35d11db8184b259e5e67d75c48ac96095913aab5bcfac74be9b6e84807b7553b

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 20:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

35d11db8184b259e5e67d75c48ac96095913aab5bcfac74be9b6e84807b7553b.exe
Size

448KB
MD5

307019b996f45497ed60925435cbdaea
SHA1

9eb0f6eac7fe59819d0807f7b063325ec7984591
SHA256

35d11db8184b259e5e67d75c48ac96095913aab5bcfac74be9b6e84807b7553b
SHA512

39c7c34e9a5396de253b165a52e29011190f1674f6468cbf0cbc346ed988cdf4496a598a99c27c41a99eace584e1a7bfbf289b04decf6c3114bef09bf22a4b75
SSDEEP

6144:m+zM+uq+U/6s21L7/s50z/Wa3/PNlP59ENQdgrb8X6SJqGaPonZh/nr0xuIKjyAs:l7E705kWM/9J6gqGBf/sAHZHbgdhgi

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onocomdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckilmcgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddnobj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocdnln32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Epcdqd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkgnfhnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iddljmpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aokkahlo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikfabm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcobaedj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ifleoe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agiamhdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Caienjfd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmdlffhj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fneggdhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oepifi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgobel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klpakj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnnikdnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bidqko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Polppg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igdnabjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgobel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ifmqfm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gphgbafl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qlimed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Addaif32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkjafn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbgcih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkbkdkpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gphgbafl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aqkgpedc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfhhoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkehkocf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfchidda.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpecbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Innfnl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abponp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpijnqkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lehaho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckeimm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jepjhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jianff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kppici32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Neppokal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dclkee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nimbkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Giqkkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llcghg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mpablkhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohnebd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfpnph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nklbmllg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qlmgopjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Flinkojm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfhnaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdmmbq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idkbkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fpdcag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onkidm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlofcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkaicd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnfiplog.exe

Executes dropped EXE 64 IoCs

pid	Process
4784	Jpijnqkp.exe
3616	Jianff32.exe
4068	Jfeopj32.exe
3692	Lfkaag32.exe
5020	Llgjjnlj.exe
1868	Lepncd32.exe
4760	Lmiciaaj.exe
4072	Medgncoe.exe
2856	Mlopkm32.exe
4428	Mplhql32.exe
884	Mgfqmfde.exe
4568	Mdjagjco.exe
4964	Migjoaaf.exe
1056	Mpablkhc.exe
4116	Menjdbgj.exe
840	Ncbknfed.exe
4028	Ngpccdlj.exe
668	Nnjlpo32.exe
1656	Npjebj32.exe
2660	Nnneknob.exe
640	Nckndeni.exe
2244	Oflgep32.exe
2696	Ojjolnaq.exe
3108	Oqfdnhfk.exe
1632	Onjegled.exe
3004	Pqknig32.exe
3304	Pggbkagp.exe
4436	Pgioqq32.exe
4616	Pncgmkmj.exe
1520	Pjjhbl32.exe
1068	Pgnilpah.exe
3372	Qnhahj32.exe
3788	Qmmnjfnl.exe
2264	Qgcbgo32.exe
3196	Aqkgpedc.exe
868	Ageolo32.exe
4240	Ambgef32.exe
4448	Agglboim.exe
4840	Aeklkchg.exe
2104	Afmhck32.exe
4252	Aabmqd32.exe
4268	Aglemn32.exe
3448	Anfmjhmd.exe
3208	Aadifclh.exe
3468	Bfabnjjp.exe
4924	Bmkjkd32.exe
5088	Bebblb32.exe
1216	Bfdodjhm.exe
2792	Baicac32.exe
1276	Bgcknmop.exe
992	Bnmcjg32.exe
4788	Beglgani.exe
800	Bfhhoi32.exe
4640	Banllbdn.exe
4192	Bfkedibe.exe
2508	Bmemac32.exe
1176	Cjinkg32.exe
4360	Cenahpha.exe
4320	Cfpnph32.exe
4652	Cmiflbel.exe
2156	Chokikeb.exe
4076	Cmlcbbcj.exe
4188	Chagok32.exe
2804	Cnkplejl.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dfoplpla.exe	Ddadpdmn.exe
File created	C:\Windows\SysWOW64\Kdflmg32.dll	Phodcg32.exe
File opened for modification	C:\Windows\SysWOW64\Eiokinbk.exe	Deqcbpld.exe
File opened for modification	C:\Windows\SysWOW64\Hemdlj32.exe	Hfjdqmng.exe
File opened for modification	C:\Windows\SysWOW64\Kpiqfima.exe	Khbiello.exe
File opened for modification	C:\Windows\SysWOW64\Fgjccb32.exe	Fehfljca.exe
File created	C:\Windows\SysWOW64\Hfdhao32.dll	Ifihif32.exe
File created	C:\Windows\SysWOW64\Bidqko32.exe	Bfedoc32.exe
File created	C:\Windows\SysWOW64\Hiikaj32.dll	Nafjjf32.exe
File opened for modification	C:\Windows\SysWOW64\Aaohcj32.exe	Aoalgn32.exe
File created	C:\Windows\SysWOW64\Nflkbanj.exe	Nnafno32.exe
File created	C:\Windows\SysWOW64\Miiflecc.dll	Jeqbpb32.exe
File created	C:\Windows\SysWOW64\Lnnikdnj.exe	Lhdqnj32.exe
File opened for modification	C:\Windows\SysWOW64\Nookip32.exe	Nlqomd32.exe
File created	C:\Windows\SysWOW64\Lkabjbih.exe	Licfngjd.exe
File created	C:\Windows\SysWOW64\Pfandnla.exe	Pnfiplog.exe
File created	C:\Windows\SysWOW64\Qgaeof32.dll	Qdaniq32.exe
File opened for modification	C:\Windows\SysWOW64\Eopbnbhd.exe	Edknqiho.exe
File created	C:\Windows\SysWOW64\Dbikpjdg.dll	Hfklhhcl.exe
File opened for modification	C:\Windows\SysWOW64\Ahfdjanb.exe	Agdhbi32.exe
File opened for modification	C:\Windows\SysWOW64\Akglloai.exe	Aaohcj32.exe
File opened for modification	C:\Windows\SysWOW64\Bgbpaipl.exe	Baegibae.exe
File created	C:\Windows\SysWOW64\Cpbjkn32.exe	Ckebcg32.exe
File opened for modification	C:\Windows\SysWOW64\Agglboim.exe	Ambgef32.exe
File created	C:\Windows\SysWOW64\Cmmmdlag.dll	Gkobjpin.exe
File created	C:\Windows\SysWOW64\Gdfoio32.exe	Giqkkf32.exe
File created	C:\Windows\SysWOW64\Ggiabl32.dll	Mglfplgk.exe
File opened for modification	C:\Windows\SysWOW64\Ahcajk32.exe	Aaiimadl.exe
File created	C:\Windows\SysWOW64\Bjpjel32.exe	Bokehc32.exe
File created	C:\Windows\SysWOW64\Ongbqjjf.dll	Dnpdegjp.exe
File opened for modification	C:\Windows\SysWOW64\Ofgdcipq.exe	Oonlfo32.exe
File opened for modification	C:\Windows\SysWOW64\Aeklkchg.exe	Agglboim.exe
File opened for modification	C:\Windows\SysWOW64\Nomncpcg.exe	Nhbfff32.exe
File opened for modification	C:\Windows\SysWOW64\Pkcadhgm.exe	Pakllc32.exe
File created	C:\Windows\SysWOW64\Cdbcfp32.dll	Jcgnbaeo.exe
File created	C:\Windows\SysWOW64\Aonhghjl.exe	Aajhndkb.exe
File created	C:\Windows\SysWOW64\Fegbnohh.dll	Llcghg32.exe
File created	C:\Windows\SysWOW64\Fnmnbf32.dll	Dfnjafap.exe
File opened for modification	C:\Windows\SysWOW64\Bjcmebie.exe	Bciehh32.exe
File created	C:\Windows\SysWOW64\Fgbdja32.dll	Innfnl32.exe
File created	C:\Windows\SysWOW64\Mnjgghdi.dll	Aabmqd32.exe
File created	C:\Windows\SysWOW64\Mapmipen.dll	Jkomneim.exe
File created	C:\Windows\SysWOW64\Hmkjpibb.dll	Oadfkdgd.exe
File opened for modification	C:\Windows\SysWOW64\Nnjlpo32.exe	Ngpccdlj.exe
File created	C:\Windows\SysWOW64\Melmcj32.dll	Oehlkc32.exe
File created	C:\Windows\SysWOW64\Phlepppi.dll	Aaldccip.exe
File opened for modification	C:\Windows\SysWOW64\Fkhpfbce.exe	Fndpmndl.exe
File created	C:\Windows\SysWOW64\Hncmmd32.exe	Hhfedm32.exe
File created	C:\Windows\SysWOW64\Hkgnfhnh.exe	Hdmein32.exe
File created	C:\Windows\SysWOW64\Elcfgpga.dll	Kinmcg32.exe
File opened for modification	C:\Windows\SysWOW64\Agiamhdo.exe	Aobilkcl.exe
File opened for modification	C:\Windows\SysWOW64\Lkofdbkj.exe	Lbgalmej.exe
File created	C:\Windows\SysWOW64\Bcddcbab.exe	Bkmmaeap.exe
File created	C:\Windows\SysWOW64\Dnjfibml.dll	Akglloai.exe
File created	C:\Windows\SysWOW64\Klkfenfk.dll	Gimqajgh.exe
File created	C:\Windows\SysWOW64\Dnieoofh.dll	Cmiflbel.exe
File created	C:\Windows\SysWOW64\Pbpebh32.dll	Llbidimc.exe
File opened for modification	C:\Windows\SysWOW64\Pckppl32.exe	Plagcbdn.exe
File created	C:\Windows\SysWOW64\Ipjijkpg.dll	Dgcihgaj.exe
File opened for modification	C:\Windows\SysWOW64\Fndpmndl.exe	Fbmohmoh.exe
File created	C:\Windows\SysWOW64\Ddgplado.exe	Dbicpfdk.exe
File created	C:\Windows\SysWOW64\Cikamapb.dll	Hfhgkmpj.exe
File created	C:\Windows\SysWOW64\Kjgeedch.exe	Kjeiodek.exe
File opened for modification	C:\Windows\SysWOW64\Aokkahlo.exe	Apjkcadp.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1932	9240	WerFault.exe	912

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgbpaipl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnfkdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmefhako.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpkddhpn.dll"	Lclpdncg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egacbb32.dll"	Idhnkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pnfiplog.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ieojgc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnneknob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlleaeff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgdokkfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gnjjfegi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpkefnho.dll"	Njmhhefi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Feenjgfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chokikeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnmnbf32.dll"	Dfnjafap.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Flinkojm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfojmmbg.dll"	Paelfmaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dafmjm32.dll"	Ipgbdbqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aglafhih.dll"	Ihbponja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jicchk32.dll"	Lhcali32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ceelqcdb.dll"	Kenggi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bkmmaeap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Phigif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Monjjgkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pidabppl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjokgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ibmeoq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Popbpqjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ekhobd32.dll"	Aoalgn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Imiehfao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfehed32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hglppijc.dll"	Iakiia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhjlnlii.dll"	Pojcjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pehbea32.dll"	Cofecami.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogacbllg.dll"	Pecellgl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jeapcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmaplg32.dll"	Pcmlfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bidqko32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgknhl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpbfii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jomdjhoo.dll"	Nbadcpbh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Addaif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bpdnjple.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Idebdcdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmdjce32.dll"	Kppici32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gaebef32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lndagg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cikamapb.dll"	Hfhgkmpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glgpnm32.dll"	Ohghgodi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Polppg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fmpqfq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Doccpcja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgejpd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olojcl32.dll"	Lghcocol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hlambk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Meepdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmigpf32.dll"	Qlgpod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fehfljca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgjbbcpq.dll"	Glgjlm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfhgkmpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ingfla32.dll"	Cdhhdlid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdjibj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnkplejl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aplpihjd.dll"	Dakacjdb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 4784	3864	35d11db8184b259e5e67d75c48ac96095913aab5bcfac74be9b6e84807b7553b.exe	87
PID 3864 wrote to memory of 4784	3864	35d11db8184b259e5e67d75c48ac96095913aab5bcfac74be9b6e84807b7553b.exe	87
PID 3864 wrote to memory of 4784	3864	35d11db8184b259e5e67d75c48ac96095913aab5bcfac74be9b6e84807b7553b.exe	87
PID 4784 wrote to memory of 3616	4784	Jpijnqkp.exe	88
PID 4784 wrote to memory of 3616	4784	Jpijnqkp.exe	88
PID 4784 wrote to memory of 3616	4784	Jpijnqkp.exe	88
PID 3616 wrote to memory of 4068	3616	Jianff32.exe	89
PID 3616 wrote to memory of 4068	3616	Jianff32.exe	89
PID 3616 wrote to memory of 4068	3616	Jianff32.exe	89
PID 4068 wrote to memory of 3692	4068	Jfeopj32.exe	90
PID 4068 wrote to memory of 3692	4068	Jfeopj32.exe	90
PID 4068 wrote to memory of 3692	4068	Jfeopj32.exe	90
PID 3692 wrote to memory of 5020	3692	Lfkaag32.exe	91
PID 3692 wrote to memory of 5020	3692	Lfkaag32.exe	91
PID 3692 wrote to memory of 5020	3692	Lfkaag32.exe	91
PID 5020 wrote to memory of 1868	5020	Llgjjnlj.exe	93
PID 5020 wrote to memory of 1868	5020	Llgjjnlj.exe	93
PID 5020 wrote to memory of 1868	5020	Llgjjnlj.exe	93
PID 1868 wrote to memory of 4760	1868	Lepncd32.exe	95
PID 1868 wrote to memory of 4760	1868	Lepncd32.exe	95
PID 1868 wrote to memory of 4760	1868	Lepncd32.exe	95
PID 4760 wrote to memory of 4072	4760	Lmiciaaj.exe	97
PID 4760 wrote to memory of 4072	4760	Lmiciaaj.exe	97
PID 4760 wrote to memory of 4072	4760	Lmiciaaj.exe	97
PID 4072 wrote to memory of 2856	4072	Medgncoe.exe	98
PID 4072 wrote to memory of 2856	4072	Medgncoe.exe	98
PID 4072 wrote to memory of 2856	4072	Medgncoe.exe	98
PID 2856 wrote to memory of 4428	2856	Mlopkm32.exe	99
PID 2856 wrote to memory of 4428	2856	Mlopkm32.exe	99
PID 2856 wrote to memory of 4428	2856	Mlopkm32.exe	99
PID 4428 wrote to memory of 884	4428	Mplhql32.exe	100
PID 4428 wrote to memory of 884	4428	Mplhql32.exe	100
PID 4428 wrote to memory of 884	4428	Mplhql32.exe	100
PID 884 wrote to memory of 4568	884	Mgfqmfde.exe	101
PID 884 wrote to memory of 4568	884	Mgfqmfde.exe	101
PID 884 wrote to memory of 4568	884	Mgfqmfde.exe	101
PID 4568 wrote to memory of 4964	4568	Mdjagjco.exe	102
PID 4568 wrote to memory of 4964	4568	Mdjagjco.exe	102
PID 4568 wrote to memory of 4964	4568	Mdjagjco.exe	102
PID 4964 wrote to memory of 1056	4964	Migjoaaf.exe	103
PID 4964 wrote to memory of 1056	4964	Migjoaaf.exe	103
PID 4964 wrote to memory of 1056	4964	Migjoaaf.exe	103
PID 1056 wrote to memory of 4116	1056	Mpablkhc.exe	104
PID 1056 wrote to memory of 4116	1056	Mpablkhc.exe	104
PID 1056 wrote to memory of 4116	1056	Mpablkhc.exe	104
PID 4116 wrote to memory of 840	4116	Menjdbgj.exe	105
PID 4116 wrote to memory of 840	4116	Menjdbgj.exe	105
PID 4116 wrote to memory of 840	4116	Menjdbgj.exe	105
PID 840 wrote to memory of 4028	840	Ncbknfed.exe	106
PID 840 wrote to memory of 4028	840	Ncbknfed.exe	106
PID 840 wrote to memory of 4028	840	Ncbknfed.exe	106
PID 4028 wrote to memory of 668	4028	Ngpccdlj.exe	107
PID 4028 wrote to memory of 668	4028	Ngpccdlj.exe	107
PID 4028 wrote to memory of 668	4028	Ngpccdlj.exe	107
PID 668 wrote to memory of 1656	668	Nnjlpo32.exe	108
PID 668 wrote to memory of 1656	668	Nnjlpo32.exe	108
PID 668 wrote to memory of 1656	668	Nnjlpo32.exe	108
PID 1656 wrote to memory of 2660	1656	Npjebj32.exe	109
PID 1656 wrote to memory of 2660	1656	Npjebj32.exe	109
PID 1656 wrote to memory of 2660	1656	Npjebj32.exe	109
PID 2660 wrote to memory of 640	2660	Nnneknob.exe	110
PID 2660 wrote to memory of 640	2660	Nnneknob.exe	110
PID 2660 wrote to memory of 640	2660	Nnneknob.exe	110
PID 640 wrote to memory of 2244	640	Nckndeni.exe	111

C:\Users\Admin\AppData\Local\Temp\35d11db8184b259e5e67d75c48ac96095913aab5bcfac74be9b6e84807b7553b.exe
"C:\Users\Admin\AppData\Local\Temp\35d11db8184b259e5e67d75c48ac96095913aab5bcfac74be9b6e84807b7553b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Windows\SysWOW64\Jpijnqkp.exe
  C:\Windows\system32\Jpijnqkp.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\SysWOW64\Jianff32.exe
    C:\Windows\system32\Jianff32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3616
  - - C:\Windows\SysWOW64\Jfeopj32.exe
      C:\Windows\system32\Jfeopj32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4068
    - - C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3692
      - C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5020
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1868
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4760
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4072
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:884
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4964
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1056
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4116
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:840
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4028
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:668
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1656
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2660
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:640
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        23⤵
        Executes dropped EXE
        
        PID:2244
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        24⤵
        Executes dropped EXE
        
        PID:2696
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        25⤵
        Executes dropped EXE
        
        PID:3108
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        26⤵
        Executes dropped EXE
        
        PID:1632
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        27⤵
        Executes dropped EXE
        
        PID:3004
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        28⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        29⤵
        Executes dropped EXE
        
        PID:3304
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        30⤵
        Executes dropped EXE
        
        PID:4436
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        31⤵
        Executes dropped EXE
        
        PID:4616
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        32⤵
        Executes dropped EXE
        
        PID:1520
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        33⤵
        Executes dropped EXE
        
        PID:1068
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        34⤵
        Executes dropped EXE
        
        PID:3372
        
        C:\Windows\SysWOW64\Qmmnjfnl.exe
        
        C:\Windows\system32\Qmmnjfnl.exe
        35⤵
        Executes dropped EXE
        
        PID:3788
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        36⤵
        Executes dropped EXE
        
        PID:2264
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3196
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:868
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4240
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4448
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        41⤵
        Executes dropped EXE
        
        PID:4840
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        42⤵
        Executes dropped EXE
        
        PID:2104
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4252
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        44⤵
        Executes dropped EXE
        
        PID:4268
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        45⤵
        Executes dropped EXE
        
        PID:3448
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        46⤵
        Executes dropped EXE
        
        PID:3208
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        47⤵
        Executes dropped EXE
        
        PID:3468
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        48⤵
        Executes dropped EXE
        
        PID:4924
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        49⤵
        Executes dropped EXE
        
        PID:5088
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        50⤵
        Executes dropped EXE
        
        PID:1216
        
        C:\Windows\SysWOW64\Baicac32.exe
        
        C:\Windows\system32\Baicac32.exe
        51⤵
        Executes dropped EXE
        
        PID:2792
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        52⤵
        Executes dropped EXE
        
        PID:1276
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        53⤵
        Executes dropped EXE
        
        PID:992
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        54⤵
        Executes dropped EXE
        
        PID:4788
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:800
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        56⤵
        Executes dropped EXE
        
        PID:4640
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        57⤵
        Executes dropped EXE
        
        PID:4192
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        58⤵
        Executes dropped EXE
        
        PID:2508
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        59⤵
        Executes dropped EXE
        
        PID:1176
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        60⤵
        Executes dropped EXE
        
        PID:4360
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4320
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4652
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2156
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        64⤵
        Executes dropped EXE
        
        PID:4076
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        65⤵
        Executes dropped EXE
        
        PID:4188
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        66⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2804
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        67⤵
        Modifies registry class
        
        PID:3244
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        68⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        69⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        70⤵
        Modifies registry class
        
        PID:1104
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        71⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1940
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        72⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        73⤵
        
        PID:180
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        74⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        75⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        76⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\Egdqae32.exe
        
        C:\Windows\system32\Egdqae32.exe
        77⤵
        
        PID:2456
        
        C:\Windows\SysWOW64\Emoinpcd.exe
        
        C:\Windows\system32\Emoinpcd.exe
        78⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\Edhakj32.exe
        
        C:\Windows\system32\Edhakj32.exe
        79⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\Ekbihd32.exe
        
        C:\Windows\system32\Ekbihd32.exe
        80⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\Edknqiho.exe
        
        C:\Windows\system32\Edknqiho.exe
        81⤵
        Drops file in System32 directory
        
        PID:5132
        
        C:\Windows\SysWOW64\Eopbnbhd.exe
        
        C:\Windows\system32\Eopbnbhd.exe
        82⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Eaonjngh.exe
        
        C:\Windows\system32\Eaonjngh.exe
        83⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Ehiffh32.exe
        
        C:\Windows\system32\Ehiffh32.exe
        84⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Emeoooml.exe
        
        C:\Windows\system32\Emeoooml.exe
        85⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Eemgplno.exe
        
        C:\Windows\system32\Eemgplno.exe
        86⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Egnchd32.exe
        
        C:\Windows\system32\Egnchd32.exe
        87⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Feocelll.exe
        
        C:\Windows\system32\Feocelll.exe
        88⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Fkllnbjc.exe
        
        C:\Windows\system32\Fkllnbjc.exe
        89⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Fafdkmap.exe
        
        C:\Windows\system32\Fafdkmap.exe
        90⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Fhpmgg32.exe
        
        C:\Windows\system32\Fhpmgg32.exe
        91⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Fnmepn32.exe
        
        C:\Windows\system32\Fnmepn32.exe
        92⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Fdfmlhna.exe
        
        C:\Windows\system32\Fdfmlhna.exe
        93⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Fgeihcme.exe
        
        C:\Windows\system32\Fgeihcme.exe
        94⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Folaiqng.exe
        
        C:\Windows\system32\Folaiqng.exe
        95⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Fdijbg32.exe
        
        C:\Windows\system32\Fdijbg32.exe
        96⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Fonnop32.exe
        
        C:\Windows\system32\Fonnop32.exe
        97⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Fehfljca.exe
        
        C:\Windows\system32\Fehfljca.exe
        98⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5908
        
        C:\Windows\SysWOW64\Fgjccb32.exe
        
        C:\Windows\system32\Fgjccb32.exe
        99⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Foqkdp32.exe
        
        C:\Windows\system32\Foqkdp32.exe
        100⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Gkglja32.exe
        
        C:\Windows\system32\Gkglja32.exe
        101⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Gdppbfff.exe
        
        C:\Windows\system32\Gdppbfff.exe
        102⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Gnhdkl32.exe
        
        C:\Windows\system32\Gnhdkl32.exe
        103⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Ggqida32.exe
        
        C:\Windows\system32\Ggqida32.exe
        104⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Gnkaalkd.exe
        
        C:\Windows\system32\Gnkaalkd.exe
        105⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Gddinf32.exe
        
        C:\Windows\system32\Gddinf32.exe
        106⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Gkobjpin.exe
        
        C:\Windows\system32\Gkobjpin.exe
        107⤵
        Drops file in System32 directory
        
        PID:5412
        
        C:\Windows\SysWOW64\Gfdfgiid.exe
        
        C:\Windows\system32\Gfdfgiid.exe
        108⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Hnagak32.exe
        
        C:\Windows\system32\Hnagak32.exe
        109⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Hfipbh32.exe
        
        C:\Windows\system32\Hfipbh32.exe
        110⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\Hkehkocf.exe
        
        C:\Windows\system32\Hkehkocf.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5676
        
        C:\Windows\SysWOW64\Hfklhhcl.exe
        
        C:\Windows\system32\Hfklhhcl.exe
        112⤵
        Drops file in System32 directory
        
        PID:5776
        
        C:\Windows\SysWOW64\Hbbmmi32.exe
        
        C:\Windows\system32\Hbbmmi32.exe
        113⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Hkjafn32.exe
        
        C:\Windows\system32\Hkjafn32.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5916
        
        C:\Windows\SysWOW64\Hfpecg32.exe
        
        C:\Windows\system32\Hfpecg32.exe
        115⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Inkjhi32.exe
        
        C:\Windows\system32\Inkjhi32.exe
        116⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Idebdcdo.exe
        
        C:\Windows\system32\Idebdcdo.exe
        117⤵
        Modifies registry class
        
        PID:6100
        
        C:\Windows\SysWOW64\Ibicnh32.exe
        
        C:\Windows\system32\Ibicnh32.exe
        118⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Ikaggmii.exe
        
        C:\Windows\system32\Ikaggmii.exe
        119⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Idjlpc32.exe
        
        C:\Windows\system32\Idjlpc32.exe
        120⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Ifihif32.exe
        
        C:\Windows\system32\Ifihif32.exe
        121⤵
        Drops file in System32 directory
        
        PID:5496
        
        C:\Windows\SysWOW64\Ikfabm32.exe
        
        C:\Windows\system32\Ikfabm32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5592
        
        C:\Windows\SysWOW64\Ifleoe32.exe
        
        C:\Windows\system32\Ifleoe32.exe
        123⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5680
        
        C:\Windows\SysWOW64\Igmagnkg.exe
        
        C:\Windows\system32\Igmagnkg.exe
        124⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\Jbbfdfkn.exe
        
        C:\Windows\system32\Jbbfdfkn.exe
        125⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Jeqbpb32.exe
        
        C:\Windows\system32\Jeqbpb32.exe
        126⤵
        Drops file in System32 directory
        
        PID:5928
        
        C:\Windows\SysWOW64\Jkkjmlan.exe
        
        C:\Windows\system32\Jkkjmlan.exe
        127⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Jfpojead.exe
        
        C:\Windows\system32\Jfpojead.exe
        128⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Jgakbm32.exe
        
        C:\Windows\system32\Jgakbm32.exe
        129⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\Joiccj32.exe
        
        C:\Windows\system32\Joiccj32.exe
        130⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Jfbkpd32.exe
        
        C:\Windows\system32\Jfbkpd32.exe
        131⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Jiaglp32.exe
        
        C:\Windows\system32\Jiaglp32.exe
        132⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Jkodhk32.exe
        
        C:\Windows\system32\Jkodhk32.exe
        133⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Jnnpdg32.exe
        
        C:\Windows\system32\Jnnpdg32.exe
        134⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Jfehed32.exe
        
        C:\Windows\system32\Jfehed32.exe
        135⤵
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Jgfdmlcm.exe
        
        C:\Windows\system32\Jgfdmlcm.exe
        136⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Jblijebc.exe
        
        C:\Windows\system32\Jblijebc.exe
        137⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Jieagojp.exe
        
        C:\Windows\system32\Jieagojp.exe
        138⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\Kppici32.exe
        
        C:\Windows\system32\Kppici32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5184
        
        C:\Windows\SysWOW64\Kfjapcii.exe
        
        C:\Windows\system32\Kfjapcii.exe
        140⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Kgknhl32.exe
        
        C:\Windows\system32\Kgknhl32.exe
        141⤵
        Modifies registry class
        
        PID:6068
        
        C:\Windows\SysWOW64\Kpbfii32.exe
        
        C:\Windows\system32\Kpbfii32.exe
        142⤵
        Modifies registry class
        
        PID:5960
        
        C:\Windows\SysWOW64\Kflnfcgg.exe
        
        C:\Windows\system32\Kflnfcgg.exe
        143⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Klifnj32.exe
        
        C:\Windows\system32\Klifnj32.exe
        144⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Kbbokdlk.exe
        
        C:\Windows\system32\Kbbokdlk.exe
        145⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Kimghn32.exe
        
        C:\Windows\system32\Kimghn32.exe
        146⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Knippe32.exe
        
        C:\Windows\system32\Knippe32.exe
        147⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Kfqgab32.exe
        
        C:\Windows\system32\Kfqgab32.exe
        148⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Khbdikip.exe
        
        C:\Windows\system32\Khbdikip.exe
        149⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Knlleepl.exe
        
        C:\Windows\system32\Knlleepl.exe
        150⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Kfcdfbqo.exe
        
        C:\Windows\system32\Kfcdfbqo.exe
        151⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Lhdqnj32.exe
        
        C:\Windows\system32\Lhdqnj32.exe
        152⤵
        Drops file in System32 directory
        
        PID:6476
        
        C:\Windows\SysWOW64\Lnnikdnj.exe
        
        C:\Windows\system32\Lnnikdnj.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6532
        
        C:\Windows\SysWOW64\Lehaho32.exe
        
        C:\Windows\system32\Lehaho32.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6576
        
        C:\Windows\SysWOW64\Llbidimc.exe
        
        C:\Windows\system32\Llbidimc.exe
        155⤵
        Drops file in System32 directory
        
        PID:6620
        
        C:\Windows\SysWOW64\Lfhnaa32.exe
        
        C:\Windows\system32\Lfhnaa32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6664
        
        C:\Windows\SysWOW64\Lhijijbg.exe
        
        C:\Windows\system32\Lhijijbg.exe
        157⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Mlklkgei.exe
        
        C:\Windows\system32\Mlklkgei.exe
        158⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Mbedga32.exe
        
        C:\Windows\system32\Mbedga32.exe
        159⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Medqcmki.exe
        
        C:\Windows\system32\Medqcmki.exe
        160⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Mpieqeko.exe
        
        C:\Windows\system32\Mpieqeko.exe
        161⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Mefmimif.exe
        
        C:\Windows\system32\Mefmimif.exe
        162⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Mplafeil.exe
        
        C:\Windows\system32\Mplafeil.exe
        163⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Mhgfkg32.exe
        
        C:\Windows\system32\Mhgfkg32.exe
        164⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Mpnnle32.exe
        
        C:\Windows\system32\Mpnnle32.exe
        165⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Mblkhq32.exe
        
        C:\Windows\system32\Mblkhq32.exe
        166⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Mekgdl32.exe
        
        C:\Windows\system32\Mekgdl32.exe
        167⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Mhicpg32.exe
        
        C:\Windows\system32\Mhicpg32.exe
        168⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Mpqkad32.exe
        
        C:\Windows\system32\Mpqkad32.exe
        169⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Mbognp32.exe
        
        C:\Windows\system32\Mbognp32.exe
        170⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Nemcjk32.exe
        
        C:\Windows\system32\Nemcjk32.exe
        171⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Npchgdcd.exe
        
        C:\Windows\system32\Npchgdcd.exe
        172⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Nbadcpbh.exe
        
        C:\Windows\system32\Nbadcpbh.exe
        173⤵
        Modifies registry class
        
        PID:6584
        
        C:\Windows\SysWOW64\Neppokal.exe
        
        C:\Windows\system32\Neppokal.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6656
        
        C:\Windows\SysWOW64\Nlihle32.exe
        
        C:\Windows\system32\Nlihle32.exe
        175⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Nohehq32.exe
        
        C:\Windows\system32\Nohehq32.exe
        176⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Ngomin32.exe
        
        C:\Windows\system32\Ngomin32.exe
        177⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Niniei32.exe
        
        C:\Windows\system32\Niniei32.exe
        178⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\Nlleaeff.exe
        
        C:\Windows\system32\Nlleaeff.exe
        179⤵
        Modifies registry class
        
        PID:6892
        
        C:\Windows\SysWOW64\Nhbfff32.exe
        
        C:\Windows\system32\Nhbfff32.exe
        180⤵
        Drops file in System32 directory
        
        PID:6944
        
        C:\Windows\SysWOW64\Nomncpcg.exe
        
        C:\Windows\system32\Nomncpcg.exe
        181⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Neffpj32.exe
        
        C:\Windows\system32\Neffpj32.exe
        182⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Nlqomd32.exe
        
        C:\Windows\system32\Nlqomd32.exe
        183⤵
        Drops file in System32 directory
        
        PID:5408
        
        C:\Windows\SysWOW64\Nookip32.exe
        
        C:\Windows\system32\Nookip32.exe
        184⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Oeicejia.exe
        
        C:\Windows\system32\Oeicejia.exe
        185⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Ohgoaehe.exe
        
        C:\Windows\system32\Ohgoaehe.exe
        186⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Opogbbig.exe
        
        C:\Windows\system32\Opogbbig.exe
        187⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Oghppm32.exe
        
        C:\Windows\system32\Oghppm32.exe
        188⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        189⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Opadhb32.exe
        
        C:\Windows\system32\Opadhb32.exe
        190⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\Oenlqi32.exe
        
        C:\Windows\system32\Oenlqi32.exe
        191⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\Opcqnb32.exe
        
        C:\Windows\system32\Opcqnb32.exe
        192⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Ocamjm32.exe
        
        C:\Windows\system32\Ocamjm32.exe
        193⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Oepifi32.exe
        
        C:\Windows\system32\Oepifi32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6240
        
        C:\Windows\SysWOW64\Ohnebd32.exe
        
        C:\Windows\system32\Ohnebd32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6384
        
        C:\Windows\SysWOW64\Oohnonij.exe
        
        C:\Windows\system32\Oohnonij.exe
        196⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Ogpepl32.exe
        
        C:\Windows\system32\Ogpepl32.exe
        197⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Ojnblg32.exe
        
        C:\Windows\system32\Ojnblg32.exe
        198⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Pedbahod.exe
        
        C:\Windows\system32\Pedbahod.exe
        199⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Ploknb32.exe
        
        C:\Windows\system32\Ploknb32.exe
        200⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Pomgjn32.exe
        
        C:\Windows\system32\Pomgjn32.exe
        201⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Pgdokkfg.exe
        
        C:\Windows\system32\Pgdokkfg.exe
        202⤵
        Modifies registry class
        
        PID:6616
        
        C:\Windows\SysWOW64\Plagcbdn.exe
        
        C:\Windows\system32\Plagcbdn.exe
        203⤵
        Drops file in System32 directory
        
        PID:3736
        
        C:\Windows\SysWOW64\Pckppl32.exe
        
        C:\Windows\system32\Pckppl32.exe
        204⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Phhhhc32.exe
        
        C:\Windows\system32\Phhhhc32.exe
        205⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Pcmlfl32.exe
        
        C:\Windows\system32\Pcmlfl32.exe
        206⤵
        Modifies registry class
        
        PID:6844
        
        C:\Windows\SysWOW64\Pjgebf32.exe
        
        C:\Windows\system32\Pjgebf32.exe
        207⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Ppamophb.exe
        
        C:\Windows\system32\Ppamophb.exe
        208⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Pfnegggi.exe
        
        C:\Windows\system32\Pfnegggi.exe
        209⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Qjlnnemp.exe
        
        C:\Windows\system32\Qjlnnemp.exe
        210⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7244
        
        C:\Windows\SysWOW64\Agbkmijg.exe
        
        C:\Windows\system32\Agbkmijg.exe
        212⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Amodep32.exe
        
        C:\Windows\system32\Amodep32.exe
        213⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Agdhbi32.exe
        
        C:\Windows\system32\Agdhbi32.exe
        214⤵
        Drops file in System32 directory
        
        PID:7376
        
        C:\Windows\SysWOW64\Ahfdjanb.exe
        
        C:\Windows\system32\Ahfdjanb.exe
        215⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Aopmfk32.exe
        
        C:\Windows\system32\Aopmfk32.exe
        216⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Aggegh32.exe
        
        C:\Windows\system32\Aggegh32.exe
        217⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Amcmpodi.exe
        
        C:\Windows\system32\Amcmpodi.exe
        218⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Aobilkcl.exe
        
        C:\Windows\system32\Aobilkcl.exe
        219⤵
        Drops file in System32 directory
        
        PID:7596
        
        C:\Windows\SysWOW64\Agiamhdo.exe
        
        C:\Windows\system32\Agiamhdo.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7640
        
        C:\Windows\SysWOW64\Aqaffn32.exe
        
        C:\Windows\system32\Aqaffn32.exe
        221⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Acpbbi32.exe
        
        C:\Windows\system32\Acpbbi32.exe
        222⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Ajjjocap.exe
        
        C:\Windows\system32\Ajjjocap.exe
        223⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Bgnkhg32.exe
        
        C:\Windows\system32\Bgnkhg32.exe
        224⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Boipmj32.exe
        
        C:\Windows\system32\Boipmj32.exe
        225⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Bfchidda.exe
        
        C:\Windows\system32\Bfchidda.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7904
        
        C:\Windows\SysWOW64\Biadeoce.exe
        
        C:\Windows\system32\Biadeoce.exe
        227⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Bqilgmdg.exe
        
        C:\Windows\system32\Bqilgmdg.exe
        228⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Bfedoc32.exe
        
        C:\Windows\system32\Bfedoc32.exe
        229⤵
        Drops file in System32 directory
        
        PID:8044
        
        C:\Windows\SysWOW64\Bidqko32.exe
        
        C:\Windows\system32\Bidqko32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8080
        
        C:\Windows\SysWOW64\Bciehh32.exe
        
        C:\Windows\system32\Bciehh32.exe
        231⤵
        Drops file in System32 directory
        
        PID:8140
        
        C:\Windows\SysWOW64\Bjcmebie.exe
        
        C:\Windows\system32\Bjcmebie.exe
        232⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Bqmeal32.exe
        
        C:\Windows\system32\Bqmeal32.exe
        233⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Bggnof32.exe
        
        C:\Windows\system32\Bggnof32.exe
        234⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Bjfjka32.exe
        
        C:\Windows\system32\Bjfjka32.exe
        235⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Cmdfgm32.exe
        
        C:\Windows\system32\Cmdfgm32.exe
        236⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Ccnncgmc.exe
        
        C:\Windows\system32\Ccnncgmc.exe
        237⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Cikglnkj.exe
        
        C:\Windows\system32\Cikglnkj.exe
        238⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Cpeohh32.exe
        
        C:\Windows\system32\Cpeohh32.exe
        239⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Cfogeb32.exe
        
        C:\Windows\system32\Cfogeb32.exe
        240⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Ccchof32.exe
        
        C:\Windows\system32\Ccchof32.exe
        241⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Cfadkb32.exe
        
        C:\Windows\system32\Cfadkb32.exe
        242⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Cippgm32.exe
        
        C:\Windows\system32\Cippgm32.exe
        243⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Cpihcgoa.exe
        
        C:\Windows\system32\Cpihcgoa.exe
        244⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Cjomap32.exe
        
        C:\Windows\system32\Cjomap32.exe
        245⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Caienjfd.exe
        
        C:\Windows\system32\Caienjfd.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7476
        
        C:\Windows\SysWOW64\Ccgajfeh.exe
        
        C:\Windows\system32\Ccgajfeh.exe
        247⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Cjaifp32.exe
        
        C:\Windows\system32\Cjaifp32.exe
        248⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Dakacjdb.exe
        
        C:\Windows\system32\Dakacjdb.exe
        249⤵
        Modifies registry class
        
        PID:7920
        
        C:\Windows\SysWOW64\Dgejpd32.exe
        
        C:\Windows\system32\Dgejpd32.exe
        250⤵
        Modifies registry class
        
        PID:8052
        
        C:\Windows\SysWOW64\Dmbbhkjf.exe
        
        C:\Windows\system32\Dmbbhkjf.exe
        251⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Dclkee32.exe
        
        C:\Windows\system32\Dclkee32.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1596
        
        C:\Windows\SysWOW64\Dapkni32.exe
        
        C:\Windows\system32\Dapkni32.exe
        253⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Dhjckcgi.exe
        
        C:\Windows\system32\Dhjckcgi.exe
        254⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Dikpbl32.exe
        
        C:\Windows\system32\Dikpbl32.exe
        255⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Ddadpdmn.exe
        
        C:\Windows\system32\Ddadpdmn.exe
        256⤵
        Drops file in System32 directory
        
        PID:7264
        
        C:\Windows\SysWOW64\Dfoplpla.exe
        
        C:\Windows\system32\Dfoplpla.exe
        257⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Dmihij32.exe
        
        C:\Windows\system32\Dmihij32.exe
        258⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Dpgeee32.exe
        
        C:\Windows\system32\Dpgeee32.exe
        259⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Dhomfc32.exe
        
        C:\Windows\system32\Dhomfc32.exe
        260⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Emlenj32.exe
        
        C:\Windows\system32\Emlenj32.exe
        261⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        262⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Eaindh32.exe
        
        C:\Windows\system32\Eaindh32.exe
        263⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Eidbij32.exe
        
        C:\Windows\system32\Eidbij32.exe
        264⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Ejdocm32.exe
        
        C:\Windows\system32\Ejdocm32.exe
        265⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Epagkd32.exe
        
        C:\Windows\system32\Epagkd32.exe
        266⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Ehhpla32.exe
        
        C:\Windows\system32\Ehhpla32.exe
        267⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Eiildjag.exe
        
        C:\Windows\system32\Eiildjag.exe
        268⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Epcdqd32.exe
        
        C:\Windows\system32\Epcdqd32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8528
        
        C:\Windows\SysWOW64\Efmmmn32.exe
        
        C:\Windows\system32\Efmmmn32.exe
        270⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Facqkg32.exe
        
        C:\Windows\system32\Facqkg32.exe
        271⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        272⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Fdcjlb32.exe
        
        C:\Windows\system32\Fdcjlb32.exe
        273⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Fknbil32.exe
        
        C:\Windows\system32\Fknbil32.exe
        274⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Fagjfflb.exe
        
        C:\Windows\system32\Fagjfflb.exe
        275⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Fhabbp32.exe
        
        C:\Windows\system32\Fhabbp32.exe
        276⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Fmnkkg32.exe
        
        C:\Windows\system32\Fmnkkg32.exe
        277⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Fdhcgaic.exe
        
        C:\Windows\system32\Fdhcgaic.exe
        278⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Fkbkdkpp.exe
        
        C:\Windows\system32\Fkbkdkpp.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8948
        
        C:\Windows\SysWOW64\Gkdhjknm.exe
        
        C:\Windows\system32\Gkdhjknm.exe
        280⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Gaopfe32.exe
        
        C:\Windows\system32\Gaopfe32.exe
        281⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9080
        
        C:\Windows\SysWOW64\Ggkiol32.exe
        
        C:\Windows\system32\Ggkiol32.exe
        283⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Gijekg32.exe
        
        C:\Windows\system32\Gijekg32.exe
        284⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        285⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Ggnedlao.exe
        
        C:\Windows\system32\Ggnedlao.exe
        286⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Gnhnaf32.exe
        
        C:\Windows\system32\Gnhnaf32.exe
        287⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\Gpfjma32.exe
        
        C:\Windows\system32\Gpfjma32.exe
        288⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Ghmbno32.exe
        
        C:\Windows\system32\Ghmbno32.exe
        289⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Gnjjfegi.exe
        
        C:\Windows\system32\Gnjjfegi.exe
        290⤵
        Modifies registry class
        
        PID:8560
        
        C:\Windows\SysWOW64\Gphgbafl.exe
        
        C:\Windows\system32\Gphgbafl.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8644
        
        C:\Windows\SysWOW64\Ghpocngo.exe
        
        C:\Windows\system32\Ghpocngo.exe
        292⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Giqkkf32.exe
        
        C:\Windows\system32\Giqkkf32.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8812
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        294⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Hajpbckl.exe
        
        C:\Windows\system32\Hajpbckl.exe
        295⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        296⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Hhfedm32.exe
        
        C:\Windows\system32\Hhfedm32.exe
        297⤵
        Drops file in System32 directory
        
        PID:9092
        
        C:\Windows\SysWOW64\Hncmmd32.exe
        
        C:\Windows\system32\Hncmmd32.exe
        298⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        299⤵
        Drops file in System32 directory
        
        PID:7316
        
        C:\Windows\SysWOW64\Hkgnfhnh.exe
        
        C:\Windows\system32\Hkgnfhnh.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8268
        
        C:\Windows\SysWOW64\Hgnoki32.exe
        
        C:\Windows\system32\Hgnoki32.exe
        301⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Ihnkel32.exe
        
        C:\Windows\system32\Ihnkel32.exe
        302⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Injcmc32.exe
        
        C:\Windows\system32\Injcmc32.exe
        303⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Iddljmpc.exe
        
        C:\Windows\system32\Iddljmpc.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8792
        
        C:\Windows\SysWOW64\Igchfiof.exe
        
        C:\Windows\system32\Igchfiof.exe
        305⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Ijadbdoj.exe
        
        C:\Windows\system32\Ijadbdoj.exe
        306⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        307⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Ihbdplfi.exe
        
        C:\Windows\system32\Ihbdplfi.exe
        308⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        309⤵
        Modifies registry class
        
        PID:8408
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        310⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Ibmeoq32.exe
        
        C:\Windows\system32\Ibmeoq32.exe
        311⤵
        Modifies registry class
        
        PID:8776
        
        C:\Windows\SysWOW64\Idkbkl32.exe
        
        C:\Windows\system32\Idkbkl32.exe
        312⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8924
        
        C:\Windows\SysWOW64\Ijhjcchb.exe
        
        C:\Windows\system32\Ijhjcchb.exe
        313⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        314⤵
        Drops file in System32 directory
        
        PID:8452
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        315⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Jibmgi32.exe
        
        C:\Windows\system32\Jibmgi32.exe
        316⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\Jkaicd32.exe
        
        C:\Windows\system32\Jkaicd32.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3868
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        318⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        319⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        320⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        321⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Kenggi32.exe
        
        C:\Windows\system32\Kenggi32.exe
        322⤵
        Modifies registry class
        
        PID:8980
        
        C:\Windows\SysWOW64\Kgmcce32.exe
        
        C:\Windows\system32\Kgmcce32.exe
        323⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Kniieo32.exe
        
        C:\Windows\system32\Kniieo32.exe
        324⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\Kinmcg32.exe
        
        C:\Windows\system32\Kinmcg32.exe
        325⤵
        Drops file in System32 directory
        
        PID:9152
        
        C:\Windows\SysWOW64\Lbgalmej.exe
        
        C:\Windows\system32\Lbgalmej.exe
        326⤵
        Drops file in System32 directory
        
        PID:8524
        
        C:\Windows\SysWOW64\Lkofdbkj.exe
        
        C:\Windows\system32\Lkofdbkj.exe
        327⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Licfngjd.exe
        
        C:\Windows\system32\Licfngjd.exe
        328⤵
        Drops file in System32 directory
        
        PID:9220
        
        C:\Windows\SysWOW64\Lkabjbih.exe
        
        C:\Windows\system32\Lkabjbih.exe
        329⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        330⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        331⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Lghcocol.exe
        
        C:\Windows\system32\Lghcocol.exe
        332⤵
        Modifies registry class
        
        PID:9400
        
        C:\Windows\SysWOW64\Lnbklm32.exe
        
        C:\Windows\system32\Lnbklm32.exe
        333⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Lelchgne.exe
        
        C:\Windows\system32\Lelchgne.exe
        334⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        335⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Lbpdblmo.exe
        
        C:\Windows\system32\Lbpdblmo.exe
        336⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        337⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        338⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Mjneln32.exe
        
        C:\Windows\system32\Mjneln32.exe
        339⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Mecjif32.exe
        
        C:\Windows\system32\Mecjif32.exe
        340⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Majjng32.exe
        
        C:\Windows\system32\Majjng32.exe
        341⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Noeahkfc.exe
        
        C:\Windows\system32\Noeahkfc.exe
        342⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        343⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Nhmeapmd.exe
        
        C:\Windows\system32\Nhmeapmd.exe
        344⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Nklbmllg.exe
        
        C:\Windows\system32\Nklbmllg.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10052
        
        C:\Windows\SysWOW64\Nafjjf32.exe
        
        C:\Windows\system32\Nafjjf32.exe
        346⤵
        Drops file in System32 directory
        
        PID:10108
        
        C:\Windows\SysWOW64\Nimbkc32.exe
        
        C:\Windows\system32\Nimbkc32.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10160
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        348⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Niooqcad.exe
        
        C:\Windows\system32\Niooqcad.exe
        349⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        350⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9332
        
        C:\Windows\SysWOW64\Nefped32.exe
        
        C:\Windows\system32\Nefped32.exe
        352⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Nlphbnoe.exe
        
        C:\Windows\system32\Nlphbnoe.exe
        353⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Objpoh32.exe
        
        C:\Windows\system32\Objpoh32.exe
        354⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Oehlkc32.exe
        
        C:\Windows\system32\Oehlkc32.exe
        355⤵
        Drops file in System32 directory
        
        PID:9664
        
        C:\Windows\SysWOW64\Ohghgodi.exe
        
        C:\Windows\system32\Ohghgodi.exe
        356⤵
        Modifies registry class
        
        PID:9732
        
        C:\Windows\SysWOW64\Oaompd32.exe
        
        C:\Windows\system32\Oaompd32.exe
        357⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        358⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Oaajed32.exe
        
        C:\Windows\system32\Oaajed32.exe
        359⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Ooejohhq.exe
        
        C:\Windows\system32\Ooejohhq.exe
        360⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Oadfkdgd.exe
        
        C:\Windows\system32\Oadfkdgd.exe
        361⤵
        Drops file in System32 directory
        
        PID:10088
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        362⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Oohgdhfn.exe
        
        C:\Windows\system32\Oohgdhfn.exe
        363⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Oeaoab32.exe
        
        C:\Windows\system32\Oeaoab32.exe
        364⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Ohpkmn32.exe
        
        C:\Windows\system32\Ohpkmn32.exe
        365⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Pojcjh32.exe
        
        C:\Windows\system32\Pojcjh32.exe
        366⤵
        Modifies registry class
        
        PID:9484
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        367⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Plndcl32.exe
        
        C:\Windows\system32\Plndcl32.exe
        368⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Polppg32.exe
        
        C:\Windows\system32\Polppg32.exe
        369⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9852
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        370⤵
        Drops file in System32 directory
        
        PID:9896
        
        C:\Windows\SysWOW64\Pkcadhgm.exe
        
        C:\Windows\system32\Pkcadhgm.exe
        371⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Pcjiff32.exe
        
        C:\Windows\system32\Pcjiff32.exe
        372⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Pidabppl.exe
        
        C:\Windows\system32\Pidabppl.exe
        373⤵
        Modifies registry class
        
        PID:9260
        
        C:\Windows\SysWOW64\Pkenjh32.exe
        
        C:\Windows\system32\Pkenjh32.exe
        374⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        375⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Pkhjph32.exe
        
        C:\Windows\system32\Pkhjph32.exe
        376⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Pcobaedj.exe
        
        C:\Windows\system32\Pcobaedj.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9944
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        378⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Qofcff32.exe
        
        C:\Windows\system32\Qofcff32.exe
        379⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        380⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Qkmdkgob.exe
        
        C:\Windows\system32\Qkmdkgob.exe
        381⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Akoqpg32.exe
        
        C:\Windows\system32\Akoqpg32.exe
        382⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Aaiimadl.exe
        
        C:\Windows\system32\Aaiimadl.exe
        383⤵
        Drops file in System32 directory
        
        PID:9316
        
        C:\Windows\SysWOW64\Ahcajk32.exe
        
        C:\Windows\system32\Ahcajk32.exe
        384⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Ahenokjf.exe
        
        C:\Windows\system32\Ahenokjf.exe
        385⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Ackbmcjl.exe
        
        C:\Windows\system32\Ackbmcjl.exe
        386⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Alcfei32.exe
        
        C:\Windows\system32\Alcfei32.exe
        387⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Aoabad32.exe
        
        C:\Windows\system32\Aoabad32.exe
        388⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Abponp32.exe
        
        C:\Windows\system32\Abponp32.exe
        389⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10272
        
        C:\Windows\SysWOW64\Ahjgjj32.exe
        
        C:\Windows\system32\Ahjgjj32.exe
        390⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        391⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        392⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Blhpqhlh.exe
        
        C:\Windows\system32\Blhpqhlh.exe
        393⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Bcahmb32.exe
        
        C:\Windows\system32\Bcahmb32.exe
        394⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        395⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        396⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10624
        
        C:\Windows\SysWOW64\Bcddcbab.exe
        
        C:\Windows\system32\Bcddcbab.exe
        397⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        398⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        399⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Bokehc32.exe
        
        C:\Windows\system32\Bokehc32.exe
        400⤵
        Drops file in System32 directory
        
        PID:10796
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        401⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Bkafmd32.exe
        
        C:\Windows\system32\Bkafmd32.exe
        402⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Bblnindg.exe
        
        C:\Windows\system32\Bblnindg.exe
        403⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Bjbfklei.exe
        
        C:\Windows\system32\Bjbfklei.exe
        404⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        405⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Bkdcbd32.exe
        
        C:\Windows\system32\Bkdcbd32.exe
        406⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        407⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        408⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11164
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        409⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Cfnqklgh.exe
        
        C:\Windows\system32\Cfnqklgh.exe
        410⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        411⤵
        Modifies registry class
        
        PID:10264
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        412⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        413⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        414⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        415⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        416⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Djhimica.exe
        
        C:\Windows\system32\Djhimica.exe
        417⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        418⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Dbcmakpl.exe
        
        C:\Windows\system32\Dbcmakpl.exe
        419⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        420⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        421⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        422⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        423⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        424⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        425⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        426⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        427⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        428⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        429⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\Eblpgjha.exe
        
        C:\Windows\system32\Eblpgjha.exe
        430⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Ejchhgid.exe
        
        C:\Windows\system32\Ejchhgid.exe
        431⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        432⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        433⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Fcniglmb.exe
        
        C:\Windows\system32\Fcniglmb.exe
        434⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        435⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10812
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        437⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        438⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        439⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        440⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        441⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        442⤵
        
        PID:10644
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        443⤵
        Modifies registry class
        
        PID:11160
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        444⤵
        Modifies registry class
        
        PID:11212
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        445⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        446⤵
        
        PID:11316
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        447⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        448⤵
        Modifies registry class
        
        PID:11408
        
        C:\Windows\SysWOW64\Gfmojenc.exe
        
        C:\Windows\system32\Gfmojenc.exe
        449⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        450⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        451⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11540
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        452⤵
        
        PID:11580
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        453⤵
        
        PID:11632
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        454⤵
        
        PID:11688
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        455⤵
        
        PID:11736
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        456⤵
        Modifies registry class
        
        PID:11796
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        457⤵
        
        PID:11840
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        458⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        459⤵
        
        PID:11928
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        460⤵
        
        PID:11976
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        461⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        462⤵
        
        PID:12060
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        463⤵
        
        PID:12108
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        464⤵
        
        PID:12152
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        465⤵
        
        PID:12196
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        466⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        467⤵
        
        PID:12284
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        468⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        469⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        470⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        471⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11504
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        472⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11564
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        473⤵
        Modifies registry class
        
        PID:11628
        
        C:\Windows\SysWOW64\Ilccoh32.exe
        
        C:\Windows\system32\Ilccoh32.exe
        474⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        475⤵
        
        PID:836
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        476⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        477⤵
        
        PID:11872
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        478⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        479⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        480⤵
        Drops file in System32 directory
        
        PID:12028
        
        C:\Windows\SysWOW64\Jlobkg32.exe
        
        C:\Windows\system32\Jlobkg32.exe
        481⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        482⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        483⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        484⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12272
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        485⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        486⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        487⤵
        
        PID:11620
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        488⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        489⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        490⤵
        
        PID:11900
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        491⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Lcggio32.exe
        
        C:\Windows\system32\Lcggio32.exe
        492⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        493⤵
        
        PID:12136
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        494⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        495⤵
        
        PID:12280
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        496⤵
        
        PID:11396
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        497⤵
        
        PID:3616
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        498⤵
        Modifies registry class
        
        PID:11652
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        499⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        500⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        501⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        502⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        503⤵
        Modifies registry class
        
        PID:11328
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        504⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        505⤵
        Drops file in System32 directory
        
        PID:11884
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        506⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        507⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2808
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        508⤵
        
        PID:12192
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        509⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        510⤵
        Modifies registry class
        
        PID:5096
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        511⤵
        Modifies registry class
        
        PID:5112
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        512⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        513⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        514⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        515⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        516⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        517⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        518⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        519⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        520⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        521⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        522⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        523⤵
        Modifies registry class
        
        PID:1540
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        524⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        525⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        526⤵
        
        PID:452
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        527⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        528⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        529⤵
        
        PID:12324
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        530⤵
        
        PID:12364
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        531⤵
        
        PID:12428
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        532⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        533⤵
        
        PID:12528
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        534⤵
        
        PID:12572
        
        C:\Windows\SysWOW64\Paelfmaf.exe
        
        C:\Windows\system32\Paelfmaf.exe
        535⤵
        Modifies registry class
        
        PID:12632
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        536⤵
        Drops file in System32 directory
        
        PID:12684
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        537⤵
        
        PID:12720
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        538⤵
        Modifies registry class
        
        PID:12772
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        539⤵
        
        PID:12816
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        540⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        541⤵
        
        PID:12904
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        542⤵
        
        PID:12948
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        543⤵
        
        PID:12988
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        544⤵
        
        PID:13032
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        545⤵
        Modifies registry class
        
        PID:13096
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        546⤵
        Modifies registry class
        
        PID:13148
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        547⤵
        
        PID:13204
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        548⤵
        Modifies registry class
        
        PID:13244
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        549⤵
        
        PID:13292
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        550⤵
        
        PID:1152
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        551⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12308
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        552⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12396
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        553⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        554⤵
        
        PID:12524
        
        C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        555⤵
        
        PID:3956
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        556⤵
        
        PID:12592
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        557⤵
        
        PID:12612
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        558⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        559⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12740
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        560⤵
        Drops file in System32 directory
        
        PID:12804
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        561⤵
        Drops file in System32 directory
        
        PID:4868
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        562⤵
        
        PID:12928
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        563⤵
        
        PID:12984
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        564⤵
        
        PID:13048
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        565⤵
        
        PID:13084
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        566⤵
        
        PID:13164
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        567⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        568⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13284
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        569⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        570⤵
        
        PID:12296
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        571⤵
        
        PID:12388
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        572⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        573⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        574⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        575⤵
        Drops file in System32 directory
        
        PID:12588
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        576⤵
        
        PID:12628
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        577⤵
        Drops file in System32 directory
        
        PID:12736
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        578⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        579⤵
        
        PID:3292
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        580⤵
        
        PID:12872
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        581⤵
        
        PID:540
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        582⤵
        Drops file in System32 directory
        
        PID:3260
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        583⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        584⤵
        
        PID:13156
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        585⤵
        
        PID:3168
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        586⤵
        
        PID:13228
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        587⤵
        
        PID:13276
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        588⤵
        
        PID:2032
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        589⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2196
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        590⤵
        
        PID:12312
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        591⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1424
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        592⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        593⤵
        
        PID:764
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        594⤵
        
        PID:12512
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        595⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        596⤵
        Drops file in System32 directory
        
        PID:212
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        597⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        598⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        599⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        600⤵
        
        PID:2592
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        601⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        602⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        603⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1312
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        604⤵
        
        PID:4132
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        605⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        606⤵
        Drops file in System32 directory
        
        PID:1856
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        607⤵
        
        PID:13212
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        608⤵
        
        PID:13188
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        609⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4468
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        610⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        611⤵
        
        PID:992
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        612⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        613⤵
        Modifies registry class
        
        PID:12360
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        614⤵
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        615⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        616⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        617⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        618⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        619⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        620⤵
        
        PID:552
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        621⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        622⤵
        
        PID:712
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        623⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        624⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        625⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        626⤵
        
        PID:13020
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        627⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        628⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5636
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        629⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        630⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        631⤵
        
        PID:12960
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        632⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        633⤵
        
        PID:13080
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        634⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        635⤵
        
        PID:696
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        636⤵
        Drops file in System32 directory
        
        PID:5412
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        637⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        638⤵
        
        PID:13232
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        639⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        640⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        641⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        642⤵
        
        PID:11476
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        643⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        644⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        645⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        646⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        647⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        648⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        649⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        650⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        651⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        652⤵
        Modifies registry class
        
        PID:2200
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        653⤵
        
        PID:652
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        654⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        655⤵
        Drops file in System32 directory
        
        PID:4480
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        656⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        657⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        658⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        659⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        660⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5556
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        661⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        662⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        663⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4800
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        664⤵
        
        PID:996
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        665⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        666⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:4584
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        667⤵
        
        PID:800
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        668⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        669⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        670⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        671⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        672⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        673⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        674⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        675⤵
        Drops file in System32 directory
        
        PID:6972
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        676⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        677⤵
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        678⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6668
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        679⤵
        Drops file in System32 directory
        
        PID:6388
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        680⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        681⤵
        Drops file in System32 directory
        
        PID:2804
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        682⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        683⤵
        
        PID:12956
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        684⤵
        Modifies registry class
        
        PID:6904
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        685⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        686⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        687⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        688⤵
        Drops file in System32 directory
        
        PID:5244
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        689⤵
        Modifies registry class
        
        PID:6428
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        690⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        691⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        692⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        693⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        694⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        695⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        696⤵
        Drops file in System32 directory
        
        PID:6312
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        697⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        698⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        699⤵
        Modifies registry class
        
        PID:4492
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        700⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        701⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        702⤵
        Drops file in System32 directory
        
        PID:6152
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        703⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        704⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Dqnjgl32.exe
        
        C:\Windows\system32\Dqnjgl32.exe
        705⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Dkcndeen.exe
        
        C:\Windows\system32\Dkcndeen.exe
        706⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        707⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        708⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        709⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        710⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6616
        
        C:\Windows\SysWOW64\Doccpcja.exe
        
        C:\Windows\system32\Doccpcja.exe
        711⤵
        Modifies registry class
        
        PID:3736
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        712⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        713⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\Ebfign32.exe
        
        C:\Windows\system32\Ebfign32.exe
        714⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        715⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        716⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        717⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        718⤵
        Drops file in System32 directory
        
        PID:7784
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        719⤵
        Drops file in System32 directory
        
        PID:7288
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        720⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        721⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        722⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        723⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        724⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        725⤵
        Modifies registry class
        
        PID:7056
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        726⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        727⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        728⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        729⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        730⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        731⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        732⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        733⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        734⤵
        Modifies registry class
        
        PID:8112
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        735⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        736⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        737⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        738⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        739⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        740⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        741⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        742⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Ibqnkh32.exe
        
        C:\Windows\system32\Ibqnkh32.exe
        743⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Ieojgc32.exe
        
        C:\Windows\system32\Ieojgc32.exe
        744⤵
        Modifies registry class
        
        PID:12400
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        745⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        746⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        747⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        748⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        749⤵
        Modifies registry class
        
        PID:7636
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        750⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        751⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        752⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        753⤵
        Modifies registry class
        
        PID:7832
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        754⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        755⤵
        
        PID:12676
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        756⤵
        Drops file in System32 directory
        
        PID:6420
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        757⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        758⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        759⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        760⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8752
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        761⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        762⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        763⤵
        
        PID:12884
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        764⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        765⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        766⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        767⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        768⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        769⤵
        
        PID:180
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        770⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        771⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        772⤵
        Modifies registry class
        
        PID:8736
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        773⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        774⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        775⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        776⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        777⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9048
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        778⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        779⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        780⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        781⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        782⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        783⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        784⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5628
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        785⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        786⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        787⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        788⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        789⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        790⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Nbphglbe.exe
        
        C:\Windows\system32\Nbphglbe.exe
        791⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        792⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        793⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        794⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        795⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        796⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        797⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Nfqnbjfi.exe
        
        C:\Windows\system32\Nfqnbjfi.exe
        798⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        799⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        800⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8896
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        801⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        802⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        803⤵
        Drops file in System32 directory
        
        PID:11876
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        804⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        805⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        806⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        807⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        808⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        809⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        810⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        811⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        812⤵
        
        PID:316
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        813⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        814⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        815⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9240 -s 408
        816⤵
        Program crash
        
        PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 9240 -ip 9240
1⤵
PID:6332

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:10256

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:5728

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:7412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aeklkchg.exe

Filesize
18KB

MD5
db2c21b3e3476c1297e04cd6f7c1ac54

SHA1
adfb73abe3ea607a08373715f3aee8bdc082cbb9

SHA256
87444d162e41ffa17ac047483456fe58a1d4fbc3bba585a05269c8fb11ec338f

SHA512
60c93afa59c61d0f07eb3a61c40843578df4412ab2b336c8c8525b21023bd3f8468f9752cc9b4e8294dc0e58965008dfdf34f40472549be6ad750d207ee48df6

Download Submit
C:\Windows\SysWOW64\Agiamhdo.exe

Filesize
448KB

MD5
e0a4a4a570eceeda1451bd49770820d2

SHA1
ffd314e04441214a253cf651645f5cfa87a5f02d

SHA256
8ec22b18fc6c95900e93e480d1537040d11bf5ddae2465535bc6bc0b9aff409e

SHA512
c0923e229e7709252461b61262813378a08e0763b5ade7b52b2bb1fcbc6c2d99d5878774930850869986484674445c16fea3be1edf28ac423dafbe27459aa272

Download Submit
C:\Windows\SysWOW64\Ahjgjj32.exe

Filesize
448KB

MD5
5b6398b820e16bc04ada25429eb47a11

SHA1
3c87797c06ccb4f968c44862a6d10a47c1132920

SHA256
1becc381b83e616c11bfc7ae0783cbcdbaecc95a0f224edd8fdc0692702687c2

SHA512
3a9fad2bf777a57b813f66d707aac4682bae8e1c9d435aa802ab836639e18c9caefb1e21fef773259333d84f11f5bdc02177c742de816aad541ef50edeadcc69

Download Submit
C:\Windows\SysWOW64\Ajjjocap.exe

Filesize
448KB

MD5
7420d99cfa55978720f5295fb8a8244c

SHA1
eaedf416ece9bbf998469e76c35746568080d807

SHA256
0963263730c97e24606d73527c1b13b195ee592ffaa7f5ed36d8372fc1369108

SHA512
965e96168db0ffc67bba51275221e0a5f6a188fcf80c032da6c05d95dc81edc0d0ca77c98ed156b83216205b547b43595c08e51300330d1b22b809f2b187c94a

Download Submit
C:\Windows\SysWOW64\Baicac32.exe

Filesize
448KB

MD5
43721c0482a20a85ea4e9591caf22ce3

SHA1
dfdd0ee9f7a834870657fa569bd43dde12046fee

SHA256
f77a0ccdef577531c7902e6803b637297f9f283dd3aa3fa534ea580dc19e5e29

SHA512
7b304b6a725eac07f05b529fbd58fd7da42f05955071eb95c39088c1059a814da72444b65a3eed8e3e63beaa7d4ddca5f4760af4afbee72e50c7d9af29fe4ab5

Download Submit
C:\Windows\SysWOW64\Cmiflbel.exe

Filesize
448KB

MD5
b91e9eefe4447ea2a299d4b4a0aa7889

SHA1
7a63f196beb7c021c418cdce397f89fd79ad23b2

SHA256
215af24e1f90ebad3656f42b19893671d1506a8a625bce32301601db81774c0b

SHA512
4e49a014d6e7eb412b076cf106a85ec91fedb39662d8a50860ba638641c2091242338a75da5ba319e1abbdcfab76821b559f9a947b7c4e432974f75bd9267c4e

Download Submit
C:\Windows\SysWOW64\Cnkplejl.exe

Filesize
448KB

MD5
ef9e46be4e236fa36bcb85e226db8e64

SHA1
274c93712ff59b7e0526719bcca7970044da4e06

SHA256
6bb6c9705e08496db9a223108ecb764ee4f6761b51e836901c5da31689221af0

SHA512
fb848f955a76da300db4bce89344cab7186e17fd6be385f6649d0bad4519b253f57e0c70c5eb90e26550f5e2c3f144799d4d49210476ffad46b2d553f1194528

Download Submit
C:\Windows\SysWOW64\Cobkhb32.exe

Filesize
448KB

MD5
0e3db86f119302d318f9decabdf4be4d

SHA1
1fea6d32383c8aef497d123009c1a0e7f2b5ae55

SHA256
3c60bdd09eb51a4742aab2edd333945fb7f43047faafe8692a066d5c711ea4ae

SHA512
025cb6de6a57ee5d75c382a24a647d13bc84246aa7d1408b61b2fe3fd01e471d5256e49900fb0f89233cfefb4b214ad3b567a4c462d7c95ac67f58f5faca7762

Download Submit
C:\Windows\SysWOW64\Dmefhako.exe

Filesize
448KB

MD5
65ba8e773e2b970f2ac5053929065420

SHA1
d4b2d425c254242779571091458902814251a240

SHA256
dcd5351b75c8b190f417990a5714fa7000f23f08c62d3beee244a46b0f1c0009

SHA512
376ccb53061135107215ddb9ab7b4239e838a1e5f756466ba0df3ff74272034086a307d8321bba50a34ed341d692f84b3f65b81c19bd55c224a0358b262bf474

Download Submit
C:\Windows\SysWOW64\Ebjcajjd.exe

Filesize
448KB

MD5
ee12f9035d02c802a9bd5c78a169b3cb

SHA1
48e7ef26b47539a66872a5d67760f3a5af218e57

SHA256
0f40aed0906f504fdca629b26844c1e10d76fcf0dd4281eab2a6e0c1fedb1fca

SHA512
ab65a42ac3d8de47876990052ed668d7b30592dbe848926a83bdac6a1d5cd7f45b12785d3cabb5654a7935ea02760226d4ca2105c5483af64b79bd0853b36a51

Download Submit
C:\Windows\SysWOW64\Fdijbg32.exe

Filesize
448KB

MD5
6910a554f509bc7aad203a8e9bccc287

SHA1
a3eb99c20e17dc19be834a2e5df16c79322b646e

SHA256
0d83ce3e38e22a5331759107b7a979dafdac07da5259ce60e1a569113b397894

SHA512
3377c86544bed9a629cb70fbde0fb985ad6a770a858348c1863745d22988a5b86c33b7907a387bb6392a4dc46148cf9218960ef1209def786ff817325be0553c

Download Submit
C:\Windows\SysWOW64\Ffclcgfn.exe

Filesize
448KB

MD5
93184e1ed33e397f0533b3ce1a673f09

SHA1
c3e962fce3e09d4efc7ab678d07ff394f9156acc

SHA256
9ed3dbf0318bff5ac2cfc4b66b782260cc64cf4cce6b8c4384cb6869513854d3

SHA512
440ea60786b8db21c2a9ede6c4b3be0dee490504ab99e3fe4e22abf3cfe2b4ba3a7dddd597f0933f75589a85e6b47de7cc37ee400c6bada0ec8e20271675ce06

Download Submit
C:\Windows\SysWOW64\Fplpll32.exe

Filesize
448KB

MD5
4bde797db4b304963e80c215b825c6e9

SHA1
8d79248100fd79f433736599c97e1bb563325936

SHA256
910033345b3169ffd7bb26e956550ea8da08a270f581fa097462998ccdae152c

SHA512
c30c687d997aaaa2152d99bdf21df6285264c862b5dacf43f2db678e8fdc5ef7c86b3c9a161d7f990bdf597e536b76557c1407ae5427049deb71f93ebbba3450

Download Submit
C:\Windows\SysWOW64\Gkglja32.exe

Filesize
448KB

MD5
e046ad205a951bb721a6aa8e156a9771

SHA1
af4def94bdbfa214808a7c64e39bc4e869912e32

SHA256
707f96cb5708f56a5493554b3e50e80acbdcc8419a412e8a6c70e5d32d91a958

SHA512
a52eda54b3341aa93d646bac69e335494a8ef63b2b5659a2f578e55c1aa2cddfd09e09178c15231b70aae9902ef3aa0041012a4b7f04fec93340f8797795bc94

Download Submit
C:\Windows\SysWOW64\Glengm32.exe

Filesize
448KB

MD5
18f7fa3fdf25b756f9d4c10b855854ba

SHA1
77a5eed5478bd8b1c0fa100329ebfc67b22a9d9e

SHA256
c634ba9341789ae41c42c5384d90fc708102315d6d6dabc12e79eebf6764f96b

SHA512
3d4e65f8702c2971204d65adbd85781d2e146e6ca77552a5bf28c7a45a976eee2ad7487c16fc821dc1948b5d50ecdac4c87e10bfe43d114736b9f7d99295441b

Download Submit
C:\Windows\SysWOW64\Hajpbckl.exe

Filesize
64KB

MD5
9485a1250e77d4db1a808309b1cd89c7

SHA1
0baa295c2877b293ed2030c5bfc42656efe40476

SHA256
25700e2bc4a8170ff628178656115293e761e64484da5e108ee3b9a30f5af57c

SHA512
b5756b690f07de76f25f27fa271a877288807995360613d068519f70211d169a646617c2a992d4d6590c02febbc5e4657c3cebc53185ece05946c78648dde6af

Download Submit
C:\Windows\SysWOW64\Ibmeoq32.exe

Filesize
448KB

MD5
582fe1924e1c7244b7ae03e1d794c3f3

SHA1
11781d445ee78c63513008f8440ae6fab58b2547

SHA256
5f4d81fb587fd2e2dcff9dbd169c6af93889fe494750f2d66c7fee5608ee8574

SHA512
bea0a151ac8fe11656599b2a271a8deefb668ffca4b61f69c37255b4034d9ade319fa8e00a0bea2466c83b7667cb70de0b7e3ed4b0fb1b4ae76a2a81bccf894e

Download Submit
C:\Windows\SysWOW64\Ikdcmpnl.exe

Filesize
448KB

MD5
f2f9deb680501cec484a99d32275569e

SHA1
5593feb40cde4b22806a1c1f4577d9aeaa9326ec

SHA256
872e2e9c4779e4c213161ea022be7cbc201d9cbf4531643f4a50f2bf0029f7b0

SHA512
a5833f7c355fd2722b55530b31a1fb375585af547d2f1a38eb534437710bb94e86e4752e3aaf8f26b0976b514e8d8faad01f9eb1241ad7462be952dc2f3afb75

Download Submit
C:\Windows\SysWOW64\Jfeopj32.exe

Filesize
448KB

MD5
b99966bb6bf60c74126f541f701ea05b

SHA1
c17995d54480a5a2ac504667d164cf1a32c2d25b

SHA256
226ce094882378c4a4779293fec658c55908e8c5419af189046e4a97394e56a4

SHA512
98b21d869b2c76f71130841d95b58b8e063090514a86e3aaeea57971e74a623c4434371941a82607d422351806f40c5f6ab1de97df876baf9605c97e58965efc

Download Submit
C:\Windows\SysWOW64\Jianff32.exe

Filesize
448KB

MD5
352f61d66350bb4cce787a36c7d8eb38

SHA1
656e77bbd86496028e84205ce5f691d76960cfa1

SHA256
555b05c01a7d767a711244af3b5422cce471c86c20f63cd1a8f148c8151fa8d0

SHA512
e684be549113e515cafabe1950b207fec0f858b5f2671dc800e2c0ef5e20d4d302fa7603e3575e00abb46169d0464dc6047c5feed27a5ddaee40508c638cbb0f

Download Submit
C:\Windows\SysWOW64\Jnpfop32.exe

Filesize
448KB

MD5
7f343dc8aaf2bb4611c353e2b383ded8

SHA1
75a6841f7d672193e74efb173e798ecf4f765426

SHA256
708d44fb5fb70265d8711f7612d42522570f32171de273dc703d516ccf7959f3

SHA512
5c7eb9fec75e3d6a5ba5bbb3956f9869426d37f136bf57592e832e273928eaba01befde29151f0004b1fb2866facd48f3fc21f1ffd14300fd6306be98e833d14

Download Submit
C:\Windows\SysWOW64\Jpijnqkp.exe

Filesize
448KB

MD5
f1bb121073d2354b9ae60e70c373fd21

SHA1
6853e25dcc19584be78a2e054cb13feed2c44397

SHA256
6be96c98165b5e2ae406ddd6f9ac14ac5a3f1cc790f9f0cf17426279e486e692

SHA512
163e045e7d774ba4c5c148c3754f6e0e30291072b3257da041daff210603daa95a2728dd103efaa44612ff0be26b321bcbac966daca6732aa64d80828cd2b24d

Download Submit
C:\Windows\SysWOW64\Kelkaj32.exe

Filesize
448KB

MD5
42af37e3fdf069fddcdcf01388d559b2

SHA1
d4b96e97d8791b4f753f7afeb09bfc3d42ed4845

SHA256
f27906d3860793181716de51305f50aff092400029fd5c771d22af74308d4857

SHA512
68ae0cbcc6a320e61a8d6081913b3318a4c6b7cb475387a7af73a5486774ef52876a9d7fb50963e97959ba2795f87566b66325c717d22f3adab31303426258e9

Download Submit
C:\Windows\SysWOW64\Kniieo32.exe

Filesize
128KB

MD5
c3a2e11a501aa2bbc9b7024c8d4e013b

SHA1
0415816d080b39972669082f96cb96a827ac31d7

SHA256
23f8431e8a211041b07d19c777b9a06c3c4072f1ddfef30d2b3bec0431d0c279

SHA512
2b24b45ba4568e87871d19bef895df6729061d1ff4d7996a6cd86381acd556f3e7f7c43799a7f37408c9c220667bf2182f57c4a57a00e02b603929990b405652

Download Submit
C:\Windows\SysWOW64\Lepncd32.exe

Filesize
448KB

MD5
c455b3cca909e25b9f1d1bcb9a03d705

SHA1
2a2e76653f3d3aeef0c9cb8bc5f909f126bc0e2c

SHA256
0e0089f9ee2db078f9d068eb3771829de0d1033cf57cdd83b22db18c734bb4b5

SHA512
96b09c7d9159f1da6a2f4639eaaac23df3dd80b84ff63027151511d065e61de5b6c4028c85941003099daa99febba4bda5ee9ae85204815375e2cf3da94ac3d0

Download Submit
C:\Windows\SysWOW64\Lfkaag32.exe

Filesize
448KB

MD5
5548ac39fac83ce9814c3a5eabd6b3c3

SHA1
326d0e118d2978ef009f13033f81db4de82edfa4

SHA256
051c34e78cdf721ed79322ada21a088a5f2c0b7751434c8d31946620bd9ba1c1

SHA512
3dc22a1526c1a1331471728717ea2f76239e92ef046c795a37bc035c785d2d35079b087835168993d9a821241b6d99d5e5480ea4237142e07408b2f31ae546fa

Download Submit
C:\Windows\SysWOW64\Ljkifn32.exe

Filesize
448KB

MD5
55b16870b38f987d679b3bd5a109a8c4

SHA1
0c5bb9fcbae262ba53cc346b2adc44aedc52d0d4

SHA256
8d7c432fb0a7d689852296f16b94c1f70c4ba7242d0c4e604feb9828f8f390e9

SHA512
883ade66148d59687533e8fb21e7b6a0de5a75070d6db5fc5ac18ec53e150037bad2ac251217bb9819f70e824a684a2c6e618750240ed8cf0a1d3b8017b17bf3

Download Submit
C:\Windows\SysWOW64\Lkofdbkj.exe

Filesize
448KB

MD5
7b72819f09e689ec139bdeeb00e51b69

SHA1
a558551a87b938bd72268cc9ee093f4167474688

SHA256
fe29e20684af4edd20e110fa20fe6efd97d059eb4dc29da38dad8aca5d3eb7a5

SHA512
3e87f6007d83791d8b0891e11e6ad6b0b2965675e594346d1ec7e11fac126331a90c3d3bdec3137b785bb50508bf8f0a41054593a55a2cacf15d16fde164143f

Download Submit
C:\Windows\SysWOW64\Llgjjnlj.exe

Filesize
448KB

MD5
c783f843d323313008b551f7d7917b66

SHA1
2b54d04dec8f91e21863558b9f666018f534cf54

SHA256
d6e7a1e322f09bd50e1d3c07d8ccc48319063dc11f970ef805ccc9deb537f1af

SHA512
7eb5f4b80c2d71317b2d46dab07a8913377db173036b0971f1c0af245da95616189bc3fb2f518a32a74efbb4f7bb9412d7ea9654d8e680537b2368a5e1d1c7f5

Download Submit
C:\Windows\SysWOW64\Lmiciaaj.exe

Filesize
448KB

MD5
f0c79db1729642ee8180a6159561436b

SHA1
d3a654143365f6faea25a1f47ebf06749826e952

SHA256
ad743b0a62f65fba23ebc507cd74931158c424dad9ba8629ab0465bd79b6c205

SHA512
20a91b3feadc6eaaf16e5022fee59b5d0f859577fee761581d889fd7a5834f41476c06a922c43817e3faf52cf8feeadc7d2acefc362a4be84d66c223381bb969

Download Submit
C:\Windows\SysWOW64\Mdjagjco.exe

Filesize
448KB

MD5
7069d1d0721d5bf9ad9a9232ef88b6e0

SHA1
6edba0b554b7b8ed6f6ab123f71b11e8f6786bed

SHA256
3ea2ad690f5d3015390213fa9ebf61ab16b16ca142cadd9c1ad082cf6e2ae04b

SHA512
28d5d1e56abbb8aed837c37f166b6bfe7f866ad951af9ae05262b6eb116696bf9f81c93a53aa99d407cc3b7ae2a71036de0e6e98a3e3f35dcc5b4569d8184e18

Download Submit
C:\Windows\SysWOW64\Mdjagjco.exe

Filesize
349KB

MD5
cc5b2cb9d599fcdf6e4b5c8fbe8b6e59

SHA1
498df47e759ab69fc932140b67abd84e1fa8eeab

SHA256
54f09018fd729e1030be8a85347863ff5ec89dc4f54f04c237154c9d3a0ece11

SHA512
e4d9429099bc5db325aa0a82bc1d70a6b260fbae2c3805727fe1665c46ecc2e178b0ed084df35b89d7af54a7fc3efeb685f052c14bcd09f994b37256d996bb02

Download Submit
C:\Windows\SysWOW64\Medgncoe.exe

Filesize
373KB

MD5
82ad4e07bedfd1fc3373e06f3f2ecf92

SHA1
4da288d439eabc674ee22cb0e0e8f3461994f39f

SHA256
6805f7ffcfa1f6338836b0656198135fdf3befa0ad0d0164951f1875e4a01c54

SHA512
e012dca4fc02348cd37b91921a0119d7dc2a18f0939f0aec4d40fc8f4a1bfae6adbc106c84794da758de2b3261140eb0ac7aaf2f5bc43c715b9bdfdb0fc621b4

Download Submit
C:\Windows\SysWOW64\Medgncoe.exe

Filesize
381KB

MD5
142f43f18905eb863bb97fe43fba5387

SHA1
62a18d22113c4f8ed8e6092ff93dacb1fc98897d

SHA256
27f0ecc10f9581374f9e718f42e2aabced2fa01abe41aa1abfde9d8788137407

SHA512
282f267cce7b934657a0a5fbf5850ec1f9130c92d9dc33cde240758b2f75d827eb1c81bb725c8a5bd65b3581a10e8648efb2377a54a49b8a2ea463ab159e6295

Download Submit
C:\Windows\SysWOW64\Menjdbgj.exe

Filesize
448KB

MD5
9705b48478b5e4d79da0f89a406b0288

SHA1
9b84cbfa705df90651f0f12f29dbbe84a373dae0

SHA256
63beedead00d79565f6a2fe4a5eede35cd79bbc82154a32f8a1a45921c531a06

SHA512
ee11b80bb36e9f498e81435acaa1f5bde897d76f480b724a0cedc2e42421d4af0e8149ec8f3e2774105d631a187895cf6e5e8909334decddd2a4acfd3773d03e

Download Submit
C:\Windows\SysWOW64\Mgfqmfde.exe

Filesize
448KB

MD5
e26308002c79d15c5c6bb180b186250e

SHA1
343132d37634b76bff310e5fb9ceb65794945718

SHA256
a85e67aff0d83c3018c82c73085941f91fd8c920e34e9fb930075edeaf401cd6

SHA512
124d467f5a689342b071a937b38d6b3a3b7706bacb7b5cbb61802e9780c1a7ecec33a6dbd79e9e70c43ae88347779a46da8bd817aee46ec04cee586f63d3d1f1

Download Submit
C:\Windows\SysWOW64\Mgfqmfde.exe

Filesize
409KB

MD5
5986c3ff199cf6675e2f3f263ea8188b

SHA1
c54957e97406f32d332521142269e4ed9cb565f0

SHA256
93921cddf3cbe245dd848e0c316a86d05a2bc6808cc6c32cd16f9ae0af4c02b6

SHA512
300fd49eead27547bcfcd83d9bad35c5b26a32eeb19e77d1502c85e139f65f7ee9b2ca4cf59b5cb188acae263b243bf91db3b36dbfe82e2d9eb6e17e977766b1

Download Submit
C:\Windows\SysWOW64\Mgfqmfde.exe

Filesize
226KB

MD5
453f42fb65dbe1679df86c34011ab002

SHA1
53268ed8a58f25ea0f6beacb43511f8c8d451e5a

SHA256
2734c9066e0c25bd11fcb739b64bb18f0199e5a3fc7646a98d8cd9cdf883bc94

SHA512
cf55d1b933263aba9b1cb19b612b2ee73bc5209d7d2608c823253078975928a1c0337265b188e83e3ab60736f29b96fba29562c4e344dbb35708ae841e17a6a8

Download Submit
C:\Windows\SysWOW64\Migjoaaf.exe

Filesize
208KB

MD5
0441b8fb0b387a1eacd8c04882df0198

SHA1
cde2272b972f685e8aab73f9f4db4daebff68faf

SHA256
1d5bb12c62bdc3bbbcd7ae8ed57b4c1321037328539fcaa2830fdd4ee2952117

SHA512
0ea65630abca9af7b09f5d8841cfb5350f5ba946dba053aa857b3d96915d6cb5c730571eb50d20be19d13b29fbe111aa56d051b3d6150f8115a5e0f6a73ecd9f

Download Submit
C:\Windows\SysWOW64\Migjoaaf.exe

Filesize
192KB

MD5
a2084f8550158c3687523e852616c18a

SHA1
4cbab196d5fa4d4d51b3c0c6efd6cab1130cd9ca

SHA256
7df3318830b5e064f168742716a192d8a6daec17aedbf5888dddd1a2d015e522

SHA512
191214cffd71c06e78ad09891e028e35ded00b8bcf869a39caf8fa751c687279fa0215e78bdf0cde2c39dedda68042b4d9fc9bd3eabd433dffd8ae316416b004

Download Submit
C:\Windows\SysWOW64\Mlopkm32.exe

Filesize
448KB

MD5
7bbb4c2fddb1c7fde254d22822398085

SHA1
ebf37ea6cb8723a3968f0e20e7ab777f16e80318

SHA256
501c9dda87db553332938a4129dbf58be329b940e9ae5ff96d3d2abfebda15c7

SHA512
2718d48ae1825448921213b93447ce70f5a1290e05321ec98d208c8754aba7e42f760d30e5ee3662265ab243e667cb128b07a3773088433174d7593f768e3e28

Download Submit
C:\Windows\SysWOW64\Mlopkm32.exe

Filesize
398KB

MD5
7a22cb281f4bc060aad3ab372702e677

SHA1
49b84d131d475784018ac8278a82774d33ca08a0

SHA256
d22426947c89e7097c21a1d26165c92524a9461a9a675d3bcbb1ae39e9127a77

SHA512
1c9b6be9910c52017b1f6c24e4f3cde7cd005ad120ad26e25982234439a9b36024d3eb3561be81f1826e2d76a841df9160ccdf75a7b949f4b2af3c9ba40e9499

Download Submit
C:\Windows\SysWOW64\Mpablkhc.exe

Filesize
153KB

MD5
e8ac6e1432c4c1b3f987bb29f45e1504

SHA1
9140bcdf6db37c1de780c843f6e6f95438402186

SHA256
fb4b58c5614f2a42f589b3bc5d7f0305c1a84cd674d9e85b4b8c8115f407c9a7

SHA512
9823688417ad769817a9775324aeb0503ba9a8585c9e999bf44f5bc6628924dfa51d52d63ae4d1681afadf597e3262b48a727d8577a8837c12c12cf0a6ff0261

Download Submit
C:\Windows\SysWOW64\Mpablkhc.exe

Filesize
166KB

MD5
4236b544971b2ae43ab82d7826c0f4c8

SHA1
c1a3c31e8d3bcdf4ef61a9cd3919eb8ff74f1d3e

SHA256
1f3f98874ca275efe1d5e5a7b898ce77401c4d2aeb9c4ea330803dc7fd62a597

SHA512
5d490da3d00cff15c7035058fac5cda8b1fbfef779c0653998899bda915eb089b240548a82c4a210caf35186d88754533c71da97be7dc7d979513bf2452f770a

Download Submit
C:\Windows\SysWOW64\Mplhql32.exe

Filesize
448KB

MD5
c58f113e7091b28d611c39d4e11490f3

SHA1
ec497232735a87b359beaffaafe919a785f7f9bf

SHA256
d8952cf36b4b9318e69ca0d41bd3bbd5eee98ae3b21a4e5f3e016b203080670a

SHA512
cb12b878334a5ad2cbc611c5c3ee04ee20a3833036e370385c790605d1675c1bcaf26cef72f5a022be0ba64d4347277ee67a9009381e7d91ca9ab656b2679f9d

Download Submit
C:\Windows\SysWOW64\Mplhql32.exe

Filesize
201KB

MD5
2d586b292d26457fc3604694a4f72b89

SHA1
c8efd14ea655cafe18cc8a2d35e5452a3eb76ec6

SHA256
cac93b96cb807b3ff51d9b23a49c582a2f1d692ada27847f358aebc18e611bcf

SHA512
8f33f275db8ebad95ae844b58638c386f46b2862d172dada57d07bd544f237e9a79fd25ea68d12734530d6f98a3f28e945bf78bbdd36d872d9d7de696817eb4f

Download Submit
C:\Windows\SysWOW64\Ncbknfed.exe

Filesize
448KB

MD5
cc0c5c5eb4acf0eabe23974d9da029b0

SHA1
7b8d44cf7e3bd19542db19df5eee6d83b924857a

SHA256
922c17e3124bd580fb24da047b464471fcbb248b197af753aafc0b617d814031

SHA512
9d45ba4d78a03a1f6fbf2e7dc77a3c9cfafc124be0d3374c6c47364029d64bb632fe7bf47ad38a04f899e3f918459596ad1fbd9add822101bd7b7e94a323cc43

Download Submit
C:\Windows\SysWOW64\Nckndeni.exe

Filesize
448KB

MD5
0d257e41aa032d0755645c878161559d

SHA1
a13508fd823a76d6095553499f3b04dd9edf7e25

SHA256
43148e244a128ef6d4794474c0986c9c8ca5c4a1bb2e94378cbdc1296ce4ab29

SHA512
e54bc3220f8802193e9084ba0b0c0848836ebdcc526f0959e36d47befb34c4f1d32126c4e3ec350a506d47a52bd26f55b91eb2c749b30d5bb23df45c11b36f21

Download Submit
C:\Windows\SysWOW64\Ngpccdlj.exe

Filesize
57KB

MD5
b0cb726b4326aa4f0862a0e6531eaeab

SHA1
dbfca2edcc31940471c06813e51e12773c3ed0df

SHA256
f60ebac973f05294fbf997c722cb53454a59393c75ba1a111272c61be2c0bdaa

SHA512
9827ac6f7d6264b9b7daa24846f1bc56fec9acfb7da75b7ea9947e274654de2428fc503bcb161f907e5750e75b9c141bc4c1c890ece675b1360846587fb0fe34

Download Submit
C:\Windows\SysWOW64\Ngpccdlj.exe

Filesize
54KB

MD5
6bc9764d7a4356e35a5cb88b649cf8e6

SHA1
65ed12a25bd8f1ae254543bd917a2e36ae4665d1

SHA256
77f2f6cf9b8914c3cde07e3b35ddd8949bce0a80eb250638737bf5ca13cf1823

SHA512
ca2edf404395f6edc27d7dc0ff069a4b404526bc2c2f78878a358c38cea5540962560b08990ce8f95fd8082d82ba3cf91025a5ab9c039af3bbaaae54eafdab35

Download Submit
C:\Windows\SysWOW64\Nnjlpo32.exe

Filesize
448KB

MD5
13b193ba5a4a2cdfad561ebeb901cc3f

SHA1
1af55332047d230e817e6101c09a0c460a15d865

SHA256
039fda8a1fa770daa7f03e0d7b2d5948b51cebb6fa5fa6fc0cd7867fc3693cff

SHA512
b35760524920a716d4e34ed2a0098028ad8c51b896b9b994b6f0ba2706c7900614dab94b3cbd33c2209bcdd0776a9615c31ee11461ce4ed00da4105171dc914a

Download Submit
C:\Windows\SysWOW64\Nnneknob.exe

Filesize
448KB

MD5
6fc5200a0cc10cbd6479f8f4314da602

SHA1
fe47c5f6c52b004a3de08c31945fb0f3c2c48b40

SHA256
9ca918e120ffa6c3d52750ba4372e709335030e8b175f93471df6d779bc3b1be

SHA512
cc02fbdc4dbebdf627572d0c9a25b77f57058b43c161423857f9d50778f905a22e99cd16f588a965c26aa4676ec7ed6d0a2ea7d865e11d70dcd9266c367c215b

Download Submit
C:\Windows\SysWOW64\Npjebj32.exe

Filesize
448KB

MD5
c82cd824b8723ce6dbeea89ad473a3c1

SHA1
0a36d412500df76c995a46cadd85d10eaf846e8a

SHA256
6b05dc30b32bb121332dc09f8eeaad74fb97ac26bd525f371c233a65a97e4883

SHA512
98eb7bcad1c51a0a0f0d95761c2ee63cd9def9821a4e6089642d1c95bf471af450d9802046cf929bdf1356147b47464965d58550dbe621a6f4adaa336625100a

Download Submit
C:\Windows\SysWOW64\Oaajed32.exe

Filesize
448KB

MD5
76a7cd52eb0dd345d00bb284a4033c1f

SHA1
68c9fc01ac7c4e5c7b01506a8eceae093879b396

SHA256
4e67acbc274ea9c47badced26ffbae85b6ff4f1c91f0adffcb2470075a1c7277

SHA512
fe0f8f38cc31fcd55f92df2c86766f9cccfa050948739cdb1e0a0ac2b38eaf43baa3c3702b2f5234e2194073796fc4a72a5a4eb03e90f669ecc0388a645ce7eb

Download Submit
C:\Windows\SysWOW64\Oflgep32.exe

Filesize
448KB

MD5
ac156da1462f5533e6436e808c3c583a

SHA1
9b94fa6580361ceb88186f883f4633c5d04bc5c2

SHA256
46dee90b415758c2b7f2f933e61eb435b950ad79f0e03079f7fe717a1218076b

SHA512
e79f5c022b524d5a3ed8498fad36e0d2caba355b25c9fbf6076aa7d70a6ad56ec60e1d6df4e050a17867a0983beb8a047400513f3ca046c4fb0500b3c1c12ae5

Download Submit
C:\Windows\SysWOW64\Oflgep32.exe

Filesize
439KB

MD5
50b645eafb9549022feff727befdf479

SHA1
ee68a5a500b045cbae5a7cbbb98e98d7e2d13024

SHA256
8b97c6aaca1f4e22321dc76d711c8a21102e9aff8997b017044831feb917c081

SHA512
8019526a0939e5bdf1544043effc2f73a672c3a1582f5e3e94a61cea54b3bec71e681004bc38b35e4b43e25bece655ff0493e2e8ae2b14225ad26346eaed7a00

Download Submit
C:\Windows\SysWOW64\Ojjolnaq.exe

Filesize
448KB

MD5
59ee31a9281b852d5b835b3bb4ca7244

SHA1
c19d2db586792e66fb8b7055fcc74ae3a8ef29c1

SHA256
b29ef3d8f89da36d2450be0811f8aece10941b32b097e7153d8afbf904e58a99

SHA512
fb65ea953a9a72542a568d5a808866c71b905f67f8691e90a94d5b998659fb9c249bc221fe8ae7ea2d610233bacf6f06e5c17ca4933f666441020c781552c54b

Download Submit
C:\Windows\SysWOW64\Onjegled.exe

Filesize
270KB

MD5
6ad23b971ba001797392c2e11585ff1d

SHA1
f2c418c6620645d23e7cbbcca52566356e23d75f

SHA256
bf87d84efff68758d13d7ddd4bfaf19eff7ce6759716b5a31dbb8925e6affc37

SHA512
17d4fca3e8497640ec1c26c13cc636fa6ddea46039c08f31a0ce4770e402ad1809cc308ed955d3ca132420b3ffdecef5dd80edab6e2108e7881d1492a495d84f

Download Submit
C:\Windows\SysWOW64\Onjegled.exe

Filesize
448KB

MD5
4264c0a2271136da34dec363bd1e24cd

SHA1
c63d2ae469ea91070dfbcf4a4eab2bea03439ab4

SHA256
6566f36eb213ef624d2dcf8a4ffd72a9f703870e2f5552d506b82c6026359131

SHA512
cbd0da934baa0b32425405c5f98e98230cc37e8781f769d2bc398ba383e0488cd3040fe8b6e248960b333a4f50452cffb0c9f2e0b23a10521168b8ad0785d71a

Download Submit
C:\Windows\SysWOW64\Onjegled.exe

Filesize
283KB

MD5
9355fdf883b0fd74dd923327888ca0cd

SHA1
9ba64c482ccb0113ae035c2b54ba1fdef5a647fb

SHA256
9c2596c4d0055293c13b95b728d503a56d578cbacf753104f8c5ac2bcb0ed504

SHA512
2afdedd1d62c1716971d42a2aee20384f7da019c222e180f3ebf0810a6a7831cf9740a5ad9dd98deb781091a34b029f66bff4206b084a5d74e08c4be0e0dfccc

Download Submit
C:\Windows\SysWOW64\Oqfdnhfk.exe

Filesize
448KB

MD5
e50fc84cf5475b09cc4527c6f5658e9a

SHA1
61401e086390222623481ad237e1ef29842b936f

SHA256
f9c3e4ec3b36d3816b2637c0524681d4ee2356070f9d3840001be954733cd107

SHA512
73f2aaebedcc2e14a1ffe3e282a386a93ac69119ccbf9d3893c17b03136c292e480470c93833a357d517ba14aa3be3c2305a826d451f00db4cf895432d959105

Download Submit
C:\Windows\SysWOW64\Oqfdnhfk.exe

Filesize
213KB

MD5
bb21f56e7512a04e9376c8b4815487d8

SHA1
da44af76f0a2dc449117e69e29e4e4353602dd49

SHA256
7df19268d94cb4a93280b88f3a663a7b32ae4025eb959a98e7dca4de2dde2e3c

SHA512
c8565015a055e6bbaac71ffeb07837a8d4d8956354046f36a83775c397a937889c4afaad6c67bab58098dcdf3646b2c04566e245e5636a9a649ec8d45b6508bb

Download Submit
C:\Windows\SysWOW64\Pakllc32.exe

Filesize
448KB

MD5
d9f4600d6c27839671701fea6adae306

SHA1
43b3c232a6da7d7f9a9276c960b109c13075e25a

SHA256
3f2a933b7e47768845c7756784ce8d1a03a44a03aff0f16e24e043fac4b7c2b7

SHA512
70b72825d143b10fe0b177cf54b7ab76419ab893145413edf4a46b1c60e9f38817b61a60e070778f982c583a9d7a7d68d80139a08941d84e777d4d4b1de197df

Download Submit
C:\Windows\SysWOW64\Pggbkagp.exe

Filesize
448KB

MD5
f1f75248b8839acd76df431765ad0ab5

SHA1
155cf7296b989a41075c219f0a329351c882b3de

SHA256
c6bf4d466a41b9eb0ccd6496a90067f94e660e28d0ceda040efbf206bdc4d740

SHA512
a9e3231ab44707d7fcef01c19830a17172f8246d51d6338064e6332107d088f6ef14c1a57384d90ea8a5435acb20fabf6cc03dc8c75edb998f4fda7b48733f73

Download Submit
C:\Windows\SysWOW64\Pggbkagp.exe

Filesize
412KB

MD5
06aadd7a49a7526acf2cb30f4d71008d

SHA1
d7f488e7f3b217fdac3d4b2e55608b543083b9db

SHA256
015b83dc83c238fbd7bced3b832437829edfeb80f2b6c2d455e3e97c6d7b4d7e

SHA512
1456b02050dc6b9529ed656c694c71a6f6157456f6842734f60281bc8e15296db06d75efaa3947b0e1ff1ceacea3ced21e5b5b2f3ae49acee7bba1f289eab84b

Download Submit
C:\Windows\SysWOW64\Pgioqq32.exe

Filesize
448KB

MD5
142a09e8eb3aaa47743220da3526106e

SHA1
836897e1cdbde8f6f036eab15e71eb9a2034bbf8

SHA256
3bc2cffec6f17a2bebfa58514bbd78859d2c681ef3dca19215d7570664cb7ae2

SHA512
7876abdd626cd2d55cd589b86faa55ce84ea033a6bde60ee00680a9f9df6c8de2030d78713061ecb255aa2c3ccc13ca33e147fa3ba759d7c0b37a9780d50571a

Download Submit
C:\Windows\SysWOW64\Pgnilpah.exe

Filesize
183KB

MD5
6523e34d213b3d696f2280d31b746a7b

SHA1
8aac6b994c4db12aad884a6c4a1b9917f5d27d03

SHA256
69ddf64795ba4581263308d2bed5f3ff31394d8b2c291c9f52ca4d17f16feb50

SHA512
24366e79d2c158c8ef72a6e404f021433efc1fe985aa872f44ef6d47fc77a6eb4483c72edf32378aca426a16d0d2c74b83e8c44f2157887539c306f78286e2ab

Download Submit
C:\Windows\SysWOW64\Pgnilpah.exe

Filesize
320KB

MD5
3f439d1525823c7d2258c38d9085ce42

SHA1
6f3c179ab55ab4bb548090d2ead1decba0dfe63a

SHA256
03f7ef041cb5dad16ab744c068a3431110000e3ab435671e0a643d1986d58157

SHA512
c22ad4026948f580db61cc494296e11d93ab4a7ef681c8e7d8ddeb6205753873bbdfc93dea371ec83f1faab0ba366eb033f9ec277d7d6a9d455b91be1b2dcb8e

Download Submit
C:\Windows\SysWOW64\Pjjhbl32.exe

Filesize
170KB

MD5
0caae09280eb0baeb7d54baf5941b26c

SHA1
f8371f580bf04e48fa1fd06be4d0617ce0fc9d0a

SHA256
cd92d8741c366c53186e30870039a38282720833f890f3defc322d8af20ad1a0

SHA512
915499e401bad1a821c8d7a63c51e2a22fdcbe6b44f87127f1f8548e59712c6887534477863f8dca4dc2cbf29a93183065fd5cb449ec882e8cd58eb0027b3aad

Download Submit
C:\Windows\SysWOW64\Pjjhbl32.exe

Filesize
448KB

MD5
32a011a2e9a3b7fa9b338ca82d852170

SHA1
d5efc41bfa7a5f01528e23c257a44ce8c54b786e

SHA256
d2f3be90c4a9362311c655a467d99e4648e79e40a1026eff978d5cecdd5feef1

SHA512
cd37d572a7e4e49a091cda701f64c479ced15733938604bd43666a0e808d9e1b34e5f6a79c2ddab232217ba6db1ab5046e1cc8f6d75a6edb55487aa41c2c6f1d

Download Submit
C:\Windows\SysWOW64\Pjjhbl32.exe

Filesize
283KB

MD5
380bdfcc017a6a24dfed5995c86b2b34

SHA1
f36e2bd2630917349cb00333fbd786b6bf66e0ae

SHA256
ccc175577dffe56d308a31eafcd191ca2fac7d3abcff86ee9ea37d9129c11d75

SHA512
f158a1dbe30ee0391723319be4a1e3101bfc9e7799150b3db57bd1ef8f702b60645ef930c58910a6989edafc440bdec848696c0fdd8d284be2b943c7904bf779

Download Submit
C:\Windows\SysWOW64\Pncgmkmj.exe

Filesize
380KB

MD5
afc0560bd1a57ce416e50ae7f95a8d10

SHA1
9809d6f27fb870422e64e4210eacbd1223622de1

SHA256
e6daa67b81a5d84f587fd63d42157decd9741385d828ea44b192fedb8d95d576

SHA512
49d79be1a7689cdc8dfea6c39717ca6f5fc8b7458c22073d502582a66effaf0aa9e08c6ef521e55077157ab464a577e7b392fe486b69122c276814f91b769ba5

Download Submit
C:\Windows\SysWOW64\Pncgmkmj.exe

Filesize
204KB

MD5
fe95fbe0bea1772b2c9f05c7985255c8

SHA1
e93cfb0c820fd03ab695fcff45a7683b1f4dd3f6

SHA256
1b8e221459d15af38a6db9e7725b18bcef967d75c582a6c4236cbb3e50c893e2

SHA512
0d7bc2316318cc00281b41f6cf0f957b9a7246b4cdc05c66aba03632297ee118b855433802468dbc8906cc97a689a742079bbd6cbc0faa77df65fe432f86beb3

Download Submit
C:\Windows\SysWOW64\Pojcjh32.exe

Filesize
448KB

MD5
f9dccd915a5d690c3d1b626bb75d7b1c

SHA1
28c2a3186d73ddfbcfe140e2a8583250c08c259d

SHA256
6a7ba85336184528b2cc76b8f1583b704c25516b488e3d4ec514f4d9f7c6f432

SHA512
75114de859e4400f1933208354592b03db3ee44c51c87e6b70d80e2280a75c9c08b6ba9c25fcc39697ed4e17178b4273274610035a811990830722f3711d2b3a

Download Submit
C:\Windows\SysWOW64\Pqknig32.exe

Filesize
404KB

MD5
5ad129fb2e577aaba69fb7983cffbe95

SHA1
a4f16d86f5ea0177526fcd3d46cd71902a8eb3b9

SHA256
85a3c355e2a1590d623f049d3deb0a7fc2e38f7b239855419396ff6f875b0d0b

SHA512
20dba8e02bbabc3ff99afc5139ef803dba9c9deb3354b1f22820a8b0a56ca8ef6032201ab71099d459b959f3022bb899bbb81be57a8fe20833391945ec4d55cf

Download Submit
C:\Windows\SysWOW64\Pqknig32.exe

Filesize
425KB

MD5
f0eb8f583cc76dfb8c5c1b0fdcb5ddff

SHA1
46a46836e3d254ee3261d8ebe2af1a266eb202ce

SHA256
ae5ec1cc1f1474d3faff99e49cf04ff229cc84641275400366ee476a42db9c6d

SHA512
48313580fa362706514b466e8eb22a84dc2128e044c22139e74245d3f811649a6be855c782bbc66c4f81ee0be8c035cd0138f2c5f1f86dd3e4da7fb585c46936

Download Submit
C:\Windows\SysWOW64\Qlmgopjq.exe

Filesize
448KB

MD5
c094be4d1f8082a7fcccf9168c605082

SHA1
33109858579d60a88ede0d51d202786abc63ed30

SHA256
6c852cda5f50c0866e99652bcd9e19d79229c770cb2d7c0be85656fc5ddea24c

SHA512
3804e4834528049d518674bb9a2502ed306c0b04e7cdf6cc68600ddf22dfed9d7c21a26638031decc41eb201ebda07b2a310833456ac64446ca7dd1bc78ead95

Download Submit
C:\Windows\SysWOW64\Qmmnjfnl.exe

Filesize
416KB

MD5
6a5f0d2adf4ac86eda5142fc8c3a4470

SHA1
76b1e05789d410dae4b5567330f8d27b8a18fd60

SHA256
7431b52f1e841fced8c7d238966e960a525aa537dadcd3038c075a858c1cd1b4

SHA512
bbcc0a99ce374326a54be194e03b0e79e0ef63bdf247f24ad18b108506fec543f77c50bc6fd53cc8a37d8035241e015ed08e2bd0db11afe606686297c2ba49ae

Download Submit
C:\Windows\SysWOW64\Qnhahj32.exe

Filesize
92KB

MD5
13155a69b87ba8dd21dd3d1c5c949b59

SHA1
736ae254ddcd6f83599e786967d504c86d195393

SHA256
eb7425f19ddb25a8ccc075b4330bdc76381ed2b6e8988667f26d857f01bcbd58

SHA512
282e25588499faedc47f4d97c8fa575b6a177ff00ac5f490d5b8049f68c882ca39d897ce76d855b5451f2d267401df206d141addf8255a8ef54eeae6492cdbd5

Download Submit
C:\Windows\SysWOW64\Qnhahj32.exe

Filesize
230KB

MD5
a9578f5685405575f17d9884bce10bf9

SHA1
e36076ff581e2b12862170ee25a1487e3eda3b53

SHA256
b129aee9ee4a6705cca6b9a3bbc7711fc583d387846cbc1aea4c2a4e9852cb8e

SHA512
f4ab17a80e985e30805baef78457e4601060f46e2fdd216305f507354bff991463cf104fcfe03146541dfde90cddd471f846d6c0872f54bf0735769b97099e67

Download Submit
memory/640-167-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/668-143-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/800-383-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/840-128-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/868-281-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/884-88-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/992-371-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1056-119-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1068-248-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1176-407-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1216-353-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1276-369-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1520-239-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1632-199-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1656-152-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1868-47-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2104-305-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2156-431-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2244-175-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2264-269-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2508-401-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2660-160-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2696-184-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2792-359-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2856-71-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3004-207-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3108-191-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3196-275-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3208-329-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3304-216-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3372-255-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3448-323-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3468-339-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3616-16-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3692-32-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3788-263-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3864-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4028-136-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4068-24-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4072-64-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4076-437-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4116-124-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4192-395-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4240-287-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4252-311-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4268-317-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4320-419-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4360-417-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4428-79-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4436-224-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4448-293-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4568-96-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4616-231-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4640-389-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4652-425-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4672-208-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4760-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4784-12-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4788-377-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4840-299-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4924-341-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4964-104-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5020-39-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5088-349-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads