8c67b7d22dba2471c49f9cc074cf9b5cb5d970a6265cdef0d06f9677737078fd

Analysis

max time kernel
161s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07-03-2024 22:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c67b7d22dba2471c49f9cc074cf9b5cb5d970a6265cdef0d06f9677737078fd.exe
Size

352KB
MD5

125f2efd4b2ff0fd21d288b4da7692e1
SHA1

0274be65645d046fc25e00ba67a39d58df2afd31
SHA256

8c67b7d22dba2471c49f9cc074cf9b5cb5d970a6265cdef0d06f9677737078fd
SHA512

efbf198c1b4526304f71eac1e7cc76d9abb33e451a6dc773a039fcc55281f14fba29f5db886182d3ad873fbbc574cb56839678da933dc978ea2e70f09fa3cac2
SSDEEP

6144:cWoCWbSe5z9iWis/j9SrJz9ieis/j9SrJz9is/j9SrJwWisp:VMbgsUasUqsU6sp

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjpbam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hgkkkcbc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohfami32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmdbooik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfmpob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikcmmjkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lckglc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oemefcap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohmhmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnlpgibd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhefhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Giahndcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgkfnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oamgcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kciaqi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmdbooik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcofbifb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hjlkge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfokoelp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fgpplf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Monjjgkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iepihf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebjcajjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bflagg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjcjmclj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Phmnfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bebjdgmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jqhphq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmbhgjoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkpqkcpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pldcjeia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gammbfqa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmipdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jabiie32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkcdfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Peahgl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fefedmil.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgbchj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abbkcpma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmdjha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kqbdldnq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlbcnd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gomkkagl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knkcmild.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcpqgbkj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjpfjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Epehnhbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eaenkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qebhhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmedmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eacaej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jknfcofa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojdnid32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnhjig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kofheeoq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Poajkgnc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjgeedch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkomhhae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jikjmbmb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ophjdehd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Polppg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmkdcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfehpg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjmpfdhb.exe

Executes dropped EXE 64 IoCs

pid	Process
4620	Hgghjjid.exe
3772	Hgiepjga.exe
1892	Hdmein32.exe
2400	Hhknpmma.exe
1764	Hjlkge32.exe
3664	Igqkqiai.exe
5092	Ihphkl32.exe
2028	Ijcahd32.exe
664	Ijfnmc32.exe
1432	Ijhjcchb.exe
5108	Jhndljll.exe
2508	Jjamia32.exe
1628	Jqlefl32.exe
2176	Kdinljnk.exe
2020	Kqbkfkal.exe
1964	Kbddfmgl.exe
3780	Liqihglg.exe
4828	Lejgch32.exe
3868	Ljgpkonp.exe
628	Llflea32.exe
4424	Leopnglc.exe
3732	Mhoipb32.exe
3656	Mbenmk32.exe
1792	Mjpbam32.exe
3668	Meefofek.exe
3096	Mlpokp32.exe
1616	Mldhfpib.exe
4868	Njiegl32.exe
2136	Niakfbpa.exe
4772	Oehlkc32.exe
400	Oblmdhdo.exe
1132	Oocmii32.exe
3604	Oemefcap.exe
5032	Ooejohhq.exe
1856	Oohgdhfn.exe
4632	Pllgnl32.exe
3352	Pcepkfld.exe
3500	Piphgq32.exe
3460	Polppg32.exe
2472	Plpqil32.exe
2804	Pcjiff32.exe
4268	Phganm32.exe
4068	Poajkgnc.exe
3064	Pifnhpmi.exe
1644	Plejdkmm.exe
100	Qljcoj32.exe
5096	Qohpkf32.exe
2936	Qebhhp32.exe
2852	Ahqddk32.exe
4544	Aaiimadl.exe
4364	Ahcajk32.exe
4536	Aakebqbj.exe
3196	Ahenokjf.exe
2760	Ackbmcjl.exe
3420	Ajdjin32.exe
3100	Aoabad32.exe
4836	Ajggomog.exe
2168	Aleckinj.exe
1056	Abbkcpma.exe
3508	Bhldpj32.exe
668	Bfpdin32.exe
4584	Bkmmaeap.exe
1128	Bhamkipi.exe
5044	Bkoigdom.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Plpqil32.exe	Polppg32.exe
File created	C:\Windows\SysWOW64\Beefhclj.dll	Elgohj32.exe
File created	C:\Windows\SysWOW64\Fbjmhh32.exe	Flqdlnde.exe
File created	C:\Windows\SysWOW64\Nmqmbmdf.dll	Fihnomjp.exe
File opened for modification	C:\Windows\SysWOW64\Fefedmil.exe	Fnlmhc32.exe
File opened for modification	C:\Windows\SysWOW64\Mqdcnl32.exe	Mjjkaabc.exe
File opened for modification	C:\Windows\SysWOW64\Nelfeo32.exe	Mkadfj32.exe
File opened for modification	C:\Windows\SysWOW64\Jgmjmjnb.exe	Jofalmmp.exe
File created	C:\Windows\SysWOW64\Jkkdccim.dll	Mknlef32.exe
File created	C:\Windows\SysWOW64\Oamgcm32.exe	Ohbfeh32.exe
File created	C:\Windows\SysWOW64\Pdgjaf32.dll	Aokcjngj.exe
File opened for modification	C:\Windows\SysWOW64\Ggoiap32.exe	Gohapb32.exe
File created	C:\Windows\SysWOW64\Nfcconde.dll	Kclgmq32.exe
File created	C:\Windows\SysWOW64\Clgbhl32.dll	Cdbfab32.exe
File opened for modification	C:\Windows\SysWOW64\Mgphpe32.exe	Moipoh32.exe
File created	C:\Windows\SysWOW64\Pbifol32.exe	Pbdmdlie.exe
File opened for modification	C:\Windows\SysWOW64\Agiahlkf.exe	Adkelplc.exe
File created	C:\Windows\SysWOW64\Haapme32.dll	Aklciimh.exe
File opened for modification	C:\Windows\SysWOW64\Glbapoqh.exe	Gammbfqa.exe
File opened for modification	C:\Windows\SysWOW64\Ijfnmc32.exe	Ijcahd32.exe
File created	C:\Windows\SysWOW64\Pgfcalbj.dll	Qdbdcg32.exe
File created	C:\Windows\SysWOW64\Loighj32.exe	Lljklo32.exe
File created	C:\Windows\SysWOW64\Padkjq32.dll	Bpfcelml.exe
File created	C:\Windows\SysWOW64\Mcmeff32.dll	Epgdch32.exe
File opened for modification	C:\Windows\SysWOW64\Pkedbmab.exe	Phfhfa32.exe
File opened for modification	C:\Windows\SysWOW64\Gbeejp32.exe	Gmimai32.exe
File created	C:\Windows\SysWOW64\Bejlik32.dll	Fdjnolfd.exe
File opened for modification	C:\Windows\SysWOW64\Fmfnpa32.exe	Ffmfchle.exe
File opened for modification	C:\Windows\SysWOW64\Iphioh32.exe	Iljpij32.exe
File opened for modification	C:\Windows\SysWOW64\Nooikj32.exe	Lefkkg32.exe
File created	C:\Windows\SysWOW64\Oblmdhdo.exe	Oehlkc32.exe
File opened for modification	C:\Windows\SysWOW64\Jfgnka32.exe	Jomeoggk.exe
File created	C:\Windows\SysWOW64\Hicobn32.dll	Jomeoggk.exe
File opened for modification	C:\Windows\SysWOW64\Mhoipb32.exe	Leopnglc.exe
File opened for modification	C:\Windows\SysWOW64\Qdbdcg32.exe	Qmhlgmmm.exe
File created	C:\Windows\SysWOW64\Bkhjpn32.exe	Bijncb32.exe
File created	C:\Windows\SysWOW64\Kfbmgo32.exe	Kcdakd32.exe
File created	C:\Windows\SysWOW64\Kmpcpigl.dll	Komoed32.exe
File created	C:\Windows\SysWOW64\Fhbfdm32.dll	Kfbmgo32.exe
File created	C:\Windows\SysWOW64\Mldhfpib.exe	Mlpokp32.exe
File created	C:\Windows\SysWOW64\Nmiadaea.dll	Npbceggm.exe
File created	C:\Windows\SysWOW64\Bijncb32.exe	Bflagg32.exe
File opened for modification	C:\Windows\SysWOW64\Pkgaglpp.exe	Phiekaql.exe
File opened for modification	C:\Windows\SysWOW64\Ajaqjfbp.exe	Agcdnjcl.exe
File created	C:\Windows\SysWOW64\Bjkcqdje.exe	Bglgdi32.exe
File created	C:\Windows\SysWOW64\Gglnncqg.dll	Cjomldfp.exe
File opened for modification	C:\Windows\SysWOW64\Iepaaico.exe	Ibaeen32.exe
File opened for modification	C:\Windows\SysWOW64\Ebnddn32.exe	Ejglcq32.exe
File created	C:\Windows\SysWOW64\Ohkijc32.exe	Npcaie32.exe
File created	C:\Windows\SysWOW64\Aboncdme.dll	Hhknpmma.exe
File opened for modification	C:\Windows\SysWOW64\Qljcoj32.exe	Plejdkmm.exe
File opened for modification	C:\Windows\SysWOW64\Aoalgn32.exe	Aamknj32.exe
File created	C:\Windows\SysWOW64\Gfkcaoef.dll	Nggnadib.exe
File created	C:\Windows\SysWOW64\Ndhqmknd.dll	Cihjeq32.exe
File opened for modification	C:\Windows\SysWOW64\Ioffhn32.exe	Imhjlb32.exe
File created	C:\Windows\SysWOW64\Pfbmge32.dll	Lhammfci.exe
File opened for modification	C:\Windows\SysWOW64\Bjmpfdhb.exe	Bgodjiio.exe
File opened for modification	C:\Windows\SysWOW64\Golcak32.exe	Giokid32.exe
File opened for modification	C:\Windows\SysWOW64\Hcdfho32.exe	Hpejlc32.exe
File created	C:\Windows\SysWOW64\Obimmnpq.dll	Plpqil32.exe
File opened for modification	C:\Windows\SysWOW64\Aaiimadl.exe	Ahqddk32.exe
File created	C:\Windows\SysWOW64\Dhbmpk32.dll	Dfgcakon.exe
File created	C:\Windows\SysWOW64\Hkpqkcpd.exe	Hdehni32.exe
File opened for modification	C:\Windows\SysWOW64\Dnbakghm.exe	Dhclmp32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10820	11704	WerFault.exe	990

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gddmgi32.dll"	Hloqml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlkfjqib.dll"	Nlkgmh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ondljl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohbfeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfghlhmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hccomh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihejacdm.dll"	Lenicahg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cocacl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hhaljido.dll"	Jokkgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogjdmbil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ioffhn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kciaqi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmabggdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bcghka32.dll"	Fipkjb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qmhlgmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgegjnih.dll"	Oakbehfe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jhqqlmba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckjbhmad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ffqhcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibcaknbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlgdjg32.dll"	Joahqn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hgdlcm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djqblj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npdpachh.dll"	Dngjff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dheiop32.dll"	Gckcap32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hhknpmma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elcgieob.dll"	Mldhfpib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Niakfbpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nlmdbh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gedfblql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmlbhekk.dll"	Fpgpgfmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eglkdbfn.dll"	Fmkqpkla.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gmimai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Imfmgcdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdliee32.dll"	Pllgnl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pkklbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohbfeh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mabdlk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkpbpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fidgmfgl.dll"	Jbpkfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncdpoaed.dll"	Oocmii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfjkjgbh.dll"	Ebjcajjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hkbmqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhpopokm.dll"	Fealin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mokmqben.dll"	Alnfpcag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfnmog32.dll"	Gnqfcbnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfbhhfbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Enedio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmikeaap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjinodke.dll"	Aamknj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffqhcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lfjchn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Efafgifc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Polppg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glienb32.dll"	Emphocjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgbdja32.dll"	Innfnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpklcffg.dll"	Jabiie32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gegchl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohobebig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jjefao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dccledea.dll"	Cjnffjkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iedbcebd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mqbgcd32.dll"	Gedfblql.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jicdlc32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4620	4848	8c67b7d22dba2471c49f9cc074cf9b5cb5d970a6265cdef0d06f9677737078fd.exe	87
PID 4848 wrote to memory of 4620	4848	8c67b7d22dba2471c49f9cc074cf9b5cb5d970a6265cdef0d06f9677737078fd.exe	87
PID 4848 wrote to memory of 4620	4848	8c67b7d22dba2471c49f9cc074cf9b5cb5d970a6265cdef0d06f9677737078fd.exe	87
PID 4620 wrote to memory of 3772	4620	Hgghjjid.exe	88
PID 4620 wrote to memory of 3772	4620	Hgghjjid.exe	88
PID 4620 wrote to memory of 3772	4620	Hgghjjid.exe	88
PID 3772 wrote to memory of 1892	3772	Hgiepjga.exe	89
PID 3772 wrote to memory of 1892	3772	Hgiepjga.exe	89
PID 3772 wrote to memory of 1892	3772	Hgiepjga.exe	89
PID 1892 wrote to memory of 2400	1892	Hdmein32.exe	90
PID 1892 wrote to memory of 2400	1892	Hdmein32.exe	90
PID 1892 wrote to memory of 2400	1892	Hdmein32.exe	90
PID 2400 wrote to memory of 1764	2400	Hhknpmma.exe	91
PID 2400 wrote to memory of 1764	2400	Hhknpmma.exe	91
PID 2400 wrote to memory of 1764	2400	Hhknpmma.exe	91
PID 1764 wrote to memory of 3664	1764	Hjlkge32.exe	93
PID 1764 wrote to memory of 3664	1764	Hjlkge32.exe	93
PID 1764 wrote to memory of 3664	1764	Hjlkge32.exe	93
PID 3664 wrote to memory of 5092	3664	Igqkqiai.exe	94
PID 3664 wrote to memory of 5092	3664	Igqkqiai.exe	94
PID 3664 wrote to memory of 5092	3664	Igqkqiai.exe	94
PID 5092 wrote to memory of 2028	5092	Ihphkl32.exe	96
PID 5092 wrote to memory of 2028	5092	Ihphkl32.exe	96
PID 5092 wrote to memory of 2028	5092	Ihphkl32.exe	96
PID 2028 wrote to memory of 664	2028	Ijcahd32.exe	97
PID 2028 wrote to memory of 664	2028	Ijcahd32.exe	97
PID 2028 wrote to memory of 664	2028	Ijcahd32.exe	97
PID 664 wrote to memory of 1432	664	Ijfnmc32.exe	98
PID 664 wrote to memory of 1432	664	Ijfnmc32.exe	98
PID 664 wrote to memory of 1432	664	Ijfnmc32.exe	98
PID 1432 wrote to memory of 5108	1432	Ijhjcchb.exe	99
PID 1432 wrote to memory of 5108	1432	Ijhjcchb.exe	99
PID 1432 wrote to memory of 5108	1432	Ijhjcchb.exe	99
PID 5108 wrote to memory of 2508	5108	Jhndljll.exe	101
PID 5108 wrote to memory of 2508	5108	Jhndljll.exe	101
PID 5108 wrote to memory of 2508	5108	Jhndljll.exe	101
PID 2508 wrote to memory of 1628	2508	Jjamia32.exe	102
PID 2508 wrote to memory of 1628	2508	Jjamia32.exe	102
PID 2508 wrote to memory of 1628	2508	Jjamia32.exe	102
PID 1628 wrote to memory of 2176	1628	Jqlefl32.exe	103
PID 1628 wrote to memory of 2176	1628	Jqlefl32.exe	103
PID 1628 wrote to memory of 2176	1628	Jqlefl32.exe	103
PID 2176 wrote to memory of 2020	2176	Kdinljnk.exe	104
PID 2176 wrote to memory of 2020	2176	Kdinljnk.exe	104
PID 2176 wrote to memory of 2020	2176	Kdinljnk.exe	104
PID 2020 wrote to memory of 1964	2020	Kqbkfkal.exe	105
PID 2020 wrote to memory of 1964	2020	Kqbkfkal.exe	105
PID 2020 wrote to memory of 1964	2020	Kqbkfkal.exe	105
PID 1964 wrote to memory of 3780	1964	Kbddfmgl.exe	106
PID 1964 wrote to memory of 3780	1964	Kbddfmgl.exe	106
PID 1964 wrote to memory of 3780	1964	Kbddfmgl.exe	106
PID 3780 wrote to memory of 4828	3780	Liqihglg.exe	107
PID 3780 wrote to memory of 4828	3780	Liqihglg.exe	107
PID 3780 wrote to memory of 4828	3780	Liqihglg.exe	107
PID 4828 wrote to memory of 3868	4828	Lejgch32.exe	108
PID 4828 wrote to memory of 3868	4828	Lejgch32.exe	108
PID 4828 wrote to memory of 3868	4828	Lejgch32.exe	108
PID 3868 wrote to memory of 628	3868	Ljgpkonp.exe	109
PID 3868 wrote to memory of 628	3868	Ljgpkonp.exe	109
PID 3868 wrote to memory of 628	3868	Ljgpkonp.exe	109
PID 628 wrote to memory of 4424	628	Llflea32.exe	110
PID 628 wrote to memory of 4424	628	Llflea32.exe	110
PID 628 wrote to memory of 4424	628	Llflea32.exe	110
PID 4424 wrote to memory of 3732	4424	Leopnglc.exe	111

C:\Users\Admin\AppData\Local\Temp\8c67b7d22dba2471c49f9cc074cf9b5cb5d970a6265cdef0d06f9677737078fd.exe
"C:\Users\Admin\AppData\Local\Temp\8c67b7d22dba2471c49f9cc074cf9b5cb5d970a6265cdef0d06f9677737078fd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\SysWOW64\Hgghjjid.exe
  C:\Windows\system32\Hgghjjid.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\SysWOW64\Hgiepjga.exe
    C:\Windows\system32\Hgiepjga.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3772
  - - C:\Windows\SysWOW64\Hdmein32.exe
      C:\Windows\system32\Hdmein32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1892
    - - C:\Windows\SysWOW64\Hhknpmma.exe
        
        C:\Windows\system32\Hhknpmma.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2400
      - C:\Windows\SysWOW64\Hjlkge32.exe
        
        C:\Windows\system32\Hjlkge32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1764
        
        C:\Windows\SysWOW64\Igqkqiai.exe
        
        C:\Windows\system32\Igqkqiai.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3664
        
        C:\Windows\SysWOW64\Ihphkl32.exe
        
        C:\Windows\system32\Ihphkl32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\SysWOW64\Ijcahd32.exe
        
        C:\Windows\system32\Ijcahd32.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2028
        
        C:\Windows\SysWOW64\Ijfnmc32.exe
        
        C:\Windows\system32\Ijfnmc32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:664
        
        C:\Windows\SysWOW64\Ijhjcchb.exe
        
        C:\Windows\system32\Ijhjcchb.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1432
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\SysWOW64\Jjamia32.exe
        
        C:\Windows\system32\Jjamia32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2508
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1628
        
        C:\Windows\SysWOW64\Kdinljnk.exe
        
        C:\Windows\system32\Kdinljnk.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2176
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2020
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Windows\SysWOW64\Liqihglg.exe
        
        C:\Windows\system32\Liqihglg.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3780
        
        C:\Windows\SysWOW64\Lejgch32.exe
        
        C:\Windows\system32\Lejgch32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4828
        
        C:\Windows\SysWOW64\Ljgpkonp.exe
        
        C:\Windows\system32\Ljgpkonp.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3868
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:628
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4424
        
        C:\Windows\SysWOW64\Mhoipb32.exe
        
        C:\Windows\system32\Mhoipb32.exe
        23⤵
        Executes dropped EXE
        
        PID:3732
        
        C:\Windows\SysWOW64\Mbenmk32.exe
        
        C:\Windows\system32\Mbenmk32.exe
        24⤵
        Executes dropped EXE
        
        PID:3656
        
        C:\Windows\SysWOW64\Mjpbam32.exe
        
        C:\Windows\system32\Mjpbam32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1792
        
        C:\Windows\SysWOW64\Meefofek.exe
        
        C:\Windows\system32\Meefofek.exe
        26⤵
        Executes dropped EXE
        
        PID:3668
        
        C:\Windows\SysWOW64\Mlpokp32.exe
        
        C:\Windows\system32\Mlpokp32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3096
        
        C:\Windows\SysWOW64\Mldhfpib.exe
        
        C:\Windows\system32\Mldhfpib.exe
        28⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1616
        
        C:\Windows\SysWOW64\Njiegl32.exe
        
        C:\Windows\system32\Njiegl32.exe
        29⤵
        Executes dropped EXE
        
        PID:4868
        
        C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2136
        
        C:\Windows\SysWOW64\Oehlkc32.exe
        
        C:\Windows\system32\Oehlkc32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4772
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        32⤵
        Executes dropped EXE
        
        PID:400
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1132
        
        C:\Windows\SysWOW64\Oemefcap.exe
        
        C:\Windows\system32\Oemefcap.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3604
        
        C:\Windows\SysWOW64\Ooejohhq.exe
        
        C:\Windows\system32\Ooejohhq.exe
        35⤵
        Executes dropped EXE
        
        PID:5032
        
        C:\Windows\SysWOW64\Oohgdhfn.exe
        
        C:\Windows\system32\Oohgdhfn.exe
        36⤵
        Executes dropped EXE
        
        PID:1856
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4632
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        38⤵
        Executes dropped EXE
        
        PID:3352
        
        C:\Windows\SysWOW64\Piphgq32.exe
        
        C:\Windows\system32\Piphgq32.exe
        39⤵
        Executes dropped EXE
        
        PID:3500
        
        C:\Windows\SysWOW64\Polppg32.exe
        
        C:\Windows\system32\Polppg32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3460
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2472
        
        C:\Windows\SysWOW64\Pcjiff32.exe
        
        C:\Windows\system32\Pcjiff32.exe
        42⤵
        Executes dropped EXE
        
        PID:2804
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        43⤵
        Executes dropped EXE
        
        PID:4268
        
        C:\Windows\SysWOW64\Poajkgnc.exe
        
        C:\Windows\system32\Poajkgnc.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4068
        
        C:\Windows\SysWOW64\Pifnhpmi.exe
        
        C:\Windows\system32\Pifnhpmi.exe
        45⤵
        Executes dropped EXE
        
        PID:3064
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1644
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        47⤵
        Executes dropped EXE
        
        PID:100
        
        C:\Windows\SysWOW64\Qohpkf32.exe
        
        C:\Windows\system32\Qohpkf32.exe
        48⤵
        Executes dropped EXE
        
        PID:5096
        
        C:\Windows\SysWOW64\Qebhhp32.exe
        
        C:\Windows\system32\Qebhhp32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2936
        
        C:\Windows\SysWOW64\Ahqddk32.exe
        
        C:\Windows\system32\Ahqddk32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2852
        
        C:\Windows\SysWOW64\Aaiimadl.exe
        
        C:\Windows\system32\Aaiimadl.exe
        51⤵
        Executes dropped EXE
        
        PID:4544
        
        C:\Windows\SysWOW64\Ahcajk32.exe
        
        C:\Windows\system32\Ahcajk32.exe
        52⤵
        Executes dropped EXE
        
        PID:4364
        
        C:\Windows\SysWOW64\Aakebqbj.exe
        
        C:\Windows\system32\Aakebqbj.exe
        53⤵
        Executes dropped EXE
        
        PID:4536
        
        C:\Windows\SysWOW64\Ahenokjf.exe
        
        C:\Windows\system32\Ahenokjf.exe
        54⤵
        Executes dropped EXE
        
        PID:3196
        
        C:\Windows\SysWOW64\Ackbmcjl.exe
        
        C:\Windows\system32\Ackbmcjl.exe
        55⤵
        Executes dropped EXE
        
        PID:2760
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        56⤵
        Executes dropped EXE
        
        PID:3420
        
        C:\Windows\SysWOW64\Aoabad32.exe
        
        C:\Windows\system32\Aoabad32.exe
        57⤵
        Executes dropped EXE
        
        PID:3100
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        58⤵
        Executes dropped EXE
        
        PID:4836
        
        C:\Windows\SysWOW64\Aleckinj.exe
        
        C:\Windows\system32\Aleckinj.exe
        59⤵
        Executes dropped EXE
        
        PID:2168
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1056
        
        C:\Windows\SysWOW64\Bhldpj32.exe
        
        C:\Windows\system32\Bhldpj32.exe
        61⤵
        Executes dropped EXE
        
        PID:3508
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        62⤵
        Executes dropped EXE
        
        PID:668
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        63⤵
        Executes dropped EXE
        
        PID:4584
        
        C:\Windows\SysWOW64\Bhamkipi.exe
        
        C:\Windows\system32\Bhamkipi.exe
        64⤵
        Executes dropped EXE
        
        PID:1128
        
        C:\Windows\SysWOW64\Bkoigdom.exe
        
        C:\Windows\system32\Bkoigdom.exe
        65⤵
        Executes dropped EXE
        
        PID:5044
        
        C:\Windows\SysWOW64\Bfendmoc.exe
        
        C:\Windows\system32\Bfendmoc.exe
        66⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Bkafmd32.exe
        
        C:\Windows\system32\Bkafmd32.exe
        67⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        68⤵
        Modifies registry class
        
        PID:3916
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        69⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        70⤵
        
        PID:688
        
        C:\Windows\SysWOW64\Ckkiccep.exe
        
        C:\Windows\system32\Ckkiccep.exe
        71⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Cbeapmll.exe
        
        C:\Windows\system32\Cbeapmll.exe
        72⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        73⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        74⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        75⤵
        Modifies registry class
        
        PID:2064
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        76⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        77⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\Djqblj32.exe
        
        C:\Windows\system32\Djqblj32.exe
        78⤵
        Modifies registry class
        
        PID:4824
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        79⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\Dfgcakon.exe
        
        C:\Windows\system32\Dfgcakon.exe
        80⤵
        Drops file in System32 directory
        
        PID:3348
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        81⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        82⤵
        
        PID:60
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        83⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        84⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        85⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        86⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        87⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        88⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        89⤵
        Modifies registry class
        
        PID:5232
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        90⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        91⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        92⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        93⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5464
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        95⤵
        Modifies registry class
        
        PID:5508
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        96⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        97⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        98⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        99⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Ffmfchle.exe
        
        C:\Windows\system32\Ffmfchle.exe
        100⤵
        Drops file in System32 directory
        
        PID:5708
        
        C:\Windows\SysWOW64\Fmfnpa32.exe
        
        C:\Windows\system32\Fmfnpa32.exe
        101⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        102⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        103⤵
        Modifies registry class
        
        PID:5864
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        104⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        105⤵
        Modifies registry class
        
        PID:5952
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        106⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        107⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        108⤵
        Drops file in System32 directory
        
        PID:6084
        
        C:\Windows\SysWOW64\Fbjmhh32.exe
        
        C:\Windows\system32\Fbjmhh32.exe
        109⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        110⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        111⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        112⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        113⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        114⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        115⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        116⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        117⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        118⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5940
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        120⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        121⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        122⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        123⤵
        Modifies registry class
        
        PID:5540
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        124⤵
        Drops file in System32 directory
        
        PID:5656
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5872
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        126⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        127⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        128⤵
        Modifies registry class
        
        PID:5476
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        129⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        130⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        131⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5300
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        133⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        134⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        135⤵
        Drops file in System32 directory
        
        PID:6232
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        136⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        137⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        138⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        139⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        140⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        141⤵
        Modifies registry class
        
        PID:6516
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        142⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Idkkpf32.exe
        
        C:\Windows\system32\Idkkpf32.exe
        143⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        144⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        145⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        146⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        147⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        148⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        149⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        150⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        151⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7016
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        153⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        154⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        155⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        156⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        157⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        158⤵
        Drops file in System32 directory
        
        PID:6268
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3808
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        160⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        161⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        162⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        163⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        164⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        165⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        166⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        167⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        168⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Lcggio32.exe
        
        C:\Windows\system32\Lcggio32.exe
        169⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        170⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        171⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        172⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        173⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        174⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        175⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        176⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        177⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        178⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        179⤵
        Modifies registry class
        
        PID:6752
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        180⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        181⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        182⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        183⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        184⤵
        Drops file in System32 directory
        
        PID:6176
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        185⤵
        
        PID:916
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        186⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        187⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        188⤵
        Modifies registry class
        
        PID:6784
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        189⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        190⤵
        Modifies registry class
        
        PID:4752
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        191⤵
        
        PID:960
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        192⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        193⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6980
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3568
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        196⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        197⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        198⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        199⤵
        
        PID:3764
        
        C:\Windows\SysWOW64\Oodcdb32.exe
        
        C:\Windows\system32\Oodcdb32.exe
        200⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        201⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7172
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        203⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7252
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        205⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        206⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        207⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        208⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        209⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        210⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        211⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        212⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        213⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        214⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        215⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        216⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7768
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        218⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        219⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        220⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7904
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        221⤵
        Drops file in System32 directory
        
        PID:7952
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        222⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        223⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        224⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        225⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        226⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        227⤵
        Modifies registry class
        
        PID:2300
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        228⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        229⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7324
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        230⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        231⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        232⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        233⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        234⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        235⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        236⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        237⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        238⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8084
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        240⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        241⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        242⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        243⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        244⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        245⤵
        Modifies registry class
        
        PID:7712
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        246⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        247⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        248⤵
        Modifies registry class
        
        PID:8048
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        249⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        250⤵
        Drops file in System32 directory
        
        PID:7368
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        251⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        252⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        253⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        254⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        255⤵
        Drops file in System32 directory
        
        PID:7744
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        256⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        257⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        258⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        259⤵
        Modifies registry class
        
        PID:8196
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        260⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        261⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        262⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        263⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        264⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        265⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        266⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        267⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        268⤵
        Drops file in System32 directory
        
        PID:8552
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        269⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        270⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        271⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        272⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        273⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        274⤵
        Modifies registry class
        
        PID:8836
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        275⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        276⤵
        Modifies registry class
        
        PID:8920
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        277⤵
        Modifies registry class
        
        PID:8952
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        278⤵
        Modifies registry class
        
        PID:8988
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        279⤵
        Drops file in System32 directory
        
        PID:9044
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9080
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        281⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        282⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        283⤵
        Modifies registry class
        
        PID:9204
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        284⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        285⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        286⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        287⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        288⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8484
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        289⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        290⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        291⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        292⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        293⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        294⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9032
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        296⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        297⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        298⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        299⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        300⤵
        Drops file in System32 directory
        
        PID:8432
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        301⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        302⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        303⤵
        Modifies registry class
        
        PID:8876
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        304⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        305⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        306⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        307⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        308⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        309⤵
        Modifies registry class
        
        PID:8644
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        310⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        311⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        312⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        313⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        314⤵
        Drops file in System32 directory
        
        PID:8568
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        315⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        316⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        317⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        318⤵
        
        PID:4164
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        319⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        320⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        321⤵
        Modifies registry class
        
        PID:2456
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6648
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        323⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        324⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        325⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        326⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        327⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        328⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        329⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        330⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9448
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        332⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9528
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        334⤵
        Drops file in System32 directory
        
        PID:9568
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        335⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        336⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        337⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        338⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        339⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        340⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        341⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        342⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        343⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        344⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        345⤵
        Drops file in System32 directory
        
        PID:10020
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        346⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        347⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10148
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        349⤵
        Drops file in System32 directory
        
        PID:10188
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        350⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        351⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        352⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        353⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9440
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        355⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        356⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        357⤵
        Drops file in System32 directory
        
        PID:9628
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        358⤵
        Drops file in System32 directory
        
        PID:9696
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        359⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        360⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9884
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        362⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        363⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        364⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        365⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        366⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        367⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        368⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        369⤵
        Modifies registry class
        
        PID:9524
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        370⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        371⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        372⤵
        Modifies registry class
        
        PID:9816
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        373⤵
        Modifies registry class
        
        PID:9932
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        374⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        375⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        376⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        377⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9676
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        379⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        380⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        381⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        382⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        383⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        384⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        385⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        386⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        387⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Fkfcqb32.exe
        
        C:\Windows\system32\Fkfcqb32.exe
        388⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        389⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        390⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        391⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        392⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Nbphglbe.exe
        
        C:\Windows\system32\Nbphglbe.exe
        393⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Afhfaddk.exe
        
        C:\Windows\system32\Afhfaddk.exe
        394⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Dcffnbee.exe
        
        C:\Windows\system32\Dcffnbee.exe
        395⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Dajbaika.exe
        
        C:\Windows\system32\Dajbaika.exe
        396⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Ekngemhd.exe
        
        C:\Windows\system32\Ekngemhd.exe
        397⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Hbdgec32.exe
        
        C:\Windows\system32\Hbdgec32.exe
        398⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Leoejh32.exe
        
        C:\Windows\system32\Leoejh32.exe
        399⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\Lefkkg32.exe
        
        C:\Windows\system32\Lefkkg32.exe
        400⤵
        Drops file in System32 directory
        
        PID:10888
        
        C:\Windows\SysWOW64\Nooikj32.exe
        
        C:\Windows\system32\Nooikj32.exe
        401⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Obidcdfo.exe
        
        C:\Windows\system32\Obidcdfo.exe
        402⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Ohcmpn32.exe
        
        C:\Windows\system32\Ohcmpn32.exe
        403⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\Oheienli.exe
        
        C:\Windows\system32\Oheienli.exe
        404⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Ocmjhfjl.exe
        
        C:\Windows\system32\Ocmjhfjl.exe
        405⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Pkklbh32.exe
        
        C:\Windows\system32\Pkklbh32.exe
        406⤵
        Modifies registry class
        
        PID:440
        
        C:\Windows\SysWOW64\Qejfkmem.exe
        
        C:\Windows\system32\Qejfkmem.exe
        407⤵
        
        PID:3804
        
        C:\Windows\SysWOW64\Aijlgkjq.exe
        
        C:\Windows\system32\Aijlgkjq.exe
        408⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\Bbalaoda.exe
        
        C:\Windows\system32\Bbalaoda.exe
        409⤵
        
        PID:3928
        
        C:\Windows\SysWOW64\Bmkjig32.exe
        
        C:\Windows\system32\Bmkjig32.exe
        410⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Cmmgof32.exe
        
        C:\Windows\system32\Cmmgof32.exe
        411⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Cemeoh32.exe
        
        C:\Windows\system32\Cemeoh32.exe
        412⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\Cmgjee32.exe
        
        C:\Windows\system32\Cmgjee32.exe
        413⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Dpgbgpbe.exe
        
        C:\Windows\system32\Dpgbgpbe.exe
        414⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Dedkogqm.exe
        
        C:\Windows\system32\Dedkogqm.exe
        415⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\Dpjompqc.exe
        
        C:\Windows\system32\Dpjompqc.exe
        416⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\Emeffcid.exe
        
        C:\Windows\system32\Emeffcid.exe
        417⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Epjhcnbp.exe
        
        C:\Windows\system32\Epjhcnbp.exe
        418⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Fdjnolfd.exe
        
        C:\Windows\system32\Fdjnolfd.exe
        419⤵
        Drops file in System32 directory
        
        PID:5184
        
        C:\Windows\SysWOW64\Fgpplf32.exe
        
        C:\Windows\system32\Fgpplf32.exe
        420⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5896
        
        C:\Windows\SysWOW64\Gcimfg32.exe
        
        C:\Windows\system32\Gcimfg32.exe
        421⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Gfjfhbpb.exe
        
        C:\Windows\system32\Gfjfhbpb.exe
        422⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Hjlhipbc.exe
        
        C:\Windows\system32\Hjlhipbc.exe
        423⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Hddilh32.exe
        
        C:\Windows\system32\Hddilh32.exe
        424⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Hjabdo32.exe
        
        C:\Windows\system32\Hjabdo32.exe
        425⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Hfhbipdb.exe
        
        C:\Windows\system32\Hfhbipdb.exe
        426⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Hdicggla.exe
        
        C:\Windows\system32\Hdicggla.exe
        427⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Igjlibib.exe
        
        C:\Windows\system32\Igjlibib.exe
        428⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\Icqmncof.exe
        
        C:\Windows\system32\Icqmncof.exe
        429⤵
        
        PID:748
        
        C:\Windows\SysWOW64\Iepihf32.exe
        
        C:\Windows\system32\Iepihf32.exe
        430⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10700
        
        C:\Windows\SysWOW64\Iedbcebd.exe
        
        C:\Windows\system32\Iedbcebd.exe
        431⤵
        Modifies registry class
        
        PID:2020
        
        C:\Windows\SysWOW64\Jcjodbgl.exe
        
        C:\Windows\system32\Jcjodbgl.exe
        432⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\Japmcfcc.exe
        
        C:\Windows\system32\Japmcfcc.exe
        433⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Jabiie32.exe
        
        C:\Windows\system32\Jabiie32.exe
        434⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10764
        
        C:\Windows\SysWOW64\Kagbdenk.exe
        
        C:\Windows\system32\Kagbdenk.exe
        435⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Knkcmild.exe
        
        C:\Windows\system32\Knkcmild.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4372
        
        C:\Windows\SysWOW64\Lmjcdd32.exe
        
        C:\Windows\system32\Lmjcdd32.exe
        437⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Lechkaga.exe
        
        C:\Windows\system32\Lechkaga.exe
        438⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Mmcfkc32.exe
        
        C:\Windows\system32\Mmcfkc32.exe
        439⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Maaoaa32.exe
        
        C:\Windows\system32\Maaoaa32.exe
        440⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Mknlef32.exe
        
        C:\Windows\system32\Mknlef32.exe
        441⤵
        Drops file in System32 directory
        
        PID:4212
        
        C:\Windows\SysWOW64\Nhbmnj32.exe
        
        C:\Windows\system32\Nhbmnj32.exe
        442⤵
        
        PID:2840
        
        C:\Windows\SysWOW64\Ndpcdjho.exe
        
        C:\Windows\system32\Ndpcdjho.exe
        443⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Ogcike32.exe
        
        C:\Windows\system32\Ogcike32.exe
        444⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Ohbfeh32.exe
        
        C:\Windows\system32\Ohbfeh32.exe
        445⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6972
        
        C:\Windows\SysWOW64\Oamgcm32.exe
        
        C:\Windows\system32\Oamgcm32.exe
        446⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7104
        
        C:\Windows\SysWOW64\Pdnpeh32.exe
        
        C:\Windows\system32\Pdnpeh32.exe
        447⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Pbdmdlie.exe
        
        C:\Windows\system32\Pbdmdlie.exe
        448⤵
        Drops file in System32 directory
        
        PID:10912
        
        C:\Windows\SysWOW64\Pbifol32.exe
        
        C:\Windows\system32\Pbifol32.exe
        449⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Qkakhakq.exe
        
        C:\Windows\system32\Qkakhakq.exe
        450⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Agjhbbob.exe
        
        C:\Windows\system32\Agjhbbob.exe
        451⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Andqol32.exe
        
        C:\Windows\system32\Andqol32.exe
        452⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\Adnilfnl.exe
        
        C:\Windows\system32\Adnilfnl.exe
        453⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Aijeme32.exe
        
        C:\Windows\system32\Aijeme32.exe
        454⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\Aocmio32.exe
        
        C:\Windows\system32\Aocmio32.exe
        455⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\Akjnnpcf.exe
        
        C:\Windows\system32\Akjnnpcf.exe
        456⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\Afpbkicl.exe
        
        C:\Windows\system32\Afpbkicl.exe
        457⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Aecbge32.exe
        
        C:\Windows\system32\Aecbge32.exe
        458⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Afboah32.exe
        
        C:\Windows\system32\Afboah32.exe
        459⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Agckiqgg.exe
        
        C:\Windows\system32\Agckiqgg.exe
        460⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Aokcjngj.exe
        
        C:\Windows\system32\Aokcjngj.exe
        461⤵
        Drops file in System32 directory
        
        PID:11128
        
        C:\Windows\SysWOW64\Abipfifn.exe
        
        C:\Windows\system32\Abipfifn.exe
        462⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Bfghlhmd.exe
        
        C:\Windows\system32\Bfghlhmd.exe
        463⤵
        Modifies registry class
        
        PID:7740
        
        C:\Windows\SysWOW64\Bkdqdokk.exe
        
        C:\Windows\system32\Bkdqdokk.exe
        464⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\Bpomem32.exe
        
        C:\Windows\system32\Bpomem32.exe
        465⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Bfieagka.exe
        
        C:\Windows\system32\Bfieagka.exe
        466⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\Bihancje.exe
        
        C:\Windows\system32\Bihancje.exe
        467⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Bgkaip32.exe
        
        C:\Windows\system32\Bgkaip32.exe
        468⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Bpaikm32.exe
        
        C:\Windows\system32\Bpaikm32.exe
        469⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\Bbpeghpe.exe
        
        C:\Windows\system32\Bbpeghpe.exe
        470⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Bflagg32.exe
        
        C:\Windows\system32\Bflagg32.exe
        471⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7576
        
        C:\Windows\SysWOW64\Bijncb32.exe
        
        C:\Windows\system32\Bijncb32.exe
        472⤵
        Drops file in System32 directory
        
        PID:4284
        
        C:\Windows\SysWOW64\Bkhjpn32.exe
        
        C:\Windows\system32\Bkhjpn32.exe
        473⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\Bpdfpmoo.exe
        
        C:\Windows\system32\Bpdfpmoo.exe
        474⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Bbbblhnc.exe
        
        C:\Windows\system32\Bbbblhnc.exe
        475⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\Bgokdomj.exe
        
        C:\Windows\system32\Bgokdomj.exe
        476⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Bpfcelml.exe
        
        C:\Windows\system32\Bpfcelml.exe
        477⤵
        Drops file in System32 directory
        
        PID:1968
        
        C:\Windows\SysWOW64\Bnicai32.exe
        
        C:\Windows\system32\Bnicai32.exe
        478⤵
        
        PID:116
        
        C:\Windows\SysWOW64\Bfpkbfdi.exe
        
        C:\Windows\system32\Bfpkbfdi.exe
        479⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Ciogobcm.exe
        
        C:\Windows\system32\Ciogobcm.exe
        480⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Cgagjo32.exe
        
        C:\Windows\system32\Cgagjo32.exe
        481⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\Cnlpgibd.exe
        
        C:\Windows\system32\Cnlpgibd.exe
        482⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7728
        
        C:\Windows\SysWOW64\Cfbhhfbg.exe
        
        C:\Windows\system32\Cfbhhfbg.exe
        483⤵
        Modifies registry class
        
        PID:7244
        
        C:\Windows\SysWOW64\Ciaddaaj.exe
        
        C:\Windows\system32\Ciaddaaj.exe
        484⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Clpppmqn.exe
        
        C:\Windows\system32\Clpppmqn.exe
        485⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Cpklql32.exe
        
        C:\Windows\system32\Cpklql32.exe
        486⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Cfedmfqd.exe
        
        C:\Windows\system32\Cfedmfqd.exe
        487⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Chfaenfb.exe
        
        C:\Windows\system32\Chfaenfb.exe
        488⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\Cifmoa32.exe
        
        C:\Windows\system32\Cifmoa32.exe
        489⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Cppelkeb.exe
        
        C:\Windows\system32\Cppelkeb.exe
        490⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Cihjeq32.exe
        
        C:\Windows\system32\Cihjeq32.exe
        491⤵
        Drops file in System32 directory
        
        PID:4500
        
        C:\Windows\SysWOW64\Cnebmgjj.exe
        
        C:\Windows\system32\Cnebmgjj.exe
        492⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Cfljnejl.exe
        
        C:\Windows\system32\Cfljnejl.exe
        493⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Dijgjpip.exe
        
        C:\Windows\system32\Dijgjpip.exe
        494⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\Dngobghg.exe
        
        C:\Windows\system32\Dngobghg.exe
        495⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Dfngcdhi.exe
        
        C:\Windows\system32\Dfngcdhi.exe
        496⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\Dhpdkm32.exe
        
        C:\Windows\system32\Dhpdkm32.exe
        497⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\Dbehienn.exe
        
        C:\Windows\system32\Dbehienn.exe
        498⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Diopep32.exe
        
        C:\Windows\system32\Diopep32.exe
        499⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Dbgdnelk.exe
        
        C:\Windows\system32\Dbgdnelk.exe
        500⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\Defajqko.exe
        
        C:\Windows\system32\Defajqko.exe
        501⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Dhdmfljb.exe
        
        C:\Windows\system32\Dhdmfljb.exe
        502⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\Donecfao.exe
        
        C:\Windows\system32\Donecfao.exe
        503⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Dfemdcba.exe
        
        C:\Windows\system32\Dfemdcba.exe
        504⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\Dhgjll32.exe
        
        C:\Windows\system32\Dhgjll32.exe
        505⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Efhjjcpo.exe
        
        C:\Windows\system32\Efhjjcpo.exe
        506⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Eoconenj.exe
        
        C:\Windows\system32\Eoconenj.exe
        507⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Efjgpc32.exe
        
        C:\Windows\system32\Efjgpc32.exe
        508⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Elgohj32.exe
        
        C:\Windows\system32\Elgohj32.exe
        509⤵
        Drops file in System32 directory
        
        PID:8312
        
        C:\Windows\SysWOW64\Eoekde32.exe
        
        C:\Windows\system32\Eoekde32.exe
        510⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Eeodqocd.exe
        
        C:\Windows\system32\Eeodqocd.exe
        511⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Ehnpmkbg.exe
        
        C:\Windows\system32\Ehnpmkbg.exe
        512⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Epehnhbj.exe
        
        C:\Windows\system32\Epehnhbj.exe
        513⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1100
        
        C:\Windows\SysWOW64\Eeaqfo32.exe
        
        C:\Windows\system32\Eeaqfo32.exe
        514⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\Epgdch32.exe
        
        C:\Windows\system32\Epgdch32.exe
        515⤵
        Drops file in System32 directory
        
        PID:8708
        
        C:\Windows\SysWOW64\Ebeapc32.exe
        
        C:\Windows\system32\Ebeapc32.exe
        516⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Efampahd.exe
        
        C:\Windows\system32\Efampahd.exe
        517⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Eipilmgh.exe
        
        C:\Windows\system32\Eipilmgh.exe
        518⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Epiaig32.exe
        
        C:\Windows\system32\Epiaig32.exe
        519⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Fbhnec32.exe
        
        C:\Windows\system32\Fbhnec32.exe
        520⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\Fgcjea32.exe
        
        C:\Windows\system32\Fgcjea32.exe
        521⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Fplnogmb.exe
        
        C:\Windows\system32\Fplnogmb.exe
        522⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Feifgnki.exe
        
        C:\Windows\system32\Feifgnki.exe
        523⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Fhgccijm.exe
        
        C:\Windows\system32\Fhgccijm.exe
        524⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Fcmgpbjc.exe
        
        C:\Windows\system32\Fcmgpbjc.exe
        525⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Fifomlap.exe
        
        C:\Windows\system32\Fifomlap.exe
        526⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Flekihpc.exe
        
        C:\Windows\system32\Flekihpc.exe
        527⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Fcodfa32.exe
        
        C:\Windows\system32\Fcodfa32.exe
        528⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Fempbm32.exe
        
        C:\Windows\system32\Fempbm32.exe
        529⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\Fpcdof32.exe
        
        C:\Windows\system32\Fpcdof32.exe
        530⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Fikihlmj.exe
        
        C:\Windows\system32\Fikihlmj.exe
        531⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Gohapb32.exe
        
        C:\Windows\system32\Gohapb32.exe
        532⤵
        Drops file in System32 directory
        
        PID:5680
        
        C:\Windows\SysWOW64\Ggoiap32.exe
        
        C:\Windows\system32\Ggoiap32.exe
        533⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Ginenk32.exe
        
        C:\Windows\system32\Ginenk32.exe
        534⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Ghqeihbb.exe
        
        C:\Windows\system32\Ghqeihbb.exe
        535⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Ggafgo32.exe
        
        C:\Windows\system32\Ggafgo32.exe
        536⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Gedfblql.exe
        
        C:\Windows\system32\Gedfblql.exe
        537⤵
        Modifies registry class
        
        PID:8976
        
        C:\Windows\SysWOW64\Glnnofhi.exe
        
        C:\Windows\system32\Glnnofhi.exe
        538⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Gomkkagl.exe
        
        C:\Windows\system32\Gomkkagl.exe
        539⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6256
        
        C:\Windows\SysWOW64\Gchflq32.exe
        
        C:\Windows\system32\Gchflq32.exe
        540⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Gegchl32.exe
        
        C:\Windows\system32\Gegchl32.exe
        541⤵
        Modifies registry class
        
        PID:9128
        
        C:\Windows\SysWOW64\Gheodg32.exe
        
        C:\Windows\system32\Gheodg32.exe
        542⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Gplged32.exe
        
        C:\Windows\system32\Gplged32.exe
        543⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Gckcap32.exe
        
        C:\Windows\system32\Gckcap32.exe
        544⤵
        Modifies registry class
        
        PID:8972
        
        C:\Windows\SysWOW64\Geipnl32.exe
        
        C:\Windows\system32\Geipnl32.exe
        545⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\Ghgljg32.exe
        
        C:\Windows\system32\Ghgljg32.exe
        546⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Gcmpgpkp.exe
        
        C:\Windows\system32\Gcmpgpkp.exe
        547⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Hgmebnpd.exe
        
        C:\Windows\system32\Hgmebnpd.exe
        548⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Hljnkdnk.exe
        
        C:\Windows\system32\Hljnkdnk.exe
        549⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Hpejlc32.exe
        
        C:\Windows\system32\Hpejlc32.exe
        550⤵
        Drops file in System32 directory
        
        PID:10784
        
        C:\Windows\SysWOW64\Hcdfho32.exe
        
        C:\Windows\system32\Hcdfho32.exe
        551⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Hfbbdj32.exe
        
        C:\Windows\system32\Hfbbdj32.exe
        552⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Hgbonm32.exe
        
        C:\Windows\system32\Hgbonm32.exe
        553⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Hhckeeam.exe
        
        C:\Windows\system32\Hhckeeam.exe
        554⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Hqjcgbbo.exe
        
        C:\Windows\system32\Hqjcgbbo.exe
        555⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Hcipcnac.exe
        
        C:\Windows\system32\Hcipcnac.exe
        556⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\Hgdlcm32.exe
        
        C:\Windows\system32\Hgdlcm32.exe
        557⤵
        Modifies registry class
        
        PID:9416
        
        C:\Windows\SysWOW64\Hjbhph32.exe
        
        C:\Windows\system32\Hjbhph32.exe
        558⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\Hladlc32.exe
        
        C:\Windows\system32\Hladlc32.exe
        559⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Icklhnop.exe
        
        C:\Windows\system32\Icklhnop.exe
        560⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Ifihdi32.exe
        
        C:\Windows\system32\Ifihdi32.exe
        561⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Ijedehgm.exe
        
        C:\Windows\system32\Ijedehgm.exe
        562⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Iqombb32.exe
        
        C:\Windows\system32\Iqombb32.exe
        563⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Igieoleg.exe
        
        C:\Windows\system32\Igieoleg.exe
        564⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Ijgakgej.exe
        
        C:\Windows\system32\Ijgakgej.exe
        565⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Imfmgcdn.exe
        
        C:\Windows\system32\Imfmgcdn.exe
        566⤵
        Modifies registry class
        
        PID:9396
        
        C:\Windows\SysWOW64\Iodjcnca.exe
        
        C:\Windows\system32\Iodjcnca.exe
        567⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Igkadlcd.exe
        
        C:\Windows\system32\Igkadlcd.exe
        568⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Ijjnpg32.exe
        
        C:\Windows\system32\Ijjnpg32.exe
        569⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Imhjlb32.exe
        
        C:\Windows\system32\Imhjlb32.exe
        570⤵
        Drops file in System32 directory
        
        PID:4156
        
        C:\Windows\SysWOW64\Ioffhn32.exe
        
        C:\Windows\system32\Ioffhn32.exe
        571⤵
        Modifies registry class
        
        PID:6588
        
        C:\Windows\SysWOW64\Ijlkfg32.exe
        
        C:\Windows\system32\Ijlkfg32.exe
        572⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Ioicnn32.exe
        
        C:\Windows\system32\Ioicnn32.exe
        573⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Ijngkf32.exe
        
        C:\Windows\system32\Ijngkf32.exe
        574⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Jmmcgbnf.exe
        
        C:\Windows\system32\Jmmcgbnf.exe
        575⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Jqhphq32.exe
        
        C:\Windows\system32\Jqhphq32.exe
        576⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7060
        
        C:\Windows\SysWOW64\Jcgldl32.exe
        
        C:\Windows\system32\Jcgldl32.exe
        577⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\Jfehpg32.exe
        
        C:\Windows\system32\Jfehpg32.exe
        578⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6212
        
        C:\Windows\SysWOW64\Jicdlc32.exe
        
        C:\Windows\system32\Jicdlc32.exe
        579⤵
        Modifies registry class
        
        PID:5436
        
        C:\Windows\SysWOW64\Jmopmalc.exe
        
        C:\Windows\system32\Jmopmalc.exe
        580⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Jonlimkg.exe
        
        C:\Windows\system32\Jonlimkg.exe
        581⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\Jgedjjki.exe
        
        C:\Windows\system32\Jgedjjki.exe
        582⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Jjcqffkm.exe
        
        C:\Windows\system32\Jjcqffkm.exe
        583⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Jifabb32.exe
        
        C:\Windows\system32\Jifabb32.exe
        584⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Jqmicpbj.exe
        
        C:\Windows\system32\Jqmicpbj.exe
        585⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Jopiom32.exe
        
        C:\Windows\system32\Jopiom32.exe
        586⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Jfjakgpa.exe
        
        C:\Windows\system32\Jfjakgpa.exe
        587⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Jihngboe.exe
        
        C:\Windows\system32\Jihngboe.exe
        588⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Jmdjha32.exe
        
        C:\Windows\system32\Jmdjha32.exe
        589⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10952
        
        C:\Windows\SysWOW64\Jobfdl32.exe
        
        C:\Windows\system32\Jobfdl32.exe
        590⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Jginej32.exe
        
        C:\Windows\system32\Jginej32.exe
        591⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\Jikjmbmb.exe
        
        C:\Windows\system32\Jikjmbmb.exe
        592⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2876
        
        C:\Windows\SysWOW64\Jmffnq32.exe
        
        C:\Windows\system32\Jmffnq32.exe
        593⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\Jpdbjleo.exe
        
        C:\Windows\system32\Jpdbjleo.exe
        594⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Jglkkiea.exe
        
        C:\Windows\system32\Jglkkiea.exe
        595⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Kimgba32.exe
        
        C:\Windows\system32\Kimgba32.exe
        596⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Kpgoolbl.exe
        
        C:\Windows\system32\Kpgoolbl.exe
        597⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Kcbkpj32.exe
        
        C:\Windows\system32\Kcbkpj32.exe
        598⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\Kjlcmdbb.exe
        
        C:\Windows\system32\Kjlcmdbb.exe
        599⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Kiodha32.exe
        
        C:\Windows\system32\Kiodha32.exe
        600⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Kaflio32.exe
        
        C:\Windows\system32\Kaflio32.exe
        601⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Kgqdfi32.exe
        
        C:\Windows\system32\Kgqdfi32.exe
        602⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Kplijk32.exe
        
        C:\Windows\system32\Kplijk32.exe
        603⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Kgcqlh32.exe
        
        C:\Windows\system32\Kgcqlh32.exe
        604⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\Kjamhd32.exe
        
        C:\Windows\system32\Kjamhd32.exe
        605⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Kidmcqeg.exe
        
        C:\Windows\system32\Kidmcqeg.exe
        606⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Kakednfj.exe
        
        C:\Windows\system32\Kakednfj.exe
        607⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Kciaqi32.exe
        
        C:\Windows\system32\Kciaqi32.exe
        608⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7336
        
        C:\Windows\SysWOW64\Kgemahmg.exe
        
        C:\Windows\system32\Kgemahmg.exe
        609⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Kjcjmclj.exe
        
        C:\Windows\system32\Kjcjmclj.exe
        610⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7396
        
        C:\Windows\SysWOW64\Kmbfiokn.exe
        
        C:\Windows\system32\Kmbfiokn.exe
        611⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Kppbejka.exe
        
        C:\Windows\system32\Kppbejka.exe
        612⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Kclnfi32.exe
        
        C:\Windows\system32\Kclnfi32.exe
        613⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\Kfjjbd32.exe
        
        C:\Windows\system32\Kfjjbd32.exe
        614⤵
        
        PID:1848
        
        C:\Windows\SysWOW64\Lmdbooik.exe
        
        C:\Windows\system32\Lmdbooik.exe
        615⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10252
        
        C:\Windows\SysWOW64\Lpbokjho.exe
        
        C:\Windows\system32\Lpbokjho.exe
        616⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Lfmghdpl.exe
        
        C:\Windows\system32\Lfmghdpl.exe
        617⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Likcdpop.exe
        
        C:\Windows\system32\Likcdpop.exe
        618⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Lpelqj32.exe
        
        C:\Windows\system32\Lpelqj32.exe
        619⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\Lglcag32.exe
        
        C:\Windows\system32\Lglcag32.exe
        620⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Limpiomm.exe
        
        C:\Windows\system32\Limpiomm.exe
        621⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\Ladhkmno.exe
        
        C:\Windows\system32\Ladhkmno.exe
        622⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Lccdghmc.exe
        
        C:\Windows\system32\Lccdghmc.exe
        623⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Lfaqcclf.exe
        
        C:\Windows\system32\Lfaqcclf.exe
        624⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Lipmoo32.exe
        
        C:\Windows\system32\Lipmoo32.exe
        625⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Lagepl32.exe
        
        C:\Windows\system32\Lagepl32.exe
        626⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Lpjelibg.exe
        
        C:\Windows\system32\Lpjelibg.exe
        627⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Lhammfci.exe
        
        C:\Windows\system32\Lhammfci.exe
        628⤵
        Drops file in System32 directory
        
        PID:7552
        
        C:\Windows\SysWOW64\Ljoiibbm.exe
        
        C:\Windows\system32\Ljoiibbm.exe
        629⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Lmneemaq.exe
        
        C:\Windows\system32\Lmneemaq.exe
        630⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Laiafl32.exe
        
        C:\Windows\system32\Laiafl32.exe
        631⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Ldgnbg32.exe
        
        C:\Windows\system32\Ldgnbg32.exe
        632⤵
        
        PID:2720
        
        C:\Windows\SysWOW64\Mffjnc32.exe
        
        C:\Windows\system32\Mffjnc32.exe
        633⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Midfjnge.exe
        
        C:\Windows\system32\Midfjnge.exe
        634⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\Malnklgg.exe
        
        C:\Windows\system32\Malnklgg.exe
        635⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Mdjjgggk.exe
        
        C:\Windows\system32\Mdjjgggk.exe
        636⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\Mhefhf32.exe
        
        C:\Windows\system32\Mhefhf32.exe
        637⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10492
        
        C:\Windows\SysWOW64\Mhhcne32.exe
        
        C:\Windows\system32\Mhhcne32.exe
        638⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\Mjfoja32.exe
        
        C:\Windows\system32\Mjfoja32.exe
        639⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Mpchbhjl.exe
        
        C:\Windows\system32\Mpchbhjl.exe
        640⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Mfmpob32.exe
        
        C:\Windows\system32\Mfmpob32.exe
        641⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8824
        
        C:\Windows\SysWOW64\Miklkm32.exe
        
        C:\Windows\system32\Miklkm32.exe
        642⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\Mabdlk32.exe
        
        C:\Windows\system32\Mabdlk32.exe
        643⤵
        Modifies registry class
        
        PID:9176
        
        C:\Windows\SysWOW64\Mdaqhf32.exe
        
        C:\Windows\system32\Mdaqhf32.exe
        644⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Mfomda32.exe
        
        C:\Windows\system32\Mfomda32.exe
        645⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Minipm32.exe
        
        C:\Windows\system32\Minipm32.exe
        646⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\Mphamg32.exe
        
        C:\Windows\system32\Mphamg32.exe
        647⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Mhoind32.exe
        
        C:\Windows\system32\Mhoind32.exe
        648⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Njmejp32.exe
        
        C:\Windows\system32\Njmejp32.exe
        649⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\Nmlafk32.exe
        
        C:\Windows\system32\Nmlafk32.exe
        650⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Npjnbg32.exe
        
        C:\Windows\system32\Npjnbg32.exe
        651⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\Nfdfoala.exe
        
        C:\Windows\system32\Nfdfoala.exe
        652⤵
        
        PID:3408
        
        C:\Windows\SysWOW64\Nkpbpp32.exe
        
        C:\Windows\system32\Nkpbpp32.exe
        653⤵
        Modifies registry class
        
        PID:8432
        
        C:\Windows\SysWOW64\Nmnnlk32.exe
        
        C:\Windows\system32\Nmnnlk32.exe
        654⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\Nplkhf32.exe
        
        C:\Windows\system32\Nplkhf32.exe
        655⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\Nhcbidcd.exe
        
        C:\Windows\system32\Nhcbidcd.exe
        656⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Nieoal32.exe
        
        C:\Windows\system32\Nieoal32.exe
        657⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Nalgbi32.exe
        
        C:\Windows\system32\Nalgbi32.exe
        658⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\Ndjcne32.exe
        
        C:\Windows\system32\Ndjcne32.exe
        659⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Nkdlkope.exe
        
        C:\Windows\system32\Nkdlkope.exe
        660⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Nmbhgjoi.exe
        
        C:\Windows\system32\Nmbhgjoi.exe
        661⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9668
        
        C:\Windows\SysWOW64\Npadcfnl.exe
        
        C:\Windows\system32\Npadcfnl.exe
        662⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Nhhldc32.exe
        
        C:\Windows\system32\Nhhldc32.exe
        663⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Nkghqo32.exe
        
        C:\Windows\system32\Nkghqo32.exe
        664⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Nmedmj32.exe
        
        C:\Windows\system32\Nmedmj32.exe
        665⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9260
        
        C:\Windows\SysWOW64\Npcaie32.exe
        
        C:\Windows\system32\Npcaie32.exe
        666⤵
        Drops file in System32 directory
        
        PID:9372
        
        C:\Windows\SysWOW64\Ohkijc32.exe
        
        C:\Windows\system32\Ohkijc32.exe
        667⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Omgabj32.exe
        
        C:\Windows\system32\Omgabj32.exe
        668⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Opfnne32.exe
        
        C:\Windows\system32\Opfnne32.exe
        669⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Ohmepbki.exe
        
        C:\Windows\system32\Ohmepbki.exe
        670⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Okkalnjm.exe
        
        C:\Windows\system32\Okkalnjm.exe
        671⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Omjnhiiq.exe
        
        C:\Windows\system32\Omjnhiiq.exe
        672⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Ophjdehd.exe
        
        C:\Windows\system32\Ophjdehd.exe
        673⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6232
        
        C:\Windows\SysWOW64\Ohobebig.exe
        
        C:\Windows\system32\Ohobebig.exe
        674⤵
        Modifies registry class
        
        PID:6252
        
        C:\Windows\SysWOW64\Oknnanhj.exe
        
        C:\Windows\system32\Oknnanhj.exe
        675⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Omlkmign.exe
        
        C:\Windows\system32\Omlkmign.exe
        676⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Opjgidfa.exe
        
        C:\Windows\system32\Opjgidfa.exe
        677⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Ogdofo32.exe
        
        C:\Windows\system32\Ogdofo32.exe
        678⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Oickbjmb.exe
        
        C:\Windows\system32\Oickbjmb.exe
        679⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Opmcod32.exe
        
        C:\Windows\system32\Opmcod32.exe
        680⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Ohdlpa32.exe
        
        C:\Windows\system32\Ohdlpa32.exe
        681⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Okbhlm32.exe
        
        C:\Windows\system32\Okbhlm32.exe
        682⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\Onqdhh32.exe
        
        C:\Windows\system32\Onqdhh32.exe
        683⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Opopdd32.exe
        
        C:\Windows\system32\Opopdd32.exe
        684⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Phfhfa32.exe
        
        C:\Windows\system32\Phfhfa32.exe
        685⤵
        Drops file in System32 directory
        
        PID:1540
        
        C:\Windows\SysWOW64\Pkedbmab.exe
        
        C:\Windows\system32\Pkedbmab.exe
        686⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Pncanhaf.exe
        
        C:\Windows\system32\Pncanhaf.exe
        687⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Ppamjcpj.exe
        
        C:\Windows\system32\Ppamjcpj.exe
        688⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Phiekaql.exe
        
        C:\Windows\system32\Phiekaql.exe
        689⤵
        Drops file in System32 directory
        
        PID:9624
        
        C:\Windows\SysWOW64\Pkgaglpp.exe
        
        C:\Windows\system32\Pkgaglpp.exe
        690⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\Pnenchoc.exe
        
        C:\Windows\system32\Pnenchoc.exe
        691⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\Ppdjpcng.exe
        
        C:\Windows\system32\Ppdjpcng.exe
        692⤵
        
        PID:1036
        
        C:\Windows\SysWOW64\Phkaqqoi.exe
        
        C:\Windows\system32\Phkaqqoi.exe
        693⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\Pkinmlnm.exe
        
        C:\Windows\system32\Pkinmlnm.exe
        694⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\Pnhjig32.exe
        
        C:\Windows\system32\Pnhjig32.exe
        695⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7624
        
        C:\Windows\SysWOW64\Ppffec32.exe
        
        C:\Windows\system32\Ppffec32.exe
        696⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Phmnfp32.exe
        
        C:\Windows\system32\Phmnfp32.exe
        697⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11160
        
        C:\Windows\SysWOW64\Pklkbl32.exe
        
        C:\Windows\system32\Pklkbl32.exe
        698⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Pafcofcg.exe
        
        C:\Windows\system32\Pafcofcg.exe
        699⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Pddokabk.exe
        
        C:\Windows\system32\Pddokabk.exe
        700⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Pgbkgmao.exe
        
        C:\Windows\system32\Pgbkgmao.exe
        701⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Pjahchpb.exe
        
        C:\Windows\system32\Pjahchpb.exe
        702⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Pahpee32.exe
        
        C:\Windows\system32\Pahpee32.exe
        703⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\Qhbhapha.exe
        
        C:\Windows\system32\Qhbhapha.exe
        704⤵
        
        PID:3168
        
        C:\Windows\SysWOW64\Qkqdnkge.exe
        
        C:\Windows\system32\Qkqdnkge.exe
        705⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Qnopjfgi.exe
        
        C:\Windows\system32\Qnopjfgi.exe
        706⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Qpmmfbfl.exe
        
        C:\Windows\system32\Qpmmfbfl.exe
        707⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\Qhddgofo.exe
        
        C:\Windows\system32\Qhddgofo.exe
        708⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Qjeaog32.exe
        
        C:\Windows\system32\Qjeaog32.exe
        709⤵
        
        PID:452
        
        C:\Windows\SysWOW64\Aamipe32.exe
        
        C:\Windows\system32\Aamipe32.exe
        710⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Adkelplc.exe
        
        C:\Windows\system32\Adkelplc.exe
        711⤵
        Drops file in System32 directory
        
        PID:9640
        
        C:\Windows\SysWOW64\Agiahlkf.exe
        
        C:\Windows\system32\Agiahlkf.exe
        712⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Ajhndgjj.exe
        
        C:\Windows\system32\Ajhndgjj.exe
        713⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\Aaofedkl.exe
        
        C:\Windows\system32\Aaofedkl.exe
        714⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Ahinbo32.exe
        
        C:\Windows\system32\Ahinbo32.exe
        715⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Akgjnj32.exe
        
        C:\Windows\system32\Akgjnj32.exe
        716⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Anffje32.exe
        
        C:\Windows\system32\Anffje32.exe
        717⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Adpogp32.exe
        
        C:\Windows\system32\Adpogp32.exe
        718⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Akjgdjoj.exe
        
        C:\Windows\system32\Akjgdjoj.exe
        719⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Anhcpeon.exe
        
        C:\Windows\system32\Anhcpeon.exe
        720⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Aqfolqna.exe
        
        C:\Windows\system32\Aqfolqna.exe
        721⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Ahngmnnd.exe
        
        C:\Windows\system32\Ahngmnnd.exe
        722⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Aklciimh.exe
        
        C:\Windows\system32\Aklciimh.exe
        723⤵
        Drops file in System32 directory
        
        PID:2952
        
        C:\Windows\SysWOW64\Anjpeelk.exe
        
        C:\Windows\system32\Anjpeelk.exe
        724⤵
        
        PID:2080
        
        C:\Windows\SysWOW64\Addhbo32.exe
        
        C:\Windows\system32\Addhbo32.exe
        725⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Agcdnjcl.exe
        
        C:\Windows\system32\Agcdnjcl.exe
        726⤵
        Drops file in System32 directory
        
        PID:9152
        
        C:\Windows\SysWOW64\Ajaqjfbp.exe
        
        C:\Windows\system32\Ajaqjfbp.exe
        727⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Bbhhlccb.exe
        
        C:\Windows\system32\Bbhhlccb.exe
        728⤵
        
        PID:544
        
        C:\Windows\SysWOW64\Bdgehobe.exe
        
        C:\Windows\system32\Bdgehobe.exe
        729⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Bgeadjai.exe
        
        C:\Windows\system32\Bgeadjai.exe
        730⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Bjcmpepm.exe
        
        C:\Windows\system32\Bjcmpepm.exe
        731⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Bqnemp32.exe
        
        C:\Windows\system32\Bqnemp32.exe
        732⤵
        
        PID:556
        
        C:\Windows\SysWOW64\Bhennm32.exe
        
        C:\Windows\system32\Bhennm32.exe
        733⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Bnaffdfc.exe
        
        C:\Windows\system32\Bnaffdfc.exe
        734⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Bqpbboeg.exe
        
        C:\Windows\system32\Bqpbboeg.exe
        735⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Bjhgke32.exe
        
        C:\Windows\system32\Bjhgke32.exe
        736⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Bqbohocd.exe
        
        C:\Windows\system32\Bqbohocd.exe
        737⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Biigildg.exe
        
        C:\Windows\system32\Biigildg.exe
        738⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Bglgdi32.exe
        
        C:\Windows\system32\Bglgdi32.exe
        739⤵
        Drops file in System32 directory
        
        PID:5348
        
        C:\Windows\SysWOW64\Bjkcqdje.exe
        
        C:\Windows\system32\Bjkcqdje.exe
        740⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Bbbkbbkg.exe
        
        C:\Windows\system32\Bbbkbbkg.exe
        741⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Bdphnmjk.exe
        
        C:\Windows\system32\Bdphnmjk.exe
        742⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Bgodjiio.exe
        
        C:\Windows\system32\Bgodjiio.exe
        743⤵
        Drops file in System32 directory
        
        PID:9356
        
        C:\Windows\SysWOW64\Bjmpfdhb.exe
        
        C:\Windows\system32\Bjmpfdhb.exe
        744⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9436
        
        C:\Windows\SysWOW64\Cbdhgaid.exe
        
        C:\Windows\system32\Cbdhgaid.exe
        745⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Cqghcn32.exe
        
        C:\Windows\system32\Cqghcn32.exe
        746⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Cgaqphgl.exe
        
        C:\Windows\system32\Cgaqphgl.exe
        747⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\Cjomldfp.exe
        
        C:\Windows\system32\Cjomldfp.exe
        748⤵
        Drops file in System32 directory
        
        PID:10916
        
        C:\Windows\SysWOW64\Cqiehnml.exe
        
        C:\Windows\system32\Cqiehnml.exe
        749⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Ciqmjkno.exe
        
        C:\Windows\system32\Ciqmjkno.exe
        750⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Ckoifgmb.exe
        
        C:\Windows\system32\Ckoifgmb.exe
        751⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Cnmebblf.exe
        
        C:\Windows\system32\Cnmebblf.exe
        752⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Cegnol32.exe
        
        C:\Windows\system32\Cegnol32.exe
        753⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Cgejkh32.exe
        
        C:\Windows\system32\Cgejkh32.exe
        754⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Cnpbgajc.exe
        
        C:\Windows\system32\Cnpbgajc.exe
        755⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Canocm32.exe
        
        C:\Windows\system32\Canocm32.exe
        756⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Cjfclcpg.exe
        
        C:\Windows\system32\Cjfclcpg.exe
        757⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\Cbnknpqj.exe
        
        C:\Windows\system32\Cbnknpqj.exe
        758⤵
        
        PID:960
        
        C:\Windows\SysWOW64\Celgjlpn.exe
        
        C:\Windows\system32\Celgjlpn.exe
        759⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\Cgjcfgoa.exe
        
        C:\Windows\system32\Cgjcfgoa.exe
        760⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Dndlba32.exe
        
        C:\Windows\system32\Dndlba32.exe
        761⤵
        
        PID:948
        
        C:\Windows\SysWOW64\Dendok32.exe
        
        C:\Windows\system32\Dendok32.exe
        762⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Dgmpkg32.exe
        
        C:\Windows\system32\Dgmpkg32.exe
        763⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\Dbbdip32.exe
        
        C:\Windows\system32\Dbbdip32.exe
        764⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Dgomaf32.exe
        
        C:\Windows\system32\Dgomaf32.exe
        765⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Dnienqbi.exe
        
        C:\Windows\system32\Dnienqbi.exe
        766⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Decmjjie.exe
        
        C:\Windows\system32\Decmjjie.exe
        767⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\Dgaiffii.exe
        
        C:\Windows\system32\Dgaiffii.exe
        768⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Djpfbahm.exe
        
        C:\Windows\system32\Djpfbahm.exe
        769⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Dajnol32.exe
        
        C:\Windows\system32\Dajnol32.exe
        770⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Dhcfleff.exe
        
        C:\Windows\system32\Dhcfleff.exe
        771⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Dnnoip32.exe
        
        C:\Windows\system32\Dnnoip32.exe
        772⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\Dehgejep.exe
        
        C:\Windows\system32\Dehgejep.exe
        773⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\Dhfcae32.exe
        
        C:\Windows\system32\Dhfcae32.exe
        774⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\Eieplhlf.exe
        
        C:\Windows\system32\Eieplhlf.exe
        775⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Ejglcq32.exe
        
        C:\Windows\system32\Ejglcq32.exe
        776⤵
        Drops file in System32 directory
        
        PID:10672
        
        C:\Windows\SysWOW64\Ebnddn32.exe
        
        C:\Windows\system32\Ebnddn32.exe
        777⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Ehklmd32.exe
        
        C:\Windows\system32\Ehklmd32.exe
        778⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Enedio32.exe
        
        C:\Windows\system32\Enedio32.exe
        779⤵
        Modifies registry class
        
        PID:6672
        
        C:\Windows\SysWOW64\Eacaej32.exe
        
        C:\Windows\system32\Eacaej32.exe
        780⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10588
        
        C:\Windows\SysWOW64\Ehmibdol.exe
        
        C:\Windows\system32\Ehmibdol.exe
        781⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Ejkenpnp.exe
        
        C:\Windows\system32\Ejkenpnp.exe
        782⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Eaenkj32.exe
        
        C:\Windows\system32\Eaenkj32.exe
        783⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10860
        
        C:\Windows\SysWOW64\Eimelg32.exe
        
        C:\Windows\system32\Eimelg32.exe
        784⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Ejnbdp32.exe
        
        C:\Windows\system32\Ejnbdp32.exe
        785⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Ebejem32.exe
        
        C:\Windows\system32\Ebejem32.exe
        786⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Fjpoio32.exe
        
        C:\Windows\system32\Fjpoio32.exe
        787⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Fbnmkk32.exe
        
        C:\Windows\system32\Fbnmkk32.exe
        788⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Fiheheka.exe
        
        C:\Windows\system32\Fiheheka.exe
        789⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\Fbqiak32.exe
        
        C:\Windows\system32\Fbqiak32.exe
        790⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\Feofmf32.exe
        
        C:\Windows\system32\Feofmf32.exe
        791⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Ghmbib32.exe
        
        C:\Windows\system32\Ghmbib32.exe
        792⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Gbcffk32.exe
        
        C:\Windows\system32\Gbcffk32.exe
        793⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Glkkop32.exe
        
        C:\Windows\system32\Glkkop32.exe
        794⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Gojgkl32.exe
        
        C:\Windows\system32\Gojgkl32.exe
        795⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Giokid32.exe
        
        C:\Windows\system32\Giokid32.exe
        796⤵
        Drops file in System32 directory
        
        PID:7956
        
        C:\Windows\SysWOW64\Golcak32.exe
        
        C:\Windows\system32\Golcak32.exe
        797⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Gajpmg32.exe
        
        C:\Windows\system32\Gajpmg32.exe
        798⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Giahndcf.exe
        
        C:\Windows\system32\Giahndcf.exe
        799⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7840
        
        C:\Windows\SysWOW64\Gkcdfl32.exe
        
        C:\Windows\system32\Gkcdfl32.exe
        800⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5092
        
        C:\Windows\SysWOW64\Gbjlgj32.exe
        
        C:\Windows\system32\Gbjlgj32.exe
        801⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Gammbfqa.exe
        
        C:\Windows\system32\Gammbfqa.exe
        802⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Glbapoqh.exe
        
        C:\Windows\system32\Glbapoqh.exe
        803⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\Gclimi32.exe
        
        C:\Windows\system32\Gclimi32.exe
        804⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\Hifaic32.exe
        
        C:\Windows\system32\Hifaic32.exe
        805⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\Hkgnalep.exe
        
        C:\Windows\system32\Hkgnalep.exe
        806⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\Hcofbifb.exe
        
        C:\Windows\system32\Hcofbifb.exe
        807⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8644
        
        C:\Windows\SysWOW64\Hembndee.exe
        
        C:\Windows\system32\Hembndee.exe
        808⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Hkjjfkcm.exe
        
        C:\Windows\system32\Hkjjfkcm.exe
        809⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Hcabhido.exe
        
        C:\Windows\system32\Hcabhido.exe
        810⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Hepoddcc.exe
        
        C:\Windows\system32\Hepoddcc.exe
        811⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Hhnkppbf.exe
        
        C:\Windows\system32\Hhnkppbf.exe
        812⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Hccomh32.exe
        
        C:\Windows\system32\Hccomh32.exe
        813⤵
        Modifies registry class
        
        PID:1712
        
        C:\Windows\SysWOW64\Himgjbii.exe
        
        C:\Windows\system32\Himgjbii.exe
        814⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Hojpbigq.exe
        
        C:\Windows\system32\Hojpbigq.exe
        815⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Hahlnefd.exe
        
        C:\Windows\system32\Hahlnefd.exe
        816⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Hhbdko32.exe
        
        C:\Windows\system32\Hhbdko32.exe
        817⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\Hommhi32.exe
        
        C:\Windows\system32\Hommhi32.exe
        818⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Iefedcmk.exe
        
        C:\Windows\system32\Iefedcmk.exe
        819⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Iheaqolo.exe
        
        C:\Windows\system32\Iheaqolo.exe
        820⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Ikcmmjkb.exe
        
        C:\Windows\system32\Ikcmmjkb.exe
        821⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5516
        
        C:\Windows\SysWOW64\Iameid32.exe
        
        C:\Windows\system32\Iameid32.exe
        822⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Ihgnfnjl.exe
        
        C:\Windows\system32\Ihgnfnjl.exe
        823⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\Ikejbjip.exe
        
        C:\Windows\system32\Ikejbjip.exe
        824⤵
        
        PID:628
        
        C:\Windows\SysWOW64\Icmbcg32.exe
        
        C:\Windows\system32\Icmbcg32.exe
        825⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Ieknpb32.exe
        
        C:\Windows\system32\Ieknpb32.exe
        826⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Ihjjln32.exe
        
        C:\Windows\system32\Ihjjln32.exe
        827⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Ikhghi32.exe
        
        C:\Windows\system32\Ikhghi32.exe
        828⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Icooig32.exe
        
        C:\Windows\system32\Icooig32.exe
        829⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Ijigfaol.exe
        
        C:\Windows\system32\Ijigfaol.exe
        830⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\Ilgcblnp.exe
        
        C:\Windows\system32\Ilgcblnp.exe
        831⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Iofpnhmc.exe
        
        C:\Windows\system32\Iofpnhmc.exe
        832⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Iohlcg32.exe
        
        C:\Windows\system32\Iohlcg32.exe
        833⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Jfbdpabn.exe
        
        C:\Windows\system32\Jfbdpabn.exe
        834⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Jhqqlmba.exe
        
        C:\Windows\system32\Jhqqlmba.exe
        835⤵
        Modifies registry class
        
        PID:1288
        
        C:\Windows\SysWOW64\Jkomhhae.exe
        
        C:\Windows\system32\Jkomhhae.exe
        836⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9944
        
        C:\Windows\SysWOW64\Jcfejfag.exe
        
        C:\Windows\system32\Jcfejfag.exe
        837⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Jfdafa32.exe
        
        C:\Windows\system32\Jfdafa32.exe
        838⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Jloibkhh.exe
        
        C:\Windows\system32\Jloibkhh.exe
        839⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\Jomeoggk.exe
        
        C:\Windows\system32\Jomeoggk.exe
        840⤵
        Drops file in System32 directory
        
        PID:1448
        
        C:\Windows\SysWOW64\Jfgnka32.exe
        
        C:\Windows\system32\Jfgnka32.exe
        841⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Jhejgl32.exe
        
        C:\Windows\system32\Jhejgl32.exe
        842⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Jbnopbdl.exe
        
        C:\Windows\system32\Jbnopbdl.exe
        843⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Jjefao32.exe
        
        C:\Windows\system32\Jjefao32.exe
        844⤵
        Modifies registry class
        
        PID:5364
        
        C:\Windows\SysWOW64\Jkfcigkm.exe
        
        C:\Windows\system32\Jkfcigkm.exe
        845⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Jcmkjeko.exe
        
        C:\Windows\system32\Jcmkjeko.exe
        846⤵
        
        PID:540
        
        C:\Windows\SysWOW64\Jbpkfa32.exe
        
        C:\Windows\system32\Jbpkfa32.exe
        847⤵
        Modifies registry class
        
        PID:2936
        
        C:\Windows\SysWOW64\Jjgcgo32.exe
        
        C:\Windows\system32\Jjgcgo32.exe
        848⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\Jmepcj32.exe
        
        C:\Windows\system32\Jmepcj32.exe
        849⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Jodlof32.exe
        
        C:\Windows\system32\Jodlof32.exe
        850⤵
        
        PID:11316
        
        C:\Windows\SysWOW64\Kbbhka32.exe
        
        C:\Windows\system32\Kbbhka32.exe
        851⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Kjipmoai.exe
        
        C:\Windows\system32\Kjipmoai.exe
        852⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\Kmhlijpm.exe
        
        C:\Windows\system32\Kmhlijpm.exe
        853⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Kofheeoq.exe
        
        C:\Windows\system32\Kofheeoq.exe
        854⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11468
        
        C:\Windows\SysWOW64\Kbedaand.exe
        
        C:\Windows\system32\Kbedaand.exe
        855⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Kiomnk32.exe
        
        C:\Windows\system32\Kiomnk32.exe
        856⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Kcdakd32.exe
        
        C:\Windows\system32\Kcdakd32.exe
        857⤵
        Drops file in System32 directory
        
        PID:11604
        
        C:\Windows\SysWOW64\Kfbmgo32.exe
        
        C:\Windows\system32\Kfbmgo32.exe
        858⤵
        Drops file in System32 directory
        
        PID:11660
        
        C:\Windows\SysWOW64\Kiajck32.exe
        
        C:\Windows\system32\Kiajck32.exe
        859⤵
        
        PID:11712
        
        C:\Windows\SysWOW64\Kokbpe32.exe
        
        C:\Windows\system32\Kokbpe32.exe
        860⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Kbinlp32.exe
        
        C:\Windows\system32\Kbinlp32.exe
        861⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\Kjqfmn32.exe
        
        C:\Windows\system32\Kjqfmn32.exe
        862⤵
        
        PID:11840
        
        C:\Windows\SysWOW64\Kmobii32.exe
        
        C:\Windows\system32\Kmobii32.exe
        863⤵
        
        PID:11884
        
        C:\Windows\SysWOW64\Komoed32.exe
        
        C:\Windows\system32\Komoed32.exe
        864⤵
        Drops file in System32 directory
        
        PID:11924
        
        C:\Windows\SysWOW64\Kblkap32.exe
        
        C:\Windows\system32\Kblkap32.exe
        865⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\Kjcccm32.exe
        
        C:\Windows\system32\Kjcccm32.exe
        866⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\Kmaooihb.exe
        
        C:\Windows\system32\Kmaooihb.exe
        867⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\Lckglc32.exe
        
        C:\Windows\system32\Lckglc32.exe
        868⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12120
        
        C:\Windows\SysWOW64\Lfjchn32.exe
        
        C:\Windows\system32\Lfjchn32.exe
        869⤵
        Modifies registry class
        
        PID:12180
        
        C:\Windows\SysWOW64\Lihpdj32.exe
        
        C:\Windows\system32\Lihpdj32.exe
        870⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\Lobhqdec.exe
        
        C:\Windows\system32\Lobhqdec.exe
        871⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\Lbqdmodg.exe
        
        C:\Windows\system32\Lbqdmodg.exe
        872⤵
        
        PID:11268
        
        C:\Windows\SysWOW64\Lijlii32.exe
        
        C:\Windows\system32\Lijlii32.exe
        873⤵
        
        PID:11324
        
        C:\Windows\SysWOW64\Lkiiee32.exe
        
        C:\Windows\system32\Lkiiee32.exe
        874⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\Lcpqgbkj.exe
        
        C:\Windows\system32\Lcpqgbkj.exe
        875⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11464
        
        C:\Windows\SysWOW64\Lfnmcnjn.exe
        
        C:\Windows\system32\Lfnmcnjn.exe
        876⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\Limioiia.exe
        
        C:\Windows\system32\Limioiia.exe
        877⤵
        
        PID:11612
        
        C:\Windows\SysWOW64\Lkkekdhe.exe
        
        C:\Windows\system32\Lkkekdhe.exe
        878⤵
        
        PID:11708
        
        C:\Windows\SysWOW64\Lcbmlbig.exe
        
        C:\Windows\system32\Lcbmlbig.exe
        879⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\Ljleil32.exe
        
        C:\Windows\system32\Ljleil32.exe
        880⤵
        
        PID:11872
        
        C:\Windows\SysWOW64\Lmkbeg32.exe
        
        C:\Windows\system32\Lmkbeg32.exe
        881⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Lbgjmnno.exe
        
        C:\Windows\system32\Lbgjmnno.exe
        882⤵
        
        PID:12000
        
        C:\Windows\SysWOW64\Ljoboloa.exe
        
        C:\Windows\system32\Ljoboloa.exe
        883⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\Lmmokgne.exe
        
        C:\Windows\system32\Lmmokgne.exe
        884⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Mpkkgbmi.exe
        
        C:\Windows\system32\Mpkkgbmi.exe
        885⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\Mfeccm32.exe
        
        C:\Windows\system32\Mfeccm32.exe
        886⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Mmokpglb.exe
        
        C:\Windows\system32\Mmokpglb.exe
        887⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Mpnglbkf.exe
        
        C:\Windows\system32\Mpnglbkf.exe
        888⤵
        
        PID:11532
        
        C:\Windows\SysWOW64\Mbldhn32.exe
        
        C:\Windows\system32\Mbldhn32.exe
        889⤵
        
        PID:11704
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11704 -s 400
        890⤵
        Program crash
        
        PID:10820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 11704 -ip 11704
1⤵
PID:11896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ackbmcjl.exe

Filesize
53KB

MD5
cf24c910699407793fcaabbf0818c354

SHA1
715b0f09c1dd5093c28940b31cf346e44c5ed940

SHA256
f9bf8d275f7a85b4ed9dc92f244c6778419ff7530c5e8ab7e9bf7fa92a92a57d

SHA512
ba0f3ed3190fbf17a068b08a6b8d70aba0d40b862b893a18d700505be5973272a98fc2f1f910f2dcc7530dedc467ed7d1cba2ab64705f65d89b0d24c3da82873

Download Submit
C:\Windows\SysWOW64\Aklciimh.exe

Filesize
352KB

MD5
f24a73028ec02ba657f029557e401e57

SHA1
0091ebebbdd4eaf9f912d9585d3a94e40b0186ef

SHA256
1060b4023cf9a9feba9891348c6871b80f5ecc5793c5913c543c5c798a56dcd8

SHA512
b2f960779fe73beca88aa0921c6661b8bbf734926f544f6f58864625628da0d72dd6f856f386d4f9f8bd6a947fdecc314646fdd69de4e147337a4284e42ba685

Download Submit
C:\Windows\SysWOW64\Bffcpg32.exe

Filesize
256KB

MD5
d8bb316d1c570ccb483d2f5dae7400b8

SHA1
ec81d051d0cf6f33be1773923c4d7c53ff0b9dfa

SHA256
9ee7e5328d18e4f161e36efb4c25ae64ba726db15facbc27538f5489308037ea

SHA512
6af7b3587b95639659761524b077a93d5d11c1cf04925b695c0e6203c333a81782e53cf231f99a5eef955a16bbd5583ea8e53dbe2f72ae2707a613c3e37a60c6

Download Submit
C:\Windows\SysWOW64\Bqnemp32.exe

Filesize
352KB

MD5
8bd3ee09b596501c04631e32f61514e0

SHA1
2e862a50d03ce8488d423a183748c142a451d36b

SHA256
3e0e6ee60dea72f1bfa32a145a6cce1bfd685936007a0dc374213a1e19020b84

SHA512
628fdd630470843fbee31b34d9e05759680181d6c67433d5eaf90514e055ed42a08c3e1fdbc6798d861e42b592d6b5365b7a93cb85c6c9756295b4693bbf64bd

Download Submit
C:\Windows\SysWOW64\Dcpmen32.exe

Filesize
352KB

MD5
c14ca60753df2d5c8e800b786d1a9eda

SHA1
c3e91d77d5360114386203bdda614efabb729212

SHA256
d9f2737db559b34c744d70315a7c6dc1f1881db8f7637a1372763e77fbb1f766

SHA512
05209e5d2d3c572bf5a1a6d1d3eb5e7ddcc39bd0cd796f6ea169cc21c2895a79413698c59e491cda744a162a9c5175245a832769d1488778c03436dd68bca603

Download Submit
C:\Windows\SysWOW64\Ekdnei32.exe

Filesize
352KB

MD5
237e037ba280c706fe3f6f98c89aa992

SHA1
8759185da1409d99ad356e2fc3cc9df43e1716d1

SHA256
3e7ca229424bf293c0934e931ec2e861ded461b219da52ea3d4129d7ccf66cfc

SHA512
8ec6d985b6eb4877d4b5d4531d75c7b7225c87df6b676236925edce7ad388f7ea74b8c5248ca0d10727cab7c8ba3ac7826619e06412356c9f2c79339952d3f48

Download Submit
C:\Windows\SysWOW64\Gnqfcbnj.exe

Filesize
256KB

MD5
0589fd3ad566712520fc694723a2906f

SHA1
f231a9a974c2f887b4f5b586be1b3c1fdf484d0f

SHA256
db2b1cb2fa3997c8a533bb852038db31b088d300b7734fde60a78ecfc4f62149

SHA512
f87c19e484af13d7c43034de4c71dcbcae78d0fe5bea1797470597e5ab6b062a10400a5cfbf7bd0808f10106438955f95e69a818a46f89ce4b13e9d3d6205296

Download Submit
C:\Windows\SysWOW64\Hdmein32.exe

Filesize
352KB

MD5
dc3046eea9fb68511b982142c64bcfb3

SHA1
4e0ec6394fe35bb10834903c0c33ffda50952cb7

SHA256
c98bb26ef3dd56ec1584962d40e960f6d2659ae86a712eee4e8f111890ba30f2

SHA512
97e35c78e1f9854d98bc77213b58bf7ff30ef6bbeb76b22970d842ebe2876c282992b4b9c2e0bae543bba6ed82937eda66e272cba4e7a7f6bc1cc6a2d4b60978

Download Submit
C:\Windows\SysWOW64\Hgghjjid.exe

Filesize
352KB

MD5
0e23a4940372d8c8bfcb73a9e9ec10dd

SHA1
91b011dc0be5d38ee45714c4001865e4280839a3

SHA256
a96e0a7d943cef38e7a13314bc1106a3178264b2c0633d40db37b7e6a99c7684

SHA512
e007526ebad09d88c4521eddcd8e62ad81e77aa7ad033fda66465155dab9ff0cc4a684f6cb2acffe9852e58bf78624a12fa6a3283c4e068976cd5e81ef7b2d62

Download Submit
C:\Windows\SysWOW64\Hgiepjga.exe

Filesize
352KB

MD5
e7629d7fe599150b4b3c4528812bdc4f

SHA1
8ab55a9344e6d9ed28868a1314f2665715db3594

SHA256
a7cd26e69af6b35618f4ccefe58cc3dff218f37585d4c1c865594aae596fe014

SHA512
d9fe52fbc68d505cebf72168812977b2f9ccc967504c7632c8ec7599c0530793bbb83c4f9b208302c37655ab94da74315529cf7a227706681cc8b6b4038f3c31

Download Submit
C:\Windows\SysWOW64\Hgiepjga.exe

Filesize
250KB

MD5
b3aeb21c7abecb5d6f4439eea23a5666

SHA1
f7614bbd4610943d84599e9d93911d532322081b

SHA256
d21de6a07277c520c889a250256a018dfa48628d845e99e4cbf9b91c11db7c78

SHA512
49e819a6e2b3771b809822cbca2281a319507effd12c24de95e68ec1046e54f2987c49dad23f67d91d0e49c2d49db63e988e83e904216e3fb5f4a00d5d80ec21

Download Submit
C:\Windows\SysWOW64\Hhknpmma.exe

Filesize
352KB

MD5
d4f38cac9d5247d3dd3479b7ea7b1f14

SHA1
439c1ac0803fbb3cc26a83aaa7f042edc351b1a8

SHA256
135fbbb7856aab297dda0d184adb3814e9fc1a19ee4b60195d7a9c8ed2f7bb03

SHA512
3f8b8143997de5a5abdcde0aa96b2f1d3eabb94f4883271bffb8f4293748fe7c92ba914d19c090ca5f6fd1c9d57f164897f889814e4c92a6656f7cab24392cb1

Download Submit
C:\Windows\SysWOW64\Hhnkppbf.exe

Filesize
352KB

MD5
3ffbb1f6c6c23740b1e2a4a09e350604

SHA1
70b054ded0ec83eeacda7d0afcea5d2a2eede9e5

SHA256
714b101a1b76346a84b2fcae00d0522aaab7921c362133643085ecfa8be907f0

SHA512
fb682cb7dbd61f18188d3aa89c9f704c783b2d12f4deebe35febbfc486edd063534008ad83eaaaab804f0ca4aaf9beeddad5a7bd9d072fe25c8b5ba706012906

Download Submit
C:\Windows\SysWOW64\Hjlkge32.exe

Filesize
352KB

MD5
a22179ee273cf55b0de9360d7c11d296

SHA1
b62ebd36e6c0691f8de389dbeac61352bac61861

SHA256
0518abab9c93b655224c9a11a21a12dcac372bc922e8e0cfd8fd928439f75c28

SHA512
2262a805e88dc065bfe5fc5011ceffec8ce98a46afe85c321491e581768a1101b78b8373a6e376cfbc2c48548ad31b7f789e1d3b4e405e961ba334c53871922a

Download Submit
C:\Windows\SysWOW64\Igqkqiai.exe

Filesize
352KB

MD5
a934d4746235639935b10b725c070faf

SHA1
bd4674a78fc122d0ee0b918a266f5642ea430dc3

SHA256
8f4df775b2fae840c4037e9e7a658498a562ae476bc77f6a45b8c98691de1e00

SHA512
2a6c2a8112324d1ce9200a515649312b02269ccf695d08dc2cab5c1fdabf1c58ab97cfdf1aadb8d32b4b1f3010cb37cbcfc6527d7fa1b916ea764d2ea7bbd063

Download Submit
C:\Windows\SysWOW64\Ihphkl32.exe

Filesize
352KB

MD5
f02e8a849d8be1524dc7d2989c058dd1

SHA1
08da6e915bd278f4cf6ee111532d6affbc7c051a

SHA256
795da474af34d2bcb549524704ae67c3c907c5e16c066c5d2e1cf8b2951a54cb

SHA512
b40c6d64bc8dadb984424054f530eafc7271e6b1e01652fb9c3109f6bd1db0d275f10dd36aa8df381b33e9c6e5dba496af932530f8779c9d8a3622ef02420412

Download Submit
C:\Windows\SysWOW64\Iinjhh32.exe

Filesize
128KB

MD5
25f3e95bd45d0659b04ae799df55e221

SHA1
834b4d3f33f22902df454c5a5380d53d696b66c4

SHA256
9f487f50d118bdf5407298fe51bd0595f2bef80b28a3951a7170343048bb41ee

SHA512
b02d081adcb8ab2150c017e2c1e4a75b790d80f3c76253477aa110adbb24ad036546bc0e26fbd0746e2f9eb27ebe1e4fb0bfd191d3f8dec69875dbd08457430c

Download Submit
C:\Windows\SysWOW64\Ijcahd32.exe

Filesize
352KB

MD5
a8a3055b0261fb8d1225ab7015e559b3

SHA1
e7f51f69e20663f215bc55d003634a6ab11581a4

SHA256
73477c197f415370b82a839a7156cd42b5aa30291548a29543adaf53c9c19032

SHA512
f88b63c21b399998f9fc7ed9955a05640ec2fb02b08a7dd12acbffec51ee99a8bdeaafc5c5a443a1887d29e7f412526eaaa0294aa1212719d048d41799d88f28

Download Submit
C:\Windows\SysWOW64\Ijfnmc32.exe

Filesize
352KB

MD5
813df905df29e94ec3f4683fee0167b6

SHA1
253aa965d9a75bb7a1170e2a7ab4a0921fece005

SHA256
4aa91e17061f76e5bb988f0c5e74064fa1dcec7348cd7052ab47595419b55e3c

SHA512
3951fa5b39d70756e1cec10bd53bc64e2ff123b7394506b120bc4df5dca68c6dead019294fb434f6bac891c9a7bb3dd2ed2333cc7458768e89c4f89dfc103d30

Download Submit
C:\Windows\SysWOW64\Ijhjcchb.exe

Filesize
352KB

MD5
9286a977de703919c0c4c309bef0f1f3

SHA1
cdc5b385edbdd4511348f2f4af2ee51c5617c24b

SHA256
28555163f0ed0bd93b53c066e46a5b18c6cb11a9644f0a9d8895207149136394

SHA512
50ceb71d8bbf56049b1df2172d390a5df62183615d718497b891e169001a587ad4f7dcb2500a711f71e71dc81118fdf402dde2756d58af9a1446a0d0b5806b48

Download Submit
C:\Windows\SysWOW64\Iofpnhmc.exe

Filesize
352KB

MD5
7b2aef21453dcc38e22944adedef07ea

SHA1
3824042e003a3ca09633482f84a745d92284dc5a

SHA256
4801fc2a8cc008c820c817f0fefccfcc007e0c7005838df0db0c63b3b01d1dbb

SHA512
8d23a9df9b87f600f0fc89ba7d784b94e3e6255e1b8a21efcc4c614625c6193494e343663a761f165f97aef254b951611df04221abd2364deb60942ab6d7417c

Download Submit
C:\Windows\SysWOW64\Jhndljll.exe

Filesize
352KB

MD5
f854fc356c6e2c33ef7917fea59fa1d1

SHA1
613d73fe258f36eb4ee110dc53a0f21e2c0223d6

SHA256
03feb428059e01e734b2c225c14cc35ced2f0a02beb091264658287cceea0c2e

SHA512
fe34ec1b8a7d2ac4ac9cc06dc761ffa07212e05bef1f49c53c260413a72994d550072874578b999bbd468e01de0233884316256914ff6d101c9c2cf1d07d4d1e

Download Submit
C:\Windows\SysWOW64\Jjamia32.exe

Filesize
352KB

MD5
27498c90ba4215652dd7c37244a8549d

SHA1
16d4dabbb97c2475dcf72bda43841b6336db9ce6

SHA256
5ebe4c8595f845fb9f4f80902177ddae009fb41b1efd5f0444720d2b3fb396f0

SHA512
5bd6a5333645ff1d613ffaacb44589c8da9ecea5d732281c6f45bb3b484672c71c969fb068ce7040d357569a452cd79f16705eff02aca31c70ffd2d48bbf9bee

Download Submit
C:\Windows\SysWOW64\Jlfpdh32.exe

Filesize
352KB

MD5
709ad1282a5513d5b56863bfcfefc27d

SHA1
55881e851ab264a7ebb132b6d817430e04c54af3

SHA256
783fa48f053073029bc0c608fed18e5c10f454d700d198e4a687a350117e337b

SHA512
f246368515e43a4fa249e18182c62e22bb115dd3b9b43fb9fefaf9f7e53a97dc8346b746f99ec370c02b3999dea3280eda61074caa07c4b0945d6a89b1d321ae

Download Submit
C:\Windows\SysWOW64\Jomeoggk.exe

Filesize
352KB

MD5
07fda3dead257f0b9d1b1b1b8a270618

SHA1
b712bb5dad9547ef39e90b36d2395d18be7dc2fd

SHA256
cbe03eeefd2e5e33fd6f709ed27b9a55c51d3cff474275abb1a2db7663cb16b8

SHA512
70f9506d9fff9363ac95f46fa364e352c77d2d3b0db0c4cac159329b5be6ed882a10b3e0888af235dac4504848b37b9316f4cab4bd99556a243f201345cb0734

Download Submit
C:\Windows\SysWOW64\Jqlefl32.exe

Filesize
352KB

MD5
adae954aa5fccfddf4b5c317bd4af686

SHA1
2c028059aa6ff74eb0b1eafafd320c6fd9711b53

SHA256
e875f03b431e88473716c1592204865fd6eff333c400531bdfaa8bf2e4aac292

SHA512
74fea2b60f951cfad5137f1b9a79d7e9ffbadacbdac1effbd0aeaff72102c072bc4f74354319a13023a27d15eeeb5f5d46dbf3db465fd8400a5b08986b424c8b

Download Submit
C:\Windows\SysWOW64\Kbddfmgl.exe

Filesize
352KB

MD5
594fed1c26570d6201f7b273e7231a02

SHA1
4e1af0651a3f2610d4a7b8d4ef1e0a2df732a614

SHA256
1277e4f02b7a4bd703eea4489f3f299940154c850243f3dd8e6b117351b63def

SHA512
4410388e191d8246427ae51653d7b2c3c23ba8568ccdd72be4fcb422ffaafa2da14b07ff1b2629a63b8e1060e065ffd345735260a89405db7da2375c577937cb

Download Submit
C:\Windows\SysWOW64\Kbddfmgl.exe

Filesize
320KB

MD5
e62237677fd23dd2eaaf4a5d1532efba

SHA1
b01a982c49466bb2c953377552750e2fd014a2d2

SHA256
91f57e265c2b0f400dfec009e59b5c67df75f2a0521d1d24833f9ac9948ddf90

SHA512
d03176c6b9d5c316965987f0edd0ac64efab3aaa5fbde7cc30cf9bb470cc964a384c135c22946e9da9300210cb345ce1bb13d71ba7f6f838df2998371b11979f

Download Submit
C:\Windows\SysWOW64\Kdinljnk.exe

Filesize
352KB

MD5
f776ca6a1aa23af896d960ff8d255c4b

SHA1
aa214f51c20e184c29daa05752cd1058c72e6dd8

SHA256
d42c606aa5a6a16a4fa93a0f814351e1aeb3cd944a46f15f695e9dfb83c0081c

SHA512
e0f3471a372f595a25f3e70047d90df4a7c38500bd3bdb91217eccec11bd797ae24366c892d62e19e6d299b1393b2d6f5b20320c15ec3d32bb1834db9df91bc5

Download Submit
C:\Windows\SysWOW64\Kqbkfkal.exe

Filesize
352KB

MD5
ff775df1c809834513b69b1cb3cbcf19

SHA1
4c3172149f5ff1b29bd3aaa99c70d3e1d2e3f70a

SHA256
39d3de156f4fde9a5cafc8b2d437a815c95743cd7ac364f4272e0ec2fbbf1502

SHA512
fbf03e8ec4517f6fdf6dd21687ea7749eb9420b73c03b918be62fd764edf664171f684ea8e9fb666f12cd6d4b4f4cbf3ff84586ef94ba16a816f788ff88a2aca

Download Submit
C:\Windows\SysWOW64\Lejgch32.exe

Filesize
352KB

MD5
e5182a4d8e8c51a209e753dccda5e208

SHA1
4ac857139a89807af2e328ecedc3ae07b1b7fc3b

SHA256
139afd39ddac1a70de1b7cefaf1af16784af8039c58c1a29de51937b298e246f

SHA512
80c794590e7417e41e126a46fe6271cfb001d4ef687a2e56ec02601785a85a34df47e9ce81522442ef8ce234488199584dd1e87280c1d29162ce76c120bfc3a5

Download Submit
C:\Windows\SysWOW64\Leopnglc.exe

Filesize
352KB

MD5
aaf98c99845db37fb81b386a1af8001c

SHA1
062679313abaa3a404b36f946b663c427bd8d096

SHA256
99928a627dbe273272b96b050268927cec535269288c9e0daa6449cc08e9ce2d

SHA512
052b2da68399c6f36ced65e4bc45b074c3b3db1585d5955f8bf59b77d210554119e0b799e56d5f342035a83a47203152ef0cb3f467ad6e82dbc1da6181f74c64

Download Submit
C:\Windows\SysWOW64\Liqihglg.exe

Filesize
352KB

MD5
2fc78b9457a8a6a6e2c758c74bb3032b

SHA1
b3296fd922b38d069c84696f1f67a83080250b6f

SHA256
06b5a4e64016cc9b54e346c8b8a97d5109d206b069c27dd839b7dceddf69ce16

SHA512
f0558a03f5f777c38f7046e856047f3633670c894578c3b65fd47a1ae4ce7ea2a44aa8a17a316ae713d366c1386f84985eb00bf705c1ae69dfe249e473d12b53

Download Submit
C:\Windows\SysWOW64\Ljgpkonp.exe

Filesize
352KB

MD5
1bbe6b5fc8fe950c273dc74470f0183e

SHA1
be0e00d62a76c04ce0b9a0676fad261700c3a26e

SHA256
9a0f549495335d3c06c4b8512384c4f9ee486a9647d0794c6046411c47e44516

SHA512
080eb30c27c7b29557e51789b9c28bd3367631715936a4873d6c2cb0a551d345e4c61ce96d69356ead3e9ec71b10a502fc44ab7f2741864048e33b687f24005a

Download Submit
C:\Windows\SysWOW64\Ljqhkckn.exe

Filesize
352KB

MD5
caa81c49d0f6db8874f3e1b80dd3e3f1

SHA1
5faf1cbcc40cf69fed532bda88a65f08d7957e9f

SHA256
d115deea536442e8230d11f66eb23852d3a51f07298fa9c0510937eabe9488d2

SHA512
c5770b65acfb32f5965ce470b23e1ded9715753ffdcd213b9b60b29f043565b690bb61d947a983953e60f3d74fbdddc7db666a22859f3db3c1a4bc54b41f435e

Download Submit
C:\Windows\SysWOW64\Llflea32.exe

Filesize
352KB

MD5
23d9f86115705d23c6776de57533fa29

SHA1
413435f9275bf8a357287fa11677b90f7b451635

SHA256
55f95a9c6648bb42889f3f8f84b917eaeb343ab145bd31784eb48240be1cbf4e

SHA512
5d69b29a8db7bec5c0d5979a856c3c44f4fee9ebc0da71c1bb4173663bb6d71e54efc054bee2a0c616fd7f55c40afe80f3b71b80b9d1917851bd2c2108acb07f

Download Submit
C:\Windows\SysWOW64\Mbenmk32.exe

Filesize
352KB

MD5
31f4a8a976de18e84aac08277261a344

SHA1
d614411695245d045483fc4a6cb80e654f13d942

SHA256
73e4049cc422000fc7d4a9f85480ac3b84f1639a5c72f1c9bb363f9257ffe953

SHA512
dd0d23952485fc9e329e62a422966b5c7414fa8de372eb0b50b699e2dfcea0a46f59b278dc4d1fcdb16d090d239fba9cdb2643ba016b0647a37451563dedd949

Download Submit
C:\Windows\SysWOW64\Meefofek.exe

Filesize
352KB

MD5
e12f9e21e34e249fb7a28b58e77adfe7

SHA1
8037565372a318954d032742e39eb968d4437a2a

SHA256
b2b35a39eced6dc0e58f10b3c2bab98f743457c1e25367890a7e06ed8d4412ad

SHA512
95b036fecefd0931116247ebaa618b3fbea80e6304a6d91bfb0b75fd3487dc3ea424973e268ae083b410096b9d440981743ac038431c684371ff5c276aaf870f

Download Submit
C:\Windows\SysWOW64\Mhoipb32.exe

Filesize
352KB

MD5
561a20f8900c60deae80a0134f052e37

SHA1
20a42dbeab2455cebebdf5e8f70d0a154e8d66b2

SHA256
2d62b65c81bf4cd88356ecc54b86387af200c7990d5fa175fa0367f3f2f790fa

SHA512
55d5003270705c4e84f92a2fb0479f5d8363a63e6165e2cf1d2e59b86d43283a26cead644f8aaba56011b3f6294592d195346a9fbeca862f33a0154890456dda

Download Submit
C:\Windows\SysWOW64\Mjpbam32.exe

Filesize
352KB

MD5
649964d64ca930fadace49f2926139ba

SHA1
c313cb23f4ba567d20febe665c37f3bc3c2f33dc

SHA256
4430a804394bfa5e703483e90e17809549425ec39922488ebcc49b72c27846ea

SHA512
980838e4dddf3035a29c6128194aadb95b6616bd2e2a6c124edd2892126405052012b445ea10dbbc393e8c3c099c9f3f103bb494d2ce215a5bec61b8b8808c50

Download Submit
C:\Windows\SysWOW64\Mldhfpib.exe

Filesize
352KB

MD5
f5ea9803e37613494a1e6e146967663b

SHA1
e35688ba87e37dd4ce86bcaab54144a59fe59ab4

SHA256
db39d4c30ef6dc5f7af28297bc008a9533ba4a6ebcd5b71c7ae8db3a5c7a0d44

SHA512
a30e4999cff5691518f4338bb7e211029dbd763fa3f820fbc1e4a4228165e726afb179f151e0b87f425bd0e64b01e8bff753b14f8d4e069bddd085fbfc22f356

Download Submit
C:\Windows\SysWOW64\Mlpokp32.exe

Filesize
352KB

MD5
58b4580a84ecc0625d5af48924a95942

SHA1
5a743be78b4d2f5e2fd38a3004aa535ce614bb87

SHA256
7b4c2d54cccdc260bff85672771829413a6d057d65d6bc1a8badb5278b38b18d

SHA512
fb7f1c1129ad65f56e0009547010a9cdbf5ad58b74be3c46717b4fd5df97c7cf720a93a08e17659eda914f4a40804df48344f77bddcdc7502a55896970552dd7

Download Submit
C:\Windows\SysWOW64\Nelfeo32.exe

Filesize
352KB

MD5
f2a76ebfb6ff106f02cb4dca0e3bc057

SHA1
4cbd57a38a454561923a04b3a6ac95ba35d2859b

SHA256
1b83af4cc32d84b8a112821ee5adce78ac43e8575f01912c8704e3517c3708ef

SHA512
0d841aa9e3eee7be0bb484f3bb2589a9a05f7879a922bff97ab15bcdde4edf2714d35ce1a9dc0e96df01448ae639471b929841c4804ee258a64a913897bc84c0

Download Submit
C:\Windows\SysWOW64\Nggnadib.exe

Filesize
352KB

MD5
53bd6b4b0e4b1b4573f8b8bf945434c0

SHA1
91066bd2c3aec192b24ed326fa64a0faa64df8ef

SHA256
7beb54d3c4f5574039e54a3933c051da1e842bca10d4514fea5ecb7833bbd676

SHA512
081985563f27622b7afe124fda6e22e1249ad5ebdd701b04b2a24a4462f5e9a20eaa570a3d3e732b0d57f02859cc14eedceaa4282d621dd596bcc4bedc3dd60d

Download Submit
C:\Windows\SysWOW64\Niakfbpa.exe

Filesize
352KB

MD5
6017da28cafa090f4b117b8b0af081cd

SHA1
72a626149eab3f3f45698c4f6b318d8812d940d1

SHA256
1d78dc0111ab06b219b22585da126cc06cb36ea17eb5b50eade11633abc14d52

SHA512
aa6950416b92f992905419ed91bac7ee99754ef1a82eb7602146c7f742fd92c95691731c21dae48399b8ac9ec2567eac3666a07a89a54aaa54cf1f1df4e71840

Download Submit
C:\Windows\SysWOW64\Niakfbpa.exe

Filesize
297KB

MD5
29c6f15a8acc550ec63c5f5a752190c5

SHA1
ce433d096355d6799bfd38d1571e09ad3ea6d709

SHA256
25bb4a05a3e50f9866a7727ab5adb36654b03a064f757fc4ad7cfc031b989f87

SHA512
7e4d3da3d832941ebb3b47e3b890b49e9588daf174abd6a8d3366e6d682c10b82914fb8513eb915e95383b7f5e50581d38290be56bce2b1481905e2ca6f86f59

Download Submit
C:\Windows\SysWOW64\Njiegl32.exe

Filesize
352KB

MD5
76a46f01530036c88c1019d3c30a55a1

SHA1
811dfe3819ed1f5cc2228b8bae4319f0feb58ff7

SHA256
ea31c16ad3ed98d6d1f51d67d4bc0d7440669ba8a4ee82731c9df0106594a8f6

SHA512
1b9c88ec8f9de2981ba652d66030434e732745afd650c08f70b70ea743d726036292ff5ac33b8564cf6479439a2127a05b5c9163eda3a6944ea2c9420c0b48da

Download Submit
C:\Windows\SysWOW64\Oblmdhdo.exe

Filesize
5KB

MD5
b7e76b56a9f7ed7c62f0f3ded2c543f4

SHA1
efb6bf07f86375d1746d98af743ccfc6fff6e224

SHA256
55b9c6e705d8e18b411a571dc6b5d92f129016c573dd0e96c1a04dd220434226

SHA512
db07538d9551df4dbdd8d8c061333061940667c3e896a45e78823050e6a45ec82afd22b184bda61097da9edec35e15f0c47e1733bc308488115c66457025afa0

Download Submit
C:\Windows\SysWOW64\Oblmdhdo.exe

Filesize
1KB

MD5
eb0350067c368b1e87b7f4b2ed9eebbf

SHA1
a186b082560f1e67e55ac90072f48ea3817bc5d5

SHA256
835c06424ac88cb4f9b0ed05a77e19f2bda73cd4f2c007fdabb1c3e10c5307db

SHA512
daf2c4f72b7a48b53951b65e023fb67831e58baafaa415365732be1cc08d4e6b3569aec627435a8750eaae1af71b9032c4a9eb39b1f2ca83103cbf0fc9de87cc

Download Submit
C:\Windows\SysWOW64\Oehlkc32.exe

Filesize
121KB

MD5
786f95f41ce36d004f4bb065d9ada72a

SHA1
8aa4a2767300e461df8261780a4f50fdd8c0e88d

SHA256
bac03ad5854a80dc0e853e4b0580493333260ab21f0a2b5011bebe17542f8df5

SHA512
3f59aa243f34d23cdb2d74959159c7b395f2469f516117fc25dec59d4f4822f81ad0b2eacd48010943a9983590078163c9f69a4822579802f369d9531650d19c

Download Submit
C:\Windows\SysWOW64\Oehlkc32.exe

Filesize
208KB

MD5
4a4e648e98e4ed49cbccc19d8afa283a

SHA1
7066362416a3265047364ac7da85137ea9627f69

SHA256
7f8ea2e1576976a926b8d7775dd8f2f7fb922f23630bf3d4b2d69ec73bfcd2bc

SHA512
d5ce5394424a2841af4afaba1e6b3900f162b9a1e3a82d683d9cf3313b1da0dd3edc95f48617927a845bbbd612d7c2e43f246a6c433f4485f8486cbca4289729

Download Submit
C:\Windows\SysWOW64\Ojomcopk.exe

Filesize
352KB

MD5
712f19443da59e4a41fad8dc6b7dea76

SHA1
e2c1e9b1bcb0b55066f3b865826bbddf678fea1a

SHA256
0e735e3e2fc3b59d263fdc3af7363647f43b836110e51cc8975608be36773ad0

SHA512
7ab13e1a0eddeb34923cd0b08778c3d27fefcb2d15665727bde0a419b5af1cd54964d912773392e01f9f59c4d34291d37a125c5fdec6e96436bee005473508ad

Download Submit
C:\Windows\SysWOW64\Oocmii32.exe

Filesize
352KB

MD5
ea85e3fbbcdfcc38e721e45df8d6bf02

SHA1
404f26052d2114904901f006dbe0761dd7907fcf

SHA256
339bf8d820ae63b87e772a7a2f19296ac95fc6e0933cefb8ab8a7d0211a23c1e

SHA512
b9815cf8a7bc9b599c2ed30ca203a6921d7b44fe51773456dbe6c3d3e40e07f7ea777e26c0f4056fe316f3390aa587310a24985fb13ce1cd7e22507ebba35cc4

Download Submit
C:\Windows\SysWOW64\Pllgnl32.exe

Filesize
352KB

MD5
91842e628ce0371d267947223cd32589

SHA1
3c341910479fb50e31ff6ee90a2607e2f04cdc63

SHA256
37fdeb533addcefd3395fd1d5fbfdc88febf706ff2c337c3bf55fa4866260839

SHA512
04cea3151079e6800c198ae0a1b2058bc13c7b66e548ceea37157bfcefcf2f994f5d5b2bc768bf3dc853244d75dda81a171c62b6f6185cb64b5368ea2b91fcea

Download Submit
memory/100-344-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/400-250-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/628-162-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/664-72-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/668-435-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1056-419-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1132-262-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1432-82-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1616-218-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1628-106-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1644-336-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1764-41-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1792-194-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1856-276-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1892-25-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/1964-130-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2020-122-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2028-64-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2136-233-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2168-413-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2176-113-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2400-37-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2472-308-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2508-98-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2760-389-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2804-312-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2852-360-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/2936-358-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3064-330-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3096-210-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3100-401-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3196-383-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3352-288-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3420-395-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3460-300-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3500-298-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3508-425-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3604-264-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3656-186-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3664-53-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3668-202-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3732-180-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3772-21-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3780-137-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/3868-154-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4068-324-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4268-318-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4364-371-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4424-170-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4536-377-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4584-437-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4620-9-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4632-282-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4772-246-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4828-146-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4836-409-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4848-80-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4848-0-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4848-5-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/4868-231-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/5032-270-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/5092-56-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/5096-348-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download
memory/5108-89-0x0000000000400000-0x000000000047F000-memory.dmp

Filesize
508KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads