4226bbc14496e9b09947697205f3f7ab6d8c68fcf639f88460cdb40aa1fbfd2e

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 19:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4226bbc14496e9b09947697205f3f7ab6d8c68fcf639f88460cdb40aa1fbfd2e.exe
Size

64KB
MD5

0713fc609c9dcc3074aa924c332ed47e
SHA1

373cc593d02d7176c5fec973e87af4c771b8036d
SHA256

4226bbc14496e9b09947697205f3f7ab6d8c68fcf639f88460cdb40aa1fbfd2e
SHA512

c116778edb0804152efae2ebbc5a77c7557337646493031c0598ac575d15d23938cc6d6d0f4ec30d9b9ecfcf69b27f1b63a283e25f60e8d167846b9f3cda9b43
SSDEEP

1536:ataDCdvuWF+3RHPKyWANM7jVq3M42LrrDWBi:at8SuFRvKyWzfVGCr2Bi

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knnhjcog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gacjadad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omgcpokp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eecphp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdehni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Neqopnhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ennqfenp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bklomh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Loacdc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onjegled.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnkgeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kinmcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikokan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfbkpd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ipihpkkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqcejcha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcidmkpq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iliinc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpdnjple.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfolbmje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Beeoaapl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lldfjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnhgjaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhmgki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hheoid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbdoof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ienekbld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhppji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfgklkoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fnckpmql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkehkocf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jppnpjel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqoefand.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lplfcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aimkjp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmgjia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nhokljge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aojefobm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Goedpofl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbbmmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgjijmin.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eecphp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oaifpi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgkiaj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdhedh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfojdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkhjph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlkbjqgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gingkqkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlbcnd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkjlic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbpjaeoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hehkajig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pplobcpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jgbchj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgjhpcmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbojlfdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omalpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phcomcng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Acpbbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Objpoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ommceclc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blnoga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdlkdhnk.exe

Executes dropped EXE 64 IoCs

pid	Process
1112	Fhjfhl32.exe
5016	Gcojed32.exe
3092	Gdqgmmjb.exe
3212	Gofkje32.exe
2748	Gcddpdpo.exe
3200	Ghaliknf.exe
760	Gcfqfc32.exe
4348	Gicinj32.exe
1852	Gcimkc32.exe
1632	Hmabdibj.exe
1336	Hmcojh32.exe
2572	Hcmgfbhd.exe
2552	Hmfkoh32.exe
4404	Himldi32.exe
1936	Hofdacke.exe
3980	Jmbdbd32.exe
4964	Jcllonma.exe
4084	Kmdqgd32.exe
4156	Kbaipkbi.exe
3972	Kmfmmcbo.exe
2424	Kbceejpf.exe
2168	Kimnbd32.exe
2476	Kpgfooop.exe
384	Kmkfhc32.exe
2936	Kpjcdn32.exe
1500	Kibgmdcn.exe
2932	Leihbeib.exe
4800	Lmppcbjd.exe
660	Lfhdlh32.exe
892	Lmbmibhb.exe
2608	Lboeaifi.exe
4356	Liimncmf.exe
2144	Likjcbkc.exe
572	Ldanqkki.exe
1980	Lgokmgjm.exe
3120	Lmiciaaj.exe
4420	Mmlpoqpg.exe
992	Megdccmb.exe
968	Mplhql32.exe
1276	Mgfqmfde.exe
4804	Mdjagjco.exe
4872	Melnob32.exe
4632	Mpablkhc.exe
4440	Menjdbgj.exe
2260	Mnebeogl.exe
2036	Npcoakfp.exe
5012	Nepgjaeg.exe
1728	Nljofl32.exe
3264	Ngpccdlj.exe
1636	Nnjlpo32.exe
1624	Ndcdmikd.exe
5124	Njqmepik.exe
5176	Ngdmod32.exe
5224	Nlaegk32.exe
5264	Nnqbanmo.exe
5320	Ogifjcdp.exe
5372	Ojgbfocc.exe
5436	Opakbi32.exe
5480	Ogkcpbam.exe
5528	Ojjolnaq.exe
5572	Opdghh32.exe
5608	Odocigqg.exe
5652	Onhhamgg.exe
5704	Oqfdnhfk.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nnqbanmo.exe	Nlaegk32.exe
File created	C:\Windows\SysWOW64\Ffpmlcim.dll	Chagok32.exe
File created	C:\Windows\SysWOW64\Ehjlaaig.exe	Eaqdegaj.exe
File opened for modification	C:\Windows\SysWOW64\Hbhijepa.exe	Hdehni32.exe
File created	C:\Windows\SysWOW64\Ibjqaf32.exe	Ilphdlqh.exe
File created	C:\Windows\SysWOW64\Lllagh32.exe	Lafmjp32.exe
File created	C:\Windows\SysWOW64\Ilnjmilq.dll	Mbgeqmjp.exe
File created	C:\Windows\SysWOW64\Ibffhhek.exe	Iohjlmeg.exe
File opened for modification	C:\Windows\SysWOW64\Hdpbon32.exe	Hjjnae32.exe
File created	C:\Windows\SysWOW64\Mdfggeba.dll	Eiaoid32.exe
File opened for modification	C:\Windows\SysWOW64\Eciplm32.exe	Elbhjp32.exe
File opened for modification	C:\Windows\SysWOW64\Megljppl.exe	Mjahlgpf.exe
File created	C:\Windows\SysWOW64\Aphblj32.dll	Blnoga32.exe
File created	C:\Windows\SysWOW64\Fpgpgfmh.exe	Fmhdkknd.exe
File opened for modification	C:\Windows\SysWOW64\Omfekbdh.exe	Ojhiogdd.exe
File created	C:\Windows\SysWOW64\Ingfla32.dll	Chcddk32.exe
File opened for modification	C:\Windows\SysWOW64\Knbiofhg.exe	Jghabl32.exe
File created	C:\Windows\SysWOW64\Biadeoce.exe	Bcbohigp.exe
File created	C:\Windows\SysWOW64\Kbpnnj32.dll	Dlkbjqgm.exe
File created	C:\Windows\SysWOW64\Lenicahg.exe	Lgjijmin.exe
File created	C:\Windows\SysWOW64\Efepbi32.exe	Eplgeokq.exe
File created	C:\Windows\SysWOW64\Hdlpneli.exe	Hnagak32.exe
File created	C:\Windows\SysWOW64\Akejpg32.dll	Jecofa32.exe
File created	C:\Windows\SysWOW64\Eklpgqkc.dll	Cjhfpa32.exe
File opened for modification	C:\Windows\SysWOW64\Cimcan32.exe	Cglgjeci.exe
File opened for modification	C:\Windows\SysWOW64\Fmlneg32.exe	Fknbil32.exe
File opened for modification	C:\Windows\SysWOW64\Cncnob32.exe	Coqncejg.exe
File created	C:\Windows\SysWOW64\Ojqhdcii.dll	Mlofcf32.exe
File opened for modification	C:\Windows\SysWOW64\Pciqnk32.exe	Pmphaaln.exe
File created	C:\Windows\SysWOW64\Ehaaclak.dll	Pqpgdfnp.exe
File created	C:\Windows\SysWOW64\Fhgbhfbe.exe	Fehfljca.exe
File opened for modification	C:\Windows\SysWOW64\Bbnkonbd.exe	Bhcjqinf.exe
File opened for modification	C:\Windows\SysWOW64\Aojefobm.exe	Addaif32.exe
File opened for modification	C:\Windows\SysWOW64\Ffqhcq32.exe	Fbelcblk.exe
File created	C:\Windows\SysWOW64\Omfekbdh.exe	Ojhiogdd.exe
File opened for modification	C:\Windows\SysWOW64\Chjaol32.exe	Bmemac32.exe
File created	C:\Windows\SysWOW64\Pocehodm.dll	Ggeboaob.exe
File created	C:\Windows\SysWOW64\Leckbi32.dll	Qgpogili.exe
File opened for modification	C:\Windows\SysWOW64\Ckbemgcp.exe	Cggimh32.exe
File opened for modification	C:\Windows\SysWOW64\Mjpjgj32.exe	Mfenglqf.exe
File created	C:\Windows\SysWOW64\Lfgipd32.exe	Lgdidgjg.exe
File opened for modification	C:\Windows\SysWOW64\Djhpgofm.exe	Dapkni32.exe
File opened for modification	C:\Windows\SysWOW64\Ehjlaaig.exe	Eaqdegaj.exe
File created	C:\Windows\SysWOW64\Icpkgc32.dll	Hmechmip.exe
File opened for modification	C:\Windows\SysWOW64\Igdnabjh.exe	Iknmla32.exe
File created	C:\Windows\SysWOW64\Ffqhcq32.exe	Fbelcblk.exe
File created	C:\Windows\SysWOW64\Glhimp32.exe	Gacepg32.exe
File created	C:\Windows\SysWOW64\Afjlnk32.exe	Aeiofcji.exe
File opened for modification	C:\Windows\SysWOW64\Hffcmh32.exe	Goljqnpd.exe
File created	C:\Windows\SysWOW64\Pdggmekl.dll	Hdpiid32.exe
File created	C:\Windows\SysWOW64\Dimenegi.exe	Dfoiaj32.exe
File opened for modification	C:\Windows\SysWOW64\Kjjbjd32.exe	Kgkfnh32.exe
File opened for modification	C:\Windows\SysWOW64\Pcpnhl32.exe	Pqbala32.exe
File created	C:\Windows\SysWOW64\Pblkiipl.dll	Fhbimf32.exe
File created	C:\Windows\SysWOW64\Gceegdko.dll	Bheplb32.exe
File opened for modification	C:\Windows\SysWOW64\Pnifekmd.exe	Pmiikh32.exe
File created	C:\Windows\SysWOW64\Hnbeeiji.exe	Hldiinke.exe
File opened for modification	C:\Windows\SysWOW64\Njljch32.exe	Nbebbk32.exe
File created	C:\Windows\SysWOW64\Jgbcdnbb.dll	Gcfqfc32.exe
File created	C:\Windows\SysWOW64\Bcflijmh.dll	Lcjcnoej.exe
File created	C:\Windows\SysWOW64\Mgaokl32.exe	Maggnali.exe
File opened for modification	C:\Windows\SysWOW64\Fpjjac32.exe	Fmlneg32.exe
File opened for modification	C:\Windows\SysWOW64\Hhfedm32.exe	Hdkidohn.exe
File created	C:\Windows\SysWOW64\Dpipfd32.dll	Dimenegi.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10344	10568	WerFault.exe	1000

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cggimh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qncbfk32.dll"	Ldanqkki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fhbimf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Knbiofhg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjhfpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Djhpgofm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acfhad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccmbmpbk.dll"	Odhifjkg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gkmdecbg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnjqmpgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmiikh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecbfdd32.dll"	Lankbigo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jofalmmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hldiinke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehiffj32.dll"	Ggkiol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfnqklgh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Higjaoci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aaohcj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jnkcogno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgndoeag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgnilk32.dll"	Cgndoeag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flcmfp32.dll"	Mhoipb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnhgjaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iijfhbhl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nijqcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Glfmgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pacmhc32.dll"	Folaiqng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cimcan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ecefqnel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eplgeokq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdobnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mdkgabfn.dll"	Eifaim32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmiadfmi.dll"	Fijkdmhn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbnlaldg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oqoefand.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gofkje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfnkkb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lfealaol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jgpmmp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgaokl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Impliekg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pplobcpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmniml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmdnbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijilflah.dll"	Cdpcal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fefjfked.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jpkphjeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akqgne32.dll"	Ajcdnd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jhlgfj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ienekbld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbdmhm32.dll"	Jnkcogno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpecpgjp.dll"	Nognnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iankcfdg.dll"	Gbabigfj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ffqhcq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ldanqkki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qpeahb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Egcaod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iomoenej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Migmpjdh.dll"	Ilcldb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lafmjp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apjfbb32.dll"	Lhcali32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ionqbdem.dll"	Acgolj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlofcf32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 1112	3248	4226bbc14496e9b09947697205f3f7ab6d8c68fcf639f88460cdb40aa1fbfd2e.exe	94
PID 3248 wrote to memory of 1112	3248	4226bbc14496e9b09947697205f3f7ab6d8c68fcf639f88460cdb40aa1fbfd2e.exe	94
PID 3248 wrote to memory of 1112	3248	4226bbc14496e9b09947697205f3f7ab6d8c68fcf639f88460cdb40aa1fbfd2e.exe	94
PID 1112 wrote to memory of 5016	1112	Fhjfhl32.exe	95
PID 1112 wrote to memory of 5016	1112	Fhjfhl32.exe	95
PID 1112 wrote to memory of 5016	1112	Fhjfhl32.exe	95
PID 5016 wrote to memory of 3092	5016	Gcojed32.exe	96
PID 5016 wrote to memory of 3092	5016	Gcojed32.exe	96
PID 5016 wrote to memory of 3092	5016	Gcojed32.exe	96
PID 3092 wrote to memory of 3212	3092	Gdqgmmjb.exe	97
PID 3092 wrote to memory of 3212	3092	Gdqgmmjb.exe	97
PID 3092 wrote to memory of 3212	3092	Gdqgmmjb.exe	97
PID 3212 wrote to memory of 2748	3212	Gofkje32.exe	98
PID 3212 wrote to memory of 2748	3212	Gofkje32.exe	98
PID 3212 wrote to memory of 2748	3212	Gofkje32.exe	98
PID 2748 wrote to memory of 3200	2748	Gcddpdpo.exe	99
PID 2748 wrote to memory of 3200	2748	Gcddpdpo.exe	99
PID 2748 wrote to memory of 3200	2748	Gcddpdpo.exe	99
PID 3200 wrote to memory of 760	3200	Ghaliknf.exe	100
PID 3200 wrote to memory of 760	3200	Ghaliknf.exe	100
PID 3200 wrote to memory of 760	3200	Ghaliknf.exe	100
PID 760 wrote to memory of 4348	760	Gcfqfc32.exe	101
PID 760 wrote to memory of 4348	760	Gcfqfc32.exe	101
PID 760 wrote to memory of 4348	760	Gcfqfc32.exe	101
PID 4348 wrote to memory of 1852	4348	Gicinj32.exe	102
PID 4348 wrote to memory of 1852	4348	Gicinj32.exe	102
PID 4348 wrote to memory of 1852	4348	Gicinj32.exe	102
PID 1852 wrote to memory of 1632	1852	Gcimkc32.exe	103
PID 1852 wrote to memory of 1632	1852	Gcimkc32.exe	103
PID 1852 wrote to memory of 1632	1852	Gcimkc32.exe	103
PID 1632 wrote to memory of 1336	1632	Hmabdibj.exe	104
PID 1632 wrote to memory of 1336	1632	Hmabdibj.exe	104
PID 1632 wrote to memory of 1336	1632	Hmabdibj.exe	104
PID 1336 wrote to memory of 2572	1336	Hmcojh32.exe	106
PID 1336 wrote to memory of 2572	1336	Hmcojh32.exe	106
PID 1336 wrote to memory of 2572	1336	Hmcojh32.exe	106
PID 2572 wrote to memory of 2552	2572	Hcmgfbhd.exe	107
PID 2572 wrote to memory of 2552	2572	Hcmgfbhd.exe	107
PID 2572 wrote to memory of 2552	2572	Hcmgfbhd.exe	107
PID 2552 wrote to memory of 4404	2552	Hmfkoh32.exe	108
PID 2552 wrote to memory of 4404	2552	Hmfkoh32.exe	108
PID 2552 wrote to memory of 4404	2552	Hmfkoh32.exe	108
PID 4404 wrote to memory of 1936	4404	Himldi32.exe	109
PID 4404 wrote to memory of 1936	4404	Himldi32.exe	109
PID 4404 wrote to memory of 1936	4404	Himldi32.exe	109
PID 1936 wrote to memory of 3980	1936	Hofdacke.exe	110
PID 1936 wrote to memory of 3980	1936	Hofdacke.exe	110
PID 1936 wrote to memory of 3980	1936	Hofdacke.exe	110
PID 3980 wrote to memory of 4964	3980	Jmbdbd32.exe	111
PID 3980 wrote to memory of 4964	3980	Jmbdbd32.exe	111
PID 3980 wrote to memory of 4964	3980	Jmbdbd32.exe	111
PID 4964 wrote to memory of 4084	4964	Jcllonma.exe	112
PID 4964 wrote to memory of 4084	4964	Jcllonma.exe	112
PID 4964 wrote to memory of 4084	4964	Jcllonma.exe	112
PID 4084 wrote to memory of 4156	4084	Kmdqgd32.exe	113
PID 4084 wrote to memory of 4156	4084	Kmdqgd32.exe	113
PID 4084 wrote to memory of 4156	4084	Kmdqgd32.exe	113
PID 4156 wrote to memory of 3972	4156	Kbaipkbi.exe	114
PID 4156 wrote to memory of 3972	4156	Kbaipkbi.exe	114
PID 4156 wrote to memory of 3972	4156	Kbaipkbi.exe	114
PID 3972 wrote to memory of 2424	3972	Kmfmmcbo.exe	115
PID 3972 wrote to memory of 2424	3972	Kmfmmcbo.exe	115
PID 3972 wrote to memory of 2424	3972	Kmfmmcbo.exe	115
PID 2424 wrote to memory of 2168	2424	Kbceejpf.exe	116

C:\Users\Admin\AppData\Local\Temp\4226bbc14496e9b09947697205f3f7ab6d8c68fcf639f88460cdb40aa1fbfd2e.exe
"C:\Users\Admin\AppData\Local\Temp\4226bbc14496e9b09947697205f3f7ab6d8c68fcf639f88460cdb40aa1fbfd2e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\SysWOW64\Fhjfhl32.exe
  C:\Windows\system32\Fhjfhl32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\SysWOW64\Gcojed32.exe
    C:\Windows\system32\Gcojed32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Windows\SysWOW64\Gdqgmmjb.exe
      C:\Windows\system32\Gdqgmmjb.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3092
    - - C:\Windows\SysWOW64\Gofkje32.exe
        
        C:\Windows\system32\Gofkje32.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3212
      - C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2748
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3200
        
        C:\Windows\SysWOW64\Gcfqfc32.exe
        
        C:\Windows\system32\Gcfqfc32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4348
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1852
        
        C:\Windows\SysWOW64\Hmabdibj.exe
        
        C:\Windows\system32\Hmabdibj.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1336
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2572
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2552
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4404
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1936
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3980
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\SysWOW64\Kmdqgd32.exe
        
        C:\Windows\system32\Kmdqgd32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4156
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3972
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2424
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        23⤵
        Executes dropped EXE
        
        PID:2168
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        24⤵
        Executes dropped EXE
        
        PID:2476
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        25⤵
        Executes dropped EXE
        
        PID:384
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        26⤵
        Executes dropped EXE
        
        PID:2936
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        27⤵
        Executes dropped EXE
        
        PID:1500
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        28⤵
        Executes dropped EXE
        
        PID:2932
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        29⤵
        Executes dropped EXE
        
        PID:4800
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        30⤵
        Executes dropped EXE
        
        PID:660
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        31⤵
        Executes dropped EXE
        
        PID:892
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        32⤵
        Executes dropped EXE
        
        PID:2608
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        33⤵
        Executes dropped EXE
        
        PID:4356
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        34⤵
        Executes dropped EXE
        
        PID:2144
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:572
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        36⤵
        Executes dropped EXE
        
        PID:1980
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        37⤵
        Executes dropped EXE
        
        PID:3120
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        38⤵
        Executes dropped EXE
        
        PID:4420
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        39⤵
        Executes dropped EXE
        
        PID:992
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        40⤵
        Executes dropped EXE
        
        PID:968
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        41⤵
        Executes dropped EXE
        
        PID:1276
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        42⤵
        Executes dropped EXE
        
        PID:4804
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        43⤵
        Executes dropped EXE
        
        PID:4872
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        44⤵
        Executes dropped EXE
        
        PID:4632
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        45⤵
        Executes dropped EXE
        
        PID:4440
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        46⤵
        Executes dropped EXE
        
        PID:2260
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        47⤵
        Executes dropped EXE
        
        PID:2036
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        48⤵
        Executes dropped EXE
        
        PID:5012
        
        C:\Windows\SysWOW64\Nljofl32.exe
        
        C:\Windows\system32\Nljofl32.exe
        49⤵
        Executes dropped EXE
        
        PID:1728
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        50⤵
        Executes dropped EXE
        
        PID:3264
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        51⤵
        Executes dropped EXE
        
        PID:1636
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        52⤵
        Executes dropped EXE
        
        PID:1624
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        53⤵
        Executes dropped EXE
        
        PID:5124
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        54⤵
        Executes dropped EXE
        
        PID:5176
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5224
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        56⤵
        Executes dropped EXE
        
        PID:5264
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        57⤵
        Executes dropped EXE
        
        PID:5320
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        58⤵
        Executes dropped EXE
        
        PID:5372
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        59⤵
        Executes dropped EXE
        
        PID:5436
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        60⤵
        Executes dropped EXE
        
        PID:5480
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        61⤵
        Executes dropped EXE
        
        PID:5528
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        62⤵
        Executes dropped EXE
        
        PID:5572
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        63⤵
        Executes dropped EXE
        
        PID:5608
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        64⤵
        Executes dropped EXE
        
        PID:5652
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        65⤵
        Executes dropped EXE
        
        PID:5704
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        66⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5792
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        68⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        69⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        70⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        71⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Pqpgdfnp.exe
        
        C:\Windows\system32\Pqpgdfnp.exe
        72⤵
        Drops file in System32 directory
        
        PID:6060
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        73⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        74⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5200
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        76⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        77⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        78⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        79⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        80⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        81⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        82⤵
        Modifies registry class
        
        PID:5828
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        83⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        84⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        85⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        86⤵
        Drops file in System32 directory
        
        PID:5184
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        87⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        88⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        89⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        90⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        91⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        92⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        93⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        94⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        95⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        96⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6008
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5260
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        99⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        100⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        101⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        102⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        103⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        104⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        105⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        106⤵
        Drops file in System32 directory
        
        PID:6348
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        107⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        108⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        109⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        110⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        111⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        112⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        113⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        114⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        115⤵
        Drops file in System32 directory
        
        PID:6820
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        116⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        117⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        118⤵
        Drops file in System32 directory
        
        PID:6952
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        119⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        120⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        121⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        122⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        123⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        124⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        125⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        126⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6384
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        127⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Eajeon32.exe
        
        C:\Windows\system32\Eajeon32.exe
        128⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Ehdmlhcj.exe
        
        C:\Windows\system32\Ehdmlhcj.exe
        129⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Eonehbjg.exe
        
        C:\Windows\system32\Eonehbjg.exe
        130⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Edknqiho.exe
        
        C:\Windows\system32\Edknqiho.exe
        131⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Eopbnbhd.exe
        
        C:\Windows\system32\Eopbnbhd.exe
        132⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Edmjfifl.exe
        
        C:\Windows\system32\Edmjfifl.exe
        133⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Edpgli32.exe
        
        C:\Windows\system32\Edpgli32.exe
        134⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Ekiohclf.exe
        
        C:\Windows\system32\Ekiohclf.exe
        135⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Eachem32.exe
        
        C:\Windows\system32\Eachem32.exe
        136⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Fgppmd32.exe
        
        C:\Windows\system32\Fgppmd32.exe
        137⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Fgbmccpg.exe
        
        C:\Windows\system32\Fgbmccpg.exe
        138⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Fahaplon.exe
        
        C:\Windows\system32\Fahaplon.exe
        139⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Fhbimf32.exe
        
        C:\Windows\system32\Fhbimf32.exe
        140⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6648
        
        C:\Windows\SysWOW64\Folaiqng.exe
        
        C:\Windows\system32\Folaiqng.exe
        141⤵
        Modifies registry class
        
        PID:6808
        
        C:\Windows\SysWOW64\Fefjfked.exe
        
        C:\Windows\system32\Fefjfked.exe
        142⤵
        Modifies registry class
        
        PID:6948
        
        C:\Windows\SysWOW64\Fehfljca.exe
        
        C:\Windows\system32\Fehfljca.exe
        143⤵
        Drops file in System32 directory
        
        PID:7056
        
        C:\Windows\SysWOW64\Fhgbhfbe.exe
        
        C:\Windows\system32\Fhgbhfbe.exe
        144⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Fnckpmql.exe
        
        C:\Windows\system32\Fnckpmql.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6308
        
        C:\Windows\SysWOW64\Gekcaj32.exe
        
        C:\Windows\system32\Gekcaj32.exe
        146⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Ghipne32.exe
        
        C:\Windows\system32\Ghipne32.exe
        147⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Gkglja32.exe
        
        C:\Windows\system32\Gkglja32.exe
        148⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Gnfhfl32.exe
        
        C:\Windows\system32\Gnfhfl32.exe
        149⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Gdppbfff.exe
        
        C:\Windows\system32\Gdppbfff.exe
        150⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Goedpofl.exe
        
        C:\Windows\system32\Goedpofl.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5380
        
        C:\Windows\SysWOW64\Gadqlkep.exe
        
        C:\Windows\system32\Gadqlkep.exe
        152⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Ghniielm.exe
        
        C:\Windows\system32\Ghniielm.exe
        153⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Gkleeplq.exe
        
        C:\Windows\system32\Gkleeplq.exe
        154⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Gafmaj32.exe
        
        C:\Windows\system32\Gafmaj32.exe
        155⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Gojnko32.exe
        
        C:\Windows\system32\Gojnko32.exe
        156⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Ggeboaob.exe
        
        C:\Windows\system32\Ggeboaob.exe
        157⤵
        Drops file in System32 directory
        
        PID:5212
        
        C:\Windows\SysWOW64\Goljqnpd.exe
        
        C:\Windows\system32\Goljqnpd.exe
        158⤵
        Drops file in System32 directory
        
        PID:7216
        
        C:\Windows\SysWOW64\Hffcmh32.exe
        
        C:\Windows\system32\Hffcmh32.exe
        159⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Hheoid32.exe
        
        C:\Windows\system32\Hheoid32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7308
        
        C:\Windows\SysWOW64\Hnagak32.exe
        
        C:\Windows\system32\Hnagak32.exe
        161⤵
        Drops file in System32 directory
        
        PID:7356
        
        C:\Windows\SysWOW64\Hdlpneli.exe
        
        C:\Windows\system32\Hdlpneli.exe
        162⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Hkehkocf.exe
        
        C:\Windows\system32\Hkehkocf.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7440
        
        C:\Windows\SysWOW64\Hbpphi32.exe
        
        C:\Windows\system32\Hbpphi32.exe
        164⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Hhihdcbp.exe
        
        C:\Windows\system32\Hhihdcbp.exe
        165⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Hbbmmi32.exe
        
        C:\Windows\system32\Hbbmmi32.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7576
        
        C:\Windows\SysWOW64\Hdpiid32.exe
        
        C:\Windows\system32\Hdpiid32.exe
        167⤵
        Drops file in System32 directory
        
        PID:7624
        
        C:\Windows\SysWOW64\Hgoeep32.exe
        
        C:\Windows\system32\Hgoeep32.exe
        168⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Hdbfodfa.exe
        
        C:\Windows\system32\Hdbfodfa.exe
        169⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Iohjlmeg.exe
        
        C:\Windows\system32\Iohjlmeg.exe
        170⤵
        Drops file in System32 directory
        
        PID:7752
        
        C:\Windows\SysWOW64\Ibffhhek.exe
        
        C:\Windows\system32\Ibffhhek.exe
        171⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Ikokan32.exe
        
        C:\Windows\system32\Ikokan32.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7840
        
        C:\Windows\SysWOW64\Idgojc32.exe
        
        C:\Windows\system32\Idgojc32.exe
        173⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Ikaggmii.exe
        
        C:\Windows\system32\Ikaggmii.exe
        174⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Ibkpcg32.exe
        
        C:\Windows\system32\Ibkpcg32.exe
        175⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Ighhln32.exe
        
        C:\Windows\system32\Ighhln32.exe
        176⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Ieliebnf.exe
        
        C:\Windows\system32\Ieliebnf.exe
        177⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Igjeanmj.exe
        
        C:\Windows\system32\Igjeanmj.exe
        178⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Ibpiogmp.exe
        
        C:\Windows\system32\Ibpiogmp.exe
        179⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Ienekbld.exe
        
        C:\Windows\system32\Ienekbld.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8188
        
        C:\Windows\SysWOW64\Jecofa32.exe
        
        C:\Windows\system32\Jecofa32.exe
        181⤵
        Drops file in System32 directory
        
        PID:7196
        
        C:\Windows\SysWOW64\Jnkcogno.exe
        
        C:\Windows\system32\Jnkcogno.exe
        182⤵
        Modifies registry class
        
        PID:7272
        
        C:\Windows\SysWOW64\Jfbkpd32.exe
        
        C:\Windows\system32\Jfbkpd32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7324
        
        C:\Windows\SysWOW64\Jpkphjeb.exe
        
        C:\Windows\system32\Jpkphjeb.exe
        184⤵
        Modifies registry class
        
        PID:7392
        
        C:\Windows\SysWOW64\Jghabl32.exe
        
        C:\Windows\system32\Jghabl32.exe
        185⤵
        Drops file in System32 directory
        
        PID:7456
        
        C:\Windows\SysWOW64\Knbiofhg.exe
        
        C:\Windows\system32\Knbiofhg.exe
        186⤵
        Modifies registry class
        
        PID:7520
        
        C:\Windows\SysWOW64\Kfjapcii.exe
        
        C:\Windows\system32\Kfjapcii.exe
        187⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Klfjijgq.exe
        
        C:\Windows\system32\Klfjijgq.exe
        188⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Knefeffd.exe
        
        C:\Windows\system32\Knefeffd.exe
        189⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Keonap32.exe
        
        C:\Windows\system32\Keonap32.exe
        190⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\Kijjbofj.exe
        
        C:\Windows\system32\Kijjbofj.exe
        191⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Kpdboimg.exe
        
        C:\Windows\system32\Kpdboimg.exe
        192⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Kfnkkb32.exe
        
        C:\Windows\system32\Kfnkkb32.exe
        193⤵
        Modifies registry class
        
        PID:8028
        
        C:\Windows\SysWOW64\Klmpiiai.exe
        
        C:\Windows\system32\Klmpiiai.exe
        194⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\Lfealaol.exe
        
        C:\Windows\system32\Lfealaol.exe
        195⤵
        Modifies registry class
        
        PID:820
        
        C:\Windows\SysWOW64\Lidmhmnp.exe
        
        C:\Windows\system32\Lidmhmnp.exe
        196⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Llbidimc.exe
        
        C:\Windows\system32\Llbidimc.exe
        197⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Lpneegel.exe
        
        C:\Windows\system32\Lpneegel.exe
        198⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Lfhnaa32.exe
        
        C:\Windows\system32\Lfhnaa32.exe
        199⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Lejnmncd.exe
        
        C:\Windows\system32\Lejnmncd.exe
        200⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Lldfjh32.exe
        
        C:\Windows\system32\Lldfjh32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7552
        
        C:\Windows\SysWOW64\Locbfd32.exe
        
        C:\Windows\system32\Locbfd32.exe
        202⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Lemkcnaa.exe
        
        C:\Windows\system32\Lemkcnaa.exe
        203⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Lhkgoiqe.exe
        
        C:\Windows\system32\Lhkgoiqe.exe
        204⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Lbchba32.exe
        
        C:\Windows\system32\Lbchba32.exe
        205⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Mhppji32.exe
        
        C:\Windows\system32\Mhppji32.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8112
        
        C:\Windows\SysWOW64\Mbedga32.exe
        
        C:\Windows\system32\Mbedga32.exe
        207⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Miomdk32.exe
        
        C:\Windows\system32\Miomdk32.exe
        208⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Mbhamajc.exe
        
        C:\Windows\system32\Mbhamajc.exe
        209⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Mbjnbqhp.exe
        
        C:\Windows\system32\Mbjnbqhp.exe
        210⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Mbognp32.exe
        
        C:\Windows\system32\Mbognp32.exe
        211⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Niipjj32.exe
        
        C:\Windows\system32\Niipjj32.exe
        212⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Neppokal.exe
        
        C:\Windows\system32\Neppokal.exe
        213⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Nlleaeff.exe
        
        C:\Windows\system32\Nlleaeff.exe
        214⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\Nipekiep.exe
        
        C:\Windows\system32\Nipekiep.exe
        215⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Nomncpcg.exe
        
        C:\Windows\system32\Nomncpcg.exe
        216⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Ngdfdmdi.exe
        
        C:\Windows\system32\Ngdfdmdi.exe
        217⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Nplkmckj.exe
        
        C:\Windows\system32\Nplkmckj.exe
        218⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Ogfcjm32.exe
        
        C:\Windows\system32\Ogfcjm32.exe
        219⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Olehhc32.exe
        
        C:\Windows\system32\Olehhc32.exe
        220⤵
        
        PID:64
        
        C:\Windows\SysWOW64\Ogklelna.exe
        
        C:\Windows\system32\Ogklelna.exe
        221⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Ohlimd32.exe
        
        C:\Windows\system32\Ohlimd32.exe
        222⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Oljaccjf.exe
        
        C:\Windows\system32\Oljaccjf.exe
        223⤵
        
        PID:3684
        
        C:\Windows\SysWOW64\Ocdjpmac.exe
        
        C:\Windows\system32\Ocdjpmac.exe
        224⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Ookjdn32.exe
        
        C:\Windows\system32\Ookjdn32.exe
        225⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Phcomcng.exe
        
        C:\Windows\system32\Phcomcng.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4196
        
        C:\Windows\SysWOW64\Pfgogh32.exe
        
        C:\Windows\system32\Pfgogh32.exe
        227⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Plagcbdn.exe
        
        C:\Windows\system32\Plagcbdn.exe
        228⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\Pgflqkdd.exe
        
        C:\Windows\system32\Pgflqkdd.exe
        229⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Plcdiabk.exe
        
        C:\Windows\system32\Plcdiabk.exe
        230⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Pcmlfl32.exe
        
        C:\Windows\system32\Pcmlfl32.exe
        231⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Pgkelj32.exe
        
        C:\Windows\system32\Pgkelj32.exe
        232⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Pqcjepfo.exe
        
        C:\Windows\system32\Pqcjepfo.exe
        233⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Pofjpl32.exe
        
        C:\Windows\system32\Pofjpl32.exe
        234⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Qfpbmfdf.exe
        
        C:\Windows\system32\Qfpbmfdf.exe
        235⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Qjlnnemp.exe
        
        C:\Windows\system32\Qjlnnemp.exe
        236⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Qgpogili.exe
        
        C:\Windows\system32\Qgpogili.exe
        237⤵
        Drops file in System32 directory
        
        PID:8512
        
        C:\Windows\SysWOW64\Acgolj32.exe
        
        C:\Windows\system32\Acgolj32.exe
        238⤵
        Modifies registry class
        
        PID:8556
        
        C:\Windows\SysWOW64\Agbkmijg.exe
        
        C:\Windows\system32\Agbkmijg.exe
        239⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Amodep32.exe
        
        C:\Windows\system32\Amodep32.exe
        240⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Aompak32.exe
        
        C:\Windows\system32\Aompak32.exe
        241⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Agdhbi32.exe
        
        C:\Windows\system32\Agdhbi32.exe
        242⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Ajcdnd32.exe
        
        C:\Windows\system32\Ajcdnd32.exe
        243⤵
        Modifies registry class
        
        PID:8772
        
        C:\Windows\SysWOW64\Amaqjp32.exe
        
        C:\Windows\system32\Amaqjp32.exe
        244⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Aopmfk32.exe
        
        C:\Windows\system32\Aopmfk32.exe
        245⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Afjeceml.exe
        
        C:\Windows\system32\Afjeceml.exe
        246⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Ajeadd32.exe
        
        C:\Windows\system32\Ajeadd32.exe
        247⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Aqoiqn32.exe
        
        C:\Windows\system32\Aqoiqn32.exe
        248⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Agiamhdo.exe
        
        C:\Windows\system32\Agiamhdo.exe
        249⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Ajhniccb.exe
        
        C:\Windows\system32\Ajhniccb.exe
        250⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Acpbbi32.exe
        
        C:\Windows\system32\Acpbbi32.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9188
        
        C:\Windows\SysWOW64\Afnnnd32.exe
        
        C:\Windows\system32\Afnnnd32.exe
        252⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Aimkjp32.exe
        
        C:\Windows\system32\Aimkjp32.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8292
        
        C:\Windows\SysWOW64\Bcbohigp.exe
        
        C:\Windows\system32\Bcbohigp.exe
        254⤵
        Drops file in System32 directory
        
        PID:8320
        
        C:\Windows\SysWOW64\Biadeoce.exe
        
        C:\Windows\system32\Biadeoce.exe
        255⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Bmomlnjk.exe
        
        C:\Windows\system32\Bmomlnjk.exe
        256⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Bgeaifia.exe
        
        C:\Windows\system32\Bgeaifia.exe
        257⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Bmbiamhi.exe
        
        C:\Windows\system32\Bmbiamhi.exe
        258⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Cpbbch32.exe
        
        C:\Windows\system32\Cpbbch32.exe
        259⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Cflkpblf.exe
        
        C:\Windows\system32\Cflkpblf.exe
        260⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Cjhfpa32.exe
        
        C:\Windows\system32\Cjhfpa32.exe
        261⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8808
        
        C:\Windows\SysWOW64\Cmfclm32.exe
        
        C:\Windows\system32\Cmfclm32.exe
        262⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Cabomkll.exe
        
        C:\Windows\system32\Cabomkll.exe
        263⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Cglgjeci.exe
        
        C:\Windows\system32\Cglgjeci.exe
        264⤵
        Drops file in System32 directory
        
        PID:9056
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        265⤵
        Modifies registry class
        
        PID:9120
        
        C:\Windows\SysWOW64\Ccchof32.exe
        
        C:\Windows\system32\Ccchof32.exe
        266⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Cgndoeag.exe
        
        C:\Windows\system32\Cgndoeag.exe
        267⤵
        Modifies registry class
        
        PID:8240
        
        C:\Windows\SysWOW64\Caghhk32.exe
        
        C:\Windows\system32\Caghhk32.exe
        268⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Cceddf32.exe
        
        C:\Windows\system32\Cceddf32.exe
        269⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Cmniml32.exe
        
        C:\Windows\system32\Cmniml32.exe
        270⤵
        Modifies registry class
        
        PID:8592
        
        C:\Windows\SysWOW64\Cgcmjd32.exe
        
        C:\Windows\system32\Cgcmjd32.exe
        271⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Dmpfbk32.exe
        
        C:\Windows\system32\Dmpfbk32.exe
        272⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Dpnbog32.exe
        
        C:\Windows\system32\Dpnbog32.exe
        273⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Djdflp32.exe
        
        C:\Windows\system32\Djdflp32.exe
        274⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Dmbbhkjf.exe
        
        C:\Windows\system32\Dmbbhkjf.exe
        275⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\Dapkni32.exe
        
        C:\Windows\system32\Dapkni32.exe
        276⤵
        Drops file in System32 directory
        
        PID:8176
        
        C:\Windows\SysWOW64\Djhpgofm.exe
        
        C:\Windows\system32\Djhpgofm.exe
        277⤵
        Modifies registry class
        
        PID:8308
        
        C:\Windows\SysWOW64\Dpehof32.exe
        
        C:\Windows\system32\Dpehof32.exe
        278⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Eaindh32.exe
        
        C:\Windows\system32\Eaindh32.exe
        279⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        280⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Eigonjcj.exe
        
        C:\Windows\system32\Eigonjcj.exe
        281⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Eangpgcl.exe
        
        C:\Windows\system32\Eangpgcl.exe
        282⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Efkphnbd.exe
        
        C:\Windows\system32\Efkphnbd.exe
        283⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Eiildjag.exe
        
        C:\Windows\system32\Eiildjag.exe
        284⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Eaqdegaj.exe
        
        C:\Windows\system32\Eaqdegaj.exe
        285⤵
        Drops file in System32 directory
        
        PID:8708
        
        C:\Windows\SysWOW64\Ehjlaaig.exe
        
        C:\Windows\system32\Ehjlaaig.exe
        286⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Fkihnmhj.exe
        
        C:\Windows\system32\Fkihnmhj.exe
        287⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\Facqkg32.exe
        
        C:\Windows\system32\Facqkg32.exe
        288⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Fdamgb32.exe
        
        C:\Windows\system32\Fdamgb32.exe
        289⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Fhmigagd.exe
        
        C:\Windows\system32\Fhmigagd.exe
        290⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Fkkeclfh.exe
        
        C:\Windows\system32\Fkkeclfh.exe
        291⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Fmjaphek.exe
        
        C:\Windows\system32\Fmjaphek.exe
        292⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Fphnlcdo.exe
        
        C:\Windows\system32\Fphnlcdo.exe
        293⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Fgbfhmll.exe
        
        C:\Windows\system32\Fgbfhmll.exe
        294⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Fknbil32.exe
        
        C:\Windows\system32\Fknbil32.exe
        295⤵
        Drops file in System32 directory
        
        PID:9312
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        296⤵
        Drops file in System32 directory
        
        PID:9364
        
        C:\Windows\SysWOW64\Fpjjac32.exe
        
        C:\Windows\system32\Fpjjac32.exe
        297⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Fhdohp32.exe
        
        C:\Windows\system32\Fhdohp32.exe
        298⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        299⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Gpaqbbld.exe
        
        C:\Windows\system32\Gpaqbbld.exe
        300⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Ghhhcomg.exe
        
        C:\Windows\system32\Ghhhcomg.exe
        301⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Ggkiol32.exe
        
        C:\Windows\system32\Ggkiol32.exe
        302⤵
        Modifies registry class
        
        PID:9616
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        303⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Gpcmga32.exe
        
        C:\Windows\system32\Gpcmga32.exe
        304⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Ggnedlao.exe
        
        C:\Windows\system32\Ggnedlao.exe
        305⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Gacjadad.exe
        
        C:\Windows\system32\Gacjadad.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9796
        
        C:\Windows\SysWOW64\Gdafnpqh.exe
        
        C:\Windows\system32\Gdafnpqh.exe
        307⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Ghmbno32.exe
        
        C:\Windows\system32\Ghmbno32.exe
        308⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Gklnjj32.exe
        
        C:\Windows\system32\Gklnjj32.exe
        309⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Gnjjfegi.exe
        
        C:\Windows\system32\Gnjjfegi.exe
        310⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Gphgbafl.exe
        
        C:\Windows\system32\Gphgbafl.exe
        311⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Gknkpjfb.exe
        
        C:\Windows\system32\Gknkpjfb.exe
        312⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Giqkkf32.exe
        
        C:\Windows\system32\Giqkkf32.exe
        313⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Gahcmd32.exe
        
        C:\Windows\system32\Gahcmd32.exe
        314⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Hgelek32.exe
        
        C:\Windows\system32\Hgelek32.exe
        315⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Hdkidohn.exe
        
        C:\Windows\system32\Hdkidohn.exe
        316⤵
        Drops file in System32 directory
        
        PID:5556
        
        C:\Windows\SysWOW64\Hhfedm32.exe
        
        C:\Windows\system32\Hhfedm32.exe
        317⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Hpbiip32.exe
        
        C:\Windows\system32\Hpbiip32.exe
        318⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Hjjnae32.exe
        
        C:\Windows\system32\Hjjnae32.exe
        319⤵
        Drops file in System32 directory
        
        PID:9436
        
        C:\Windows\SysWOW64\Hdpbon32.exe
        
        C:\Windows\system32\Hdpbon32.exe
        320⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Hgnoki32.exe
        
        C:\Windows\system32\Hgnoki32.exe
        321⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Hkjjlhle.exe
        
        C:\Windows\system32\Hkjjlhle.exe
        322⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Ihnkel32.exe
        
        C:\Windows\system32\Ihnkel32.exe
        323⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Injcmc32.exe
        
        C:\Windows\system32\Injcmc32.exe
        324⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Ihphkl32.exe
        
        C:\Windows\system32\Ihphkl32.exe
        325⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        326⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Ijcahd32.exe
        
        C:\Windows\system32\Ijcahd32.exe
        327⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Ihdafkdg.exe
        
        C:\Windows\system32\Ihdafkdg.exe
        328⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Ikcmbfcj.exe
        
        C:\Windows\system32\Ikcmbfcj.exe
        329⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        330⤵
        Modifies registry class
        
        PID:10200
        
        C:\Windows\SysWOW64\Jjmcnbdm.exe
        
        C:\Windows\system32\Jjmcnbdm.exe
        331⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Jnkldqkc.exe
        
        C:\Windows\system32\Jnkldqkc.exe
        332⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Jhpqaiji.exe
        
        C:\Windows\system32\Jhpqaiji.exe
        333⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        334⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        335⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        336⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        337⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        338⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Kjhcjq32.exe
        
        C:\Windows\system32\Kjhcjq32.exe
        339⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Kbpkkn32.exe
        
        C:\Windows\system32\Kbpkkn32.exe
        340⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Kenggi32.exe
        
        C:\Windows\system32\Kenggi32.exe
        341⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Kkhpdcab.exe
        
        C:\Windows\system32\Kkhpdcab.exe
        342⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Kgopidgf.exe
        
        C:\Windows\system32\Kgopidgf.exe
        343⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Kkjlic32.exe
        
        C:\Windows\system32\Kkjlic32.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9860
        
        C:\Windows\SysWOW64\Kniieo32.exe
        
        C:\Windows\system32\Kniieo32.exe
        345⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        346⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\Kinmcg32.exe
        
        C:\Windows\system32\Kinmcg32.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9340
        
        C:\Windows\SysWOW64\Lgffic32.exe
        
        C:\Windows\system32\Lgffic32.exe
        348⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        349⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        350⤵
        Modifies registry class
        
        PID:10048
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        351⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        352⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        353⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Maeachag.exe
        
        C:\Windows\system32\Maeachag.exe
        354⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Mhoipb32.exe
        
        C:\Windows\system32\Mhoipb32.exe
        355⤵
        Modifies registry class
        
        PID:9916
        
        C:\Windows\SysWOW64\Micoed32.exe
        
        C:\Windows\system32\Micoed32.exe
        356⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Mlbkap32.exe
        
        C:\Windows\system32\Mlbkap32.exe
        357⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Mhilfa32.exe
        
        C:\Windows\system32\Mhilfa32.exe
        358⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        359⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Neoieenp.exe
        
        C:\Windows\system32\Neoieenp.exe
        360⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        361⤵
        Modifies registry class
        
        PID:10424
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        362⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Nhpbfpka.exe
        
        C:\Windows\system32\Nhpbfpka.exe
        363⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        364⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\Objpoh32.exe
        
        C:\Windows\system32\Objpoh32.exe
        365⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10608
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        366⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        367⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Oadfkdgd.exe
        
        C:\Windows\system32\Oadfkdgd.exe
        368⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        369⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        370⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        371⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Pojcjh32.exe
        
        C:\Windows\system32\Pojcjh32.exe
        372⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Pkcadhgm.exe
        
        C:\Windows\system32\Pkcadhgm.exe
        373⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        374⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Pkhjph32.exe
        
        C:\Windows\system32\Pkhjph32.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11048
        
        C:\Windows\SysWOW64\Pcobaedj.exe
        
        C:\Windows\system32\Pcobaedj.exe
        376⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Piijno32.exe
        
        C:\Windows\system32\Piijno32.exe
        377⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Qlggjk32.exe
        
        C:\Windows\system32\Qlggjk32.exe
        378⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Qadoba32.exe
        
        C:\Windows\system32\Qadoba32.exe
        379⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\Ahqddk32.exe
        
        C:\Windows\system32\Ahqddk32.exe
        380⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Akoqpg32.exe
        
        C:\Windows\system32\Akoqpg32.exe
        381⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Acfhad32.exe
        
        C:\Windows\system32\Acfhad32.exe
        382⤵
        Modifies registry class
        
        PID:10376
        
        C:\Windows\SysWOW64\Aomifecf.exe
        
        C:\Windows\system32\Aomifecf.exe
        383⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Ajbmdn32.exe
        
        C:\Windows\system32\Ajbmdn32.exe
        384⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        385⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        386⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Bhcjqinf.exe
        
        C:\Windows\system32\Bhcjqinf.exe
        387⤵
        Drops file in System32 directory
        
        PID:10724
        
        C:\Windows\SysWOW64\Bbnkonbd.exe
        
        C:\Windows\system32\Bbnkonbd.exe
        388⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        389⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        390⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        391⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        392⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Cfnqklgh.exe
        
        C:\Windows\system32\Cfnqklgh.exe
        393⤵
        Modifies registry class
        
        PID:11168
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        394⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        395⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Dmalne32.exe
        
        C:\Windows\system32\Dmalne32.exe
        396⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        397⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        398⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        399⤵
        Drops file in System32 directory
        
        PID:10772
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        400⤵
        Drops file in System32 directory
        
        PID:10868
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        401⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11012
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        402⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        403⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        404⤵
        Modifies registry class
        
        PID:10328
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        405⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        406⤵
        Drops file in System32 directory
        
        PID:10792
        
        C:\Windows\SysWOW64\Eplgeokq.exe
        
        C:\Windows\system32\Eplgeokq.exe
        407⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11000
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        408⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        409⤵
        Drops file in System32 directory
        
        PID:10448
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        410⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Ejchhgid.exe
        
        C:\Windows\system32\Ejchhgid.exe
        411⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        412⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        413⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        414⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Fpbmfn32.exe
        
        C:\Windows\system32\Fpbmfn32.exe
        415⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        416⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        417⤵
        
        PID:912
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        418⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Fdccbl32.exe
        
        C:\Windows\system32\Fdccbl32.exe
        419⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        420⤵
        
        PID:11400
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        421⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\Fjadje32.exe
        
        C:\Windows\system32\Fjadje32.exe
        422⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        423⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        424⤵
        
        PID:11584
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        425⤵
        
        PID:11632
        
        C:\Windows\SysWOW64\Gdobnj32.exe
        
        C:\Windows\system32\Gdobnj32.exe
        426⤵
        Modifies registry class
        
        PID:11684
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        427⤵
        Modifies registry class
        
        PID:11728
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        428⤵
        
        PID:11768
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        429⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        430⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        431⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11900
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        432⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11944
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        433⤵
        
        PID:11988
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        434⤵
        Modifies registry class
        
        PID:12040
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        435⤵
        
        PID:12080
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12128
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        437⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        438⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        439⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12256
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        440⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        441⤵
        
        PID:11344
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        442⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        443⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        444⤵
        Modifies registry class
        
        PID:11524
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        445⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        446⤵
        
        PID:11644
        
        C:\Windows\SysWOW64\Hmechmip.exe
        
        C:\Windows\system32\Hmechmip.exe
        447⤵
        Drops file in System32 directory
        
        PID:11724
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        448⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        449⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        450⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        451⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        452⤵
        Drops file in System32 directory
        
        PID:12028
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        453⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        454⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        455⤵
        
        PID:12196
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        456⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        457⤵
        
        PID:11316
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        458⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        459⤵
        
        PID:11488
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        460⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        461⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        462⤵
        
        PID:11720
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        463⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        464⤵
        
        PID:11876
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        465⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        466⤵
        Modifies registry class
        
        PID:3664
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        467⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        468⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        469⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        470⤵
        
        PID:12192
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        471⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        472⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        473⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        474⤵
        
        PID:11620
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        475⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        476⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        477⤵
        
        PID:684
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        478⤵
        
        PID:12008
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        479⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        480⤵
        
        PID:12224
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        481⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        482⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        483⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        484⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        485⤵
        
        PID:11820
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        486⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        487⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        488⤵
        
        PID:12116
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        489⤵
        Drops file in System32 directory
        
        PID:11392
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        490⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        491⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        492⤵
        
        PID:11840
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        493⤵
        
        PID:4156
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        494⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4664
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        495⤵
        
        PID:12204
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        496⤵
        
        PID:12280
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        497⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        498⤵
        Drops file in System32 directory
        
        PID:1852
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        499⤵
        Modifies registry class
        
        PID:1632
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        500⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        501⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        502⤵
        Drops file in System32 directory
        
        PID:2448
        
        C:\Windows\SysWOW64\Megljppl.exe
        
        C:\Windows\system32\Megljppl.exe
        503⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        504⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        505⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        506⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        507⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        508⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        509⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        510⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        511⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2308
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        512⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        513⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:752
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        514⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1848
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        515⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        516⤵
        Modifies registry class
        
        PID:2908
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        517⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        518⤵
        
        PID:916
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        519⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        520⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        521⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        522⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        523⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        524⤵
        
        PID:2224
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        525⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        526⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:760
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        527⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        528⤵
        Drops file in System32 directory
        
        PID:5340
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        529⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1184
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        530⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        531⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        532⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        533⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        534⤵
        Modifies registry class
        
        PID:11580
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        535⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        536⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        537⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        538⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        539⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        540⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5360
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        541⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        542⤵
        Drops file in System32 directory
        
        PID:5856
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        543⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        544⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        545⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        546⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        547⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        548⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        549⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        550⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        551⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        552⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        553⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        554⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5928
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        555⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        556⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        557⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        558⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        559⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        560⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5432
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        561⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        562⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        563⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5528
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        564⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        565⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        566⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        567⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        568⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        569⤵
        Modifies registry class
        
        PID:5732
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        570⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        571⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        572⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        573⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        574⤵
        Modifies registry class
        
        PID:3936
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        575⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        576⤵
        
        PID:3232
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        577⤵
        Drops file in System32 directory
        
        PID:6684
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        578⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        579⤵
        Drops file in System32 directory
        
        PID:3932
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        580⤵
        Modifies registry class
        
        PID:11244
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        581⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        582⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        583⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        584⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        585⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        586⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        587⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        588⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        589⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        590⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        591⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        592⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        593⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        594⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        595⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5160
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        596⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6668
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        597⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        598⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        599⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        600⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6000
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        601⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        602⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        603⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        604⤵
        Modifies registry class
        
        PID:7052
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        605⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        606⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        607⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        608⤵
        Modifies registry class
        
        PID:6848
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        609⤵
        Modifies registry class
        
        PID:6944
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        610⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        611⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        612⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        613⤵
        Modifies registry class
        
        PID:7128
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        614⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        615⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        616⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        617⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        618⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        619⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        620⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7992
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        621⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7124
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        622⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        623⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7672
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        624⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        625⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        626⤵
        
        PID:952
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        627⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        628⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        629⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        630⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        631⤵
        Drops file in System32 directory
        
        PID:7336
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        632⤵
        
        PID:548
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        633⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        634⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        635⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        636⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        637⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        638⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        639⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        640⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        641⤵
        Drops file in System32 directory
        
        PID:6708
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        642⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        643⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        644⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        645⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        646⤵
        Modifies registry class
        
        PID:6784
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        647⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        648⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        649⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        650⤵
        Modifies registry class
        
        PID:7532
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        651⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        652⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        653⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        654⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        655⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        656⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        657⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        658⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        659⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        660⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        661⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        662⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        663⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        664⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        665⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        666⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        667⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        668⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        669⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        670⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        671⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7104
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        672⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        673⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        674⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        675⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        676⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        677⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        678⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        679⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        680⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        681⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        682⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        683⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7316
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        684⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        685⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        686⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        687⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        688⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        689⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7764
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        690⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        691⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        692⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        693⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        694⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        695⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        696⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        697⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        698⤵
        Modifies registry class
        
        PID:3684
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        699⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        700⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        701⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        702⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        703⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        704⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        705⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        706⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        707⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        708⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        709⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        710⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4196
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        711⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8300
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        712⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        713⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8516
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        714⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        715⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        716⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        717⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        718⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8872
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        719⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        720⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        721⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        722⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        723⤵
        Drops file in System32 directory
        
        PID:1204
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        724⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        725⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        726⤵
        Modifies registry class
        
        PID:232
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        727⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        728⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        729⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8348
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        730⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        731⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        732⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        733⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        734⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        735⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        736⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        737⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        738⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        739⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        740⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        741⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        742⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        743⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        744⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        745⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        746⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Ebfign32.exe
        
        C:\Windows\system32\Ebfign32.exe
        747⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        748⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        749⤵
        Modifies registry class
        
        PID:8624
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        750⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        751⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        752⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        753⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        754⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        755⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        756⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        757⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        758⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        759⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        760⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9100
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        761⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8920
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        762⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        763⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        764⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        765⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        766⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        767⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        768⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        769⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        770⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        771⤵
        Modifies registry class
        
        PID:9680
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        772⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        773⤵
        Drops file in System32 directory
        
        PID:9812
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        774⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        775⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        776⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        777⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        778⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        779⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9584
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        780⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        781⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        782⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        783⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Ipbaol32.exe
        
        C:\Windows\system32\Ipbaol32.exe
        784⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        785⤵
        Modifies registry class
        
        PID:10064
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        786⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        787⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        788⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        789⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        790⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9892
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        791⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        792⤵
        Drops file in System32 directory
        
        PID:8588
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        793⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        794⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        795⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        796⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        797⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        798⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        799⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9656
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        800⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9740
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        801⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        802⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        803⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        804⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        805⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        806⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        807⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        808⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        809⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        810⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        811⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        812⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        813⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        814⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        815⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        816⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        817⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Kifojnol.exe
        
        C:\Windows\system32\Kifojnol.exe
        818⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        819⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        820⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        821⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        822⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        823⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        824⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        825⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9456
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        826⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        827⤵
        Modifies registry class
        
        PID:10068
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        828⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        829⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9608
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        830⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        831⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        832⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9260
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        833⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        834⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        835⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        836⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        837⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        838⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        839⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        840⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        841⤵
        Drops file in System32 directory
        
        PID:10248
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        842⤵
        
        PID:12304
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        843⤵
        
        PID:12348
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        844⤵
        
        PID:12392
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        845⤵
        Drops file in System32 directory
        
        PID:12432
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        846⤵
        
        PID:12480
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        847⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12516
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        848⤵
        
        PID:12568
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        849⤵
        
        PID:12616
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        850⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12652
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        851⤵
        
        PID:12704
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        852⤵
        
        PID:12748
        
        C:\Windows\SysWOW64\Noppeaed.exe
        
        C:\Windows\system32\Noppeaed.exe
        853⤵
        
        PID:12788
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        854⤵
        Modifies registry class
        
        PID:12836
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        855⤵
        
        PID:12880
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        856⤵
        
        PID:12928
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        857⤵
        Modifies registry class
        
        PID:12972
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        858⤵
        
        PID:13024
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        859⤵
        
        PID:13064
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        860⤵
        
        PID:13116
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        861⤵
        
        PID:13152
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        862⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13200
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        863⤵
        
        PID:13236
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        864⤵
        Drops file in System32 directory
        
        PID:13292
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        865⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        866⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12340
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        867⤵
        
        PID:12408
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        868⤵
        
        PID:12524
        
        C:\Windows\SysWOW64\Ocihgnam.exe
        
        C:\Windows\system32\Ocihgnam.exe
        869⤵
        
        PID:12576
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        870⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        871⤵
        
        PID:12700
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        872⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12744
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        873⤵
        
        PID:12808
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        874⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        875⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9548
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        876⤵
        
        PID:12956
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        877⤵
        
        PID:13020
        
        C:\Windows\SysWOW64\Ojhiogdd.exe
        
        C:\Windows\system32\Ojhiogdd.exe
        878⤵
        Drops file in System32 directory
        
        PID:13100
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        879⤵
        
        PID:13188
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        880⤵
        Drops file in System32 directory
        
        PID:13228
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        881⤵
        
        PID:13288
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        882⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10124
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        883⤵
        
        PID:12368
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        884⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        885⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        886⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        887⤵
        
        PID:12668
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        888⤵
        
        PID:12772
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        889⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        890⤵
        
        PID:12864
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        891⤵
        Drops file in System32 directory
        
        PID:12964
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        892⤵
        
        PID:13056
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        893⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10568 -s 408
        894⤵
        Program crash
        
        PID:10344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4500 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:8
1⤵
PID:9148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 10568 -ip 10568
1⤵
PID:13212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Accfbokl.exe

Filesize
64KB

MD5
78543d59daa106e840a7f9d74bd20f11

SHA1
a52b66e17efad01dace0a96997b61df0409fdd00

SHA256
74c6de10cc996224f02fcf20d2563e79542ed28b30c6e8bc8f5cfdb398498eb0

SHA512
15d607e6f530d20b497138532af0a40a54407b3e3a1c200b23720a9727686697792a627b8727a773500599fdacc05981ba6c7fc364e4ca17dcc641f830263e12

Download Submit
C:\Windows\SysWOW64\Agbkmijg.exe

Filesize
64KB

MD5
a44347fdd7c92debf1e42501231ffe9b

SHA1
080d0ee9844feaf374dd06155880ea4f66ae2d6c

SHA256
1893422db1f0157d6ec5491531caa999465355d40294db7a113ca8ff89d8639b

SHA512
d0396773ab61d0d13d67527421f61e4ea84c3d2f7bd66e670c0252d7ae00374285ddad674d38ac11782a2a0c5212540c7ca89900d48e70c3ba667730eb90167c

Download Submit
C:\Windows\SysWOW64\Akcjkfij.exe

Filesize
64KB

MD5
e0d93dc7c4401c5bee48fde3c08642a1

SHA1
39798155afe50a1b893c0d109f8e7f8136461665

SHA256
a231bdacaebe112999454802a755f0fdadc9a8a1a95495c1747983a5a2cac46c

SHA512
4f489bad5692738f314432c26f9af349a845dce9e1aceaadc2f1a763c20d220810361875fadf0a56f7eec34ee979e0a8c1350f33dc258b4b607d04bc1e1f8643

Download Submit
C:\Windows\SysWOW64\Bebblb32.exe

Filesize
64KB

MD5
958fefd5aba272b027612af1a40c49bb

SHA1
b8b7d1cd5e657b47ebe1cad33d119060d38acd6b

SHA256
3cb081e239ab89ea8bdee5860daa7866edd4312f84b1858af6e42193fe5a0541

SHA512
d5aeba94b573a3c304066f53e539d868b7f586d3114b90dad460f3886e70a2fd9aaa78b14636481893043cc5328caf08856aff090cb2d9a6850f50dc9e1a5a8a

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
64KB

MD5
2e417d7facab81a983f117d95ae29943

SHA1
47211182262f7e8022aa55767fa95cd9fe3f4c76

SHA256
3a73a3e7bd493d0edc01239d83bc8f6784f8e87299cd302819b5dea89742757a

SHA512
da2665ed4458644ea36d7ba1688adef01587cf76bca4071163bb1340b93a5add3111c59d773be4e42aa7ca7a1fd288ffd874f3f6808bc99783d7227a9df90bb9

Download Submit
C:\Windows\SysWOW64\Bhcjqinf.exe

Filesize
64KB

MD5
ff7b08435dd3065b633046e1276920bc

SHA1
bbce3f5527fabf9ca815efe8bc24da619cf63c4e

SHA256
18d856b21bcd395319bc9b9cf32b8e59704e139c860b031750302c6ba0abc28f

SHA512
f2cb13dc99d1c4042cc3b4595d7b85e9c8cbec6eac19319727968e7bb448342d089cc3dd9912e18371c24fedebb03c48de0c6b4cde52f2f601e6efedfc31221e

Download Submit
C:\Windows\SysWOW64\Biadeoce.exe

Filesize
64KB

MD5
7591bf1cf9e259695b69a4833b6a1d2c

SHA1
a95d1a0b47a1624ee79fd46dac07316e4c8cdd5b

SHA256
d69f939d861dfb931ac805f5129504913fe7ce923a1d422e30afad7181184d02

SHA512
896ce6320506d9aa2240290e91d74bcff016b759b9d97527b33141ad2ffc41c44c821d1f112d6c36d3cf0117bfcc24a07cf2276471f07ed21bf569261747b6c4

Download Submit
C:\Windows\SysWOW64\Ccbadp32.exe

Filesize
64KB

MD5
ac1c632551e650a46570ebdc84df290e

SHA1
2f91d0634d59730d9387b2bd4c41c188bba8788c

SHA256
b0813931472a269770b12921e95d9af723416f1ec1564c364ad3d7df85535618

SHA512
76ecfd74edcfd46b3ccf6fa8866e6f844fca3cb3a294c46013e70640c665cae33422df7d7ece84991049fb4044382641053949782e4fe9c749bf683fe56af9d5

Download Submit
C:\Windows\SysWOW64\Ceehho32.exe

Filesize
64KB

MD5
c3fa060c4e8fc12d053889590c6ebc78

SHA1
b3de7cacbd611da4d6cc44c9366078e278f48773

SHA256
69ba994e64da2f100be3651fb284998596acf23494d2f6bebe018a2ce8f85adf

SHA512
ecce34737a4507ae1bb263d44ed66d724e1c9e79721d1a46aacf8fb05b5f51f8e5640b5b45c77ed98f98b118b8ab993c479d07855139a5bcc564efc1c5f6e1c5

Download Submit
C:\Windows\SysWOW64\Cgndoeag.exe

Filesize
64KB

MD5
55f487ab9a4b5e4c4f079e7860174bca

SHA1
850f5d0d16c8d4b3acc3f3a864aeb12bb568af52

SHA256
feec6a14a441850e7bdfb89519e130e819f01c39fa4d8686f6f8d72cdf925683

SHA512
1e91359a6111f496775f2b7ecf9d077d8aa05652844abebc5335dac1a2e626dff795de9af9bef1f0b9d4e15b75318fc7943d515316729f833846134eaa99ece0

Download Submit
C:\Windows\SysWOW64\Djhpgofm.exe

Filesize
64KB

MD5
c84fc06e80e3fa6a7a0f645b2493072c

SHA1
046d78bfbbfc125cb013e3fdebc38c0815ea4379

SHA256
42a510cd7e4b750c4dab236f545c53655bb43b7072ae0e6ae8c06893642d9a73

SHA512
f80dd8082bb5853f694d96cef5f2939a73dd204fac1f2b69e642ed51dce6a47485c53071c820a5dd584ee7df0ba3c9f3c56d62e8696883025186603937a4c888

Download Submit
C:\Windows\SysWOW64\Dmfeidbe.exe

Filesize
64KB

MD5
ac3fe3902a04ac6d2ed2004adf8e17fe

SHA1
dc5bf892590f4b7c0fdc059a5104864366938586

SHA256
4deaaf3cba3a9d4866e30601fca2ba79f22d91b565c39bc44ef2ff57d915f192

SHA512
f54c2a7a2583dd115972d8ac9ad9f76c9f58db919725484ca59fa51a3db945c20a1127ea837e4fb4d4b575eb2de3202a9997f7022f8b0ba9b229a2876753ebae

Download Submit
C:\Windows\SysWOW64\Ejchhgid.exe

Filesize
64KB

MD5
a4f5885fcf7461d4c6a070dc4a32fa2b

SHA1
081fd999190d5f16421102c19f7ad4cf0d544697

SHA256
9bf8f01c47abc4a42e5e1b2167ad3ca812b095195a3c3757dc5bb4880c8386c8

SHA512
f9faa3afc23c4ad2105983ecfa115e41f366566fe07aa64a6018a11e3243818088bf60260030d56859b57013da7eb58ea18cc87716ad6e0df0683adbfb10da22

Download Submit
C:\Windows\SysWOW64\Eopbnbhd.exe

Filesize
64KB

MD5
87f17ba800a3631049c843d9f7b9367c

SHA1
7159c29f07887298e0adbc2f525f2f0afab7257c

SHA256
a314c3f5edfc79d31b7d45c06d830ec5e6a04d319711ed4eb839d8daf60fe13d

SHA512
92d1d82fba5e65be6989c5272a04e1a3bb6ffd7ee814eb2de00b6572421ab246de2387eeef0e4635be263a0d0fb78831bea8c72343f3e3774c5f830a104efa05

Download Submit
C:\Windows\SysWOW64\Fgbmccpg.exe

Filesize
64KB

MD5
dd861ce32cd5cd743256c4efaaeed4d6

SHA1
f69a5f7915518e23162491e1e8983d2f4635e4db

SHA256
852159999ee0ada71fd27204ba96b55e6ae302e0732e0a1208a87811dc32a174

SHA512
19bcbf48eaa4068eb16c7620b3ee98f22ea2de0cbb7661cf9db7f820d9e40bfa3166302d22b78929c53a5e7999fc3a97e0d9354bd0cbeacce72802a157039476

Download Submit
C:\Windows\SysWOW64\Fhjfhl32.exe

Filesize
64KB

MD5
963c4763b140d89605f0e06cc22dc13b

SHA1
9030ea6d6ac3ba070cd9febd60c19794dc5f1b35

SHA256
9d75639aa63b400ac6d24040396ed1ec6ac21cbbac1dc044e934f8f178637869

SHA512
3f9303af1d2889cecf277dbfc9ebf15ae00db02edd4294dbbcc890b9b1fddd48deb95a0c5303a7dd56dc614be95184e9317303a9871e4d99378dcd9f749efe9a

Download Submit
C:\Windows\SysWOW64\Flngfn32.exe

Filesize
64KB

MD5
e1ada5ee223a0bdf2b47ebde2a4866f9

SHA1
7cd522b0f1e234c5a9a5c1880360bb2fce024010

SHA256
87fa1c3ab4d4f42025343741a11a456bc58d934c7adc1c87e87189da3554935c

SHA512
c2635229a6d065b8e9bfc63e7fee437285ea6a7ba087c72e5655bcc9c9d6df6241f87eb55e0126ab45906c4702174792caf23b901a3c7002bff6ec2f2cbd199f

Download Submit
C:\Windows\SysWOW64\Fpbmfn32.exe

Filesize
64KB

MD5
4e55cfcf36e30782d70e10d288c09454

SHA1
6cb1cdad0105b925ce553f960fb62025b0d8c232

SHA256
71ce87661dce051375edfc548efb833296472f2ed8d5df7036787cfa3f5c2fa3

SHA512
16941f705714f22dd247317f475baaf7303550a8819fba429a7ae657f4bf880a64eda8c174198921e4349012c82697e3924883946a27c094e6daaf4befcf484a

Download Submit
C:\Windows\SysWOW64\Fpjjac32.exe

Filesize
64KB

MD5
9f5a0f2bfb063d51f1c5641b31ae16e4

SHA1
369635a97fd9b84ca4cc45f028313a5bdbd47a20

SHA256
984448695262e92911025176a2bf07cbcfaee3334a2edc24ecc25faf29d34095

SHA512
2b5880699f72ad92b79b0e819001583ddd7bd6339fbac9375e21fc0ec373d1ff6f94553e407054f056e7ac15c0416382ee28d7293760763dd7ca150e1f08417d

Download Submit
C:\Windows\SysWOW64\Gcddpdpo.exe

Filesize
64KB

MD5
e16ad0916d15b6dab90b3ba2754b1560

SHA1
1c03718cf3367fb9ee3eb6fad73242efe5039f0f

SHA256
a46b8285423532a67407535380dfa6d780d07da5bb92517d3fbb51c65ed6b5db

SHA512
9b1f07a9d00689e10dd36a7248bd70d5b883b24fa910eb9bf675e1cea5cab3eb57053c8f71660034d2490437bbd502c3c83fbefa96ee53e9ceb9728a9fed73cc

Download Submit
C:\Windows\SysWOW64\Gcfqfc32.exe

Filesize
64KB

MD5
1aa804f719a15b4d07e9767e64939ab2

SHA1
e859292329b63b5127d177db973c5d1cb3ff864b

SHA256
c9e09737c627143466eae11dcb33f242a08c13d3df15c531c335424f09568707

SHA512
65cba2f13ce2ca495fd16c94960aba3a2c9d5d2ee0932df6544528a3e88319d6c021e40711dabc4ed607425105b74677e0d41bb6cf04874c1373ee3f09e694cb

Download Submit
C:\Windows\SysWOW64\Gcimkc32.exe

Filesize
64KB

MD5
f98f1487f8b05191a0965fdd02bd70ba

SHA1
e1471a0da1855ce05537321c249bd43616632e16

SHA256
26762060890369d3256944685f02fade532a28f20f90da32644ffdcd17e7377f

SHA512
b8265024d168c8005245a20cfab8b10debe8e7db1485d77d838d55fffbc2b1080da89e75a14a00ffad1fc53524822a071ce146c79ee26f227765db7bec92b8ba

Download Submit
C:\Windows\SysWOW64\Gcojed32.exe

Filesize
64KB

MD5
700323e325602ee6ecdc184e2968ea7b

SHA1
6c6f1438037a6ad3c43727c46ab610dfc0322f0a

SHA256
6ad95b8fb8cc5cbd59ac7640121abc490cec0681abf1d29ae4a4d40b1e61b7c5

SHA512
38e176d0d7b9eada9ca87d747925a87991e8150d51e0ee15fe4839550bb42411e73862f03812743df168a62d8909af83b02315508242a6422de23fbfd878e120

Download Submit
C:\Windows\SysWOW64\Gdqgmmjb.exe

Filesize
64KB

MD5
f6deb19f8a5c2367ae844bd53d186494

SHA1
c62848bd93e78ecf06df830f1e888fef44786280

SHA256
252805930c2df1594f59d6bffce3c7fb9080cfd0a67e49e5f1c9460f5c4c7506

SHA512
1bc84aa17a796155c51f8a6be6b4257fadd09e83527b757a592095cc8220094dd338e2b645cb959f34391c6add4c4d937250128658fd35d1bd99980fbc50d816

Download Submit
C:\Windows\SysWOW64\Ggnedlao.exe

Filesize
64KB

MD5
91104eb9ead1971de16f994a847321e3

SHA1
3c245b77a76d0c3e2789cbf7549e135362380547

SHA256
1eb9a68d8ab6535085dd36167d7e8d7504b94b7a50d8850b63287057966c6dbe

SHA512
a91ad17775e18010994bcdf26ca80bf2e142c38bd9948ae0aeb95d8f0ed3d4ec63a1ae66cc7df899a9a58519e664df4291376832586b7f9aade6231d525efbc7

Download Submit
C:\Windows\SysWOW64\Ghaliknf.exe

Filesize
64KB

MD5
e58494d4b6fffa50d051912dfd40c1c3

SHA1
4045a1be3e50e2922f9b024c6509906e36551871

SHA256
8b7234ecf523e0dfac4ba3a8a7f15a4d18b4a4db829bbc2ea504e8766b91bfe3

SHA512
9538dde775757db46cdbf513b634ffd400af57752704d7cf9bd0cd353198daf692065f0a4c33d7d2e870a9ae784c9f737f87e721e5db22a1ab15730ac5354eca

Download Submit
C:\Windows\SysWOW64\Gicinj32.exe

Filesize
64KB

MD5
6ce48c96e30e27882497e87fa9a2ecf1

SHA1
8993b9d645b461f2547b46df5a6f787639f7d4f6

SHA256
31fa615caedcb1ac5b0d94041ca90d471e5f61b1502ad0a10099e11c2bd35b5a

SHA512
bab7fac03c19411b645e591a36c417ff39862c3bc81742d611167667d91697d57bac567e7890b3841ec4c5a1a20b4e6b71e846166bec457a70e12a4b17c88be0

Download Submit
C:\Windows\SysWOW64\Gofkje32.exe

Filesize
64KB

MD5
a34ccab74b8da9c5af1414bb49ca23a7

SHA1
f777fe3404a637fdde333ea797e48707f6019f18

SHA256
6172c88e2e73f419f0697f43a19425ccfc131cbd6d6594426161e1357d9ead53

SHA512
f23904ae016913f4144a80a3a4d1c71da65dacf1b39fd7d1b3e824b5f0fe8792610a6309475c95ce7b76aa1720a1283d0ad2b48fb945baff253abbe9d3c4f4cf

Download Submit
C:\Windows\SysWOW64\Hcmgfbhd.exe

Filesize
64KB

MD5
25ab278cc1d65231af6ab906c3a4e15e

SHA1
48c48a33b2bd4e82f4ea7136940c69629408183e

SHA256
89ea416dec1f01ef75fa4d82c31826c2b2e77eb529f5e2ed97b2372aeacafd6b

SHA512
765c7a1a2825495e8e6c5616c2d042abceeb649f2597b0eb49cd2fb72b8f640b2cb0755232d6942679b78b73842130dba3320bf9e63e7b2ff92137f27a6c4760

Download Submit
C:\Windows\SysWOW64\Himldi32.exe

Filesize
64KB

MD5
2d51fe7b51480482c0658eaa62fdfdae

SHA1
d1855a1d6d8f47033098a7a1b9653176ccd00cb1

SHA256
a9893588825c5892d0da38d52671228c0316b875dac439166e9d3099300e35f7

SHA512
e0d707d5e057090cc93b096be65da7afee1993115b6a720cffdc4262dca00daa8094e90d8c24c17678552e38b6c3eb38eb92d24ccefb733b209a3451660094fe

Download Submit
C:\Windows\SysWOW64\Hmabdibj.exe

Filesize
64KB

MD5
12a662fe7606fdab4fe1d586ba573c02

SHA1
ff9a74fd3a3fe56f33276fb8e691bb6ca485ad10

SHA256
47c33d4eb47a19bb3b5783db9f5c00eedf0f836ecbf06e991d1b5b7b1c6667e9

SHA512
eef3bc21e936ae3d06043fd3f1ed9748a9fbbd0904ed731c0af9e15d6cea646947659e20d663aeb70c5ef46e94e0e39a2f001f9c9ef30ed2c45dec38965186d1

Download Submit
C:\Windows\SysWOW64\Hmcojh32.exe

Filesize
64KB

MD5
3c03cde228d19e7ef67ab8ae35d008f1

SHA1
eb5c65c2b5346fe773066f42f64e34dbb4070c7e

SHA256
47d9134e6bdb084f4e640e80daff995282bc20ea7b1cff0bf4148bc35816ab15

SHA512
8748d1fa88839147e73809c547dd3ecafeb3e620c28dc5b28864ee8b7d284cb3301f258ad3308070980db79240ee574c8fb231f97b67af5de02f0cab997be40c

Download Submit
C:\Windows\SysWOW64\Hmfkoh32.exe

Filesize
64KB

MD5
176c63eab187431ddd959a6dffe07d33

SHA1
ae1f210baf31ad36cbc2c680246a38cf7e47b48e

SHA256
371be9a461d07569566c87d3855ab8e1dbfcacc08b0077561efe74eed92146c4

SHA512
38f4690264eba8f49c6291287b68f0bea440fedd2d4cc6160c29410cf17a522e93925754e844c65e48453119730c81b7cd27d95059e541e949adefd3bfa4b1ef

Download Submit
C:\Windows\SysWOW64\Hofdacke.exe

Filesize
64KB

MD5
99bf617b2d6faa5cec9beb6a0211509e

SHA1
2f97794b58e11a6d548b048a77617608cb2c2b82

SHA256
f16b6b0a1957b8abd1776eb2de12a1c1620deadc743a966403fb3c79bd4523d4

SHA512
6d2c1f76db68fbeef35263477fa2ff4fa54f341a11abeded80f0434cd6a9000f4c9845daacc945fb5d2fd176950535cf6bfbe9a5951d29fbcc9e0e0837d4d7a7

Download Submit
C:\Windows\SysWOW64\Ibffhhek.exe

Filesize
64KB

MD5
d4fba6db1d4bd0ceef8c3d3bf5047fc8

SHA1
276027263086f54f07904fb0dbe800ec5b824e8f

SHA256
0e1b47389f5f24557ed0fee765c3a143db9c17fa32d6dc77a3932c232f4a2f13

SHA512
fff6f59798f3b4dd69c89eaf641e109ae7c1fb0b001605a3709a3e30cff718a19b52f6d4e30e2a825c2e6cda69c96d916f0dccfa287262282b7b983f27895f99

Download Submit
C:\Windows\SysWOW64\Ijcahd32.exe

Filesize
64KB

MD5
08b82d79d0427f4b4a65566e5b6a5523

SHA1
e5b69c95cea20f27f8534742648c196cfeb1d34f

SHA256
ad18a94e46aeebbf17dc035150373fbfd38109b855f3aa6ebcb92eb3f7c37a4d

SHA512
bb67cf9c43c99cb4208e12a8f545e7d9ca0eeff587e73ebf724e17c82faef33d09e3784fab6601f09716a383972b681ed0aa20189a71b6982da76729bbe50ea8

Download Submit
C:\Windows\SysWOW64\Ikokan32.exe

Filesize
64KB

MD5
d45db72b60a5f768462769e7e628c6c4

SHA1
d0716378b619c53b3fa26116c8af788ad2927156

SHA256
0a8f1b18c8cde0379197ed73bcdb2756e81af83ed43ecd86a07b101d0084029e

SHA512
72be8c30ff5bcb771255afca69cb2d49403ed9f186d06eaa1be89807e39238da34cd3df9e2fb2a85e9b1e72f6990ed19fd8ae432d484cd04e5f1a88167927e01

Download Submit
C:\Windows\SysWOW64\Injcmc32.exe

Filesize
64KB

MD5
ced413c06d549ce870ce8f52969fcee6

SHA1
5dd5fe321c23a0fd00b4bca2a35560fac0dc2916

SHA256
324d9a11279bcb3fa991b7c13b57c0ff88f15b1569a9e99222365a08eff131d9

SHA512
eff48ad6f42e0653273819be54fe1ebdd6394370d2370d0cd8a8cd8c9777b1befb53a0e75624768c93220a361dcf31b0e6323c4295c2c2b9d1d1ddefc19d3859

Download Submit
C:\Windows\SysWOW64\Jcllonma.exe

Filesize
64KB

MD5
595c2480501cce6f943d43d53a3e06fe

SHA1
27fbb1a9bbbeca18b7ebab4fc607032761c958bd

SHA256
fee207e577153f13f3a420d7f073b811a2a4c5685211d4f4f8d12a633f74c6e2

SHA512
2a6d6c4d07e105a782dd4e8884bf080bce23d24c2a35f59d0409736bb96e2f13dba00592f7fbbe510813021d416f3f712af15cc3a61b53d324157e43e0b03a65

Download Submit
C:\Windows\SysWOW64\Jghabl32.exe

Filesize
64KB

MD5
b5f968bf85ca2480ba17fba604e28dde

SHA1
23cfec573c4dee69961986a330de64607d9c3f02

SHA256
e37c4570c61f7346a5ac36d0c426a427a7d477727f43e0ec0c8e8eb7695143e5

SHA512
dfda7578f6778716aba96d0d17dbff2b1b7464cf999869fc9d6edebebb6c26f3e7292060be55c47dc8580868dd8d481cfc071d8d5d2947a724e022acf4947299

Download Submit
C:\Windows\SysWOW64\Jmbdbd32.exe

Filesize
64KB

MD5
141470597302c8db2c8de379eb5fe0e9

SHA1
bb2c2641b2b77001bcad4f3fc6ff0fbb7279c3c2

SHA256
b999b53da3a046fc47f525a55b75f3b6051a04e5fef6c9f97d829d6404ee8ae3

SHA512
790decbbd640588e1f577621a56ac65e5b49da94af0e430f5bd7e5111cccead04eb78cb0b84d2ab482ec6b05226213df69cff65ec518bfef7cf119823ccfd64b

Download Submit
C:\Windows\SysWOW64\Kbaipkbi.exe

Filesize
64KB

MD5
e52f4d8ca03297882e8a864c33ca9850

SHA1
31f6e6841d98b627cb55508bf5803b347c449b35

SHA256
01335dab7793dbea879d1cb626226dafe4d4508ecd2324a595c21b44a12441fc

SHA512
449ea99ad4d2e0f548e191563164bd9b028db4197ba2745d7e0776e1ded5025f1df2108ccf754d82ba25c2d703d1ff5f51b13e14dcc0080d81adcb7666f3d8e8

Download Submit
C:\Windows\SysWOW64\Kbceejpf.exe

Filesize
64KB

MD5
09eb9c0ed9fbe6071533495ea4550995

SHA1
010bae0c30b09336673cb28aed3572659059532d

SHA256
b1c645cf221c72fc9a33352035a7f33d900e24406f91c639e2b4d3e92a31c84c

SHA512
8a94ac43ec4924e1f6fe80d03b7d8d31a8c4f4354b854aaf0c7fafaa789f3d8e6b19fb87053861ab3eadf9085a105ce669cf9a17ab0c6f2e1fbbec4b584cb833

Download Submit
C:\Windows\SysWOW64\Kfnkkb32.exe

Filesize
64KB

MD5
3491192a925e2a2ce84cb0e676b290e1

SHA1
e8641ff48903f68b4071b60734b52b351a1f9294

SHA256
cf40c714e841d745b199aff57dd67b310ce9e162083267cde6f34f97c7ea6b91

SHA512
65109a48789b5f7dccfe37fa660ad22adce49b65577bd819a8e3d0d66b9c80131cf75e239f6b87d6c27b072f33737fdee0c4814be785f8207b39bdc2f798cf0e

Download Submit
C:\Windows\SysWOW64\Kibgmdcn.exe

Filesize
64KB

MD5
a7d41adc41719b50b35e8f24804f7460

SHA1
b470b7a86f6ecef4aa84321ece41b8730451a736

SHA256
953f0db8e9796f951ca401790ecf8e9c1548c564105c9a028e9a44904db2fd9b

SHA512
17a3254468170b226ec824825fcad725175b1d4d7f1e49c7cb0d37381c87446ca965a42d812d472aa8fbdd73f91ff6385f8d5c6aab8d90237c3d7ff15a41d1b6

Download Submit
C:\Windows\SysWOW64\Kimnbd32.exe

Filesize
64KB

MD5
6ce046c62c187d6185f6707ddd0fc4f3

SHA1
f674d342bd690b40cae88ee7d779c5ec02f40a28

SHA256
eb3da1b848c8793070446066cee8b9ff1e7c0c31972f8b2c22bd5311289f031e

SHA512
a01413be8bb031d30ea30cebfeb1893ab7bf3aaa6e6cd63225ba464e45bb79ae24234e4b2530bd11bee9d70bad5e40fc14d77ff81e12390d4e0d52575d5b4538

Download Submit
C:\Windows\SysWOW64\Kmdqgd32.exe

Filesize
64KB

MD5
fd568ea9342368f0b1731f0b355f7ee5

SHA1
50e1042651c69ce375bbd7a7f40210ede0947020

SHA256
b340d555ccf12f56a491533a44ebdf17c7a01ce683f420cd75ec7bf17e43467a

SHA512
45007f48a32497c019a0cff358f5201a965a764f6f3bf090bc04b016a66c551203f5410461203f1e58236967d70e89d2886eea69f476e087f7c0cc63bbdbd8ca

Download Submit
C:\Windows\SysWOW64\Kmfmmcbo.exe

Filesize
64KB

MD5
bdb3d7c8b0060c9197d4af495b396897

SHA1
5187061102119c8bec41fc1dc0314e145efc6bcf

SHA256
549cbf2a484943be971918cdad71030bbba448e78989a10ac734c2b2e8611583

SHA512
1dc78dd0dd977015cc9e44bc7b38971cfc8c69dc353a3cf5dbaff6caa5f7903f0bdb0e6c9127caf80782327ef16c2e1394ae7f961230c08395b2aef0b46b23b8

Download Submit
C:\Windows\SysWOW64\Kmkfhc32.exe

Filesize
64KB

MD5
7a8fe7915899e3457aa060961b0c1826

SHA1
c0b2fb550e291a53ccd74c6a2d2ab3c4e8901e52

SHA256
7eb56e13ad6037b41063fca3da52571f4bd3e4b081aa5a1373e7ebaff81c165a

SHA512
e3cd67f698d3e09810525226f055c613eb8600deb9c7bedd30205759625d819c4c102c767b711de70f07bbdf9494bced58191c6056ca8dcd0ce5aaeb7d8bba9a

Download Submit
C:\Windows\SysWOW64\Kpgfooop.exe

Filesize
64KB

MD5
c3d04aef736ed6775d88c2d982c01832

SHA1
ac206d3516e4397c00f198a8e93872a35e865cd0

SHA256
8dedd4923a90a1a388ece984e7f1ccb811e7e43ce914b960a263c136a148e5b0

SHA512
977c34c4b24602142b3a43b4daed32fcd1459da9860784e212bd0b8a803cbc176b4bd83d4cef6ed97d791bcd11cd0e9cd730ee4388efb9cdf5a6084361e055d1

Download Submit
C:\Windows\SysWOW64\Kpjcdn32.exe

Filesize
64KB

MD5
166ce9b80303e23752b72ea5964c26e8

SHA1
1acc5cee5d422b1610511e8d233dc7e55a2094b1

SHA256
2f6e05c247073f89fe27dc29e1a594e8b572c9d1bc95ca805d0e0d357ff820d9

SHA512
d8ae0fb82c6ce4ad7c78b0026b901b03616fd33cbed0bbf3afd3e95097a2c84a02fe2a882a9ee4b6472f673e91a829addb54eb2bdb53d04d521d9bd55642866c

Download Submit
C:\Windows\SysWOW64\Lboeaifi.exe

Filesize
64KB

MD5
127a9f7903d9ec96f59dcdaaf3e8bcc6

SHA1
4eafc706de335f669f0a041d75b76ee02a3f3b23

SHA256
8128c812c6b6d653a66b54c14f978cac1ad0a57312b3ab8e4b8bdf6f6c41eac7

SHA512
39dd40dff046ee2067424baa809110d3ce217c050ae4094fa51ba5d1032d5e64113d8f7d45db7570e4f59b4adfef00cea8ab70874b9416bcdc6f313bcf163ea3

Download Submit
C:\Windows\SysWOW64\Leihbeib.exe

Filesize
64KB

MD5
6eb6e2d518530d69a274cb5f6591a608

SHA1
551015c49678e155f2fba5fc8fe56ae5ad382049

SHA256
d274b0de465678b8abfe43389337dbc47a6cc641143d277aa085dcc1a9578fd5

SHA512
6e28c7d6295756251dba7239b41fedb7096e34c8f4abe6c78954a9345e44fc9faee9878a01f23d4d950f828cbee518afef9ee4de733decf0986beb125ea6107a

Download Submit
C:\Windows\SysWOW64\Lfhdlh32.exe

Filesize
64KB

MD5
fd07e4ec4b2277a97c663815865308ca

SHA1
01d51e1910da728ae62627da3b8424a162fe31e8

SHA256
ec04705a7a0a7ce5bda2d0f521b56fc63e2d5a8d5becea6c95f48729adeab4f2

SHA512
33d8dc966eb01cb3296bd5ed52ef661f77fa80fc597fbb6f9a05abc47b1da2ab97ded7509fb3cce53cb9decbafacac54faa94f919a2919bda598c1ed30aca9a0

Download Submit
C:\Windows\SysWOW64\Lhkgoiqe.exe

Filesize
64KB

MD5
c232e1e2b82171b026564b0c63b8b80a

SHA1
2fe778c55464318e90e510253fffefed6b3ba8e5

SHA256
f4d4ef5bb10f25efdcadc1ba944ccc432a0cbf80157eda1c3d047249736c3974

SHA512
44849a97a4f766e7f64dd676db6b82973af131ff40a83b9490f0f0e9c6ef03ba0f83659a2a5a6895f108da1013fca31443fd2bf7e3cea11f3350f6a88af63eac

Download Submit
C:\Windows\SysWOW64\Liimncmf.exe

Filesize
64KB

MD5
b8a52a9fd741ce6299c117b80eaf9e2d

SHA1
d508b99d183ca1e4056255e0efbc82a24a3a7750

SHA256
350c695183252c574bb2d3844d9a28d2537ccc75cf8f1a4fa2a4ab406717aac4

SHA512
c8096c0c5699011a373694a74098c68b6d230779da7507390e12f84b5d76a5682ffc46af07501dead97a9a493d70496dd8ed5baf13ba38df4d56741fee33dc6a

Download Submit
C:\Windows\SysWOW64\Lmbmibhb.exe

Filesize
64KB

MD5
67254b0101e40751d64076c6bc61ea0c

SHA1
399e37b7b12ff2489a293943c1b7958fe4a66a2f

SHA256
1ec8715a5237e29ceb6adaefc12b368bf9c5a6c6aa95ac55e4d8be9fa0040484

SHA512
1974c609ef7f6439fa28ca1c7c0a198f2396f5b1b7e11420aa30f4bb4dc1e13f2ded96ab205969fe2dd13eb447230e97080d6f96a4f7a9f875b3b10d47630799

Download Submit
C:\Windows\SysWOW64\Lmppcbjd.exe

Filesize
64KB

MD5
e7708d524eba8b9db9a644451a6ae1fa

SHA1
8c03c563bb595305066fcf603fe29496014e1de4

SHA256
dea128d48b93d30250102563160f08e4958d4b32cf943d3311e3d75d5d383b0c

SHA512
be77660398030b7e91f10529a783e88150a9b4fee2ff35040ecb80701d1cb216b4215e134f68fab1ed06e53307ec683ad36d897cf04ec87ba41b2a586a305a40

Download Submit
C:\Windows\SysWOW64\Mhilfa32.exe

Filesize
64KB

MD5
6a3d14eb56b2a183c42b71622d754b34

SHA1
db28b8b344f31c7ed80c09b546bbd7c67c657d65

SHA256
abfb7f4e4757f2fc202d1606d0257b4ebe59cd4ddcbf2f898ada294366fe56fc

SHA512
7c40906ddd03cd2894d98055f47bb1fe558358a4c033c8431fe7acfad353246e8d3084ce5b785a199fc8373023080e4b7f80bc1dac0ee55871b38244eb8736fc

Download Submit
C:\Windows\SysWOW64\Mhoipb32.exe

Filesize
64KB

MD5
442c7c218179593b55b370ff40834e95

SHA1
e08bbee3d2df6390aa8367360f750aa2ab335532

SHA256
7b8ecbaf6c8065aa91c1b2292585deff02d6cd7881e66253051d875954136076

SHA512
2bcc29e0c1e4caad4c1ccda19603cf3840b18e8d5c7a4ce983e3be7fb938dca2c9de3cc7fb35e11b2f9ffff3ed450042566a5cd91fe961c3878b056c49c5de9d

Download Submit
C:\Windows\SysWOW64\Nognnj32.exe

Filesize
64KB

MD5
7b25ed330200cbc54370bd0b0638d447

SHA1
9d220826141f1bd9befcd93b70bea6b731a0c7d4

SHA256
e50890a9548dfafbc5a724b2160c86afb19f49d80ded67e5c3dadb5cbf172f60

SHA512
0ff4b74ce724424043184502a2102b000eff9292d326f4d38b6a249bfe5f906777d66da39fd2660af5b29b04adab71b6361fd28c89af8fde6a6e6b86ae33d970

Download Submit
C:\Windows\SysWOW64\Ohnohn32.exe

Filesize
64KB

MD5
79aa5bbe8e246820cba91cd5badc7ff9

SHA1
dc317d6061e20fa8089ea95a4d78ec8442d4c831

SHA256
9108c61780e4eb5e64af90b1465fd513405b3622192edffb20b4d5e8f4fe7e32

SHA512
1633e7633dbf47640385cb4ca9dea57f7a50818d7ccdc9889939dae973184dc932b3c5618bca1704bdd339109af7318db8f69eee066489d82b813fad6cc3e794

Download Submit
C:\Windows\SysWOW64\Oljaccjf.exe

Filesize
64KB

MD5
0552c692d6c49c27d433870cd7b1e0d8

SHA1
5a346e3aec863c482ad54e5356f31573fb0d5a39

SHA256
18c24e0969cf8a6bee0a441f3d6bca1567e3cf371d5a8bb6a51c8466e4aa07b0

SHA512
748992fac890f1f80473e4dff229b23e9e123750ee7a9a5e4bad098f1dbea6f5d84c4d1953dbfefa63cd877c4e364047ea848e88e2f9fc51b4726ae6598e5a57

Download Submit
C:\Windows\SysWOW64\Plbmokop.exe

Filesize
64KB

MD5
d0865295d9617e466faf3d94bf020afa

SHA1
acf8ee5c17b860e709526b7b1dd185cd402d3fe2

SHA256
7fb286a1eb942ad6a4ad5e38ce1fedd8a5eeff1fa264647c050dbfbb0f2fda20

SHA512
bee5c8eae800df46c4d199e68914edd883872e135349bb976e5a7a10d807f04268170084ea9120134a3d7c78c04b67c9360474ad43d6e558bce7d869527c775b

Download Submit
C:\Windows\SysWOW64\Pojcjh32.exe

Filesize
64KB

MD5
92917dfc4b74532c5bf8e7aecad749a6

SHA1
a1ad75b4a0d1c6d45afa78352a730b3cccda5bd7

SHA256
0ab084c621dff128215311d4ff78f1cdeb10989122966fe44956b5f009f3db2c

SHA512
1da9197db54f6b8aebb741ca13603b299590985c5e304c65f9658a4586a7e9d54bfd329be54c2be93f8d11251abe516cf3b1a8d67e3ecce884a32f97cd23bdb0

Download Submit
C:\Windows\SysWOW64\Qgpogili.exe

Filesize
64KB

MD5
ae933c8237c369a9bf636db7bc34d9e4

SHA1
9cb93149ce21447f5fd708e07204a9f60f10364f

SHA256
25cab9f474475a7b5b3759d87683ab95f8a56444f0020e2298687090edcb7796

SHA512
b45f0d8422891817364c086132c0c75bf277fe2436ceea72cca172a616a46cbe7daf9d5a8e65a10ef68b834c4eb69b8468286e454627dd234c43a86937a8835a

Download Submit
memory/384-210-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/572-287-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/660-254-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/760-144-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/760-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/892-325-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/892-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/968-319-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/992-313-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1112-90-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1112-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1276-330-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1336-95-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1500-299-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1500-221-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1632-82-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1632-170-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1852-78-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1936-213-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1936-127-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1980-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2144-285-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2168-273-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2168-187-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2424-179-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2424-265-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2476-201-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2552-108-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2552-195-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2572-105-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2608-271-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2748-126-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2748-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2932-236-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2936-218-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3092-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3092-107-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3120-300-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3200-135-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3200-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3212-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3212-117-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3248-77-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3248-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3248-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3972-248-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3972-175-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3980-140-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4084-158-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4156-247-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4156-162-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4348-153-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4348-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4356-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4404-118-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4404-208-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4420-306-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4800-239-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4800-312-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4804-332-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4964-235-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4964-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5016-16-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5016-99-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads