3364
        
        C:\Windows\SysWOW64\Cicjokll.exe
        
        C:\Windows\system32\Cicjokll.exe
        39⤵
        Executes dropped EXE
        
        PID:2632
        
        C:\Windows\SysWOW64\Dlhlleeh.exe
        
        C:\Windows\system32\Dlhlleeh.exe
        40⤵
        Executes dropped EXE
        
        PID:816
        
        C:\Windows\SysWOW64\Ebejem32.exe
        
        C:\Windows\system32\Ebejem32.exe
        41⤵
        Executes dropped EXE
        
        PID:3324
        
        C:\Windows\SysWOW64\Fhbbmc32.exe
        
        C:\Windows\system32\Fhbbmc32.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4288
        
        C:\Windows\SysWOW64\Glinjqhb.exe
        
        C:\Windows\system32\Glinjqhb.exe
        43⤵
        Executes dropped EXE
        
        PID:4180
        
        C:\Windows\SysWOW64\Gclimi32.exe
        
        C:\Windows\system32\Gclimi32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2760
        
        C:\Windows\SysWOW64\Hhiaepfl.exe
        
        C:\Windows\system32\Hhiaepfl.exe
        45⤵
        Executes dropped EXE
        
        PID:2700
        
        C:\Windows\SysWOW64\Hojpbigq.exe
        
        C:\Windows\system32\Hojpbigq.exe
        46⤵
        Executes dropped EXE
        
        PID:1032
        
        C:\Windows\SysWOW64\Iofpnhmc.exe
        
        C:\Windows\system32\Iofpnhmc.exe
        47⤵
        Executes dropped EXE
        
        PID:1756
        
        C:\Windows\SysWOW64\Ijkdkq32.exe
        
        C:\Windows\system32\Ijkdkq32.exe
        48⤵
        Executes dropped EXE
        
        PID:4544
        
        C:\Windows\SysWOW64\Jkcfch32.exe
        
        C:\Windows\system32\Jkcfch32.exe
        49⤵
        Executes dropped EXE
        
        PID:2200
        
        C:\Windows\SysWOW64\Limioiia.exe
        
        C:\Windows\system32\Limioiia.exe
        50⤵
        Executes dropped EXE
        
        PID:1392
        
        C:\Windows\SysWOW64\Nbmmoklg.exe
        
        C:\Windows\system32\Nbmmoklg.exe
        51⤵
        Executes dropped EXE
        
        PID:5080
        
        C:\Windows\SysWOW64\Nfjeej32.exe
        
        C:\Windows\system32\Nfjeej32.exe
        52⤵
        Executes dropped EXE
        
        PID:1600
        
        C:\Windows\SysWOW64\Ofdhlh32.exe
        
        C:\Windows\system32\Ofdhlh32.exe
        53⤵
        Executes dropped EXE
        
        PID:3104
        
        C:\Windows\SysWOW64\Anjikoip.exe
        
        C:\Windows\system32\Anjikoip.exe
        54⤵
        Executes dropped EXE
        
        PID:4636
        
        C:\Windows\SysWOW64\Bjhpqn32.exe
        
        C:\Windows\system32\Bjhpqn32.exe
        55⤵
        Executes dropped EXE
        
        PID:1552
        
        C:\Windows\SysWOW64\Bqahmhpi.exe
        
        C:\Windows\system32\Bqahmhpi.exe
        56⤵
        Executes dropped EXE
        
        PID:1332
        
        C:\Windows\SysWOW64\Cddjofbj.exe
        
        C:\Windows\system32\Cddjofbj.exe
        57⤵
        Executes dropped EXE
        
        PID:4312
        
        C:\Windows\SysWOW64\Egelgoah.exe
        
        C:\Windows\system32\Egelgoah.exe
        58⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\Faiplcmk.exe
        
        C:\Windows\system32\Faiplcmk.exe
        59⤵
        Executes dropped EXE
        
        PID:408
        
        C:\Windows\SysWOW64\Genobp32.exe
        
        C:\Windows\system32\Genobp32.exe
        60⤵
        Executes dropped EXE
        
        PID:3356
        
        C:\Windows\SysWOW64\Gmjcgb32.exe
        
        C:\Windows\system32\Gmjcgb32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4392
        
        C:\Windows\SysWOW64\Gajibq32.exe
        
        C:\Windows\system32\Gajibq32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:440
        
        C:\Windows\SysWOW64\Hdokok32.exe
        
        C:\Windows\system32\Hdokok32.exe
        63⤵
        Executes dropped EXE
        
        PID:436
        
        C:\Windows\SysWOW64\Hmhphqoe.exe
        
        C:\Windows\system32\Hmhphqoe.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1672
        
        C:\Windows\SysWOW64\Hhmdeink.exe
        
        C:\Windows\system32\Hhmdeink.exe
        65⤵
        Executes dropped EXE
        
        PID:4540
        
        C:\Windows\SysWOW64\Ionbcb32.exe
        
        C:\Windows\system32\Ionbcb32.exe
        66⤵
        Executes dropped EXE
        
        PID:3816
        
        C:\Windows\SysWOW64\Iehkpmgl.exe
        
        C:\Windows\system32\Iehkpmgl.exe
        67⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\Jddnah32.exe
        
        C:\Windows\system32\Jddnah32.exe
        68⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\Koceep32.exe
        
        C:\Windows\system32\Koceep32.exe
        69⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\Kfmmajed.exe
        
        C:\Windows\system32\Kfmmajed.exe
        70⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\Knhbflbp.exe
        
        C:\Windows\system32\Knhbflbp.exe
        71⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Kdipce32.exe
        
        C:\Windows\system32\Kdipce32.exe
        72⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\Lnfngj32.exe
        
        C:\Windows\system32\Lnfngj32.exe
        73⤵
        
        PID:768
        
        C:\Windows\SysWOW64\Aofemaog.exe
        
        C:\Windows\system32\Aofemaog.exe
        74⤵
        Modifies registry class
        
        PID:2928
        
        C:\Windows\SysWOW64\Cfbcfh32.exe
        
        C:\Windows\system32\Cfbcfh32.exe
        75⤵
        Modifies registry class
        
        PID:3780
        
        C:\Windows\SysWOW64\Dfeibf32.exe
        
        C:\Windows\system32\Dfeibf32.exe
        76⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\Eqbcqnph.exe
        
        C:\Windows\system32\Eqbcqnph.exe
        77⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\Fnjmea32.exe
        
        C:\Windows\system32\Fnjmea32.exe
        78⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\Gpgihh32.exe
        
        C:\Windows\system32\Gpgihh32.exe
        79⤵
        Drops file in System32 directory
        
        PID:4916
        
        C:\Windows\SysWOW64\Gjmmfq32.exe
        
        C:\Windows\system32\Gjmmfq32.exe
        80⤵
        Drops file in System32 directory
        
        PID:5036
        
        C:\Windows\SysWOW64\Hnpognhd.exe
        
        C:\Windows\system32\Hnpognhd.exe
        81⤵
        
        PID:748
        
        C:\Windows\SysWOW64\Hdcnpd32.exe
        
        C:\Windows\system32\Hdcnpd32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4348
        
        C:\Windows\SysWOW64\Iophnl32.exe
        
        C:\Windows\system32\Iophnl32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4736
        
        C:\Windows\SysWOW64\Ipaeedpp.exe
        
        C:\Windows\system32\Ipaeedpp.exe
        84⤵
        Drops file in System32 directory
        
        PID:3140
        
        C:\Windows\SysWOW64\Jhapmphg.exe
        
        C:\Windows\system32\Jhapmphg.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1748
        
        C:\Windows\SysWOW64\Jolhjj32.exe
        
        C:\Windows\system32\Jolhjj32.exe
        86⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\Jncapf32.exe
        
        C:\Windows\system32\Jncapf32.exe
        87⤵
        Modifies registry class
        
        PID:2208
        
        C:\Windows\SysWOW64\Kahpgcch.exe
        
        C:\Windows\system32\Kahpgcch.exe
        88⤵
        
        PID:692
        
        C:\Windows\SysWOW64\Mqimdomb.exe
        
        C:\Windows\system32\Mqimdomb.exe
        89⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\Mggolhaj.exe
        
        C:\Windows\system32\Mggolhaj.exe
        90⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\Mqpcdn32.exe
        
        C:\Windows\system32\Mqpcdn32.exe
        91⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\Nkmmbe32.exe
        
        C:\Windows\system32\Nkmmbe32.exe
        92⤵
        Drops file in System32 directory
        
        PID:4732
        
        C:\Windows\SysWOW64\Qpikao32.exe
        
        C:\Windows\system32\Qpikao32.exe
        93⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\Alioloje.exe
        
        C:\Windows\system32\Alioloje.exe
        94⤵
        Modifies registry class
        
        PID:4692
        
        C:\Windows\SysWOW64\Cohdoh32.exe
        
        C:\Windows\system32\Cohdoh32.exe
        95⤵
        Modifies registry class
        
        PID:220
        
        C:\Windows\SysWOW64\Djkdnool.exe
        
        C:\Windows\system32\Djkdnool.exe
        96⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\Dpemjifi.exe
        
        C:\Windows\system32\Dpemjifi.exe
        97⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\Dcdifdem.exe
        
        C:\Windows\system32\Dcdifdem.exe
        98⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\Djnaco32.exe
        
        C:\Windows\system32\Djnaco32.exe
        99⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\Fbeeco32.exe
        
        C:\Windows\system32\Fbeeco32.exe
        100⤵
        Drops file in System32 directory
        
        PID:4468
        
        C:\Windows\SysWOW64\Fqfeag32.exe
        
        C:\Windows\system32\Fqfeag32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3188
        
        C:\Windows\SysWOW64\Fbiooolb.exe
        
        C:\Windows\system32\Fbiooolb.exe
        102⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\Gbqeonfj.exe
        
        C:\Windows\system32\Gbqeonfj.exe
        103⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Gcdkdpih.exe
        
        C:\Windows\system32\Gcdkdpih.exe
        104⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\Hboaql32.exe
        
        C:\Windows\system32\Hboaql32.exe
        105⤵
        Modifies registry class
        
        PID:4172
        
        C:\Windows\SysWOW64\Iffmmihf.exe
        
        C:\Windows\system32\Iffmmihf.exe
        106⤵
        
        PID:3272
        
        C:\Windows\SysWOW64\Jbccbi32.exe
        
        C:\Windows\system32\Jbccbi32.exe
        107⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\Jbkjcgaj.exe
        
        C:\Windows\system32\Jbkjcgaj.exe
        108⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\Kkihedld.exe
        
        C:\Windows\system32\Kkihedld.exe
        109⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\Kinefp32.exe
        
        C:\Windows\system32\Kinefp32.exe
        110⤵
        Modifies registry class
        
        PID:3096
        
        C:\Windows\SysWOW64\Kkmapc32.exe
        
        C:\Windows\system32\Kkmapc32.exe
        111⤵
        Modifies registry class
        
        PID:4900
        
        C:\Windows\SysWOW64\Kpjjhj32.exe
        
        C:\Windows\system32\Kpjjhj32.exe
        112⤵
        
        PID:620
        
        C:\Windows\SysWOW64\Lanpml32.exe
        
        C:\Windows\system32\Lanpml32.exe
        113⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\Lgkhec32.exe
        
        C:\Windows\system32\Lgkhec32.exe
        114⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\Mjqjbn32.exe
        
        C:\Windows\system32\Mjqjbn32.exe
        115⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\Nkgmmpab.exe
        
        C:\Windows\system32\Nkgmmpab.exe
        116⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\Nbfoeiei.exe
        
        C:\Windows\system32\Nbfoeiei.exe
        117⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\Ocqncp32.exe
        
        C:\Windows\system32\Ocqncp32.exe
        118⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\Occkhp32.exe
        
        C:\Windows\system32\Occkhp32.exe
        119⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\Oqgkadod.exe
        
        C:\Windows\system32\Oqgkadod.exe
        120⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Okloomoj.exe
        
        C:\Windows\system32\Okloomoj.exe
        121⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\Pbfglg32.exe
        
        C:\Windows\system32\Pbfglg32.exe
        122⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4048
        
        C:\Windows\SysWOW64\Pgcpdn32.exe
        
        C:\Windows\system32\Pgcpdn32.exe
        123⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\Pbkagfba.exe
        
        C:\Windows\system32\Pbkagfba.exe
        124⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\Qgalelin.exe
        
        C:\Windows\system32\Qgalelin.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:944
        
        C:\Windows\SysWOW64\Anbkbe32.exe
        
        C:\Windows\system32\Anbkbe32.exe
        126⤵
        Drops file in System32 directory
        
        PID:2064
        
        C:\Windows\SysWOW64\Bhohfj32.exe
        
        C:\Windows\system32\Bhohfj32.exe
        127⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Bbemdb32.exe
        
        C:\Windows\system32\Bbemdb32.exe
        128⤵
        
        PID:696
        
        C:\Windows\SysWOW64\Bhaeli32.exe
        
        C:\Windows\system32\Bhaeli32.exe
        129⤵
        
        PID:112
        
        C:\Windows\SysWOW64\Bajjeo32.exe
        
        C:\Windows\system32\Bajjeo32.exe
        130⤵
        
        PID:2632
        
        C:\Windows\SysWOW64\Blonbh32.exe
        
        C:\Windows\system32\Blonbh32.exe
        131⤵
        
        PID:2784
        
        C:\Windows\SysWOW64\Bblcda32.exe
        
        C:\Windows\system32\Bblcda32.exe
        132⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\Coijja32.exe
        
        C:\Windows\system32\Coijja32.exe
        133⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\Cdfbbhdp.exe
        
        C:\Windows\system32\Cdfbbhdp.exe
        134⤵
        Modifies registry class
        
        PID:1680
        
        C:\Windows\SysWOW64\Ddmhcg32.exe
        
        C:\Windows\system32\Ddmhcg32.exe
        135⤵
        Drops file in System32 directory
        
        PID:3128
        
        C:\Windows\SysWOW64\Dkgqpaed.exe
        
        C:\Windows\system32\Dkgqpaed.exe
        136⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\Ddbbngjb.exe
        
        C:\Windows\system32\Ddbbngjb.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3948
        
        C:\Windows\SysWOW64\Eefhcimp.exe
        
        C:\Windows\system32\Eefhcimp.exe
        138⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\Elpppcdl.exe
        
        C:\Windows\system32\Elpppcdl.exe
        139⤵
        Drops file in System32 directory
        
        PID:464
        
        C:\Windows\SysWOW64\Eehdii32.exe
        
        C:\Windows\system32\Eehdii32.exe
        140⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\Ecmebm32.exe
        
        C:\Windows\system32\Ecmebm32.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3364
        
        C:\Windows\SysWOW64\Ednajepe.exe
        
        C:\Windows\system32\Ednajepe.exe
        142⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\Eocegn32.exe
        
        C:\Windows\system32\Eocegn32.exe
        143⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\Fhljpcfk.exe
        
        C:\Windows\system32\Fhljpcfk.exe
        144⤵
        Modifies registry class
        
        PID:212
        
        C:\Windows\SysWOW64\Fkjfloeo.exe
        
        C:\Windows\system32\Fkjfloeo.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1600
        
        C:\Windows\SysWOW64\Fhbpqb32.exe
        
        C:\Windows\system32\Fhbpqb32.exe
        146⤵
        
        PID:3868
        
        C:\Windows\SysWOW64\Fbkdjh32.exe
        
        C:\Windows\system32\Fbkdjh32.exe
        147⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Glcelq32.exe
        
        C:\Windows\system32\Glcelq32.exe
        148⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Gkhbnm32.exe
        
        C:\Windows\system32\Gkhbnm32.exe
        149⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Gdqgfbop.exe
        
        C:\Windows\system32\Gdqgfbop.exe
        150⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Gcddjiel.exe
        
        C:\Windows\system32\Gcddjiel.exe
        151⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Gkoinlbg.exe
        
        C:\Windows\system32\Gkoinlbg.exe
        152⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Hicihp32.exe
        
        C:\Windows\system32\Hicihp32.exe
        153⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Hoakpi32.exe
        
        C:\Windows\system32\Hoakpi32.exe
        154⤵
        Drops file in System32 directory
        
        PID:5472
        
        C:\Windows\SysWOW64\Hijohoki.exe
        
        C:\Windows\system32\Hijohoki.exe
        155⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Heapmp32.exe
        
        C:\Windows\system32\Heapmp32.exe
        156⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Icdmqg32.exe
        
        C:\Windows\system32\Icdmqg32.exe
        157⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Ipmjkh32.exe
        
        C:\Windows\system32\Ipmjkh32.exe
        158⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Ifgbhbbh.exe
        
        C:\Windows\system32\Ifgbhbbh.exe
        159⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Imakdl32.exe
        
        C:\Windows\system32\Imakdl32.exe
        160⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Iempingp.exe
        
        C:\Windows\system32\Iempingp.exe
        161⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Ilfhfh32.exe
        
        C:\Windows\system32\Ilfhfh32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5800
        
        C:\Windows\SysWOW64\Jfllca32.exe
        
        C:\Windows\system32\Jfllca32.exe
        163⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Jimeelkc.exe
        
        C:\Windows\system32\Jimeelkc.exe
        164⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Jcbibeki.exe
        
        C:\Windows\system32\Jcbibeki.exe
        165⤵
        Modifies registry class
        
        PID:5944
        
        C:\Windows\SysWOW64\Kekljlkp.exe
        
        C:\Windows\system32\Kekljlkp.exe
        166⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Kmdqai32.exe
        
        C:\Windows\system32\Kmdqai32.exe
        167⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Kikafjoc.exe
        
        C:\Windows\system32\Kikafjoc.exe
        168⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6072
        
        C:\Windows\SysWOW64\Kmijliej.exe
        
        C:\Windows\system32\Kmijliej.exe
        169⤵
        Drops file in System32 directory
        
        PID:6112
        
        C:\Windows\SysWOW64\Kbebdpca.exe
        
        C:\Windows\system32\Kbebdpca.exe
        170⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\Lmkfah32.exe
        
        C:\Windows\system32\Lmkfah32.exe
        171⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Lbhojo32.exe
        
        C:\Windows\system32\Lbhojo32.exe
        172⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Lfhdem32.exe
        
        C:\Windows\system32\Lfhdem32.exe
        173⤵
        
        PID:5280

C:\Windows\SysWOW64\Lmbmbgmo.exe
C:\Windows\system32\Lmbmbgmo.exe
1⤵
PID:5352
- C:\Windows\SysWOW64\Ldleoa32.exe
  C:\Windows\system32\Ldleoa32.exe
  2⤵
  PID:5392
- - C:\Windows\SysWOW64\Lemagjjj.exe
    C:\Windows\system32\Lemagjjj.exe
    3⤵
    PID:5440
  - - C:\Windows\SysWOW64\Llgjcd32.exe
      C:\Windows\system32\Llgjcd32.exe
      4⤵
      PID:5480
    - - C:\Windows\SysWOW64\Lbabpn32.exe
        
        C:\Windows\system32\Lbabpn32.exe
        5⤵
        
        PID:4392
      - C:\Windows\SysWOW64\Mmgfmg32.exe
        
        C:\Windows\system32\Mmgfmg32.exe
        6⤵
        
        PID:436
        
        C:\Windows\SysWOW64\Mgokflpj.exe
        
        C:\Windows\system32\Mgokflpj.exe
        7⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Mmiccf32.exe
        
        C:\Windows\system32\Mmiccf32.exe
        8⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Mnpice32.exe
        
        C:\Windows\system32\Mnpice32.exe
        9⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Njploeoi.exe
        
        C:\Windows\system32\Njploeoi.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5884
        
        C:\Windows\SysWOW64\Ojcidelf.exe
        
        C:\Windows\system32\Ojcidelf.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3668
        
        C:\Windows\SysWOW64\Ocpghj32.exe
        
        C:\Windows\system32\Ocpghj32.exe
        12⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\Onekeb32.exe
        
        C:\Windows\system32\Onekeb32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5096
        
        C:\Windows\SysWOW64\Pgpmdh32.exe
        
        C:\Windows\system32\Pgpmdh32.exe
        14⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\Pdifhkni.exe
        
        C:\Windows\system32\Pdifhkni.exe
        15⤵
        
        PID:2436
        
        C:\Windows\SysWOW64\Pqpgnl32.exe
        
        C:\Windows\system32\Pqpgnl32.exe
        16⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Aegbji32.exe
        
        C:\Windows\system32\Aegbji32.exe
        17⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Ajckbp32.exe
        
        C:\Windows\system32\Ajckbp32.exe
        18⤵
        Modifies registry class
        
        PID:3956
        
        C:\Windows\SysWOW64\Babmjj32.exe
        
        C:\Windows\system32\Babmjj32.exe
        19⤵
        Drops file in System32 directory
        
        PID:672
        
        C:\Windows\SysWOW64\Bminokil.exe
        
        C:\Windows\system32\Bminokil.exe
        20⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Bepeph32.exe
        
        C:\Windows\system32\Bepeph32.exe
        21⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\Balpph32.exe
        
        C:\Windows\system32\Balpph32.exe
        22⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Bhehmbbj.exe
        
        C:\Windows\system32\Bhehmbbj.exe
        23⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Cabfagee.exe
        
        C:\Windows\system32\Cabfagee.exe
        24⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Chagiqhm.exe
        
        C:\Windows\system32\Chagiqhm.exe
        25⤵
        Modifies registry class
        
        PID:6060
        
        C:\Windows\SysWOW64\Dkgjekai.exe
        
        C:\Windows\system32\Dkgjekai.exe
        26⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Dhkjooqb.exe
        
        C:\Windows\system32\Dhkjooqb.exe
        27⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Dmgbgf32.exe
        
        C:\Windows\system32\Dmgbgf32.exe
        28⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\Deokhc32.exe
        
        C:\Windows\system32\Deokhc32.exe
        29⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Edknjonl.exe
        
        C:\Windows\system32\Edknjonl.exe
        30⤵
        Drops file in System32 directory
        
        PID:5624
        
        C:\Windows\SysWOW64\Emcbcd32.exe
        
        C:\Windows\system32\Emcbcd32.exe
        31⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Ehifpm32.exe
        
        C:\Windows\system32\Ehifpm32.exe
        32⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\Fneohd32.exe
        
        C:\Windows\system32\Fneohd32.exe
        33⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Fdpgen32.exe
        
        C:\Windows\system32\Fdpgen32.exe
        34⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Foekbg32.exe
        
        C:\Windows\system32\Foekbg32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2596
        
        C:\Windows\SysWOW64\Gonnhf32.exe
        
        C:\Windows\system32\Gonnhf32.exe
        36⤵
        Modifies registry class
        
        PID:4792
        
        C:\Windows\SysWOW64\Gehfepio.exe
        
        C:\Windows\system32\Gehfepio.exe
        37⤵
        Modifies registry class
        
        PID:5224
        
        C:\Windows\SysWOW64\Goqkne32.exe
        
        C:\Windows\system32\Goqkne32.exe
        38⤵
        Drops file in System32 directory
        
        PID:6064
        
        C:\Windows\SysWOW64\Ghiogkfp.exe
        
        C:\Windows\system32\Ghiogkfp.exe
        39⤵
        Drops file in System32 directory
        
        PID:1244
        
        C:\Windows\SysWOW64\Gnfhob32.exe
        
        C:\Windows\system32\Gnfhob32.exe
        40⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\Gkjhif32.exe
        
        C:\Windows\system32\Gkjhif32.exe
        41⤵
        Drops file in System32 directory
        
        PID:5580
        
        C:\Windows\SysWOW64\Gfomfo32.exe
        
        C:\Windows\system32\Gfomfo32.exe
        42⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\Gafmkp32.exe
        
        C:\Windows\system32\Gafmkp32.exe
        43⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\Hbhjqp32.exe
        
        C:\Windows\system32\Hbhjqp32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4472
        
        C:\Windows\SysWOW64\Hbkgfode.exe
        
        C:\Windows\system32\Hbkgfode.exe
        45⤵
        Drops file in System32 directory
        
        PID:4072
        
        C:\Windows\SysWOW64\Hheoci32.exe
        
        C:\Windows\system32\Hheoci32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3976
        
        C:\Windows\SysWOW64\Hnagkp32.exe
        
        C:\Windows\system32\Hnagkp32.exe
        47⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Hdlphjaf.exe
        
        C:\Windows\system32\Hdlphjaf.exe
        48⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4852
        
        C:\Windows\SysWOW64\Hoadecal.exe
        
        C:\Windows\system32\Hoadecal.exe
        49⤵
        Modifies registry class
        
        PID:1940
        
        C:\Windows\SysWOW64\Inpclnnj.exe
        
        C:\Windows\system32\Inpclnnj.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1256
        
        C:\Windows\SysWOW64\Iiehjgnp.exe
        
        C:\Windows\system32\Iiehjgnp.exe
        51⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\Ibnlbm32.exe
        
        C:\Windows\system32\Ibnlbm32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2432
        
        C:\Windows\SysWOW64\Jgjekc32.exe
        
        C:\Windows\system32\Jgjekc32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2424
        
        C:\Windows\SysWOW64\Jfkehk32.exe
        
        C:\Windows\system32\Jfkehk32.exe
        54⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\Jkhnab32.exe
        
        C:\Windows\system32\Jkhnab32.exe
        55⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Jfnbnk32.exe
        
        C:\Windows\system32\Jfnbnk32.exe
        56⤵
        Modifies registry class
        
        PID:6236
        
        C:\Windows\SysWOW64\Jbgoik32.exe
        
        C:\Windows\system32\Jbgoik32.exe
        57⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Khknaa32.exe
        
        C:\Windows\system32\Khknaa32.exe
        58⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Kbpboj32.exe
        
        C:\Windows\system32\Kbpboj32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6368
        
        C:\Windows\SysWOW64\Lfqgjh32.exe
        
        C:\Windows\system32\Lfqgjh32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6408
        
        C:\Windows\SysWOW64\Liocgc32.exe
        
        C:\Windows\system32\Liocgc32.exe
        61⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Lpilcnoo.exe
        
        C:\Windows\system32\Lpilcnoo.exe
        62⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Lihfmb32.exe
        
        C:\Windows\system32\Lihfmb32.exe
        63⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Lpbojlfd.exe
        
        C:\Windows\system32\Lpbojlfd.exe
        64⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Mflgff32.exe
        
        C:\Windows\system32\Mflgff32.exe
        65⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Mfoclflo.exe
        
        C:\Windows\system32\Mfoclflo.exe
        66⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Mimphakb.exe
        
        C:\Windows\system32\Mimphakb.exe
        67⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Mpghel32.exe
        
        C:\Windows\system32\Mpghel32.exe
        68⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Nlglpkpi.exe
        
        C:\Windows\system32\Nlglpkpi.exe
        69⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Edqdij32.exe
        
        C:\Windows\system32\Edqdij32.exe
        70⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Fabqdl32.exe
        
        C:\Windows\system32\Fabqdl32.exe
        71⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Ggfombmd.exe
        
        C:\Windows\system32\Ggfombmd.exe
        72⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Gpodfh32.exe
        
        C:\Windows\system32\Gpodfh32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7068
        
        C:\Windows\SysWOW64\Ghflgedf.exe
        
        C:\Windows\system32\Ghflgedf.exe
        74⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Gmcdolbn.exe
        
        C:\Windows\system32\Gmcdolbn.exe
        75⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Gdmmlf32.exe
        
        C:\Windows\system32\Gdmmlf32.exe
        76⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\Gneaelqk.exe
        
        C:\Windows\system32\Gneaelqk.exe
        77⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Ghkebd32.exe
        
        C:\Windows\system32\Ghkebd32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6276
        
        C:\Windows\SysWOW64\Gacjkjgb.exe
        
        C:\Windows\system32\Gacjkjgb.exe
        79⤵
        Drops file in System32 directory
        
        PID:6268
        
        C:\Windows\SysWOW64\Ghmbhd32.exe
        
        C:\Windows\system32\Ghmbhd32.exe
        80⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Gjnnoldm.exe
        
        C:\Windows\system32\Gjnnoldm.exe
        81⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Hddbmedc.exe
        
        C:\Windows\system32\Hddbmedc.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6468
        
        C:\Windows\SysWOW64\Hjqkel32.exe
        
        C:\Windows\system32\Hjqkel32.exe
        83⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Iaaflh32.exe
        
        C:\Windows\system32\Iaaflh32.exe
        84⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Ikijenab.exe
        
        C:\Windows\system32\Ikijenab.exe
        85⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Igpkjo32.exe
        
        C:\Windows\system32\Igpkjo32.exe
        86⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Iddlccfp.exe
        
        C:\Windows\system32\Iddlccfp.exe
        87⤵
        Drops file in System32 directory
        
        PID:448
        
        C:\Windows\SysWOW64\Ikndpm32.exe
        
        C:\Windows\system32\Ikndpm32.exe
        88⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Ibhlmgdj.exe
        
        C:\Windows\system32\Ibhlmgdj.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3556
        
        C:\Windows\SysWOW64\Ijcaaibe.exe
        
        C:\Windows\system32\Ijcaaibe.exe
        90⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Ikcmklih.exe
        
        C:\Windows\system32\Ikcmklih.exe
        91⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Jnaighhk.exe
        
        C:\Windows\system32\Jnaighhk.exe
        92⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\Jdkadb32.exe
        
        C:\Windows\system32\Jdkadb32.exe
        93⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\Jdnnjane.exe
        
        C:\Windows\system32\Jdnnjane.exe
        94⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\Jbaocfmo.exe
        
        C:\Windows\system32\Jbaocfmo.exe
        95⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Jbdliejl.exe
        
        C:\Windows\system32\Jbdliejl.exe
        96⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Jhndepbi.exe
        
        C:\Windows\system32\Jhndepbi.exe
        97⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\Jnklnfpq.exe
        
        C:\Windows\system32\Jnklnfpq.exe
        98⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\Kbpkdd32.exe
        
        C:\Windows\system32\Kbpkdd32.exe
        99⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Kjkpif32.exe
        
        C:\Windows\system32\Kjkpif32.exe
        100⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Kepdfo32.exe
        
        C:\Windows\system32\Kepdfo32.exe
        101⤵
        Modifies registry class
        
        PID:7120
        
        C:\Windows\SysWOW64\Nklbfaae.exe
        
        C:\Windows\system32\Nklbfaae.exe
        102⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Nbcjhobg.exe
        
        C:\Windows\system32\Nbcjhobg.exe
        103⤵
        
        PID:512
        
        C:\Windows\SysWOW64\Nhpbpepo.exe
        
        C:\Windows\system32\Nhpbpepo.exe
        104⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\Oefpoi32.exe
        
        C:\Windows\system32\Oefpoi32.exe
        105⤵
        Drops file in System32 directory
        
        PID:1748
        
        C:\Windows\SysWOW64\Oampdkbj.exe
        
        C:\Windows\system32\Oampdkbj.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6440
        
        C:\Windows\SysWOW64\Okedmp32.exe
        
        C:\Windows\system32\Okedmp32.exe
        107⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\Oaomij32.exe
        
        C:\Windows\system32\Oaomij32.exe
        108⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\Ohiefdhd.exe
        
        C:\Windows\system32\Ohiefdhd.exe
        109⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Pllggbje.exe
        
        C:\Windows\system32\Pllggbje.exe
        110⤵
        Drops file in System32 directory
        
        PID:384
        
        C:\Windows\SysWOW64\Pcepdl32.exe
        
        C:\Windows\system32\Pcepdl32.exe
        111⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Piphaf32.exe
        
        C:\Windows\system32\Piphaf32.exe
        112⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\Pkqdhnom.exe
        
        C:\Windows\system32\Pkqdhnom.exe
        113⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\Pakleh32.exe
        
        C:\Windows\system32\Pakleh32.exe
        114⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\Pkcannmj.exe
        
        C:\Windows\system32\Pkcannmj.exe
        115⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\Pamikh32.exe
        
        C:\Windows\system32\Pamikh32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6924
        
        C:\Windows\SysWOW64\Aljcip32.exe
        
        C:\Windows\system32\Aljcip32.exe
        117⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\Aaflag32.exe
        
        C:\Windows\system32\Aaflag32.exe
        118⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Ahpdnaci.exe
        
        C:\Windows\system32\Ahpdnaci.exe
        119⤵
        Drops file in System32 directory
        
        PID:7036
        
        C:\Windows\SysWOW64\Bhnqoo32.exe
        
        C:\Windows\system32\Bhnqoo32.exe
        120⤵
        Drops file in System32 directory
        
        PID:1612
        
        C:\Windows\SysWOW64\Ckaffjbg.exe
        
        C:\Windows\system32\Ckaffjbg.exe
        121⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Cfnqdale.exe
        
        C:\Windows\system32\Cfnqdale.exe
        122⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Dldlbgbb.exe
        
        C:\Windows\system32\Dldlbgbb.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2804
        
        C:\Windows\SysWOW64\Dfjpppbh.exe
        
        C:\Windows\system32\Dfjpppbh.exe
        124⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Dflmep32.exe
        
        C:\Windows\system32\Dflmep32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6376
        
        C:\Windows\SysWOW64\Elienf32.exe
        
        C:\Windows\system32\Elienf32.exe
        126⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Ebcmjqej.exe
        
        C:\Windows\system32\Ebcmjqej.exe
        127⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Eimegk32.exe
        
        C:\Windows\system32\Eimegk32.exe
        128⤵
        Modifies registry class
        
        PID:5040
        
        C:\Windows\SysWOW64\Ecbjdcml.exe
        
        C:\Windows\system32\Ecbjdcml.exe
        129⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\Emphhhoh.exe
        
        C:\Windows\system32\Emphhhoh.exe
        130⤵
        Modifies registry class
        
        PID:1144
        
        C:\Windows\SysWOW64\Eblpqono.exe
        
        C:\Windows\system32\Eblpqono.exe
        131⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Fbomfokl.exe
        
        C:\Windows\system32\Fbomfokl.exe
        132⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\Fihecici.exe
        
        C:\Windows\system32\Fihecici.exe
        133⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Fdnipbbo.exe
        
        C:\Windows\system32\Fdnipbbo.exe
        134⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\Fikbhiaf.exe
        
        C:\Windows\system32\Fikbhiaf.exe
        135⤵
        
        PID:1196
        
        C:\Windows\SysWOW64\Fdqffaql.exe
        
        C:\Windows\system32\Fdqffaql.exe
        136⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\Ffobbmpp.exe
        
        C:\Windows\system32\Ffobbmpp.exe
        137⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\Fbecgned.exe
        
        C:\Windows\system32\Fbecgned.exe
        138⤵
        Modifies registry class
        
        PID:2304
        
        C:\Windows\SysWOW64\Fipkch32.exe
        
        C:\Windows\system32\Fipkch32.exe
        139⤵
        Drops file in System32 directory
        
        PID:620
        
        C:\Windows\SysWOW64\Fdepaa32.exe
        
        C:\Windows\system32\Fdepaa32.exe
        140⤵
        
        PID:112
        
        C:\Windows\SysWOW64\Gibhihko.exe
        
        C:\Windows\system32\Gibhihko.exe
        141⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\Igmgji32.exe
        
        C:\Windows\system32\Igmgji32.exe
        142⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Injmlbkh.exe
        
        C:\Windows\system32\Injmlbkh.exe
        143⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Icfediio.exe
        
        C:\Windows\system32\Icfediio.exe
        144⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\Ijqmacpl.exe
        
        C:\Windows\system32\Ijqmacpl.exe
        145⤵
        Drops file in System32 directory
        
        PID:2008
        
        C:\Windows\SysWOW64\Idfaolpb.exe
        
        C:\Windows\system32\Idfaolpb.exe
        146⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Ikpjkf32.exe
        
        C:\Windows\system32\Ikpjkf32.exe
        147⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Jdhndlno.exe
        
        C:\Windows\system32\Jdhndlno.exe
        148⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Jjeflc32.exe
        
        C:\Windows\system32\Jjeflc32.exe
        149⤵
        Drops file in System32 directory
        
        PID:1076
        
        C:\Windows\SysWOW64\Jdkkjl32.exe
        
        C:\Windows\system32\Jdkkjl32.exe
        150⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Jncobabm.exe
        
        C:\Windows\system32\Jncobabm.exe
        151⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Jcphkhad.exe
        
        C:\Windows\system32\Jcphkhad.exe
        152⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\Jnelha32.exe
        
        C:\Windows\system32\Jnelha32.exe
        153⤵
        Drops file in System32 directory
        
        PID:4820
        
        C:\Windows\SysWOW64\Jnhinq32.exe
        
        C:\Windows\system32\Jnhinq32.exe
        154⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\Jdaajkfd.exe
        
        C:\Windows\system32\Jdaajkfd.exe
        155⤵
        
        PID:836
        
        C:\Windows\SysWOW64\Jkligd32.exe
        
        C:\Windows\system32\Jkligd32.exe
        156⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\Jqhaolli.exe
        
        C:\Windows\system32\Jqhaolli.exe
        157⤵
        Drops file in System32 directory
        
        PID:4900
        
        C:\Windows\SysWOW64\Kgbjlf32.exe
        
        C:\Windows\system32\Kgbjlf32.exe
        158⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\Kqknekjf.exe
        
        C:\Windows\system32\Kqknekjf.exe
        159⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Kgefae32.exe
        
        C:\Windows\system32\Kgefae32.exe
        160⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\Kkelmc32.exe
        
        C:\Windows\system32\Kkelmc32.exe
        161⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Kmfhelke.exe
        
        C:\Windows\system32\Kmfhelke.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5396
        
        C:\Windows\SysWOW64\Kcpqafba.exe
        
        C:\Windows\system32\Kcpqafba.exe
        163⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\Ljcldo32.exe
        
        C:\Windows\system32\Ljcldo32.exe
        164⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Lqndahiq.exe
        
        C:\Windows\system32\Lqndahiq.exe
        165⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Mekmgg32.exe
        
        C:\Windows\system32\Mekmgg32.exe
        166⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Mndapl32.exe
        
        C:\Windows\system32\Mndapl32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5512
        
        C:\Windows\SysWOW64\Mcqjhc32.exe
        
        C:\Windows\system32\Mcqjhc32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1264
        
        C:\Windows\SysWOW64\Mchpibng.exe
        
        C:\Windows\system32\Mchpibng.exe
        169⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Nnmdfknm.exe
        
        C:\Windows\system32\Nnmdfknm.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5636
        
        C:\Windows\SysWOW64\Ncjmob32.exe
        
        C:\Windows\system32\Ncjmob32.exe
        171⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\Nlcaeo32.exe
        
        C:\Windows\system32\Nlcaeo32.exe
        172⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Napjnfik.exe
        
        C:\Windows\system32\Napjnfik.exe
        173⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Nhjbjp32.exe
        
        C:\Windows\system32\Nhjbjp32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5804
        
        C:\Windows\SysWOW64\Nmgjbg32.exe
        
        C:\Windows\system32\Nmgjbg32.exe
        175⤵
        Modifies registry class
        
        PID:5860
        
        C:\Windows\SysWOW64\Nhmopp32.exe
        
        C:\Windows\system32\Nhmopp32.exe
        176⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\Nljgfn32.exe
        
        C:\Windows\system32\Nljgfn32.exe
        177⤵
        Modifies registry class
        
        PID:3888
        
        C:\Windows\SysWOW64\Oagpne32.exe
        
        C:\Windows\system32\Oagpne32.exe
        178⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Omnqcfig.exe
        
        C:\Windows\system32\Omnqcfig.exe
        179⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Odhipp32.exe
        
        C:\Windows\system32\Odhipp32.exe
        180⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Ompmie32.exe
        
        C:\Windows\system32\Ompmie32.exe
        181⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Olangmod.exe
        
        C:\Windows\system32\Olangmod.exe
        182⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\Pddhlnfg.exe
        
        C:\Windows\system32\Pddhlnfg.exe
        183⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Pknqhh32.exe
        
        C:\Windows\system32\Pknqhh32.exe
        184⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\Pdfeandd.exe
        
        C:\Windows\system32\Pdfeandd.exe
        185⤵
        
        PID:628
        
        C:\Windows\SysWOW64\Pkpmnh32.exe
        
        C:\Windows\system32\Pkpmnh32.exe
        186⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Peeakakg.exe
        
        C:\Windows\system32\Peeakakg.exe
        187⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Pkbjchio.exe
        
        C:\Windows\system32\Pkbjchio.exe
        188⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\Palbpb32.exe
        
        C:\Windows\system32\Palbpb32.exe
        189⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\Phfjmlhh.exe
        
        C:\Windows\system32\Phfjmlhh.exe
        190⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5736
        
        C:\Windows\SysWOW64\Qmccecfp.exe
        
        C:\Windows\system32\Qmccecfp.exe
        191⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Qdmkbmnl.exe
        
        C:\Windows\system32\Qdmkbmnl.exe
        192⤵
        Modifies registry class
        
        PID:4544
        
        C:\Windows\SysWOW64\Qkgcog32.exe
        
        C:\Windows\system32\Qkgcog32.exe
        193⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\Qaalkamf.exe
        
        C:\Windows\system32\Qaalkamf.exe
        194⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Aoeleelp.exe
        
        C:\Windows\system32\Aoeleelp.exe
        195⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\Addabl32.exe
        
        C:\Windows\system32\Addabl32.exe
        196⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\Aojepe32.exe
        
        C:\Windows\system32\Aojepe32.exe
        197⤵
        Modifies registry class
        
        PID:2700
        
        C:\Windows\SysWOW64\Bkeppeii.exe
        
        C:\Windows\system32\Bkeppeii.exe
        198⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Bekdmnio.exe
        
        C:\Windows\system32\Bekdmnio.exe
        199⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Bochfc32.exe
        
        C:\Windows\system32\Bochfc32.exe
        200⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\Bemqcngl.exe
        
        C:\Windows\system32\Bemqcngl.exe
        201⤵
        Modifies registry class
        
        PID:4316
        
        C:\Windows\SysWOW64\Boeelcmm.exe
        
        C:\Windows\system32\Boeelcmm.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5968
        
        C:\Windows\SysWOW64\Beomhm32.exe
        
        C:\Windows\system32\Beomhm32.exe
        203⤵
        Modifies registry class
        
        PID:5596
        
        C:\Windows\SysWOW64\Bhnidi32.exe
        
        C:\Windows\system32\Bhnidi32.exe
        204⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\Beajnm32.exe
        
        C:\Windows\system32\Beajnm32.exe
        205⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Bllbkg32.exe
        
        C:\Windows\system32\Bllbkg32.exe
        206⤵
        Modifies registry class
        
        PID:1356
        
        C:\Windows\SysWOW64\Chbcphph.exe
        
        C:\Windows\system32\Chbcphph.exe
        207⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Cfmijkhj.exe
        
        C:\Windows\system32\Cfmijkhj.exe
        208⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Ckjbbbga.exe
        
        C:\Windows\system32\Ckjbbbga.exe
        209⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Dbdjol32.exe
        
        C:\Windows\system32\Dbdjol32.exe
        210⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Dhnbkfek.exe
        
        C:\Windows\system32\Dhnbkfek.exe
        211⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\Dnmhim32.exe
        
        C:\Windows\system32\Dnmhim32.exe
        212⤵
        Modifies registry class
        
        PID:4144
        
        C:\Windows\SysWOW64\Diclff32.exe
        
        C:\Windows\system32\Diclff32.exe
        213⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Dnpdom32.exe
        
        C:\Windows\system32\Dnpdom32.exe
        214⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Ddjmkg32.exe
        
        C:\Windows\system32\Ddjmkg32.exe
        215⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\Dooaip32.exe
        
        C:\Windows\system32\Dooaip32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4824
        
        C:\Windows\SysWOW64\Eecpaeoo.exe
        
        C:\Windows\system32\Eecpaeoo.exe
        217⤵
        Modifies registry class
        
        PID:1752
        
        C:\Windows\SysWOW64\Enkdjkep.exe
        
        C:\Windows\system32\Enkdjkep.exe
        218⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Ennqpkcm.exe
        
        C:\Windows\system32\Ennqpkcm.exe
        219⤵
        
        PID:228
        
        C:\Windows\SysWOW64\Eicemccc.exe
        
        C:\Windows\system32\Eicemccc.exe
        220⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Epmmjnkp.exe
        
        C:\Windows\system32\Epmmjnkp.exe
        221⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Fmancbji.exe
        
        C:\Windows\system32\Fmancbji.exe
        222⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Fihnhc32.exe
        
        C:\Windows\system32\Fihnhc32.exe
        223⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Fpbfem32.exe
        
        C:\Windows\system32\Fpbfem32.exe
        224⤵
        
        PID:100
        
        C:\Windows\SysWOW64\Fbbpgh32.exe
        
        C:\Windows\system32\Fbbpgh32.exe
        225⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Gefencoj.exe
        
        C:\Windows\system32\Gefencoj.exe
        226⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Glpmkm32.exe
        
        C:\Windows\system32\Glpmkm32.exe
        227⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\Gbjegg32.exe
        
        C:\Windows\system32\Gbjegg32.exe
        228⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Gmafjp32.exe
        
        C:\Windows\system32\Gmafjp32.exe
        229⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\Goccbhae.exe
        
        C:\Windows\system32\Goccbhae.exe
        230⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Gmdcpoid.exe
        
        C:\Windows\system32\Gmdcpoid.exe
        231⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Geohdago.exe
        
        C:\Windows\system32\Geohdago.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4540
        
        C:\Windows\SysWOW64\Hpdlajfe.exe
        
        C:\Windows\system32\Hpdlajfe.exe
        233⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Ibcadcgf.exe
        
        C:\Windows\system32\Ibcadcgf.exe
        234⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Ilnbch32.exe
        
        C:\Windows\system32\Ilnbch32.exe
        235⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Jmnomk32.exe
        
        C:\Windows\system32\Jmnomk32.exe
        236⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Jcjgeb32.exe
        
        C:\Windows\system32\Jcjgeb32.exe
        237⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\Jidpblik.exe
        
        C:\Windows\system32\Jidpblik.exe
        238⤵
        Drops file in System32 directory
        
        PID:1036
        
        C:\Windows\SysWOW64\Jpnhof32.exe
        
        C:\Windows\system32\Jpnhof32.exe
        239⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Jiglgl32.exe
        
        C:\Windows\system32\Jiglgl32.exe
        240⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\Jpqedfne.exe
        
        C:\Windows\system32\Jpqedfne.exe
        241⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Jgkmap32.exe
        
        C:\Windows\system32\Jgkmap32.exe
        242⤵
        Modifies registry class
        
        PID:5516
        
        C:\Windows\SysWOW64\Jndenjmo.exe
        
        C:\Windows\system32\Jndenjmo.exe
        243⤵
        
        PID:312
        
        C:\Windows\SysWOW64\Jcanfakf.exe
        
        C:\Windows\system32\Jcanfakf.exe
        244⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Jcdjka32.exe
        
        C:\Windows\system32\Jcdjka32.exe
        245⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Kllodfpd.exe
        
        C:\Windows\system32\Kllodfpd.exe
        246⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Kedcml32.exe
        
        C:\Windows\system32\Kedcml32.exe
        247⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Komhfa32.exe
        
        C:\Windows\system32\Komhfa32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6064
        
        C:\Windows\SysWOW64\Kgdpgo32.exe
        
        C:\Windows\system32\Kgdpgo32.exe
        249⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Knnhdied.exe
        
        C:\Windows\system32\Knnhdied.exe
        250⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\Kckqlpck.exe
        
        C:\Windows\system32\Kckqlpck.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3852
        
        C:\Windows\SysWOW64\Kjeiij32.exe
        
        C:\Windows\system32\Kjeiij32.exe
        252⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Kpoaed32.exe
        
        C:\Windows\system32\Kpoaed32.exe
        253⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\Kcpjgo32.exe
        
        C:\Windows\system32\Kcpjgo32.exe
        254⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1716
        
        C:\Windows\SysWOW64\Ljibdifc.exe
        
        C:\Windows\system32\Ljibdifc.exe
        255⤵
        
        PID:1412
        
        C:\Windows\SysWOW64\Lofklp32.exe
        
        C:\Windows\system32\Lofklp32.exe
        256⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\Ljloii32.exe
        
        C:\Windows\system32\Ljloii32.exe
        257⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\Lgpocm32.exe
        
        C:\Windows\system32\Lgpocm32.exe
        258⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Lnjgpgkf.exe
        
        C:\Windows\system32\Lnjgpgkf.exe
        259⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Lokdgpqe.exe
        
        C:\Windows\system32\Lokdgpqe.exe
        260⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Ljqhdhpk.exe
        
        C:\Windows\system32\Ljqhdhpk.exe
        261⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Lgdinmod.exe
        
        C:\Windows\system32\Lgdinmod.exe
        262⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Mjeaph32.exe
        
        C:\Windows\system32\Mjeaph32.exe
        263⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\Mqojlbcb.exe
        
        C:\Windows\system32\Mqojlbcb.exe
        264⤵
        Modifies registry class
        
        PID:6104
        
        C:\Windows\SysWOW64\Mflbdibj.exe
        
        C:\Windows\system32\Mflbdibj.exe
        265⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\Mjjkkghp.exe
        
        C:\Windows\system32\Mjjkkghp.exe
        266⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Mcbpcm32.exe
        
        C:\Windows\system32\Mcbpcm32.exe
        267⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Mjlhpgfn.exe
        
        C:\Windows\system32\Mjlhpgfn.exe
        268⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Mjodff32.exe
        
        C:\Windows\system32\Mjodff32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6336
        
        C:\Windows\SysWOW64\Mokmnm32.exe
        
        C:\Windows\system32\Mokmnm32.exe
        270⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Njaakf32.exe
        
        C:\Windows\system32\Njaakf32.exe
        271⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Nqkihpie.exe
        
        C:\Windows\system32\Nqkihpie.exe
        272⤵
        Drops file in System32 directory
        
        PID:6556
        
        C:\Windows\SysWOW64\Njhglelp.exe
        
        C:\Windows\system32\Njhglelp.exe
        273⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Ncplekbq.exe
        
        C:\Windows\system32\Ncplekbq.exe
        274⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Njjdae32.exe
        
        C:\Windows\system32\Njjdae32.exe
        275⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Ofaeffpa.exe
        
        C:\Windows\system32\Ofaeffpa.exe
        276⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Omkmcpgo.exe
        
        C:\Windows\system32\Omkmcpgo.exe
        277⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Ofcale32.exe
        
        C:\Windows\system32\Ofcale32.exe
        278⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Ommjipel.exe
        
        C:\Windows\system32\Ommjipel.exe
        279⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Ocgbej32.exe
        
        C:\Windows\system32\Ocgbej32.exe
        280⤵
        Drops file in System32 directory
        
        PID:7448
        
        C:\Windows\SysWOW64\Opqopj32.exe
        
        C:\Windows\system32\Opqopj32.exe
        281⤵
        Modifies registry class
        
        PID:7488
        
        C:\Windows\SysWOW64\Onapnbhi.exe
        
        C:\Windows\system32\Onapnbhi.exe
        282⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Ppclej32.exe
        
        C:\Windows\system32\Ppclej32.exe
        283⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Pjhpccnn.exe
        
        C:\Windows\system32\Pjhpccnn.exe
        284⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Phlqlgmg.exe
        
        C:\Windows\system32\Phlqlgmg.exe
        285⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Padeem32.exe
        
        C:\Windows\system32\Padeem32.exe
        286⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Phombg32.exe
        
        C:\Windows\system32\Phombg32.exe
        287⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Pnifoaba.exe
        
        C:\Windows\system32\Pnifoaba.exe
        288⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Phcgmffo.exe
        
        C:\Windows\system32\Phcgmffo.exe
        289⤵
        Modifies registry class
        
        PID:7868
        
        C:\Windows\SysWOW64\Pmpoemef.exe
        
        C:\Windows\system32\Pmpoemef.exe
        290⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Qdjgbg32.exe
        
        C:\Windows\system32\Qdjgbg32.exe
        291⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Qjfmda32.exe
        
        C:\Windows\system32\Qjfmda32.exe
        292⤵
        Modifies registry class
        
        PID:8004
        
        C:\Windows\SysWOW64\Ahacndjo.exe
        
        C:\Windows\system32\Ahacndjo.exe
        293⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Aokkknbl.exe
        
        C:\Windows\system32\Aokkknbl.exe
        294⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Apmhbf32.exe
        
        C:\Windows\system32\Apmhbf32.exe
        295⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Agfpoqog.exe
        
        C:\Windows\system32\Agfpoqog.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8172
        
        C:\Windows\SysWOW64\Bmqhlk32.exe
        
        C:\Windows\system32\Bmqhlk32.exe
        297⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7200
        
        C:\Windows\SysWOW64\Bdjqienq.exe
        
        C:\Windows\system32\Bdjqienq.exe
        298⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Bopefnnf.exe
        
        C:\Windows\system32\Bopefnnf.exe
        299⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Bpaanfce.exe
        
        C:\Windows\system32\Bpaanfce.exe
        300⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Bgkijp32.exe
        
        C:\Windows\system32\Bgkijp32.exe
        301⤵
        Drops file in System32 directory
        
        PID:7484
        
        C:\Windows\SysWOW64\Bmeagjbo.exe
        
        C:\Windows\system32\Bmeagjbo.exe
        302⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Bhkfdcbd.exe
        
        C:\Windows\system32\Bhkfdcbd.exe
        303⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Bngnmjql.exe
        
        C:\Windows\system32\Bngnmjql.exe
        304⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Bhmbjb32.exe
        
        C:\Windows\system32\Bhmbjb32.exe
        305⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Bgbpkoej.exe
        
        C:\Windows\system32\Bgbpkoej.exe
        306⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Cnlhhi32.exe
        
        C:\Windows\system32\Cnlhhi32.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7996
        
        C:\Windows\SysWOW64\Cgiflnoa.exe
        
        C:\Windows\system32\Cgiflnoa.exe
        308⤵
        Modifies registry class
        
        PID:4724
        
        C:\Windows\SysWOW64\Cpajdc32.exe
        
        C:\Windows\system32\Cpajdc32.exe
        309⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Ckgnbl32.exe
        
        C:\Windows\system32\Ckgnbl32.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8068
        
        C:\Windows\SysWOW64\Cpdgjc32.exe
        
        C:\Windows\system32\Cpdgjc32.exe
        311⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Dkikglce.exe
        
        C:\Windows\system32\Dkikglce.exe
        312⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Dnhgcgbi.exe
        
        C:\Windows\system32\Dnhgcgbi.exe
        313⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Dhnlapbo.exe
        
        C:\Windows\system32\Dhnlapbo.exe
        314⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Dnjdigpf.exe
        
        C:\Windows\system32\Dnjdigpf.exe
        315⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Dkndbkop.exe
        
        C:\Windows\system32\Dkndbkop.exe
        316⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Dahmoefm.exe
        
        C:\Windows\system32\Dahmoefm.exe
        317⤵
        Modifies registry class
        
        PID:7864
        
        C:\Windows\SysWOW64\Gaqhdmmm.exe
        
        C:\Windows\system32\Gaqhdmmm.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1400
        
        C:\Windows\SysWOW64\Hngebq32.exe
        
        C:\Windows\system32\Hngebq32.exe
        319⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Hpkkhc32.exe
        
        C:\Windows\system32\Hpkkhc32.exe
        320⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Hbihdn32.exe
        
        C:\Windows\system32\Hbihdn32.exe
        321⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Ioebdomd.exe
        
        C:\Windows\system32\Ioebdomd.exe
        322⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Jefpahoi.exe
        
        C:\Windows\system32\Jefpahoi.exe
        323⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\Jhficc32.exe
        
        C:\Windows\system32\Jhficc32.exe
        324⤵
        
        PID:4192
        
        C:\Windows\SysWOW64\Joqapmcf.exe
        
        C:\Windows\system32\Joqapmcf.exe
        325⤵
        Modifies registry class
        
        PID:6352
        
        C:\Windows\SysWOW64\Jhifib32.exe
        
        C:\Windows\system32\Jhifib32.exe
        326⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Jocnem32.exe
        
        C:\Windows\system32\Jocnem32.exe
        327⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Jemfbgiq.exe
        
        C:\Windows\system32\Jemfbgiq.exe
        328⤵
        Drops file in System32 directory
        
        PID:6176
        
        C:\Windows\SysWOW64\Jpbjophf.exe
        
        C:\Windows\system32\Jpbjophf.exe
        329⤵
        Drops file in System32 directory
        
        PID:8072
        
        C:\Windows\SysWOW64\Jeocgfgn.exe
        
        C:\Windows\system32\Jeocgfgn.exe
        330⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Jpegeo32.exe
        
        C:\Windows\system32\Jpegeo32.exe
        331⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Keapmf32.exe
        
        C:\Windows\system32\Keapmf32.exe
        332⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Kpgdjo32.exe
        
        C:\Windows\system32\Kpgdjo32.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6596
        
        C:\Windows\SysWOW64\Kahqbgjp.exe
        
        C:\Windows\system32\Kahqbgjp.exe
        334⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Khbioa32.exe
        
        C:\Windows\system32\Khbioa32.exe
        335⤵
        Drops file in System32 directory
        
        PID:6660
        
        C:\Windows\SysWOW64\Kolakkii.exe
        
        C:\Windows\system32\Kolakkii.exe
        336⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\Kefiheqf.exe
        
        C:\Windows\system32\Kefiheqf.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7768
        
        C:\Windows\SysWOW64\Kplmenpl.exe
        
        C:\Windows\system32\Kplmenpl.exe
        338⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Keifneoc.exe
        
        C:\Windows\system32\Keifneoc.exe
        339⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Kpnjknni.exe
        
        C:\Windows\system32\Kpnjknni.exe
        340⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Khiopp32.exe
        
        C:\Windows\system32\Khiopp32.exe
        341⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Lcocmi32.exe
        
        C:\Windows\system32\Lcocmi32.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2000
        
        C:\Windows\SysWOW64\Liikiccg.exe
        
        C:\Windows\system32\Liikiccg.exe
        343⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Loedajao.exe
        
        C:\Windows\system32\Loedajao.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2832
        
        C:\Windows\SysWOW64\Leplndhk.exe
        
        C:\Windows\system32\Leplndhk.exe
        345⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Lohqgj32.exe
        
        C:\Windows\system32\Lohqgj32.exe
        346⤵
        Drops file in System32 directory
        
        PID:6724
        
        C:\Windows\SysWOW64\Lebiddfi.exe
        
        C:\Windows\system32\Lebiddfi.exe
        347⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Lllaqn32.exe
        
        C:\Windows\system32\Lllaqn32.exe
        348⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Laiiie32.exe
        
        C:\Windows\system32\Laiiie32.exe
        349⤵
        Drops file in System32 directory
        
        PID:3564
        
        C:\Windows\SysWOW64\Mfkkjbnn.exe
        
        C:\Windows\system32\Mfkkjbnn.exe
        350⤵
        Modifies registry class
        
        PID:6488
        
        C:\Windows\SysWOW64\Nobldfio.exe
        
        C:\Windows\system32\Nobldfio.exe
        351⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Njgqaohd.exe
        
        C:\Windows\system32\Njgqaohd.exe
        352⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\Nqaini32.exe
        
        C:\Windows\system32\Nqaini32.exe
        353⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Nfnafpni.exe
        
        C:\Windows\system32\Nfnafpni.exe
        354⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Omhicj32.exe
        
        C:\Windows\system32\Omhicj32.exe
        355⤵
        Modifies registry class
        
        PID:7268
        
        C:\Windows\SysWOW64\Ofqnlplf.exe
        
        C:\Windows\system32\Ofqnlplf.exe
        356⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\Omjfij32.exe
        
        C:\Windows\system32\Omjfij32.exe
        357⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Ofckao32.exe
        
        C:\Windows\system32\Ofckao32.exe
        358⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Oqhooh32.exe
        
        C:\Windows\system32\Oqhooh32.exe
        359⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Ojqchnpj.exe
        
        C:\Windows\system32\Ojqchnpj.exe
        360⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\Oqkkdh32.exe
        
        C:\Windows\system32\Oqkkdh32.exe
        361⤵
        Drops file in System32 directory
        
        PID:668
        
        C:\Windows\SysWOW64\Oblhlpne.exe
        
        C:\Windows\system32\Oblhlpne.exe
        362⤵
        Drops file in System32 directory
        
        PID:6500
        
        C:\Windows\SysWOW64\Omalii32.exe
        
        C:\Windows\system32\Omalii32.exe
        363⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Ofjqbndk.exe
        
        C:\Windows\system32\Ofjqbndk.exe
        364⤵
        
        PID:748
        
        C:\Windows\SysWOW64\Pqoepgca.exe
        
        C:\Windows\system32\Pqoepgca.exe
        365⤵
        Drops file in System32 directory
        
        PID:2308
        
        C:\Windows\SysWOW64\Pjhihm32.exe
        
        C:\Windows\system32\Pjhihm32.exe
        366⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\Pbekboej.exe
        
        C:\Windows\system32\Pbekboej.exe
        367⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Piocoi32.exe
        
        C:\Windows\system32\Piocoi32.exe
        368⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Pbgghn32.exe
        
        C:\Windows\system32\Pbgghn32.exe
        369⤵
        Drops file in System32 directory
        
        PID:1020
        
        C:\Windows\SysWOW64\Pjopil32.exe
        
        C:\Windows\system32\Pjopil32.exe
        370⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Qfepnmjn.exe
        
        C:\Windows\system32\Qfepnmjn.exe
        371⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\Qmphkg32.exe
        
        C:\Windows\system32\Qmphkg32.exe
        372⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Qfhmcl32.exe
        
        C:\Windows\system32\Qfhmcl32.exe
        373⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Aiifeg32.exe
        
        C:\Windows\system32\Aiifeg32.exe
        374⤵
        Modifies registry class
        
        PID:8296
        
        C:\Windows\SysWOW64\Apbnbali.exe
        
        C:\Windows\system32\Apbnbali.exe
        375⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Afmfolcf.exe
        
        C:\Windows\system32\Afmfolcf.exe
        376⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Aabkldcl.exe
        
        C:\Windows\system32\Aabkldcl.exe
        377⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Afocdkac.exe
        
        C:\Windows\system32\Afocdkac.exe
        378⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8464
        
        C:\Windows\SysWOW64\Aadgadai.exe
        
        C:\Windows\system32\Aadgadai.exe
        379⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8500
        
        C:\Windows\SysWOW64\Afapjk32.exe
        
        C:\Windows\system32\Afapjk32.exe
        380⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Bjfoqhpo.exe
        
        C:\Windows\system32\Bjfoqhpo.exe
        381⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8604
        
        C:\Windows\SysWOW64\Cgdefhok.exe
        
        C:\Windows\system32\Cgdefhok.exe
        382⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Ddaifk32.exe
        
        C:\Windows\system32\Ddaifk32.exe
        383⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Dkkabeng.exe
        
        C:\Windows\system32\Dkkabeng.exe
        384⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Dphikllo.exe
        
        C:\Windows\system32\Dphikllo.exe
        385⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Dgbagf32.exe
        
        C:\Windows\system32\Dgbagf32.exe
        386⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Dagfeo32.exe
        
        C:\Windows\system32\Dagfeo32.exe
        387⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Dcibmgip.exe
        
        C:\Windows\system32\Dcibmgip.exe
        388⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Dnnfjp32.exe
        
        C:\Windows\system32\Dnnfjp32.exe
        389⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Ddhofjpb.exe
        
        C:\Windows\system32\Ddhofjpb.exe
        390⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8992
        
        C:\Windows\SysWOW64\Dkbgcd32.exe
        
        C:\Windows\system32\Dkbgcd32.exe
        391⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Ealopnol.exe
        
        C:\Windows\system32\Ealopnol.exe
        392⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Egihhe32.exe
        
        C:\Windows\system32\Egihhe32.exe
        393⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Edaamihh.exe
        
        C:\Windows\system32\Edaamihh.exe
        394⤵
        Drops file in System32 directory
        
        PID:2020
        
        C:\Windows\SysWOW64\Fcpadd32.exe
        
        C:\Windows\system32\Fcpadd32.exe
        395⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Fgnjjb32.exe
        
        C:\Windows\system32\Fgnjjb32.exe
        396⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Gbcngk32.exe
        
        C:\Windows\system32\Gbcngk32.exe
        397⤵
        Modifies registry class
        
        PID:8272
        
        C:\Windows\SysWOW64\Gnjollpe.exe
        
        C:\Windows\system32\Gnjollpe.exe
        398⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Ggcceagf.exe
        
        C:\Windows\system32\Ggcceagf.exe
        399⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Gnmlbl32.exe
        
        C:\Windows\system32\Gnmlbl32.exe
        400⤵
        Modifies registry class
        
        PID:8536
        
        C:\Windows\SysWOW64\Gnohgk32.exe
        
        C:\Windows\system32\Gnohgk32.exe
        401⤵
        
        PID:3272
        
        C:\Windows\SysWOW64\Gggmqa32.exe
        
        C:\Windows\system32\Gggmqa32.exe
        402⤵
        Modifies registry class
        
        PID:8564
        
        C:\Windows\SysWOW64\Gqpaifia.exe
        
        C:\Windows\system32\Gqpaifia.exe
        403⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Gcnnebhe.exe
        
        C:\Windows\system32\Gcnnebhe.exe
        404⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Hndbbkhk.exe
        
        C:\Windows\system32\Hndbbkhk.exe
        405⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Hglflpok.exe
        
        C:\Windows\system32\Hglflpok.exe
        406⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Hbakiina.exe
        
        C:\Windows\system32\Hbakiina.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8796
        
        C:\Windows\SysWOW64\Hccgqa32.exe
        
        C:\Windows\system32\Hccgqa32.exe
        408⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Haghje32.exe
        
        C:\Windows\system32\Haghje32.exe
        409⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Hkllgnco.exe
        
        C:\Windows\system32\Hkllgnco.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9000
        
        C:\Windows\SysWOW64\Haidpeaf.exe
        
        C:\Windows\system32\Haidpeaf.exe
        411⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\Hkohmnal.exe
        
        C:\Windows\system32\Hkohmnal.exe
        412⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\Ibdpefnl.exe
        
        C:\Windows\system32\Ibdpefnl.exe
        413⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Kbbmfdbl.exe
        
        C:\Windows\system32\Kbbmfdbl.exe
        414⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Kecehp32.exe
        
        C:\Windows\system32\Kecehp32.exe
        415⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Kkpnqf32.exe
        
        C:\Windows\system32\Kkpnqf32.exe
        416⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1992
        
        C:\Windows\SysWOW64\Kbgfad32.exe
        
        C:\Windows\system32\Kbgfad32.exe
        417⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\Laalnpoi.exe
        
        C:\Windows\system32\Laalnpoi.exe
        418⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\Mhdgqh32.exe
        
        C:\Windows\system32\Mhdgqh32.exe
        419⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8240
        
        C:\Windows\SysWOW64\Nchhooaa.exe
        
        C:\Windows\system32\Nchhooaa.exe
        420⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2404
        
        C:\Windows\SysWOW64\Nlefcddl.exe
        
        C:\Windows\system32\Nlefcddl.exe
        421⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Oconpn32.exe
        
        C:\Windows\system32\Oconpn32.exe
        422⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Ohlfhe32.exe
        
        C:\Windows\system32\Ohlfhe32.exe
        423⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Oofoeo32.exe
        
        C:\Windows\system32\Oofoeo32.exe
        424⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Odbgmf32.exe
        
        C:\Windows\system32\Odbgmf32.exe
        425⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Okmpjpfa.exe
        
        C:\Windows\system32\Okmpjpfa.exe
        426⤵
        Modifies registry class
        
        PID:8592
        
        C:\Windows\SysWOW64\Ofdpmi32.exe
        
        C:\Windows\system32\Ofdpmi32.exe
        427⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Pfijhhpp.exe
        
        C:\Windows\system32\Pfijhhpp.exe
        428⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Pmcbdb32.exe
        
        C:\Windows\system32\Pmcbdb32.exe
        429⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Qfeicffb.exe
        
        C:\Windows\system32\Qfeicffb.exe
        430⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Qkablmdj.exe
        
        C:\Windows\system32\Qkablmdj.exe
        431⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Qejfeb32.exe
        
        C:\Windows\system32\Qejfeb32.exe
        432⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Akdoam32.exe
        
        C:\Windows\system32\Akdoam32.exe
        433⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\Aihoka32.exe
        
        C:\Windows\system32\Aihoka32.exe
        434⤵
        Drops file in System32 directory
        
        PID:5560
        
        C:\Windows\SysWOW64\Abpcdfha.exe
        
        C:\Windows\system32\Abpcdfha.exe
        435⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\Aijlqq32.exe
        
        C:\Windows\system32\Aijlqq32.exe
        436⤵
        Modifies registry class
        
        PID:7100
        
        C:\Windows\SysWOW64\Abbpif32.exe
        
        C:\Windows\system32\Abbpif32.exe
        437⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Amhdfo32.exe
        
        C:\Windows\system32\Amhdfo32.exe
        438⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\Acbmcima.exe
        
        C:\Windows\system32\Acbmcima.exe
        439⤵
        
        PID:4892

C:\Windows\SysWOW64\Apimhjbe.exe
C:\Windows\system32\Apimhjbe.exe
1⤵
PID:4932
- C:\Windows\SysWOW64\Afceed32.exe
  C:\Windows\system32\Afceed32.exe
  2⤵
  PID:6672
- - C:\Windows\SysWOW64\Blpnmk32.exe
    C:\Windows\system32\Blpnmk32.exe
    3⤵
    PID:2384
  - - C:\Windows\SysWOW64\Bmokgnol.exe
      C:\Windows\system32\Bmokgnol.exe
      4⤵
      PID:5228
    - - C:\Windows\SysWOW64\Bcicdhgi.exe
        
        C:\Windows\system32\Bcicdhgi.exe
        5⤵
        
        PID:6432
      - C:\Windows\SysWOW64\Bifkloeq.exe
        
        C:\Windows\system32\Bifkloeq.exe
        6⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Bckpihef.exe
        
        C:\Windows\system32\Bckpihef.exe
        7⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Bemlap32.exe
        
        C:\Windows\system32\Bemlap32.exe
        8⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Blgdnjba.exe
        
        C:\Windows\system32\Blgdnjba.exe
        9⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\Bmfqhmid.exe
        
        C:\Windows\system32\Bmfqhmid.exe
        10⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\Bbcipdgl.exe
        
        C:\Windows\system32\Bbcipdgl.exe
        11⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Cmhmmmgb.exe
        
        C:\Windows\system32\Cmhmmmgb.exe
        12⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\Clnjoilj.exe
        
        C:\Windows\system32\Clnjoilj.exe
        13⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Cbhbkc32.exe
        
        C:\Windows\system32\Cbhbkc32.exe
        14⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Cmmghl32.exe
        
        C:\Windows\system32\Cmmghl32.exe
        15⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\Cbjoac32.exe
        
        C:\Windows\system32\Cbjoac32.exe
        16⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Cmpcnlaj.exe
        
        C:\Windows\system32\Cmpcnlaj.exe
        17⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\Cfhhga32.exe
        
        C:\Windows\system32\Cfhhga32.exe
        18⤵
        
        PID:740
        
        C:\Windows\SysWOW64\Cmbpckog.exe
        
        C:\Windows\system32\Cmbpckog.exe
        19⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Cfjdma32.exe
        
        C:\Windows\system32\Cfjdma32.exe
        20⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\Dlgmehdo.exe
        
        C:\Windows\system32\Dlgmehdo.exe
        21⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Dfmabqce.exe
        
        C:\Windows\system32\Dfmabqce.exe
        22⤵
        
        PID:5380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abdfkj32.exe

Filesize
93KB

MD5
0ecd15936907b027a7b062f446d9da0e

SHA1
e8b8fceb0b18053c95231ea436800359b547337b

SHA256
fad34e3658a56581a21eeefed34edba59817b78cdb77b6eea7d8c094cbb0c2e9

SHA512
0afd2ca04ee39ddafcbb94ff6b3e956bfcb82e580f70dd46095a5a6c7be98d4a85a877561e9bace2001f6cdf7bff09ebfaf84cea30f015d89e234311ad282f7b

Download Submit
C:\Windows\SysWOW64\Aojepe32.exe

Filesize
93KB

MD5
e6f516d9b96d2185ecd2e9813d8c2c05

SHA1
58d78664911be787b957a71e70fdc68fb192e951

SHA256
98c8df37de9b774eb55706651abce755bce5bcacb1810240d74cb4b9333832d2

SHA512
be338d5371d6e4bab1f3c8dc1c05867b714d752a4201ab21d00e980e4bc52b668ad57579536366e0dee5bb51a643ba7ff436004bd33f0c93dcc2cb70cfd9ddc0

Download Submit
C:\Windows\SysWOW64\Bbklli32.exe

Filesize
93KB

MD5
577d8226d49048e7ac0f0fb68f5e0f20

SHA1
dc4fe7165fc4e5b46a27abf96496e3a8f13f1852

SHA256
fe89cbffecde94f0e5f93e165f4d41fd62b6c965dd1ba35d65b81db5d9e9ce4c

SHA512
5fe1618ba23c4dadb81e5688a563ae27aac493c306455843bc3ca88aa3de4916226840620b17e8e0267ee199ee96b5db2b9a848cb189686ad0739535bcf8e19f

Download Submit
C:\Windows\SysWOW64\Bgfhnpde.exe

Filesize
93KB

MD5
0bfc2e1be99629b8fe6c598b894f284e

SHA1
62f0f20569a7bf69048fdf173483932320f7f04f

SHA256
62ffc49707d9821321e63fa4a870f856834b77d423022015ef52450f539b6dcf

SHA512
772e74d913233a79fe95d2e11258f14d994eef127235680e0ced94ac9f05fe69ae82bb6a327d6365f8a1fb5fd90715516f8103a72ef9ad2863f17267947100b5

Download Submit
C:\Windows\SysWOW64\Bggknnmj.dll

Filesize
7KB

MD5
f75380941613ef6e9919f705b5965f7b

SHA1
4c960995e14ed012b1937bf07668ca069133864b

SHA256
82d53741e569c7dcefd882ca767f6df29ea1baf0b994638e0008a29c501c80b8

SHA512
cd60c76e73b9929249312a309244511c051aa75ab2f69ad8f3bcd703b10dbf2bc6ac793cdf53741e736a70864ecd56194e50990fe7f91a730511e883cbf662b6

Download Submit
C:\Windows\SysWOW64\Bgokdomj.exe

Filesize
93KB

MD5
a98043bf804da68e584e67a7971ea252

SHA1
d416b0f3f19aec4824852fbe23b1785d6942e8df

SHA256
6c2e32eb96ff92b9ab16e7b141edd293a06efad73bc89d557a31ee80b27fc302

SHA512
7e11f6a01fd70d01c08e34a6a816846c8bc36c103789e1d7e2e5ad882128b62461a9f564734aeaef9283482328973f590d709b7011812c641e356536fde6c9a1

Download Submit
C:\Windows\SysWOW64\Bijncb32.exe

Filesize
93KB

MD5
6ef34b8e328b19eaff05d5f4e042a80a

SHA1
6a87a022de1fc6ea4af0980302dbfe6145a19b4c

SHA256
166f6a5f1f4509f30e9f50a70cf38f717bb986022859fb80ee2b51ca2c1f0fa7

SHA512
042e65aa4e3582f146acd68a6af864b05f71fc608a13cc506f24e3eef1340452f0b2491e6cdcfd3995b6b0e6b9d5b02a638e339415f8d39245cdd6c7fe65f207

Download Submit
C:\Windows\SysWOW64\Chagiqhm.exe

Filesize
93KB

MD5
76b176905e23ab5ce1cb500851921d74

SHA1
7b4eb81a5c17b9f1f507f90a7ac7d0f799846028

SHA256
394b92339834ef7b27756b404f86347233d5999f9cd72e97975b06cb7cbfa17d

SHA512
04438740ee3c85f92d475f318db4d603785ae4a934f215e6622f8d442e8604301d90ca628b93213969b4a66721d19623e3d7d1941b52852b76432ef79cd7b2b6

Download Submit
C:\Windows\SysWOW64\Clpppmqn.exe

Filesize
93KB

MD5
f32641bf09d897b9dd871e409e716e33

SHA1
e46909a06f71731a4481cba72eee27e315a00b64

SHA256
7a1c4287b21eeaa637c10c4f6c2d87b04d7e047be6e9f66fef72826429d7fcd7

SHA512
068ad6c6c204e600cfffd3d005346a477264d40d085757ce9f7702a8954a0703e4750bbf81882f6dd84daac427c1a3138afe364bce674845e80ea25cf2b7d953

Download Submit
C:\Windows\SysWOW64\Cpbbak32.exe

Filesize
93KB

MD5
91dc5f6171775a4b3e5210452c8b1a8f

SHA1
69b8d2bb312b25d9454adf9119d934d4fa08d1d4

SHA256
729ed0c73927af51f809025d9309e977b1eb3c9827a9437e18fdf4a54cd8a418

SHA512
8f8e7731fe7f363ec4e65f2dfcc88a5f367453e636cb860144f3174c9a81da413979e8c7b80c19b370616e75f7f82a2f2bbdd1f6547af2a93a949e3aac225484

Download Submit
C:\Windows\SysWOW64\Dbckcf32.exe

Filesize
93KB

MD5
6cac328d820ae08cb9b48e42645af5e2

SHA1
e0d9e05ccd8479d9cbdd2b4784c493f732a906ef

SHA256
74d0d7b63b1fffcf1142122e1098f523573ea1c35729267b4759e837a8b973a6

SHA512
18180b345bcfdae8700848f643455fe56f8b66fff54c77eb6d2d2942ba11b24133dde91f9bd4801c2b4e16951f1f5443edc7e48ed36e60e8082dee7d1676bca9

Download Submit
C:\Windows\SysWOW64\Dfeibf32.exe

Filesize
93KB

MD5
73df5a98ed03c3af8a36ee5ac80b49be

SHA1
41cee711e3e4c12e2665e0b0dfd3f78a3a0825e2

SHA256
e22073846fc4d70ed7faae637d735c87e445c489625bccd2d25faf80135655c5

SHA512
cbd96961178976f7f025a4b2d3b8d9ea82f110648302b216bfc0cf25410c14cd4e9f3d29110d2063a8c7cadd2783d526a4699ad815286819c2ed62dee31de396

Download Submit
C:\Windows\SysWOW64\Dhnlapbo.exe

Filesize
93KB

MD5
b2a14a3e63eac2ec779945648e6ee521

SHA1
ce354a78a658d6af002f0bdf93b431cb2f94a5d0

SHA256
ea586da361755780394703c014b297205f7ad706d1ecb31533da9acdda44c9cc

SHA512
417aec6aca8373643c6b8a845df3e593f574e32a6b082769d34e1fdf7ac17c800e1d25f2bd15916dcabc82faa03caf00b12925c8b44d5390e173586169337b04

Download Submit
C:\Windows\SysWOW64\Dlbfmjqi.exe

Filesize
93KB

MD5
21ce9641fa4132469dbb01e7105f9468

SHA1
f6385236023c64668ec471488790389bb3e693ea

SHA256
b0463a59d02fce6b8f14c3d701af17af5b12cd8f46a5dc689edc635d85ed5e72

SHA512
b21f6a8e44bd95aeec0193afa692c287ea6ca60b8b936f8e020a3a5ab32b624ff33ebffb190221128d0cd86d3ba7975507fa42f5a3a6a6292d2ace9db4ea3122

Download Submit
C:\Windows\SysWOW64\Eldbbjof.exe

Filesize
93KB

MD5
57d465a3d85ca5b05bc0a0ff9b2cced9

SHA1
d2493be4c4a88ae6de7f459f6b90fda36fe41320

SHA256
815bbc5afc6b00bbe01656906c25a714f2350454418b29d00e3c132d3027666c

SHA512
4dffbd213cc9d9114a85988066c9922aed78ed282717b6858a26629dc33a08b1f8f893259775d2c89a660a00cecc87f3ebafbbd9b8d9b57197cbd3fbba6e6378

Download Submit
C:\Windows\SysWOW64\Epiaig32.exe

Filesize
93KB

MD5
eef9757e1b0efcaa512825e0bb3f556b

SHA1
e90e0ddb5e77033703214e8c6fb9daba9a62d87c

SHA256
2ca58550284708a369b576ba2dfe81d18a2705da4ad8d77d08f543f9b036fdd0

SHA512
2f630416bbb4760120455ebfc4708699e73faf3a26b4ab67831fcfaff4ae769649153393f78ae13c3c3e12155ad012b8fe0616424c707220db15f04bdf5376a5

Download Submit
C:\Windows\SysWOW64\Fgjpfqpi.exe

Filesize
93KB

MD5
98631d4bb2d08bfb55d12ea800ec2685

SHA1
05610f306edc23af358db5d7f4e7413d8696d99a

SHA256
a2e6387fa28c573455883f60736c264e6a61b1f68c57ebce9d87397d2062f7f0

SHA512
8ff387fa64635a62a942fac4ff00439a3a3553e8afbee3dc5c229b6a6c6b985542496a876090b518e26ec878a21152209910575a32ea410456e82a280873c45d

Download Submit
C:\Windows\SysWOW64\Fhbbmc32.exe

Filesize
93KB

MD5
780bb4347d5bb2ad9d421d5c6b295cfc

SHA1
d2586e7b041e8ca9fadd5fdb5be197cb992c903a

SHA256
554d91846983d6cf27bd35c811eff0fa2bcce6d4b3a55857eea0cb14ee2a37ef

SHA512
7366ec61431c5a0f7bbbd4491390652a2086803af8dbefc7a26d675a762d68a0124b5ab774cdc717e88ab6f9c1ac4815747aacc125a04b9ff9fc09e1c4480227

Download Submit
C:\Windows\SysWOW64\Gafmkp32.exe

Filesize
93KB

MD5
0148049c2e166cf374dd87d9c548cf17

SHA1
5ec1a0f760878a70eaece60365f9572c0fd7d23f

SHA256
9ae798f9f992f397571e2216c025f1781f6a59e3a876195540be1de33489f8e0

SHA512
9d68eb3b2a4ba920da1966c95ecd698b788d7678ce05044a27c3cfa76234c83795036fefb6bf9dd2aad7b44e39da29b4f97119283cfd2f716df0d42cfb7eeae2

Download Submit
C:\Windows\SysWOW64\Geklckkd.exe

Filesize
93KB

MD5
deaca33466f113c26dc2a8d9fa2ea90f

SHA1
a8ce72fd85c92cf460ad3ff7ad516f9f108959a6

SHA256
aedeb554f774a5e26146c4903cb5d6e70e4b80a1ae484da07140258eeae4b627

SHA512
06f00d55f039019685794f90109fa35c197e19ea7709bf42dc2968d63da1055177587c89dc8ea4f2ec0e87d5b18bc55ca39dc583ed107bc4db01ba232c82f7a9

Download Submit
C:\Windows\SysWOW64\Gjdknjep.exe

Filesize
93KB

MD5
9b90471fadc5fcf754620e514b97afd7

SHA1
39346e550515fb9959d5e812113a88bc1d4b894b

SHA256
39143e5e0cb27704a540eff7b593bd7207aa6f937fbd20e9f1429187adeca7b5

SHA512
caf0de282228e36c751afa36e1f9b524aaaa59c11de7262b34d65727c7722859b56403f5edaaf2231f0038769b6c22f96e68e35fa069f07e9256ed0ac4a5abae

Download Submit
C:\Windows\SysWOW64\Gplged32.exe

Filesize
93KB

MD5
1413ddc6a8f0a1bfbf0ae482a40e75f6

SHA1
c2055fcc3b9a3ea5faa49767effa556ed4f6b329

SHA256
4622e806d9cdb91be6285fba919ac5b25bc8d82f4b7c6eeca579df71d557410d

SHA512
28edd815f31f68ba618b1777de66ca7366516418721628516cfe17941f3cfb900cc6c6cf75d5b744c1916c2705b3dfbba5ea2e30809a86ece4380fda71ab6655

Download Submit
C:\Windows\SysWOW64\Hcipcnac.exe

Filesize
93KB

MD5
9ef5c363fd3e5e9995a6b28565b39593

SHA1
96e1da17bd73f2566a66fe8b36bfdea9446bc43b

SHA256
3e58ecd5fe70312070b3eba92a8b3d59a6222b35335d4621af45f31352e8cf66

SHA512
f65afbe41a2afa481d22e755c6b740208476cb56d80299c66a27af1f256e8389451f7438681b387e36e70c7c5aaf580b0b3c32077f083941f85fa9d23b5e233d

Download Submit
C:\Windows\SysWOW64\Hijohoki.exe

Filesize
64KB

MD5
c991a50b00d299e1e1331f957cd54184

SHA1
9471cf816e31a78ab0938d5fd222f9095a8c2b24

SHA256
331e1d0ae878b85e011237e835b453b323a8b24fb832f99e13f3b8bc9ca6a349

SHA512
a25aca95d70056148a6f15521da3a6d6347362f1020d02d9f50ffbae2e9133f903674a78f1dadf1fd254e43ae8e670fffc52bbe934a04a9d95897402ef3de7e6

Download Submit
C:\Windows\SysWOW64\Hladlc32.exe

Filesize
93KB

MD5
c00faa6a5d47c5bf6a1414cf2c82c6c1

SHA1
49a4b27aac731c4bca80a5859139593bfb80e311

SHA256
ed3fb588e62a8922392a93b0ef58fd81ccdbd0b20f06786d73de6efa09e43732

SHA512
5757ffdad4d91dc5e3c78c17236479b2a6b575b1715c16aa7081c41f0db8e8ee0a48e00a172b60b6db7597fe88fdafd6a52c6a14ec1f8e73169f4d5c6c554010

Download Submit
C:\Windows\SysWOW64\Hojpbigq.exe

Filesize
93KB

MD5
ccccbb6c2e91d8cb0b7d862f3f1a24bd

SHA1
4a687619d71ccd64217640f8f40f57ab4ed83227

SHA256
33c61c07ddcca58279dbdf04459d8801cbf9ba5b78438d197da5a6742c5cdf45

SHA512
2a83e20372d96a8a435fe72b263b48b3b1eea3105cd488ab337abd40c30ce303a07bc2d11160825dcddfa7e1a5e530e754e9043dc630321219f4eef9f3ae377f

Download Submit
C:\Windows\SysWOW64\Ifnbph32.exe

Filesize
93KB

MD5
1de103a43074faba6ecacc10daf4630a

SHA1
8e846b10fb9a18f652ac260ff92987ffab4140ee

SHA256
de18161a0d5e467ac7615545307bb0aa5b9fb604fda12a038f4e5869d58f03fa

SHA512
c7f41af7689b39d8739818f1d0639fa3dccc5064c483df2a4f0aa6d24e9a171fa88687064088088eefe9a3594b613c0b1e7d4dacc4059e8be0a4b50f8ffcdf3c

Download Submit
C:\Windows\SysWOW64\Igpkjo32.exe

Filesize
93KB

MD5
15d6223743ba72fcb7fc8e8ea88c0efd

SHA1
680fe669392056b5dc9627117924a69a32657cdb

SHA256
6ace6a7540df66f7e49480b4d1f67480a8cc6c4c75053baa129f9e7fe6d513b4

SHA512
84252e3181b86bd7f3fa689b0c7eb8ae9b57e7aa86f4b9418ece1610a61b572d0256ab37d93d17d69ae39b82391364c991bacb7b2101ab9d16d732cade1cc8a1

Download Submit
C:\Windows\SysWOW64\Ijcaaibe.exe

Filesize
93KB

MD5
b470b1a70600f92adab6a5f893ed95cd

SHA1
2ee17ba54068c8c4aa3956fc9036737b0884eed4

SHA256
ee9f565877ccdbbfa1a46f7e1ac3a3725be22c06f0aca6f45801bb4c64abb966

SHA512
d8a227673e457b074ed5847450be12d02b72ec84c90cd50d23d5ef8949ca98fe8e301548fa466268046e0647918f16f1aa8b21d01e9a2eff1319d5de98643c47

Download Submit
C:\Windows\SysWOW64\Jfmekm32.exe

Filesize
93KB

MD5
6a5704dad97d6be8a4498142307d5b46

SHA1
466199e2331a4d14b8f1ea9c19c43dc0f52bdee7

SHA256
e738c6e26fd5fe1b5b774d9451be8f55bb89216a71934c5ab33258acadbb3d7e

SHA512
49385be19b54e4eb663ed9fad295c059b34532eaa72ad5e2d91cbc9da3b94b21468eeeb2489b8b0fcae994a577e07c92c317b07a411f892905fea0e94519ca58

Download Submit
C:\Windows\SysWOW64\Jmnomk32.exe

Filesize
93KB

MD5
cef2ee74e123616edb83c97ae2c159cf

SHA1
8144230606ad6990f7a49fbacff8a783df360a1a

SHA256
c5098cbe66bd5f8da5378fec2d233db8742524a13495e9ca27e8b7b73c7ff01b

SHA512
ba2ec6f06c0c3670739e9b467f886bfe0a3647af8ea18ddf5d70ba573a3855e319814ac6cd9cbf4ffc3929ad9515588a3172adb48140af0fabb16db13ebd4cd6

Download Submit
C:\Windows\SysWOW64\Jncapf32.exe

Filesize
93KB

MD5
8f49bc3dc44934affeb9cf9da86423d2

SHA1
ac3e3a10968ba6bb3ee069028bb8a4f208b05ff7

SHA256
37b6f7a1838eba2b1a15bcd5d0c49e60d8ad4b030c16a284555efb61d581f7b7

SHA512
4b723a9c9a36f3577d31bd061f6b540ac03e6de7304d6b3f8d57265bf2dffd08ec3d7c3b50e7957db7c67599251a52174de290d6cb2ef3019cf9e8477ebb7b84

Download Submit
C:\Windows\SysWOW64\Jqklnp32.exe

Filesize
93KB

MD5
98f7345b09f9e772bb80137ff1acd317

SHA1
dabbaa3d0d989eea366d1aa2fdc31df100844ae0

SHA256
c50a6171a765eb008dcb4c9cb1956e6fdb383ee4467e54a2c4af5bcbc50695ac

SHA512
1e3fdde732b93a2ba792c41ff549e648e37e0065e264712653c5af5e65b02cd841400b9e5cc842c50a3395aaf41c3494f59e91ca474abce57d54b2c8afdd29ed

Download Submit
C:\Windows\SysWOW64\Kcpjgo32.exe

Filesize
93KB

MD5
7eb782bfb8f861437d9bbc6233196b0d

SHA1
daa95ad5bf1422e98dfb3ebf2f187baa21d22eca

SHA256
efcf78e1db45adf99e04b1762cd032ac716b0ae3f6da4e9b5cf233d72e2e833b

SHA512
c26f164524f2293dc4d8a103a07ddbb636f0242036de48250c740f6b5af8fbd5188d686ce5f2f9972a29ae8a1dc766c2dd4832bfcacab67dd0e5e4f9b06984eb

Download Submit
C:\Windows\SysWOW64\Kgngqico.exe

Filesize
93KB

MD5
120b2fa9261fbf716dd7f9308d79f3e9

SHA1
8a5bdabc6f40c6562c28aa5fbb1c5ebe6424d186

SHA256
a2228bb87413ea1e899c82876494ae88e92c60d4221863778d319fa1099aa1e6

SHA512
d56ee6d422cfbfc4bd0993c01b3a12af3057da867f11028878ff2e95322c91449d2b94c1d69019ce1dcae595213d35ac26255cffc1aae51843e63a6ef6b91566

Download Submit
C:\Windows\SysWOW64\Kinefp32.exe

Filesize
93KB

MD5
80640ad9b7cb65fdf7ab1de8f55eba2f

SHA1
ce08cb732ce16032d74247a68cb63f64d280c0f3

SHA256
b94f74f6052ef6c8a0ca11b44742fea3a10aff0c6180b65b0b89af8d2d705120

SHA512
515109c1a67552c3b8f668f940cb8590ab82e1af708ad473f20b47ef4a710ddff129485509a5f933d4dbf944be96334d7733ac959960da3e8f653447f3a9c382

Download Submit
C:\Windows\SysWOW64\Lgkhec32.exe

Filesize
93KB

MD5
9f944bafb34214587910f545937db4c0

SHA1
599d7b57e01816dd2fc2c09bb5ef96a40c3faa24

SHA256
2113bf5bd92540a5f09547fca49e3e1f26d14ebf487cc18ac5375ecd658391e6

SHA512
e1ac62cb3dcf3327321b30ec0df50c095f10919097a6d28a1afaf10904daef899a45545d76937965c9edf49a71143f761ca06afd44ad7d3b903feab45622b254

Download Submit
C:\Windows\SysWOW64\Lhammfci.exe

Filesize
93KB

MD5
f337d73ab0b12b47b3c439c5dd98d0aa

SHA1
827c88070f9e1052364d9fc03e3a6e8f74da2a1d

SHA256
d3216754716ce2fdfbbce02d451e93ff30375fed1875b795b5239ba1132ee415

SHA512
2b196595729b9210546b895906d2becdc40dc628cb97f94524a3b61e9a03d9707e1a3d63daa5e5a0cb6371f8e5b370b4b5884e5972b22dc03a2815730096828b

Download Submit
C:\Windows\SysWOW64\Lplaaiqd.exe

Filesize
93KB

MD5
3ff4c9ddce4632ff365aaac38fb7a7c0

SHA1
7bf0d9a75b10f5451e635113bce4d33cd06d1f46

SHA256
dbaf9f5669a04ca3072a156bbc04f7e6e6d528d5dd6df6f90381d45a4b1cc011

SHA512
08a3c5fae02b392bacdf8d31577b3b86a0478d8ad0e4f6165eaa9c366f0db7c0495b202027b6b033d1d0694540c09fe950e7e0f151f3b3b869350890f3bbc0d1

Download Submit
C:\Windows\SysWOW64\Mjqjbn32.exe

Filesize
93KB

MD5
fb324b562ec1b8e9a5ebd3dda549a030

SHA1
fa685926595308f79818730bbbb6508d5e4066b2

SHA256
0e1a7e70b1740940c6e5b00a2292bfd39d2bb54a4699511ddbd1f2ebf24ab05d

SHA512
1dcf04532bd47ac136e365102fad3b150d8da991411d0bf2caa9b96dad23ed3e2c7d9cf0035c234d3ff2b61337b46b29da8dfb69ed6f3f75944bab2914b38b74

Download Submit
C:\Windows\SysWOW64\Mklpof32.exe

Filesize
93KB

MD5
c8e5dc754cae7654e48870966186ee9e

SHA1
c5f1bdfbfc06c8be8d10808d09302df77c3c52a8

SHA256
8026bbf07d6b091315d8ef37b4440a71fc0449f26df8d2bf82c0d89dbeb9e0e6

SHA512
e9b95847f197ab6c9d6fa84377337a1fe2edcea0a26665d003d2ba42291357abff67cf8dc1436ec49732b157fd737e0db57147956a8bd38472f0902b62d5b9e1

Download Submit
C:\Windows\SysWOW64\Namnmp32.exe

Filesize
93KB

MD5
5a505d855b0152c7948894ece81ba426

SHA1
187f972c7f49f89b4d8da17f5c472fe59b326d94

SHA256
aff69626fe93d51ed39f828ad0675c5460999c2999f49fc22fc5ecbc42649e8d

SHA512
894dfcbecfdfd81286b4445c4b938c79e3de672885378d4bbd7df739e9cb126f371ebebfe088e5d3021afd39a7ca33bdbd6936dc960fa057640e81638e497b49

Download Submit
C:\Windows\SysWOW64\Nbfoeiei.exe

Filesize
93KB

MD5
bef3e24d556f3fb517475da20ce10952

SHA1
5e7faa94480ef638d53bb62f2f2742dda997924a

SHA256
b7a6c3546e27f72357f84c0e288becc8ddf01ef2b3bcdb20703413fcfb0250eb

SHA512
362111ec59ec913846eb4180ac65d5d7addc87b3a09d7c8e33b911c0144c02b869f146e3860858823e8ddb18dd46d266711421f7b1c626cd541c7c14c000b295

Download Submit
C:\Windows\SysWOW64\Nhcbidcd.exe

Filesize
93KB

MD5
4fd696c94a46bb878fbf533dfe592887

SHA1
88caf3196d0ed87401a5327bb4a5e8729b560010

SHA256
13b9300b33e5061e7cd186386f1ae3cd58cd6b2320cc6f7062a0ca597aaa1d0b

SHA512
6dbc108454ab31339a0f8ad395c8ae260f6802c8028efc6cfb1f86168a543ef63627f820dd579673ead8f15e4663d34ac361a1731e2db2d46330a9723be1316f

Download Submit
C:\Windows\SysWOW64\Npjnbg32.exe

Filesize
93KB

MD5
f81322bf3a5be3e0682e3570f3789df4

SHA1
3d795b6491363d8617c3aa49f891e4817bc6c9e3

SHA256
8f13caaac7a898a66c44e44b8e49bdba040868264fd37fac42da3bf01b61c411

SHA512
fd3ad42d64b95b6eb29aacc023e6a4af018af14bcffb326e0f2958bed9f1ae0ac1e9f71d8f3c333e8b998940a86edb4719a5a7150e6e51792a6d5aaec220ee45

Download Submit
C:\Windows\SysWOW64\Oafacn32.exe

Filesize
93KB

MD5
62ea2c2a422a7df6ffd2706e9a8cc3e5

SHA1
4bbb607dd9ea1ce84557f0315c02e0b22c65873d

SHA256
fec19cf2bf5e2a9799a90b08dadcd7f2e3723164781c855eecc050dc3565033c

SHA512
657e6d224bf69415a26e502345d120dc868f11bbba9555f8522c43d3ed517d39310c182bf7380a261a38f576ff9090ba0a73ceea4c7ab989aa778ae49b375621

Download Submit
C:\Windows\SysWOW64\Occkhp32.exe

Filesize
93KB

MD5
dc8cb3d96f8c4e98395c8a2e8a7681ab

SHA1
037eac0eee51a76ed92591362907cd1667b0d3a8

SHA256
6aa09cd9534a076033dc7887c18bafdf041642ad62826e2b6df355b786a9272a

SHA512
8dbc69829f2858ef521ae04b042b60cc856a2b03d931f749e3882197949ba063bc2bec5bba85cea624cca2ada835912f5eff8e7deae296db2a0ebc46900b423a

Download Submit
C:\Windows\SysWOW64\Ofaeffpa.exe

Filesize
93KB

MD5
d4dd14d8bf3d7a678d21a19f4e51b492

SHA1
c01f1a091f06160973d6f7fc4438a2662f83e8bb

SHA256
3ac6957c47f62ea21945b626e5b53410909ac9152e607e94e9742c8c6690c270

SHA512
9914fb7f42a49121938561fddf91d134abe7d4000252308b5b3a1343f0f7bb1fc534d111acc2a7089df6198b97978549c257d15cb2389ab884744460218e7808

Download Submit
C:\Windows\SysWOW64\Ofhcdlgg.exe

Filesize
93KB

MD5
2753fc680c9d8a98791eec0ab4dad54a

SHA1
05d5d9c8e338c04ea30a88be2b128e216761b3e6

SHA256
b5b21f90bb704e32525df3f7a6bda0fab1b41010e0a7054ac7512cbebc3933eb

SHA512
593a650f0530d423209da79a83010fa2babbcb291f201baaf06876331d6dd284c3c0574835ed9afccc09078e1fdfe15282ae408985e2d77b17ffa251f2d845af

Download Submit
C:\Windows\SysWOW64\Okkalnjm.exe

Filesize
93KB

MD5
f941aa381092b963383d9c629031d841

SHA1
904d9e971f1d99309ad73ad34ee62a9b9b6a1855

SHA256
138ff516fd3d3c7c00f1028b6fc8a46f71dfd571698ceb939e3f9c3602122e37

SHA512
c17682909afe4e141acb4c1ac8a1cf10e484e0cdfe45cbcec4127c504fb968f0e26bc2d6d0cbcbda2925ca58fc32a92134f7fe9a501d20c554d2f398e841e1d1

Download Submit
C:\Windows\SysWOW64\Phiekaql.exe

Filesize
93KB

MD5
50dc5446959645749928688ad6390e7d

SHA1
b013858655f59cd4a340dae13d0525e8403ad726

SHA256
c1c54e9cb021503c36b67e2e5dd4266f2f3817778d3d73f28c5482870635d06c

SHA512
8c2605e9048794791e5540065b5f8360ea0813aecc1a8e0b7c3940798144dc4edf86b655e6664876765fcabb3058437a4a67a312f209423f9bd66c5cac34eb74

Download Submit
C:\Windows\SysWOW64\Pklamb32.exe

Filesize
93KB

MD5
f6339c9448f813817c3a8a858a0854b4

SHA1
929d3df1206ae79bb84b7956fe31b670f7f66fbb

SHA256
df0a019ff3d96448120d81a5376bc241c6b454406cfd3b499567d33199e97de5

SHA512
928e9c47aa5d7b79b9b466c3cd0a7d942e7ecf5d195db088e003fd426fe643ab1f76716b6e4012ab4eecaf86485f13e458b63a4ade7fec15e52f77f5401f8ed0

Download Submit
memory/408-407-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/436-431-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/440-425-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/696-127-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/736-160-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/816-298-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1032-338-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1084-192-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1116-240-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1332-394-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1356-120-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1392-358-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1552-388-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1600-370-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1672-437-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1756-340-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1828-199-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/1956-231-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2200-352-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2320-168-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2404-71-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2484-96-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2496-135-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2568-248-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2632-292-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2652-151-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2664-0-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2684-39-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2700-328-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2760-322-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2832-143-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/2836-272-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3104-376-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3228-215-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3272-103-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3288-8-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3324-304-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3356-413-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3364-286-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3368-262-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3420-47-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3424-112-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3476-32-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3484-175-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3496-208-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3504-55-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3580-256-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3584-80-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3672-64-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/3768-224-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4112-184-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4144-278-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4180-320-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4288-310-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4312-400-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4340-16-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4392-419-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4420-23-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4544-346-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4636-382-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4744-87-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4780-282-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4904-403-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/5080-364-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads