4d424b6b8dcb29a72638a485df228632c8d0a263d7e0aacd45dfd9bd92134638

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
23/01/2024, 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

70c5117867827699fdfd10822fd54121.exe
Size

363KB
MD5

70c5117867827699fdfd10822fd54121
SHA1

8a6e5c291c262989da2a74ed24df3b115d06bb7f
SHA256

4d424b6b8dcb29a72638a485df228632c8d0a263d7e0aacd45dfd9bd92134638
SHA512

8e49f67207f233113940ce09e387f6b1e54d0de7946f94fd2140dc8baf626e8dca462b2fb6293d74221aafee276e2aac4f24a5dc1859092c2e9f806ab90188d7
SSDEEP

6144:ZjgqdKEr5tTDUZNSN58VU5tTb3MdEqc5tTDUZNSN58VU5tT:Z955t6NSN6G5t/3F5t6NSN6G5t

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lknojl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afpjel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Caageq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqknig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glldgljg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjcngpjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fnhbmgmk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hocqam32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikaggmii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Egcaod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqmlccdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mepfiq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aphnnafb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mffjcopi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Neqopnhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oepifi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bokehc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bapgdm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njciko32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdijbg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iafonaao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omgcpokp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnkfmm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Deokon32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmofagfp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iinqbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Holfoqcm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qaqegecm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbcncibp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Efkphnbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Naaqofgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpbflg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nebdoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amcmpodi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlphbnoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bombmcec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkqeib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Foqkdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfbibikg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpgpgfmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebifmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Paihlpfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgdokkfg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pafkgphl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kmieae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oeaoab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckclhn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ealkjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acfhad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lddgmbpb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmlkhofd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbbajjlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mockmala.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgnkhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nciopppp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdapehop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cajjjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bggnof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nolgijpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmikeaap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eonehbjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akepfpcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lchfib32.exe

Executes dropped EXE 64 IoCs

pid	Process
2424	Nebdoa32.exe
228	Ndcdmikd.exe
1744	Neeqea32.exe
3404	Ndfqbhia.exe
2284	Njciko32.exe
1292	Npmagine.exe
4612	Nfjjppmm.exe
2080	Ojgbfocc.exe
1324	Ofnckp32.exe
2924	Odocigqg.exe
4188	Ojllan32.exe
4984	Olmeci32.exe
2788	Ogbipa32.exe
3028	Pqknig32.exe
4532	Pgefeajb.exe
1460	Pqmjog32.exe
976	Pcncpbmd.exe
2640	Pmfhig32.exe
1312	Pgllfp32.exe
5052	Pnfdcjkg.exe
4916	Pjmehkqk.exe
3232	Qdbiedpa.exe
1452	Qjoankoi.exe
3900	Ampkof32.exe
3664	Aeiofcji.exe
4976	Anadoi32.exe
1316	Afmhck32.exe
4604	Amgapeea.exe
3744	Aglemn32.exe
3400	Agoabn32.exe
4444	Bmkjkd32.exe
4868	Bganhm32.exe
1616	Baicac32.exe
420	Bffkij32.exe
100	Bcjlcn32.exe
4200	Bjddphlq.exe
1820	Bmbplc32.exe
5012	Beihma32.exe
5004	Bfkedibe.exe
2996	Bapiabak.exe
4496	Chjaol32.exe
464	Cabfga32.exe
2932	Cdabcm32.exe
4716	Cnicfe32.exe
4440	Ceckcp32.exe
3100	Cfdhkhjj.exe
4972	Cmnpgb32.exe
3612	Cdhhdlid.exe
5080	Cmqmma32.exe
5084	Cegdnopg.exe
4108	Dfiafg32.exe
812	Dmcibama.exe
4368	Dhhnpjmh.exe
220	Dmefhako.exe
3372	Ddonekbl.exe
3828	Dodbbdbb.exe
1156	Deokon32.exe
444	Dfpgffpm.exe
3064	Dmjocp32.exe
5032	Dahhio32.exe
2920	Edfdej32.exe
2732	Ekpmbddq.exe
904	Eajeon32.exe
2164	Eonehbjg.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Npodfe32.dll	Elgaeolp.exe
File created	C:\Windows\SysWOW64\Lnnlhc32.dll	Gbofcghl.exe
File created	C:\Windows\SysWOW64\Cdkifmjq.exe	Cnaaib32.exe
File created	C:\Windows\SysWOW64\Idkobdie.dll	Kekbjo32.exe
File opened for modification	C:\Windows\SysWOW64\Jnhpoamf.exe	Jgogbgei.exe
File created	C:\Windows\SysWOW64\Jecampmk.dll	Ckpbnb32.exe
File created	C:\Windows\SysWOW64\Cgilho32.dll	Ecdbop32.exe
File created	C:\Windows\SysWOW64\Phpmopfk.dll	Gempgj32.exe
File created	C:\Windows\SysWOW64\Jmpocjfb.dll	Mlklkgei.exe
File created	C:\Windows\SysWOW64\Plhfdjfl.dll	Opemca32.exe
File created	C:\Windows\SysWOW64\Bblnindg.exe	Bombmcec.exe
File created	C:\Windows\SysWOW64\Enigke32.exe	Dmennnni.exe
File opened for modification	C:\Windows\SysWOW64\Gppcmeem.exe	Gfhndpol.exe
File created	C:\Windows\SysWOW64\Nhhlki32.dll	Qaqegecm.exe
File created	C:\Windows\SysWOW64\Jfpqiega.dll	Mcdeeq32.exe
File created	C:\Windows\SysWOW64\Njciko32.exe	Ndfqbhia.exe
File created	C:\Windows\SysWOW64\Pafkgphl.exe	Pbcncibp.exe
File created	C:\Windows\SysWOW64\Hgagmm32.dll	Qgpogili.exe
File created	C:\Windows\SysWOW64\Bildbk32.dll	Ggnedlao.exe
File opened for modification	C:\Windows\SysWOW64\Pchlpfjb.exe	Pkadoiip.exe
File created	C:\Windows\SysWOW64\Jleiba32.dll	Jinboekc.exe
File created	C:\Windows\SysWOW64\Bgemej32.dll	Npepkf32.exe
File created	C:\Windows\SysWOW64\Kaadlo32.dll	Nmaciefp.exe
File created	C:\Windows\SysWOW64\Ofjljj32.dll	Eqmlccdi.exe
File created	C:\Windows\SysWOW64\Phhhhc32.exe	Pckppl32.exe
File opened for modification	C:\Windows\SysWOW64\Fgiaemic.exe	Fcneeo32.exe
File created	C:\Windows\SysWOW64\Jcnmjgff.dll	Ggnlobej.exe
File opened for modification	C:\Windows\SysWOW64\Jecofa32.exe	Jkkjmlan.exe
File created	C:\Windows\SysWOW64\Ncgjgp32.dll	Dfoiaj32.exe
File opened for modification	C:\Windows\SysWOW64\Jpdhkf32.exe	Jnelok32.exe
File created	C:\Windows\SysWOW64\Fbiipkjk.dll	Maggnali.exe
File created	C:\Windows\SysWOW64\Kngmnjok.dll	Pmbegqjk.exe
File created	C:\Windows\SysWOW64\Efoomp32.dll	Affikdfn.exe
File opened for modification	C:\Windows\SysWOW64\Fhmpagkp.exe	Feocelll.exe
File opened for modification	C:\Windows\SysWOW64\Baicac32.exe	Bganhm32.exe
File created	C:\Windows\SysWOW64\Gdbmhf32.exe	Gnhdkl32.exe
File created	C:\Windows\SysWOW64\Nimbkc32.exe	Nafjjf32.exe
File opened for modification	C:\Windows\SysWOW64\Phganm32.exe	Pchlpfjb.exe
File opened for modification	C:\Windows\SysWOW64\Lqhdbm32.exe	Lgpoihnl.exe
File created	C:\Windows\SysWOW64\Lfgipd32.exe	Lcimdh32.exe
File opened for modification	C:\Windows\SysWOW64\Pffgom32.exe	Pjpfjl32.exe
File created	C:\Windows\SysWOW64\Goaojagc.dll	Nebdoa32.exe
File opened for modification	C:\Windows\SysWOW64\Lhenai32.exe	Ljbnfleo.exe
File opened for modification	C:\Windows\SysWOW64\Aggegh32.exe	Aqmlknnd.exe
File created	C:\Windows\SysWOW64\Bhldpj32.exe	Bfngdn32.exe
File created	C:\Windows\SysWOW64\Ffceip32.exe	Fpimlfke.exe
File created	C:\Windows\SysWOW64\Bjdlfi32.dll	Fpimlfke.exe
File opened for modification	C:\Windows\SysWOW64\Dpiplm32.exe	Cklhcfle.exe
File created	C:\Windows\SysWOW64\Pbcncibp.exe	Ppdbgncl.exe
File created	C:\Windows\SysWOW64\Oomibind.dll	Pqmjog32.exe
File created	C:\Windows\SysWOW64\Ajggomog.exe	Aoabad32.exe
File created	C:\Windows\SysWOW64\Pmlmkn32.exe	Plkpcfal.exe
File created	C:\Windows\SysWOW64\Fgijpe32.dll	Baegibae.exe
File created	C:\Windows\SysWOW64\Glllagck.dll	Ljbnfleo.exe
File created	C:\Windows\SysWOW64\Fkcboack.exe	Fdijbg32.exe
File created	C:\Windows\SysWOW64\Gcnobqph.dll	Jjjghcfp.exe
File created	C:\Windows\SysWOW64\Jklinohd.exe	Jcdala32.exe
File opened for modification	C:\Windows\SysWOW64\Eklajcmc.exe	Ehndnh32.exe
File opened for modification	C:\Windows\SysWOW64\Ddmhhd32.exe	Dncpkjoc.exe
File created	C:\Windows\SysWOW64\Bhkacq32.dll	Epdime32.exe
File opened for modification	C:\Windows\SysWOW64\Beihma32.exe	Bmbplc32.exe
File opened for modification	C:\Windows\SysWOW64\Ofhknodl.exe	Ocgbld32.exe
File opened for modification	C:\Windows\SysWOW64\Ebdlangb.exe	Eoepebho.exe
File created	C:\Windows\SysWOW64\Dnmhpg32.exe	Dmlkhofd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
11124	9392	WerFault.exe	985

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Noppeaed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fnffhgon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajlgckkf.dll"	Oeaoab32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qadoba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpkpbaea.dll"	Mjlhgaqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ifihif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ginacp32.dll"	Akccap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecbfdd32.dll"	Licfngjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jnjejjgh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdjgha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnnbqnjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npodfe32.dll"	Elgaeolp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nobkpkdh.dll"	Dkfadkgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Noppeaed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dgbanq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amgapeea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abgiapmj.dll"	Pfnegggi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmklglpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iolgql32.dll"	Fjmfmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfllfd32.dll"	Kkgiimng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bohgljdl.dll"	Kodnmkap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nphihiif.dll"	Ombcji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdmpga32.dll"	Omdppiif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohlimd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lldopb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ioenpjfm.dll"	Bmabggdm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hoadkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgclpkac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omalpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ebaplnie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aammfkln.dll"	Daeifj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kelalp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mfhfhong.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjnmpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkjaaljm.dll"	Jbccge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjmkmfbo.dll"	Klpakj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcpeei32.dll"	Dfgcakon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Egnajocq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ampkof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bclang32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aoabad32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Igbalblk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jilkmnni.dll"	Ojllan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lbjelc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mffjcopi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfhndpol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjehnm32.dll"	Pjpfjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ilphdlqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipckmjqi.dll"	Dbndfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Momkkhch.dll"	Fbhpch32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akhkncql.dll"	Dbpjaeoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgplfcko.dll"	Bogcgj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddcqedkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpbiip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhkacq32.dll"	Epdime32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjcbnbmg.dll"	Npmagine.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Beihma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfnegggi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ipoopgnf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omjpeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Holfoqcm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chiblk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fofilp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Likcilhh.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 2424	4968	70c5117867827699fdfd10822fd54121.exe	84
PID 4968 wrote to memory of 2424	4968	70c5117867827699fdfd10822fd54121.exe	84
PID 4968 wrote to memory of 2424	4968	70c5117867827699fdfd10822fd54121.exe	84
PID 2424 wrote to memory of 228	2424	Nebdoa32.exe	85
PID 2424 wrote to memory of 228	2424	Nebdoa32.exe	85
PID 2424 wrote to memory of 228	2424	Nebdoa32.exe	85
PID 228 wrote to memory of 1744	228	Ndcdmikd.exe	86
PID 228 wrote to memory of 1744	228	Ndcdmikd.exe	86
PID 228 wrote to memory of 1744	228	Ndcdmikd.exe	86
PID 1744 wrote to memory of 3404	1744	Neeqea32.exe	87
PID 1744 wrote to memory of 3404	1744	Neeqea32.exe	87
PID 1744 wrote to memory of 3404	1744	Neeqea32.exe	87
PID 3404 wrote to memory of 2284	3404	Ndfqbhia.exe	88
PID 3404 wrote to memory of 2284	3404	Ndfqbhia.exe	88
PID 3404 wrote to memory of 2284	3404	Ndfqbhia.exe	88
PID 2284 wrote to memory of 1292	2284	Njciko32.exe	90
PID 2284 wrote to memory of 1292	2284	Njciko32.exe	90
PID 2284 wrote to memory of 1292	2284	Njciko32.exe	90
PID 1292 wrote to memory of 4612	1292	Npmagine.exe	91
PID 1292 wrote to memory of 4612	1292	Npmagine.exe	91
PID 1292 wrote to memory of 4612	1292	Npmagine.exe	91
PID 4612 wrote to memory of 2080	4612	Nfjjppmm.exe	92
PID 4612 wrote to memory of 2080	4612	Nfjjppmm.exe	92
PID 4612 wrote to memory of 2080	4612	Nfjjppmm.exe	92
PID 2080 wrote to memory of 1324	2080	Ojgbfocc.exe	94
PID 2080 wrote to memory of 1324	2080	Ojgbfocc.exe	94
PID 2080 wrote to memory of 1324	2080	Ojgbfocc.exe	94
PID 1324 wrote to memory of 2924	1324	Ofnckp32.exe	95
PID 1324 wrote to memory of 2924	1324	Ofnckp32.exe	95
PID 1324 wrote to memory of 2924	1324	Ofnckp32.exe	95
PID 2924 wrote to memory of 4188	2924	Odocigqg.exe	96
PID 2924 wrote to memory of 4188	2924	Odocigqg.exe	96
PID 2924 wrote to memory of 4188	2924	Odocigqg.exe	96
PID 4188 wrote to memory of 4984	4188	Ojllan32.exe	97
PID 4188 wrote to memory of 4984	4188	Ojllan32.exe	97
PID 4188 wrote to memory of 4984	4188	Ojllan32.exe	97
PID 4984 wrote to memory of 2788	4984	Olmeci32.exe	99
PID 4984 wrote to memory of 2788	4984	Olmeci32.exe	99
PID 4984 wrote to memory of 2788	4984	Olmeci32.exe	99
PID 2788 wrote to memory of 3028	2788	Ogbipa32.exe	100
PID 2788 wrote to memory of 3028	2788	Ogbipa32.exe	100
PID 2788 wrote to memory of 3028	2788	Ogbipa32.exe	100
PID 3028 wrote to memory of 4532	3028	Pqknig32.exe	101
PID 3028 wrote to memory of 4532	3028	Pqknig32.exe	101
PID 3028 wrote to memory of 4532	3028	Pqknig32.exe	101
PID 4532 wrote to memory of 1460	4532	Pgefeajb.exe	102
PID 4532 wrote to memory of 1460	4532	Pgefeajb.exe	102
PID 4532 wrote to memory of 1460	4532	Pgefeajb.exe	102
PID 1460 wrote to memory of 976	1460	Pqmjog32.exe	103
PID 1460 wrote to memory of 976	1460	Pqmjog32.exe	103
PID 1460 wrote to memory of 976	1460	Pqmjog32.exe	103
PID 976 wrote to memory of 2640	976	Pcncpbmd.exe	104
PID 976 wrote to memory of 2640	976	Pcncpbmd.exe	104
PID 976 wrote to memory of 2640	976	Pcncpbmd.exe	104
PID 2640 wrote to memory of 1312	2640	Pmfhig32.exe	105
PID 2640 wrote to memory of 1312	2640	Pmfhig32.exe	105
PID 2640 wrote to memory of 1312	2640	Pmfhig32.exe	105
PID 1312 wrote to memory of 5052	1312	Pgllfp32.exe	106
PID 1312 wrote to memory of 5052	1312	Pgllfp32.exe	106
PID 1312 wrote to memory of 5052	1312	Pgllfp32.exe	106
PID 5052 wrote to memory of 4916	5052	Pnfdcjkg.exe	107
PID 5052 wrote to memory of 4916	5052	Pnfdcjkg.exe	107
PID 5052 wrote to memory of 4916	5052	Pnfdcjkg.exe	107
PID 4916 wrote to memory of 3232	4916	Pjmehkqk.exe	108

C:\Users\Admin\AppData\Local\Temp\70c5117867827699fdfd10822fd54121.exe
"C:\Users\Admin\AppData\Local\Temp\70c5117867827699fdfd10822fd54121.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Windows\SysWOW64\Nebdoa32.exe
  C:\Windows\system32\Nebdoa32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\SysWOW64\Ndcdmikd.exe
    C:\Windows\system32\Ndcdmikd.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:228
  - - C:\Windows\SysWOW64\Neeqea32.exe
      C:\Windows\system32\Neeqea32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1744
    - - C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3404
      - C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2284
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1292
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2080
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1324
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2924
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4188
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2788
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3028
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4532
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1460
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:976
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2640
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1312
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4916
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        23⤵
        Executes dropped EXE
        
        PID:3232
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        24⤵
        Executes dropped EXE
        
        PID:1452
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3900
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        26⤵
        Executes dropped EXE
        
        PID:3664
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        27⤵
        Executes dropped EXE
        
        PID:4976
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        28⤵
        Executes dropped EXE
        
        PID:1316
        
        C:\Windows\SysWOW64\Amgapeea.exe
        
        C:\Windows\system32\Amgapeea.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4604
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        30⤵
        Executes dropped EXE
        
        PID:3744
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        31⤵
        Executes dropped EXE
        
        PID:3400
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        32⤵
        Executes dropped EXE
        
        PID:4444
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4868
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        34⤵
        Executes dropped EXE
        
        PID:1616
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        35⤵
        Executes dropped EXE
        
        PID:420
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        36⤵
        Executes dropped EXE
        
        PID:100
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4200
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1820
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        39⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5012
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        40⤵
        Executes dropped EXE
        
        PID:5004
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        41⤵
        Executes dropped EXE
        
        PID:2996
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        42⤵
        Executes dropped EXE
        
        PID:4496
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        43⤵
        Executes dropped EXE
        
        PID:464
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        44⤵
        Executes dropped EXE
        
        PID:2932
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        45⤵
        Executes dropped EXE
        
        PID:4716
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        46⤵
        Executes dropped EXE
        
        PID:4440
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        47⤵
        Executes dropped EXE
        
        PID:3100
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        48⤵
        Executes dropped EXE
        
        PID:4972
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        49⤵
        Executes dropped EXE
        
        PID:3612
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        50⤵
        Executes dropped EXE
        
        PID:5080
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        51⤵
        Executes dropped EXE
        
        PID:5084
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        52⤵
        Executes dropped EXE
        
        PID:4108
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        53⤵
        Executes dropped EXE
        
        PID:812
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        54⤵
        Executes dropped EXE
        
        PID:4368
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        55⤵
        Executes dropped EXE
        
        PID:220
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        56⤵
        Executes dropped EXE
        
        PID:3372
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        57⤵
        Executes dropped EXE
        
        PID:3828
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1156
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        59⤵
        Executes dropped EXE
        
        PID:444
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        60⤵
        Executes dropped EXE
        
        PID:3064
        
        C:\Windows\SysWOW64\Dahhio32.exe
        
        C:\Windows\system32\Dahhio32.exe
        61⤵
        Executes dropped EXE
        
        PID:5032
        
        C:\Windows\SysWOW64\Edfdej32.exe
        
        C:\Windows\system32\Edfdej32.exe
        62⤵
        Executes dropped EXE
        
        PID:2920
        
        C:\Windows\SysWOW64\Ekpmbddq.exe
        
        C:\Windows\system32\Ekpmbddq.exe
        63⤵
        Executes dropped EXE
        
        PID:2732
        
        C:\Windows\SysWOW64\Eajeon32.exe
        
        C:\Windows\system32\Eajeon32.exe
        64⤵
        Executes dropped EXE
        
        PID:904
        
        C:\Windows\SysWOW64\Eonehbjg.exe
        
        C:\Windows\system32\Eonehbjg.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2164
        
        C:\Windows\SysWOW64\Egijmegb.exe
        
        C:\Windows\system32\Egijmegb.exe
        66⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\Eejjjl32.exe
        
        C:\Windows\system32\Eejjjl32.exe
        67⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\Eglgbdep.exe
        
        C:\Windows\system32\Eglgbdep.exe
        68⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\Eaakpm32.exe
        
        C:\Windows\system32\Eaakpm32.exe
        69⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\Ehkclgmb.exe
        
        C:\Windows\system32\Ehkclgmb.exe
        70⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\Eoekia32.exe
        
        C:\Windows\system32\Eoekia32.exe
        71⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Feocelll.exe
        
        C:\Windows\system32\Feocelll.exe
        72⤵
        Drops file in System32 directory
        
        PID:3948
        
        C:\Windows\SysWOW64\Fhmpagkp.exe
        
        C:\Windows\system32\Fhmpagkp.exe
        73⤵
        
        PID:568
        
        C:\Windows\SysWOW64\Fddqghpd.exe
        
        C:\Windows\system32\Fddqghpd.exe
        74⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\Fgbmccpg.exe
        
        C:\Windows\system32\Fgbmccpg.exe
        75⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\Fnmepn32.exe
        
        C:\Windows\system32\Fnmepn32.exe
        76⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\Fdfmlhna.exe
        
        C:\Windows\system32\Fdfmlhna.exe
        77⤵
        
        PID:852
        
        C:\Windows\SysWOW64\Fkqeib32.exe
        
        C:\Windows\system32\Fkqeib32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4672
        
        C:\Windows\SysWOW64\Fnobem32.exe
        
        C:\Windows\system32\Fnobem32.exe
        79⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\Fdijbg32.exe
        
        C:\Windows\system32\Fdijbg32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1716
        
        C:\Windows\SysWOW64\Fkcboack.exe
        
        C:\Windows\system32\Fkcboack.exe
        81⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\Fehfljca.exe
        
        C:\Windows\system32\Fehfljca.exe
        82⤵
        
        PID:1008
        
        C:\Windows\SysWOW64\Fhgbhfbe.exe
        
        C:\Windows\system32\Fhgbhfbe.exe
        83⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\Foqkdp32.exe
        
        C:\Windows\system32\Foqkdp32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:640
        
        C:\Windows\SysWOW64\Gaogak32.exe
        
        C:\Windows\system32\Gaogak32.exe
        85⤵
        
        PID:920
        
        C:\Windows\SysWOW64\Gglpibgm.exe
        
        C:\Windows\system32\Gglpibgm.exe
        86⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Gochjpho.exe
        
        C:\Windows\system32\Gochjpho.exe
        87⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Gempgj32.exe
        
        C:\Windows\system32\Gempgj32.exe
        88⤵
        Drops file in System32 directory
        
        PID:5232
        
        C:\Windows\SysWOW64\Ggnlobej.exe
        
        C:\Windows\system32\Ggnlobej.exe
        89⤵
        Drops file in System32 directory
        
        PID:5280
        
        C:\Windows\SysWOW64\Gnhdkl32.exe
        
        C:\Windows\system32\Gnhdkl32.exe
        90⤵
        Drops file in System32 directory
        
        PID:5320
        
        C:\Windows\SysWOW64\Gdbmhf32.exe
        
        C:\Windows\system32\Gdbmhf32.exe
        91⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Ggqida32.exe
        
        C:\Windows\system32\Ggqida32.exe
        92⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Gnkaalkd.exe
        
        C:\Windows\system32\Gnkaalkd.exe
        93⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Gfbibikg.exe
        
        C:\Windows\system32\Gfbibikg.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5556
        
        C:\Windows\SysWOW64\Ggcfja32.exe
        
        C:\Windows\system32\Ggcfja32.exe
        95⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Gojnko32.exe
        
        C:\Windows\system32\Gojnko32.exe
        96⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Hffcmh32.exe
        
        C:\Windows\system32\Hffcmh32.exe
        97⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Hghoeqmp.exe
        
        C:\Windows\system32\Hghoeqmp.exe
        98⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Hbmcbime.exe
        
        C:\Windows\system32\Hbmcbime.exe
        99⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Hhgloc32.exe
        
        C:\Windows\system32\Hhgloc32.exe
        100⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Hoadkn32.exe
        
        C:\Windows\system32\Hoadkn32.exe
        101⤵
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Hbpphi32.exe
        
        C:\Windows\system32\Hbpphi32.exe
        102⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Hglipp32.exe
        
        C:\Windows\system32\Hglipp32.exe
        103⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Hocqam32.exe
        
        C:\Windows\system32\Hocqam32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6024
        
        C:\Windows\SysWOW64\Hfningai.exe
        
        C:\Windows\system32\Hfningai.exe
        105⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Hgoeep32.exe
        
        C:\Windows\system32\Hgoeep32.exe
        106⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Hofmfmhj.exe
        
        C:\Windows\system32\Hofmfmhj.exe
        107⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Hfpecg32.exe
        
        C:\Windows\system32\Hfpecg32.exe
        108⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Hhnbpb32.exe
        
        C:\Windows\system32\Hhnbpb32.exe
        109⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Inkjhi32.exe
        
        C:\Windows\system32\Inkjhi32.exe
        110⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Idebdcdo.exe
        
        C:\Windows\system32\Idebdcdo.exe
        111⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Igcoqocb.exe
        
        C:\Windows\system32\Igcoqocb.exe
        112⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Inmgmijo.exe
        
        C:\Windows\system32\Inmgmijo.exe
        113⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Ifdonfka.exe
        
        C:\Windows\system32\Ifdonfka.exe
        114⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Ikaggmii.exe
        
        C:\Windows\system32\Ikaggmii.exe
        115⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5836
        
        C:\Windows\SysWOW64\Ikcdlmgf.exe
        
        C:\Windows\system32\Ikcdlmgf.exe
        116⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Ifihif32.exe
        
        C:\Windows\system32\Ifihif32.exe
        117⤵
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Igjeanmj.exe
        
        C:\Windows\system32\Igjeanmj.exe
        118⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Ibpiogmp.exe
        
        C:\Windows\system32\Ibpiogmp.exe
        119⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Jkhngl32.exe
        
        C:\Windows\system32\Jkhngl32.exe
        120⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Jngjch32.exe
        
        C:\Windows\system32\Jngjch32.exe
        121⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Jeqbpb32.exe
        
        C:\Windows\system32\Jeqbpb32.exe
        122⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Jkkjmlan.exe
        
        C:\Windows\system32\Jkkjmlan.exe
        123⤵
        Drops file in System32 directory
        
        PID:5572
        
        C:\Windows\SysWOW64\Jecofa32.exe
        
        C:\Windows\system32\Jecofa32.exe
        124⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Joiccj32.exe
        
        C:\Windows\system32\Joiccj32.exe
        125⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Jfbkpd32.exe
        
        C:\Windows\system32\Jfbkpd32.exe
        126⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Jpkphjeb.exe
        
        C:\Windows\system32\Jpkphjeb.exe
        127⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Jehhaaci.exe
        
        C:\Windows\system32\Jehhaaci.exe
        128⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Jgfdmlcm.exe
        
        C:\Windows\system32\Jgfdmlcm.exe
        129⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Jieagojp.exe
        
        C:\Windows\system32\Jieagojp.exe
        130⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Kldmckic.exe
        
        C:\Windows\system32\Kldmckic.exe
        131⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Kelalp32.exe
        
        C:\Windows\system32\Kelalp32.exe
        132⤵
        Modifies registry class
        
        PID:5856
        
        C:\Windows\SysWOW64\Kgknhl32.exe
        
        C:\Windows\system32\Kgknhl32.exe
        133⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Kflnfcgg.exe
        
        C:\Windows\system32\Kflnfcgg.exe
        134⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Kijjbofj.exe
        
        C:\Windows\system32\Kijjbofj.exe
        135⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Kngcje32.exe
        
        C:\Windows\system32\Kngcje32.exe
        136⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Keakgpko.exe
        
        C:\Windows\system32\Keakgpko.exe
        137⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Klkcdj32.exe
        
        C:\Windows\system32\Klkcdj32.exe
        138⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\Knlleepl.exe
        
        C:\Windows\system32\Knlleepl.exe
        139⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Kefdbo32.exe
        
        C:\Windows\system32\Kefdbo32.exe
        140⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Lhdqnj32.exe
        
        C:\Windows\system32\Lhdqnj32.exe
        141⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Lbjelc32.exe
        
        C:\Windows\system32\Lbjelc32.exe
        142⤵
        Modifies registry class
        
        PID:6196
        
        C:\Windows\SysWOW64\Lehaho32.exe
        
        C:\Windows\system32\Lehaho32.exe
        143⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Lhfmdj32.exe
        
        C:\Windows\system32\Lhfmdj32.exe
        144⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Lpneegel.exe
        
        C:\Windows\system32\Lpneegel.exe
        145⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Lfhnaa32.exe
        
        C:\Windows\system32\Lfhnaa32.exe
        146⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Lifjnm32.exe
        
        C:\Windows\system32\Lifjnm32.exe
        147⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Lldfjh32.exe
        
        C:\Windows\system32\Lldfjh32.exe
        148⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Lfjjga32.exe
        
        C:\Windows\system32\Lfjjga32.exe
        149⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Lhkgoiqe.exe
        
        C:\Windows\system32\Lhkgoiqe.exe
        150⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Lpbopfag.exe
        
        C:\Windows\system32\Lpbopfag.exe
        151⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Likcilhh.exe
        
        C:\Windows\system32\Likcilhh.exe
        152⤵
        Modifies registry class
        
        PID:6644
        
        C:\Windows\SysWOW64\Lfodbqfa.exe
        
        C:\Windows\system32\Lfodbqfa.exe
        153⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Mlklkgei.exe
        
        C:\Windows\system32\Mlklkgei.exe
        154⤵
        Drops file in System32 directory
        
        PID:6732
        
        C:\Windows\SysWOW64\Mfaqhp32.exe
        
        C:\Windows\system32\Mfaqhp32.exe
        155⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Molelb32.exe
        
        C:\Windows\system32\Molelb32.exe
        156⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Mfcmmp32.exe
        
        C:\Windows\system32\Mfcmmp32.exe
        157⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Mplafeil.exe
        
        C:\Windows\system32\Mplafeil.exe
        158⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Mffjcopi.exe
        
        C:\Windows\system32\Mffjcopi.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6952
        
        C:\Windows\SysWOW64\Mpnnle32.exe
        
        C:\Windows\system32\Mpnnle32.exe
        160⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Mfhfhong.exe
        
        C:\Windows\system32\Mfhfhong.exe
        161⤵
        Modifies registry class
        
        PID:7040
        
        C:\Windows\SysWOW64\Mockmala.exe
        
        C:\Windows\system32\Mockmala.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7084
        
        C:\Windows\SysWOW64\Nlglfe32.exe
        
        C:\Windows\system32\Nlglfe32.exe
        163⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Neppokal.exe
        
        C:\Windows\system32\Neppokal.exe
        164⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Npedmdab.exe
        
        C:\Windows\system32\Npedmdab.exe
        165⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Ngomin32.exe
        
        C:\Windows\system32\Ngomin32.exe
        166⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Nhpiafnm.exe
        
        C:\Windows\system32\Nhpiafnm.exe
        167⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\Nojanpej.exe
        
        C:\Windows\system32\Nojanpej.exe
        168⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\Ngaionfl.exe
        
        C:\Windows\system32\Ngaionfl.exe
        169⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Nomncpcg.exe
        
        C:\Windows\system32\Nomncpcg.exe
        170⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Neffpj32.exe
        
        C:\Windows\system32\Neffpj32.exe
        171⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Oekpkigo.exe
        
        C:\Windows\system32\Oekpkigo.exe
        172⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        173⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Ogklelna.exe
        
        C:\Windows\system32\Ogklelna.exe
        174⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Ohlimd32.exe
        
        C:\Windows\system32\Ohlimd32.exe
        175⤵
        Modifies registry class
        
        PID:6852
        
        C:\Windows\SysWOW64\Opcqnb32.exe
        
        C:\Windows\system32\Opcqnb32.exe
        176⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Ogmijllo.exe
        
        C:\Windows\system32\Ogmijllo.exe
        177⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Oepifi32.exe
        
        C:\Windows\system32\Oepifi32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7052
        
        C:\Windows\SysWOW64\Ohnebd32.exe
        
        C:\Windows\system32\Ohnebd32.exe
        179⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Opemca32.exe
        
        C:\Windows\system32\Opemca32.exe
        180⤵
        Drops file in System32 directory
        
        PID:6180
        
        C:\Windows\SysWOW64\Oebflhaf.exe
        
        C:\Windows\system32\Oebflhaf.exe
        181⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Ocffempp.exe
        
        C:\Windows\system32\Ocffempp.exe
        182⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\Pjpobg32.exe
        
        C:\Windows\system32\Pjpobg32.exe
        183⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Phcomcng.exe
        
        C:\Windows\system32\Phcomcng.exe
        184⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\Ppjgoaoj.exe
        
        C:\Windows\system32\Ppjgoaoj.exe
        185⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\Pgdokkfg.exe
        
        C:\Windows\system32\Pgdokkfg.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4168
        
        C:\Windows\SysWOW64\Phelcc32.exe
        
        C:\Windows\system32\Phelcc32.exe
        187⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Pckppl32.exe
        
        C:\Windows\system32\Pckppl32.exe
        188⤵
        Drops file in System32 directory
        
        PID:6768
        
        C:\Windows\SysWOW64\Phhhhc32.exe
        
        C:\Windows\system32\Phhhhc32.exe
        189⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Poaqemao.exe
        
        C:\Windows\system32\Poaqemao.exe
        190⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Phjenbhp.exe
        
        C:\Windows\system32\Phjenbhp.exe
        191⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Ppamophb.exe
        
        C:\Windows\system32\Ppamophb.exe
        192⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Pfnegggi.exe
        
        C:\Windows\system32\Pfnegggi.exe
        193⤵
        Modifies registry class
        
        PID:1524
        
        C:\Windows\SysWOW64\Phlacbfm.exe
        
        C:\Windows\system32\Phlacbfm.exe
        194⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\Pofjpl32.exe
        
        C:\Windows\system32\Pofjpl32.exe
        195⤵
        
        PID:656
        
        C:\Windows\SysWOW64\Qgnbaj32.exe
        
        C:\Windows\system32\Qgnbaj32.exe
        196⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Qjlnnemp.exe
        
        C:\Windows\system32\Qjlnnemp.exe
        197⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Qoifflkg.exe
        
        C:\Windows\system32\Qoifflkg.exe
        198⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Qgpogili.exe
        
        C:\Windows\system32\Qgpogili.exe
        199⤵
        Drops file in System32 directory
        
        PID:6476
        
        C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        200⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Acgolj32.exe
        
        C:\Windows\system32\Acgolj32.exe
        201⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Afelhf32.exe
        
        C:\Windows\system32\Afelhf32.exe
        202⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Ahchda32.exe
        
        C:\Windows\system32\Ahchda32.exe
        203⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Ahfdjanb.exe
        
        C:\Windows\system32\Ahfdjanb.exe
        204⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Aqmlknnd.exe
        
        C:\Windows\system32\Aqmlknnd.exe
        205⤵
        Drops file in System32 directory
        
        PID:6460
        
        C:\Windows\SysWOW64\Aggegh32.exe
        
        C:\Windows\system32\Aggegh32.exe
        206⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Ajeadd32.exe
        
        C:\Windows\system32\Ajeadd32.exe
        207⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Amcmpodi.exe
        
        C:\Windows\system32\Amcmpodi.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7264
        
        C:\Windows\SysWOW64\Acnemi32.exe
        
        C:\Windows\system32\Acnemi32.exe
        209⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Aflaie32.exe
        
        C:\Windows\system32\Aflaie32.exe
        210⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Aijnep32.exe
        
        C:\Windows\system32\Aijnep32.exe
        211⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Aodfajaj.exe
        
        C:\Windows\system32\Aodfajaj.exe
        212⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Afnnnd32.exe
        
        C:\Windows\system32\Afnnnd32.exe
        213⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Aimkjp32.exe
        
        C:\Windows\system32\Aimkjp32.exe
        214⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Bogcgj32.exe
        
        C:\Windows\system32\Bogcgj32.exe
        215⤵
        Modifies registry class
        
        PID:7572
        
        C:\Windows\SysWOW64\Bgnkhg32.exe
        
        C:\Windows\system32\Bgnkhg32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7616
        
        C:\Windows\SysWOW64\Bjlgdc32.exe
        
        C:\Windows\system32\Bjlgdc32.exe
        217⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Bqfoamfj.exe
        
        C:\Windows\system32\Bqfoamfj.exe
        218⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Bgpgng32.exe
        
        C:\Windows\system32\Bgpgng32.exe
        219⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Boklbi32.exe
        
        C:\Windows\system32\Boklbi32.exe
        220⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Bjaqpbkh.exe
        
        C:\Windows\system32\Bjaqpbkh.exe
        221⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Bmomlnjk.exe
        
        C:\Windows\system32\Bmomlnjk.exe
        222⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Bciehh32.exe
        
        C:\Windows\system32\Bciehh32.exe
        223⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Bclang32.exe
        
        C:\Windows\system32\Bclang32.exe
        224⤵
        Modifies registry class
        
        PID:7972
        
        C:\Windows\SysWOW64\Bggnof32.exe
        
        C:\Windows\system32\Bggnof32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8012
        
        C:\Windows\SysWOW64\Cqpbglno.exe
        
        C:\Windows\system32\Cqpbglno.exe
        226⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Cgjjdf32.exe
        
        C:\Windows\system32\Cgjjdf32.exe
        227⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Cjhfpa32.exe
        
        C:\Windows\system32\Cjhfpa32.exe
        228⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Cabomkll.exe
        
        C:\Windows\system32\Cabomkll.exe
        229⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Cfogeb32.exe
        
        C:\Windows\system32\Cfogeb32.exe
        230⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Cmipblaq.exe
        
        C:\Windows\system32\Cmipblaq.exe
        231⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Cpglnhad.exe
        
        C:\Windows\system32\Cpglnhad.exe
        232⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Cfadkb32.exe
        
        C:\Windows\system32\Cfadkb32.exe
        233⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Cmklglpn.exe
        
        C:\Windows\system32\Cmklglpn.exe
        234⤵
        Modifies registry class
        
        PID:7452
        
        C:\Windows\SysWOW64\Cgqqdeod.exe
        
        C:\Windows\system32\Cgqqdeod.exe
        235⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Cibmlmeb.exe
        
        C:\Windows\system32\Cibmlmeb.exe
        236⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Cpleig32.exe
        
        C:\Windows\system32\Cpleig32.exe
        237⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Cidjbmcp.exe
        
        C:\Windows\system32\Cidjbmcp.exe
        238⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Dakacjdb.exe
        
        C:\Windows\system32\Dakacjdb.exe
        239⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Dgejpd32.exe
        
        C:\Windows\system32\Dgejpd32.exe
        240⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Dmdonkgc.exe
        
        C:\Windows\system32\Dmdonkgc.exe
        241⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Dfoplpla.exe
        
        C:\Windows\system32\Dfoplpla.exe
        242⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Daediilg.exe
        
        C:\Windows\system32\Daediilg.exe
        243⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Ddcqedkk.exe
        
        C:\Windows\system32\Ddcqedkk.exe
        244⤵
        Modifies registry class
        
        PID:8172
        
        C:\Windows\SysWOW64\Dfamapjo.exe
        
        C:\Windows\system32\Dfamapjo.exe
        245⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Eipinkib.exe
        
        C:\Windows\system32\Eipinkib.exe
        246⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Eagaoh32.exe
        
        C:\Windows\system32\Eagaoh32.exe
        247⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        248⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Ejpfhnpe.exe
        
        C:\Windows\system32\Ejpfhnpe.exe
        249⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Edhjqc32.exe
        
        C:\Windows\system32\Edhjqc32.exe
        250⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        251⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Ealkjh32.exe
        
        C:\Windows\system32\Ealkjh32.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8004
        
        C:\Windows\SysWOW64\Edjgfcec.exe
        
        C:\Windows\system32\Edjgfcec.exe
        253⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Embkoi32.exe
        
        C:\Windows\system32\Embkoi32.exe
        254⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Efkphnbd.exe
        
        C:\Windows\system32\Efkphnbd.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7460
        
        C:\Windows\SysWOW64\Eiildjag.exe
        
        C:\Windows\system32\Eiildjag.exe
        256⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Eaqdegaj.exe
        
        C:\Windows\system32\Eaqdegaj.exe
        257⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Edopabqn.exe
        
        C:\Windows\system32\Edopabqn.exe
        258⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Efmmmn32.exe
        
        C:\Windows\system32\Efmmmn32.exe
        259⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Fmgejhgn.exe
        
        C:\Windows\system32\Fmgejhgn.exe
        260⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Fpeafcfa.exe
        
        C:\Windows\system32\Fpeafcfa.exe
        261⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        262⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Fineoi32.exe
        
        C:\Windows\system32\Fineoi32.exe
        263⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Faenpf32.exe
        
        C:\Windows\system32\Faenpf32.exe
        264⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\Fhofmq32.exe
        
        C:\Windows\system32\Fhofmq32.exe
        265⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Fknbil32.exe
        
        C:\Windows\system32\Fknbil32.exe
        266⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        267⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Fpjjac32.exe
        
        C:\Windows\system32\Fpjjac32.exe
        268⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\Fhabbp32.exe
        
        C:\Windows\system32\Fhabbp32.exe
        269⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\Fkpool32.exe
        
        C:\Windows\system32\Fkpool32.exe
        270⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\Falcae32.exe
        
        C:\Windows\system32\Falcae32.exe
        271⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        272⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Ggilil32.exe
        
        C:\Windows\system32\Ggilil32.exe
        273⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Gigheh32.exe
        
        C:\Windows\system32\Gigheh32.exe
        274⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Gaopfe32.exe
        
        C:\Windows\system32\Gaopfe32.exe
        275⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        276⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Ggkiol32.exe
        
        C:\Windows\system32\Ggkiol32.exe
        277⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Gijekg32.exe
        
        C:\Windows\system32\Gijekg32.exe
        278⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        279⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Ggnedlao.exe
        
        C:\Windows\system32\Ggnedlao.exe
        280⤵
        Drops file in System32 directory
        
        PID:8520
        
        C:\Windows\SysWOW64\Gacjadad.exe
        
        C:\Windows\system32\Gacjadad.exe
        281⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Gdafnpqh.exe
        
        C:\Windows\system32\Gdafnpqh.exe
        282⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Ggpbjkpl.exe
        
        C:\Windows\system32\Ggpbjkpl.exe
        283⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Ginnfgop.exe
        
        C:\Windows\system32\Ginnfgop.exe
        284⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Gphgbafl.exe
        
        C:\Windows\system32\Gphgbafl.exe
        285⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Ghpocngo.exe
        
        C:\Windows\system32\Ghpocngo.exe
        286⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Gknkpjfb.exe
        
        C:\Windows\system32\Gknkpjfb.exe
        287⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Hgelek32.exe
        
        C:\Windows\system32\Hgelek32.exe
        288⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Hdilnojp.exe
        
        C:\Windows\system32\Hdilnojp.exe
        289⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Hgghjjid.exe
        
        C:\Windows\system32\Hgghjjid.exe
        290⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Hjedffig.exe
        
        C:\Windows\system32\Hjedffig.exe
        291⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Hdkidohn.exe
        
        C:\Windows\system32\Hdkidohn.exe
        292⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Hkeaqi32.exe
        
        C:\Windows\system32\Hkeaqi32.exe
        293⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Hncmmd32.exe
        
        C:\Windows\system32\Hncmmd32.exe
        294⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Hpbiip32.exe
        
        C:\Windows\system32\Hpbiip32.exe
        295⤵
        Modifies registry class
        
        PID:9184
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        296⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Hkjjlhle.exe
        
        C:\Windows\system32\Hkjjlhle.exe
        297⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Hacbhb32.exe
        
        C:\Windows\system32\Hacbhb32.exe
        298⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Ihnkel32.exe
        
        C:\Windows\system32\Ihnkel32.exe
        299⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Ijogmdqm.exe
        
        C:\Windows\system32\Ijogmdqm.exe
        300⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Iafonaao.exe
        
        C:\Windows\system32\Iafonaao.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8504
        
        C:\Windows\SysWOW64\Igchfiof.exe
        
        C:\Windows\system32\Igchfiof.exe
        302⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        303⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Iqklon32.exe
        
        C:\Windows\system32\Iqklon32.exe
        304⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Ihbdplfi.exe
        
        C:\Windows\system32\Ihbdplfi.exe
        305⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        306⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        307⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        308⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Ihdafkdg.exe
        
        C:\Windows\system32\Ihdafkdg.exe
        309⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Inainbcn.exe
        
        C:\Windows\system32\Inainbcn.exe
        310⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Ihgnkkbd.exe
        
        C:\Windows\system32\Ihgnkkbd.exe
        311⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Ikejgf32.exe
        
        C:\Windows\system32\Ikejgf32.exe
        312⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Ibobdqid.exe
        
        C:\Windows\system32\Ibobdqid.exe
        313⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Jhijqj32.exe
        
        C:\Windows\system32\Jhijqj32.exe
        314⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Jjjghcfp.exe
        
        C:\Windows\system32\Jjjghcfp.exe
        315⤵
        Drops file in System32 directory
        
        PID:8628
        
        C:\Windows\SysWOW64\Jbaojpgb.exe
        
        C:\Windows\system32\Jbaojpgb.exe
        316⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Jgogbgei.exe
        
        C:\Windows\system32\Jgogbgei.exe
        317⤵
        Drops file in System32 directory
        
        PID:8848
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        318⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\Jdbhkk32.exe
        
        C:\Windows\system32\Jdbhkk32.exe
        319⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Jklphekp.exe
        
        C:\Windows\system32\Jklphekp.exe
        320⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Jqiipljg.exe
        
        C:\Windows\system32\Jqiipljg.exe
        321⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Jhpqaiji.exe
        
        C:\Windows\system32\Jhpqaiji.exe
        322⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Jnmijq32.exe
        
        C:\Windows\system32\Jnmijq32.exe
        323⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Jgenbfoa.exe
        
        C:\Windows\system32\Jgenbfoa.exe
        324⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        325⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Kdinljnk.exe
        
        C:\Windows\system32\Kdinljnk.exe
        326⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Knbbep32.exe
        
        C:\Windows\system32\Knbbep32.exe
        327⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Kiggbhda.exe
        
        C:\Windows\system32\Kiggbhda.exe
        328⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Kkfcndce.exe
        
        C:\Windows\system32\Kkfcndce.exe
        329⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        330⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Lnnbqnjn.exe
        
        C:\Windows\system32\Lnnbqnjn.exe
        331⤵
        Modifies registry class
        
        PID:8512
        
        C:\Windows\SysWOW64\Licfngjd.exe
        
        C:\Windows\system32\Licfngjd.exe
        332⤵
        Modifies registry class
        
        PID:8916
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        333⤵
        Modifies registry class
        
        PID:8480
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        334⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        335⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        336⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Mecjif32.exe
        
        C:\Windows\system32\Mecjif32.exe
        337⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Mnlnbl32.exe
        
        C:\Windows\system32\Mnlnbl32.exe
        338⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Meefofek.exe
        
        C:\Windows\system32\Meefofek.exe
        339⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Mhfppabl.exe
        
        C:\Windows\system32\Mhfppabl.exe
        340⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        341⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Maodigil.exe
        
        C:\Windows\system32\Maodigil.exe
        342⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Mifljdjo.exe
        
        C:\Windows\system32\Mifljdjo.exe
        343⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Mldhfpib.exe
        
        C:\Windows\system32\Mldhfpib.exe
        344⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        345⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9648
        
        C:\Windows\SysWOW64\Nhmeapmd.exe
        
        C:\Windows\system32\Nhmeapmd.exe
        347⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Nklbmllg.exe
        
        C:\Windows\system32\Nklbmllg.exe
        348⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Nafjjf32.exe
        
        C:\Windows\system32\Nafjjf32.exe
        349⤵
        Drops file in System32 directory
        
        PID:9784
        
        C:\Windows\SysWOW64\Nimbkc32.exe
        
        C:\Windows\system32\Nimbkc32.exe
        350⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Nlkngo32.exe
        
        C:\Windows\system32\Nlkngo32.exe
        351⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Nojjcj32.exe
        
        C:\Windows\system32\Nojjcj32.exe
        352⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Nahgoe32.exe
        
        C:\Windows\system32\Nahgoe32.exe
        353⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Niooqcad.exe
        
        C:\Windows\system32\Niooqcad.exe
        354⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        355⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Nolgijpk.exe
        
        C:\Windows\system32\Nolgijpk.exe
        356⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10092
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        357⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        358⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Nlphbnoe.exe
        
        C:\Windows\system32\Nlphbnoe.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10220
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        360⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Oekiqccc.exe
        
        C:\Windows\system32\Oekiqccc.exe
        361⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        362⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        363⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        364⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        365⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        366⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Oafcqcea.exe
        
        C:\Windows\system32\Oafcqcea.exe
        367⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Oeaoab32.exe
        
        C:\Windows\system32\Oeaoab32.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9768
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        369⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        370⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Phbhcmjl.exe
        
        C:\Windows\system32\Phbhcmjl.exe
        371⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Pkadoiip.exe
        
        C:\Windows\system32\Pkadoiip.exe
        372⤵
        Drops file in System32 directory
        
        PID:10080
        
        C:\Windows\SysWOW64\Pchlpfjb.exe
        
        C:\Windows\system32\Pchlpfjb.exe
        373⤵
        Drops file in System32 directory
        
        PID:10144
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        374⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Poajkgnc.exe
        
        C:\Windows\system32\Poajkgnc.exe
        375⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        376⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        377⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        378⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Piijno32.exe
        
        C:\Windows\system32\Piijno32.exe
        379⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Qlggjk32.exe
        
        C:\Windows\system32\Qlggjk32.exe
        380⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Qadoba32.exe
        
        C:\Windows\system32\Qadoba32.exe
        381⤵
        Modifies registry class
        
        PID:9948
        
        C:\Windows\SysWOW64\Qikgco32.exe
        
        C:\Windows\system32\Qikgco32.exe
        382⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Qkmdkgob.exe
        
        C:\Windows\system32\Qkmdkgob.exe
        383⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Acfhad32.exe
        
        C:\Windows\system32\Acfhad32.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9316
        
        C:\Windows\SysWOW64\Aomifecf.exe
        
        C:\Windows\system32\Aomifecf.exe
        385⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Afgacokc.exe
        
        C:\Windows\system32\Afgacokc.exe
        386⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Ahenokjf.exe
        
        C:\Windows\system32\Ahenokjf.exe
        387⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        388⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Ackbmcjl.exe
        
        C:\Windows\system32\Ackbmcjl.exe
        389⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        390⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Aoabad32.exe
        
        C:\Windows\system32\Aoabad32.exe
        391⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9484
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        392⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        393⤵
        Drops file in System32 directory
        
        PID:10012
        
        C:\Windows\SysWOW64\Bhldpj32.exe
        
        C:\Windows\system32\Bhldpj32.exe
        394⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        395⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Bcahmb32.exe
        
        C:\Windows\system32\Bcahmb32.exe
        396⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        397⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Bbgeno32.exe
        
        C:\Windows\system32\Bbgeno32.exe
        398⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Bjnmpl32.exe
        
        C:\Windows\system32\Bjnmpl32.exe
        399⤵
        Modifies registry class
        
        PID:9596
        
        C:\Windows\SysWOW64\Bokehc32.exe
        
        C:\Windows\system32\Bokehc32.exe
        400⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10248
        
        C:\Windows\SysWOW64\Bbiado32.exe
        
        C:\Windows\system32\Bbiado32.exe
        401⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Bmofagfp.exe
        
        C:\Windows\system32\Bmofagfp.exe
        402⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10328
        
        C:\Windows\SysWOW64\Bombmcec.exe
        
        C:\Windows\system32\Bombmcec.exe
        403⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10376
        
        C:\Windows\SysWOW64\Bblnindg.exe
        
        C:\Windows\system32\Bblnindg.exe
        404⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        405⤵
        Modifies registry class
        
        PID:10464
        
        C:\Windows\SysWOW64\Bopocbcq.exe
        
        C:\Windows\system32\Bopocbcq.exe
        406⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Cmcolgbj.exe
        
        C:\Windows\system32\Cmcolgbj.exe
        407⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        408⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        409⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Cjliajmo.exe
        
        C:\Windows\system32\Cjliajmo.exe
        410⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        411⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        412⤵
        Drops file in System32 directory
        
        PID:10760
        
        C:\Windows\SysWOW64\Dbjkkl32.exe
        
        C:\Windows\system32\Dbjkkl32.exe
        413⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        414⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Dfgcakon.exe
        
        C:\Windows\system32\Dfgcakon.exe
        415⤵
        Modifies registry class
        
        PID:10892
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        416⤵
        Modifies registry class
        
        PID:10932
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        417⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        418⤵
        Drops file in System32 directory
        
        PID:11024
        
        C:\Windows\SysWOW64\Dmhand32.exe
        
        C:\Windows\system32\Dmhand32.exe
        419⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        420⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        421⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        422⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        423⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        424⤵
        
        PID:10260
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        425⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        426⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        427⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10456
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        428⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10532
        
        C:\Windows\SysWOW64\Fbhpch32.exe
        
        C:\Windows\system32\Fbhpch32.exe
        429⤵
        Modifies registry class
        
        PID:10600
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        430⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        431⤵
        Drops file in System32 directory
        
        PID:10756
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        432⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Gfmojenc.exe
        
        C:\Windows\system32\Gfmojenc.exe
        433⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        434⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        435⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        436⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        437⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11136
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        438⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        439⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        440⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        441⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        442⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        443⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        444⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        445⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        446⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        447⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11092
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        448⤵
        Modifies registry class
        
        PID:11180
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        449⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        450⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        451⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        452⤵
        Modifies registry class
        
        PID:10816
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        453⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        454⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        455⤵
        Drops file in System32 directory
        
        PID:11168
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        456⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        457⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        458⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        459⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        460⤵
        Drops file in System32 directory
        
        PID:10776
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        461⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        462⤵
        Modifies registry class
        
        PID:11056
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        463⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        464⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        465⤵
        
        PID:11344
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        466⤵
        
        PID:11384
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        467⤵
        Modifies registry class
        
        PID:11428
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        468⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11468
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        469⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        470⤵
        
        PID:11556
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        471⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11600
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        472⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11644
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        473⤵
        
        PID:11688
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        474⤵
        
        PID:11732
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        475⤵
        
        PID:11772
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        476⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        477⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        478⤵
        
        PID:11928
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        479⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        480⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12012
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        481⤵
        
        PID:12060
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        482⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        483⤵
        Drops file in System32 directory
        
        PID:12156
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        484⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        485⤵
        
        PID:12252
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        486⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        487⤵
        Modifies registry class
        
        PID:11332
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        488⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        489⤵
        
        PID:11464
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        490⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        491⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        492⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        493⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        494⤵
        
        PID:448
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        495⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        496⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        497⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        498⤵
        
        PID:12108
        
        C:\Windows\SysWOW64\Ncabfkqo.exe
        
        C:\Windows\system32\Ncabfkqo.exe
        499⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        500⤵
        
        PID:12240
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        501⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        502⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11436
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        503⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        504⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        505⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        506⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        507⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        508⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        509⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        510⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        511⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        512⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        513⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        514⤵
        
        PID:11924
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        515⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12124
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        516⤵
        
        PID:12284
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        517⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        518⤵
        Modifies registry class
        
        PID:11492
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        519⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        520⤵
        Drops file in System32 directory
        
        PID:3456
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        521⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        522⤵
        
        PID:924
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        523⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Pajeam32.exe
        
        C:\Windows\system32\Pajeam32.exe
        524⤵
        
        PID:228
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        525⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        526⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        527⤵
        
        PID:12136
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        528⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        529⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        530⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        531⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        532⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        533⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        534⤵
        
        PID:12200
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        535⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        536⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        537⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        538⤵
        
        PID:408
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        539⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        540⤵
        Modifies registry class
        
        PID:4188
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        541⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        542⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        543⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12000
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        544⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        545⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        546⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        547⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        548⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        549⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        126⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        35⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        36⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        37⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        38⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        39⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        40⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        41⤵
        
        PID:812
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        42⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        43⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        44⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4604
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        46⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        47⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        48⤵
        
        PID:424
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2296
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        50⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        51⤵
        Drops file in System32 directory
        
        PID:3016
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        52⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        53⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        54⤵
        
        PID:772
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        55⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2364
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        56⤵
        
        PID:872
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        57⤵
        
        PID:3168
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        58⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        59⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        60⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        61⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        62⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        63⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4436
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        65⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        66⤵
        
        PID:476
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        67⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        68⤵
        
        PID:3440
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        69⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        70⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        71⤵
        
        PID:852
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        72⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        73⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        74⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        75⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        76⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        77⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        78⤵
        Drops file in System32 directory
        
        PID:5900
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        79⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        80⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        81⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        82⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        83⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        84⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        85⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        86⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        87⤵
        Modifies registry class
        
        PID:5696
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        88⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        89⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        90⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        91⤵
        Drops file in System32 directory
        
        PID:728
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        92⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        93⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        94⤵
        Drops file in System32 directory
        
        PID:5340
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        95⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        96⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        97⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        98⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        99⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        100⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        101⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        102⤵
        Modifies registry class
        
        PID:5376
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        103⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        104⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        105⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        106⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5216
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        108⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        109⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        110⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        111⤵
        Drops file in System32 directory
        
        PID:5844
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        112⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        113⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        114⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        115⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        116⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        117⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        118⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        119⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        120⤵
        Drops file in System32 directory
        
        PID:5652
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        121⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        122⤵
        Modifies registry class
        
        PID:5716
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        123⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        124⤵
        Modifies registry class
        
        PID:2824
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        125⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        126⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        127⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        128⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        129⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        130⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        131⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        132⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        133⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6632

C:\Windows\SysWOW64\Bllbaa32.exe
C:\Windows\system32\Bllbaa32.exe
1⤵
PID:552
- C:\Windows\SysWOW64\Bdgged32.exe
  C:\Windows\system32\Bdgged32.exe
  2⤵
  PID:1060
- - C:\Windows\SysWOW64\Bnoknihb.exe
    C:\Windows\system32\Bnoknihb.exe
    3⤵
    PID:2120
  - - C:\Windows\SysWOW64\Bdickcpo.exe
      C:\Windows\system32\Bdickcpo.exe
      4⤵
      PID:1972
    - - C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2812

C:\Windows\SysWOW64\Cfipef32.exe
C:\Windows\system32\Cfipef32.exe
1⤵
PID:1108
- C:\Windows\SysWOW64\Ckeimm32.exe
  C:\Windows\system32\Ckeimm32.exe
  2⤵
  PID:2336
- - C:\Windows\SysWOW64\Cdnmfclj.exe
    C:\Windows\system32\Cdnmfclj.exe
    3⤵
    PID:4620
  - - C:\Windows\SysWOW64\Cofnik32.exe
      C:\Windows\system32\Cofnik32.exe
      4⤵
      PID:1348
    - - C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        5⤵
        
        PID:4048
      - C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        6⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        7⤵
        
        PID:3568
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11888
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        9⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        10⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        11⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        12⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        13⤵
        Modifies registry class
        
        PID:1020
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        14⤵
        Modifies registry class
        
        PID:3024
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        15⤵
        Drops file in System32 directory
        
        PID:1616

C:\Windows\SysWOW64\Pffgom32.exe
C:\Windows\system32\Pffgom32.exe
1⤵
PID:3544
- C:\Windows\SysWOW64\Pnmopk32.exe
  C:\Windows\system32\Pnmopk32.exe
  2⤵
  PID:6620
- - C:\Windows\SysWOW64\Palklf32.exe
    C:\Windows\system32\Palklf32.exe
    3⤵
    PID:7060
  - - C:\Windows\SysWOW64\Pdjgha32.exe
      C:\Windows\system32\Pdjgha32.exe
      4⤵
      Modifies registry class
      PID:6668
    - - C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        5⤵
        
        PID:7076
      - C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        6⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6232
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        8⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        9⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6028
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        11⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5816

C:\Windows\SysWOW64\Aopemh32.exe
C:\Windows\system32\Aopemh32.exe
1⤵
PID:6852
- C:\Windows\SysWOW64\Bgkiaj32.exe
  C:\Windows\system32\Bgkiaj32.exe
  2⤵
  PID:6100
- - C:\Windows\SysWOW64\Bmeandma.exe
    C:\Windows\system32\Bmeandma.exe
    3⤵
    PID:6656
  - - C:\Windows\SysWOW64\Bhmbqm32.exe
      C:\Windows\system32\Bhmbqm32.exe
      4⤵
      PID:6572
    - - C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        5⤵
        Drops file in System32 directory
        
        PID:6276
      - C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        6⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        7⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        8⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        9⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        10⤵
        Drops file in System32 directory
        
        PID:6820
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        11⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        12⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        13⤵
        Modifies registry class
        
        PID:6964
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        14⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6372
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        16⤵
        Drops file in System32 directory
        
        PID:3412
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        17⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        18⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        19⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        20⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        21⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        22⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        23⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        24⤵
        Modifies registry class
        
        PID:7316
        
        C:\Windows\SysWOW64\Edplhjhi.exe
        
        C:\Windows\system32\Edplhjhi.exe
        25⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        26⤵
        Drops file in System32 directory
        
        PID:7004
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        27⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Eqgmmk32.exe
        
        C:\Windows\system32\Eqgmmk32.exe
        28⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        29⤵
        Drops file in System32 directory
        
        PID:6412
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        30⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        31⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        32⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4676
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6068
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        35⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        36⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        37⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        38⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        39⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        40⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        41⤵
        Modifies registry class
        
        PID:6880
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        42⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5208
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        44⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        45⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        46⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        47⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        48⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Ggmmlamj.exe
        
        C:\Windows\system32\Ggmmlamj.exe
        49⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8116

C:\Windows\SysWOW64\Hlmchoan.exe
C:\Windows\system32\Hlmchoan.exe
1⤵
PID:7880
- C:\Windows\SysWOW64\Hbgkei32.exe
  C:\Windows\system32\Hbgkei32.exe
  2⤵
  PID:7364
- - C:\Windows\SysWOW64\Heegad32.exe
    C:\Windows\system32\Heegad32.exe
    3⤵
    PID:7700
  - - C:\Windows\SysWOW64\Hbihjifh.exe
      C:\Windows\system32\Hbihjifh.exe
      4⤵
      PID:5508
    - - C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        5⤵
        
        PID:7464
      - C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        6⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        7⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        8⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\Ibqnkh32.exe
        
        C:\Windows\system32\Ibqnkh32.exe
        9⤵
        
        PID:3476
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        10⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        11⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        12⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        13⤵
        Modifies registry class
        
        PID:7424
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        14⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Jifecp32.exe
        
        C:\Windows\system32\Jifecp32.exe
        15⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        16⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        17⤵
        
        PID:7248

C:\Windows\SysWOW64\Hpfbcn32.exe
C:\Windows\system32\Hpfbcn32.exe
1⤵
PID:3340

C:\Windows\SysWOW64\Jojdlfeo.exe
C:\Windows\system32\Jojdlfeo.exe
1⤵
PID:4600
- C:\Windows\SysWOW64\Kpiqfima.exe
  C:\Windows\system32\Kpiqfima.exe
  2⤵
  PID:8744
- - C:\Windows\SysWOW64\Kefiopki.exe
    C:\Windows\system32\Kefiopki.exe
    3⤵
    PID:3144
  - - C:\Windows\SysWOW64\Klpakj32.exe
      C:\Windows\system32\Klpakj32.exe
      4⤵
      Modifies registry class
      PID:7440
    - - C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        5⤵
        
        PID:3524
      - C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        6⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        7⤵
        Drops file in System32 directory
        
        PID:8392
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        8⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        9⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        10⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        11⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        12⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        13⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        14⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        15⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        16⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        17⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Ledepn32.exe
        
        C:\Windows\system32\Ledepn32.exe
        18⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        19⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9092
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        21⤵
        Drops file in System32 directory
        
        PID:9036
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        22⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        23⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Lfiokmkc.exe
        
        C:\Windows\system32\Lfiokmkc.exe
        24⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        25⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        26⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        27⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        28⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        29⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        30⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        31⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Mpclce32.exe
        
        C:\Windows\system32\Mpclce32.exe
        32⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        33⤵
        Drops file in System32 directory
        
        PID:4164
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        34⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        35⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        36⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        37⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        38⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        39⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6336
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        41⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Nmaciefp.exe
        
        C:\Windows\system32\Nmaciefp.exe
        42⤵
        Drops file in System32 directory
        
        PID:8732
        
        C:\Windows\SysWOW64\Noppeaed.exe
        
        C:\Windows\system32\Noppeaed.exe
        43⤵
        Modifies registry class
        
        PID:7616
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        44⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        45⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        46⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        47⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Nbphglbe.exe
        
        C:\Windows\system32\Nbphglbe.exe
        48⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        49⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        50⤵
        
        PID:8408

C:\Windows\SysWOW64\Jbccge32.exe
C:\Windows\system32\Jbccge32.exe
1⤵
- Modifies registry class
PID:6764

C:\Windows\SysWOW64\Nimmifgo.exe
C:\Windows\system32\Nimmifgo.exe
1⤵
PID:8820
- C:\Windows\SysWOW64\Nmjfodne.exe
  C:\Windows\system32\Nmjfodne.exe
  2⤵
  PID:8004
- - C:\Windows\SysWOW64\Ocdnln32.exe
    C:\Windows\system32\Ocdnln32.exe
    3⤵
    PID:9136
  - - C:\Windows\SysWOW64\Ofckhj32.exe
      C:\Windows\system32\Ofckhj32.exe
      4⤵
      PID:9064
    - - C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        5⤵
        
        PID:6612
      - C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        6⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        7⤵
        
        PID:4960

C:\Windows\SysWOW64\Omalpc32.exe
C:\Windows\system32\Omalpc32.exe
1⤵
- Modifies registry class
PID:8508
- C:\Windows\SysWOW64\Obnehj32.exe
  C:\Windows\system32\Obnehj32.exe
  2⤵
  PID:8992
- - C:\Windows\SysWOW64\Obqanjdb.exe
    C:\Windows\system32\Obqanjdb.exe
    3⤵
    PID:7604
  - - C:\Windows\SysWOW64\Omfekbdh.exe
      C:\Windows\system32\Omfekbdh.exe
      4⤵
      PID:8856
    - - C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        5⤵
        Drops file in System32 directory
        
        PID:7640
      - C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8132
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9148
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        8⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        9⤵
        
        PID:6808

C:\Windows\SysWOW64\Paihlpfi.exe
C:\Windows\system32\Paihlpfi.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:7176
- C:\Windows\SysWOW64\Pbjddh32.exe
  C:\Windows\system32\Pbjddh32.exe
  2⤵
  PID:7596
- - C:\Windows\SysWOW64\Pmbegqjk.exe
    C:\Windows\system32\Pmbegqjk.exe
    3⤵
    - Drops file in System32 directory
    PID:8068
  - - C:\Windows\SysWOW64\Qapnmopa.exe
      C:\Windows\system32\Qapnmopa.exe
      4⤵
      PID:6504
    - - C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        5⤵
        
        PID:8852
      - C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        6⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Aabkbono.exe
        
        C:\Windows\system32\Aabkbono.exe
        7⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Acqgojmb.exe
        
        C:\Windows\system32\Acqgojmb.exe
        8⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Ajjokd32.exe
        
        C:\Windows\system32\Ajjokd32.exe
        9⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Abfdpfaj.exe
        
        C:\Windows\system32\Abfdpfaj.exe
        10⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Apjdikqd.exe
        
        C:\Windows\system32\Apjdikqd.exe
        11⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Ajohfcpj.exe
        
        C:\Windows\system32\Ajohfcpj.exe
        12⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Adgmoigj.exe
        
        C:\Windows\system32\Adgmoigj.exe
        13⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Affikdfn.exe
        
        C:\Windows\system32\Affikdfn.exe
        14⤵
        Drops file in System32 directory
        
        PID:7824
        
        C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        15⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Adjjeieh.exe
        
        C:\Windows\system32\Adjjeieh.exe
        16⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Afhfaddk.exe
        
        C:\Windows\system32\Afhfaddk.exe
        17⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Bigbmpco.exe
        
        C:\Windows\system32\Bigbmpco.exe
        18⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Banjnm32.exe
        
        C:\Windows\system32\Banjnm32.exe
        19⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Bboffejp.exe
        
        C:\Windows\system32\Bboffejp.exe
        20⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Bapgdm32.exe
        
        C:\Windows\system32\Bapgdm32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9600
        
        C:\Windows\SysWOW64\Bdapehop.exe
        
        C:\Windows\system32\Bdapehop.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9668
        
        C:\Windows\SysWOW64\Bmidnm32.exe
        
        C:\Windows\system32\Bmidnm32.exe
        23⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Bdcmkgmm.exe
        
        C:\Windows\system32\Bdcmkgmm.exe
        24⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Bfaigclq.exe
        
        C:\Windows\system32\Bfaigclq.exe
        25⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Bipecnkd.exe
        
        C:\Windows\system32\Bipecnkd.exe
        26⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Bbhildae.exe
        
        C:\Windows\system32\Bbhildae.exe
        27⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Cajjjk32.exe
        
        C:\Windows\system32\Cajjjk32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9448
        
        C:\Windows\SysWOW64\Ckdkhq32.exe
        
        C:\Windows\system32\Ckdkhq32.exe
        29⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Cancekeo.exe
        
        C:\Windows\system32\Cancekeo.exe
        30⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Ciihjmcj.exe
        
        C:\Windows\system32\Ciihjmcj.exe
        31⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Ckidcpjl.exe
        
        C:\Windows\system32\Ckidcpjl.exe
        32⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Cacmpj32.exe
        
        C:\Windows\system32\Cacmpj32.exe
        33⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Cpfmlghd.exe
        
        C:\Windows\system32\Cpfmlghd.exe
        34⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Ccdihbgg.exe
        
        C:\Windows\system32\Ccdihbgg.exe
        35⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Dkkaiphj.exe
        
        C:\Windows\system32\Dkkaiphj.exe
        36⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        37⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Daeifj32.exe
        
        C:\Windows\system32\Daeifj32.exe
        38⤵
        Modifies registry class
        
        PID:10160
        
        C:\Windows\SysWOW64\Ddcebe32.exe
        
        C:\Windows\system32\Ddcebe32.exe
        39⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Dgbanq32.exe
        
        C:\Windows\system32\Dgbanq32.exe
        40⤵
        Modifies registry class
        
        PID:9344
        
        C:\Windows\SysWOW64\Dgdncplk.exe
        
        C:\Windows\system32\Dgdncplk.exe
        41⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Dkpjdo32.exe
        
        C:\Windows\system32\Dkpjdo32.exe
        42⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Dpmcmf32.exe
        
        C:\Windows\system32\Dpmcmf32.exe
        43⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Dnqcfjae.exe
        
        C:\Windows\system32\Dnqcfjae.exe
        44⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Ddklbd32.exe
        
        C:\Windows\system32\Ddklbd32.exe
        45⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\Dkedonpo.exe
        
        C:\Windows\system32\Dkedonpo.exe
        46⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\Dncpkjoc.exe
        
        C:\Windows\system32\Dncpkjoc.exe
        47⤵
        Drops file in System32 directory
        
        PID:9988
        
        C:\Windows\SysWOW64\Ddmhhd32.exe
        
        C:\Windows\system32\Ddmhhd32.exe
        48⤵
        
        PID:8936

C:\Windows\SysWOW64\Ekgqennl.exe
C:\Windows\system32\Ekgqennl.exe
1⤵
PID:9788
- C:\Windows\SysWOW64\Enemaimp.exe
  C:\Windows\system32\Enemaimp.exe
  2⤵
  PID:9420
- - C:\Windows\SysWOW64\Epdime32.exe
    C:\Windows\system32\Epdime32.exe
    3⤵
    - Drops file in System32 directory
    - Modifies registry class
    PID:8240
  - - C:\Windows\SysWOW64\Egnajocq.exe
      C:\Windows\system32\Egnajocq.exe
      4⤵
      Modifies registry class
      PID:10004
    - - C:\Windows\SysWOW64\Ecdbop32.exe
        
        C:\Windows\system32\Ecdbop32.exe
        5⤵
        Drops file in System32 directory
        
        PID:9588
      - C:\Windows\SysWOW64\Ekljpm32.exe
        
        C:\Windows\system32\Ekljpm32.exe
        6⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Ejojljqa.exe
        
        C:\Windows\system32\Ejojljqa.exe
        7⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Eddnic32.exe
        
        C:\Windows\system32\Eddnic32.exe
        8⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Egbken32.exe
        
        C:\Windows\system32\Egbken32.exe
        9⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Eahobg32.exe
        
        C:\Windows\system32\Eahobg32.exe
        10⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Egegjn32.exe
        
        C:\Windows\system32\Egegjn32.exe
        11⤵
        
        PID:9820

C:\Windows\SysWOW64\Eqmlccdi.exe
C:\Windows\system32\Eqmlccdi.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
PID:9276
- C:\Windows\SysWOW64\Edihdb32.exe
  C:\Windows\system32\Edihdb32.exe
  2⤵
  PID:10020
- - C:\Windows\SysWOW64\Fnalmh32.exe
    C:\Windows\system32\Fnalmh32.exe
    3⤵
    PID:8340
  - - C:\Windows\SysWOW64\Fqphic32.exe
      C:\Windows\system32\Fqphic32.exe
      4⤵
      PID:9168
    - - C:\Windows\SysWOW64\Fcneeo32.exe
        
        C:\Windows\system32\Fcneeo32.exe
        5⤵
        Drops file in System32 directory
        
        PID:8380
      - C:\Windows\SysWOW64\Fgiaemic.exe
        
        C:\Windows\system32\Fgiaemic.exe
        6⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Fjhmbihg.exe
        
        C:\Windows\system32\Fjhmbihg.exe
        7⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Fqbeoc32.exe
        
        C:\Windows\system32\Fqbeoc32.exe
        8⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Fcpakn32.exe
        
        C:\Windows\system32\Fcpakn32.exe
        9⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Fnffhgon.exe
        
        C:\Windows\system32\Fnffhgon.exe
        10⤵
        Modifies registry class
        
        PID:6980
        
        C:\Windows\SysWOW64\Fdpnda32.exe
        
        C:\Windows\system32\Fdpnda32.exe
        11⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Fgnjqm32.exe
        
        C:\Windows\system32\Fgnjqm32.exe
        12⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        13⤵
        Modifies registry class
        
        PID:8520
        
        C:\Windows\SysWOW64\Fnhbmgmk.exe
        
        C:\Windows\system32\Fnhbmgmk.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7360
        
        C:\Windows\SysWOW64\Fgqgfl32.exe
        
        C:\Windows\system32\Fgqgfl32.exe
        15⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Fnjocf32.exe
        
        C:\Windows\system32\Fnjocf32.exe
        16⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Gddgpqbe.exe
        
        C:\Windows\system32\Gddgpqbe.exe
        17⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9392 -s 408
        18⤵
        Program crash
        
        PID:11124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 9392 -ip 9392
1⤵
PID:9840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aeiofcji.exe

Filesize
363KB

MD5
67645c72f4d2ad357043221a03345c5f

SHA1
dbbb4624fffa9889480f106909a504d5820269dc

SHA256
ee9341df4a6a4e644e67e488ac6bdb7586cd8fbac655344bc1b6d2fba886ae0d

SHA512
8fd4c66d5902237701639e2962ebb807dcb968ec8657d32f031072a2ab3c87ba78d1e25b2bfbf35d1e68ee76bdbd94da7780b20969fc97b231884151922227c6

Download Submit
C:\Windows\SysWOW64\Afmhck32.exe

Filesize
363KB

MD5
6ba8f88f8adef231f4b784a15bd61fad

SHA1
9ba78425d62b267a48ffcf5dd58ba4fb1532a65e

SHA256
e45200d136aa7c7a4733304ea503fa3730c8df489f54edd6ecc9586f58a21cb4

SHA512
d293bd4b6bc2a6b342d424200a122dbd39554179f2601877b7394446643ec54d2dbdf4f8c54669498cc746b260dd0121fe4dbf7985639172286f85676c235aba

Download Submit
C:\Windows\SysWOW64\Aglemn32.exe

Filesize
363KB

MD5
355bc4fbbd6df4f4c27100b1545b5bc9

SHA1
56a4f46acf68baa6a730f458eb9b8dee91d68b76

SHA256
39d6e96e65faeacf4763172402109e803fa8daf8956dcb1e98c8062c3aedb656

SHA512
0101bb2e9f00c03c59d8be5cf422c323ebe3bd3f6d0c5d6b752d2536f71528d5c835533b73c0cbcf225ad75c22b171c1e8d886d105dc85d805d0a598b7e79038

Download Submit
C:\Windows\SysWOW64\Agoabn32.exe

Filesize
363KB

MD5
e07fc4dd79f17b276a498eff55ae579b

SHA1
4b16e284032980bd65fe8a238db54ac3e7b7168f

SHA256
febe3bd3bcd033c72f07cfafc08ec15d17c8224793b847b7f5601c17e0b5af81

SHA512
741cd06e9c3cc618dfbc58a93889fe983dc810646858b4ae7270822060688074800bcd8c7cfab2209b4ea61b7b3094a2172fefacab94518ed79e9c659b1c1801

Download Submit
C:\Windows\SysWOW64\Amgapeea.exe

Filesize
363KB

MD5
8c446a91f2a545b28eeb01a1110d8de1

SHA1
3807173c670407f4f686e32fddae997081b4077c

SHA256
09e32cc6b214d7a9b8297cd6cf061c67d6d950e5e8af4381574db6a3e671c420

SHA512
17cd4822da876872bc9873ed747bbb80bd16424aca1041b2d0fe5e3f01bf7c3ab95d8805c51310af5c7d54d78496a5bd1fd39e32d929a3fe5d28d2d76f81b7b3

Download Submit
C:\Windows\SysWOW64\Ampkof32.exe

Filesize
363KB

MD5
ccef4b27a01e5961cdbb199cfe5a7273

SHA1
2bb522c0f219152bdab3a37321ba21bceeaddf9c

SHA256
cd34b1baec40ce7794e9a3156c06d52adcc72d796cce7fb0949479e7a5e580a1

SHA512
5c67c282104fefb798c14f10c8180a61de302bce702f664893b312feaaf423e6db39d74b2fb90679c1167fdbdcb686f8655cac86782ddc6c7857453948f16eec

Download Submit
C:\Windows\SysWOW64\Anadoi32.exe

Filesize
363KB

MD5
dba31e4054118e3cab762924fe7c5178

SHA1
2b291689d64ecdd516ddb2b0218469ebc549c808

SHA256
905e05b37c5348da2c2eec95290e2f35315d3f5062fce346d066a118e859cac2

SHA512
5cca7a6d5ef666c495009c3978228bacd9b4c22c7375f614ec04bb8e6aaff7755b3a8a6f7de8ecb8fdf185f8769d9e3840768f7fca2195346e180d70cd0545da

Download Submit
C:\Windows\SysWOW64\Bciehh32.exe

Filesize
363KB

MD5
0cdd63f3aa1b6c24dd4592a50d3e237b

SHA1
638f041aac6f1f935c131f097e302c109acff7a8

SHA256
7a9a649c9746d06cfccdcbe77e0e957e379531edcab5f04c8a72424b636fee41

SHA512
2af922f6e2bc6f66d8b1878321f476734846e9ef2604f1ec833eea4bfc25656ed9b450c08e8f6a60adae4ee8e70a95b065c9e8a0c00d2c65a15d58ba20a71560

Download Submit
C:\Windows\SysWOW64\Bganhm32.exe

Filesize
363KB

MD5
52b56a7d8188ad4324fd59ba0827c236

SHA1
49ee3727174e26c08bca6376b6c73d05c23dc7ee

SHA256
ffa8b32fc890f7b6ba3a6b62f9842d58b1249abb4d7798e0392dae95c88bb99a

SHA512
6ec3e4f510aa5425ca3949d141162c2d29bec49440146fdc0a75a0e2ee810ffc9598720833839b3026824d300fcaa7a9a6d678717bcae72229fa697877664ac7

Download Submit
C:\Windows\SysWOW64\Bmkjkd32.exe

Filesize
363KB

MD5
7ee5711dd3b3f4b237af099bc5a966c0

SHA1
0217e9b785184168053acfdf579afc3f06d42069

SHA256
ef96d7060ef90d9c8712ba19f3f454fe4454eb6cd86c90df8b06c2723fa7baac

SHA512
0f8a45c69b14c284d0d92a033765d55d1ab28579ba6dc24cf517994035b48ab5bf3f859ae6ec30811e9c8c669f88f2f8fc62e499d32d401a33d6268a49873723

Download Submit
C:\Windows\SysWOW64\Cfogeb32.exe

Filesize
363KB

MD5
e4044de40e287d4f18beb4731b93b367

SHA1
2fcb5db86068c83058ebcc0c06da06672833bd86

SHA256
40949718db8260f2577a13ee0130f90297affe819195ad07477627ca71e2b6cb

SHA512
00c8d5b15f6619ff3fd58e7fd82c76ce9143be3a46105c5fda4858691057ba25c9552766969c267e10a96b192c320f906d7eab6366245bd9a420f0f270ef7785

Download Submit
C:\Windows\SysWOW64\Cmcolgbj.exe

Filesize
363KB

MD5
867660ca8adbac6a1f33aa850ee7eaaa

SHA1
fddd101d81be8e17da7b3a2a8c6ced19a001cfda

SHA256
968713b03cccf21b3a7f95e7fdcf770b80647924770df1ff30138e80b1124060

SHA512
40317a586791f8e9aef2cc233e47e472ca655756602bb8dd240eea5161f0e2f15e6bc0a7a5220deff52f74f85b77aebcef1cbb6f15e8f4ad8647796d46b90325

Download Submit
C:\Windows\SysWOW64\Cqpbglno.exe

Filesize
64KB

MD5
347718ca96fcf0fe66b46e795a1caae5

SHA1
38fbd4dd049a0896d2ab2e7ea9998597dccfef3f

SHA256
331aabb3feff843c62fff24c3a8261aaa11b8f3573ea6249768912a5c152963e

SHA512
ef9cade5dd82da954cbd7d311a7cd86553538c198219a1bb566fe9413a5c3a7bcef820881ea982bf405ecf25feddda478f390ec00fe1a30d817ed1207f726aae

Download Submit
C:\Windows\SysWOW64\Dfgcakon.exe

Filesize
363KB

MD5
11763cfc9e4eb5562e17838ecea83be2

SHA1
befbbf3d23e8a14ebb861f716496c43248013398

SHA256
64d4964cd2b020b37cbb16399c237f62127c0add268412870e4d52ea24b7b6f2

SHA512
c33263497625700d2fd20510a10ef7e1f55f6a99d01030ad0dfb6f032829f42c4ad6e72c0426e594bf1cff3c43b7ada5ede2fc2c9dfb5a12273e0fb0db85b7f3

Download Submit
C:\Windows\SysWOW64\Eciplm32.exe

Filesize
363KB

MD5
887f742eaf2d87ef1ad87dc612b525ac

SHA1
91bfb6af1e0ec62e99763cfdda82cbfb3c8b915b

SHA256
9bca5b195df7e4d0b35ab7dc5358302f8b0d78e73611787652db3dc663b40821

SHA512
12e7c3b94082b8dd9740a2216a1076e152bdb646b26b654943a381e1497df492cd7612572345e5ae75e384dd50cc48fbfca3d84910209589fe40e59b9cf90ecb

Download Submit
C:\Windows\SysWOW64\Eglgbdep.exe

Filesize
363KB

MD5
c9acbce2bba2f59204037ea47c5595a7

SHA1
f233ef3c8c97185e4cf9cfd3e8a3eaf0c3634ecd

SHA256
30de281d6aec115919ebc53431c9ef3b6107bc3e897bd7e3914e40f4f063c7f8

SHA512
9db613fe297194c4593023765a33506ce7e70efdce3eb654160b0fe92691cc25a1c585e145fd29554a0f6c9dadd3830b757e79a3e9950b264925543a7d06f0af

Download Submit
C:\Windows\SysWOW64\Fkcboack.exe

Filesize
363KB

MD5
6b89358577e56bb5264b500ac64fd0e3

SHA1
29ecd10c3542d9f2e97b42bd0d0c771e2b5a7906

SHA256
9871ff7aaf73371b90925125e17a06c251efdc6f56d0a80848cde49809456e18

SHA512
4cc65df19d1e2cb69c0a2ca9ea0e6695b8751438d3331506e4c4168500a7ff15f71348d25dfe29374d77fafe7b8c42d06d77f52de880aa2ed1465a8181551ce8

Download Submit
C:\Windows\SysWOW64\Gbofcghl.exe

Filesize
128KB

MD5
ab3f08e9fc2da50a7a4959b6b5b3ec1d

SHA1
27f0f769b3eb0fd67ae02b75d3b526be55a7e01f

SHA256
4d0a4cc7c4f9efb8099bedaa8b3e1b7db1a0ed5e477f879fb2dd5cb19cc1efec

SHA512
6d17bb5e3c60792de2340d63df701e802a56e076036a2a8da9886f77eefab8fa030d251b1dd05a2a967685939f61b279a3598614842aa8062eabf5c982d89ccb

Download Submit
C:\Windows\SysWOW64\Hcpojd32.exe

Filesize
363KB

MD5
eafba131d7913eb4a45b452250de9248

SHA1
66f40ab939ad50b6e7a61a14ac52e2a401005a89

SHA256
0b9d4494b09a112047be0f442252c81bdcd60b2fc7d9b83d3e4faa87bf06a610

SHA512
83fc454a9dd3c3124df1892443d61c11ea95af4d4d0cbf2824b93ff78c2ffbfb615175ecd532761c3f6d1a0806831b83f1a25a7fa121258a61e32793e0855bfc

Download Submit
C:\Windows\SysWOW64\Hdehni32.exe

Filesize
363KB

MD5
f1bf81ea6bf84989a84463d2dfde7efc

SHA1
07e54b04c3fbefe1bc945d64431c97e6618ee7a6

SHA256
8376f451bc3dee00b17ca81438027dc3525bed4b3be8041157d5d5569451bc79

SHA512
90c768f5272333cbec635b75a271d99e61419e7566b1c89337bbff2dac2baf744ed2135a5418f977319f59be365285c3c7a092d692ad8fe7048ae4837a2d9e2f

Download Submit
C:\Windows\SysWOW64\Hfpecg32.exe

Filesize
363KB

MD5
c3820b5914dc5fee99ce66a69537cd39

SHA1
53235d47105beea728a1c2c2ffc93de309bac9f7

SHA256
9f9f1160f0f4e016b544b0debe4ac03a988b31c2a6cfbd108631cf1f37b5eaed

SHA512
f0f1f24b4d315f7405c8d825787237e4fe91aa0f4f71ce7f7c4ef45e00a3078530d2f7b64c022e7136a9aa5d83e8cd6f46d7a172efcdcadbae423de7a7c1fc22

Download Submit
C:\Windows\SysWOW64\Hnfjbdmk.exe

Filesize
363KB

MD5
e1bb5ef3c29713494e42cabcdf94e018

SHA1
e5c716fb5b1f681b185224fe5cd0d30c747cd3bc

SHA256
db489c04c2b238f39f523345dd45f0e9e9dcd78760d7da1bb0eca7cb1e617fe4

SHA512
f4c5d05e8773cdd167b370818c302052177b7e2a5a67a938684cf5502934ba885b09a0ac43983f80f42a51b29fa78f12321754b71e44778b9c5ba57e0c5a2933

Download Submit
C:\Windows\SysWOW64\Igbalblk.exe

Filesize
363KB

MD5
88a08f7579a082d921b617de518c5ecf

SHA1
2baeb52b9f8edea3bb10dfa8861cca7934fb4a49

SHA256
cbaaf533f1d2ea2f7406ff119d45e42328ca61a84dcf482efb05ddc3cce60cd4

SHA512
74a089b76be028b31228172f8e0c323d3d7556170b3b815b9a78db3e9ad3b9cefa8fa82fe19536bb1774a92d359ec6f484214f8946ab853565e53d65ea059d4d

Download Submit
C:\Windows\SysWOW64\Igigla32.exe

Filesize
363KB

MD5
9cde56ae62bf8e5a4d6779d5b2b54f99

SHA1
ad6d34756e3e52a208aed1f0425139a0d17190dd

SHA256
dec801d5b70ec7064d6c4497a01178eb41f2b0f2a62321027ae284f71246ea67

SHA512
4a53ce62e96548ed1f18802b493e01a30fe3beef1aab31f36f910d491a1761ece1c62dfcea3dc275e5e5f1501db3eac86aa4d364be827742a111120e9dda80fb

Download Submit
C:\Windows\SysWOW64\Innfnl32.exe

Filesize
363KB

MD5
a7a34b5363ed7191421ed6a9eac31144

SHA1
536db952ddca30b2fbd734acd47286f2b0747088

SHA256
ff6f45795d75aa3de4e6ab1f1d6ad7596b8dc7523f21e4444934dfc0e9a19a24

SHA512
6f900aa22bcc6b303bb4f0513e3c66df1cbbfc9a189f9a9fed0ad331c3a6eb7144d96c840102d85d285865682af24370fff87b8aff8bbcb1922447a5392a7c78

Download Submit
C:\Windows\SysWOW64\Kbddfmgl.exe

Filesize
363KB

MD5
3d0f0ba66284c4da63d6527b504ad6be

SHA1
febf234947f16aa00db7d559b870920f3d6db6f3

SHA256
fa29079dc2612a43844882526436a22fa9b46d75979a3f21afd82c6b6bbf63ae

SHA512
5a445497b876a725b7e9eb73a1230fd94ae69d255199c63c583b15d7032f5c814c94da7453847c42955094b46a39189f01182e014786f202db92eab8cf9c59a9

Download Submit
C:\Windows\SysWOW64\Kgninn32.exe

Filesize
363KB

MD5
a985d3be02f91456359e8b1d7005a289

SHA1
e84cf9574908f8a9d76390b6ceed08970e42f2fb

SHA256
e694dbe97d937410be585b25af9c260234582279f1fa90f884ae2696d44a6cd2

SHA512
cccf8bc8ba8c8cf2bb4cc31e7756b3e99a9436912ed4907fc993f3a16d072e2a0963469f624b1c0d946e2d0de40be9dc2698887b43bb0439911a152d6578696b

Download Submit
C:\Windows\SysWOW64\Klkcdj32.exe

Filesize
363KB

MD5
2f382c35ed3fcddc82d1755cea0c107b

SHA1
a85cefc5cd850906451001e3c275fe4468dc7580

SHA256
73977d664c51b6a55628524f3fd3c1908c142dbe6aa11cf05b570948a2ba83d7

SHA512
baf3ed89782fa8eb2d1a1069bda1278193037004e5cecd49d9f9d2888d64d22ee4a7e681f8afe4cc9b0477848733e6ac5adbe5de8bd89ce3590d154cd1d8fe31

Download Submit
C:\Windows\SysWOW64\Ljfhqh32.exe

Filesize
363KB

MD5
c3d6198b4bee81cf728fc8959c6409df

SHA1
bc06aeb4075b66f070b062612f70a16bbfb5addd

SHA256
cdc283a205735714749382a38bab63d46b4dbde23bbefe78355d41f8611de676

SHA512
97f9aa70bdf5d1354789146635545b1d0939511f095d8250b44f2f74ce9b4bf115261956ad6be6b1d4acb775451c4aa2ee628ed31d14b1199afe1ad18dc25c29

Download Submit
C:\Windows\SysWOW64\Mecjif32.exe

Filesize
363KB

MD5
f845b3be72cab1e004192e9a83038296

SHA1
f0dde411562c17d3f99e1d207f3ced14b5db1d27

SHA256
8b0a0302ebca3926c7468ed32af1320ec456cebd48594f658d838282d7afc326

SHA512
5718a0e33ab6e661a3b9e2774785367dd06e0a714fb662cad3a11e8425bad67ee35b8e1a79832387428b893325a9cb255ffc35f61bf7e2d47d558cd1decfa724

Download Submit
C:\Windows\SysWOW64\Mfaqhp32.exe

Filesize
363KB

MD5
e40b46eb4482601c50232baacc9a1684

SHA1
dc3f4a1e979eed0d578fe98b4508513afb51b59e

SHA256
2c81bb7e2f2efe0726ab9b0d4a9eb52423adfea1c002404b0ccb3e5829f4a76f

SHA512
2d72e224f1ae82a524418050d0de65fcbe3da1edb133e18792ed6e59721daf05fec96d18cf53dce463bc03814446a8ec972522ba801bb409850ca6593ec7b526

Download Submit
C:\Windows\SysWOW64\Mfcmmp32.exe

Filesize
64KB

MD5
0956991a62a1aace544b52b05d75e9fe

SHA1
084d335d38fb47087237a7bcef3903ca33c0c309

SHA256
f840dfc8f51ec96da4a2aa238e1eefea248eb71cc682ba2455e9759015f379e8

SHA512
cccdc0574840719dc806530ef589cb30397c5fdb817bed4d345a46e007cdc94a907330140ea92427c98e6db65f300eb1e81abaf04924a77e285044248665638f

Download Submit
C:\Windows\SysWOW64\Mgclpkac.exe

Filesize
363KB

MD5
ef3b110e36a246066cb8e45c3dbebc15

SHA1
1d975b7bfe1b6834c083e38a9b68e639803c0ace

SHA256
fb09be3e1b7c01fbf6c7612a6315ac5eaef9cf2971b1ab85fe379d4d342d37e3

SHA512
f4723a5541cc2f5860d91a808757af7256fe837a25c0d8529445476db10a633bd691ceef94b2958e6efd06f966f96a051f974330ab28a3dac1bf54b12b269953

Download Submit
C:\Windows\SysWOW64\Ndcdmikd.exe

Filesize
363KB

MD5
54a9e4cf6a77545d19dc99c4d94c4c67

SHA1
88e7946c74dc0d5ee4d429f9429b8286bfb4227c

SHA256
ee07f94f36bcd3830881963ebaf3e1e57cb7dcb5073d81f5ccef39a8fd586038

SHA512
f65d83c6a59633ad5c87f79fada69567672257ffc57d1396c3c2261ffad201f04905325578a4d398a44566fea5623b2dfce340731e001e2db92eb8ad4af9fe6c

Download Submit
C:\Windows\SysWOW64\Ndfqbhia.exe

Filesize
363KB

MD5
e780d548b2fcdf5d84afba8cd4334a0c

SHA1
578e45cb3b31c5c02bf004f3294b502d1a408523

SHA256
43daa71d32801d421baf1db332f232a4206049cb8783195f7b658f8859bc2c36

SHA512
5a5ba8d24b95d7243c07bb57ef7d40e516f0d7de9ae7a71e1bd42632f341b8cd6c1d99e31ba581e857077617a7979bfd8cc778d27607b868e2ca74e471c54df0

Download Submit
C:\Windows\SysWOW64\Nebdoa32.exe

Filesize
363KB

MD5
18db7046ad1de4c01fd564cc8d158ca2

SHA1
24281c59ee5b23685d664c09181a860072c98621

SHA256
1c6024dee97cef409e07ae4a3e321fc67680b11ace383ee17e807f545da9e116

SHA512
c9092e245b75879ba5aba6f3736c714876853c30bd912c188f2c3eef80ed594d15f169de854882d8394e9f7fbf468c9842befb51fa659a9b930cd46f69fc621e

Download Submit
C:\Windows\SysWOW64\Neeqea32.exe

Filesize
363KB

MD5
00fdb4c7b07df8813bf601368cf26619

SHA1
967960c79a839726bc64c3379759a492711039ea

SHA256
27c324b190f9042c450ead6f5318a830ef2db88d929c56d1273c36ff598d6c6d

SHA512
5f30adcceb58a9a355738b98058b9448f4ee3f54dfaa36ac30b201c2e757c994a14fcb886351405fc44c14ac80f34c4c3d6b3e2516437e3244d78b41fae4092e

Download Submit
C:\Windows\SysWOW64\Nfjjppmm.exe

Filesize
363KB

MD5
c6e133536fa244b8546cefe04b72fb0c

SHA1
359497897eefa6339207dfb1ab315fb3ced3bb2a

SHA256
8780dc8c468630b2526829709c1d83765a06f28cee0fb1be6f74b6b5881354db

SHA512
4a789c882728be056698d5192d9d500fbd7867091906d8bc8abb31f6c9d1749c43f8d4b2421570cf50f125b8080c1532659410deb57c9a58b62c9f52316ed250

Download Submit
C:\Windows\SysWOW64\Njciko32.exe

Filesize
363KB

MD5
f9b4ca11205775b4f431aefd3494a468

SHA1
0ef31370d0c5b17a6b4173d56e41f005b9cba7f3

SHA256
835ffad412f838dc8f32db0a6438ff906f691a45832c7e95dd19c201b4b81a7c

SHA512
43c18e97c8e306075527b3c8751412b80b15ffa8cd212fd39d068bd264cb9bc1a781110470bf2699acfd1df3c28a0face3bb6bab15a999ac7a4c8e5edcf538c0

Download Submit
C:\Windows\SysWOW64\Npmagine.exe

Filesize
363KB

MD5
c12076e64cee6fb19f2c9625f3e1eec3

SHA1
7594a36069a8504a47052707b5aff59891e22e26

SHA256
64966de4ffdaa64a255af31969bf1ac3312835d9d3a8cc42a6b7ea4408b93562

SHA512
073b0d0205c0a8f3e473528e43190f3304bddb5ca807df2291a7a86352729967f434b91289b02a1c3fb75896e28ac0c97be2e60485df77bd64fcef0bcf1532f7

Download Submit
C:\Windows\SysWOW64\Oampjeml.exe

Filesize
363KB

MD5
1762ff62c9ab7b68525e358161812841

SHA1
07711ac20a71b9ef6a2f3922c28db68b411fd5d1

SHA256
12a788b40197cddde10cd5601d758c100308785ed6167b550c188ab9b5ad8707

SHA512
36dc965a7b0adff3afd9ed6005322a4bde3c5f52fbc6d47ee21f0190ea3a1ec2e6a51e6576fa244da508e10b7e976afcb81bf0c1a7edba47441a6ddadab3ac0d

Download Submit
C:\Windows\SysWOW64\Odocigqg.exe

Filesize
363KB

MD5
9372c1f8d2503e19d6a0004318d9dc3e

SHA1
1d666313320aec0152fdd357ff8d1f61241cf559

SHA256
a829c6c9019b5cc34b1b2c015b6f15fcdb15c6494f955683935d4e44c0af73cc

SHA512
6de8deb35f22cfef820ae9add47c0d5d23b14a41ed36f807d01d44496344fd1d617338088ea840b2ca2c5e81c116bfad99c01a054c2f64cad6aa7a0a07b44007

Download Submit
C:\Windows\SysWOW64\Ofnckp32.exe

Filesize
363KB

MD5
97e8152a98e7e4dfd9ec39b1656a6b1d

SHA1
4190a82e5ed9b33203ed1192a8f45afa8cffc96b

SHA256
50e993d26454244a17a7f6eadca2d68d51fcfc2cf0762a0eca95127459671c55

SHA512
b971426a02d888706cf89cc5790c4dd5145db000fa96ba82235e8c714cc72b409c69e870b217db505e9ad9308a31e476e2d25321fbe71cf40ed8a6323c1b8d72

Download Submit
C:\Windows\SysWOW64\Ogbipa32.exe

Filesize
363KB

MD5
845f42295418be5ca5b674119493966e

SHA1
3aa598e9977c155981985e32a14188c75c2d2bf8

SHA256
6e91a05931a38426ed2c164c6e9d93b759d4a7a3bf2abb0240b3468b13358dd8

SHA512
cb6697118feb87dfa2259185d10aa96c4f38ee3c77875bb9b91471cf04bfb0901c5301393ba054a59d551dfc0ca2a7a39c9db8c2210ff2fbe0a631f5aee75e54

Download Submit
C:\Windows\SysWOW64\Ojgbfocc.exe

Filesize
363KB

MD5
3688273a61b830ade16beb7ca180e776

SHA1
fc7aef7ff9ac2eb18b4f1b97e181b1911618191c

SHA256
4ddca45e3bb703ad9a949e9de0ba618e03900e5f2e7c50d2818e1ce625681351

SHA512
22c3cc2b6556e2a4d824f34285816b1a20b5ee6e7cdb0e7ebe0b5b949e41f2d49b89b9f4671a2bfaaaa7f7e9d214daf880a7047eacc71ca267537a935571fda5

Download Submit
C:\Windows\SysWOW64\Ojllan32.exe

Filesize
363KB

MD5
77e0726a53315615266b09c66c140b83

SHA1
068fa67d19341f56b91ef93fb2a4d6b508da78f6

SHA256
50389860fe96a00e32c791de5950081daa331b0255a3521f462967745d34f62c

SHA512
ce82abc4ef4fa7721d6c13068565e2f96591f27a886274f810b58677b15141b2d9c3630363e509b0c90f5a12b989c75f52f413322427c9cf4a53ac21c7db3735

Download Submit
C:\Windows\SysWOW64\Olmeci32.exe

Filesize
363KB

MD5
692707c21a649bfc96a9ba972c5aee25

SHA1
493b8451cdd5ec3dc91c28cdce1decf876b98852

SHA256
754375566c3dafd66e12b972a3d52e0e33db3d58a95ab812f49a12ae612058b4

SHA512
c3046143b536bff75510a81018d95bbb71f11421985f0bd522d7d588ca1b49ab424601afe4b01765c35292d08124c4786d2aacd4c2498e7adfa761957ddd340a

Download Submit
C:\Windows\SysWOW64\Pcncpbmd.exe

Filesize
363KB

MD5
89c2464118a8c2de3441a36e820b0711

SHA1
eaa341d75ff5e87e1e7f215b28ec28a963968ed4

SHA256
5c6c4efab5001da5f620e136fc02ff43806a73844f464dab8c0e142b8f87f4cb

SHA512
c74af919c5bad50b25bd931127033b7444f21af5703c21c978cbfde72cd5dc3278c84882fd37a4b39ee7965a058b393b877b05002c6426808cb2a89e678e1a4d

Download Submit
C:\Windows\SysWOW64\Pgefeajb.exe

Filesize
363KB

MD5
8829984eb42f85160d0bbee186f83a6a

SHA1
a13d088b4adf26cd643ca9ec12fac0269319325c

SHA256
b15ed36633b5d71895cb22f619ca46f1290b9420edd1bd41fdf181564c783f2d

SHA512
80d7f99d6e069107b21ae6a37f46d71bc20f7667769c1bc09575eba8101e34c0d5f359c1b9d56beb2f1f4b157032ae7b40a57ccffcecc3f4390a20d98c8878e6

Download Submit
C:\Windows\SysWOW64\Pgllfp32.exe

Filesize
363KB

MD5
16fbf98f76094c2026ddd7ac39059e7f

SHA1
96f522e07b5b999ed71d3b6c731794c614e69b1b

SHA256
575c3bb3bb44708d7c55ad4a3c955deb78009e80f9afea47e47a7b8e3c4f0967

SHA512
7e59e6c4e25ba1390bfbb7563a4005e48c73bcd053ae8eff94044a6b4c2af3ae2820e4ee74765f087ec4328dcdcd899c1fe44852db665e35ea25d38c2e250fdb

Download Submit
C:\Windows\SysWOW64\Pjmehkqk.exe

Filesize
363KB

MD5
55666edc9a76624d1f57730b5dc9c88e

SHA1
281a824fd57f46bbb3cfc7658a6243f53e03ec5f

SHA256
198835e04fd266a2833001f6c2a2b6f17ae72be1a24f7f4a49f147abdfa5b7af

SHA512
f84d41054ca72de2b957e602d5a94245c78f705ba31013d8ddc125860cfd587c237c7be7da994f5bf0e533b21431011244c8373ca04f4f12a79bfbef9e75c690

Download Submit
C:\Windows\SysWOW64\Pmfhig32.exe

Filesize
363KB

MD5
5098604dcec5e813fb9c7cd110f4a210

SHA1
e491acbdfa9a7afca171442c7481170924426e54

SHA256
6e4bbb8289aa0d95abdd7bc3c22a79e33cb3fe26fcbe058f2db7a44c0391c04c

SHA512
3b08ac6ae5b93132815f9b0fcf268f2c5a9fd9fef6101a0b6c09b9ed7fa94b78be9f5b0b2308d050f3f7249f9b3a86270cdc18c12356a7492b95df1d31d937ae

Download Submit
C:\Windows\SysWOW64\Pnfdcjkg.exe

Filesize
363KB

MD5
72fcc2f7006418d9bc8bb40cc8974ad7

SHA1
99db7dd0af0f21e56954a403369faed4b6d2f5f7

SHA256
8e9d0efa554b8bc261331bd416bc99858e0de01e0c8e2ce479cd72430e69880f

SHA512
ddf443c81f1b001804010c23eca1a40e5e9b73a2dc5e1e7752710f7c4e89db8f53c5fbec0687ed2e4b9d659074bd18052ba66d5223189fedbdbe03cfdc0edb0d

Download Submit
C:\Windows\SysWOW64\Pqknig32.exe

Filesize
363KB

MD5
055bf51394435f1b15399e87e3b42310

SHA1
ef421fd0f286c35d94163aa1a940ae5bf175afab

SHA256
36b70754b0b4b837875dbc8383fdde017fac451fc55cdd27cbfb6fed6a3038d4

SHA512
883a65a96b8313547ef1c3743e3dd36e48b09f9d66650d2f449973d1ee6f22d945db1022ab7fbc6242ada37b9a70fdf42a3b6b4241640d4da350f1adc17ee30d

Download Submit
C:\Windows\SysWOW64\Pqmjog32.exe

Filesize
363KB

MD5
23c416aa7d8ac8531be7d534a854b90a

SHA1
287ebd5c9232816b27c37be9d833e25e1a15f2e7

SHA256
fa2ff332576533f90adecfb3decce753d7b14d80bccd68b6403cb5fb1720317f

SHA512
fe7243ec21f009c409729579847b112f5f67cefa1534ddfb75ad44b67138387c395bd5d0028a9d47ba1e9ecda6c61963427b6dda46ec75e469b6db8cfa330d79

Download Submit
C:\Windows\SysWOW64\Qdbiedpa.exe

Filesize
363KB

MD5
10301d5343bb2521622e49259931594d

SHA1
926cb3c8bb52f7b8088c1006587f44f3150f1c5e

SHA256
a7e73c32035cce670a759adfb8108e770668dd1cbfc4b48a581d1b4c9f0568e0

SHA512
43bccbb18c9f5e0dd595f9fe98978b1b76401d54e9c50446856d6caa6229f735d87ba976ea93c8ff6cee7a14c53ec410600a52df25e4bbc695bd5ddc35b58c9d

Download Submit
C:\Windows\SysWOW64\Qjoankoi.exe

Filesize
363KB

MD5
22673871ace83a046c6545799a0502dc

SHA1
cb3de5bee41adfece6ed9499c97167a4fe36800e

SHA256
094a611751c6339860495c5f17f28870da96cff9dfcc50eb102402812e88abea

SHA512
3d3b051881aad7096d9b0a96f1e8991f30c4998d7eddc7014c59b88afd61f1551054bcaf9197f8e5f81dfe51315ebe151905bd5828619228dcdf2b4388040f02

Download Submit
C:\Windows\SysWOW64\Qkmdkgob.exe

Filesize
363KB

MD5
17ea2ba8306da9821e27d301e7f7d0bc

SHA1
8bcf219bea400a8bfd420fab11fe9beb2117199d

SHA256
6b2b33770f23d30d1525116907d29f4f39a752ce0b77b8cf11e7c6e9760b49f0

SHA512
83833a2fee09b42007f1cbed77252a252177ae3cc2066545094957480be19f72c38d33ffa86f166e11da12bd9a74ce2651411faa920e0088d4a87833aee7efbc

Download Submit
memory/100-274-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/220-392-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/228-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/420-268-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/444-412-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/464-316-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/812-376-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/904-442-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/976-135-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1156-406-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1292-52-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1312-152-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1316-216-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1324-71-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1452-183-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1460-127-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1616-262-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1744-24-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1820-286-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2080-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2284-40-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2424-8-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2640-144-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2732-436-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2788-104-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2920-430-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2924-79-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2932-322-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2996-304-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3028-112-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3064-418-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3100-340-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3232-180-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3372-394-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3400-239-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3404-36-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3612-352-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3664-200-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3744-232-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3828-400-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3900-192-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4108-370-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4188-87-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4200-280-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4368-386-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4440-334-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4444-250-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4496-310-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4532-119-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4604-224-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4612-56-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4716-328-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4868-256-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4916-172-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4968-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4972-346-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4976-208-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4984-100-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5004-298-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5012-293-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5032-424-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5052-164-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5080-358-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5084-364-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads