f22dcb85002cf561f5155470df8d9d1b31c2192c662505f63a5a2c455caa35a2

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11-03-2024 01:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f22dcb85002cf561f5155470df8d9d1b31c2192c662505f63a5a2c455caa35a2.exe
Size

80KB
MD5

2d302d5b649f21f3b4bba287f9754285
SHA1

d5e51af904d178786bf5190b9e267b195d2b23cd
SHA256

f22dcb85002cf561f5155470df8d9d1b31c2192c662505f63a5a2c455caa35a2
SHA512

d013cbd127e9aca418ac127be31d458014badebdf6b9d00a84ce001bd9f327295834b16c44b9d0833442907acea514a5e44db1508b2d2b5986e9bac6318f527b
SSDEEP

1536:Usiuku0qq3TA7AuqkPp0rnhU2LN9J9VqDlzVxyh+CbxMa:RRt0V3mAuRPohtTJ9IDlRxyhTb7

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmnldp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dcjnoece.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qmeigg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkgiimng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hbhboolf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hoaojp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgkfnh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpgfooop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjjhbl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikcdlmgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iojbpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oclkgccf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbchba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dheibpje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jleijb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgcknmop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Addaif32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahfmpnql.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhppji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjnmpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpchib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mejpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmoohe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdmqmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpmdfonj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhmmjbkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Papfgbmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbqqkkbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Niooqcad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mccfdmmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eoekia32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gafmaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjkpoq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gojiiafp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oneklm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogmijllo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmbiamhi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqbpojnp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bqilgmdg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohnohn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnfihkqm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjepjkhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hoogfnnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnhpoamf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mejpje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akblfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gaamlecg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dcpmen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmlpaoaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgbbek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qlgpod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fggocmhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcinna32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnifekmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdabcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkleeplq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qqhcpo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dejacond.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohghgodi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cihclh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pibdmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhngolpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odmbaj32.exe

Executes dropped EXE 64 IoCs

pid	Process
2016	Kmdqgd32.exe
2200	Kdnidn32.exe
4200	Kikame32.exe
2072	Kpeiioac.exe
3456	Kfoafi32.exe
4252	Kpgfooop.exe
880	Kmkfhc32.exe
3968	Kibgmdcn.exe
4676	Lpnlpnih.exe
1716	Lboeaifi.exe
1604	Llgjjnlj.exe
3904	Lgmngglp.exe
4244	Lpebpm32.exe
4020	Medgncoe.exe
2780	Mmnldp32.exe
1880	Mckemg32.exe
5060	Mpablkhc.exe
5096	Mgkjhe32.exe
4420	Nilcjp32.exe
4496	Npfkgjdn.exe
1496	Ndcdmikd.exe
1096	Njqmepik.exe
3800	Nfgmjqop.exe
3584	Ndhmhh32.exe
4008	Njefqo32.exe
5020	Ogifjcdp.exe
3096	Olfobjbg.exe
3804	Ogkcpbam.exe
2960	Odocigqg.exe
4292	Odapnf32.exe
2572	Pcijeb32.exe
3516	Pmannhhj.exe
2052	Pfjcgn32.exe
3240	Pdkcde32.exe
4476	Pjhlml32.exe
4388	Pdmpje32.exe
1888	Pjjhbl32.exe
544	Pcbmka32.exe
2896	Qmkadgpo.exe
2560	Qnjnnj32.exe
5076	Qcgffqei.exe
2920	Aqkgpedc.exe
1932	Ajckij32.exe
4924	Ambgef32.exe
4512	Aeiofcji.exe
2848	Ajfhnjhq.exe
4380	Acnlgp32.exe
1828	Ajhddjfn.exe
3140	Aabmqd32.exe
1248	Afoeiklb.exe
1608	Aadifclh.exe
368	Bfabnjjp.exe
4800	Bmkjkd32.exe
2536	Bjokdipf.exe
3352	Bmngqdpj.exe
2644	Bgcknmop.exe
3088	Bmpcfdmg.exe
768	Bcjlcn32.exe
5068	Bnpppgdj.exe
4408	Bclhhnca.exe
4828	Bmemac32.exe
1188	Chjaol32.exe
3568	Cmgjgcgo.exe
212	Cdabcm32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Migidc32.dll	Ginnfgop.exe
File created	C:\Windows\SysWOW64\Hnfjbdmk.exe	Hglaej32.exe
File created	C:\Windows\SysWOW64\Eciplm32.exe	Emphocjj.exe
File opened for modification	C:\Windows\SysWOW64\Kjkpoq32.exe	Kenggi32.exe
File opened for modification	C:\Windows\SysWOW64\Mejpje32.exe	Mjellmbp.exe
File created	C:\Windows\SysWOW64\Bjnmpl32.exe	Bohibc32.exe
File opened for modification	C:\Windows\SysWOW64\Bnfihkqm.exe	Alelqb32.exe
File created	C:\Windows\SysWOW64\Eopjfnlo.dll	Pnfiplog.exe
File opened for modification	C:\Windows\SysWOW64\Bcjlcn32.exe	Bmpcfdmg.exe
File created	C:\Windows\SysWOW64\Ogpoeg32.dll	Anmfbl32.exe
File opened for modification	C:\Windows\SysWOW64\Jlgepanl.exe	Jmeede32.exe
File opened for modification	C:\Windows\SysWOW64\Ofhknodl.exe	Ocjoadei.exe
File created	C:\Windows\SysWOW64\Nkioig32.dll	Ibffhhek.exe
File opened for modification	C:\Windows\SysWOW64\Eeelnp32.exe	Ekmhejao.exe
File created	C:\Windows\SysWOW64\Ekdnei32.exe	Eifaim32.exe
File opened for modification	C:\Windows\SysWOW64\Lqojclne.exe	Ljeafb32.exe
File created	C:\Windows\SysWOW64\Daediilg.exe	Djklmo32.exe
File created	C:\Windows\SysWOW64\Mgekdpbp.dll	Okchnk32.exe
File created	C:\Windows\SysWOW64\Jlgepanl.exe	Jmeede32.exe
File opened for modification	C:\Windows\SysWOW64\Cdimqm32.exe	Bajqda32.exe
File created	C:\Windows\SysWOW64\Fdijbg32.exe	Fnobem32.exe
File opened for modification	C:\Windows\SysWOW64\Mjokgg32.exe	Mmkkmc32.exe
File created	C:\Windows\SysWOW64\Cocopa32.dll	Enbjad32.exe
File created	C:\Windows\SysWOW64\Lpneegel.exe	Keakgpko.exe
File created	C:\Windows\SysWOW64\Liqihglg.exe	Lajagj32.exe
File opened for modification	C:\Windows\SysWOW64\Flmqlg32.exe	Fiodpl32.exe
File created	C:\Windows\SysWOW64\Jcoaglhk.exe	Jpaekqhh.exe
File created	C:\Windows\SysWOW64\Bjokdipf.exe	Bmkjkd32.exe
File opened for modification	C:\Windows\SysWOW64\Djhimica.exe	Dbqqkkbo.exe
File created	C:\Windows\SysWOW64\Icpkgc32.dll	Hlegnjbm.exe
File opened for modification	C:\Windows\SysWOW64\Alnfpcag.exe	Adfnofpd.exe
File opened for modification	C:\Windows\SysWOW64\Kndojobi.exe	Kkfcndce.exe
File created	C:\Windows\SysWOW64\Bcinna32.exe	Bmofagfp.exe
File created	C:\Windows\SysWOW64\Ljobpiql.exe	Lgqfdnah.exe
File created	C:\Windows\SysWOW64\Plpjoe32.exe	Pajeam32.exe
File opened for modification	C:\Windows\SysWOW64\Cggimh32.exe	Cdimqm32.exe
File created	C:\Windows\SysWOW64\Ennamn32.dll	Cklhcfle.exe
File opened for modification	C:\Windows\SysWOW64\Fgbfhmll.exe	Ffpicn32.exe
File created	C:\Windows\SysWOW64\Ejlbhh32.exe	Dcpmen32.exe
File created	C:\Windows\SysWOW64\Jkchlonc.dll	Clgbmp32.exe
File created	C:\Windows\SysWOW64\Bpcaaeme.dll	Afpjel32.exe
File opened for modification	C:\Windows\SysWOW64\Amlogfel.exe	Adcjop32.exe
File created	C:\Windows\SysWOW64\Fjegoh32.dll	Nfgmjqop.exe
File created	C:\Windows\SysWOW64\Olgncmim.exe	Oihagaji.exe
File opened for modification	C:\Windows\SysWOW64\Bckkca32.exe	Bheffh32.exe
File created	C:\Windows\SysWOW64\Dckdjomg.exe	Dkdliame.exe
File opened for modification	C:\Windows\SysWOW64\Najmjokc.exe	Nnkpnclp.exe
File created	C:\Windows\SysWOW64\Anmfbl32.exe	Alkijdci.exe
File opened for modification	C:\Windows\SysWOW64\Gnqfcbnj.exe	Gfeaopqo.exe
File created	C:\Windows\SysWOW64\Eoonaj32.dll	Iigdfa32.exe
File opened for modification	C:\Windows\SysWOW64\Okchnk32.exe	Nhdlao32.exe
File created	C:\Windows\SysWOW64\Fideeaco.exe	Fdglmkeg.exe
File created	C:\Windows\SysWOW64\Gfokoelp.exe	Gpcfmkff.exe
File opened for modification	C:\Windows\SysWOW64\Icfekc32.exe	Ilmmni32.exe
File created	C:\Windows\SysWOW64\Bkibgh32.exe	Bpdnjple.exe
File opened for modification	C:\Windows\SysWOW64\Medgncoe.exe	Lpebpm32.exe
File opened for modification	C:\Windows\SysWOW64\Nfgmjqop.exe	Njqmepik.exe
File created	C:\Windows\SysWOW64\Dfljoa32.dll	Ajqgidij.exe
File created	C:\Windows\SysWOW64\Jbfheo32.exe	Jklphekp.exe
File created	C:\Windows\SysWOW64\Fpjcgm32.exe	Fipkjb32.exe
File created	C:\Windows\SysWOW64\Ggnjnq32.dll	Ejflhm32.exe
File created	C:\Windows\SysWOW64\Ehjlaaig.exe	Eaqdegaj.exe
File created	C:\Windows\SysWOW64\Aboncdme.dll	Hgnoki32.exe
File created	C:\Windows\SysWOW64\Camfoh32.dll	Leopnglc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
13964	7788	WerFault.exe	950

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jghdlf32.dll"	Dcjnoece.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocgmoc32.dll"	Ajdjin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnmoijje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ojhpimhp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lboeaifi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nfgmjqop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcjlcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdpaeehj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Enbjad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjmejn32.dll"	Gahjgj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kelkaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmoiqneg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Plpqil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Abponp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddooacnk.dll"	Iljpij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Phaahggp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekgbccni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Idajkk32.dll"	Hammhcij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnoigi32.dll"	Pkogiikb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qepkbpak.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aonoao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpmcmd32.dll"	Amaqjp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Efdjgo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nijeec32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lelchgne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhaimehd.dll"	Bckkca32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bdpaeehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jodjhkkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Noekdfjb.dll"	Kijjbofj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lgcjdd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndhmhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olgemcli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kaehljpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djhimica.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikgbdnie.dll"	Igajal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehjhee32.dll"	Fehfljca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nobdka32.dll"	Gafmaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgklej32.dll"	Hjhalefe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bohibc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gingkqkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfdpad32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fiodpl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfdjinjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nookip32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fgbfhmll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akffafgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pffgom32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddgibkpc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Leadnm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bogcgj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmkbfeab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocaegbjb.dll"	Idieem32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nhmofj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpkpbaea.dll"	Mqfpckhm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmdqgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Koijai32.dll"	Hgjljpkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkioig32.dll"	Ibffhhek.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnegbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mcpeiqdc.dll"	Dmbbhkjf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dcpmen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfjdqmng.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qhonib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqhajknb.dll"	Aqkpeopg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oodcdb32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 2016	3236	f22dcb85002cf561f5155470df8d9d1b31c2192c662505f63a5a2c455caa35a2.exe	90
PID 3236 wrote to memory of 2016	3236	f22dcb85002cf561f5155470df8d9d1b31c2192c662505f63a5a2c455caa35a2.exe	90
PID 3236 wrote to memory of 2016	3236	f22dcb85002cf561f5155470df8d9d1b31c2192c662505f63a5a2c455caa35a2.exe	90
PID 2016 wrote to memory of 2200	2016	Kmdqgd32.exe	91
PID 2016 wrote to memory of 2200	2016	Kmdqgd32.exe	91
PID 2016 wrote to memory of 2200	2016	Kmdqgd32.exe	91
PID 2200 wrote to memory of 4200	2200	Kdnidn32.exe	92
PID 2200 wrote to memory of 4200	2200	Kdnidn32.exe	92
PID 2200 wrote to memory of 4200	2200	Kdnidn32.exe	92
PID 4200 wrote to memory of 2072	4200	Kikame32.exe	93
PID 4200 wrote to memory of 2072	4200	Kikame32.exe	93
PID 4200 wrote to memory of 2072	4200	Kikame32.exe	93
PID 2072 wrote to memory of 3456	2072	Kpeiioac.exe	94
PID 2072 wrote to memory of 3456	2072	Kpeiioac.exe	94
PID 2072 wrote to memory of 3456	2072	Kpeiioac.exe	94
PID 3456 wrote to memory of 4252	3456	Kfoafi32.exe	95
PID 3456 wrote to memory of 4252	3456	Kfoafi32.exe	95
PID 3456 wrote to memory of 4252	3456	Kfoafi32.exe	95
PID 4252 wrote to memory of 880	4252	Kpgfooop.exe	96
PID 4252 wrote to memory of 880	4252	Kpgfooop.exe	96
PID 4252 wrote to memory of 880	4252	Kpgfooop.exe	96
PID 880 wrote to memory of 3968	880	Kmkfhc32.exe	97
PID 880 wrote to memory of 3968	880	Kmkfhc32.exe	97
PID 880 wrote to memory of 3968	880	Kmkfhc32.exe	97
PID 3968 wrote to memory of 4676	3968	Kibgmdcn.exe	98
PID 3968 wrote to memory of 4676	3968	Kibgmdcn.exe	98
PID 3968 wrote to memory of 4676	3968	Kibgmdcn.exe	98
PID 4676 wrote to memory of 1716	4676	Lpnlpnih.exe	99
PID 4676 wrote to memory of 1716	4676	Lpnlpnih.exe	99
PID 4676 wrote to memory of 1716	4676	Lpnlpnih.exe	99
PID 1716 wrote to memory of 1604	1716	Lboeaifi.exe	100
PID 1716 wrote to memory of 1604	1716	Lboeaifi.exe	100
PID 1716 wrote to memory of 1604	1716	Lboeaifi.exe	100
PID 1604 wrote to memory of 3904	1604	Llgjjnlj.exe	101
PID 1604 wrote to memory of 3904	1604	Llgjjnlj.exe	101
PID 1604 wrote to memory of 3904	1604	Llgjjnlj.exe	101
PID 3904 wrote to memory of 4244	3904	Lgmngglp.exe	102
PID 3904 wrote to memory of 4244	3904	Lgmngglp.exe	102
PID 3904 wrote to memory of 4244	3904	Lgmngglp.exe	102
PID 4244 wrote to memory of 4020	4244	Lpebpm32.exe	103
PID 4244 wrote to memory of 4020	4244	Lpebpm32.exe	103
PID 4244 wrote to memory of 4020	4244	Lpebpm32.exe	103
PID 4020 wrote to memory of 2780	4020	Medgncoe.exe	104
PID 4020 wrote to memory of 2780	4020	Medgncoe.exe	104
PID 4020 wrote to memory of 2780	4020	Medgncoe.exe	104
PID 2780 wrote to memory of 1880	2780	Mmnldp32.exe	105
PID 2780 wrote to memory of 1880	2780	Mmnldp32.exe	105
PID 2780 wrote to memory of 1880	2780	Mmnldp32.exe	105
PID 1880 wrote to memory of 5060	1880	Mckemg32.exe	106
PID 1880 wrote to memory of 5060	1880	Mckemg32.exe	106
PID 1880 wrote to memory of 5060	1880	Mckemg32.exe	106
PID 5060 wrote to memory of 5096	5060	Mpablkhc.exe	107
PID 5060 wrote to memory of 5096	5060	Mpablkhc.exe	107
PID 5060 wrote to memory of 5096	5060	Mpablkhc.exe	107
PID 5096 wrote to memory of 4420	5096	Mgkjhe32.exe	108
PID 5096 wrote to memory of 4420	5096	Mgkjhe32.exe	108
PID 5096 wrote to memory of 4420	5096	Mgkjhe32.exe	108
PID 4420 wrote to memory of 4496	4420	Nilcjp32.exe	109
PID 4420 wrote to memory of 4496	4420	Nilcjp32.exe	109
PID 4420 wrote to memory of 4496	4420	Nilcjp32.exe	109
PID 4496 wrote to memory of 1496	4496	Npfkgjdn.exe	110
PID 4496 wrote to memory of 1496	4496	Npfkgjdn.exe	110
PID 4496 wrote to memory of 1496	4496	Npfkgjdn.exe	110
PID 1496 wrote to memory of 1096	1496	Ndcdmikd.exe	111

C:\Users\Admin\AppData\Local\Temp\f22dcb85002cf561f5155470df8d9d1b31c2192c662505f63a5a2c455caa35a2.exe
"C:\Users\Admin\AppData\Local\Temp\f22dcb85002cf561f5155470df8d9d1b31c2192c662505f63a5a2c455caa35a2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Windows\SysWOW64\Kmdqgd32.exe
  C:\Windows\system32\Kmdqgd32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\Kdnidn32.exe
    C:\Windows\system32\Kdnidn32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Windows\SysWOW64\Kikame32.exe
      C:\Windows\system32\Kikame32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4200
    - - C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2072
      - C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3456
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:880
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3968
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1716
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1604
        
        C:\Windows\SysWOW64\Lgmngglp.exe
        
        C:\Windows\system32\Lgmngglp.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3904
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\Windows\SysWOW64\Medgncoe.exe
        
        C:\Windows\system32\Medgncoe.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4020
        
        C:\Windows\SysWOW64\Mmnldp32.exe
        
        C:\Windows\system32\Mmnldp32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1880
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5060
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5096
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4420
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4496
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1496
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1096
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3800
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3584
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        26⤵
        Executes dropped EXE
        
        PID:4008
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        27⤵
        Executes dropped EXE
        
        PID:5020
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        28⤵
        Executes dropped EXE
        
        PID:3096
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        29⤵
        Executes dropped EXE
        
        PID:3804
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3060
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        31⤵
        Executes dropped EXE
        
        PID:2960
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        32⤵
        Executes dropped EXE
        
        PID:4292
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        33⤵
        Executes dropped EXE
        
        PID:2572
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        34⤵
        Executes dropped EXE
        
        PID:3516
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        35⤵
        Executes dropped EXE
        
        PID:2052
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        36⤵
        Executes dropped EXE
        
        PID:3240
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        37⤵
        Executes dropped EXE
        
        PID:4476
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        38⤵
        Executes dropped EXE
        
        PID:4388
        
        C:\Windows\SysWOW64\Pjjhbl32.exe
        
        C:\Windows\system32\Pjjhbl32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1888
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        40⤵
        Executes dropped EXE
        
        PID:544
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        41⤵
        Executes dropped EXE
        
        PID:2896
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        42⤵
        Executes dropped EXE
        
        PID:2560
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        43⤵
        Executes dropped EXE
        
        PID:5076
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        44⤵
        Executes dropped EXE
        
        PID:2920
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        45⤵
        Executes dropped EXE
        
        PID:1932
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        46⤵
        Executes dropped EXE
        
        PID:4924
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        47⤵
        Executes dropped EXE
        
        PID:4512
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        48⤵
        Executes dropped EXE
        
        PID:2848
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        49⤵
        Executes dropped EXE
        
        PID:4380
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        50⤵
        Executes dropped EXE
        
        PID:1828
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        51⤵
        Executes dropped EXE
        
        PID:3140
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        52⤵
        Executes dropped EXE
        
        PID:1248
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        53⤵
        Executes dropped EXE
        
        PID:1608
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        54⤵
        Executes dropped EXE
        
        PID:368
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4800
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        56⤵
        Executes dropped EXE
        
        PID:2536
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        57⤵
        Executes dropped EXE
        
        PID:3352
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2644
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3088
        
        C:\Windows\SysWOW64\Bcjlcn32.exe
        
        C:\Windows\system32\Bcjlcn32.exe
        60⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:768
        
        C:\Windows\SysWOW64\Bnpppgdj.exe
        
        C:\Windows\system32\Bnpppgdj.exe
        61⤵
        Executes dropped EXE
        
        PID:5068
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        62⤵
        Executes dropped EXE
        
        PID:4408
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        63⤵
        Executes dropped EXE
        
        PID:4828
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        64⤵
        Executes dropped EXE
        
        PID:1188
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        65⤵
        Executes dropped EXE
        
        PID:3568
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:212
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        67⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\Cdcoim32.exe
        
        C:\Windows\system32\Cdcoim32.exe
        68⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\Cjmgfgdf.exe
        
        C:\Windows\system32\Cjmgfgdf.exe
        69⤵
        
        PID:376
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        70⤵
        
        PID:64
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        71⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        72⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        73⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        74⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:636
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        76⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        77⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        78⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\Eecdjmfi.exe
        
        C:\Windows\system32\Eecdjmfi.exe
        79⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\Eefaomcg.exe
        
        C:\Windows\system32\Eefaomcg.exe
        80⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Ehdmlhcj.exe
        
        C:\Windows\system32\Ehdmlhcj.exe
        81⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Ealadnik.exe
        
        C:\Windows\system32\Ealadnik.exe
        82⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Ehfjah32.exe
        
        C:\Windows\system32\Ehfjah32.exe
        83⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Emcbio32.exe
        
        C:\Windows\system32\Emcbio32.exe
        84⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Eejjjl32.exe
        
        C:\Windows\system32\Eejjjl32.exe
        85⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Ekgbccni.exe
        
        C:\Windows\system32\Ekgbccni.exe
        86⤵
        Modifies registry class
        
        PID:5388
        
        C:\Windows\SysWOW64\Edpgli32.exe
        
        C:\Windows\system32\Edpgli32.exe
        87⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Eoekia32.exe
        
        C:\Windows\system32\Eoekia32.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5480
        
        C:\Windows\SysWOW64\Eachem32.exe
        
        C:\Windows\system32\Eachem32.exe
        89⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Fdbdah32.exe
        
        C:\Windows\system32\Fdbdah32.exe
        90⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Foghnabl.exe
        
        C:\Windows\system32\Foghnabl.exe
        91⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Fojedapj.exe
        
        C:\Windows\system32\Fojedapj.exe
        92⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Fedmqk32.exe
        
        C:\Windows\system32\Fedmqk32.exe
        93⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Fdfmlhna.exe
        
        C:\Windows\system32\Fdfmlhna.exe
        94⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Fnobem32.exe
        
        C:\Windows\system32\Fnobem32.exe
        95⤵
        Drops file in System32 directory
        
        PID:5840
        
        C:\Windows\SysWOW64\Fdijbg32.exe
        
        C:\Windows\system32\Fdijbg32.exe
        96⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Fonnop32.exe
        
        C:\Windows\system32\Fonnop32.exe
        97⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Fehfljca.exe
        
        C:\Windows\system32\Fehfljca.exe
        98⤵
        Modifies registry class
        
        PID:5992
        
        C:\Windows\SysWOW64\Fhgbhfbe.exe
        
        C:\Windows\system32\Fhgbhfbe.exe
        99⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Foqkdp32.exe
        
        C:\Windows\system32\Foqkdp32.exe
        100⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Gekcaj32.exe
        
        C:\Windows\system32\Gekcaj32.exe
        101⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Ghipne32.exe
        
        C:\Windows\system32\Ghipne32.exe
        102⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Gochjpho.exe
        
        C:\Windows\system32\Gochjpho.exe
        103⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Gempgj32.exe
        
        C:\Windows\system32\Gempgj32.exe
        104⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Ggnlobej.exe
        
        C:\Windows\system32\Ggnlobej.exe
        105⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Gnhdkl32.exe
        
        C:\Windows\system32\Gnhdkl32.exe
        106⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Gepmlimi.exe
        
        C:\Windows\system32\Gepmlimi.exe
        107⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\Gdbmhf32.exe
        
        C:\Windows\system32\Gdbmhf32.exe
        108⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Gkleeplq.exe
        
        C:\Windows\system32\Gkleeplq.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5672
        
        C:\Windows\SysWOW64\Gafmaj32.exe
        
        C:\Windows\system32\Gafmaj32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5756
        
        C:\Windows\SysWOW64\Ghpendjj.exe
        
        C:\Windows\system32\Ghpendjj.exe
        111⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Gkobjpin.exe
        
        C:\Windows\system32\Gkobjpin.exe
        112⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Gahjgj32.exe
        
        C:\Windows\system32\Gahjgj32.exe
        113⤵
        Modifies registry class
        
        PID:5924
        
        C:\Windows\SysWOW64\Gdgfce32.exe
        
        C:\Windows\system32\Gdgfce32.exe
        114⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Goljqnpd.exe
        
        C:\Windows\system32\Goljqnpd.exe
        115⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Hakgmjoh.exe
        
        C:\Windows\system32\Hakgmjoh.exe
        116⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Hheoid32.exe
        
        C:\Windows\system32\Hheoid32.exe
        117⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Hoogfnnb.exe
        
        C:\Windows\system32\Hoogfnnb.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5468
        
        C:\Windows\SysWOW64\Hfipbh32.exe
        
        C:\Windows\system32\Hfipbh32.exe
        119⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Hgjljpkm.exe
        
        C:\Windows\system32\Hgjljpkm.exe
        120⤵
        Modifies registry class
        
        PID:5736
        
        C:\Windows\SysWOW64\Hnddgjbj.exe
        
        C:\Windows\system32\Hnddgjbj.exe
        121⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Hdnldd32.exe
        
        C:\Windows\system32\Hdnldd32.exe
        122⤵
        
        PID:928
        
        C:\Windows\SysWOW64\Hocqam32.exe
        
        C:\Windows\system32\Hocqam32.exe
        123⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Hbbmmi32.exe
        
        C:\Windows\system32\Hbbmmi32.exe
        124⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Hkjafn32.exe
        
        C:\Windows\system32\Hkjafn32.exe
        125⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Hninbj32.exe
        
        C:\Windows\system32\Hninbj32.exe
        126⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Hdbfodfa.exe
        
        C:\Windows\system32\Hdbfodfa.exe
        127⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Hgabkoee.exe
        
        C:\Windows\system32\Hgabkoee.exe
        128⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Ibffhhek.exe
        
        C:\Windows\system32\Ibffhhek.exe
        129⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6136
        
        C:\Windows\SysWOW64\Ihqoeb32.exe
        
        C:\Windows\system32\Ihqoeb32.exe
        130⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Ikokan32.exe
        
        C:\Windows\system32\Ikokan32.exe
        131⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Ibicnh32.exe
        
        C:\Windows\system32\Ibicnh32.exe
        132⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\Idgojc32.exe
        
        C:\Windows\system32\Idgojc32.exe
        133⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Ikaggmii.exe
        
        C:\Windows\system32\Ikaggmii.exe
        134⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Iomcgl32.exe
        
        C:\Windows\system32\Iomcgl32.exe
        135⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Ifgldfio.exe
        
        C:\Windows\system32\Ifgldfio.exe
        136⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Ikcdlmgf.exe
        
        C:\Windows\system32\Ikcdlmgf.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6352
        
        C:\Windows\SysWOW64\Ibnligoc.exe
        
        C:\Windows\system32\Ibnligoc.exe
        138⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Iigdfa32.exe
        
        C:\Windows\system32\Iigdfa32.exe
        139⤵
        Drops file in System32 directory
        
        PID:6444
        
        C:\Windows\SysWOW64\Ioambknl.exe
        
        C:\Windows\system32\Ioambknl.exe
        140⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Iijaka32.exe
        
        C:\Windows\system32\Iijaka32.exe
        141⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Jodjhkkj.exe
        
        C:\Windows\system32\Jodjhkkj.exe
        142⤵
        Modifies registry class
        
        PID:6576
        
        C:\Windows\SysWOW64\Jbbfdfkn.exe
        
        C:\Windows\system32\Jbbfdfkn.exe
        143⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Jeqbpb32.exe
        
        C:\Windows\system32\Jeqbpb32.exe
        144⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Jkkjmlan.exe
        
        C:\Windows\system32\Jkkjmlan.exe
        145⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Jfpojead.exe
        
        C:\Windows\system32\Jfpojead.exe
        146⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Jiokfpph.exe
        
        C:\Windows\system32\Jiokfpph.exe
        147⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Jgdhgmep.exe
        
        C:\Windows\system32\Jgdhgmep.exe
        148⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Jehhaaci.exe
        
        C:\Windows\system32\Jehhaaci.exe
        149⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Jgfdmlcm.exe
        
        C:\Windows\system32\Jgfdmlcm.exe
        150⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Jblijebc.exe
        
        C:\Windows\system32\Jblijebc.exe
        151⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Jejefqaf.exe
        
        C:\Windows\system32\Jejefqaf.exe
        152⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Kldmckic.exe
        
        C:\Windows\system32\Kldmckic.exe
        153⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Knbiofhg.exe
        
        C:\Windows\system32\Knbiofhg.exe
        154⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Kgknhl32.exe
        
        C:\Windows\system32\Kgknhl32.exe
        155⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Kbpbed32.exe
        
        C:\Windows\system32\Kbpbed32.exe
        156⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Kijjbofj.exe
        
        C:\Windows\system32\Kijjbofj.exe
        157⤵
        Modifies registry class
        
        PID:6244
        
        C:\Windows\SysWOW64\Kngcje32.exe
        
        C:\Windows\system32\Kngcje32.exe
        158⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Keakgpko.exe
        
        C:\Windows\system32\Keakgpko.exe
        159⤵
        Drops file in System32 directory
        
        PID:6412
        
        C:\Windows\SysWOW64\Lpneegel.exe
        
        C:\Windows\system32\Lpneegel.exe
        160⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Lifjnm32.exe
        
        C:\Windows\system32\Lifjnm32.exe
        161⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Lldfjh32.exe
        
        C:\Windows\system32\Lldfjh32.exe
        162⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Lbnngbbn.exe
        
        C:\Windows\system32\Lbnngbbn.exe
        163⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Lihfcm32.exe
        
        C:\Windows\system32\Lihfcm32.exe
        164⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Lpbopfag.exe
        
        C:\Windows\system32\Lpbopfag.exe
        165⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Lbqklb32.exe
        
        C:\Windows\system32\Lbqklb32.exe
        166⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Likcilhh.exe
        
        C:\Windows\system32\Likcilhh.exe
        167⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Lpekef32.exe
        
        C:\Windows\system32\Lpekef32.exe
        168⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Lbchba32.exe
        
        C:\Windows\system32\Lbchba32.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7140
        
        C:\Windows\SysWOW64\Leadnm32.exe
        
        C:\Windows\system32\Leadnm32.exe
        170⤵
        Modifies registry class
        
        PID:6236
        
        C:\Windows\SysWOW64\Mhppji32.exe
        
        C:\Windows\system32\Mhppji32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6316
        
        C:\Windows\SysWOW64\Mfaqhp32.exe
        
        C:\Windows\system32\Mfaqhp32.exe
        172⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Mhbmphjm.exe
        
        C:\Windows\system32\Mhbmphjm.exe
        173⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Molelb32.exe
        
        C:\Windows\system32\Molelb32.exe
        174⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Mefmimif.exe
        
        C:\Windows\system32\Mefmimif.exe
        175⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Mlpeff32.exe
        
        C:\Windows\system32\Mlpeff32.exe
        176⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Midfokpm.exe
        
        C:\Windows\system32\Midfokpm.exe
        177⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Mpnnle32.exe
        
        C:\Windows\system32\Mpnnle32.exe
        178⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Mhicpg32.exe
        
        C:\Windows\system32\Mhicpg32.exe
        179⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Mfjcnold.exe
        
        C:\Windows\system32\Mfjcnold.exe
        180⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Nlglfe32.exe
        
        C:\Windows\system32\Nlglfe32.exe
        181⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Nhnlkfpp.exe
        
        C:\Windows\system32\Nhnlkfpp.exe
        182⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Nohehq32.exe
        
        C:\Windows\system32\Nohehq32.exe
        183⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Nlleaeff.exe
        
        C:\Windows\system32\Nlleaeff.exe
        184⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\Ngaionfl.exe
        
        C:\Windows\system32\Ngaionfl.exe
        185⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\Nomncpcg.exe
        
        C:\Windows\system32\Nomncpcg.exe
        186⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Neffpj32.exe
        
        C:\Windows\system32\Neffpj32.exe
        187⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Nheble32.exe
        
        C:\Windows\system32\Nheble32.exe
        188⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Nookip32.exe
        
        C:\Windows\system32\Nookip32.exe
        189⤵
        Modifies registry class
        
        PID:3776
        
        C:\Windows\SysWOW64\Oeicejia.exe
        
        C:\Windows\system32\Oeicejia.exe
        190⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Olckbd32.exe
        
        C:\Windows\system32\Olckbd32.exe
        191⤵
        
        PID:3640
        
        C:\Windows\SysWOW64\Oghppm32.exe
        
        C:\Windows\system32\Oghppm32.exe
        192⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Opadhb32.exe
        
        C:\Windows\system32\Opadhb32.exe
        193⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Oiihahme.exe
        
        C:\Windows\system32\Oiihahme.exe
        194⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Olgemcli.exe
        
        C:\Windows\system32\Olgemcli.exe
        195⤵
        Modifies registry class
        
        PID:7224
        
        C:\Windows\SysWOW64\Ogmijllo.exe
        
        C:\Windows\system32\Ogmijllo.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7264
        
        C:\Windows\SysWOW64\Oileggkb.exe
        
        C:\Windows\system32\Oileggkb.exe
        197⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Oljaccjf.exe
        
        C:\Windows\system32\Oljaccjf.exe
        198⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Ojnblg32.exe
        
        C:\Windows\system32\Ojnblg32.exe
        199⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Pgbbek32.exe
        
        C:\Windows\system32\Pgbbek32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7436
        
        C:\Windows\SysWOW64\Ppjgoaoj.exe
        
        C:\Windows\system32\Ppjgoaoj.exe
        201⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Pfgogh32.exe
        
        C:\Windows\system32\Pfgogh32.exe
        202⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Plagcbdn.exe
        
        C:\Windows\system32\Plagcbdn.exe
        203⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Pckppl32.exe
        
        C:\Windows\system32\Pckppl32.exe
        204⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Plcdiabk.exe
        
        C:\Windows\system32\Plcdiabk.exe
        205⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Pflibgil.exe
        
        C:\Windows\system32\Pflibgil.exe
        206⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Phjenbhp.exe
        
        C:\Windows\system32\Phjenbhp.exe
        207⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Ppamophb.exe
        
        C:\Windows\system32\Ppamophb.exe
        208⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Plhnda32.exe
        
        C:\Windows\system32\Plhnda32.exe
        209⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Pofjpl32.exe
        
        C:\Windows\system32\Pofjpl32.exe
        210⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Qhonib32.exe
        
        C:\Windows\system32\Qhonib32.exe
        211⤵
        Modifies registry class
        
        PID:7904
        
        C:\Windows\SysWOW64\Qgpogili.exe
        
        C:\Windows\system32\Qgpogili.exe
        212⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Qqhcpo32.exe
        
        C:\Windows\system32\Qqhcpo32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7988
        
        C:\Windows\SysWOW64\Afelhf32.exe
        
        C:\Windows\system32\Afelhf32.exe
        214⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Ajqgidij.exe
        
        C:\Windows\system32\Ajqgidij.exe
        215⤵
        Drops file in System32 directory
        
        PID:8068
        
        C:\Windows\SysWOW64\Aqkpeopg.exe
        
        C:\Windows\system32\Aqkpeopg.exe
        216⤵
        Modifies registry class
        
        PID:8112
        
        C:\Windows\SysWOW64\Aompak32.exe
        
        C:\Windows\system32\Aompak32.exe
        217⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Ajcdnd32.exe
        
        C:\Windows\system32\Ajcdnd32.exe
        218⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\Amaqjp32.exe
        
        C:\Windows\system32\Amaqjp32.exe
        219⤵
        Modifies registry class
        
        PID:7208
        
        C:\Windows\SysWOW64\Aopmfk32.exe
        
        C:\Windows\system32\Aopmfk32.exe
        220⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Afnnnd32.exe
        
        C:\Windows\system32\Afnnnd32.exe
        221⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Amhfkopc.exe
        
        C:\Windows\system32\Amhfkopc.exe
        222⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Bogcgj32.exe
        
        C:\Windows\system32\Bogcgj32.exe
        223⤵
        Modifies registry class
        
        PID:7528
        
        C:\Windows\SysWOW64\Bgnkhg32.exe
        
        C:\Windows\system32\Bgnkhg32.exe
        224⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Bmkcqn32.exe
        
        C:\Windows\system32\Bmkcqn32.exe
        225⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Bfchidda.exe
        
        C:\Windows\system32\Bfchidda.exe
        226⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Bqilgmdg.exe
        
        C:\Windows\system32\Bqilgmdg.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7872
        
        C:\Windows\SysWOW64\Bjaqpbkh.exe
        
        C:\Windows\system32\Bjaqpbkh.exe
        228⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Bciehh32.exe
        
        C:\Windows\system32\Bciehh32.exe
        229⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Bmbiamhi.exe
        
        C:\Windows\system32\Bmbiamhi.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8080
        
        C:\Windows\SysWOW64\Bclang32.exe
        
        C:\Windows\system32\Bclang32.exe
        231⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Bfjnjcni.exe
        
        C:\Windows\system32\Bfjnjcni.exe
        232⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Bihjfnmm.exe
        
        C:\Windows\system32\Bihjfnmm.exe
        233⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Cmfclm32.exe
        
        C:\Windows\system32\Cmfclm32.exe
        234⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Cfogeb32.exe
        
        C:\Windows\system32\Cfogeb32.exe
        235⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Cpglnhad.exe
        
        C:\Windows\system32\Cpglnhad.exe
        236⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Cippgm32.exe
        
        C:\Windows\system32\Cippgm32.exe
        237⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Cfcqpa32.exe
        
        C:\Windows\system32\Cfcqpa32.exe
        238⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Cmniml32.exe
        
        C:\Windows\system32\Cmniml32.exe
        239⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Ccgajfeh.exe
        
        C:\Windows\system32\Ccgajfeh.exe
        240⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\Cidjbmcp.exe
        
        C:\Windows\system32\Cidjbmcp.exe
        241⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Dcjnoece.exe
        
        C:\Windows\system32\Dcjnoece.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4764
        
        C:\Windows\SysWOW64\Dmbbhkjf.exe
        
        C:\Windows\system32\Dmbbhkjf.exe
        243⤵
        Modifies registry class
        
        PID:8160
        
        C:\Windows\SysWOW64\Dmdonkgc.exe
        
        C:\Windows\system32\Dmdonkgc.exe
        244⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Djhpgofm.exe
        
        C:\Windows\system32\Djhpgofm.exe
        245⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Djklmo32.exe
        
        C:\Windows\system32\Djklmo32.exe
        246⤵
        Drops file in System32 directory
        
        PID:7572
        
        C:\Windows\SysWOW64\Daediilg.exe
        
        C:\Windows\system32\Daediilg.exe
        247⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Djmibn32.exe
        
        C:\Windows\system32\Djmibn32.exe
        248⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Edemkd32.exe
        
        C:\Windows\system32\Edemkd32.exe
        249⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Efdjgo32.exe
        
        C:\Windows\system32\Efdjgo32.exe
        250⤵
        Modifies registry class
        
        PID:1900
        
        C:\Windows\SysWOW64\Emnbdioi.exe
        
        C:\Windows\system32\Emnbdioi.exe
        251⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Edhjqc32.exe
        
        C:\Windows\system32\Edhjqc32.exe
        252⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Edjgfcec.exe
        
        C:\Windows\system32\Edjgfcec.exe
        253⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\Ejdocm32.exe
        
        C:\Windows\system32\Ejdocm32.exe
        254⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Edmclccp.exe
        
        C:\Windows\system32\Edmclccp.exe
        255⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\Ejflhm32.exe
        
        C:\Windows\system32\Ejflhm32.exe
        256⤵
        Drops file in System32 directory
        
        PID:7212
        
        C:\Windows\SysWOW64\Eiildjag.exe
        
        C:\Windows\system32\Eiildjag.exe
        257⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Eaqdegaj.exe
        
        C:\Windows\system32\Eaqdegaj.exe
        258⤵
        Drops file in System32 directory
        
        PID:8148
        
        C:\Windows\SysWOW64\Ehjlaaig.exe
        
        C:\Windows\system32\Ehjlaaig.exe
        259⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Fkihnmhj.exe
        
        C:\Windows\system32\Fkihnmhj.exe
        260⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Fmgejhgn.exe
        
        C:\Windows\system32\Fmgejhgn.exe
        261⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        262⤵
        Drops file in System32 directory
        
        PID:1640
        
        C:\Windows\SysWOW64\Fgbfhmll.exe
        
        C:\Windows\system32\Fgbfhmll.exe
        263⤵
        Modifies registry class
        
        PID:8200
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        264⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Fpjjac32.exe
        
        C:\Windows\system32\Fpjjac32.exe
        265⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Fkpool32.exe
        
        C:\Windows\system32\Fkpool32.exe
        266⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Fajgkfio.exe
        
        C:\Windows\system32\Fajgkfio.exe
        267⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Fggocmhf.exe
        
        C:\Windows\system32\Fggocmhf.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8424
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        269⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Gigheh32.exe
        
        C:\Windows\system32\Gigheh32.exe
        270⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8556
        
        C:\Windows\SysWOW64\Gkiaej32.exe
        
        C:\Windows\system32\Gkiaej32.exe
        272⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Gacjadad.exe
        
        C:\Windows\system32\Gacjadad.exe
        273⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Ghmbno32.exe
        
        C:\Windows\system32\Ghmbno32.exe
        274⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Ginnfgop.exe
        
        C:\Windows\system32\Ginnfgop.exe
        275⤵
        Drops file in System32 directory
        
        PID:8728
        
        C:\Windows\SysWOW64\Gnjjfegi.exe
        
        C:\Windows\system32\Gnjjfegi.exe
        276⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Gddbcp32.exe
        
        C:\Windows\system32\Gddbcp32.exe
        277⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Gknkpjfb.exe
        
        C:\Windows\system32\Gknkpjfb.exe
        278⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Gnlgleef.exe
        
        C:\Windows\system32\Gnlgleef.exe
        279⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Gpkchqdj.exe
        
        C:\Windows\system32\Gpkchqdj.exe
        280⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Hgelek32.exe
        
        C:\Windows\system32\Hgelek32.exe
        281⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Hjchaf32.exe
        
        C:\Windows\system32\Hjchaf32.exe
        282⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Hajpbckl.exe
        
        C:\Windows\system32\Hajpbckl.exe
        283⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Hdilnojp.exe
        
        C:\Windows\system32\Hdilnojp.exe
        284⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Hhdhon32.exe
        
        C:\Windows\system32\Hhdhon32.exe
        285⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        286⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Hammhcij.exe
        
        C:\Windows\system32\Hammhcij.exe
        287⤵
        Modifies registry class
        
        PID:8316
        
        C:\Windows\SysWOW64\Hjhalefe.exe
        
        C:\Windows\system32\Hjhalefe.exe
        288⤵
        Modifies registry class
        
        PID:8416
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        289⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Hglaej32.exe
        
        C:\Windows\system32\Hglaej32.exe
        290⤵
        Drops file in System32 directory
        
        PID:8544
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        291⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Hpdfnolo.exe
        
        C:\Windows\system32\Hpdfnolo.exe
        292⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Hgnoki32.exe
        
        C:\Windows\system32\Hgnoki32.exe
        293⤵
        Drops file in System32 directory
        
        PID:8752
        
        C:\Windows\SysWOW64\Hjlkge32.exe
        
        C:\Windows\system32\Hjlkge32.exe
        294⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Igqkqiai.exe
        
        C:\Windows\system32\Igqkqiai.exe
        295⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Iafonaao.exe
        
        C:\Windows\system32\Iafonaao.exe
        296⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Iddljmpc.exe
        
        C:\Windows\system32\Iddljmpc.exe
        297⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Ijadbdoj.exe
        
        C:\Windows\system32\Ijadbdoj.exe
        298⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Inmpcc32.exe
        
        C:\Windows\system32\Inmpcc32.exe
        299⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        300⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Inomhbeq.exe
        
        C:\Windows\system32\Inomhbeq.exe
        301⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        302⤵
        Modifies registry class
        
        PID:8548
        
        C:\Windows\SysWOW64\Inainbcn.exe
        
        C:\Windows\system32\Inainbcn.exe
        303⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Jglklggl.exe
        
        C:\Windows\system32\Jglklggl.exe
        304⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Jnfcia32.exe
        
        C:\Windows\system32\Jnfcia32.exe
        305⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8972
        
        C:\Windows\SysWOW64\Jklphekp.exe
        
        C:\Windows\system32\Jklphekp.exe
        307⤵
        Drops file in System32 directory
        
        PID:9108
        
        C:\Windows\SysWOW64\Jbfheo32.exe
        
        C:\Windows\system32\Jbfheo32.exe
        308⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Jjdjoane.exe
        
        C:\Windows\system32\Jjdjoane.exe
        309⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        310⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Kdinljnk.exe
        
        C:\Windows\system32\Kdinljnk.exe
        311⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Kjffdalb.exe
        
        C:\Windows\system32\Kjffdalb.exe
        312⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Kqpoakco.exe
        
        C:\Windows\system32\Kqpoakco.exe
        313⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        314⤵
        Modifies registry class
        
        PID:8368
        
        C:\Windows\SysWOW64\Kkfcndce.exe
        
        C:\Windows\system32\Kkfcndce.exe
        315⤵
        Drops file in System32 directory
        
        PID:8720
        
        C:\Windows\SysWOW64\Kndojobi.exe
        
        C:\Windows\system32\Kndojobi.exe
        316⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Kenggi32.exe
        
        C:\Windows\system32\Kenggi32.exe
        317⤵
        Drops file in System32 directory
        
        PID:8436
        
        C:\Windows\SysWOW64\Kjkpoq32.exe
        
        C:\Windows\system32\Kjkpoq32.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8904
        
        C:\Windows\SysWOW64\Kaehljpj.exe
        
        C:\Windows\system32\Kaehljpj.exe
        319⤵
        Modifies registry class
        
        PID:5804
        
        C:\Windows\SysWOW64\Kgopidgf.exe
        
        C:\Windows\system32\Kgopidgf.exe
        320⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Kkjlic32.exe
        
        C:\Windows\system32\Kkjlic32.exe
        321⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        322⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Kinmcg32.exe
        
        C:\Windows\system32\Kinmcg32.exe
        323⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Lajagj32.exe
        
        C:\Windows\system32\Lajagj32.exe
        324⤵
        Drops file in System32 directory
        
        PID:2452
        
        C:\Windows\SysWOW64\Liqihglg.exe
        
        C:\Windows\system32\Liqihglg.exe
        325⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Lgcjdd32.exe
        
        C:\Windows\system32\Lgcjdd32.exe
        326⤵
        Modifies registry class
        
        PID:9232
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        327⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Lgffic32.exe
        
        C:\Windows\system32\Lgffic32.exe
        328⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Ljdceo32.exe
        
        C:\Windows\system32\Ljdceo32.exe
        329⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Lbkkgl32.exe
        
        C:\Windows\system32\Lbkkgl32.exe
        330⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Lejgch32.exe
        
        C:\Windows\system32\Lejgch32.exe
        331⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        332⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        333⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Lelchgne.exe
        
        C:\Windows\system32\Lelchgne.exe
        334⤵
        Modifies registry class
        
        PID:9572
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        335⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Lbpdblmo.exe
        
        C:\Windows\system32\Lbpdblmo.exe
        336⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        337⤵
        Drops file in System32 directory
        
        PID:9700
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9744
        
        C:\Windows\SysWOW64\Mngegmbc.exe
        
        C:\Windows\system32\Mngegmbc.exe
        339⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        340⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        341⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Mecjif32.exe
        
        C:\Windows\system32\Mecjif32.exe
        342⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Mjpbam32.exe
        
        C:\Windows\system32\Mjpbam32.exe
        343⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Mnnkgl32.exe
        
        C:\Windows\system32\Mnnkgl32.exe
        344⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Micoed32.exe
        
        C:\Windows\system32\Micoed32.exe
        345⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        346⤵
        Drops file in System32 directory
        
        PID:10076
        
        C:\Windows\SysWOW64\Mejpje32.exe
        
        C:\Windows\system32\Mejpje32.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10124
        
        C:\Windows\SysWOW64\Mldhfpib.exe
        
        C:\Windows\system32\Mldhfpib.exe
        348⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        349⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        350⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Nemmoe32.exe
        
        C:\Windows\system32\Nemmoe32.exe
        351⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Njiegl32.exe
        
        C:\Windows\system32\Njiegl32.exe
        352⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        353⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        354⤵
        Modifies registry class
        
        PID:9500
        
        C:\Windows\SysWOW64\Nklbmllg.exe
        
        C:\Windows\system32\Nklbmllg.exe
        355⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        356⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        357⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Niooqcad.exe
        
        C:\Windows\system32\Niooqcad.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9792
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        359⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Nhdlao32.exe
        
        C:\Windows\system32\Nhdlao32.exe
        360⤵
        Drops file in System32 directory
        
        PID:9908
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        361⤵
        Drops file in System32 directory
        
        PID:9976
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        362⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Oehlkc32.exe
        
        C:\Windows\system32\Oehlkc32.exe
        363⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Ohghgodi.exe
        
        C:\Windows\system32\Ohghgodi.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10192
        
        C:\Windows\SysWOW64\Oaompd32.exe
        
        C:\Windows\system32\Oaompd32.exe
        365⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Oekiqccc.exe
        
        C:\Windows\system32\Oekiqccc.exe
        366⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        367⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        368⤵
        Drops file in System32 directory
        
        PID:9508
        
        C:\Windows\SysWOW64\Olgncmim.exe
        
        C:\Windows\system32\Olgncmim.exe
        369⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9756
        
        C:\Windows\SysWOW64\Oohgdhfn.exe
        
        C:\Windows\system32\Oohgdhfn.exe
        371⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        372⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Pkogiikb.exe
        
        C:\Windows\system32\Pkogiikb.exe
        373⤵
        Modifies registry class
        
        PID:10056
        
        C:\Windows\SysWOW64\Phbhcmjl.exe
        
        C:\Windows\system32\Phbhcmjl.exe
        374⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Pchlpfjb.exe
        
        C:\Windows\system32\Pchlpfjb.exe
        375⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Pibdmp32.exe
        
        C:\Windows\system32\Pibdmp32.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9468
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        377⤵
        Modifies registry class
        
        PID:9612
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        378⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        379⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        380⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Pkenjh32.exe
        
        C:\Windows\system32\Pkenjh32.exe
        381⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        382⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9652
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        383⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        384⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Pocfpf32.exe
        
        C:\Windows\system32\Pocfpf32.exe
        385⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        386⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Piijno32.exe
        
        C:\Windows\system32\Piijno32.exe
        387⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Qlggjk32.exe
        
        C:\Windows\system32\Qlggjk32.exe
        388⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Qofcff32.exe
        
        C:\Windows\system32\Qofcff32.exe
        389⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        390⤵
        Modifies registry class
        
        PID:10300
        
        C:\Windows\SysWOW64\Qhngolpo.exe
        
        C:\Windows\system32\Qhngolpo.exe
        391⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10348
        
        C:\Windows\SysWOW64\Alnmjjdb.exe
        
        C:\Windows\system32\Alnmjjdb.exe
        392⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Aakebqbj.exe
        
        C:\Windows\system32\Aakebqbj.exe
        393⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\Ahenokjf.exe
        
        C:\Windows\system32\Ahenokjf.exe
        394⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Aoofle32.exe
        
        C:\Windows\system32\Aoofle32.exe
        395⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        396⤵
        Modifies registry class
        
        PID:10560
        
        C:\Windows\SysWOW64\Akffafgg.exe
        
        C:\Windows\system32\Akffafgg.exe
        397⤵
        Modifies registry class
        
        PID:10600
        
        C:\Windows\SysWOW64\Abponp32.exe
        
        C:\Windows\system32\Abponp32.exe
        398⤵
        Modifies registry class
        
        PID:10636
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        399⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Aleckinj.exe
        
        C:\Windows\system32\Aleckinj.exe
        400⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        401⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Blhpqhlh.exe
        
        C:\Windows\system32\Blhpqhlh.exe
        402⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        403⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\Bhoqeibl.exe
        
        C:\Windows\system32\Bhoqeibl.exe
        404⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\Bohibc32.exe
        
        C:\Windows\system32\Bohibc32.exe
        405⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10940
        
        C:\Windows\SysWOW64\Bjnmpl32.exe
        
        C:\Windows\system32\Bjnmpl32.exe
        406⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10996
        
        C:\Windows\SysWOW64\Bbiado32.exe
        
        C:\Windows\system32\Bbiado32.exe
        407⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        408⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Bmofagfp.exe
        
        C:\Windows\system32\Bmofagfp.exe
        409⤵
        Drops file in System32 directory
        
        PID:11112
        
        C:\Windows\SysWOW64\Bcinna32.exe
        
        C:\Windows\system32\Bcinna32.exe
        410⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11160
        
        C:\Windows\SysWOW64\Bheffh32.exe
        
        C:\Windows\system32\Bheffh32.exe
        411⤵
        Drops file in System32 directory
        
        PID:11196
        
        C:\Windows\SysWOW64\Bckkca32.exe
        
        C:\Windows\system32\Bckkca32.exe
        412⤵
        Modifies registry class
        
        PID:11252
        
        C:\Windows\SysWOW64\Cfigpm32.exe
        
        C:\Windows\system32\Cfigpm32.exe
        413⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10364
        
        C:\Windows\SysWOW64\Cfldelik.exe
        
        C:\Windows\system32\Cfldelik.exe
        415⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        416⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Ccpdoqgd.exe
        
        C:\Windows\system32\Ccpdoqgd.exe
        417⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        418⤵
        
        PID:10644
        
        C:\Windows\SysWOW64\Coknoaic.exe
        
        C:\Windows\system32\Coknoaic.exe
        419⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        420⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        421⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10848
        
        C:\Windows\SysWOW64\Dblgpl32.exe
        
        C:\Windows\system32\Dblgpl32.exe
        422⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        423⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        424⤵
        Drops file in System32 directory
        
        PID:11056
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        425⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Djelgied.exe
        
        C:\Windows\system32\Djelgied.exe
        426⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        427⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Dpbdopck.exe
        
        C:\Windows\system32\Dpbdopck.exe
        428⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        429⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10504
        
        C:\Windows\SysWOW64\Djhimica.exe
        
        C:\Windows\system32\Djhimica.exe
        430⤵
        Modifies registry class
        
        PID:10628
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        431⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:10696
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        432⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        433⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        434⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        435⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        436⤵
        Drops file in System32 directory
        
        PID:11192
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        437⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Ejchhgid.exe
        
        C:\Windows\system32\Ejchhgid.exe
        438⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        439⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        440⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        441⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        442⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\Ffobhg32.exe
        
        C:\Windows\system32\Ffobhg32.exe
        443⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        444⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        445⤵
        Drops file in System32 directory
        
        PID:10912
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        446⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Fjohde32.exe
        
        C:\Windows\system32\Fjohde32.exe
        447⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        448⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        449⤵
        Drops file in System32 directory
        
        PID:10456
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        450⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        451⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        452⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        453⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        454⤵
        Drops file in System32 directory
        
        PID:11392
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        455⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        456⤵
        Modifies registry class
        
        PID:11476
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        457⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        458⤵
        
        PID:11560
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        459⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11604
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        460⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        461⤵
        
        PID:11688
        
        C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        462⤵
        
        PID:11732
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        463⤵
        Drops file in System32 directory
        
        PID:11772
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        464⤵
        
        PID:11820
        
        C:\Windows\SysWOW64\Hkicaahi.exe
        
        C:\Windows\system32\Hkicaahi.exe
        465⤵
        
        PID:11864
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        466⤵
        Modifies registry class
        
        PID:11928
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        467⤵
        Drops file in System32 directory
        
        PID:11968
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        468⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        469⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        470⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        471⤵
        
        PID:12160
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        472⤵
        
        PID:12204
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        473⤵
        
        PID:12240
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        474⤵
        
        PID:12284
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        475⤵
        
        PID:11296
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        476⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        477⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        478⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        479⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        480⤵
        
        PID:11684
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        481⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        482⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        483⤵
        
        PID:11872
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        484⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        485⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        486⤵
        
        PID:12108
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        487⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        488⤵
        
        PID:12248
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        489⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12264
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        490⤵
        
        PID:11376
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        491⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        492⤵
        
        PID:11584
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        493⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11660
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        494⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11808
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        495⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        496⤵
        
        PID:12000
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        497⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        498⤵
        
        PID:12200
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        499⤵
        Modifies registry class
        
        PID:12276
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        500⤵
        
        PID:11292
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        501⤵
        Drops file in System32 directory
        
        PID:11512
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        502⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        503⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        504⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        505⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        506⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        507⤵
        
        PID:11460
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        508⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        509⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        510⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11980
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        511⤵
        
        PID:560
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        512⤵
        Drops file in System32 directory
        
        PID:5236
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        513⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        514⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        515⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        516⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        517⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        518⤵
        
        PID:12192
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        519⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        520⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        521⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        522⤵
        
        PID:12140
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        523⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        524⤵
        Modifies registry class
        
        PID:11336
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        525⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        526⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        527⤵
        
        PID:564
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        528⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        529⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        530⤵
        
        PID:880
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        531⤵
        Drops file in System32 directory
        
        PID:4908
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        532⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        533⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        534⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        535⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        536⤵
        
        PID:12328
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        537⤵
        
        PID:12368
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        538⤵
        
        PID:12412
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        539⤵
        
        PID:12456
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        540⤵
        
        PID:12500
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        541⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12536
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        542⤵
        
        PID:12588
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        543⤵
        
        PID:12632
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        544⤵
        
        PID:12668
        
        C:\Windows\SysWOW64\Oodcdb32.exe
        
        C:\Windows\system32\Oodcdb32.exe
        545⤵
        Modifies registry class
        
        PID:12712
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        546⤵
        
        PID:12752
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        547⤵
        
        PID:12796
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        548⤵
        
        PID:12836
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        549⤵
        
        PID:12876
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        550⤵
        
        PID:12920
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        551⤵
        
        PID:12968
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        552⤵
        
        PID:13012
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        553⤵
        Modifies registry class
        
        PID:13056
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        554⤵
        Modifies registry class
        
        PID:13092
        
        C:\Windows\SysWOW64\Pajeam32.exe
        
        C:\Windows\system32\Pajeam32.exe
        555⤵
        Drops file in System32 directory
        
        PID:13132
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        556⤵
        
        PID:13168
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        557⤵
        
        PID:13204
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        558⤵
        
        PID:13240
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        559⤵
        
        PID:13276
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        560⤵
        
        PID:3048
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        561⤵
        
        PID:12300
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        562⤵
        
        PID:12316
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        563⤵
        
        PID:12376
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        564⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12452
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        565⤵
        
        PID:12496
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        566⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        567⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        568⤵
        
        PID:12704
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        569⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12776
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        570⤵
        Drops file in System32 directory
        
        PID:12820
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        571⤵
        Drops file in System32 directory
        
        PID:12868
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        572⤵
        
        PID:12916
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        573⤵
        Drops file in System32 directory
        
        PID:12964
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        574⤵
        
        PID:13008
        
        C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        575⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        576⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        577⤵
        
        PID:13196
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        578⤵
        Modifies registry class
        
        PID:4648
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        579⤵
        
        PID:1356
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        580⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        581⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        582⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        583⤵
        
        PID:12488
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        584⤵
        Drops file in System32 directory
        
        PID:12560
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        585⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12572
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        586⤵
        Modifies registry class
        
        PID:12732
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        587⤵
        
        PID:12788
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        588⤵
        
        PID:12884
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        589⤵
        
        PID:3804
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        590⤵
        
        PID:12952
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        591⤵
        
        PID:13024
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        592⤵
        
        PID:13088
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        593⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        594⤵
        
        PID:4164
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        595⤵
        
        PID:13260
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        596⤵
        Modifies registry class
        
        PID:13304
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        597⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        598⤵
        
        PID:12396
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        599⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        600⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        601⤵
        
        PID:12708
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        602⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        603⤵
        
        PID:12888
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        604⤵
        
        PID:12948
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        605⤵
        
        PID:12932
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        606⤵
        
        PID:13124
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        607⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        608⤵
        Drops file in System32 directory
        
        PID:4292
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        609⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        610⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        611⤵
        
        PID:12352
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        612⤵
        
        PID:12532
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        613⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        614⤵
        
        PID:404
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        615⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        616⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        617⤵
        Modifies registry class
        
        PID:4432
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        618⤵
        
        PID:13000
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        619⤵
        
        PID:13052
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        620⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        621⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1836
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        622⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        623⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        624⤵
        
        PID:12444
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        625⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        626⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        627⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        628⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        629⤵
        
        PID:2160
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        630⤵
        
        PID:13044
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        631⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        632⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        633⤵
        Drops file in System32 directory
        
        PID:1840
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        634⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        635⤵
        
        PID:12728
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        636⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        637⤵
        Drops file in System32 directory
        
        PID:3304
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        638⤵
        
        PID:13048
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        639⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2152
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        640⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        641⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        642⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        643⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        644⤵
        
        PID:12696
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        645⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        646⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        647⤵
        
        PID:3928
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        648⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        649⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        650⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5404
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        651⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        652⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        653⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        654⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        655⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        656⤵
        Drops file in System32 directory
        
        PID:5968
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        657⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        658⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        659⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        660⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        661⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        662⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        663⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        664⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        665⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        666⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        667⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5192
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        668⤵
        
        PID:64
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        669⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        670⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        671⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5508
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        672⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        673⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        674⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        675⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        676⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        677⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        678⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5976
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        679⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        680⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        681⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        682⤵
        Modifies registry class
        
        PID:6124
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        683⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        684⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        685⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5768
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        686⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        687⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        688⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        689⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5584
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        690⤵
        Modifies registry class
        
        PID:1844
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        691⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        692⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        693⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        694⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        695⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        696⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        697⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        698⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        699⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        700⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        701⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        702⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6588
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        703⤵
        Drops file in System32 directory
        
        PID:6652
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        704⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        705⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        706⤵
        Drops file in System32 directory
        
        PID:5732
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        707⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        708⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        709⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        710⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        711⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        712⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        713⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        714⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        715⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        716⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        717⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        718⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        719⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        720⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6104
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        721⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        722⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        723⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        724⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        725⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6888
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        726⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        727⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        728⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        729⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        730⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        731⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        732⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        733⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        734⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        735⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        736⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        737⤵
        Drops file in System32 directory
        
        PID:6772
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        738⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        739⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        740⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        741⤵
        
        PID:11988
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        742⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        743⤵
        Modifies registry class
        
        PID:6420
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        744⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        745⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        746⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        747⤵
        Modifies registry class
        
        PID:13316
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        748⤵
        
        PID:13364
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        749⤵
        
        PID:13404
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        750⤵
        
        PID:13440
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        751⤵
        
        PID:13484
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        752⤵
        
        PID:13528
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        753⤵
        
        PID:13568
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        754⤵
        
        PID:13612
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        755⤵
        
        PID:13652
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        756⤵
        
        PID:13704
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        757⤵
        
        PID:13740
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        758⤵
        
        PID:13784
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        759⤵
        
        PID:13828
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        760⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13868
        
        C:\Windows\SysWOW64\Ncqlkemc.exe
        
        C:\Windows\system32\Ncqlkemc.exe
        761⤵
        
        PID:13912
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        762⤵
        
        PID:13956
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        763⤵
        
        PID:14196
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        764⤵
        
        PID:14240
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        765⤵
        
        PID:14280
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        766⤵
        
        PID:14320
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        767⤵
        Drops file in System32 directory
        
        PID:6820
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        768⤵
        
        PID:13360
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        769⤵
        
        PID:13400
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        770⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13476
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        771⤵
        
        PID:13508
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        772⤵
        
        PID:13564
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        773⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        774⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        775⤵
        Modifies registry class
        
        PID:13636
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        776⤵
        
        PID:13684
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        777⤵
        
        PID:13732
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        778⤵
        
        PID:13816
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        779⤵
        
        PID:13856
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        780⤵
        Drops file in System32 directory
        
        PID:13920
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        781⤵
        
        PID:13940
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        782⤵
        
        PID:14000
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        783⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14044
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        784⤵
        
        PID:14088
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        785⤵
        Modifies registry class
        
        PID:14132
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        786⤵
        
        PID:14160
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        787⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        788⤵
        
        PID:13980
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        789⤵
        Modifies registry class
        
        PID:14236
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        790⤵
        
        PID:14316
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        791⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        792⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        793⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        794⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        795⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        796⤵
        
        PID:13560
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        797⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        798⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6640
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        799⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        800⤵
        
        PID:13760
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        801⤵
        Drops file in System32 directory
        
        PID:13848
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        802⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        803⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        804⤵
        Drops file in System32 directory
        
        PID:7576
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        805⤵
        
        PID:14052
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        806⤵
        
        PID:14120
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        807⤵
        
        PID:14112
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        808⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14188
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        809⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        810⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14228
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        811⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        812⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        813⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        814⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        815⤵
        
        PID:13452
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        816⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        817⤵
        Drops file in System32 directory
        
        PID:13600
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        818⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        819⤵
        
        PID:13780
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        820⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        821⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        822⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        823⤵
        
        PID:14008
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        824⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        825⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        826⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        827⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        828⤵
        
        PID:14220
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        829⤵
        
        PID:14288
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        830⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        831⤵
        Drops file in System32 directory
        
        PID:13344
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        832⤵
        Drops file in System32 directory
        
        PID:13432
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        833⤵
        
        PID:13548
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        834⤵
        
        PID:13584
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        835⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        836⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        837⤵
        
        PID:13924
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        838⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        839⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        840⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        841⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        842⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        843⤵
        
        PID:14204
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        844⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        845⤵
        Drops file in System32 directory
        
        PID:4568
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        846⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        847⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        848⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        849⤵
        Modifies registry class
        
        PID:7852
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        850⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7788 -s 400
        851⤵
        Program crash
        
        PID:13964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7788 -ip 7788
1⤵
PID:7932

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:7536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bddjpd32.exe

Filesize
80KB

MD5
305c736745a918f520e0576782ac7f41

SHA1
20659c86309e2ccf51190b013c99c2c8a4f8061f

SHA256
06026aec252fc361bbf84d199a6e8b9000fedae5b1c7f7992b71675393495c97

SHA512
bc63a0f8a3ff8946e9de005b54e269049c7b18d30dfd37ca71e049d2ad03e10e98d3140e9926a64d883a1d96b37f0982a5d074df1a356a3810bfb3365c52d4ed

Download Submit
C:\Windows\SysWOW64\Camddhoi.exe

Filesize
80KB

MD5
4245a7a6cd727ab16a98f808f0dff6cc

SHA1
be858e071afb05bb3a357a434af4eb832664078f

SHA256
14b9586f08e01816575a89654501c050163534004d5310d49ecfa7a4f3ba8f59

SHA512
404d4ecd95a0deaf89fcb2d02c117c4030e47d73940704933d6489341216f2df5c8a521e94dcd7b1170d922c8d75b137d2f456530d7f7f755445238ebc96b1d5

Download Submit
C:\Windows\SysWOW64\Cidjbmcp.exe

Filesize
80KB

MD5
a8d7559ccc13f03276d73d199f558274

SHA1
b7b74bdaa88d72ae27996826d4ecf7733fee70b2

SHA256
2ac707a5e58fdd1ec60951bc8acf92511d16e2089528acb8bfb08558821f38a8

SHA512
a669f43e5751ac2c6697b034e283d742933c1dae8a79883606453c2d7f55a0b3a03c4ac18fd73c1243857bfe7437f9079f4441ce9c367399e5b017e0356a8553

Download Submit
C:\Windows\SysWOW64\Cjpckf32.exe

Filesize
80KB

MD5
be84445dc9ebdb3bc17f40bac4a11b88

SHA1
04e5e393045b91fc083c4bce2cf77372f45ae650

SHA256
93257262907cc5b8eebfa51cd41763c2458ace9ebbfa720fed69f6bc19aeb898

SHA512
7d1af89eaabe81d39db894c2e00a1169d49e7af118802b03a0bcd7f831b43f7a91f9b6ccbabaa33e1ef09b423e2d67cad951a7943aae6437bb32c99080b6bd16

Download Submit
C:\Windows\SysWOW64\Dddllkbf.exe

Filesize
80KB

MD5
2c50ee09a722b244d6045608acb9a37a

SHA1
4afac6577bbf8e8c11f0e334ffa3965c4454853d

SHA256
10b1444c540006d767ae39b5f730b61ae1d52d045727c1887939b1c37aa44ba9

SHA512
9ce9ca3e38cae5450a956fe5cf132504b86de5dbb59c68521d23ba32c184e8572f1578d01880c4a21846dbab32e09b6e8f5638214d0dc2a7aaca70672374b0a3

Download Submit
C:\Windows\SysWOW64\Dmdonkgc.exe

Filesize
80KB

MD5
296f222740279d20eed41c221681605a

SHA1
e73c57efc2b5625a205062a3132c17ae4e5b5cdf

SHA256
3a0ed81afe84544bd0d7d9179502e3d98712b58bf4176c86f10696d8c9b7a425

SHA512
e84b4ca63c7532d6124b4549b28bfc73755c01a16382b337d3e13f13ab04f175b1416951258cafdf889718da1cbf733c18dfdf0e16ecd2575f8b4461987ca619

Download Submit
C:\Windows\SysWOW64\Eciplm32.exe

Filesize
80KB

MD5
81f082f012788232754b632867d5dfe3

SHA1
2d1af0ad0f1aee6a80976a570d179b09aac83a76

SHA256
9db699353337d3766e94829d4789353360f168b93bbb79c12cbf048d0040ec45

SHA512
5afe3e01fb2e83814cb6afeb074ffef1ce39200326d9b3c68a23a23328e0925321b2655ed6734dd1e26d082d345ecbec90e3b931b90a13905dbdf895ad32d43f

Download Submit
C:\Windows\SysWOW64\Emdajb32.exe

Filesize
80KB

MD5
4fa90ec3143f021151c11f6383036d8e

SHA1
e047e41309717a29b7b69c62258e5be336ea80cb

SHA256
41362e867425bb525cd07fbefe8072cc917d3edb03342988e4df20cbdbd172a1

SHA512
2b50082647ea129e2d960274bf0da4a234e0dcd24e8c39c966b7b7f249f28b45d315828ed734793b552b1358d815f1c7611b88244141f64c859d439c3e66c743

Download Submit
C:\Windows\SysWOW64\Fmikeaap.exe

Filesize
80KB

MD5
28b8373290770e981c97e96ea078b2a8

SHA1
4edaf4eb767737e18cd0fa3c0a15cb818268366a

SHA256
6dcd7dd2daa3cc2b246dd141b36d56d9ba7652c03a3b22bd24fd5ac9eb78e847

SHA512
53339610c2d11e5003d21272f7d88ca3a375d56912c9891ed0eebafc4d83fc3ef5b14f78d2dfe683ede6bd9577809b80250adaf0b09aff0cbb6b15f7f93737d2

Download Submit
C:\Windows\SysWOW64\Foghnabl.exe

Filesize
80KB

MD5
52f6c8d06b1b7fc1fb71058834f54c6e

SHA1
f4af0051437e33e5152b202f6fae8399dce786f1

SHA256
8a8d59208660696fe7ccb59e818ad48f2de16e6209ed44160b0262aff9cbfb9c

SHA512
5b86d84f2e2db0bcb2e50d913b6674c3a6afa32bff9e0fc7ead80140de4d2ca3fcaa8dfe95b3c6b09c2ac8cda3aefb963502df968c730b0887d307e89fa579ed

Download Submit
C:\Windows\SysWOW64\Gfeaopqo.exe

Filesize
80KB

MD5
653bfca5499021c99ed49ebb07f3d01a

SHA1
b1d65f717cb67940b120ddd0372541d696da4624

SHA256
c81427c07306bfc8043e5fe1b3443014ef5984c40aafc8f0f79e406f1a72cd07

SHA512
bc1d471f2abc25193669cc3f8562fd9dead61d336e1a7dbaa4ac9fd4acc97cb9ccb74ed69e9435ff6c50669e467af719cf2bccb13cde7ca5beab5305b36f53d1

Download Submit
C:\Windows\SysWOW64\Gkiaej32.exe

Filesize
80KB

MD5
d970d048b830e6c242d408d1d372476b

SHA1
959a939d6be489c108a5f6b366b22b2aa27fd588

SHA256
7965cd8d3584a88eddc3bd6166db13d191154b6f3b199b67eb999638df50c084

SHA512
eb0500c0869302013fa5e336a9c830670d5b27f5990714815d6332ef8236dfd36e36abf9c2af3cd6038aec05abe2ec580577ebb1619c7144b4d0dce49efc8fc2

Download Submit
C:\Windows\SysWOW64\Inainbcn.exe

Filesize
64KB

MD5
d7d3e367255407b7474520621b60de0d

SHA1
ba0fdc177252ad3e70478005c67e7c74c9b3e041

SHA256
e1271f886ac3fba61d04474c05145b6a6bcedebc6e0b80ce3d16c24bd901aeb3

SHA512
183cdd50d9128acad576f618e7f76fff51fd66170af4be88c9f6513c3c399038f80cebed1cc200fe0cff9445aa7db58c881a6a529a9a2f8713216080debcfa6b

Download Submit
C:\Windows\SysWOW64\Jnhpoamf.exe

Filesize
80KB

MD5
8e29e038c88a250b0c801545efb2f722

SHA1
25ad6555cfa11e6a8e371ec86d7c75942e8bb9b2

SHA256
04f3147e9ce4c799bf39fb276b30089d9df5aebd41f390e961513d4a57df6b4a

SHA512
f52e428ef0f17713396b909ad83643091d38ce7c25ab1e89dfdb0e41b06eb9c4cd35cfd686002a20c3cac5edf39a92926787a3785faf6ea8cd779bd1e29e9bca

Download Submit
C:\Windows\SysWOW64\Kdnidn32.exe

Filesize
80KB

MD5
ed60a2c6482d21c7d49b139f76a6b11f

SHA1
e249798dc5c287c835be8999cba0d273af81cd4d

SHA256
fed725e3606544e5ccfa684da5d19bffff200e430dbddac02b6a047b2b8a9391

SHA512
5e771fe12650756019aa473c7a1ecbed88eef9738597200dbf499d63b54ec3b67513bc9f61c3aaef74fe977f914252bbf88a196e28702dfce042a66edb5c2ab6

Download Submit
C:\Windows\SysWOW64\Kfoafi32.exe

Filesize
80KB

MD5
ab4a4c4f8216ff94898a041508fc4529

SHA1
6524f835e8b0e77afbeddb2c4ee4612d62ecfdd0

SHA256
459f111c107c35d24338a7a3b848db97205a84ff468ea78261776225151ed9bb

SHA512
bbed5c08a67c9c007a57ae697190a31c202b90e9c5d5d1f7cc5fd22e1b05a0a3a782d6e9c95d4fa7cebfe14d2e3f7f2ec63df6570b6e8ab8d77b24a9d612a908

Download Submit
C:\Windows\SysWOW64\Kibgmdcn.exe

Filesize
80KB

MD5
1bef32137948dc16a9d9de75153f18f5

SHA1
4bd2a958dadd633bb5f63a651971fbb6995ab838

SHA256
ea6ccf71ea0c501861d01ae32e79bad2dd1e38797b577b25846433fe3c7ff1b4

SHA512
5edf0099dce7a261500671f3b68646e9e6a9b7f4c75b88f5dc08096901ce06571b5559336b2d345f6b1e1f26aaf2dfa5feaa1419033b6e78521e1f45de1639ad

Download Submit
C:\Windows\SysWOW64\Kikame32.exe

Filesize
80KB

MD5
53747706b561ea6c4222372b0447da25

SHA1
55ff3ed3c4cecd0e121441e7f95cae1444e4271e

SHA256
917517da01d716dacf9ee3108e01b72267bfda18106e7c47a7605ccbcfe7360b

SHA512
ba2474828ca9c04a26fba94dc6a5c87866f39e0bf43b8db5d456c8a602ea57d87423540737acdf3b824df96d303d0b0c599e8ba90a20c951b7210c32c9ee6649

Download Submit
C:\Windows\SysWOW64\Kkpbin32.exe

Filesize
80KB

MD5
31da2dd4e9bdd5633f67495b8f088f1c

SHA1
6cc7e82e765bd14109371fa76e3afceab8289551

SHA256
18065467be3fbf635d26456826be7b74c7c0d5525039f7887fcaa974dba8954f

SHA512
636961d79066350114af145e1e3f8f93a93a7659e28008d4b724b65d56c13b22f37b9c68df8284dfd969a4d099efb410b0000b694b5984ee0ae86aa89ee002ab

Download Submit
C:\Windows\SysWOW64\Kmdqgd32.exe

Filesize
80KB

MD5
c9ee943f358935e6ee9df90b921f8144

SHA1
504ebff3e5781b14b0f7c2da6c43abd9a678c253

SHA256
b7fc5a8f568c4fc77e55deb8b7aaf20e5b8e1b22792f306f1b6f522ad06cdc9e

SHA512
8c54fb6023cb33effd0c7d5975ce866f5852f52d8c5bcb12b3937bfbdc751da48e06c8eae2911407afd04d9a365fecdcf7938bcf11f29a494fa898b78c0911cb

Download Submit
C:\Windows\SysWOW64\Kmkfhc32.exe

Filesize
80KB

MD5
ed819c7eb4e35ed52076e25bc0792cca

SHA1
89b56e01530e560db34dca15aefb1620fa51c97b

SHA256
239cd9b4d1461a3c4014171e74821449a3d72e12f82455afe8e3de5491f60ed4

SHA512
c64b1e21e86c1b3048337968d263e61ba2af52840f1ed4d37084cfc32c09a5facbc32e63d3da05a2c474dfa0d6d8ce64e99ea6ff74ed88ce4943c6a6f033d742

Download Submit
C:\Windows\SysWOW64\Kpeiioac.exe

Filesize
80KB

MD5
b7f5d7df3ff4a2af6e569759a7b07920

SHA1
d4849c6811e1d44b47d4f626fb0bf0c18b766867

SHA256
7e233861da717bccb56a52b07b9e1556c7dfc9e4695d61f1115d4c22e78b2f0f

SHA512
ac5f02a08b50e0992c39859d17ec5670a0cf33c68519f51baaf2c488c5ca86cc62abf3f66005bc7d09f7128178972824a90a14f3655b28b8c7afb01a0647555a

Download Submit
C:\Windows\SysWOW64\Kpgfooop.exe

Filesize
80KB

MD5
2746292dfce0e29c4c5288b4127019b7

SHA1
e6ed402d7cf236f31a927b9d245f899147a61101

SHA256
83de027b4f8e4187abf8ef0175e57a543cc28b1cd3ae582ec4a738522e38cc61

SHA512
1433cb2c83c56b60a9eb9756913e8633772aedf1de08b9ffe16591d4b706059a3e0594a8c24b7c131ddadde6ef0cc105dab17d7c8a9102559f8798521722b91b

Download Submit
C:\Windows\SysWOW64\Kpmdfonj.exe

Filesize
80KB

MD5
2ebb70a574623211a5ddc85c8e1d53c7

SHA1
d163ab2534145f7e5bda7f3dcb79e11fdff404da

SHA256
cbb8faea4282f157092086b08e741b2e131d5a771fb73d8aa95a66277a892bfb

SHA512
7c1745bc7787f85cce37d12937113dd9d3621a10aa981fea3ff0c06bda1086cc4d5f8d4296db406a0ee234fab4c2dd80b152f4add13af824c1faabdb90baaa38

Download Submit
C:\Windows\SysWOW64\Lboeaifi.exe

Filesize
80KB

MD5
7d9451eb48e8eed374169f2c76cdf3ba

SHA1
03ad241dd6cd49a6a12b4c17a54120cef17376c8

SHA256
a6f98a5fb64df41c54a06a317c15fe48626f6aae826304819e5b8b40980d04ef

SHA512
4904b427ab263ab249a0f4e645670873d3900460be7dbeed7b0dc55e19d2e83f087ceec863bac799092fd88f7351f16cd3f1bad8b07aec5398f08f817deda14c

Download Submit
C:\Windows\SysWOW64\Lgmngglp.exe

Filesize
80KB

MD5
83c4461398cd70b17f95f62c3f5c014d

SHA1
4b5d4f8cd19e3f3ab84553b829f371518f0558c3

SHA256
179fc5ad22b186b1b53d17061d799e4289ad0e0f9e34e653f072e229fef575d0

SHA512
3ea3b008b9126cba6ac0de6ae4aed750d31222d094fe4c75e90248e2316dc4c45db0baed35104d2dfb0ed8a5f4410a5696abf7df35148562316a73662bfee4a2

Download Submit
C:\Windows\SysWOW64\Ljeafb32.exe

Filesize
80KB

MD5
59739c7b646fe9f6e0fb79937e1aa895

SHA1
f97e5e507b026f5495d422e709c149be6c414cdc

SHA256
266e069ed70fbb2e17c2fa0a8ce6b5ef1220fb60de0df0fbcebf4e5760c211f7

SHA512
8afb574b510e5306a3622bf122f36f5c118b3d8952ca21f498fdb11a20bd47653fa8743f13be61cd8c53a5d66f17597461d44d597c2833b1bffd069ceb985d67

Download Submit
C:\Windows\SysWOW64\Ljhnlb32.exe

Filesize
80KB

MD5
4ce93e21d7fed7c1466387a7af0741cc

SHA1
acfd664cf80374d93a2a2bd99e53801b95694e28

SHA256
6e22883b0ae8bdf422c16d451931c11ff5bde9e299b91e4089324cfe102b7668

SHA512
c969bf599076e2a7b0243151f5c6eb2e8c5a1525424c469b8b6aa6c07c1499edf7557a7bf43f358d5a54d5abcec0a880d40a2bd75266f62da866d3ef9f07f267

Download Submit
C:\Windows\SysWOW64\Llgjjnlj.exe

Filesize
80KB

MD5
6367769bcc568d40dbca556b8ee831da

SHA1
006e6cc0cee219811d6a56673db4790c7f0be22f

SHA256
2582b52cf472de73f1a3b56ad4eb2b8e297a6de3fbbd48bd66a9e1957c4a34a9

SHA512
b617d9c0e40ee8f2feacaf41d2a09581245a617ffdced2bdb580ddd8a45c5863269abdd60fa8ae571b762297401c03fdd28affd104865cc5586f741f7acdc16b

Download Submit
C:\Windows\SysWOW64\Lpbopfag.exe

Filesize
80KB

MD5
1681dc2609108464de7bdbb25ffcf28e

SHA1
9c856b6c29c67532cab425f9f2670869a9825238

SHA256
1d1dc228780f954cab7dcfe04cb9932f323c5bb08e72e03edd55945c3952d85c

SHA512
6c83450ecd5a12ca29c425b3fa3e7f6b51175abaa1ad3e1d4cb39eb785cae973f12faf0d808ecabde533303cd6777a98ea014df3f03ba6e7783ff8a12d15e1ab

Download Submit
C:\Windows\SysWOW64\Lpebpm32.exe

Filesize
80KB

MD5
5ab3ff47b95fa427ac71847766c18271

SHA1
8cbaeaf83da8806b6c3d3c23a1d78eb59de5d3f3

SHA256
e6bcc33d42a495505771d7bef201c1f5689a6050835ba504b35671c3590b69ec

SHA512
e3e6fdb32ec3952a17af036efbf5af363548e4ce23c577bd44663986045c377e674f73cfc1d7282b228e7b2021879475ed1093ba2d17ae17ada2bb8782536fc6

Download Submit
C:\Windows\SysWOW64\Lpnlpnih.exe

Filesize
80KB

MD5
2316f269188310b4fd61ee9db99e9269

SHA1
005981543130b3c2ebf96f090011a9a8a17fa1ef

SHA256
2b17952a4905482159741ea44d5dba2427488c0a45f4837faf72d27cd4a493f9

SHA512
c5052dc2c5a0374cf5d7415114bec8e49565b976c833159314a854a6202070e4748f83645bd23965427439341ec94002ad6b0f126c7f440121a1317a45fc6eba

Download Submit
C:\Windows\SysWOW64\Mckemg32.exe

Filesize
80KB

MD5
b9fbc62a67d1828622a5f0755c8c59d0

SHA1
3b6780273b8979f3ee85e9e0bb83738e371f96a2

SHA256
5a1ed8af6bbb21a83598c47faa2de6215009517d10fabc60459f44892e02dc3d

SHA512
bcd6ae0fab74c4f08a59be946d012f7ddb41a89be85af8d541c22ef888b44fae2a98a7d287715e8196ad651289410e51717a8dbdd679c056fab1172cfac9d165

Download Submit
C:\Windows\SysWOW64\Medgncoe.exe

Filesize
80KB

MD5
a16b75ac9838dc8b22bae6c550228e5e

SHA1
949ff58e824a1d518c0b7e4159f5ee0056d19094

SHA256
1b17086f501bbd9c88ed9f0c91bdd407fc602665a377b3ca1fd20fb25f7279f6

SHA512
35bf80a257f7b2356e22d2e58e4aa1136da820a21121487d14bdacd50454c6e855782093fff02c67c612c462f1b20141bbee2bad754de12f6e8cd5bf1b6ce721

Download Submit
C:\Windows\SysWOW64\Mgkjhe32.exe

Filesize
80KB

MD5
5f6aeca68edea185deeef7ac52ed8c0c

SHA1
b1fd3501ed6091dab7ab970b10c9916a0831c2a9

SHA256
55f67786d60f22cdc770db89f379e78e8ac59452d78320d314f6218ffcd344ef

SHA512
c09a652b6c8e0701bd9708f4e68ef3fc495293dde527178e9931c230b40f7acf51f495293f3528032c22d25128dff534613b1a9eadd9843f3172c7bea594b62f

Download Submit
C:\Windows\SysWOW64\Mmnldp32.exe

Filesize
80KB

MD5
a90e0f4470888916f6e321a61d0833e9

SHA1
701b3567fa03eeece82e57f370d70232e4098223

SHA256
b7e12691c00e099f14dd3c1feae11401b89dd5899d7b322a9a93fc86d5e326ce

SHA512
24a303e98cbae42cc0bd0db7604bbea9ff1f9f446e96c79b274186372322586c89bd1d169bd850f8b8f771edac5ff47b1ca266bc529b1b566b10de7ab78ae545

Download Submit
C:\Windows\SysWOW64\Mniallpq.exe

Filesize
80KB

MD5
2f199cface06d13bd6c3482587bda7f7

SHA1
6b6d49fe9d8db2f71aa82cec0208823d7079e2c7

SHA256
4ff9218c421198058e614b5ebee237ceb966994b7c4ac8c11752d46ad188a1ab

SHA512
823c41a6523afe510ec90e2436fe7bcb3409d475bbbffe1f67d2e7ca4e5a09c0dbf39e695c7e7d037cca723aa36aad86830ae5662551e0a52b134bf84ea5f4ec

Download Submit
C:\Windows\SysWOW64\Mpablkhc.exe

Filesize
80KB

MD5
a0ba3fbf4c0a01bcf4507c056a8ae14e

SHA1
2112812d8273c86a85ab7e8eaf3ac94f9e1fbb11

SHA256
b492432f65dbc9f58ad7f308b30b19da24ef4834fc744c48940827fa89caf711

SHA512
2b693ded07f1ae89929ecc6407f5dcec2011ed3b8a943feb4ce8b7642e79214425d381e668362893bcbdbf63650a0905a3fecc6a54612d9e94a933965773e625

Download Submit
C:\Windows\SysWOW64\Ndcdmikd.exe

Filesize
80KB

MD5
4dc2b49252007d70e0e4b66aab94597f

SHA1
b00179f5877f839b62c5390fa01ef7817e1eeb24

SHA256
3b1f4bf849c5a1eb00ddc17424ce977bb034d9131c3da3f1d13ef3022aa00f74

SHA512
f36ea5b6e9321717aea72efde343f040fe18a39e9ad526197e52652ab4af5f82e6621f32582e5253de19a681612aaad5c68a34a74719c834680271160ff2f7c0

Download Submit
C:\Windows\SysWOW64\Ndhmhh32.exe

Filesize
80KB

MD5
b8bb294bf5bdc25d2d1bf2f10b6f70d1

SHA1
cb8f8779a05cad1a832712718de8315517a0a781

SHA256
3905b5d8d68af64815e4da30f857e4711a62bff57fc33075b556f6d7af8285d7

SHA512
b710fe30d29651217c657f114f764ff7adbadd41b055b4ff6b91c05c0c86a7c30ed4221de79782c9a1934baa18136346dbae08b87db4709df0c2af6b351cc82b

Download Submit
C:\Windows\SysWOW64\Nfgmjqop.exe

Filesize
80KB

MD5
66cc84b1b7092eb2d014792345228ca3

SHA1
2d8a43b26c838f6697fef391bd0d4a5913df2048

SHA256
f69b274201ae06e503565c5d446e759fa51d332fe24a960ed5b72414d713956a

SHA512
e5eca0255808005895fcf4303b76d156688a0775b235333ac094aed93d3588153579acb690f27e79e4878b162901ee0627c58beb88702512a2734889f894db1d

Download Submit
C:\Windows\SysWOW64\Nilcjp32.exe

Filesize
80KB

MD5
4014011f318ff410adab231d7224a872

SHA1
cf8c875aed46eb7e3bd1c4bcf5f80ee71fbb99f9

SHA256
68b6ebeb00f25b2e4320a5f0c8867f5159f45ebbee07ca6b249fee2b5e059b0d

SHA512
00add1ea2480f4db63652c505c88f3ec0628c955622bd6a1f90e9f40474162dd7539ebb06d62c49f60e28af642130063346cafc46e5d402ceb42f82e6ba147d5

Download Submit
C:\Windows\SysWOW64\Njefqo32.exe

Filesize
80KB

MD5
055b12e70f20b53f9e0c0188d544bd41

SHA1
e423e79c653ec7cb7ec61639c32f368e9cafadea

SHA256
98f194479ac3c4011f657bc5fbaa913387d668b66ad406564b3f71a861de6310

SHA512
5a54f0e09ef5e70d6d458899af9b0ee935bcdb9ae36a7239e2daba45b3e40b2cf89b197b7f4e304a3f0f4707c683a4c09866a43f65c23955c7237fefb038e722

Download Submit
C:\Windows\SysWOW64\Njqmepik.exe

Filesize
80KB

MD5
34b89047686e5da0c4906d9d1935d2b1

SHA1
5a3d4a05e71b4f40c7e6c9a77e38621247e82419

SHA256
0ba121e7abc08e6f3dbc089419943cda26a3521ea1e00edbc147e26ffd69a017

SHA512
e35f72f9a8fb46affd0b6a1b48a2f9cdf0f3ad3382b0908ea65caa533270c3457ca1ac74cf70b3f162376da962a7f3727af0a8b7b884cf7cb88933e62a57392e

Download Submit
C:\Windows\SysWOW64\Npfkgjdn.exe

Filesize
80KB

MD5
4654706fe3cb5af6f3cadd5b835495a0

SHA1
02a65a4c6ce07132cb0997282d1c2cc5e9b7f864

SHA256
e72263d393dd3cac5369bf2c482e63127509b5d47cd757341f8f529c2de305c0

SHA512
2a2b3725a2d63284d79346004dad2f61f69c7ff21783f57fa15f8ee79a27c262c4e79cec50cad1d1702f562f58ecfd77f4c35c24d0d6661870d78c74ac265197

Download Submit
C:\Windows\SysWOW64\Oaqbkn32.exe

Filesize
80KB

MD5
16121342ce574f2d6f06ced320947b90

SHA1
2641afbab7e5f72367980998316fffdc74fe7f15

SHA256
90bfe425e7dfb92b59709afc97b40602cac4414d10f2e2641c6bc18a674527b0

SHA512
d8c95a3d543fd420f0c9d389bd5fca3d21300146bd5f7d20f8c92ecf5204775c8c9fd70cce3402c661f858765e423d8f0859da6e830b9e422ee0cd4c47af0810

Download Submit
C:\Windows\SysWOW64\Odapnf32.exe

Filesize
80KB

MD5
2941202a036e3e3b3aaf9b732df0388a

SHA1
8b85f11b829a6688c41203aa73e32feb17c3b1e3

SHA256
1f4342cb372d779e7f0c1ff58a30b93714276a60bba3a1f8e97db6f11ad20fff

SHA512
0064fca18d32cbb86ec444380d1925f01ba48f15a4b3b87e867cce2a6ab7e6a1b7730c730a2e6600aac38b89da7fec21e9bb02e001557eb71bba1c5c9c4ba1fe

Download Submit
C:\Windows\SysWOW64\Odocigqg.exe

Filesize
80KB

MD5
5755ce6fed353b13b9862aa1dd5c5410

SHA1
511ad16adcab99898f7d67bf2eb212cf737cbe7f

SHA256
75308f68237984b5b99acf5910e8c452b2217f3984a418a9dfad3ffd762e13da

SHA512
7c0be6bfba97407cb89c77a64ca8dd8d8475fdae032dfa2d973f53f23b63f96751bb79fb31836f39a363fbf14625d0c05e970a47d6f1772aa4f198c56b30e2a7

Download Submit
C:\Windows\SysWOW64\Ogifjcdp.exe

Filesize
80KB

MD5
1266dc5a66259a5b0837a0a6b8f587f2

SHA1
9081c21d88971a483f8ada5a4e9d59c8f34f7b96

SHA256
29cabed044a51526be720c522d7d7bebea47a42b43837e9564ee652c2cc1fb7f

SHA512
8a308a26887e5c19ac2495e962b26627e3f056c694509ce3a035745c2491994a484e0ac674a0f37aa64559e0039e986e748149a4329688b0a5a229ce050cbdc4

Download Submit
C:\Windows\SysWOW64\Ogkcpbam.exe

Filesize
80KB

MD5
916cf3483a2bb068e6af28b66a0081d1

SHA1
a7c7d4c9b61fa9647ac6ec222d436a214f539c33

SHA256
d832798e8e80fa3064a188535172a5940554349a4eb309e2d1e248259100d8c5

SHA512
7e48d371285ca22431f7c01706d4e1f3214b353a3f97bac5deea966988f16356791d478719cc7e29d39964af934160c3550e80a67cb8789be6f7e3729eafa43d

Download Submit
C:\Windows\SysWOW64\Olfobjbg.exe

Filesize
80KB

MD5
9f1260591ae3dab830320a016862dddf

SHA1
43697043be861dec8c2c93a56ec92b2c1bb38799

SHA256
b5f948564ff9757b8cf627c28c6e11a0f4d017c19feffea02291e3b821fe2cb6

SHA512
d7a21895e0dfe925a86a5366f989fa05fb0389e2bcf289389052aff78a1d552c0c639e2c34e8b1ddb5ddbcbf15521e823d454616f72e97d8695a6c247c252731

Download Submit
C:\Windows\SysWOW64\Oocmii32.exe

Filesize
80KB

MD5
c6a962d12cb464f931dce6e40c8d88c1

SHA1
6c8dc41ff3df8aa83787816d9dd0bcde7344783f

SHA256
2c0660f476331c1d566c21832a564d79f217c379f58a22ee8f530fb5494fd758

SHA512
d1643c56b14eeeb4a5814b94218c1dcd79adbfb3bd464ec9e77ee2e9f3ae5067381b6f9c3d96318086e329f90b74d722a3302f20359d33e6a4bec8f6ba5454f0

Download Submit
C:\Windows\SysWOW64\Pcijeb32.exe

Filesize
80KB

MD5
c17eedf86abe2897f119b3af634eef33

SHA1
098e87757b68ed01c9403d279669113a7efe4546

SHA256
5fc6d98f6472886355ce56f57426b0bc4df4be6377e8c44ba234a9c68b144096

SHA512
6d97d0577979b25845e1a6b6fa13409a7bfab586b313a493da5ece8e8f6a158581547ed7921c22c372dd8cc6f9b6b30bc2da2cf1a1803704e4844d6aba0c2b7a

Download Submit
C:\Windows\SysWOW64\Pfjcgn32.exe

Filesize
80KB

MD5
08e5e70a14cee703337c66a017123c9f

SHA1
9ccefd6a8bd54377068b5598963b1a5ae5443859

SHA256
bca4af5cfb52a67234f63054417657ccaa112edc8fec2f845e0d9d3135fdf69b

SHA512
a63749f9eec27bc233d02529b32bab329207ef379dc2dbbe8c4f762e43e5736cb07b5e369538d147dda363ac693297670b3df5ac596b1a0cce58cdf45340cccd

Download Submit
C:\Windows\SysWOW64\Plcdiabk.exe

Filesize
80KB

MD5
50be328a430961c3d3aceeca0a65bff2

SHA1
8b61f377788c93a4ad53dc4b0684752674144278

SHA256
49582159a073eea78eba5979859b71a2231c6b109ea8d85198ad8b3ef7415e03

SHA512
d11abf2c483b44ade7c2d8c012e99b8a3ff9adf95751b78c2e014aa58db1a1ed17ec1b4175213b0fbb4312fdb3ada87efc04a826c43166d9723eebe44c131b6e

Download Submit
C:\Windows\SysWOW64\Plhnda32.exe

Filesize
80KB

MD5
34d6f3082bbdd920688e7a447997bdd6

SHA1
0c924a8dd02a929a701c52c8a8e4a53dd5f9de2a

SHA256
2e2a39f3083bb3dfae4c782e184952ab37e2515ccc7603ee32535872fbdad1b8

SHA512
2ee4b435d0dffb0b0c3c9f3c9753f7a6d5786f251b708707a02c36f7ee5acdb89feeb3af87d1e2e9b9ed2d05d0f297b2919a6f842aba9b80a6a1b057c88d57f6

Download Submit
C:\Windows\SysWOW64\Pmannhhj.exe

Filesize
80KB

MD5
97295c0a5ca34d9715cd93ff07642508

SHA1
cf9a90008dd2f1a28a5b024743ef7ab7d794af4c

SHA256
d3a805f203a7ea49183ae04b9dd7da5a02972f088492e7030059bcd68197999e

SHA512
a73640b038bfb8b69e1a22269f97403350a90193935a8db1cd02fe60a54bc6eaa09829f73e63052a3727e1d67e1ab6cb396a846d8b93d4987310e7ffc79083d7

Download Submit
memory/368-383-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/544-295-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/768-415-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/880-56-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1096-177-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1248-367-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1496-169-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1604-90-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1608-373-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1716-85-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1828-355-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1880-129-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1888-289-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1932-330-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2016-12-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2052-265-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2072-32-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2200-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2536-395-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2560-307-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2572-249-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2644-408-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2780-121-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2848-343-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2896-301-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2920-319-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2960-233-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3060-226-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3088-413-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3096-218-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3140-361-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3236-81-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3236-1-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3236-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3240-271-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3352-401-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3456-41-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3516-258-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3584-194-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3800-185-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3804-225-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3904-97-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3968-64-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4008-202-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4020-113-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4200-29-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4244-106-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4252-49-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4292-242-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4380-353-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4388-287-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4408-427-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4420-154-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4476-277-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4496-161-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4512-337-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4676-73-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4800-385-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4924-336-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5020-210-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5060-138-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5068-425-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5076-313-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5096-145-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads