41004b0556da5b3859a7eba92e7786f6583993dc44438a0e9b34c076a4eba3a3

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41004b0556da5b3859a7eba92e7786f6583993dc44438a0e9b34c076a4eba3a3.exe
Size

276KB
MD5

dd7cdbe67170fd574e924e29d8536d62
SHA1

1503e7757f45a73075923311332a2bb826d09e15
SHA256

41004b0556da5b3859a7eba92e7786f6583993dc44438a0e9b34c076a4eba3a3
SHA512

b29e4d5e107f1a9a1c055fa9528ad3a1bf4a0b9ad409fb4b2efcdc50da034b67357cbc6668132b79b0836547daa27198e5610820ca03bf434424d6bbd7a4e48b
SSDEEP

6144:4+DKVivFzctoR1dWZHEFJ7aWN1rtMsQBOSGaF+:NDKkZ2y2HEGWN1RMs1S7

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhhnpjmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbbokdlk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dakacjdb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fineoi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ackbmcjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Onapdl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqknig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdifoehl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iddljmpc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njjdho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebaplnie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ppdbgncl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcphdqmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hhihdcbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fkfcqb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eaaiahei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjehmfch.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmojkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hemmac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mplafeil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ohqbhdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pefhlaie.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hedafk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jeapcq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gkaejf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cbdjeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ogifjcdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ibkpcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbmingjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bhpfqcln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nfohgqlg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Olmeci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghniielm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jpenfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gbnhoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Odocigqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ajkaii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmkcqn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilmmni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bklfgo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgbpaipl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enhpao32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fijdjfdb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjocbhbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmbgdl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Folaiqng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Okkdic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkbjjbda.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gncchb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbnhoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oqoefand.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjcbbmif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dhhfedil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fpggamqc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hlblcn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fgjccb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ombcji32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nacmdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgjijmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nfgklkoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncbafoge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhdhon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojdnid32.exe

Executes dropped EXE 64 IoCs

pid	Process
3048	Dkoggkjo.exe
1152	Echknh32.exe
3924	Elppfmoo.exe
4104	Ehgqln32.exe
1832	Eleiam32.exe
2696	Eemnjbaj.exe
1644	Ehljfnpn.exe
2856	Ehnglm32.exe
4816	Fdegandp.exe
3884	Fojlngce.exe
3888	Fhemmlhc.exe
3228	Fkffog32.exe
4984	Gododflk.exe
2752	Gkkojgao.exe
2144	Gohhpe32.exe
3116	Gkaejf32.exe
4384	Gblngpbd.exe
3704	Hckjacjg.exe
1596	Hihbijhn.exe
3480	Hflcbngh.exe
1492	Hkikkeeo.exe
756	Hkkhqd32.exe
556	Hcbpab32.exe
4328	Hkmefd32.exe
4212	Hfcicmqp.exe
2508	Ipknlb32.exe
2892	Ibjjhn32.exe
3976	Iicbehnq.exe
1556	Imoneg32.exe
4464	Icifbang.exe
4404	Iejcji32.exe
4540	Ifllil32.exe
4904	Ilidbbgl.exe
5020	Jfoiokfb.exe
1272	Jlkagbej.exe
1020	Jfaedkdp.exe
1744	Jlnnmb32.exe
2332	Jefbfgig.exe
1668	Jcgbco32.exe
1660	Jehokgge.exe
840	Jpnchp32.exe
2852	Mgfqmfde.exe
1584	Mlcifmbl.exe
2480	Mgimcebb.exe
1520	Mmbfpp32.exe
4776	Menjdbgj.exe
2788	Npcoakfp.exe
4804	Nngokoej.exe
4292	Npfkgjdn.exe
2400	Ngpccdlj.exe
2424	Nnjlpo32.exe
4988	Ncfdie32.exe
3952	Njqmepik.exe
2388	Npjebj32.exe
3640	Ngdmod32.exe
1788	Nnneknob.exe
3556	Npmagine.exe
1816	Odkjng32.exe
976	Ogifjcdp.exe
4912	Olfobjbg.exe
5012	Ofnckp32.exe
2560	Odocigqg.exe
1672	Ojllan32.exe
4668	Odapnf32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Jkakadbk.dll	Ckpbnb32.exe
File opened for modification	C:\Windows\SysWOW64\Llmhaold.exe	Ljnlecmp.exe
File created	C:\Windows\SysWOW64\Ojenek32.dll	Oanokhdb.exe
File opened for modification	C:\Windows\SysWOW64\Enhpao32.exe	Ehlhih32.exe
File created	C:\Windows\SysWOW64\Hnnljj32.exe	Hhdcmp32.exe
File created	C:\Windows\SysWOW64\Clkgcdmh.dll	Ghniielm.exe
File opened for modification	C:\Windows\SysWOW64\Iakiia32.exe	Ikqqlgem.exe
File created	C:\Windows\SysWOW64\Cglgjeci.exe	Cabomkll.exe
File opened for modification	C:\Windows\SysWOW64\Fineoi32.exe	Facqkg32.exe
File created	C:\Windows\SysWOW64\Oblmdhdo.exe	Ohghgodi.exe
File created	C:\Windows\SysWOW64\Hjpefo32.dll	Ojdnid32.exe
File created	C:\Windows\SysWOW64\Fkccgodj.dll	Fechomko.exe
File created	C:\Windows\SysWOW64\Jpecpo32.dll	Klbnajqc.exe
File created	C:\Windows\SysWOW64\Cjinkg32.exe	Bfkedibe.exe
File created	C:\Windows\SysWOW64\Ipgocj32.dll	Qhakoa32.exe
File created	C:\Windows\SysWOW64\Ljkgblln.dll	Eaaiahei.exe
File opened for modification	C:\Windows\SysWOW64\Gokbgpeg.exe	Fgcjfbed.exe
File created	C:\Windows\SysWOW64\Nbjnhape.dll	Hejqldci.exe
File created	C:\Windows\SysWOW64\Jfdnfdoa.dll	Ndflak32.exe
File opened for modification	C:\Windows\SysWOW64\Oeheqm32.exe	Oeehkn32.exe
File created	C:\Windows\SysWOW64\Jibclo32.dll	Fijdjfdb.exe
File created	C:\Windows\SysWOW64\Kabcopmg.exe	Kpqggh32.exe
File opened for modification	C:\Windows\SysWOW64\Fddqghpd.exe	Fafdkmap.exe
File created	C:\Windows\SysWOW64\Qfmmplad.exe	Qdoacabq.exe
File created	C:\Windows\SysWOW64\Nkopekaa.dll	Efblbbqd.exe
File created	C:\Windows\SysWOW64\Mjliff32.dll	Lindkm32.exe
File created	C:\Windows\SysWOW64\Ipamlopb.dll	Llnnmhfe.exe
File created	C:\Windows\SysWOW64\Miomdk32.exe	Mojhgbdl.exe
File created	C:\Windows\SysWOW64\Copdgb32.dll	Pefabkej.exe
File created	C:\Windows\SysWOW64\Khblgpag.dll	Dokgdkeh.exe
File opened for modification	C:\Windows\SysWOW64\Mnmmboed.exe	Mgbefe32.exe
File created	C:\Windows\SysWOW64\Cglbhhga.exe	Cpbjkn32.exe
File created	C:\Windows\SysWOW64\Dhikci32.exe	Dndgfpbo.exe
File created	C:\Windows\SysWOW64\Jaonbc32.exe	Jidinqpb.exe
File created	C:\Windows\SysWOW64\Cdolgfbp.exe	Cmedjl32.exe
File created	C:\Windows\SysWOW64\Okbcgopo.dll	Idhnkf32.exe
File created	C:\Windows\SysWOW64\Ghdief32.dll	Lgjijmin.exe
File created	C:\Windows\SysWOW64\Nqobhgmh.dll	Mlofcf32.exe
File created	C:\Windows\SysWOW64\Hpfohk32.dll	Nmhijd32.exe
File created	C:\Windows\SysWOW64\Dggkipii.exe	Dnngpj32.exe
File created	C:\Windows\SysWOW64\Icgcab32.dll	Bmkcqn32.exe
File created	C:\Windows\SysWOW64\Iibccgep.exe	Iedjmioj.exe
File created	C:\Windows\SysWOW64\Ccchof32.exe	Cadlbk32.exe
File created	C:\Windows\SysWOW64\Dkpqlc32.dll	Fndpmndl.exe
File created	C:\Windows\SysWOW64\Jqcdkk32.dll	Kbbokdlk.exe
File opened for modification	C:\Windows\SysWOW64\Bfjnjcni.exe	Bppfmigl.exe
File opened for modification	C:\Windows\SysWOW64\Eqiibjlj.exe	Eohmkb32.exe
File opened for modification	C:\Windows\SysWOW64\Fijdjfdb.exe	Fqbliicp.exe
File created	C:\Windows\SysWOW64\Bdffhl32.dll	Cflkpblf.exe
File created	C:\Windows\SysWOW64\Dnkpihfh.dll	Dpgnjo32.exe
File created	C:\Windows\SysWOW64\Qhkjegqi.dll	Pchlpfjb.exe
File opened for modification	C:\Windows\SysWOW64\Cammjakm.exe	Conanfli.exe
File created	C:\Windows\SysWOW64\Khhnncno.dll	Kihnmohm.exe
File created	C:\Windows\SysWOW64\Eibfck32.exe	Efdjgo32.exe
File created	C:\Windows\SysWOW64\Oileggkb.exe	Ogmijllo.exe
File created	C:\Windows\SysWOW64\Abcgjd32.dll	Mbbagk32.exe
File opened for modification	C:\Windows\SysWOW64\Pjoppf32.exe	Pfccogfc.exe
File created	C:\Windows\SysWOW64\Ppnenlka.exe	Pjaleemj.exe
File opened for modification	C:\Windows\SysWOW64\Cmedjl32.exe	Ccppmc32.exe
File created	C:\Windows\SysWOW64\Odpich32.dll	Eachem32.exe
File created	C:\Windows\SysWOW64\Okopkl32.dll	Lejnmncd.exe
File opened for modification	C:\Windows\SysWOW64\Mbhamajc.exe	Mpieqeko.exe
File created	C:\Windows\SysWOW64\Fdhcgaic.exe	Fkpool32.exe
File opened for modification	C:\Windows\SysWOW64\Ejfeng32.exe	Ebommi32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
13148	13016	WerFault.exe	1044

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Deocpk32.dll"	Iijfhbhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jeapcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gkkojgao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lgpoihnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgmodn32.dll"	Bkgeainn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Baannc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Efffmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lndagg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Enhpao32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mhldbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbngpi32.dll"	Cgqqdeod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oeabgdnp.dll"	Dakacjdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dkdliame.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Phcgcqab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgpfqchb.dll"	Joekag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmliok32.dll"	Dcjnoece.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dfamapjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ahenokjf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Popbpqjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkbfan32.dll"	Nmipdk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mgimcebb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hacbhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jlolpq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ljceqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qaqegecm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qgpogili.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ehfcfb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hhiajmod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbnblldi.dll"	Hlkfbocp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ncbegn32.dll"	Lfiokmkc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcnfjkma.dll"	Ijegcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lmbhgd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jahqiaeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ghniielm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpeaedjn.dll"	Hhfedm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bchace32.dll"	Kbddfmgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mniallpq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nqmojd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inhdfkln.dll"	Dhjckcgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jknfcofa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Koodbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgcodk32.dll"	Khiofk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ehgqln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hacbhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaghgm32.dll"	Lqkgbcff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ilibdmgp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mfjcnold.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ccchof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kamonn32.dll"	Eddnic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mgfqmfde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ngdmod32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cjpckf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hhihdcbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogcggo32.dll"	Mlklkgei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Edbiniff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gokbgpeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inclga32.dll"	Hajkqfoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pglcddpd.dll"	Hckjacjg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dammlf32.dll"	Hflcbngh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcgfom32.dll"	Olckbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Agiamhdo.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 3048	2244	41004b0556da5b3859a7eba92e7786f6583993dc44438a0e9b34c076a4eba3a3.exe	86
PID 2244 wrote to memory of 3048	2244	41004b0556da5b3859a7eba92e7786f6583993dc44438a0e9b34c076a4eba3a3.exe	86
PID 2244 wrote to memory of 3048	2244	41004b0556da5b3859a7eba92e7786f6583993dc44438a0e9b34c076a4eba3a3.exe	86
PID 3048 wrote to memory of 1152	3048	Dkoggkjo.exe	87
PID 3048 wrote to memory of 1152	3048	Dkoggkjo.exe	87
PID 3048 wrote to memory of 1152	3048	Dkoggkjo.exe	87
PID 1152 wrote to memory of 3924	1152	Echknh32.exe	88
PID 1152 wrote to memory of 3924	1152	Echknh32.exe	88
PID 1152 wrote to memory of 3924	1152	Echknh32.exe	88
PID 3924 wrote to memory of 4104	3924	Elppfmoo.exe	89
PID 3924 wrote to memory of 4104	3924	Elppfmoo.exe	89
PID 3924 wrote to memory of 4104	3924	Elppfmoo.exe	89
PID 4104 wrote to memory of 1832	4104	Ehgqln32.exe	90
PID 4104 wrote to memory of 1832	4104	Ehgqln32.exe	90
PID 4104 wrote to memory of 1832	4104	Ehgqln32.exe	90
PID 1832 wrote to memory of 2696	1832	Eleiam32.exe	91
PID 1832 wrote to memory of 2696	1832	Eleiam32.exe	91
PID 1832 wrote to memory of 2696	1832	Eleiam32.exe	91
PID 2696 wrote to memory of 1644	2696	Eemnjbaj.exe	92
PID 2696 wrote to memory of 1644	2696	Eemnjbaj.exe	92
PID 2696 wrote to memory of 1644	2696	Eemnjbaj.exe	92
PID 1644 wrote to memory of 2856	1644	Ehljfnpn.exe	93
PID 1644 wrote to memory of 2856	1644	Ehljfnpn.exe	93
PID 1644 wrote to memory of 2856	1644	Ehljfnpn.exe	93
PID 2856 wrote to memory of 4816	2856	Ehnglm32.exe	94
PID 2856 wrote to memory of 4816	2856	Ehnglm32.exe	94
PID 2856 wrote to memory of 4816	2856	Ehnglm32.exe	94
PID 4816 wrote to memory of 3884	4816	Fdegandp.exe	96
PID 4816 wrote to memory of 3884	4816	Fdegandp.exe	96
PID 4816 wrote to memory of 3884	4816	Fdegandp.exe	96
PID 3884 wrote to memory of 3888	3884	Fojlngce.exe	97
PID 3884 wrote to memory of 3888	3884	Fojlngce.exe	97
PID 3884 wrote to memory of 3888	3884	Fojlngce.exe	97
PID 3888 wrote to memory of 3228	3888	Fhemmlhc.exe	99
PID 3888 wrote to memory of 3228	3888	Fhemmlhc.exe	99
PID 3888 wrote to memory of 3228	3888	Fhemmlhc.exe	99
PID 3228 wrote to memory of 4984	3228	Fkffog32.exe	100
PID 3228 wrote to memory of 4984	3228	Fkffog32.exe	100
PID 3228 wrote to memory of 4984	3228	Fkffog32.exe	100
PID 4984 wrote to memory of 2752	4984	Gododflk.exe	101
PID 4984 wrote to memory of 2752	4984	Gododflk.exe	101
PID 4984 wrote to memory of 2752	4984	Gododflk.exe	101
PID 2752 wrote to memory of 2144	2752	Gkkojgao.exe	102
PID 2752 wrote to memory of 2144	2752	Gkkojgao.exe	102
PID 2752 wrote to memory of 2144	2752	Gkkojgao.exe	102
PID 2144 wrote to memory of 3116	2144	Gohhpe32.exe	104
PID 2144 wrote to memory of 3116	2144	Gohhpe32.exe	104
PID 2144 wrote to memory of 3116	2144	Gohhpe32.exe	104
PID 3116 wrote to memory of 4384	3116	Gkaejf32.exe	105
PID 3116 wrote to memory of 4384	3116	Gkaejf32.exe	105
PID 3116 wrote to memory of 4384	3116	Gkaejf32.exe	105
PID 4384 wrote to memory of 3704	4384	Gblngpbd.exe	106
PID 4384 wrote to memory of 3704	4384	Gblngpbd.exe	106
PID 4384 wrote to memory of 3704	4384	Gblngpbd.exe	106
PID 3704 wrote to memory of 1596	3704	Hckjacjg.exe	107
PID 3704 wrote to memory of 1596	3704	Hckjacjg.exe	107
PID 3704 wrote to memory of 1596	3704	Hckjacjg.exe	107
PID 1596 wrote to memory of 3480	1596	Hihbijhn.exe	108
PID 1596 wrote to memory of 3480	1596	Hihbijhn.exe	108
PID 1596 wrote to memory of 3480	1596	Hihbijhn.exe	108
PID 3480 wrote to memory of 1492	3480	Hflcbngh.exe	109
PID 3480 wrote to memory of 1492	3480	Hflcbngh.exe	109
PID 3480 wrote to memory of 1492	3480	Hflcbngh.exe	109
PID 1492 wrote to memory of 756	1492	Hkikkeeo.exe	110

C:\Users\Admin\AppData\Local\Temp\41004b0556da5b3859a7eba92e7786f6583993dc44438a0e9b34c076a4eba3a3.exe
"C:\Users\Admin\AppData\Local\Temp\41004b0556da5b3859a7eba92e7786f6583993dc44438a0e9b34c076a4eba3a3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\SysWOW64\Dkoggkjo.exe
  C:\Windows\system32\Dkoggkjo.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\Echknh32.exe
    C:\Windows\system32\Echknh32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1152
  - - C:\Windows\SysWOW64\Elppfmoo.exe
      C:\Windows\system32\Elppfmoo.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3924
    - - C:\Windows\SysWOW64\Ehgqln32.exe
        
        C:\Windows\system32\Ehgqln32.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4104
      - C:\Windows\SysWOW64\Eleiam32.exe
        
        C:\Windows\system32\Eleiam32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1832
        
        C:\Windows\SysWOW64\Eemnjbaj.exe
        
        C:\Windows\system32\Eemnjbaj.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2696
        
        C:\Windows\SysWOW64\Ehljfnpn.exe
        
        C:\Windows\system32\Ehljfnpn.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1644
        
        C:\Windows\SysWOW64\Ehnglm32.exe
        
        C:\Windows\system32\Ehnglm32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2856
        
        C:\Windows\SysWOW64\Fdegandp.exe
        
        C:\Windows\system32\Fdegandp.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4816
        
        C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3884
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3888
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3228
        
        C:\Windows\SysWOW64\Gododflk.exe
        
        C:\Windows\system32\Gododflk.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4984
        
        C:\Windows\SysWOW64\Gkkojgao.exe
        
        C:\Windows\system32\Gkkojgao.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2752
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2144
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3116
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4384
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3704
        
        C:\Windows\SysWOW64\Hihbijhn.exe
        
        C:\Windows\system32\Hihbijhn.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1596
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        21⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3480
        
        C:\Windows\SysWOW64\Hkikkeeo.exe
        
        C:\Windows\system32\Hkikkeeo.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1492
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        23⤵
        Executes dropped EXE
        
        PID:756
        
        C:\Windows\SysWOW64\Hcbpab32.exe
        
        C:\Windows\system32\Hcbpab32.exe
        24⤵
        Executes dropped EXE
        
        PID:556
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        25⤵
        Executes dropped EXE
        
        PID:4328
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        26⤵
        Executes dropped EXE
        
        PID:4212
        
        C:\Windows\SysWOW64\Ipknlb32.exe
        
        C:\Windows\system32\Ipknlb32.exe
        27⤵
        Executes dropped EXE
        
        PID:2508
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        28⤵
        Executes dropped EXE
        
        PID:2892
        
        C:\Windows\SysWOW64\Iicbehnq.exe
        
        C:\Windows\system32\Iicbehnq.exe
        29⤵
        Executes dropped EXE
        
        PID:3976
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        30⤵
        Executes dropped EXE
        
        PID:1556
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        31⤵
        Executes dropped EXE
        
        PID:4464
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        32⤵
        Executes dropped EXE
        
        PID:4404
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        33⤵
        Executes dropped EXE
        
        PID:4540
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        34⤵
        Executes dropped EXE
        
        PID:4904
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        35⤵
        Executes dropped EXE
        
        PID:5020
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        36⤵
        Executes dropped EXE
        
        PID:1272
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        37⤵
        Executes dropped EXE
        
        PID:1020
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        38⤵
        Executes dropped EXE
        
        PID:1744
        
        C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        39⤵
        Executes dropped EXE
        
        PID:2332
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        40⤵
        Executes dropped EXE
        
        PID:1668
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        41⤵
        Executes dropped EXE
        
        PID:1660
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        42⤵
        Executes dropped EXE
        
        PID:840
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2852
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        44⤵
        Executes dropped EXE
        
        PID:1584
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        45⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2480
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        46⤵
        Executes dropped EXE
        
        PID:1520
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        47⤵
        Executes dropped EXE
        
        PID:4776
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        48⤵
        Executes dropped EXE
        
        PID:2788
        
        C:\Windows\SysWOW64\Nngokoej.exe
        
        C:\Windows\system32\Nngokoej.exe
        49⤵
        Executes dropped EXE
        
        PID:4804
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        50⤵
        Executes dropped EXE
        
        PID:4292
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        51⤵
        Executes dropped EXE
        
        PID:2400
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        52⤵
        Executes dropped EXE
        
        PID:2424
        
        C:\Windows\SysWOW64\Ncfdie32.exe
        
        C:\Windows\system32\Ncfdie32.exe
        53⤵
        Executes dropped EXE
        
        PID:4988
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        54⤵
        Executes dropped EXE
        
        PID:3952
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        55⤵
        Executes dropped EXE
        
        PID:2388
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        56⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3640
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        57⤵
        Executes dropped EXE
        
        PID:1788
        
        C:\Windows\SysWOW64\Npmagine.exe
        
        C:\Windows\system32\Npmagine.exe
        58⤵
        Executes dropped EXE
        
        PID:3556
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        59⤵
        Executes dropped EXE
        
        PID:1816
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:976
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        61⤵
        Executes dropped EXE
        
        PID:4912
        
        C:\Windows\SysWOW64\Ofnckp32.exe
        
        C:\Windows\system32\Ofnckp32.exe
        62⤵
        Executes dropped EXE
        
        PID:5012
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2560
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        64⤵
        Executes dropped EXE
        
        PID:1672
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        65⤵
        Executes dropped EXE
        
        PID:4668
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4840
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        67⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        68⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2336
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2868
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        71⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3232
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        73⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        74⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        75⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        76⤵
        Modifies registry class
        
        PID:3616
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        77⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        78⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        79⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        80⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        81⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        82⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        83⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        84⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5408
        
        C:\Windows\SysWOW64\Accfbokl.exe
        
        C:\Windows\system32\Accfbokl.exe
        86⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5496
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        88⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        89⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        90⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        91⤵
        Drops file in System32 directory
        
        PID:5672
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        92⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        93⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        94⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        95⤵
        Modifies registry class
        
        PID:5848
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        96⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        97⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5976
        
        C:\Windows\SysWOW64\Ddonekbl.exe
        
        C:\Windows\system32\Ddonekbl.exe
        99⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        100⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        101⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        102⤵
        Modifies registry class
        
        PID:5132
        
        C:\Windows\SysWOW64\Dahhio32.exe
        
        C:\Windows\system32\Dahhio32.exe
        103⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Eefaomcg.exe
        
        C:\Windows\system32\Eefaomcg.exe
        104⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Eehnem32.exe
        
        C:\Windows\system32\Eehnem32.exe
        105⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Ekefmc32.exe
        
        C:\Windows\system32\Ekefmc32.exe
        106⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Ehiffh32.exe
        
        C:\Windows\system32\Ehiffh32.exe
        107⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Egnchd32.exe
        
        C:\Windows\system32\Egnchd32.exe
        108⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Eachem32.exe
        
        C:\Windows\system32\Eachem32.exe
        109⤵
        Drops file in System32 directory
        
        PID:5604
        
        C:\Windows\SysWOW64\Fkllnbjc.exe
        
        C:\Windows\system32\Fkllnbjc.exe
        110⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Fafdkmap.exe
        
        C:\Windows\system32\Fafdkmap.exe
        111⤵
        Drops file in System32 directory
        
        PID:5768
        
        C:\Windows\SysWOW64\Fddqghpd.exe
        
        C:\Windows\system32\Fddqghpd.exe
        112⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Fknicb32.exe
        
        C:\Windows\system32\Fknicb32.exe
        113⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Fedmqk32.exe
        
        C:\Windows\system32\Fedmqk32.exe
        114⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Fgeihcme.exe
        
        C:\Windows\system32\Fgeihcme.exe
        115⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Folaiqng.exe
        
        C:\Windows\system32\Folaiqng.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6092
        
        C:\Windows\SysWOW64\Fajnfl32.exe
        
        C:\Windows\system32\Fajnfl32.exe
        117⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Fhdfbfdh.exe
        
        C:\Windows\system32\Fhdfbfdh.exe
        118⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Fnaokmco.exe
        
        C:\Windows\system32\Fnaokmco.exe
        119⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\Fgjccb32.exe
        
        C:\Windows\system32\Fgjccb32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5460
        
        C:\Windows\SysWOW64\Fnckpmql.exe
        
        C:\Windows\system32\Fnckpmql.exe
        121⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Gkglja32.exe
        
        C:\Windows\system32\Gkglja32.exe
        122⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Gnfhfl32.exe
        
        C:\Windows\system32\Gnfhfl32.exe
        123⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Gempgj32.exe
        
        C:\Windows\system32\Gempgj32.exe
        124⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Ggnlobej.exe
        
        C:\Windows\system32\Ggnlobej.exe
        125⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Gnhdkl32.exe
        
        C:\Windows\system32\Gnhdkl32.exe
        126⤵
        
        PID:1344
        
        C:\Windows\SysWOW64\Ghniielm.exe
        
        C:\Windows\system32\Ghniielm.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5696
        
        C:\Windows\SysWOW64\Gohaeo32.exe
        
        C:\Windows\system32\Gohaeo32.exe
        128⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Gafmaj32.exe
        
        C:\Windows\system32\Gafmaj32.exe
        129⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Gkobjpin.exe
        
        C:\Windows\system32\Gkobjpin.exe
        130⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Gahjgj32.exe
        
        C:\Windows\system32\Gahjgj32.exe
        131⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Ghbbcd32.exe
        
        C:\Windows\system32\Ghbbcd32.exe
        132⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Gkaopp32.exe
        
        C:\Windows\system32\Gkaopp32.exe
        133⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Hffcmh32.exe
        
        C:\Windows\system32\Hffcmh32.exe
        134⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Hheoid32.exe
        
        C:\Windows\system32\Hheoid32.exe
        135⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Hbmcbime.exe
        
        C:\Windows\system32\Hbmcbime.exe
        136⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Hhgloc32.exe
        
        C:\Windows\system32\Hhgloc32.exe
        137⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\Hoadkn32.exe
        
        C:\Windows\system32\Hoadkn32.exe
        138⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Hhihdcbp.exe
        
        C:\Windows\system32\Hhihdcbp.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1332
        
        C:\Windows\SysWOW64\Hkhdqoac.exe
        
        C:\Windows\system32\Hkhdqoac.exe
        140⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Hbbmmi32.exe
        
        C:\Windows\system32\Hbbmmi32.exe
        141⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Hhlejcpm.exe
        
        C:\Windows\system32\Hhlejcpm.exe
        142⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Iokgal32.exe
        
        C:\Windows\system32\Iokgal32.exe
        143⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Ifdonfka.exe
        
        C:\Windows\system32\Ifdonfka.exe
        144⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Iickkbje.exe
        
        C:\Windows\system32\Iickkbje.exe
        145⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Ibkpcg32.exe
        
        C:\Windows\system32\Ibkpcg32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6236
        
        C:\Windows\SysWOW64\Iiehpahb.exe
        
        C:\Windows\system32\Iiehpahb.exe
        147⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Inbqhhfj.exe
        
        C:\Windows\system32\Inbqhhfj.exe
        148⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Ieliebnf.exe
        
        C:\Windows\system32\Ieliebnf.exe
        149⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Ikfabm32.exe
        
        C:\Windows\system32\Ikfabm32.exe
        150⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Ibpiogmp.exe
        
        C:\Windows\system32\Ibpiogmp.exe
        151⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Iijaka32.exe
        
        C:\Windows\system32\Iijaka32.exe
        152⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Jodjhkkj.exe
        
        C:\Windows\system32\Jodjhkkj.exe
        153⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Jgonlm32.exe
        
        C:\Windows\system32\Jgonlm32.exe
        154⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Joffnk32.exe
        
        C:\Windows\system32\Joffnk32.exe
        155⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Jfpojead.exe
        
        C:\Windows\system32\Jfpojead.exe
        156⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Jiokfpph.exe
        
        C:\Windows\system32\Jiokfpph.exe
        157⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Jbgoof32.exe
        
        C:\Windows\system32\Jbgoof32.exe
        158⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Jiaglp32.exe
        
        C:\Windows\system32\Jiaglp32.exe
        159⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Jpkphjeb.exe
        
        C:\Windows\system32\Jpkphjeb.exe
        160⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Jfehed32.exe
        
        C:\Windows\system32\Jfehed32.exe
        161⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Jpmlnjco.exe
        
        C:\Windows\system32\Jpmlnjco.exe
        162⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Jfgdkd32.exe
        
        C:\Windows\system32\Jfgdkd32.exe
        163⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Jghabl32.exe
        
        C:\Windows\system32\Jghabl32.exe
        164⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Kbnepe32.exe
        
        C:\Windows\system32\Kbnepe32.exe
        165⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Kihnmohm.exe
        
        C:\Windows\system32\Kihnmohm.exe
        166⤵
        Drops file in System32 directory
        
        PID:7108
        
        C:\Windows\SysWOW64\Knefeffd.exe
        
        C:\Windows\system32\Knefeffd.exe
        167⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Keonap32.exe
        
        C:\Windows\system32\Keonap32.exe
        168⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Khmknk32.exe
        
        C:\Windows\system32\Khmknk32.exe
        169⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Kbbokdlk.exe
        
        C:\Windows\system32\Kbbokdlk.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6308
        
        C:\Windows\SysWOW64\Kimghn32.exe
        
        C:\Windows\system32\Kimghn32.exe
        171⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Kpgodhkd.exe
        
        C:\Windows\system32\Kpgodhkd.exe
        172⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Kechmoil.exe
        
        C:\Windows\system32\Kechmoil.exe
        173⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Khbdikip.exe
        
        C:\Windows\system32\Khbdikip.exe
        174⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Knlleepl.exe
        
        C:\Windows\system32\Knlleepl.exe
        175⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Kefdbo32.exe
        
        C:\Windows\system32\Kefdbo32.exe
        176⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Llpmoiof.exe
        
        C:\Windows\system32\Llpmoiof.exe
        177⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Lbjelc32.exe
        
        C:\Windows\system32\Lbjelc32.exe
        178⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Lehaho32.exe
        
        C:\Windows\system32\Lehaho32.exe
        179⤵
        
        PID:3636
        
        C:\Windows\SysWOW64\Lpneegel.exe
        
        C:\Windows\system32\Lpneegel.exe
        180⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Lejnmncd.exe
        
        C:\Windows\system32\Lejnmncd.exe
        181⤵
        Drops file in System32 directory
        
        PID:7052
        
        C:\Windows\SysWOW64\Lbnngbbn.exe
        
        C:\Windows\system32\Lbnngbbn.exe
        182⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Lihfcm32.exe
        
        C:\Windows\system32\Lihfcm32.exe
        183⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Lpbopfag.exe
        
        C:\Windows\system32\Lpbopfag.exe
        184⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Lbqklb32.exe
        
        C:\Windows\system32\Lbqklb32.exe
        185⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Leadnm32.exe
        
        C:\Windows\system32\Leadnm32.exe
        186⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Mlklkgei.exe
        
        C:\Windows\system32\Mlklkgei.exe
        187⤵
        Modifies registry class
        
        PID:6724
        
        C:\Windows\SysWOW64\Mojhgbdl.exe
        
        C:\Windows\system32\Mojhgbdl.exe
        188⤵
        Drops file in System32 directory
        
        PID:6824
        
        C:\Windows\SysWOW64\Miomdk32.exe
        
        C:\Windows\system32\Miomdk32.exe
        189⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Mpieqeko.exe
        
        C:\Windows\system32\Mpieqeko.exe
        190⤵
        Drops file in System32 directory
        
        PID:7012
        
        C:\Windows\SysWOW64\Mbhamajc.exe
        
        C:\Windows\system32\Mbhamajc.exe
        191⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Mibijk32.exe
        
        C:\Windows\system32\Mibijk32.exe
        192⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Mplafeil.exe
        
        C:\Windows\system32\Mplafeil.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6488
        
        C:\Windows\SysWOW64\Mffjcopi.exe
        
        C:\Windows\system32\Mffjcopi.exe
        194⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Mpnnle32.exe
        
        C:\Windows\system32\Mpnnle32.exe
        195⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\Mfhfhong.exe
        
        C:\Windows\system32\Mfhfhong.exe
        196⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Mhicpg32.exe
        
        C:\Windows\system32\Mhicpg32.exe
        197⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\Mfjcnold.exe
        
        C:\Windows\system32\Mfjcnold.exe
        198⤵
        Modifies registry class
        
        PID:6356
        
        C:\Windows\SysWOW64\Noehba32.exe
        
        C:\Windows\system32\Noehba32.exe
        199⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Neppokal.exe
        
        C:\Windows\system32\Neppokal.exe
        200⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Nhnlkfpp.exe
        
        C:\Windows\system32\Nhnlkfpp.exe
        201⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Nbcqiope.exe
        
        C:\Windows\system32\Nbcqiope.exe
        202⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Nedjjj32.exe
        
        C:\Windows\system32\Nedjjj32.exe
        203⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\Nlnbgddc.exe
        
        C:\Windows\system32\Nlnbgddc.exe
        204⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Nomncpcg.exe
        
        C:\Windows\system32\Nomncpcg.exe
        205⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Neffpj32.exe
        
        C:\Windows\system32\Neffpj32.exe
        206⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Nplkmckj.exe
        
        C:\Windows\system32\Nplkmckj.exe
        207⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Ncjginjn.exe
        
        C:\Windows\system32\Ncjginjn.exe
        208⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Oeicejia.exe
        
        C:\Windows\system32\Oeicejia.exe
        209⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Olckbd32.exe
        
        C:\Windows\system32\Olckbd32.exe
        210⤵
        Modifies registry class
        
        PID:7312
        
        C:\Windows\SysWOW64\Ocmconhk.exe
        
        C:\Windows\system32\Ocmconhk.exe
        211⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Oigllh32.exe
        
        C:\Windows\system32\Oigllh32.exe
        212⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Opadhb32.exe
        
        C:\Windows\system32\Opadhb32.exe
        213⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Oenlqi32.exe
        
        C:\Windows\system32\Oenlqi32.exe
        214⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Olgemcli.exe
        
        C:\Windows\system32\Olgemcli.exe
        215⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Oofaiokl.exe
        
        C:\Windows\system32\Oofaiokl.exe
        216⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Ogmijllo.exe
        
        C:\Windows\system32\Ogmijllo.exe
        217⤵
        Drops file in System32 directory
        
        PID:7624
        
        C:\Windows\SysWOW64\Oileggkb.exe
        
        C:\Windows\system32\Oileggkb.exe
        218⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Ocdjpmac.exe
        
        C:\Windows\system32\Ocdjpmac.exe
        219⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Ohqbhdpj.exe
        
        C:\Windows\system32\Ohqbhdpj.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7752
        
        C:\Windows\SysWOW64\Ophjiaql.exe
        
        C:\Windows\system32\Ophjiaql.exe
        221⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Pgbbek32.exe
        
        C:\Windows\system32\Pgbbek32.exe
        222⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Pomgjn32.exe
        
        C:\Windows\system32\Pomgjn32.exe
        223⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Pgdokkfg.exe
        
        C:\Windows\system32\Pgdokkfg.exe
        224⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Phelcc32.exe
        
        C:\Windows\system32\Phelcc32.exe
        225⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Ppmcdq32.exe
        
        C:\Windows\system32\Ppmcdq32.exe
        226⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Pckppl32.exe
        
        C:\Windows\system32\Pckppl32.exe
        227⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Pjehmfch.exe
        
        C:\Windows\system32\Pjehmfch.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8100
        
        C:\Windows\SysWOW64\Poaqemao.exe
        
        C:\Windows\system32\Poaqemao.exe
        229⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Pleaoa32.exe
        
        C:\Windows\system32\Pleaoa32.exe
        230⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Pgkelj32.exe
        
        C:\Windows\system32\Pgkelj32.exe
        231⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Phlacbfm.exe
        
        C:\Windows\system32\Phlacbfm.exe
        232⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Qfpbmfdf.exe
        
        C:\Windows\system32\Qfpbmfdf.exe
        233⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Qgpogili.exe
        
        C:\Windows\system32\Qgpogili.exe
        234⤵
        Modifies registry class
        
        PID:7428
        
        C:\Windows\SysWOW64\Qhakoa32.exe
        
        C:\Windows\system32\Qhakoa32.exe
        235⤵
        Drops file in System32 directory
        
        PID:7492
        
        C:\Windows\SysWOW64\Qqhcpo32.exe
        
        C:\Windows\system32\Qqhcpo32.exe
        236⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Agbkmijg.exe
        
        C:\Windows\system32\Agbkmijg.exe
        237⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Ajqgidij.exe
        
        C:\Windows\system32\Ajqgidij.exe
        238⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Aompak32.exe
        
        C:\Windows\system32\Aompak32.exe
        239⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Aopmfk32.exe
        
        C:\Windows\system32\Aopmfk32.exe
        240⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Amcmpodi.exe
        
        C:\Windows\system32\Amcmpodi.exe
        241⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Agiamhdo.exe
        
        C:\Windows\system32\Agiamhdo.exe
        242⤵
        Modifies registry class
        
        PID:8048
        
        C:\Windows\SysWOW64\Aijnep32.exe
        
        C:\Windows\system32\Aijnep32.exe
        243⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Acpbbi32.exe
        
        C:\Windows\system32\Acpbbi32.exe
        244⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Aimkjp32.exe
        
        C:\Windows\system32\Aimkjp32.exe
        245⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Bcbohigp.exe
        
        C:\Windows\system32\Bcbohigp.exe
        246⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Bjlgdc32.exe
        
        C:\Windows\system32\Bjlgdc32.exe
        247⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Bmkcqn32.exe
        
        C:\Windows\system32\Bmkcqn32.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7648
        
        C:\Windows\SysWOW64\Boipmj32.exe
        
        C:\Windows\system32\Boipmj32.exe
        249⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Biadeoce.exe
        
        C:\Windows\system32\Biadeoce.exe
        250⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Boklbi32.exe
        
        C:\Windows\system32\Boklbi32.exe
        251⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Bfedoc32.exe
        
        C:\Windows\system32\Bfedoc32.exe
        252⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Bmomlnjk.exe
        
        C:\Windows\system32\Bmomlnjk.exe
        253⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Bpnihiio.exe
        
        C:\Windows\system32\Bpnihiio.exe
        254⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Bgeaifia.exe
        
        C:\Windows\system32\Bgeaifia.exe
        255⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Bifmqo32.exe
        
        C:\Windows\system32\Bifmqo32.exe
        256⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Bppfmigl.exe
        
        C:\Windows\system32\Bppfmigl.exe
        257⤵
        Drops file in System32 directory
        
        PID:8116
        
        C:\Windows\SysWOW64\Bfjnjcni.exe
        
        C:\Windows\system32\Bfjnjcni.exe
        258⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Bihjfnmm.exe
        
        C:\Windows\system32\Bihjfnmm.exe
        259⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Ccnncgmc.exe
        
        C:\Windows\system32\Ccnncgmc.exe
        260⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Cflkpblf.exe
        
        C:\Windows\system32\Cflkpblf.exe
        261⤵
        Drops file in System32 directory
        
        PID:7480
        
        C:\Windows\SysWOW64\Cabomkll.exe
        
        C:\Windows\system32\Cabomkll.exe
        262⤵
        Drops file in System32 directory
        
        PID:8204
        
        C:\Windows\SysWOW64\Cglgjeci.exe
        
        C:\Windows\system32\Cglgjeci.exe
        263⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Cadlbk32.exe
        
        C:\Windows\system32\Cadlbk32.exe
        264⤵
        Drops file in System32 directory
        
        PID:8316
        
        C:\Windows\SysWOW64\Ccchof32.exe
        
        C:\Windows\system32\Ccchof32.exe
        265⤵
        Modifies registry class
        
        PID:8376
        
        C:\Windows\SysWOW64\Cfadkb32.exe
        
        C:\Windows\system32\Cfadkb32.exe
        266⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Cippgm32.exe
        
        C:\Windows\system32\Cippgm32.exe
        267⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Cpihcgoa.exe
        
        C:\Windows\system32\Cpihcgoa.exe
        268⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Cgqqdeod.exe
        
        C:\Windows\system32\Cgqqdeod.exe
        269⤵
        Modifies registry class
        
        PID:8584
        
        C:\Windows\SysWOW64\Cibmlmeb.exe
        
        C:\Windows\system32\Cibmlmeb.exe
        270⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Cgcmjd32.exe
        
        C:\Windows\system32\Cgcmjd32.exe
        271⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Cjaifp32.exe
        
        C:\Windows\system32\Cjaifp32.exe
        272⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Dakacjdb.exe
        
        C:\Windows\system32\Dakacjdb.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8764
        
        C:\Windows\SysWOW64\Dcjnoece.exe
        
        C:\Windows\system32\Dcjnoece.exe
        274⤵
        Modifies registry class
        
        PID:8804
        
        C:\Windows\SysWOW64\Dfhjkabi.exe
        
        C:\Windows\system32\Dfhjkabi.exe
        275⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Dmbbhkjf.exe
        
        C:\Windows\system32\Dmbbhkjf.exe
        276⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Dpqodfij.exe
        
        C:\Windows\system32\Dpqodfij.exe
        277⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Dhhfedil.exe
        
        C:\Windows\system32\Dhhfedil.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8988
        
        C:\Windows\SysWOW64\Djfcaohp.exe
        
        C:\Windows\system32\Djfcaohp.exe
        279⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Dapkni32.exe
        
        C:\Windows\system32\Dapkni32.exe
        280⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Dhjckcgi.exe
        
        C:\Windows\system32\Dhjckcgi.exe
        281⤵
        Modifies registry class
        
        PID:9120
        
        C:\Windows\SysWOW64\Dikpbl32.exe
        
        C:\Windows\system32\Dikpbl32.exe
        282⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Dabhdinj.exe
        
        C:\Windows\system32\Dabhdinj.exe
        283⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Dhlpqc32.exe
        
        C:\Windows\system32\Dhlpqc32.exe
        284⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Djklmo32.exe
        
        C:\Windows\system32\Djklmo32.exe
        285⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Daediilg.exe
        
        C:\Windows\system32\Daediilg.exe
        286⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Dhomfc32.exe
        
        C:\Windows\system32\Dhomfc32.exe
        287⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Dfamapjo.exe
        
        C:\Windows\system32\Dfamapjo.exe
        288⤵
        Modifies registry class
        
        PID:8572
        
        C:\Windows\SysWOW64\Epjajeqo.exe
        
        C:\Windows\system32\Epjajeqo.exe
        289⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Efdjgo32.exe
        
        C:\Windows\system32\Efdjgo32.exe
        290⤵
        Drops file in System32 directory
        
        PID:8716
        
        C:\Windows\SysWOW64\Eibfck32.exe
        
        C:\Windows\system32\Eibfck32.exe
        291⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Edhjqc32.exe
        
        C:\Windows\system32\Edhjqc32.exe
        292⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        293⤵
        Modifies registry class
        
        PID:8940
        
        C:\Windows\SysWOW64\Ealkjh32.exe
        
        C:\Windows\system32\Ealkjh32.exe
        294⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Ehfcfb32.exe
        
        C:\Windows\system32\Ehfcfb32.exe
        295⤵
        Modifies registry class
        
        PID:9088
        
        C:\Windows\SysWOW64\Eigonjcj.exe
        
        C:\Windows\system32\Eigonjcj.exe
        296⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Eangpgcl.exe
        
        C:\Windows\system32\Eangpgcl.exe
        297⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Ehhpla32.exe
        
        C:\Windows\system32\Ehhpla32.exe
        298⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Eaqdegaj.exe
        
        C:\Windows\system32\Eaqdegaj.exe
        299⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Epcdqd32.exe
        
        C:\Windows\system32\Epcdqd32.exe
        300⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Facqkg32.exe
        
        C:\Windows\system32\Facqkg32.exe
        301⤵
        Drops file in System32 directory
        
        PID:8692
        
        C:\Windows\SysWOW64\Fineoi32.exe
        
        C:\Windows\system32\Fineoi32.exe
        302⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8832
        
        C:\Windows\SysWOW64\Fhofmq32.exe
        
        C:\Windows\system32\Fhofmq32.exe
        303⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        304⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Fhabbp32.exe
        
        C:\Windows\system32\Fhabbp32.exe
        305⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Fkpool32.exe
        
        C:\Windows\system32\Fkpool32.exe
        306⤵
        Drops file in System32 directory
        
        PID:8308
        
        C:\Windows\SysWOW64\Fdhcgaic.exe
        
        C:\Windows\system32\Fdhcgaic.exe
        307⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        308⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Ghhhcomg.exe
        
        C:\Windows\system32\Ghhhcomg.exe
        309⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        310⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Ggpbjkpl.exe
        
        C:\Windows\system32\Ggpbjkpl.exe
        311⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Ginnfgop.exe
        
        C:\Windows\system32\Ginnfgop.exe
        312⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Gknkpjfb.exe
        
        C:\Windows\system32\Gknkpjfb.exe
        313⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        314⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Hjchaf32.exe
        
        C:\Windows\system32\Hjchaf32.exe
        315⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Hhdhon32.exe
        
        C:\Windows\system32\Hhdhon32.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8592
        
        C:\Windows\SysWOW64\Hammhcij.exe
        
        C:\Windows\system32\Hammhcij.exe
        317⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Hhfedm32.exe
        
        C:\Windows\system32\Hhfedm32.exe
        318⤵
        Modifies registry class
        
        PID:9284
        
        C:\Windows\SysWOW64\Hhiajmod.exe
        
        C:\Windows\system32\Hhiajmod.exe
        319⤵
        Modifies registry class
        
        PID:9328
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        320⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Hgnoki32.exe
        
        C:\Windows\system32\Hgnoki32.exe
        321⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Hkjjlhle.exe
        
        C:\Windows\system32\Hkjjlhle.exe
        322⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Hacbhb32.exe
        
        C:\Windows\system32\Hacbhb32.exe
        323⤵
        Modifies registry class
        
        PID:9504
        
        C:\Windows\SysWOW64\Injcmc32.exe
        
        C:\Windows\system32\Injcmc32.exe
        324⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Iddljmpc.exe
        
        C:\Windows\system32\Iddljmpc.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9592
        
        C:\Windows\SysWOW64\Iqklon32.exe
        
        C:\Windows\system32\Iqklon32.exe
        326⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        327⤵
        Drops file in System32 directory
        
        PID:9676
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        328⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Iggaah32.exe
        
        C:\Windows\system32\Iggaah32.exe
        329⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Iqpfjnba.exe
        
        C:\Windows\system32\Iqpfjnba.exe
        330⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Ihgnkkbd.exe
        
        C:\Windows\system32\Ihgnkkbd.exe
        331⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Ibobdqid.exe
        
        C:\Windows\system32\Ibobdqid.exe
        332⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Jhijqj32.exe
        
        C:\Windows\system32\Jhijqj32.exe
        333⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Jnfcia32.exe
        
        C:\Windows\system32\Jnfcia32.exe
        334⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Jdpkflfe.exe
        
        C:\Windows\system32\Jdpkflfe.exe
        335⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        336⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        337⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Kqnbkl32.exe
        
        C:\Windows\system32\Kqnbkl32.exe
        338⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Kghjhemo.exe
        
        C:\Windows\system32\Kghjhemo.exe
        339⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Kjffdalb.exe
        
        C:\Windows\system32\Kjffdalb.exe
        340⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        341⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Kkhpdcab.exe
        
        C:\Windows\system32\Kkhpdcab.exe
        342⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        343⤵
        Modifies registry class
        
        PID:9404
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        344⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Lnbklm32.exe
        
        C:\Windows\system32\Lnbklm32.exe
        345⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Lbpdblmo.exe
        
        C:\Windows\system32\Lbpdblmo.exe
        346⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Lijlof32.exe
        
        C:\Windows\system32\Lijlof32.exe
        347⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Llhikacp.exe
        
        C:\Windows\system32\Llhikacp.exe
        348⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Mbbagk32.exe
        
        C:\Windows\system32\Mbbagk32.exe
        349⤵
        Drops file in System32 directory
        
        PID:9928
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        350⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        351⤵
        Modifies registry class
        
        PID:4276
        
        C:\Windows\SysWOW64\Mecjif32.exe
        
        C:\Windows\system32\Mecjif32.exe
        352⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Mjpbam32.exe
        
        C:\Windows\system32\Mjpbam32.exe
        353⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        354⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Miaboe32.exe
        
        C:\Windows\system32\Miaboe32.exe
        355⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Malgcg32.exe
        
        C:\Windows\system32\Malgcg32.exe
        356⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Micoed32.exe
        
        C:\Windows\system32\Micoed32.exe
        357⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Maodigil.exe
        
        C:\Windows\system32\Maodigil.exe
        358⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        359⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Njiegl32.exe
        
        C:\Windows\system32\Njiegl32.exe
        360⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9968
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        362⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Nolgijpk.exe
        
        C:\Windows\system32\Nolgijpk.exe
        363⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Nhdlao32.exe
        
        C:\Windows\system32\Nhdlao32.exe
        364⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Objpoh32.exe
        
        C:\Windows\system32\Objpoh32.exe
        365⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Ohghgodi.exe
        
        C:\Windows\system32\Ohghgodi.exe
        366⤵
        Drops file in System32 directory
        
        PID:9384
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        367⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Oifeab32.exe
        
        C:\Windows\system32\Oifeab32.exe
        368⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        369⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Ohkbbn32.exe
        
        C:\Windows\system32\Ohkbbn32.exe
        370⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        371⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Phbhcmjl.exe
        
        C:\Windows\system32\Phbhcmjl.exe
        372⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Pchlpfjb.exe
        
        C:\Windows\system32\Pchlpfjb.exe
        373⤵
        Drops file in System32 directory
        
        PID:9668
        
        C:\Windows\SysWOW64\Pefhlaie.exe
        
        C:\Windows\system32\Pefhlaie.exe
        374⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10072
        
        C:\Windows\SysWOW64\Pkhjph32.exe
        
        C:\Windows\system32\Pkhjph32.exe
        375⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Qebhhp32.exe
        
        C:\Windows\system32\Qebhhp32.exe
        376⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Alnmjjdb.exe
        
        C:\Windows\system32\Alnmjjdb.exe
        377⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Ahenokjf.exe
        
        C:\Windows\system32\Ahenokjf.exe
        378⤵
        Modifies registry class
        
        PID:9836
        
        C:\Windows\SysWOW64\Ackbmcjl.exe
        
        C:\Windows\system32\Ackbmcjl.exe
        379⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9860
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        380⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Akffafgg.exe
        
        C:\Windows\system32\Akffafgg.exe
        381⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Ahjgjj32.exe
        
        C:\Windows\system32\Ahjgjj32.exe
        382⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        383⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        384⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        385⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\Bbgeno32.exe
        
        C:\Windows\system32\Bbgeno32.exe
        386⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        387⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        388⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Bkdcbd32.exe
        
        C:\Windows\system32\Bkdcbd32.exe
        389⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Cjecpkcg.exe
        
        C:\Windows\system32\Cjecpkcg.exe
        390⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Cmcolgbj.exe
        
        C:\Windows\system32\Cmcolgbj.exe
        391⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        392⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        393⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        394⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        395⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Ckkiccep.exe
        
        C:\Windows\system32\Ckkiccep.exe
        396⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        397⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Cjliajmo.exe
        
        C:\Windows\system32\Cjliajmo.exe
        398⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        399⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Ccdnjp32.exe
        
        C:\Windows\system32\Ccdnjp32.exe
        400⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Ciafbg32.exe
        
        C:\Windows\system32\Ciafbg32.exe
        401⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        402⤵
        Drops file in System32 directory
        
        PID:11228
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        403⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        404⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        405⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        406⤵
        Modifies registry class
        
        PID:10344
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        407⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        408⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        409⤵
        Drops file in System32 directory
        
        PID:10580
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        410⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        411⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        412⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        413⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        414⤵
        Drops file in System32 directory
        
        PID:10904
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        415⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Fpbmfn32.exe
        
        C:\Windows\system32\Fpbmfn32.exe
        416⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        417⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        418⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        419⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11260
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        420⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        421⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        422⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        423⤵
        
        PID:2860
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        424⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        425⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2496
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        426⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        427⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        428⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        429⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        430⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        431⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        432⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        433⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        434⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        435⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        436⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        437⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        438⤵
        
        PID:844
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        439⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4676
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        440⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        441⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Ipjedh32.exe
        
        C:\Windows\system32\Ipjedh32.exe
        442⤵
        
        PID:3372
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        443⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        444⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        445⤵
        Drops file in System32 directory
        
        PID:3564
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        446⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        447⤵
        Modifies registry class
        
        PID:10380
        
        C:\Windows\SysWOW64\Idkkpf32.exe
        
        C:\Windows\system32\Idkkpf32.exe
        448⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        449⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        450⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        451⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        452⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        453⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        454⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        455⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        456⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        457⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        458⤵
        Modifies registry class
        
        PID:10440
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        459⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        460⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        461⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        462⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        463⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        464⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        465⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        466⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        467⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        468⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        469⤵
        Modifies registry class
        
        PID:4384
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        470⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        471⤵
        Modifies registry class
        
        PID:4816
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        472⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        473⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3720
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        474⤵
        Modifies registry class
        
        PID:11096
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        475⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        476⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        477⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        478⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        479⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        480⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        481⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        482⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        483⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        484⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        485⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        486⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        487⤵
        
        PID:3704
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        488⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        489⤵
        
        PID:520
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        490⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        491⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        492⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        493⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        494⤵
        Drops file in System32 directory
        
        PID:1520
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        495⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        496⤵
        Drops file in System32 directory
        
        PID:5092
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        497⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        498⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2384
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        499⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        500⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        501⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        502⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        503⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        504⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        505⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:980
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        506⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        507⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        508⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        509⤵
        
        PID:428
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        510⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        511⤵
        Drops file in System32 directory
        
        PID:3952
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        512⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1456
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        513⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        514⤵
        
        PID:2720
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        515⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        516⤵
        Modifies registry class
        
        PID:1104
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        517⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        518⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        519⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        520⤵
        
        PID:2304
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        521⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        522⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        523⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        524⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        525⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        526⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        527⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        528⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4512
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        529⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        530⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10444
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        531⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        532⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        533⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        534⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        535⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        536⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        537⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        538⤵
        
        PID:1220
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        539⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        540⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5644
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        541⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        542⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        543⤵
        Drops file in System32 directory
        
        PID:11392
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        544⤵
        
        PID:11428
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        545⤵
        
        PID:11472
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        546⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        547⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        548⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        549⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        550⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        551⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        552⤵
        Drops file in System32 directory
        
        PID:11784
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        553⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        554⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        555⤵
        
        PID:11908
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        556⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        557⤵
        
        PID:11992
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        558⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        559⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        560⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        561⤵
        Drops file in System32 directory
        
        PID:12172
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        562⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        563⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        564⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        565⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        566⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        567⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11376
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        568⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        569⤵
        
        PID:11484
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        570⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11528
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        571⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        572⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        573⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        574⤵
        
        PID:11712
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        575⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        576⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6068
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        577⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        578⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        579⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        580⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        581⤵
        
        PID:11976
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        582⤵
        
        PID:12048
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        583⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        584⤵
        
        PID:12140
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        585⤵
        
        PID:12152
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        586⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        587⤵
        
        PID:12248
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        588⤵
        Drops file in System32 directory
        
        PID:5612
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        589⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        590⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        591⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        592⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        593⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        594⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        595⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        596⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        597⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        598⤵
        
        PID:11624
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        599⤵
        
        PID:11688
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        600⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11736
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        601⤵
        
        PID:11796
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        602⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        603⤵
        Modifies registry class
        
        PID:5528
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        604⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        605⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        606⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        607⤵
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        608⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        609⤵
        
        PID:12080
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        610⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        611⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        612⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        613⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        614⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        615⤵
        Modifies registry class
        
        PID:6336
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        616⤵
        Drops file in System32 directory
        
        PID:5704
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        617⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        618⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        619⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        620⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        621⤵
        Modifies registry class
        
        PID:11504
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        622⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        623⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        624⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        625⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        626⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        627⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        628⤵
        
        PID:11772
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        629⤵
        Drops file in System32 directory
        
        PID:6496
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        630⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        631⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        632⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        633⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        634⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        635⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        636⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        637⤵
        
        PID:12032
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        638⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6736
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        639⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6788
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        640⤵
        Modifies registry class
        
        PID:6884
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        641⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        642⤵
        
        PID:12268
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        643⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        644⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        645⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        646⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        647⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        648⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        649⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        650⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5808
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        651⤵
        Drops file in System32 directory
        
        PID:6444
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        652⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        653⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6912
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        654⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        655⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        656⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        657⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        658⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        659⤵
        
        PID:11768
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        660⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        661⤵
        
        PID:11896
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        662⤵
        Modifies registry class
        
        PID:5732
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        663⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        664⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        665⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        666⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        667⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        668⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        669⤵
        Modifies registry class
        
        PID:7108
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        670⤵
        Drops file in System32 directory
        
        PID:6552
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        671⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        672⤵
        
        PID:11296
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        673⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        674⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        675⤵
        
        PID:11384
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        676⤵
        
        PID:11456
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        677⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        678⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        679⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        680⤵
        
        PID:11584
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        681⤵
        
        PID:11644
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        682⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        683⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        684⤵
        Modifies registry class
        
        PID:6988
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        685⤵
        Modifies registry class
        
        PID:7856
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        686⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        687⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        688⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        689⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        690⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1344
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        691⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        692⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        693⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        694⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        695⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        696⤵
        Drops file in System32 directory
        
        PID:6984
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        697⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        698⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        699⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        700⤵
        Drops file in System32 directory
        
        PID:3384
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        701⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        702⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        703⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        704⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        705⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        706⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Dqnjgl32.exe
        
        C:\Windows\system32\Dqnjgl32.exe
        707⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        708⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        709⤵
        
        PID:11560
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        710⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Dndgfpbo.exe
        
        C:\Windows\system32\Dndgfpbo.exe
        711⤵
        Drops file in System32 directory
        
        PID:7760
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        712⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        713⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        714⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7372
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        715⤵
        Drops file in System32 directory
        
        PID:6416
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        716⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7980
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        717⤵
        Modifies registry class
        
        PID:8044
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        718⤵
        Drops file in System32 directory
        
        PID:6540
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        719⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        720⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        721⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        722⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        723⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        724⤵
        
        PID:560
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        725⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        726⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        727⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        728⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Fkfcqb32.exe
        
        C:\Windows\system32\Fkfcqb32.exe
        729⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8516
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        730⤵
        Drops file in System32 directory
        
        PID:7916
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        731⤵
        Drops file in System32 directory
        
        PID:7332
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        732⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7468
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        733⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        734⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        735⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        736⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        737⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        738⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Fganqbgg.exe
        
        C:\Windows\system32\Fganqbgg.exe
        739⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        740⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        741⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        742⤵
        Drops file in System32 directory
        
        PID:8532
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        743⤵
        Modifies registry class
        
        PID:8596
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        744⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        745⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        746⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Gbkkik32.exe
        
        C:\Windows\system32\Gbkkik32.exe
        747⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        748⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        749⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9140
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        750⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        751⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        752⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        753⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        754⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        755⤵
        Modifies registry class
        
        PID:8524
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        756⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        757⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        758⤵
        Modifies registry class
        
        PID:8124
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        759⤵
        Drops file in System32 directory
        
        PID:8744
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        760⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        761⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        762⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8668
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        763⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Hejqldci.exe
        
        C:\Windows\system32\Hejqldci.exe
        764⤵
        Drops file in System32 directory
        
        PID:9152
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        765⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        766⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        767⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8520
        
        C:\Windows\SysWOW64\Ipbaol32.exe
        
        C:\Windows\system32\Ipbaol32.exe
        768⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Ibqnkh32.exe
        
        C:\Windows\system32\Ibqnkh32.exe
        769⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        770⤵
        Modifies registry class
        
        PID:6720
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        771⤵
        Modifies registry class
        
        PID:7692
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        772⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        773⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        774⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        775⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        776⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        777⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        778⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        779⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        780⤵
        Drops file in System32 directory
        
        PID:7192
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        781⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        782⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        783⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        784⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        785⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        786⤵
        Modifies registry class
        
        PID:8784
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        787⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        788⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        789⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8260
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        790⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        791⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        792⤵
        Modifies registry class
        
        PID:8200
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        793⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        794⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        795⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        796⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        797⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        798⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        799⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        800⤵
        Drops file in System32 directory
        
        PID:7828
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        801⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        802⤵
        Modifies registry class
        
        PID:7660
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        803⤵
        Drops file in System32 directory
        
        PID:7140
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        804⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        805⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        806⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        807⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        808⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        809⤵
        Drops file in System32 directory
        
        PID:9808
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        810⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        811⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        812⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        813⤵
        Drops file in System32 directory
        
        PID:8540
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        814⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        815⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        816⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Lfiokmkc.exe
        
        C:\Windows\system32\Lfiokmkc.exe
        817⤵
        Modifies registry class
        
        PID:7864
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        818⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        819⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        820⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        821⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        822⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        823⤵
        Modifies registry class
        
        PID:10080
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        824⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        825⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        826⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        827⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        828⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        829⤵
        Drops file in System32 directory
        
        PID:9056
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        830⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        831⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9236
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        832⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        833⤵
        Modifies registry class
        
        PID:7844
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        834⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        835⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        836⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        837⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        838⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        839⤵
        Drops file in System32 directory
        
        PID:8980
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        840⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        841⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9224
        
        C:\Windows\SysWOW64\Nfqnbjfi.exe
        
        C:\Windows\system32\Nfqnbjfi.exe
        842⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        843⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Nqfbpb32.exe
        
        C:\Windows\system32\Nqfbpb32.exe
        844⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        845⤵
        
        PID:4644
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        846⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        847⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        848⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        849⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Ocihgnam.exe
        
        C:\Windows\system32\Ocihgnam.exe
        850⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        851⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        852⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        853⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        854⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9684
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        855⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Oflmnh32.exe
        
        C:\Windows\system32\Oflmnh32.exe
        856⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        857⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        858⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9748
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        859⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        860⤵
        
        PID:864
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        861⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        862⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Pfccogfc.exe
        
        C:\Windows\system32\Pfccogfc.exe
        863⤵
        Drops file in System32 directory
        
        PID:10048
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        864⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        865⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Pjaleemj.exe
        
        C:\Windows\system32\Pjaleemj.exe
        866⤵
        Drops file in System32 directory
        
        PID:8724
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        867⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Pmbegqjk.exe
        
        C:\Windows\system32\Pmbegqjk.exe
        868⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Qclmck32.exe
        
        C:\Windows\system32\Qclmck32.exe
        869⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        870⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        871⤵
        
        PID:776
        
        C:\Windows\SysWOW64\Acqgojmb.exe
        
        C:\Windows\system32\Acqgojmb.exe
        872⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Afockelf.exe
        
        C:\Windows\system32\Afockelf.exe
        873⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\Aimogakj.exe
        
        C:\Windows\system32\Aimogakj.exe
        874⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Afappe32.exe
        
        C:\Windows\system32\Afappe32.exe
        875⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Aagdnn32.exe
        
        C:\Windows\system32\Aagdnn32.exe
        876⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Afcmfe32.exe
        
        C:\Windows\system32\Afcmfe32.exe
        877⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Amnebo32.exe
        
        C:\Windows\system32\Amnebo32.exe
        878⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Affikdfn.exe
        
        C:\Windows\system32\Affikdfn.exe
        879⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Ampaho32.exe
        
        C:\Windows\system32\Ampaho32.exe
        880⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Abmjqe32.exe
        
        C:\Windows\system32\Abmjqe32.exe
        881⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Banjnm32.exe
        
        C:\Windows\system32\Banjnm32.exe
        882⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Bboffejp.exe
        
        C:\Windows\system32\Bboffejp.exe
        883⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Biiobo32.exe
        
        C:\Windows\system32\Biiobo32.exe
        884⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Bapgdm32.exe
        
        C:\Windows\system32\Bapgdm32.exe
        885⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Bbaclegm.exe
        
        C:\Windows\system32\Bbaclegm.exe
        886⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Bmggingc.exe
        
        C:\Windows\system32\Bmggingc.exe
        887⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Bfolacnc.exe
        
        C:\Windows\system32\Bfolacnc.exe
        888⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Bmidnm32.exe
        
        C:\Windows\system32\Bmidnm32.exe
        889⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Baepolni.exe
        
        C:\Windows\system32\Baepolni.exe
        890⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Bdcmkgmm.exe
        
        C:\Windows\system32\Bdcmkgmm.exe
        891⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Bfaigclq.exe
        
        C:\Windows\system32\Bfaigclq.exe
        892⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Bkmeha32.exe
        
        C:\Windows\system32\Bkmeha32.exe
        893⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Bmladm32.exe
        
        C:\Windows\system32\Bmladm32.exe
        894⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Bdeiqgkj.exe
        
        C:\Windows\system32\Bdeiqgkj.exe
        895⤵
        
        PID:380
        
        C:\Windows\SysWOW64\Bgdemb32.exe
        
        C:\Windows\system32\Bgdemb32.exe
        896⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Cmnnimak.exe
        
        C:\Windows\system32\Cmnnimak.exe
        897⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Cpljehpo.exe
        
        C:\Windows\system32\Cpljehpo.exe
        898⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Cdhffg32.exe
        
        C:\Windows\system32\Cdhffg32.exe
        899⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        900⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Cpogkhnl.exe
        
        C:\Windows\system32\Cpogkhnl.exe
        901⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Cdjblf32.exe
        
        C:\Windows\system32\Cdjblf32.exe
        902⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Ckdkhq32.exe
        
        C:\Windows\system32\Ckdkhq32.exe
        903⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Cmbgdl32.exe
        
        C:\Windows\system32\Cmbgdl32.exe
        904⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12328
        
        C:\Windows\SysWOW64\Ccppmc32.exe
        
        C:\Windows\system32\Ccppmc32.exe
        905⤵
        Drops file in System32 directory
        
        PID:12364
        
        C:\Windows\SysWOW64\Cmedjl32.exe
        
        C:\Windows\system32\Cmedjl32.exe
        906⤵
        Drops file in System32 directory
        
        PID:12400
        
        C:\Windows\SysWOW64\Cdolgfbp.exe
        
        C:\Windows\system32\Cdolgfbp.exe
        907⤵
        
        PID:12432
        
        C:\Windows\SysWOW64\Cacmpj32.exe
        
        C:\Windows\system32\Cacmpj32.exe
        908⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\Ccdihbgg.exe
        
        C:\Windows\system32\Ccdihbgg.exe
        909⤵
        
        PID:12524
        
        C:\Windows\SysWOW64\Dinael32.exe
        
        C:\Windows\system32\Dinael32.exe
        910⤵
        
        PID:12560
        
        C:\Windows\SysWOW64\Daeifj32.exe
        
        C:\Windows\system32\Daeifj32.exe
        911⤵
        
        PID:12600
        
        C:\Windows\SysWOW64\Dgbanq32.exe
        
        C:\Windows\system32\Dgbanq32.exe
        912⤵
        
        PID:12648
        
        C:\Windows\SysWOW64\Dnljkk32.exe
        
        C:\Windows\system32\Dnljkk32.exe
        913⤵
        
        PID:12688
        
        C:\Windows\SysWOW64\Dpjfgf32.exe
        
        C:\Windows\system32\Dpjfgf32.exe
        914⤵
        
        PID:12728
        
        C:\Windows\SysWOW64\Dgdncplk.exe
        
        C:\Windows\system32\Dgdncplk.exe
        915⤵
        
        PID:12772
        
        C:\Windows\SysWOW64\Dnngpj32.exe
        
        C:\Windows\system32\Dnngpj32.exe
        916⤵
        Drops file in System32 directory
        
        PID:12816
        
        C:\Windows\SysWOW64\Dggkipii.exe
        
        C:\Windows\system32\Dggkipii.exe
        917⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\Djegekil.exe
        
        C:\Windows\system32\Djegekil.exe
        918⤵
        
        PID:12900
        
        C:\Windows\SysWOW64\Dalofi32.exe
        
        C:\Windows\system32\Dalofi32.exe
        919⤵
        
        PID:12952
        
        C:\Windows\SysWOW64\Dcnlnaom.exe
        
        C:\Windows\system32\Dcnlnaom.exe
        920⤵
        
        PID:12988
        
        C:\Windows\SysWOW64\Dgihop32.exe
        
        C:\Windows\system32\Dgihop32.exe
        921⤵
        
        PID:13036
        
        C:\Windows\SysWOW64\Djgdkk32.exe
        
        C:\Windows\system32\Djgdkk32.exe
        922⤵
        
        PID:13072
        
        C:\Windows\SysWOW64\Daollh32.exe
        
        C:\Windows\system32\Daollh32.exe
        923⤵
        
        PID:13116
        
        C:\Windows\SysWOW64\Dcphdqmj.exe
        
        C:\Windows\system32\Dcphdqmj.exe
        924⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13160
        
        C:\Windows\SysWOW64\Eaaiahei.exe
        
        C:\Windows\system32\Eaaiahei.exe
        925⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:13196
        
        C:\Windows\SysWOW64\Ejlnfjbd.exe
        
        C:\Windows\system32\Ejlnfjbd.exe
        926⤵
        
        PID:13236
        
        C:\Windows\SysWOW64\Epffbd32.exe
        
        C:\Windows\system32\Epffbd32.exe
        927⤵
        
        PID:13272
        
        C:\Windows\SysWOW64\Ecdbop32.exe
        
        C:\Windows\system32\Ecdbop32.exe
        928⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Enjfli32.exe
        
        C:\Windows\system32\Enjfli32.exe
        929⤵
        
        PID:12296
        
        C:\Windows\SysWOW64\Eddnic32.exe
        
        C:\Windows\system32\Eddnic32.exe
        930⤵
        Modifies registry class
        
        PID:11080
        
        C:\Windows\SysWOW64\Ekngemhd.exe
        
        C:\Windows\system32\Ekngemhd.exe
        931⤵
        
        PID:11168
        
        C:\Windows\SysWOW64\Enlcahgh.exe
        
        C:\Windows\system32\Enlcahgh.exe
        932⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Eqkondfl.exe
        
        C:\Windows\system32\Eqkondfl.exe
        933⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Enopghee.exe
        
        C:\Windows\system32\Enopghee.exe
        934⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Fkemfl32.exe
        
        C:\Windows\system32\Fkemfl32.exe
        935⤵
        
        PID:12548
        
        C:\Windows\SysWOW64\Fcpakn32.exe
        
        C:\Windows\system32\Fcpakn32.exe
        936⤵
        
        PID:12588
        
        C:\Windows\SysWOW64\Fjjjgh32.exe
        
        C:\Windows\system32\Fjjjgh32.exe
        937⤵
        
        PID:12644
        
        C:\Windows\SysWOW64\Fqdbdbna.exe
        
        C:\Windows\system32\Fqdbdbna.exe
        938⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\Fgnjqm32.exe
        
        C:\Windows\system32\Fgnjqm32.exe
        939⤵
        
        PID:12700
        
        C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        940⤵
        
        PID:12760
        
        C:\Windows\SysWOW64\Fqfojblo.exe
        
        C:\Windows\system32\Fqfojblo.exe
        941⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Fcekfnkb.exe
        
        C:\Windows\system32\Fcekfnkb.exe
        942⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Fjocbhbo.exe
        
        C:\Windows\system32\Fjocbhbo.exe
        943⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11248
        
        C:\Windows\SysWOW64\Fbfkceca.exe
        
        C:\Windows\system32\Fbfkceca.exe
        944⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\Gddgpqbe.exe
        
        C:\Windows\system32\Gddgpqbe.exe
        945⤵
        
        PID:13016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13016 -s 420
        946⤵
        Program crash
        
        PID:13148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 13016 -ip 13016
1⤵
PID:13064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Accfbokl.exe

Filesize
276KB

MD5
0b88ab8e85f2a3f3cfb253ab4f5c23c8

SHA1
766082cc209797b3fe7095efd78d9c1c27be573b

SHA256
ab23a014fc5e9ffac1e6c8665285312035f117b3d3bdde231b7817ef2f1c7384

SHA512
674ca6364afcef514c43d12c1f0dd5a676908a3ff410d11140d7b6a53f77163955d9b81fa3957dc7ec7e865d162d81c0ef3696af7656e844e4f6eaeab37c1cfa

Download Submit
C:\Windows\SysWOW64\Ajdjin32.exe

Filesize
276KB

MD5
78a7114008ce37d8e7f9c352bdaf11e5

SHA1
5fd0de9cafff6092f344db74071f52cfcac1e10c

SHA256
ad5cad1e0478b47dea7629e1d8297431dbead2b0ecc4d8ea9dca5052ab09dfce

SHA512
9aae7922e383f9ecd2973410ebba0d78132d4e869f2c2cc653551af88de4cec8cbc49c73c28911f27e20943e09fac9e7f68d626a5af2467ede3e107c9314974c

Download Submit
C:\Windows\SysWOW64\Aompak32.exe

Filesize
276KB

MD5
4134d26d7efc84cf47fa0da04978dcd5

SHA1
7c1fc327688004877bbe7c4be308b36b3afcdac8

SHA256
f4fa6fb2e5085f000b49e234ec6fec180d190a4a06ba1ffa07da4c81e0e36088

SHA512
b4e7a2614637d4ef83bd680ea5e9a5344032c41fa9f9dbb66e43c66e2ddaac0b04acf66f9ecf0f3b2bb2bdd99cfa47e71d59029499a90275a6d2dadfc6f271a8

Download Submit
C:\Windows\SysWOW64\Bcfahbpo.exe

Filesize
276KB

MD5
8f66caf18e69c578ff6a45ebea8a74cb

SHA1
f25e110e020895dda4dab81a1c3b19e689f7d9df

SHA256
a0046004dfd4ccb03154dd45f88d3f4bfa7c9a1a4f37c38020e86fd81f58dd04

SHA512
4c6d01f9d65fcaa0407ddb0c166e0c16394b63bc3f7201f0c10c5cf98be721b5677b6205f11e10c619d5fc9823ac5d931a1b5c3e44966ba47edab0ea52a8b78d

Download Submit
C:\Windows\SysWOW64\Ccdihbgg.exe

Filesize
276KB

MD5
35e35b7d5f30bd22f21c17cc2026f5e6

SHA1
1821dd11c59148cd8cfaccf742fe91b407642cfc

SHA256
f0fc431a453a9504f60f3ace394e245913984e77736cb31dcc302c0976acecbb

SHA512
fa864d2833b4415e49507970dfcbbdf3c9a3627d2313a426cca6f939346348e4abeaaeb006315151091c1ec631185f7b332c22dd2b4eb026806d1fef6a295f4d

Download Submit
C:\Windows\SysWOW64\Ccppmc32.exe

Filesize
276KB

MD5
831da0d885acf2621e2801147a8dd5ed

SHA1
fc0f8413f52808a32df2e177e253a58a226d5f47

SHA256
02dbbaced63d2c34d44c43c1943a4ac41d084c666c27062efc32e5a56ccd5986

SHA512
8882651e55ea9e7edea122c89bbfa8d4f0f6b9ef866c1f418c2d7105d66ad7de6046cecf52ed8ddc41e30ad87a42dda5e463eec8d1b23dd17cd020f63f019f81

Download Submit
C:\Windows\SysWOW64\Daconoae.exe

Filesize
276KB

MD5
ba9712a2e8c66455d5541f5444120811

SHA1
618d5ef37b732897be33aa5e2e47b45216567092

SHA256
97fa8ed513a59a1e7e450d6bb4ffa74acba3694f6585cc7514247a000222d096

SHA512
ee8b237970d7933c5e14c607a8ae2a2fefdfc65ecc7fddad412f49a63d4ca03dd26802bd905526ae98542e476689f3166ff45772222f9313d9d5271fd79c2412

Download Submit
C:\Windows\SysWOW64\Dalofi32.exe

Filesize
276KB

MD5
a031b5175346223160fded89513f323d

SHA1
52826c70fb59832f002da63b547bec19e35f06f8

SHA256
79103c8adbc5c43ce60cde1e7f3b0d5b3e6b790980453b673beb5841f36ee718

SHA512
01157aa44455f50ec06d16c0c3ade3a14f7d465de5401208f9657dc725ca69af15da67769c20bde1de12cf0696a5bf60cb66afbcb61043e47dbac8e7867eec49

Download Submit
C:\Windows\SysWOW64\Dfamapjo.exe

Filesize
276KB

MD5
129f1e09867f8e21c8be9447a5bbd931

SHA1
743fc9bef0949d3fd277f447d9e8288619e0f6a3

SHA256
42bdc7cfe6998cff78893e7f656768c978df5c2d101fbfd011e07bd99c213406

SHA512
681ff5ddd6afc4ff776e8cb6a3b8bea9770be205c1f33e95095d72786ad2e6537ff17d2e885f868c9a70fbcb220b7b2a86a9865e549f2789d21383a65f99d8de

Download Submit
C:\Windows\SysWOW64\Dkoggkjo.exe

Filesize
276KB

MD5
418f90e6de40577875df7db7cfb8b7ee

SHA1
27a53ef7d0e1372ede74bead7a9fef9e0db5f68c

SHA256
0d36eba46b2be46ea658981002f4829e889c05495c52f100dcf7aa98e68a7715

SHA512
762c87eed22249fac32ef2a173858e8e1fcc975eb5a74385871da1d721c416b4136d4725455fb1cdae7be5468247fd275f4fe6566c5978ab51fb50bc39f2bcd8

Download Submit
C:\Windows\SysWOW64\Dlieda32.exe

Filesize
276KB

MD5
70e17e70637185f9f46a849071ced2d7

SHA1
657173dff7cb6067c7dd3aab5e5a284ae15915ae

SHA256
72f15f0bd58a3d70ca337e5f2f5e83fc6c2e0b90f4d035bac1c0c8034dbe3beb

SHA512
da173665c0c0813c42c9cceca21bff66087800f69757d583936f5ed6c93e4cde2cb6c04c335014cfce8454b535bd6a68e0c60b3c8ca6e3f01f4ac659a8547444

Download Submit
C:\Windows\SysWOW64\Eaaiahei.exe

Filesize
276KB

MD5
45d0dc5bf29e5e2a2fcb2b608a6b2549

SHA1
7f4bb10d18bac21b3e3cb4ae41c92d196d54bfed

SHA256
7a08c55446c23e74467415dc30b70e28319774087e1c2c8cba0f4aed4a5d1832

SHA512
166b14777f4aee344834ecad87d9bd9be6d896f23bd2f5f077d1860c549b06245bb16c36d8d33c43ac457128172ce7973ab62e6ac31ee185e5de42a27f37793e

Download Submit
C:\Windows\SysWOW64\Echknh32.exe

Filesize
276KB

MD5
1dd5183d6c9c8273effe6f1da3bd1f20

SHA1
325bebd4be7c12209bb2c87d2bb9580a70a20da0

SHA256
b378835f11548be5146b922180b7312ac4ac7bfa8a4ab2f35a373ca85fca262b

SHA512
050e20499168403298b2b3a6ff1d9b319323bcbc7b346273a1890fddf0881e264a65f16a8e9c882247ca7dab4c9489b296ad986773e7cb44345899c926fa4ee2

Download Submit
C:\Windows\SysWOW64\Eecphp32.exe

Filesize
276KB

MD5
4d97d7e0d4a5cd2083c390008abeb29b

SHA1
eaa1f551b0262355f65563338a6a74e8f6740aa6

SHA256
9ff8591dc70fe622fd87bd80f22a9aa1ed129824632dca389254f6ac5407b924

SHA512
80b75b16be0e4b056ff17f066897034b1a3df57149a6748b344e08349085f87f1fed26338268cc554d533e41fd2831a4768b377f0f859a582fa104a061b84a28

Download Submit
C:\Windows\SysWOW64\Eefaomcg.exe

Filesize
276KB

MD5
32ab92563f427dfb3c9aa215fad43b6a

SHA1
b5019ca590fb79eeea477826842d7232ab9a37bf

SHA256
7c0a929b38034d94603bb4c459cf70e3a3f14b2489cbc0682e9186e2ab1f307f

SHA512
bc6dd626429857380889744ef180a82f2265314de2c84f026fb586e071a31ca16c21cdb324e0398b69b4b3626cf5e5c04cb816097ebbd5ad38584f299717368e

Download Submit
C:\Windows\SysWOW64\Eemnjbaj.exe

Filesize
276KB

MD5
abdf0923e1d33148e983f87c02d28a1f

SHA1
899f6c71496bcc01be101d39f3c4a285d7c3898e

SHA256
afbb8e4e30b8387f2a70592667c869410564a510787c955a9b181919d8e0785b

SHA512
0fd1a27065baad3f32b59e6394fcdcc27f0688760cd4f3e63c48ae35f759934145cf7046e9703925296a3e52793e3b647536ed42002f311ea917ee5b95ebbfac

Download Submit
C:\Windows\SysWOW64\Ehgqln32.exe

Filesize
276KB

MD5
679b0921f7666d83fa981681e4f26b3f

SHA1
15041e8404fee3cdc943559f78cb7f7dd7141152

SHA256
b244bf3cc5fdf065202b160ad069fa9818edfebe991e66734fc572dc30340ab8

SHA512
cfb7d8ee4fa1b2520df47d35802ebda571fc882cbe4ba7ab0457b0ca86e624f779b335c3da3cdccb527daadb8cfef01a685e4852262cf1a4e62fb64663fbdfec

Download Submit
C:\Windows\SysWOW64\Ehiffh32.exe

Filesize
276KB

MD5
d2b868f12b8f07571b6101d4c20c756c

SHA1
7d92f3fc6912d45dae154758c6dde784a1c63104

SHA256
6e9186ee495cdc6d3b66c8d3e2bb68689cc367fd0c9e7221371597f04806ffc6

SHA512
727d8fefeca05564d111947df4cad2f0a84069e6d80253bad9f848e9b71906f768e1d00680cd68317f779c06fa6224695389e5adab5256100af90d2b85bbbe08

Download Submit
C:\Windows\SysWOW64\Ehljfnpn.exe

Filesize
276KB

MD5
a1531b2f9f6252d79d46ebd711381e17

SHA1
2045d145be5e5835fe3c152adb48ce1e5fff9b84

SHA256
7ac28427fe416bdde9f105db783ad1fb008185e11e3b693cbf20b54fda5129ff

SHA512
c937a580b6aa0ff9fa2956814033d71c221dd0e43968b5e403c150ddf687fc3bc0dc2630a9c9848c5ce1774909941795ac922428926a73d68e40045a15aa9438

Download Submit
C:\Windows\SysWOW64\Ehnglm32.exe

Filesize
276KB

MD5
5925bf4f0527894c7cd93e57f6a86b1a

SHA1
01701619f751a64a4aa1e55c59cceb38dac76325

SHA256
95fef9414e1c8552bb56678922ae55b3ceb17edbd2694f7c70eb41e32b6902b9

SHA512
196ceec3e133a784674a23c4c81879b24d09a9c3df0ba202cd2355a7871ce1e5700f50b5ed6cf35a23e2d2ff5dfc236d69b59819b3fee6c89367df2b6341779f

Download Submit
C:\Windows\SysWOW64\Eleiam32.exe

Filesize
276KB

MD5
090538716c581d51db5b7eab123851b0

SHA1
9d826264889367a62507cbe067c5d8bad73e3ca6

SHA256
68200f744476e5c03c12b3d8daf1382f34cd2e219232345a77f8f20c0c7a4ffa

SHA512
34dfdfd6c0305984d7b947a0a622b1f8c43703a355d9fbd54d2812f4da44ecbd945d56f0c11567cbe05f85b251f77e85dae03146706ef750d6e27a16c24091cf

Download Submit
C:\Windows\SysWOW64\Elppfmoo.exe

Filesize
276KB

MD5
322f3395e5bcde7e6d06153e492651e9

SHA1
751db2d6122b559f62d34f22754cce82284b4178

SHA256
47f065f6d6e958c7a8dc4b71749a628627b1b6593f58635e88459ca381f0b75a

SHA512
2dd573b3462f0198287e687f51dec14650b0c44f9cab725bfd0e67ed4b2f844f6b32e4e746ddcfeacb4eccc3dd32c3de46e5ee67ee6e55966fe9035da9904309

Download Submit
C:\Windows\SysWOW64\Fdegandp.exe

Filesize
193KB

MD5
17cdd32b8e8b9aa3961ac4d895757059

SHA1
211545bf5d49a57bcc87c1e601955f08904f1b51

SHA256
a277aab4c05400e6f7e599e9f8a7d8d53efd70e6645164881dde76bcf4f58889

SHA512
54edd07979d2a0d77036dfc21542b77be4d8c8deb70c9a738549ee62dcd336961440e6f2dc80f369e25ffe19592ce1ef3c5971ee38dde6f3400fc1b0ff7013dc

Download Submit
C:\Windows\SysWOW64\Fdegandp.exe

Filesize
128KB

MD5
5540a2c367a5acc51f00f7d6d1ce10ca

SHA1
9cea342f99e44368ce28c76689ddfeaa841d3f71

SHA256
cbfa4e06e5bb7959ad0a9b5b569dc6d12245735eeeb04bddd5b1e4b92259a498

SHA512
c2c6d1bcaab6051b5f4ac59bb161a0924253f2ba66f5456ff4372e917775ac0809b3f85302fc06bb3018fbf23922976898c1e8d5359a94de6f67eabee30715b6

Download Submit
C:\Windows\SysWOW64\Fhemmlhc.exe

Filesize
276KB

MD5
ff3599b421f9fd06a3c4e8743d2dffd1

SHA1
b24101ca689e92f174f8e4ef7b733b2583041607

SHA256
cfa2e4bc08188cef8abb7000191f463393710db72d9261ff7429f3711cabb164

SHA512
9e1e8200b5661da963b6a6ba5529508585417d8b02071869e2aa53c61432fc2886a5404dbdf95ae83f3a1428d66d41cf48c95704a6f3fdbd09c7f25361f21201

Download Submit
C:\Windows\SysWOW64\Fkffog32.exe

Filesize
276KB

MD5
f750088f89399bf08aea34530ed2001b

SHA1
286d6d6875aa3e5fffcb21f572dff34aa26d986d

SHA256
06c7d0cb0771b1bb8249971677f5ae596a20e38ba4f8cd9fc824636288807500

SHA512
b6cc285a6854e1e0bcff2c429ed2d5556a9824cb2f09fdb84181e5e2c29d1b745753a7180b630543d399e44189d759e119ee7db6d1359b3eb9bc89f8953481b9

Download Submit
C:\Windows\SysWOW64\Fmqgpgoc.exe

Filesize
192KB

MD5
fa2c74dc253e5497c545ec963e72ee65

SHA1
b66b9cb1abb9b4db2c9ea4f3b06dea3f1f262a7c

SHA256
a641f74d6553d139910e466b23768700f4c55fab3755ce1a6b7b53158bec2247

SHA512
c7474366576f743a01d5fa42442b5c6513cadb67edd4c521fb835c835d131d50ef300ecacf34b726439d5ab19d97ad82a5b2246f899dea93392619ff3cc9b397

Download Submit
C:\Windows\SysWOW64\Fojlngce.exe

Filesize
276KB

MD5
b4dacb116cc8e3624766cf628ddaae25

SHA1
5b3e3b4649e94a1efa8ccbdd2bd2a50366ed303d

SHA256
1a0ba87a72ca1c60f11cde829ff3c2b67bb2cebb1b550f6760a262d8e29986a4

SHA512
22e93ddce22a1855cb254d05460793b0f9b6c8bc9ff043bb5b9a49f3104ed4815ff4f5f333f43c71fc77ad5a3283e5e974462cf3166c288d58632b5d707bf60c

Download Submit
C:\Windows\SysWOW64\Gafmaj32.exe

Filesize
276KB

MD5
f61584ff71c6ecc86d4f9ef09e07ddb3

SHA1
df59ea98772c0f87d087ba3dd4bd53fb5fac82bd

SHA256
a8544cd4c29ce113f4900213dcdb556b3d60b4ac4dc0ca97efd8474f73f4d91d

SHA512
ea723d4fee009170b67ac2203e1685e57e4c4afc8264036d92ecf2a3003fca07ae4c272d3db254a80fea6d84b785a765a4906eebc5afd0c3f89bc45eaf85b90f

Download Submit
C:\Windows\SysWOW64\Gblngpbd.exe

Filesize
276KB

MD5
a776ddeacd59cef159ab14b1cb2ab58f

SHA1
5a18ac23f8a67f5f8fc9b168a6cfd5620d94fa96

SHA256
5ba7b526f5ccc708d457e57b18502b4004eedb320efa25c3e7bd0c241f539516

SHA512
7f7f1100bb9df250b5c901def57a2e4210d2b5aa82bf984d9c2342044014d698a3cfeb0f70f412810fd0bb7eb1ac873a0c4e90ad4ee69fd797d142b81ff84aee

Download Submit
C:\Windows\SysWOW64\Gkaejf32.exe

Filesize
276KB

MD5
8c7175efe18924220394a948fcff25fc

SHA1
1fa584ae35f8b9c0c70293bc67bd050cb943b540

SHA256
03381cef6f499ea76518c4244612ffc6d89be9a3a441f2e0473ee61104282c78

SHA512
a125f30b9c61da2f04c5f495bb24a82e7cb381dc77913620d409541276ae8c5fd67a50b8789fe15b95e3d516769242b6e3ef21fbbca5ffc851a12d4431e411ec

Download Submit
C:\Windows\SysWOW64\Gkkojgao.exe

Filesize
276KB

MD5
143651ff5ee95a2b7024429329c4cc15

SHA1
689b2fd451184e8a111c26da03872d5cce94e695

SHA256
d8246016b8b4c6879a5beb953c9c874ce1926b647557d8c9709663af8820c2db

SHA512
c028111f8ac3e8d83483c4f0266bd62603045b5e0d0793a51fc2b7d39f1699920d9ebe9da941ce26e7c9b15f0f6ad7b0abc2052fe164724e6c557b1084a10310

Download Submit
C:\Windows\SysWOW64\Gnhdkl32.exe

Filesize
276KB

MD5
82aa0524d5428fde68304e5ce19f581c

SHA1
66fc728e4db426078586f1a9d2e71ec56164e7b0

SHA256
80a6af3bd5b0fd25ae35f768972235f9d199160fb957fe87988acee75543d209

SHA512
09bbc62e546d8ec4bb6508f991f812583d5d9309dbbfccef0bd6f962a2f31f670eeac5611654d9bb01d79fc8179704e062f0ee5120d8f9be56e6cf8d36e03ce8

Download Submit
C:\Windows\SysWOW64\Gododflk.exe

Filesize
276KB

MD5
ae254445a80c757378afa316c5fee346

SHA1
ae403c83b385ed41119cb0dfc78177ddc9b5ccb8

SHA256
ec96b940a4efe0224d868214b7325f7d6163222e2a87c89a5459de26c90018dc

SHA512
0cc6176706c53f1319bf0c2f349114758febbf18ce80eccd1348af58da775089b02d7fb37ec9388953b8f3f1c1ed91b08d49d49cab6e23d031dfffd70e00bf2f

Download Submit
C:\Windows\SysWOW64\Gohhpe32.exe

Filesize
276KB

MD5
15d4a2def30e9534a4ad2bba5cc8bcc7

SHA1
ad6998c24da056c5313130d092401af173ccf3f4

SHA256
60f137bdb25d424d32cbbda5f8c31ce46114a40f4180cb6be663b2b4d27fb556

SHA512
d8bdf5968251f5f91ec72d1af3dfc337c7b3a725baca35fe68ca7112d0740a7153284eb341c852cc7980d1a716a11a2bb61fe623d7d95b063ae19fae4a322313

Download Submit
C:\Windows\SysWOW64\Hacbhb32.exe

Filesize
276KB

MD5
6d680ed98771c22f21baf82a7c8f3ef2

SHA1
8a703b461356f2a59b890399141a28de7e61da7c

SHA256
df0e066ebc3e755398cfa94d2d73fb7d29b346953c33113d455bb3f09f82f7a2

SHA512
14ef586918b7502c2797e59b5835af4a6fba7277464676ca7364093131a6fbb06cfc564cf06723b047817e22db4c56f944836a79db1111756a708788f3f508b4

Download Submit
C:\Windows\SysWOW64\Hcbpab32.exe

Filesize
276KB

MD5
0232bfffaec7797222f9e6c2ddcd7080

SHA1
1bc522a1d391aee247f8de02dabd84754e78875a

SHA256
ebb6d28a66d334e195e3e3bf03de07716cee1d383b100096983ca53f4720f9d9

SHA512
3166ab381556a20fea79cfd5495a9f759097e1ec9ac6d25e1eb5f70d368803346e993902bcce74607981935546d620d767ff6c25166bfd09d3e506fd900d1751

Download Submit
C:\Windows\SysWOW64\Hckjacjg.exe

Filesize
276KB

MD5
969fb1a7c4c59819c5f8f38a6e218595

SHA1
6ca605f4844dc34fb1a9a7800fbee6b2082f70a9

SHA256
f6608eb1b2d363e6509d2c6f559b467f00fdb55daff204ee6c1fd35ea4c29bc1

SHA512
aec23cb63282139dc3a3d72185c2e0c8e0145842dac7375ee3f776f8054a2fd2a9ab8a09ace4cf8760e58e2e186af7cdf9e9d48c402b1712d650b846e41b93aa

Download Submit
C:\Windows\SysWOW64\Hfcicmqp.exe

Filesize
276KB

MD5
7ff52bbc64a50e7776edee8dcbe21245

SHA1
6c50648a68ddb541a01425146c22e4b452a0d55b

SHA256
1fc7fb909dda67247b9e348dd88b01e863da01c6e6dcbabb5fddc0117a79c7aa

SHA512
5501a8fa79db726fed04f899105d5c639e9613ae2d8b23160c54f00eb661edba1f0b77d17730307fdf553dc5e1ce34381d9f929b90264b601c06f14294922280

Download Submit
C:\Windows\SysWOW64\Hflcbngh.exe

Filesize
276KB

MD5
c2aea52ad28c29ebb2d81ffdd5eaa0b7

SHA1
d74d23239a34193bd4048b8af6f7701b29d2de28

SHA256
d9cdc939829b7647d408eb4c10c611a8b2bc783b96ee35efd9a2b97ed4c87c20

SHA512
7321d4cbec9c376f4cad5eab3bbcc917c1a04cdb038623815fbbd86add0ea87523549f05a9418c552cd71e662da431e0d1dfe67a3822e93cafef5bed581777aa

Download Submit
C:\Windows\SysWOW64\Hihbijhn.exe

Filesize
276KB

MD5
4875bbc8a05bf4db5cc60b49ec5571aa

SHA1
8f4d397e16f60e70093f4fd87b2fb1faad289c02

SHA256
a7d80e146588570ed11af3ea3f5e4a7e49ffc04083c55dfdb52909a7e9668aec

SHA512
938511169e30daf16f9508024a7ef1b3fff43f8bb71d2542cf294b5b5492cb445e11cf142be2ca22d311dca6982d161aac381babe398aeeeaab869895df37797

Download Submit
C:\Windows\SysWOW64\Hkikkeeo.exe

Filesize
276KB

MD5
1ab103715cab5366dd9631d36929c9ce

SHA1
ac4353a86bafed4509e40e80d6f6ef2cfe484833

SHA256
edc4ff830981cf0a1b2e3d63c24985d44a4f668b30806c1b7502885944586850

SHA512
538d3b4ac351e20cf1d34be55903cb409e2bd284248756fe7cbb80b2d85c029bb756eb57d865d86a9d28b3266d1b47d76bba4f40dbf5790487fb4602a9108742

Download Submit
C:\Windows\SysWOW64\Hkkhqd32.exe

Filesize
276KB

MD5
b5ae0b5c867a41f88e74425b7d5a4597

SHA1
bc568e15fd222ad673d02c844500c003468f1ec5

SHA256
584887b48655d5b1df3470f613924636a4071c762f79825d5e1bb157f5867752

SHA512
163b527b503d83f98550ab14ab000331d8f80414661732cdf702bc53571176f8610e3d08b880331ea69dbf78de466630d66c97dae85326271a55a7caa7b89a26

Download Submit
C:\Windows\SysWOW64\Hkmefd32.exe

Filesize
276KB

MD5
e022c221147477135520724a3b5ef193

SHA1
6d78630430c3cba8f7bcec4af8afbd66e2480377

SHA256
4e4663f2d44b351385b1f8c73d6897b7a7f579dbaa4a9d0159e3ba8cf0863b50

SHA512
5f342c7d748630e7871008518abeac400504064a600878a4f2c02526e2e41010bd68a583b8a88a84593ad76c5a551806dc0203509c000d1c5e21323d0ec6ffbd

Download Submit
C:\Windows\SysWOW64\Hlkfbocp.exe

Filesize
276KB

MD5
4cae158641ff963cfb81199c9cd59ff0

SHA1
a8e0ff0b34c507562442b2141c0cc309441ae822

SHA256
e06d9fc9dc98fa2d61ef4e7509e629b8304cd87d34a0774e0b85cbd144644e6b

SHA512
f36d09413a238741e1b58186c8f08a5b5a3c0349dd12e253dc2604a158575cfcad68f03d1b0b2c36fbcb13f649e5f2caef01ff70d9a72f61ee6d1437da76e6a8

Download Submit
C:\Windows\SysWOW64\Hpjmnjqn.exe

Filesize
276KB

MD5
4d3d44cc9c4fe91f0f8e063a6d02e9bd

SHA1
1b45edb6c11760b4b487efed6b06e582770d1b80

SHA256
233e4c0c1faadd9f44971b835e06ce35c7c36751913dc14c5429b36e3688d5b9

SHA512
7edeac52ad25c5e6f7f793ea0c81ac1d8b50c0a9a9ea833e4b8dcee62ac534649adaa71b8df188d782fd656c5d16d955b187b1028fc96e954241d6831a8c3fe2

Download Submit
C:\Windows\SysWOW64\Ibjjhn32.exe

Filesize
276KB

MD5
b802415a3faab7cab28684437dba866a

SHA1
29cf67752cb23a81197b6eb88fd669b68266dc63

SHA256
64a38dea3a3a1cda46114a989b3cf4900cdf8e06656996d36ffcb993ab18b389

SHA512
a8681045fa43eff7ab8df4fe762578a2009345de8443f1b18af666312ca226f0ec6c8457a07e62767a02b1c8b549d948b013ce408dd069708c416a3b6c22a863

Download Submit
C:\Windows\SysWOW64\Icifbang.exe

Filesize
276KB

MD5
41b955498da52a607e09e5cad88eb66c

SHA1
9bd6ded664d1eb4f1518de880e0fe3bf5a09bd66

SHA256
a756f001829bfc93fcbfbc53278dd44096e1a70aae7a0da732b1aa709b9d7e86

SHA512
df65881e4e92dc2bffebfc33dbe43d394e031400746b9911eaa1f9b5066c4fbc1b7003dcbf16efa252f6812523224c78ae49694f35c3911093ecc78f56791daf

Download Submit
C:\Windows\SysWOW64\Icifbang.exe

Filesize
256KB

MD5
df27efd18c9191d54bb4dc2534fdd958

SHA1
bb66fa3c860eb47817e8afbafa7c9486e943c21a

SHA256
01be5fdbad0b8ea19e2078cfee9b73fdfb6fb399e57180a53a24d7b0536a5c6d

SHA512
cc26f7eaa6eebd342690a5563b4ff53c4c032cfb488c0c5fb883e234d60b290c7f87e542d5ce6ec06b65b2cc5d47771f8b231d4a51631397ed5f411a5bc72d67

Download Submit
C:\Windows\SysWOW64\Iejcji32.exe

Filesize
276KB

MD5
88a59628a5a244ad25a8eeeba1d515b1

SHA1
667cd590b152e413ba6cfa20d13115631cc1bcfc

SHA256
9274d7871cc0733a331ee25967f7be32cbea64bf77e5aced63dfec1c8f4e7c4a

SHA512
18aa66f509f9a2818a962c1257554ae6a62837c8b192b8f82161dea0f9adcad6b4928a087f713af1352fec6bf99a3a1bf699154b3e83d5232315d0e68a476eee

Download Submit
C:\Windows\SysWOW64\Ifllil32.exe

Filesize
276KB

MD5
e261b8c446418cbb8da302374ee32ee6

SHA1
9c52189184b03760754a97c118eeda6ab028eabd

SHA256
3e6eef22a6fc868b35fa42b5818194661efdd6823a57245fc9b817722bf2fae3

SHA512
f56369799498d3dc4929b2aa19bb9ebbe10229d960de360347c2211797d22cfad88ddac479d64bb69f10d9679b25a364cb845f44c0e3e349e578f4896e4c56a3

Download Submit
C:\Windows\SysWOW64\Iggaah32.exe

Filesize
276KB

MD5
35dda1291bdf92817dc9f58f38eb51a8

SHA1
eef7ea142f1ef2d8284f082ceeedc22e7ad5388f

SHA256
d4261f45c958d7afd04bb0d69b0196bef5ce94c6123f6fc487f7db12048c9f83

SHA512
d9fc87f5177e5a67feafa81c825f41b502d7e2074009709e326af69dae60341a9cfc74d57ffa381ca063ad10244ba03d22abf80f4c493beab4669cbf46f78463

Download Submit
C:\Windows\SysWOW64\Ihgnkkbd.exe

Filesize
276KB

MD5
e1a8f44cafc69e0c3ab77562fa903e21

SHA1
e17a4b8ab0d72a086a6f45598f0f4d6e8d2606e1

SHA256
e87d0ed64280df7496aa26ce96cda7ecc4684b73905199a7b925f5089aa81e66

SHA512
ed6b019f181e20d1e12f9894868e265b25b15541883a6991cc5d2d5c3b2e3b246615bf5cbce6ddc44fa4115a30745c2fb96a3016422e637fb2474bbd6830970a

Download Submit
C:\Windows\SysWOW64\Iicbehnq.exe

Filesize
276KB

MD5
30d83394beacc2c1b84f67689af05c0c

SHA1
cac4c9e83f5d0633892a37adfe8800ff1e8d59e7

SHA256
e23c5096c05809dd162076ef760014b49fcb9a10808874d6fc7d5befa3363a59

SHA512
a9870dcb1978d60a7eee849b59f3f5f0059c14383330ba9758d47b051a36a670ebed652093605c9e915a209cc2e62d1cf89f546158c03650811d334af3b9df62

Download Submit
C:\Windows\SysWOW64\Iickkbje.exe

Filesize
276KB

MD5
99f8161148c1f1d180b4ff469262c620

SHA1
f7396e6f4597939821c16215de0fd804544bb28a

SHA256
f522cdf72eabd596dcb733550b06f793539be646cf8cfd17ddd3c92ab220374b

SHA512
86fa3bd018e6ce99654095080c06a9d9f4af0c2c1093c958da13ee6584eaa4540ff38ec50ea4e8628fa65256699d6dff24a36332720e98bea4d289e7144c2558

Download Submit
C:\Windows\SysWOW64\Imoneg32.exe

Filesize
276KB

MD5
44d8486efe557f0ae2f8c4c791ddf0e7

SHA1
7559ee606b064b1401ac15b2f47518c6ee3f598f

SHA256
f6ed221a356cca0e2bf88b74abc74cd3a4d73e5ca69d423d6eca5d826992a113

SHA512
7d7d231dac1279e7e39bf1fe67aaf09346b19ea1f3eb4a390845fc598d3659eab1d47692035faff0654c1acbb8484858010f284e5d4700b7de5b9278232f3085

Download Submit
C:\Windows\SysWOW64\Ipknlb32.exe

Filesize
276KB

MD5
c1cabbed01b5777f4eb421e6aa263304

SHA1
1f8c61a96532cec30dcab2742421a720e847df2f

SHA256
bb9ab015507a52b573935bda65cf8dea1535847d650d20b83719b3319c3a5338

SHA512
ee2d34f9617c02b8d739d413714a64bd47a5566745c463ee985a4d9ddc35ac804914a655ecc9d66cafbc64de66a0f864b5ccd283f65cb3f4b8a2cf6e3fff0e52

Download Submit
C:\Windows\SysWOW64\Jjjpnlbd.exe

Filesize
276KB

MD5
13ae7e7498cbc58c93d64d94b209c873

SHA1
5ac4646ebe8e45b8e410b951886e1fca39598b54

SHA256
88325bcfae0080041d937241a723011badbc7785ca143ff1a35b9ebef953031e

SHA512
2cece928082b4c938b3447c7691828d05d48f207797decfe9f8ee756c7d34e913a81b007bcdee2a62e28fa4435df8d76c54a4ab55c54001eb2f2279930b0e401

Download Submit
C:\Windows\SysWOW64\Jknfcofa.exe

Filesize
276KB

MD5
4bb1e6cf259c27da335521c869d31316

SHA1
4ed8e4312bdaea8163998fbce07a774fbd843a7b

SHA256
25d0398f61b807d5788f9ac77569101142961166b21e85051bdfeadc267b349e

SHA512
5cdd39b58223e3fe57ec111f7b924eb4da73a26de56e42bfa638f8c8c2e26e2fc7ca0f021abe89f78917e837a3247e32e70acea22b72390eab413acfe05fe5e2

Download Submit
C:\Windows\SysWOW64\Jphkkpbp.exe

Filesize
276KB

MD5
a5759beb9bb586462bce8dc7913dcf99

SHA1
8137aa951b43c02ac0cc699498abb69e00d41808

SHA256
7ba942967dc89309138da0a3972337c58015440dbf12678e46ac39abf44e0b60

SHA512
cb469d3316ed2c8ea7dbce7a26ec8d4c4c440d564eb74c174994f9065e4b9d20bfe72710d42dc73b890329fec39adc76afe31d0d06b33f30184a9c052e7f6b9f

Download Submit
C:\Windows\SysWOW64\Kjffdalb.exe

Filesize
276KB

MD5
da54d34745ca15d9b84f93ae9f907f86

SHA1
c3892e181a1b39fffc76407fe268bb57965de498

SHA256
85ae09fa5b9f3565ff429b8d0be59d42753ab2c778c6b718ebd072557e6c3832

SHA512
450371c49a386512c5ac718c7d2babb49b9b7301ca68afa7c409bfa2bd23cde44bd7372256f62455ce24f334e9cffe7b102ab6de0eb6e90bffcb64d87565df58

Download Submit
C:\Windows\SysWOW64\Lankbigo.exe

Filesize
276KB

MD5
7238b52f3a8dbd3ed0839ed07965ac4f

SHA1
4151a0f6e112a75fca30133c3ed46248bc2c17ff

SHA256
62ab7c473d9317e91fc02f03be95e7888c2f843604c5ef13ba9317c6a78abd88

SHA512
d332c68740a9bf6f2d89f78ee8e99a88fb38835a1e62c4441b6e741cf7096a8e78fd89481172efa1a4b26859d002276e00e544857c37a31a9817d23a6a0e9f06

Download Submit
C:\Windows\SysWOW64\Lehaho32.exe

Filesize
276KB

MD5
94c8c2c83dcd599e3ffd1a1e2cc36b46

SHA1
f0ce2055d714020224106b9a49502700446d2e8d

SHA256
aa0dd7ef4e23caa8771582e9c4434ced314f9993d182eed683fae04a73a66015

SHA512
ed35793eec095fe1175d924cb3ec5b45c21ab17f225f49ae4ba1794a38884a6bb0d5035b75d69b50c7eb4e0083bfc2eb315279da10f097afe28d57242b60f227

Download Submit
C:\Windows\SysWOW64\Lgqfdnah.exe

Filesize
276KB

MD5
5e828c632a07b963057499ed3d60c543

SHA1
08c3c25e5fcf2c1829ac576ee17ba5e2ce7bc85c

SHA256
30c0cbef71c2fe78f4782be8ac82eab28ebdde7931a848c14a95f2a6d9ec18cf

SHA512
8e30cd5589a6b28c2eaeab24d806f45571e7d4618afd91a658b4f36d9a74f9775c7f801cb972d1265e85093a500c579ec0e22b6668d708d08fa5294d9c1e8599

Download Submit
C:\Windows\SysWOW64\Lmbhgd32.exe

Filesize
276KB

MD5
1f637a26451ba9f6f2af793b2d189d8f

SHA1
b8b1b95508acef384c13aba3363f9ebfd1f76f0a

SHA256
9ecea17728f32ef9bea16bf3b249659ff1eba9c03c7aa3c15aecd315d89c1267

SHA512
e02fe8931b95982d6d9fc5909534e7e656d3ba14ab6d3e2d4b6251670c977d91edc0229a3dd5b03a2d0c6bf8e02f0bc9c55df2868d1d88c3c2e0d2193bc741fe

Download Submit
C:\Windows\SysWOW64\Lndagg32.exe

Filesize
276KB

MD5
3684723accbf8eb264e773b77c92a262

SHA1
15462e037e57502748bbc608c868ffefde541925

SHA256
58acce41773441e0d36d4575c9f006b359469a992fde06737da315e7fea839e1

SHA512
905af0dcd241a70f13af917ab09de17253c3e0614e1cb55bf373894138d5f0e9d1de6bb9e22920457be54b15973f164515f7e8b2911650c1ab94be25eb4a4a4b

Download Submit
C:\Windows\SysWOW64\Lpepbgbd.exe

Filesize
276KB

MD5
7f56d90475bf35bc7c83a4922d490f2c

SHA1
9fe717cfa6d1a2bd6cb6a70e44fbc93d8ad49149

SHA256
ec93605c4b6f80335e583ac378719a7fac02855e165000d92b6c36c362211f95

SHA512
267b4deb3620d670897ace9c4d794dae9818d69edce66f086fefbe5bbab6dd01041f9b211dbde59750f5a50cf70d93134c1bdc7baac561a3d4c135a14eac317b

Download Submit
C:\Windows\SysWOW64\Neafjdkn.exe

Filesize
192KB

MD5
8b634d9d4d69d019ad3513108db7b3d9

SHA1
901b7f5f91127606ebfa33b10407ae81747a0b82

SHA256
78a32955bb0a085dca4f92915cd803da326ffdfcf1b4a755b8a10eb3242c642f

SHA512
2b6896fa937a1c934f73030e4dfa565592e2c707dfaf57021719f2fa4ff977bdef48edc40965c8f791517c1aad0626780cd33b42d10510359caed65544976e17

Download Submit
C:\Windows\SysWOW64\Nlmbpgdl.dll

Filesize
7KB

MD5
8fe5405506d018711a47e9de85a16fc5

SHA1
68f270b36bbd531daadcf19675c6bb4def9b90c0

SHA256
69756c9aa6c7bae08071dab4251a3a73f2a6b6c61e1063b6b2ef5eae8f9923af

SHA512
49028d879535d1b188135acc7d43a9cd10d7695990522f0cbd2579346332dc6ccd098168ff1f215a344533bac86820237a8d6b6c4817c137ec120ad45d36e450

Download Submit
C:\Windows\SysWOW64\Ocdjpmac.exe

Filesize
276KB

MD5
6f3345321d68808dfd705739a410da1c

SHA1
40112f838cd907edc4a8b26dbe9ff90481947f94

SHA256
1171d149e538c825d7d7b06e3b7d7480d969ed54d3f8d876b55d9411b8c62ac5

SHA512
d9761969c5bcec07508576d7430c0da5d6cb0b49f7a1c14d859aefbd8c85cb47e7fe5671bd67c0ba1d5256de6c85ab0a7cc03766aba2d7e27dd32e2ec8fd0ef8

Download Submit
C:\Windows\SysWOW64\Olfobjbg.exe

Filesize
276KB

MD5
49b466a828befeeec281a27ccbf41d10

SHA1
c4c6797a053d4f77715507d5bddc6aa572e3dccb

SHA256
2a0a01431ed2b3f2fd9e357adbc38b08792d4c15a6ecc1944c203dbd98d22692

SHA512
25781cc008feb372cc340be8944fedf6defddb02c5dffbcd79717d0e63c6a79aea2b765054b9687edffab7f863b011166e7a9104fd6abc3bf86b533b4df72064

Download Submit
C:\Windows\SysWOW64\Opadhb32.exe

Filesize
276KB

MD5
38649e4abc569fd3f80c5d991b275579

SHA1
24d19969d75734016bddcde0581c028d478826a7

SHA256
23b42e4cab0246c604e53ce413f4b13ec73a6932787087c6d0f12718561e95f0

SHA512
d2d45a67790c54160b7fa89f0765ea4b8b4bd1b9d4544c5017609541742b242fcd18b9135a35d4809bd44d0733b7aba0367f5bc366a9f85f402747a8f4ccd0f4

Download Submit
C:\Windows\SysWOW64\Pggbkagp.exe

Filesize
276KB

MD5
57df98306d5cef31b4e052fd023d4f03

SHA1
0a3b628353f4578d86d5909f366254810bad2e1d

SHA256
44cb51e0f91fe6e6c85e647796d51c81dc5c1cd6dfa6ea33f70730e6da1be893

SHA512
bd3c70091b74df9b6bbe57b41bc84c9e82134da6a18b86a11d005525f3cebb895ddf7a6bb157fbda7ca87b2d939de060008476b45ca8e1ce5c626f2689207376

Download Submit
C:\Windows\SysWOW64\Phlacbfm.exe

Filesize
276KB

MD5
2d2bd65a8c11fd57fcef353ed52ed22e

SHA1
c24c4ab115b0c5ee882bda5033c90fb6822c85a5

SHA256
3034e7ebdb1e74de2d719cd3263188c482585f7d4915bb66f2d22e9dd8669cae

SHA512
27907ae3c6f2f0aed81d800a20ff293725dfaa2e763e3ec537c4240a59ef9af3f12c13c339db295d126ce84c22750fae8f43596613386e47286acb813a217c79

Download Submit
C:\Windows\SysWOW64\Qebhhp32.exe

Filesize
276KB

MD5
8f75ba818eec8256486f5832b91c86ea

SHA1
29f7033d849a7b245120b92af41ceb28d0219ea4

SHA256
3aec6f25c915af013bab999a2168c5af5d8833c378bc3fe8da362e55804fa019

SHA512
ba4a55c1d4a09fb6965b85f70a5c82deb80b05d16af88d3addb0ead2666d90f8f8cc9cf81268ffaf5789fe8f669f4c4549dba62c9bf61d5f71701d7f19feab4e

Download Submit
memory/556-205-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/756-196-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/840-323-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1020-354-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1020-292-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1152-15-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1152-98-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1272-290-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1492-188-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1520-348-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1556-253-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1584-336-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1596-164-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1644-142-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1644-56-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1660-316-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1668-310-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1744-302-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1832-121-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/1832-40-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2144-125-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2144-276-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2244-79-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2244-0-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2332-308-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2480-342-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2508-246-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2696-52-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2752-122-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2788-361-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2852-334-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2856-157-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2856-64-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2892-250-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3048-7-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3048-93-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3116-134-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3116-289-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3228-99-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3228-200-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3480-173-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3704-155-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3884-168-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3884-81-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3888-94-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3924-107-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3924-23-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3976-252-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4104-31-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4104-115-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4212-256-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4328-207-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4384-154-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4404-258-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4404-322-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4464-254-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4540-266-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4540-329-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4776-359-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4804-371-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4816-76-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4904-282-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/4984-112-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/5020-284-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads