57000dd18788f5a9a3ab78186489da3ff2bff173ed1413a0bc1731eef2f881e3

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

57000dd18788f5a9a3ab78186489da3ff2bff173ed1413a0bc1731eef2f881e3.exe
Size

182KB
MD5

22a8328895fc910fa68026f008297e34
SHA1

80813d1888157ddccfdc924b8752524fe81da10a
SHA256

57000dd18788f5a9a3ab78186489da3ff2bff173ed1413a0bc1731eef2f881e3
SHA512

ebf6d428ecd2724486e89f2fab9519719a9a58bb920d1c831f16fde1055cb7a4e48e02a9765a288a9d41554fd2d6b6f647f2fefe0c855e1b2416b53107754dac
SSDEEP

3072:+7GpgDVt8TCkEux0XBQZuPCgi3KOyCkEux0XBQZu:6lt8T1Tx0mZuPCgBOy1Tx0mZu

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lklbdm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odoogi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahbjoe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omopjcjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dapkni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Leenhhdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bbnkonbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aehgnied.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodjjimm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpkibf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aagkhd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Epjajeqo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfpdin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pefabkej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gijmad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcogje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efblbbqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgnomg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahgjejhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hdjbiheb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qhkdof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ccqkigkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hnodaecc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbgalmej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Coadnlnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njghbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjmfjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aonoao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebgpad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgqqdeod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfamapjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nkqkhk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Njkkbehl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfiildio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Epmmqheb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbalopbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmpolgoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kilpmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmflbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nhmofj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jppnpjel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lindkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljpaqmgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mqdcnl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akhcfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djjebh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnlmhc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hammhcij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inlihl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qachgk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgphpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eaqdegaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ponfka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmeede32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfbaonae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nagpeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjfjka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lieccf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Niooqcad.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Coknoaic.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejalcgkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hildmn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlkipgpe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfiokmkc.exe

Executes dropped EXE 64 IoCs

pid	Process
1604	Jnifigpa.exe
4644	Joiccj32.exe
5060	Jgdhgmep.exe
2300	Jehhaaci.exe
2936	Jnpmjf32.exe
860	Kldmckic.exe
5044	Klfjijgq.exe
4952	Kflnfcgg.exe
556	Klifnj32.exe
4992	Kfnkkb32.exe
4856	Kfqgab32.exe
3264	Kpiljh32.exe
4440	Kfcdfbqo.exe
3948	Lpkiph32.exe
1680	Lblaabdp.exe
4792	Locbfd32.exe
4076	Lihfcm32.exe
4052	Lpekef32.exe
1032	Leadnm32.exe
4048	Mpghkf32.exe
336	Medqcmki.exe
1256	Mbhamajc.exe
2012	Mhdjehhj.exe
1460	Mehjol32.exe
224	Mekgdl32.exe
4652	Nhlpfgbb.exe
2136	Npedmdab.exe
3388	Npgabc32.exe
1000	Nedjjj32.exe
1160	Nomncpcg.exe
864	Nplkmckj.exe
3308	Oeicejia.exe
4372	Olckbd32.exe
1164	Ohjlgefb.exe
3488	Oocddono.exe
2256	Oenlqi32.exe
3392	Ohlimd32.exe
2312	Ocamjm32.exe
2332	Opemca32.exe
1984	Ohqbhdpj.exe
1376	Ocffempp.exe
4760	Pjpobg32.exe
3020	Ploknb32.exe
3244	Podmkm32.exe
3696	Pfnegggi.exe
2104	Pofjpl32.exe
3204	Qhonib32.exe
4192	Qcdbfk32.exe
4508	Qjnkcekm.exe
4684	Qqhcpo32.exe
732	Afelhf32.exe
4004	Aqkpeopg.exe
548	Ajcdnd32.exe
4084	Aggegh32.exe
1240	Aihaoqlp.exe
2400	Aobilkcl.exe
2556	Aflaie32.exe
3968	Aqaffn32.exe
2172	Aglnbhal.exe
2680	Ajjjocap.exe
3432	Bogcgj32.exe
2796	Bfqkddfd.exe
1260	Bqfoamfj.exe
3164	Bjodjb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Bfendmoc.exe	Bcfahbpo.exe
File created	C:\Windows\SysWOW64\Jcoong32.dll	Elbhjp32.exe
File created	C:\Windows\SysWOW64\Iaghgm32.dll	Lqkgbcff.exe
File created	C:\Windows\SysWOW64\Fechok32.dll	Oeokal32.exe
File created	C:\Windows\SysWOW64\Pknqoc32.exe	Peahgl32.exe
File opened for modification	C:\Windows\SysWOW64\Kjlopc32.exe	Kgnbdh32.exe
File created	C:\Windows\SysWOW64\Iocbnhog.dll	Mcgiefen.exe
File created	C:\Windows\SysWOW64\Kcllei32.dll	Ccqkigkp.exe
File created	C:\Windows\SysWOW64\Fnofdl32.dll	Dikihe32.exe
File created	C:\Windows\SysWOW64\Iohcia32.dll	Ccgajfeh.exe
File created	C:\Windows\SysWOW64\Apbffmfi.dll	Kfqgab32.exe
File opened for modification	C:\Windows\SysWOW64\Pekbga32.exe	Poajkgnc.exe
File created	C:\Windows\SysWOW64\Epmfkk32.dll	Bhamkipi.exe
File opened for modification	C:\Windows\SysWOW64\Ncchae32.exe	Nadleilm.exe
File created	C:\Windows\SysWOW64\Lfiokmkc.exe	Ljpaqmgb.exe
File created	C:\Windows\SysWOW64\Mlkfgena.dll	Kflnfcgg.exe
File created	C:\Windows\SysWOW64\Gpdbcaok.dll	Kedlip32.exe
File created	C:\Windows\SysWOW64\Podmed32.dll	Fibojhim.exe
File opened for modification	C:\Windows\SysWOW64\Nnicid32.exe	Nlkgmh32.exe
File created	C:\Windows\SysWOW64\Mablfnne.exe	Loacdc32.exe
File opened for modification	C:\Windows\SysWOW64\Lqndhcdc.exe	Lkalplel.exe
File created	C:\Windows\SysWOW64\Mejpje32.exe	Mblcnj32.exe
File created	C:\Windows\SysWOW64\Amoljp32.dll	Alkijdci.exe
File created	C:\Windows\SysWOW64\Hgghjjid.exe	Hdilnojp.exe
File opened for modification	C:\Windows\SysWOW64\Cjecpkcg.exe	Bbnkonbd.exe
File created	C:\Windows\SysWOW64\Hdjbiheb.exe	Hmpjmn32.exe
File created	C:\Windows\SysWOW64\Mjijkmod.dll	Ohcegi32.exe
File opened for modification	C:\Windows\SysWOW64\Jgkmgk32.exe	Jekqmhia.exe
File created	C:\Windows\SysWOW64\Kodnmkap.exe	Klfaapbl.exe
File opened for modification	C:\Windows\SysWOW64\Bhpofl32.exe	Bgpcliao.exe
File created	C:\Windows\SysWOW64\Khnhommq.dll	Jojdlfeo.exe
File created	C:\Windows\SysWOW64\Ooqqdi32.exe	Olbdhn32.exe
File created	C:\Windows\SysWOW64\Bmabggdm.exe	Bfgjjm32.exe
File created	C:\Windows\SysWOW64\Occgpjdk.dll	Hdmoohbo.exe
File created	C:\Windows\SysWOW64\Fnipgg32.dll	Mmkkmc32.exe
File created	C:\Windows\SysWOW64\Onpjichj.exe	Oeheqm32.exe
File opened for modification	C:\Windows\SysWOW64\Qdoacabq.exe	Qjfmkk32.exe
File created	C:\Windows\SysWOW64\Nimmifgo.exe	Nijqcf32.exe
File opened for modification	C:\Windows\SysWOW64\Bcfahbpo.exe	Bkoigdom.exe
File created	C:\Windows\SysWOW64\Hpoejj32.dll	Omopjcjp.exe
File created	C:\Windows\SysWOW64\Npgabc32.exe	Npedmdab.exe
File created	C:\Windows\SysWOW64\Aanfno32.dll	Ihdldn32.exe
File created	C:\Windows\SysWOW64\Keifdpif.exe	Kheekkjl.exe
File created	C:\Windows\SysWOW64\Mpagaf32.dll	Piocecgj.exe
File created	C:\Windows\SysWOW64\Aglmllpq.dll	Ilkoim32.exe
File created	C:\Windows\SysWOW64\Hqomopfd.dll	Nbefdijg.exe
File created	C:\Windows\SysWOW64\Keldkigj.dll	Odmbaj32.exe
File opened for modification	C:\Windows\SysWOW64\Chglab32.exe	Cnahdi32.exe
File created	C:\Windows\SysWOW64\Hacbhb32.exe	Hgnoki32.exe
File opened for modification	C:\Windows\SysWOW64\Kkcfid32.exe	Kdinljnk.exe
File created	C:\Windows\SysWOW64\Blafme32.dll	Igdnabjh.exe
File opened for modification	C:\Windows\SysWOW64\Hipmfjee.exe	Geaepk32.exe
File created	C:\Windows\SysWOW64\Ckebcg32.exe	Chfegk32.exe
File opened for modification	C:\Windows\SysWOW64\Oocddono.exe	Ohjlgefb.exe
File created	C:\Windows\SysWOW64\Gaopfe32.exe	Gigheh32.exe
File opened for modification	C:\Windows\SysWOW64\Jklphekp.exe	Jdbhkk32.exe
File created	C:\Windows\SysWOW64\Fmpbnihe.dll	Ahgjejhd.exe
File opened for modification	C:\Windows\SysWOW64\Bkoigdom.exe	Bhamkipi.exe
File created	C:\Windows\SysWOW64\Cndepccb.dll	Ponfka32.exe
File opened for modification	C:\Windows\SysWOW64\Nomncpcg.exe	Nedjjj32.exe
File created	C:\Windows\SysWOW64\Odcfhh32.dll	Gjfnedho.exe
File created	C:\Windows\SysWOW64\Gljgbllj.exe	Gkhkjd32.exe
File created	C:\Windows\SysWOW64\Dodjjimm.exe	Doaneiop.exe
File opened for modification	C:\Windows\SysWOW64\Qjnkcekm.exe	Qcdbfk32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6056	6620	WerFault.exe	813

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkccgodj.dll"	Fechomko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnqjcbao.dll"	Lihpif32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oondnini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhoqeibl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbcpja32.dll"	Bkdcbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qofmkc32.dll"	Nlmdbh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohqbhdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Moqkim32.dll"	Hpdfnolo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjellmbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckhecmcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbbicl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Joqafgni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Impjjbmh.dll"	Ajjjocap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfpdin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfefkkqp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fdepgkgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbceobam.dll"	Naecop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Innfnl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kclgmq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Inmabofh.dll"	Kjepjkhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjokon32.dll"	Modgdicm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggnjnq32.dll"	Efkphnbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ijogmdqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhielqhi.dll"	Jnpfop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oglbla32.dll"	Onmfimga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpaqbf32.dll"	Hhdcmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gilmfhhk.dll"	Bfqkddfd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qmepam32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onmfimga.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gdjibj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdnpclpq.dll"	Jqknkedi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dlgaff32.dll"	Aonoao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lqkgbcff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgagea32.dll"	Nglhld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gdglhf32.dll"	Njmqnobn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Keifdpif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gaefgd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mbenmk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgipcogp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmocfo32.dll"	Qhhpop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lnjkcfod.dll"	Eojiqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlkfgena.dll"	Kflnfcgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jnpfop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pkegpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eephln32.dll"	Ipoopgnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbopphio.dll"	Pehngkcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lbkkgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpgbgamd.dll"	Bohibc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Efhlhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qjalckog.dll"	Qachgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iocbnhog.dll"	Mcgiefen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oeoblb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Boflmdkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aljejh32.dll"	Knfeeimj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mqdcnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eblpgjha.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oaqbkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmmanjof.dll"	Qmepam32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Olckbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebadmmge.dll"	Fhmigagd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Najmjokc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hccdbf32.dll"	Ojdgnn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lacdmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kclgmq32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 1604	3076	57000dd18788f5a9a3ab78186489da3ff2bff173ed1413a0bc1731eef2f881e3.exe	87
PID 3076 wrote to memory of 1604	3076	57000dd18788f5a9a3ab78186489da3ff2bff173ed1413a0bc1731eef2f881e3.exe	87
PID 3076 wrote to memory of 1604	3076	57000dd18788f5a9a3ab78186489da3ff2bff173ed1413a0bc1731eef2f881e3.exe	87
PID 1604 wrote to memory of 4644	1604	Jnifigpa.exe	88
PID 1604 wrote to memory of 4644	1604	Jnifigpa.exe	88
PID 1604 wrote to memory of 4644	1604	Jnifigpa.exe	88
PID 4644 wrote to memory of 5060	4644	Joiccj32.exe	89
PID 4644 wrote to memory of 5060	4644	Joiccj32.exe	89
PID 4644 wrote to memory of 5060	4644	Joiccj32.exe	89
PID 5060 wrote to memory of 2300	5060	Jgdhgmep.exe	90
PID 5060 wrote to memory of 2300	5060	Jgdhgmep.exe	90
PID 5060 wrote to memory of 2300	5060	Jgdhgmep.exe	90
PID 2300 wrote to memory of 2936	2300	Jehhaaci.exe	91
PID 2300 wrote to memory of 2936	2300	Jehhaaci.exe	91
PID 2300 wrote to memory of 2936	2300	Jehhaaci.exe	91
PID 2936 wrote to memory of 860	2936	Jnpmjf32.exe	92
PID 2936 wrote to memory of 860	2936	Jnpmjf32.exe	92
PID 2936 wrote to memory of 860	2936	Jnpmjf32.exe	92
PID 860 wrote to memory of 5044	860	Kldmckic.exe	93
PID 860 wrote to memory of 5044	860	Kldmckic.exe	93
PID 860 wrote to memory of 5044	860	Kldmckic.exe	93
PID 5044 wrote to memory of 4952	5044	Klfjijgq.exe	94
PID 5044 wrote to memory of 4952	5044	Klfjijgq.exe	94
PID 5044 wrote to memory of 4952	5044	Klfjijgq.exe	94
PID 4952 wrote to memory of 556	4952	Kflnfcgg.exe	95
PID 4952 wrote to memory of 556	4952	Kflnfcgg.exe	95
PID 4952 wrote to memory of 556	4952	Kflnfcgg.exe	95
PID 556 wrote to memory of 4992	556	Klifnj32.exe	96
PID 556 wrote to memory of 4992	556	Klifnj32.exe	96
PID 556 wrote to memory of 4992	556	Klifnj32.exe	96
PID 4992 wrote to memory of 4856	4992	Kfnkkb32.exe	97
PID 4992 wrote to memory of 4856	4992	Kfnkkb32.exe	97
PID 4992 wrote to memory of 4856	4992	Kfnkkb32.exe	97
PID 4856 wrote to memory of 3264	4856	Kfqgab32.exe	98
PID 4856 wrote to memory of 3264	4856	Kfqgab32.exe	98
PID 4856 wrote to memory of 3264	4856	Kfqgab32.exe	98
PID 3264 wrote to memory of 4440	3264	Kpiljh32.exe	99
PID 3264 wrote to memory of 4440	3264	Kpiljh32.exe	99
PID 3264 wrote to memory of 4440	3264	Kpiljh32.exe	99
PID 4440 wrote to memory of 3948	4440	Kfcdfbqo.exe	101
PID 4440 wrote to memory of 3948	4440	Kfcdfbqo.exe	101
PID 4440 wrote to memory of 3948	4440	Kfcdfbqo.exe	101
PID 3948 wrote to memory of 1680	3948	Lpkiph32.exe	102
PID 3948 wrote to memory of 1680	3948	Lpkiph32.exe	102
PID 3948 wrote to memory of 1680	3948	Lpkiph32.exe	102
PID 1680 wrote to memory of 4792	1680	Lblaabdp.exe	103
PID 1680 wrote to memory of 4792	1680	Lblaabdp.exe	103
PID 1680 wrote to memory of 4792	1680	Lblaabdp.exe	103
PID 4792 wrote to memory of 4076	4792	Locbfd32.exe	104
PID 4792 wrote to memory of 4076	4792	Locbfd32.exe	104
PID 4792 wrote to memory of 4076	4792	Locbfd32.exe	104
PID 4076 wrote to memory of 4052	4076	Lihfcm32.exe	106
PID 4076 wrote to memory of 4052	4076	Lihfcm32.exe	106
PID 4076 wrote to memory of 4052	4076	Lihfcm32.exe	106
PID 4052 wrote to memory of 1032	4052	Lpekef32.exe	107
PID 4052 wrote to memory of 1032	4052	Lpekef32.exe	107
PID 4052 wrote to memory of 1032	4052	Lpekef32.exe	107
PID 1032 wrote to memory of 4048	1032	Leadnm32.exe	108
PID 1032 wrote to memory of 4048	1032	Leadnm32.exe	108
PID 1032 wrote to memory of 4048	1032	Leadnm32.exe	108
PID 4048 wrote to memory of 336	4048	Mpghkf32.exe	109
PID 4048 wrote to memory of 336	4048	Mpghkf32.exe	109
PID 4048 wrote to memory of 336	4048	Mpghkf32.exe	109
PID 336 wrote to memory of 1256	336	Medqcmki.exe	110

C:\Users\Admin\AppData\Local\Temp\57000dd18788f5a9a3ab78186489da3ff2bff173ed1413a0bc1731eef2f881e3.exe
"C:\Users\Admin\AppData\Local\Temp\57000dd18788f5a9a3ab78186489da3ff2bff173ed1413a0bc1731eef2f881e3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Windows\SysWOW64\Jnifigpa.exe
  C:\Windows\system32\Jnifigpa.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1604
- - C:\Windows\SysWOW64\Joiccj32.exe
    C:\Windows\system32\Joiccj32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Windows\SysWOW64\Jgdhgmep.exe
      C:\Windows\system32\Jgdhgmep.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5060
    - - C:\Windows\SysWOW64\Jehhaaci.exe
        
        C:\Windows\system32\Jehhaaci.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2300
      - C:\Windows\SysWOW64\Jnpmjf32.exe
        
        C:\Windows\system32\Jnpmjf32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\Windows\SysWOW64\Kldmckic.exe
        
        C:\Windows\system32\Kldmckic.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:860
        
        C:\Windows\SysWOW64\Klfjijgq.exe
        
        C:\Windows\system32\Klfjijgq.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\SysWOW64\Kflnfcgg.exe
        
        C:\Windows\system32\Kflnfcgg.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4952
        
        C:\Windows\SysWOW64\Klifnj32.exe
        
        C:\Windows\system32\Klifnj32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:556
        
        C:\Windows\SysWOW64\Kfnkkb32.exe
        
        C:\Windows\system32\Kfnkkb32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4992
        
        C:\Windows\SysWOW64\Kfqgab32.exe
        
        C:\Windows\system32\Kfqgab32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Windows\SysWOW64\Kpiljh32.exe
        
        C:\Windows\system32\Kpiljh32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3264
        
        C:\Windows\SysWOW64\Kfcdfbqo.exe
        
        C:\Windows\system32\Kfcdfbqo.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Windows\SysWOW64\Lpkiph32.exe
        
        C:\Windows\system32\Lpkiph32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3948
        
        C:\Windows\SysWOW64\Lblaabdp.exe
        
        C:\Windows\system32\Lblaabdp.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1680
        
        C:\Windows\SysWOW64\Locbfd32.exe
        
        C:\Windows\system32\Locbfd32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\SysWOW64\Lihfcm32.exe
        
        C:\Windows\system32\Lihfcm32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4076
        
        C:\Windows\SysWOW64\Lpekef32.exe
        
        C:\Windows\system32\Lpekef32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4052
        
        C:\Windows\SysWOW64\Leadnm32.exe
        
        C:\Windows\system32\Leadnm32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1032
        
        C:\Windows\SysWOW64\Mpghkf32.exe
        
        C:\Windows\system32\Mpghkf32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4048
        
        C:\Windows\SysWOW64\Medqcmki.exe
        
        C:\Windows\system32\Medqcmki.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:336
        
        C:\Windows\SysWOW64\Mbhamajc.exe
        
        C:\Windows\system32\Mbhamajc.exe
        23⤵
        Executes dropped EXE
        
        PID:1256
        
        C:\Windows\SysWOW64\Mhdjehhj.exe
        
        C:\Windows\system32\Mhdjehhj.exe
        24⤵
        Executes dropped EXE
        
        PID:2012
        
        C:\Windows\SysWOW64\Mehjol32.exe
        
        C:\Windows\system32\Mehjol32.exe
        25⤵
        Executes dropped EXE
        
        PID:1460
        
        C:\Windows\SysWOW64\Mekgdl32.exe
        
        C:\Windows\system32\Mekgdl32.exe
        26⤵
        Executes dropped EXE
        
        PID:224
        
        C:\Windows\SysWOW64\Nhlpfgbb.exe
        
        C:\Windows\system32\Nhlpfgbb.exe
        27⤵
        Executes dropped EXE
        
        PID:4652
        
        C:\Windows\SysWOW64\Npedmdab.exe
        
        C:\Windows\system32\Npedmdab.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2136
        
        C:\Windows\SysWOW64\Npgabc32.exe
        
        C:\Windows\system32\Npgabc32.exe
        29⤵
        Executes dropped EXE
        
        PID:3388
        
        C:\Windows\SysWOW64\Nedjjj32.exe
        
        C:\Windows\system32\Nedjjj32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1000
        
        C:\Windows\SysWOW64\Nomncpcg.exe
        
        C:\Windows\system32\Nomncpcg.exe
        31⤵
        Executes dropped EXE
        
        PID:1160
        
        C:\Windows\SysWOW64\Nplkmckj.exe
        
        C:\Windows\system32\Nplkmckj.exe
        32⤵
        Executes dropped EXE
        
        PID:864
        
        C:\Windows\SysWOW64\Oeicejia.exe
        
        C:\Windows\system32\Oeicejia.exe
        33⤵
        Executes dropped EXE
        
        PID:3308
        
        C:\Windows\SysWOW64\Olckbd32.exe
        
        C:\Windows\system32\Olckbd32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4372
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1164
        
        C:\Windows\SysWOW64\Oocddono.exe
        
        C:\Windows\system32\Oocddono.exe
        36⤵
        Executes dropped EXE
        
        PID:3488
        
        C:\Windows\SysWOW64\Oenlqi32.exe
        
        C:\Windows\system32\Oenlqi32.exe
        37⤵
        Executes dropped EXE
        
        PID:2256
        
        C:\Windows\SysWOW64\Ohlimd32.exe
        
        C:\Windows\system32\Ohlimd32.exe
        38⤵
        Executes dropped EXE
        
        PID:3392
        
        C:\Windows\SysWOW64\Ocamjm32.exe
        
        C:\Windows\system32\Ocamjm32.exe
        39⤵
        Executes dropped EXE
        
        PID:2312
        
        C:\Windows\SysWOW64\Opemca32.exe
        
        C:\Windows\system32\Opemca32.exe
        40⤵
        Executes dropped EXE
        
        PID:2332
        
        C:\Windows\SysWOW64\Ohqbhdpj.exe
        
        C:\Windows\system32\Ohqbhdpj.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1984
        
        C:\Windows\SysWOW64\Ocffempp.exe
        
        C:\Windows\system32\Ocffempp.exe
        42⤵
        Executes dropped EXE
        
        PID:1376
        
        C:\Windows\SysWOW64\Pjpobg32.exe
        
        C:\Windows\system32\Pjpobg32.exe
        43⤵
        Executes dropped EXE
        
        PID:4760
        
        C:\Windows\SysWOW64\Ploknb32.exe
        
        C:\Windows\system32\Ploknb32.exe
        44⤵
        Executes dropped EXE
        
        PID:3020
        
        C:\Windows\SysWOW64\Podmkm32.exe
        
        C:\Windows\system32\Podmkm32.exe
        45⤵
        Executes dropped EXE
        
        PID:3244
        
        C:\Windows\SysWOW64\Pfnegggi.exe
        
        C:\Windows\system32\Pfnegggi.exe
        46⤵
        Executes dropped EXE
        
        PID:3696
        
        C:\Windows\SysWOW64\Pofjpl32.exe
        
        C:\Windows\system32\Pofjpl32.exe
        47⤵
        Executes dropped EXE
        
        PID:2104
        
        C:\Windows\SysWOW64\Qhonib32.exe
        
        C:\Windows\system32\Qhonib32.exe
        48⤵
        Executes dropped EXE
        
        PID:3204
        
        C:\Windows\SysWOW64\Qcdbfk32.exe
        
        C:\Windows\system32\Qcdbfk32.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4192
        
        C:\Windows\SysWOW64\Qjnkcekm.exe
        
        C:\Windows\system32\Qjnkcekm.exe
        50⤵
        Executes dropped EXE
        
        PID:4508
        
        C:\Windows\SysWOW64\Qqhcpo32.exe
        
        C:\Windows\system32\Qqhcpo32.exe
        51⤵
        Executes dropped EXE
        
        PID:4684
        
        C:\Windows\SysWOW64\Afelhf32.exe
        
        C:\Windows\system32\Afelhf32.exe
        52⤵
        Executes dropped EXE
        
        PID:732
        
        C:\Windows\SysWOW64\Aqkpeopg.exe
        
        C:\Windows\system32\Aqkpeopg.exe
        53⤵
        Executes dropped EXE
        
        PID:4004
        
        C:\Windows\SysWOW64\Ajcdnd32.exe
        
        C:\Windows\system32\Ajcdnd32.exe
        54⤵
        Executes dropped EXE
        
        PID:548
        
        C:\Windows\SysWOW64\Aggegh32.exe
        
        C:\Windows\system32\Aggegh32.exe
        55⤵
        Executes dropped EXE
        
        PID:4084
        
        C:\Windows\SysWOW64\Aihaoqlp.exe
        
        C:\Windows\system32\Aihaoqlp.exe
        56⤵
        Executes dropped EXE
        
        PID:1240
        
        C:\Windows\SysWOW64\Aobilkcl.exe
        
        C:\Windows\system32\Aobilkcl.exe
        57⤵
        Executes dropped EXE
        
        PID:2400
        
        C:\Windows\SysWOW64\Aflaie32.exe
        
        C:\Windows\system32\Aflaie32.exe
        58⤵
        Executes dropped EXE
        
        PID:2556
        
        C:\Windows\SysWOW64\Aqaffn32.exe
        
        C:\Windows\system32\Aqaffn32.exe
        59⤵
        Executes dropped EXE
        
        PID:3968
        
        C:\Windows\SysWOW64\Aglnbhal.exe
        
        C:\Windows\system32\Aglnbhal.exe
        60⤵
        Executes dropped EXE
        
        PID:2172
        
        C:\Windows\SysWOW64\Ajjjocap.exe
        
        C:\Windows\system32\Ajjjocap.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2680
        
        C:\Windows\SysWOW64\Bogcgj32.exe
        
        C:\Windows\system32\Bogcgj32.exe
        62⤵
        Executes dropped EXE
        
        PID:3432
        
        C:\Windows\SysWOW64\Bfqkddfd.exe
        
        C:\Windows\system32\Bfqkddfd.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2796
        
        C:\Windows\SysWOW64\Bqfoamfj.exe
        
        C:\Windows\system32\Bqfoamfj.exe
        64⤵
        Executes dropped EXE
        
        PID:1260
        
        C:\Windows\SysWOW64\Bjodjb32.exe
        
        C:\Windows\system32\Bjodjb32.exe
        65⤵
        Executes dropped EXE
        
        PID:3164
        
        C:\Windows\SysWOW64\Boklbi32.exe
        
        C:\Windows\system32\Boklbi32.exe
        66⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\Bgbdcgld.exe
        
        C:\Windows\system32\Bgbdcgld.exe
        67⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\Bfhadc32.exe
        
        C:\Windows\system32\Bfhadc32.exe
        68⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Bqmeal32.exe
        
        C:\Windows\system32\Bqmeal32.exe
        69⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\Bppfmigl.exe
        
        C:\Windows\system32\Bppfmigl.exe
        70⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\Bjfjka32.exe
        
        C:\Windows\system32\Bjfjka32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4700
        
        C:\Windows\SysWOW64\Cmdfgm32.exe
        
        C:\Windows\system32\Cmdfgm32.exe
        72⤵
        
        PID:956
        
        C:\Windows\SysWOW64\Cpbbch32.exe
        
        C:\Windows\system32\Cpbbch32.exe
        73⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\Cgjjdf32.exe
        
        C:\Windows\system32\Cgjjdf32.exe
        74⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\Cmfclm32.exe
        
        C:\Windows\system32\Cmfclm32.exe
        75⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\Ccqkigkp.exe
        
        C:\Windows\system32\Ccqkigkp.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1204
        
        C:\Windows\SysWOW64\Cfogeb32.exe
        
        C:\Windows\system32\Cfogeb32.exe
        77⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        78⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\Ccchof32.exe
        
        C:\Windows\system32\Ccchof32.exe
        79⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\Cjmpkqqj.exe
        
        C:\Windows\system32\Cjmpkqqj.exe
        80⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Caghhk32.exe
        
        C:\Windows\system32\Caghhk32.exe
        81⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\Cgqqdeod.exe
        
        C:\Windows\system32\Cgqqdeod.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3088
        
        C:\Windows\SysWOW64\Cjomap32.exe
        
        C:\Windows\system32\Cjomap32.exe
        83⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\Ccgajfeh.exe
        
        C:\Windows\system32\Ccgajfeh.exe
        84⤵
        Drops file in System32 directory
        
        PID:4176
        
        C:\Windows\SysWOW64\Cidjbmcp.exe
        
        C:\Windows\system32\Cidjbmcp.exe
        85⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\Dpnbog32.exe
        
        C:\Windows\system32\Dpnbog32.exe
        86⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Dgejpd32.exe
        
        C:\Windows\system32\Dgejpd32.exe
        87⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        88⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Dannij32.exe
        
        C:\Windows\system32\Dannij32.exe
        89⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Dclkee32.exe
        
        C:\Windows\system32\Dclkee32.exe
        90⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Djfcaohp.exe
        
        C:\Windows\system32\Djfcaohp.exe
        91⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Dapkni32.exe
        
        C:\Windows\system32\Dapkni32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5412
        
        C:\Windows\SysWOW64\Dcogje32.exe
        
        C:\Windows\system32\Dcogje32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5468
        
        C:\Windows\SysWOW64\Djhpgofm.exe
        
        C:\Windows\system32\Djhpgofm.exe
        94⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Ddadpdmn.exe
        
        C:\Windows\system32\Ddadpdmn.exe
        95⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Djklmo32.exe
        
        C:\Windows\system32\Djklmo32.exe
        96⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Dpgeee32.exe
        
        C:\Windows\system32\Dpgeee32.exe
        97⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Dhomfc32.exe
        
        C:\Windows\system32\Dhomfc32.exe
        98⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Dfamapjo.exe
        
        C:\Windows\system32\Dfamapjo.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5736
        
        C:\Windows\SysWOW64\Epjajeqo.exe
        
        C:\Windows\system32\Epjajeqo.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5776
        
        C:\Windows\SysWOW64\Edemkd32.exe
        
        C:\Windows\system32\Edemkd32.exe
        101⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Ejpfhnpe.exe
        
        C:\Windows\system32\Ejpfhnpe.exe
        102⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Eaindh32.exe
        
        C:\Windows\system32\Eaindh32.exe
        103⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Edhjqc32.exe
        
        C:\Windows\system32\Edhjqc32.exe
        104⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        105⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Eidbij32.exe
        
        C:\Windows\system32\Eidbij32.exe
        106⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Epokedmj.exe
        
        C:\Windows\system32\Epokedmj.exe
        107⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Ejdocm32.exe
        
        C:\Windows\system32\Ejdocm32.exe
        108⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Embkoi32.exe
        
        C:\Windows\system32\Embkoi32.exe
        109⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Epagkd32.exe
        
        C:\Windows\system32\Epagkd32.exe
        110⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Efkphnbd.exe
        
        C:\Windows\system32\Efkphnbd.exe
        111⤵
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Eiildjag.exe
        
        C:\Windows\system32\Eiildjag.exe
        112⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Eaqdegaj.exe
        
        C:\Windows\system32\Eaqdegaj.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5444
        
        C:\Windows\SysWOW64\Efmmmn32.exe
        
        C:\Windows\system32\Efmmmn32.exe
        114⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Filiii32.exe
        
        C:\Windows\system32\Filiii32.exe
        115⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Fpeafcfa.exe
        
        C:\Windows\system32\Fpeafcfa.exe
        116⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Fhmigagd.exe
        
        C:\Windows\system32\Fhmigagd.exe
        117⤵
        Modifies registry class
        
        PID:5732
        
        C:\Windows\SysWOW64\Fineoi32.exe
        
        C:\Windows\system32\Fineoi32.exe
        118⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Faenpf32.exe
        
        C:\Windows\system32\Faenpf32.exe
        119⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Fhofmq32.exe
        
        C:\Windows\system32\Fhofmq32.exe
        120⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        121⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Fhabbp32.exe
        
        C:\Windows\system32\Fhabbp32.exe
        122⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Fibojhim.exe
        
        C:\Windows\system32\Fibojhim.exe
        123⤵
        Drops file in System32 directory
        
        PID:6132
        
        C:\Windows\SysWOW64\Fpmggb32.exe
        
        C:\Windows\system32\Fpmggb32.exe
        124⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Fggocmhf.exe
        
        C:\Windows\system32\Fggocmhf.exe
        125⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Gigheh32.exe
        
        C:\Windows\system32\Gigheh32.exe
        126⤵
        Drops file in System32 directory
        
        PID:5400
        
        C:\Windows\SysWOW64\Gaopfe32.exe
        
        C:\Windows\system32\Gaopfe32.exe
        127⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Ghhhcomg.exe
        
        C:\Windows\system32\Ghhhcomg.exe
        128⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Gijekg32.exe
        
        C:\Windows\system32\Gijekg32.exe
        129⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Gdoihpbk.exe
        
        C:\Windows\system32\Gdoihpbk.exe
        130⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Ggnedlao.exe
        
        C:\Windows\system32\Ggnedlao.exe
        131⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Gilapgqb.exe
        
        C:\Windows\system32\Gilapgqb.exe
        132⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Gdafnpqh.exe
        
        C:\Windows\system32\Gdafnpqh.exe
        133⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Ggpbjkpl.exe
        
        C:\Windows\system32\Ggpbjkpl.exe
        134⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Gaefgd32.exe
        
        C:\Windows\system32\Gaefgd32.exe
        135⤵
        Modifies registry class
        
        PID:5484
        
        C:\Windows\SysWOW64\Gddbcp32.exe
        
        C:\Windows\system32\Gddbcp32.exe
        136⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Gknkpjfb.exe
        
        C:\Windows\system32\Gknkpjfb.exe
        137⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Gahcmd32.exe
        
        C:\Windows\system32\Gahcmd32.exe
        138⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\Hgelek32.exe
        
        C:\Windows\system32\Hgelek32.exe
        139⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Hnodaecc.exe
        
        C:\Windows\system32\Hnodaecc.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5676
        
        C:\Windows\SysWOW64\Hdilnojp.exe
        
        C:\Windows\system32\Hdilnojp.exe
        141⤵
        Drops file in System32 directory
        
        PID:5888
        
        C:\Windows\SysWOW64\Hgghjjid.exe
        
        C:\Windows\system32\Hgghjjid.exe
        142⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Hjedffig.exe
        
        C:\Windows\system32\Hjedffig.exe
        143⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Hammhcij.exe
        
        C:\Windows\system32\Hammhcij.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6032
        
        C:\Windows\SysWOW64\Hhfedm32.exe
        
        C:\Windows\system32\Hhfedm32.exe
        145⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Hjhalefe.exe
        
        C:\Windows\system32\Hjhalefe.exe
        146⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        147⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Hpdfnolo.exe
        
        C:\Windows\system32\Hpdfnolo.exe
        148⤵
        Modifies registry class
        
        PID:6232
        
        C:\Windows\SysWOW64\Hgnoki32.exe
        
        C:\Windows\system32\Hgnoki32.exe
        149⤵
        Drops file in System32 directory
        
        PID:6284
        
        C:\Windows\SysWOW64\Hacbhb32.exe
        
        C:\Windows\system32\Hacbhb32.exe
        150⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Ihnkel32.exe
        
        C:\Windows\system32\Ihnkel32.exe
        151⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Ijogmdqm.exe
        
        C:\Windows\system32\Ijogmdqm.exe
        152⤵
        Modifies registry class
        
        PID:6416
        
        C:\Windows\SysWOW64\Iqipio32.exe
        
        C:\Windows\system32\Iqipio32.exe
        153⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Iqklon32.exe
        
        C:\Windows\system32\Iqklon32.exe
        154⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Ihdafkdg.exe
        
        C:\Windows\system32\Ihdafkdg.exe
        155⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Ijfnmc32.exe
        
        C:\Windows\system32\Ijfnmc32.exe
        156⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Ibmeoq32.exe
        
        C:\Windows\system32\Ibmeoq32.exe
        157⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Idkbkl32.exe
        
        C:\Windows\system32\Idkbkl32.exe
        158⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        159⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Ijhjcchb.exe
        
        C:\Windows\system32\Ijhjcchb.exe
        160⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Ibobdqid.exe
        
        C:\Windows\system32\Ibobdqid.exe
        161⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Jkhgmf32.exe
        
        C:\Windows\system32\Jkhgmf32.exe
        162⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Jdpkflfe.exe
        
        C:\Windows\system32\Jdpkflfe.exe
        163⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Jkjcbe32.exe
        
        C:\Windows\system32\Jkjcbe32.exe
        164⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        165⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Jdbhkk32.exe
        
        C:\Windows\system32\Jdbhkk32.exe
        166⤵
        Drops file in System32 directory
        
        PID:7064
        
        C:\Windows\SysWOW64\Jklphekp.exe
        
        C:\Windows\system32\Jklphekp.exe
        167⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Jqiipljg.exe
        
        C:\Windows\system32\Jqiipljg.exe
        168⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        169⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Jnmijq32.exe
        
        C:\Windows\system32\Jnmijq32.exe
        170⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        171⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Jibmgi32.exe
        
        C:\Windows\system32\Jibmgi32.exe
        172⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        173⤵
        Modifies registry class
        
        PID:6512
        
        C:\Windows\SysWOW64\Kdinljnk.exe
        
        C:\Windows\system32\Kdinljnk.exe
        174⤵
        Drops file in System32 directory
        
        PID:6580
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        175⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Kqpoakco.exe
        
        C:\Windows\system32\Kqpoakco.exe
        176⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Kenggi32.exe
        
        C:\Windows\system32\Kenggi32.exe
        177⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Kilpmh32.exe
        
        C:\Windows\system32\Kilpmh32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6876
        
        C:\Windows\SysWOW64\Kkjlic32.exe
        
        C:\Windows\system32\Kkjlic32.exe
        179⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Kniieo32.exe
        
        C:\Windows\system32\Kniieo32.exe
        180⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        181⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Kjpijpdg.exe
        
        C:\Windows\system32\Kjpijpdg.exe
        182⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Lbgalmej.exe
        
        C:\Windows\system32\Lbgalmej.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6216
        
        C:\Windows\SysWOW64\Leenhhdn.exe
        
        C:\Windows\system32\Leenhhdn.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6392
        
        C:\Windows\SysWOW64\Ljbfpo32.exe
        
        C:\Windows\system32\Ljbfpo32.exe
        185⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        186⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Lgffic32.exe
        
        C:\Windows\system32\Lgffic32.exe
        187⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Lbkkgl32.exe
        
        C:\Windows\system32\Lbkkgl32.exe
        188⤵
        Modifies registry class
        
        PID:6864
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6960
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        190⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Laqhhi32.exe
        
        C:\Windows\system32\Laqhhi32.exe
        191⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        192⤵
        Modifies registry class
        
        PID:6320
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        193⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        194⤵
        Modifies registry class
        
        PID:6736
        
        C:\Windows\SysWOW64\Lijlof32.exe
        
        C:\Windows\system32\Lijlof32.exe
        195⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Mlkepaam.exe
        
        C:\Windows\system32\Mlkepaam.exe
        196⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Mbenmk32.exe
        
        C:\Windows\system32\Mbenmk32.exe
        197⤵
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Mecjif32.exe
        
        C:\Windows\system32\Mecjif32.exe
        198⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Mlmbfqoj.exe
        
        C:\Windows\system32\Mlmbfqoj.exe
        199⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Mnlnbl32.exe
        
        C:\Windows\system32\Mnlnbl32.exe
        200⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Majjng32.exe
        
        C:\Windows\system32\Majjng32.exe
        201⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Miaboe32.exe
        
        C:\Windows\system32\Miaboe32.exe
        202⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Mnnkgl32.exe
        
        C:\Windows\system32\Mnnkgl32.exe
        203⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Malgcg32.exe
        
        C:\Windows\system32\Malgcg32.exe
        204⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        205⤵
        Modifies registry class
        
        PID:7156
        
        C:\Windows\SysWOW64\Mblcnj32.exe
        
        C:\Windows\system32\Mblcnj32.exe
        206⤵
        Drops file in System32 directory
        
        PID:7220
        
        C:\Windows\SysWOW64\Mejpje32.exe
        
        C:\Windows\system32\Mejpje32.exe
        207⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Mhilfa32.exe
        
        C:\Windows\system32\Mhilfa32.exe
        208⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Njghbl32.exe
        
        C:\Windows\system32\Njghbl32.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7344
        
        C:\Windows\SysWOW64\Nbnpcj32.exe
        
        C:\Windows\system32\Nbnpcj32.exe
        210⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        211⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        212⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Nklbmllg.exe
        
        C:\Windows\system32\Nklbmllg.exe
        213⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Nimbkc32.exe
        
        C:\Windows\system32\Nimbkc32.exe
        214⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        215⤵
        Drops file in System32 directory
        
        PID:7620
        
        C:\Windows\SysWOW64\Nahgoe32.exe
        
        C:\Windows\system32\Nahgoe32.exe
        216⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Niooqcad.exe
        
        C:\Windows\system32\Niooqcad.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7704
        
        C:\Windows\SysWOW64\Nkqkhk32.exe
        
        C:\Windows\system32\Nkqkhk32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7756
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        219⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        220⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Oondnini.exe
        
        C:\Windows\system32\Oondnini.exe
        221⤵
        Modifies registry class
        
        PID:7888
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        222⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Olbdhn32.exe
        
        C:\Windows\system32\Olbdhn32.exe
        223⤵
        Drops file in System32 directory
        
        PID:7968
        
        C:\Windows\SysWOW64\Ooqqdi32.exe
        
        C:\Windows\system32\Ooqqdi32.exe
        224⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Oaompd32.exe
        
        C:\Windows\system32\Oaompd32.exe
        225⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        226⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Oboijgbl.exe
        
        C:\Windows\system32\Oboijgbl.exe
        227⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        228⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Olgncmim.exe
        
        C:\Windows\system32\Olgncmim.exe
        229⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        230⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Oeoblb32.exe
        
        C:\Windows\system32\Oeoblb32.exe
        231⤵
        Modifies registry class
        
        PID:7308
        
        C:\Windows\SysWOW64\Oklkdi32.exe
        
        C:\Windows\system32\Oklkdi32.exe
        232⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Oafcqcea.exe
        
        C:\Windows\system32\Oafcqcea.exe
        233⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        234⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Pibdmp32.exe
        
        C:\Windows\system32\Pibdmp32.exe
        235⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Pkcadhgm.exe
        
        C:\Windows\system32\Pkcadhgm.exe
        236⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        237⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Pidabppl.exe
        
        C:\Windows\system32\Pidabppl.exe
        238⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Poajkgnc.exe
        
        C:\Windows\system32\Poajkgnc.exe
        239⤵
        Drops file in System32 directory
        
        PID:7832
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        240⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        241⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Qlggjk32.exe
        
        C:\Windows\system32\Qlggjk32.exe
        242⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Qadoba32.exe
        
        C:\Windows\system32\Qadoba32.exe
        243⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Qikgco32.exe
        
        C:\Windows\system32\Qikgco32.exe
        244⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        245⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Qcclld32.exe
        
        C:\Windows\system32\Qcclld32.exe
        246⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Allpejfe.exe
        
        C:\Windows\system32\Allpejfe.exe
        247⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Aojlaeei.exe
        
        C:\Windows\system32\Aojlaeei.exe
        248⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Aaiimadl.exe
        
        C:\Windows\system32\Aaiimadl.exe
        249⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Alnmjjdb.exe
        
        C:\Windows\system32\Alnmjjdb.exe
        250⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Aomifecf.exe
        
        C:\Windows\system32\Aomifecf.exe
        251⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7988
        
        C:\Windows\SysWOW64\Acmobchj.exe
        
        C:\Windows\system32\Acmobchj.exe
        253⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        254⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Akhcfe32.exe
        
        C:\Windows\system32\Akhcfe32.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7352
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        256⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        257⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Boflmdkk.exe
        
        C:\Windows\system32\Boflmdkk.exe
        258⤵
        Modifies registry class
        
        PID:7740
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7880
        
        C:\Windows\SysWOW64\Bhoqeibl.exe
        
        C:\Windows\system32\Bhoqeibl.exe
        260⤵
        Modifies registry class
        
        PID:8084
        
        C:\Windows\SysWOW64\Bohibc32.exe
        
        C:\Windows\system32\Bohibc32.exe
        261⤵
        Modifies registry class
        
        PID:7416
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6448
        
        C:\Windows\SysWOW64\Bhamkipi.exe
        
        C:\Windows\system32\Bhamkipi.exe
        263⤵
        Drops file in System32 directory
        
        PID:7736
        
        C:\Windows\SysWOW64\Bkoigdom.exe
        
        C:\Windows\system32\Bkoigdom.exe
        264⤵
        Drops file in System32 directory
        
        PID:7924
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        265⤵
        Drops file in System32 directory
        
        PID:8160
        
        C:\Windows\SysWOW64\Bfendmoc.exe
        
        C:\Windows\system32\Bfendmoc.exe
        266⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Bmofagfp.exe
        
        C:\Windows\system32\Bmofagfp.exe
        267⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Bcinna32.exe
        
        C:\Windows\system32\Bcinna32.exe
        268⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Bfgjjm32.exe
        
        C:\Windows\system32\Bfgjjm32.exe
        269⤵
        Drops file in System32 directory
        
        PID:7876
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        270⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Bkdcbd32.exe
        
        C:\Windows\system32\Bkdcbd32.exe
        271⤵
        Modifies registry class
        
        PID:8204
        
        C:\Windows\SysWOW64\Bbnkonbd.exe
        
        C:\Windows\system32\Bbnkonbd.exe
        272⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8252
        
        C:\Windows\SysWOW64\Cjecpkcg.exe
        
        C:\Windows\system32\Cjecpkcg.exe
        273⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Ckfphc32.exe
        
        C:\Windows\system32\Ckfphc32.exe
        274⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        275⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8420
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        277⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        278⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Ckkiccep.exe
        
        C:\Windows\system32\Ckkiccep.exe
        279⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        280⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        281⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        282⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        283⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Coknoaic.exe
        
        C:\Windows\system32\Coknoaic.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8752
        
        C:\Windows\SysWOW64\Dbjkkl32.exe
        
        C:\Windows\system32\Dbjkkl32.exe
        285⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        286⤵
        Modifies registry class
        
        PID:8848
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        287⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Dmalne32.exe
        
        C:\Windows\system32\Dmalne32.exe
        288⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        289⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        290⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Dlghoa32.exe
        
        C:\Windows\system32\Dlghoa32.exe
        291⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        292⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Dikihe32.exe
        
        C:\Windows\system32\Dikihe32.exe
        293⤵
        Drops file in System32 directory
        
        PID:9140
        
        C:\Windows\SysWOW64\Dpdaepai.exe
        
        C:\Windows\system32\Dpdaepai.exe
        294⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7292
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        296⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        297⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        298⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        299⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        300⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8608
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        302⤵
        Drops file in System32 directory
        
        PID:8644
        
        C:\Windows\SysWOW64\Eblpgjha.exe
        
        C:\Windows\system32\Eblpgjha.exe
        303⤵
        Modifies registry class
        
        PID:8736
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        304⤵
        Modifies registry class
        
        PID:7480
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        305⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        306⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        307⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        308⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        309⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Fmfnpa32.exe
        
        C:\Windows\system32\Fmfnpa32.exe
        310⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        311⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Ffobhg32.exe
        
        C:\Windows\system32\Ffobhg32.exe
        312⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        313⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        314⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        315⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        316⤵
        Modifies registry class
        
        PID:8828
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        317⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        318⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Fbjmhh32.exe
        
        C:\Windows\system32\Fbjmhh32.exe
        319⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        320⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        321⤵
        Modifies registry class
        
        PID:8440
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        322⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        323⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        324⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        325⤵
        Drops file in System32 directory
        
        PID:9124
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        326⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        327⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        328⤵
        Drops file in System32 directory
        
        PID:8844
        
        C:\Windows\SysWOW64\Gljgbllj.exe
        
        C:\Windows\system32\Gljgbllj.exe
        329⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        330⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        331⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        332⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        333⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        334⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        335⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        336⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        337⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        338⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        339⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        340⤵
        Drops file in System32 directory
        
        PID:9444
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        341⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9484
        
        C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        342⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        343⤵
        Drops file in System32 directory
        
        PID:9576
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        344⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        345⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9696
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        347⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        348⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        349⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9864
        
        C:\Windows\SysWOW64\Ipjedh32.exe
        
        C:\Windows\system32\Ipjedh32.exe
        351⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        352⤵
        Drops file in System32 directory
        
        PID:9952
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        353⤵
        Modifies registry class
        
        PID:9988
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        354⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        355⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        356⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        357⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        358⤵
        Modifies registry class
        
        PID:10208
        
        C:\Windows\SysWOW64\Jncoikmp.exe
        
        C:\Windows\system32\Jncoikmp.exe
        359⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        360⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        361⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        362⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        363⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9588
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        365⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        366⤵
        Modifies registry class
        
        PID:9732
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        367⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        368⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        369⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        370⤵
        Modifies registry class
        
        PID:10068
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        371⤵
        Modifies registry class
        
        PID:10108
        
        C:\Windows\SysWOW64\Kqphfe32.exe
        
        C:\Windows\system32\Kqphfe32.exe
        372⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        373⤵
        Modifies registry class
        
        PID:8920
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        374⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        375⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        376⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        377⤵
        Modifies registry class
        
        PID:9708
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        378⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        379⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        380⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10084
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        381⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        382⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        383⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9472
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        384⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        385⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Lcggio32.exe
        
        C:\Windows\system32\Lcggio32.exe
        386⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        387⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        388⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        389⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9800
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        390⤵
        Drops file in System32 directory
        
        PID:10152
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        391⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        392⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        393⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        394⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        395⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        396⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        397⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        398⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        399⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        400⤵
        Drops file in System32 directory
        
        PID:10520
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        401⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        402⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        403⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        404⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        405⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        406⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        407⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        408⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        409⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        410⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        411⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        412⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        413⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11216
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        415⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11260
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        416⤵
        Modifies registry class
        
        PID:10316
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        417⤵
        Drops file in System32 directory
        
        PID:10388
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        418⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        419⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10564
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        420⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        421⤵
        Modifies registry class
        
        PID:10728
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        422⤵
        Modifies registry class
        
        PID:10844
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        423⤵
        Drops file in System32 directory
        
        PID:10916
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        424⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        425⤵
        Drops file in System32 directory
        
        PID:11096
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        426⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        427⤵
        Drops file in System32 directory
        
        PID:11244
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        428⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        429⤵
        Modifies registry class
        
        PID:10424
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        430⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10624
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        431⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Oodcdb32.exe
        
        C:\Windows\system32\Oodcdb32.exe
        432⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        433⤵
        Drops file in System32 directory
        
        PID:9940
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        434⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        435⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        436⤵
        Drops file in System32 directory
        
        PID:10364
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        437⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        438⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        439⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        440⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        441⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        442⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10732
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        443⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11120
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        444⤵
        Modifies registry class
        
        PID:10412
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        445⤵
        Modifies registry class
        
        PID:1832
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        446⤵
        Modifies registry class
        
        PID:2588
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        447⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6176
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        448⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        449⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3176
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        450⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        451⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        452⤵
        Drops file in System32 directory
        
        PID:3172
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        453⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        454⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5036
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        455⤵
        
        PID:11268
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        456⤵
        
        PID:11316
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        457⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        458⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11416
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        459⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11476
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        460⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        461⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        462⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        463⤵
        
        PID:11652
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        464⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        465⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        466⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        467⤵
        
        PID:11820
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        468⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        469⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        470⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        471⤵
        
        PID:11984
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        472⤵
        Drops file in System32 directory
        
        PID:12028
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        473⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        474⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12104
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        475⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        476⤵
        Modifies registry class
        
        PID:12192
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        477⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        478⤵
        
        PID:12272
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        479⤵
        
        PID:11284
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        480⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        481⤵
        
        PID:11460
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        482⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        483⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        484⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        485⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        486⤵
        
        PID:11808
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        487⤵
        
        PID:11872
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        488⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11932
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        489⤵
        Drops file in System32 directory
        
        PID:12020
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        490⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12076
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        491⤵
        
        PID:12132
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        492⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        493⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        494⤵
        
        PID:11324
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        495⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        496⤵
        
        PID:11580
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        497⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11672
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        498⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11776
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        499⤵
        
        PID:11940
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        500⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        501⤵
        
        PID:12140
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        502⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12260
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        503⤵
        
        PID:11400
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        504⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        505⤵
        
        PID:11768
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        506⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        507⤵
        
        PID:12124
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        508⤵
        
        PID:12252
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        509⤵
        
        PID:11616
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        510⤵
        Modifies registry class
        
        PID:12044
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        511⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        512⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12256
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        513⤵
        
        PID:12344
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        514⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12408
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        515⤵
        
        PID:12464
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        516⤵
        
        PID:12504
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        517⤵
        
        PID:12536
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        518⤵
        
        PID:12572
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        519⤵
        
        PID:12620
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        520⤵
        
        PID:12664
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        521⤵
        
        PID:12700
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        522⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12736
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        523⤵
        
        PID:12772
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        524⤵
        Drops file in System32 directory
        
        PID:12808
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        525⤵
        
        PID:12848
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        526⤵
        
        PID:12888
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        527⤵
        
        PID:12928
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        528⤵
        
        PID:12976
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        529⤵
        
        PID:13020
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        530⤵
        
        PID:13068
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        531⤵
        
        PID:13112
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        532⤵
        
        PID:13148
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        533⤵
        
        PID:13188
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        534⤵
        
        PID:13224
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        535⤵
        
        PID:13260
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        536⤵
        
        PID:13296
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        537⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        538⤵
        
        PID:12364
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        539⤵
        
        PID:12460
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        540⤵
        
        PID:12544
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        541⤵
        Drops file in System32 directory
        
        PID:12600
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        542⤵
        
        PID:12688
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        543⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11276
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        544⤵
        
        PID:12816
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        545⤵
        
        PID:12896
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        546⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        547⤵
        
        PID:12960
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        548⤵
        
        PID:13096
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        549⤵
        
        PID:13144
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        550⤵
        
        PID:13256
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        551⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        552⤵
        
        PID:12532
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        553⤵
        
        PID:12656
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        554⤵
        Drops file in System32 directory
        
        PID:12796
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        555⤵
        
        PID:12840
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        556⤵
        
        PID:13012
        
        C:\Windows\SysWOW64\Kpcjgnhb.exe
        
        C:\Windows\system32\Kpcjgnhb.exe
        557⤵
        
        PID:13140
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        558⤵
        Drops file in System32 directory
        
        PID:13212
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        559⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        560⤵
        
        PID:12604
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        561⤵
        
        PID:12728
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        562⤵
        
        PID:12884
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        563⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        564⤵
        
        PID:13132
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        565⤵
        Modifies registry class
        
        PID:12820
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        566⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3036
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        567⤵
        
        PID:2044
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        568⤵
        
        PID:12484
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        569⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        570⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4184
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        571⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:13060
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        572⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        573⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        574⤵
        
        PID:13288
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        575⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        576⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        577⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        578⤵
        
        PID:12488
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        579⤵
        Modifies registry class
        
        PID:1128
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        580⤵
        Drops file in System32 directory
        
        PID:4048
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        581⤵
        
        PID:12452
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        582⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        583⤵
        Modifies registry class
        
        PID:3884
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        584⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        585⤵
        
        PID:4052
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        586⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        587⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        588⤵
        Modifies registry class
        
        PID:1456
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        589⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        590⤵
        Modifies registry class
        
        PID:1088
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        591⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        592⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        593⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        594⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        595⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        596⤵
        
        PID:404
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        597⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        598⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        599⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        600⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        601⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        602⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3488
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        603⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        604⤵
        Modifies registry class
        
        PID:3392
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        605⤵
        Drops file in System32 directory
        
        PID:2804
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        606⤵
        
        PID:13404
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        607⤵
        
        PID:13452
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        608⤵
        
        PID:13496
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        609⤵
        
        PID:13540
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        610⤵
        
        PID:13580
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        611⤵
        
        PID:13620
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        612⤵
        
        PID:13660
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        613⤵
        
        PID:13708
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        614⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13756
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        615⤵
        
        PID:13804
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        616⤵
        
        PID:13848
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        617⤵
        
        PID:13896
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        618⤵
        
        PID:13964
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        619⤵
        
        PID:14004
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        620⤵
        
        PID:14048
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        621⤵
        
        PID:14100
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        622⤵
        
        PID:14144
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        623⤵
        
        PID:14208
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        624⤵
        Drops file in System32 directory
        
        PID:14252
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        625⤵
        
        PID:14300
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        626⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        627⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        628⤵
        
        PID:13136
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        629⤵
        Drops file in System32 directory
        
        PID:13336
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        630⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        631⤵
        
        PID:13400
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        632⤵
        
        PID:13448
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        633⤵
        
        PID:13524
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        634⤵
        
        PID:13564
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        635⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13652
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        636⤵
        
        PID:892
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        637⤵
        
        PID:13732
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        638⤵
        
        PID:13792
        
        C:\Windows\SysWOW64\Dnonkq32.exe
        
        C:\Windows\system32\Dnonkq32.exe
        639⤵
        
        PID:13888
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        640⤵
        
        PID:13892
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        641⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        642⤵
        
        PID:13996
        
        C:\Windows\SysWOW64\Edplhjhi.exe
        
        C:\Windows\system32\Edplhjhi.exe
        643⤵
        
        PID:14044
        
        C:\Windows\SysWOW64\Ebfign32.exe
        
        C:\Windows\system32\Ebfign32.exe
        644⤵
        
        PID:14108
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        645⤵
        Modifies registry class
        
        PID:14140
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        646⤵
        
        PID:1168
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        647⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        648⤵
        Modifies registry class
        
        PID:14332
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        649⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        650⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        651⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        652⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        653⤵
        
        PID:13344
        
        C:\Windows\SysWOW64\Gbkkik32.exe
        
        C:\Windows\system32\Gbkkik32.exe
        654⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        655⤵
        
        PID:2008
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        656⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        657⤵
        
        PID:4588
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        658⤵
        
        PID:13568
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        659⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4892
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        660⤵
        
        PID:956
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        661⤵
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        662⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        663⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        664⤵
        
        PID:13864
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        665⤵
        
        PID:13920
        
        C:\Windows\SysWOW64\Ilkoim32.exe
        
        C:\Windows\system32\Ilkoim32.exe
        666⤵
        Drops file in System32 directory
        
        PID:5636
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        667⤵
        
        PID:13956
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        668⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        669⤵
        Drops file in System32 directory
        
        PID:5380
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        670⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        671⤵
        
        PID:752
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        672⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        673⤵
        Modifies registry class
        
        PID:5468
        
        C:\Windows\SysWOW64\Jifecp32.exe
        
        C:\Windows\system32\Jifecp32.exe
        674⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        675⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14176
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        676⤵
        
        PID:14200
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        677⤵
        
        PID:14216
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        678⤵
        
        PID:2336
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        679⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        680⤵
        Drops file in System32 directory
        
        PID:4108
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        681⤵
        Drops file in System32 directory
        
        PID:14312
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        682⤵
        Drops file in System32 directory
        
        PID:6136
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        683⤵
        Modifies registry class
        
        PID:3752
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        684⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        685⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        686⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        687⤵
        
        PID:13328
        
        C:\Windows\SysWOW64\Lindkm32.exe
        
        C:\Windows\system32\Lindkm32.exe
        688⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5804
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        689⤵
        
        PID:13376
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        690⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6072
        
        C:\Windows\SysWOW64\Lfiokmkc.exe
        
        C:\Windows\system32\Lfiokmkc.exe
        691⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6132
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        692⤵
        Drops file in System32 directory
        
        PID:4088
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        693⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        694⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        695⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        696⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        697⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        698⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        699⤵
        
        PID:13816
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        700⤵
        
        PID:1656
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        701⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        702⤵
        Drops file in System32 directory
        
        PID:6508
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        703⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        704⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        705⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5660
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        706⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        707⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        708⤵
        Drops file in System32 directory
        
        PID:2284
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        709⤵
        
        PID:14112
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        710⤵
        
        PID:14128
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        711⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        712⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        713⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        714⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        715⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6620 -s 400
        716⤵
        Program crash
        
        PID:6056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 6620 -ip 6620
1⤵
PID:6712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bedgjgkg.exe

Filesize
182KB

MD5
9213473e91a575f0e8a8b40f427286b5

SHA1
c472768490b328d2ef16e133ca3f35a21c7d201c

SHA256
5ead6f8f7a02d1b757e927d2af0c84f0179bac2900fa6cbe73459cf80ecd45d3

SHA512
e5f6f053aa9b716393aa34a94ca86ffca78fca417bf2e9376c50b294ac422a75ee0fc653302ddb712b90b8b002519d638083f62a5ae5e817e0654e4a53694004

Download Submit
C:\Windows\SysWOW64\Bgbdcgld.exe

Filesize
182KB

MD5
595d6d31a27d37ba6d3ee8e926c11744

SHA1
2ee74780039e50e736e6e64ac627509aeaeb3af9

SHA256
47edf794d6a48c5a0da34668fe2eccce8cbec3ff1fddef34da54b62a8a50d5fb

SHA512
37c57887b1ef0787b58463a8e5e2b86e184b07d4c4a79465e371b2c52afe4fd7ad144aeba6183a2a97bd2fa4c5fbca8f1d7de5f650be774b6ef2b31dbfd228cf

Download Submit
C:\Windows\SysWOW64\Dckdjomg.exe

Filesize
182KB

MD5
3181b132671b88974fe5dcbcc0ad120d

SHA1
3834004213a05e17c9349b8f564940227ba17832

SHA256
87d5b48af2ca3d7208da81792da338cb570c21db931a59c740bbefd178e7be8a

SHA512
090773806550d305b49644e97045426dfe9c354ae982da0b82a54ab9b0f97945765c8b0adf6f0315fb5d95b83de676331001496ab91386a1859c0170b8ed9de2

Download Submit
C:\Windows\SysWOW64\Dfiildio.exe

Filesize
182KB

MD5
e37fd94bfcda5f3fe3f69fe7dbeb31fd

SHA1
1006165b4d0c321f98b3c6db583188185988d4d7

SHA256
c5693503ab29b27178622b040013c7142f58814ab32acf1216a290f0481ac47c

SHA512
9af14736247fdfadded3ad3d8b9e9933ba67546a28fae708a3f24321c88e627234a991b09f32b6fc3a9020d1aa087f7574d13de85ba21bf5f405ea61c56956f7

Download Submit
C:\Windows\SysWOW64\Efeihb32.exe

Filesize
182KB

MD5
ff921608ddaaf07ac739f89daa6055b1

SHA1
0c4aed5180ea22594c06cc28f3a99210878fef72

SHA256
6032e3ac1723c013d7b96b4c62fd6e4be0f00b4af24dd412b0fefe0f5ab4ed97

SHA512
582b430f5bfd00c87625d7810e4b2d32c0b943e687363f591a94c9af147125ee2ac5ede7d4aaaa363ab3485f8e4dbc4c2a65bd1fb135547eb4db89e434792f6c

Download Submit
C:\Windows\SysWOW64\Flqdlnde.exe

Filesize
182KB

MD5
65825725fe83a23c7e53e5b6c3007991

SHA1
8a6a7ade6fca9703f93fa1be36fe865f55ebf3c2

SHA256
f3b3f065e47c12e37a8842b9b2b5851bee849330c6cb31827a7f7aae64db0dac

SHA512
43047ef9621521c2955a9062a8c692bbf46770824de209bb5f77ffb702f2964613d8a9a655b7b33460e42ec24368e6ca27708e4cfb25748e8136943a6bbe4a6e

Download Submit
C:\Windows\SysWOW64\Gbabigfj.exe

Filesize
182KB

MD5
f57021a7daadb9bf691c7218e1a472ba

SHA1
1895d23164ca5f17cdb8d0a5599e778184ca2cf0

SHA256
3105caad1dcf10bf8a19cb5079801d878ab47c07d9625679b3b474a78bd89789

SHA512
e82ee88a85b9b8307f05d37d968b0c9d7f281c7dcba543ead799646e80fe2e24ec00e92b99d229706a329391bde4b8d0859fb3c38d4d8cae99e3ee32a18be8c9

Download Submit
C:\Windows\SysWOW64\Gmfplibd.exe

Filesize
182KB

MD5
4669e083ed30803e5d8f7052f510c98f

SHA1
87e7af73a4406042ed5a16f4d18763fbebb23dd6

SHA256
4209530c8c26f4c95effa416153bb528cf32a22474ab98ebb1b942fb1ba89f77

SHA512
2f65daef28d5d7688c965fdf28fb940c2c4085d5e4101ee9c46b870d7237ecba39315104ab5d8930081aa21e61b4700c22e65f932d32d04c2583c36d76c39d8d

Download Submit
C:\Windows\SysWOW64\Hlpfhe32.exe

Filesize
182KB

MD5
700ff06093e652d8d8b09348571c4b92

SHA1
1956e81cd7ef03e9a260c0498e3a2d0a58214e18

SHA256
4cb6f36587ab26aaa3e094cf0cbb1e7170397789f0232c736178802c3d5d02bb

SHA512
81753446e6be4da75ef069531a28e1e55717f9aa5b739bb07e421c25fd5367723f6db4739c113d38a31536736868a9805b4655debc65ccaf3a41efe7cf3b3283

Download Submit
C:\Windows\SysWOW64\Ieidhh32.exe

Filesize
182KB

MD5
dfa48bcc2e06b9ed4d59667dca53aa6c

SHA1
200feedce0e16b2649466c0d8a6dd23f0f68d6f6

SHA256
c27522d1ded487c13c49831bd8b38ebbed5a33019f0c9af879ca1e1dbf24bfc4

SHA512
5b30578909cdad4a369f4b29323d0e6a8c1a0d628593204ffe0d878a26b3e9bc24a750b9ec7c539de2928905eb6d22e66ecd1b1b3f6f09712500a9f2666513aa

Download Submit
C:\Windows\SysWOW64\Iojbpo32.exe

Filesize
182KB

MD5
ccaa4222b9b85e8e96fb575bba0126b1

SHA1
d3f801dbe1102577660d7c321489e99b4422e87a

SHA256
20867932acfc0f389041bf3f51d94408ffc4c6b5fcad7f77787ab1eb4459e7f6

SHA512
0ec14041d2fedeea250fc2563cd56c136d7e7c9a4575c05cc1beed7c4c2ff29848139faa2869e3951385070d5712802ed4d21c4e7c703d6aa0c5237043895155

Download Submit
C:\Windows\SysWOW64\Ipjoja32.exe

Filesize
182KB

MD5
7669796ca423a2213ce540f937a9a0a9

SHA1
ec8eb70817c69f4c0743bbe99b62d9a215df0497

SHA256
8cf5d1e615d1a0b34ffe955799b05336ab8d2d5664ea93a84c3bfddb2b1aefc0

SHA512
7c7d4672ceab44fc5527ae4062910a18fff299593819d9b661140d8e2d3f774add43a31f1b477906c4836df1905a826125e6a4f1cc7bd9ebbb3dc7afed3f4e8f

Download Submit
C:\Windows\SysWOW64\Jehhaaci.exe

Filesize
182KB

MD5
f044c4fc5a5db7753a7ed340d8e20071

SHA1
738af121f552ee3e176af16ecf8b4f517f6a8927

SHA256
9a22fe81f11d579a683d6c5314efabf667d03116d06fc1385c121837a833132c

SHA512
c5b229899be346dc6a008027e95983dec63f1350139a6da032b092438d419dcb0650a667c0cb4c8b5004cbbf532abd262a9bf50a7f793d6411525c2b806ce1e6

Download Submit
C:\Windows\SysWOW64\Jgdhgmep.exe

Filesize
182KB

MD5
c287a19c8aa9d408ba1775d8a2143308

SHA1
0dc041d0eb3abbf5afb4896a82451e2baaafa77f

SHA256
e48cc3b5ffb0f9b45b4d4c15aa695425e7ab4c916f0ea1bc4b9e226781b309bc

SHA512
338c387453f8a85f47d68b3d076bd71b95ad7fc4bbfea2dc2a7bbc44ce422e382bb6830af59300781d23c3693141751366eeff3c8a67d632203397d0fb840589

Download Submit
C:\Windows\SysWOW64\Jgkmgk32.exe

Filesize
182KB

MD5
42dbfe76081e1d4e98647612f16a60ac

SHA1
aa4fa85797973e4f64d5e42bd988c58f104219d6

SHA256
9603d01994c667456ed6304f331fac9b263a4e5cf5f64893540932cdc419f893

SHA512
45768e3dbfd24b90d50211ff670b7a0b0385d6872ebeb38579f95ed58cddac358d5a2dfef5c954d7e6bd61a6697a63db6e64d770b86a146cf1e632c305eb354b

Download Submit
C:\Windows\SysWOW64\Jnelok32.exe

Filesize
182KB

MD5
11bf2f757ba93631bfd142588b0f3e2a

SHA1
cefa5bc4d002dec8e1519c9d4604993e60a5d186

SHA256
a8ea1c2d277c09d883ea257066f5d067ab07287ffcfcb9b90f6e24df6acd450d

SHA512
4d21a79b91242316f64fd637697e4f2f581ea38bdb5e62c4367dd72790cb299da1318d7e34e6c0dbe39c9667760db258fa9e8e6a998459e69629f4b8102f2472

Download Submit
C:\Windows\SysWOW64\Jnifigpa.exe

Filesize
182KB

MD5
3f04c3f3a2d95fd6af840f25f8052245

SHA1
ef2537029e33802e0a2cf104612178b0e3c13e7d

SHA256
086b9ec114d5060512a4a8f4c726cc17f6512fc7afebc0a837cd0621de4c4863

SHA512
7432b1965ff3539a947611fa031fa4311c9b4e3bb7c1d02ac722f45a4aca001d063f91a446f549c0f939651539a434d7c02cedbe1dd57c6497089530ef0de8b9

Download Submit
C:\Windows\SysWOW64\Jnpmjf32.exe

Filesize
182KB

MD5
1238b90d7152ec3108180c8cd7830fab

SHA1
f131cea9089436dff31e129edd4ea05d392f860f

SHA256
6d954e754eb192ee8010bf0f1a16de651894310bc06a5b1526fb6412d409e9d2

SHA512
0c9f8dd1c0816e1dc7c175cd1e38546dbca84ea57b44462258a994525c077bf08cd2a221b58db798056a9384ea46b4b95450c0d4cb52e087d6b1cff38904222f

Download Submit
C:\Windows\SysWOW64\Joiccj32.exe

Filesize
182KB

MD5
fa8ff4459d8c8ab48957235ffbec250f

SHA1
0cc299b695820897bff14d3fac072b8dcf7d50fe

SHA256
08c20c6982ae6d1f34e8216c729b6a042ff1d8b6cf0ef9bb757886df94461625

SHA512
efa790180ceabbfe9bbc6542700d7ba097cf8f735a52cb3cc723feb4f34e2f3c540a70839af65d61e444ea4c4bbba0a135ed602c7075e5f265157b426d8913ec

Download Submit
C:\Windows\SysWOW64\Jokkgl32.exe

Filesize
182KB

MD5
08a4636fd9f6952d42c5137c43d0731d

SHA1
3142ef50025b75b4aaa063f12367b42f415d1302

SHA256
a7d81ddc6c5b1ec8b9a0c1ab0c03f8addec59d834fa01fb461407acb3e95a1bf

SHA512
178f3a27c6ffc9a4a293e828dee2917691f7b4224950db6c8237e79ea7c85342d4cb4bb0410bd76ca4beb73c5c424d61641ac6ba308b622bcfc2eb09fb543dff

Download Submit
C:\Windows\SysWOW64\Kenggi32.exe

Filesize
182KB

MD5
b250a50fae264093fb9bb85f20958c31

SHA1
117fff6700eb761de63f64c9e34f6ba9701a360a

SHA256
87b6babd54af3e85f1bb20692a3edde719675b567539239399be49be707c4f31

SHA512
f5409eccffd3e78200aeb4f56bc85f351a9460d67927419f4e4fc05f307ab8c3bfb82d02944f037f188669868f75bbf8ae8a40d1ee486bd6dbe673bd74b79414

Download Submit
C:\Windows\SysWOW64\Kfcdfbqo.exe

Filesize
182KB

MD5
875395498c26df9aa06f44f3dd3517a5

SHA1
8f30d4febc391e8bab6d44afe1ce4b7d231451ef

SHA256
994286871cad113a86d7b7ad719b41638abe9cdce031ce09d763867a3e17ed18

SHA512
bbd17f94d663836bf58a04b6b8a5224164a8ef92b6aeddb97a911c322683f7e238ee4f24171ec0db6ee5ef55ee085b95a6c2d93bfa05702249f1d9c83340a7c0

Download Submit
C:\Windows\SysWOW64\Kflnfcgg.exe

Filesize
182KB

MD5
e6f8f9498dc9601ca973b82db60c4d0b

SHA1
697f72adfc07146b5cfabcf8532fd3c5fdd13a85

SHA256
65f1f41abd873b2f1f8a7fe26225fa7bb2809d09080108790e12912f5c785420

SHA512
1e62ddd4f9835998f4482fff0c3f2d816f8d6f485672c42a9512dc6e9b54f9691fcc0eac7270f78a34e30bd5f4c066c65f04b1ac2dd833e4be1ffc43f47f4854

Download Submit
C:\Windows\SysWOW64\Kfnkkb32.exe

Filesize
182KB

MD5
0dfa8661c67f37ce4e53ddc8d1341198

SHA1
8139816f31b7fa1432c7a49e224f02dc55704748

SHA256
0eddf9a124aa07a563394b336a9d652d5d282d5d61b7c8c8f9efae8afe0f1913

SHA512
fc45d08cd9f447bfd5ef7b7f4a70fd858c73fbe63fb77c91df3f1a83af7933d6110dc75188f81be212a2cacda42e3830e9bc20508dec2393f23c41adbb8d50f5

Download Submit
C:\Windows\SysWOW64\Kfnkkb32.exe

Filesize
52KB

MD5
a469583ee9a378c0f240b2966c884736

SHA1
6958b66e4619c34e76c6097039a4d9516c3ab188

SHA256
0752d4b5f384ea86228e5f3fd94abbf2ed83353f63f0c2146f7c57b60b977fb0

SHA512
b4f44cf8f1b63fc44f71523259a09b81850622312851b8f2c5875addb337199b7c684bd35fb96ef14cea84042fe9e3fd72c21985d9add8c504235e4afb6ff96e

Download Submit
C:\Windows\SysWOW64\Kfqgab32.exe

Filesize
182KB

MD5
4047c1b2afb0b7bcd916031797194b89

SHA1
277e6f8cec96dbab0bc090c2eb062a9f5fd08eea

SHA256
d87e65ea26853b1501288cd013f6ffbf7c3144c2a735b89c53e4fda033382c9a

SHA512
71e6442814f6748b225151a50fa093bb79e080c7dacd7b5adb06b69f90daf2ee7b87fd70141ab29bfda44a8bd3d760e375568d29a6ca7c057b10e885ecb90c61

Download Submit
C:\Windows\SysWOW64\Kldmckic.exe

Filesize
182KB

MD5
56c3fff09cab0370e7d126da4e975d70

SHA1
1368956cc8d2ac9bf767672a1e0fb05a232a1f94

SHA256
f8b9168c9e3f0b0de79b4c67471d47096f5c471f6956589a5f596c99ef8734d7

SHA512
2de45d77804e62004bc1a4a31ed09b269bf1ed53a53b16414af6edc1d115957199377c6e7705d1c9a1c3ae93af4cd015fb56604fc60236421aee42477bdea562

Download Submit
C:\Windows\SysWOW64\Klfjijgq.exe

Filesize
182KB

MD5
1c5b5777d4d9980c010dd83e955b6a13

SHA1
4b903c447d7cc5f541fb81d556c53dc081329ae2

SHA256
6d6a14475949cea97877dabef29f4970966c3203851f1ac4658c688129c2c329

SHA512
9b9d805c1e612ed761c23301b85788b8815cbf1ed9ea52607a2d38e31840b18f62bd412379633e330114d254a095bc1cb95622bc3306934c01607076eeb19e91

Download Submit
C:\Windows\SysWOW64\Klifnj32.exe

Filesize
182KB

MD5
afff8d5c50f63e444d43571af7bd7bd8

SHA1
881ef72d923cf3b46c82dbb6b8d413680cade808

SHA256
70a5e7d8e747a68014ec7b0a6079021747722b2ac949349f5e69d792bb16279c

SHA512
449edfb9643bc62e3a3d7fad8521a9f930c6f6e08c66ef912379a59fe0e4c28d9344c8e181a313a69452395f55a4dc816a8520485b5c41f4a7e6bf75b876c053

Download Submit
C:\Windows\SysWOW64\Kpiljh32.exe

Filesize
182KB

MD5
888f00249c24c08b193f10680aa257c3

SHA1
b0f690bdbd2e077bf03509775518bae6e4a2e6a7

SHA256
2d975c454d282b2a8b663062074800e9295aaabf63795cb24edc0062e29713af

SHA512
b8f4442484e1535a993ce5f80225c8725d5d0b1c5b32fbbc51c35d3e91eb9ccf921b25daa75bba275684a221d7bdf1bf2a1d209c07ffa85e2f9757dd9da2c9dc

Download Submit
C:\Windows\SysWOW64\Lblaabdp.exe

Filesize
182KB

MD5
678ac6c9691e725f6b8e558c7afdfe73

SHA1
de0b55e0110f8ebc007a6a24e3f8d143315e9de3

SHA256
d9eda39a6bbd41ad8d9b7628473fcb29451b75540ca25bc02b13137086ed72db

SHA512
8d865668326e9e62ef24b4a6b3797c169a718b3553704244f959131eda1c6597d699e721291d8e845a008045608f736782a6bf0216951b919c805fc6d68bbeb7

Download Submit
C:\Windows\SysWOW64\Leadnm32.exe

Filesize
182KB

MD5
062ad8690ce39230a68ee95ac6e2b86c

SHA1
c6deaa8ef12e6e08081bff39239a79c68068032c

SHA256
3560ed29131954e14a39e5af96d282fb8b236d0ecc1388d219c9a5bacc22968f

SHA512
75def6cdbfefd3b800692662426140f47f7d143fae71c55f82ce09ee31de79a9de26d55aad60980135cb5a55d57e9ee824662e5ed11c9e72cb19481bd4491f2d

Download Submit
C:\Windows\SysWOW64\Lihfcm32.exe

Filesize
182KB

MD5
7f5d063f3713f9c866289e0ac33bb170

SHA1
e75e502761662909bae5ad77e7f80e287afb038e

SHA256
689a299f02a6af84af84600bfb3a4d1c3bcdb44c810f22e38201734eee98bd90

SHA512
071a70c883771989a3b3e4add4af83158ed4801a1d8fdc88e254db6f43e834593ccf736656064c43bf4969e785eeccc703bee5a7879dd95f8e1be312ddb03723

Download Submit
C:\Windows\SysWOW64\Lldopb32.exe

Filesize
64KB

MD5
2830a20fc31842c79221134d15fe4ffa

SHA1
f70cd62f52e596ea869121e4b3eb398a477f40ba

SHA256
49bcfa19f961de68d300b5802e8c02a56a95f67473a04e64536a07686bb68bde

SHA512
c765168edfed0bcf25f45f957b91855344094331c7ca3ecf03fa9b8094b538e8b452ff43491659b70ac28740ca59472db4cc4b7fb2283eef2aa1098bc03ce6b7

Download Submit
C:\Windows\SysWOW64\Locbfd32.exe

Filesize
182KB

MD5
d64dc9c7845b44b6229684872c047044

SHA1
7e2370bed502ba90cedbd97696f26d0e7d32e7c9

SHA256
286c4cf260af90d148781d8aa12f3574a0a0c72e3d1c1206e2224683219196cf

SHA512
ccf2226922b0836bb5ee01ac5283871fcbb05fa0e7f126b7a408d90d9d93ca307c119af8fc055804028268f591f579533a939da6a69a94f5cb639db4740de68b

Download Submit
C:\Windows\SysWOW64\Lpekef32.exe

Filesize
182KB

MD5
8b340354702024dcabf08edfb2c42a28

SHA1
13e89b6f9d7eebf514089b01d74b29dca4c4025a

SHA256
b57cd503bd2780f58af173e748a4db2cb4048a14677813090227326755109b20

SHA512
458c1ff125afbd6297b52311c4d7fd4d374d6b40b72f0006333dc8e730a163ff7e26d9d7d20d7132e5cee46178e4d70a248ae95c452e290dc3b493786384bb4e

Download Submit
C:\Windows\SysWOW64\Lpkiph32.exe

Filesize
182KB

MD5
0d44ad985c0a4b96ad6c2a1e7bd7f34f

SHA1
8001a85a378ff06b473d1c499363ea4ff0b1ff66

SHA256
f62f57e2d2cd9eb19812b8ea543e41e0eb1ba69b33d7b42c24874cb316dd1ee0

SHA512
a43647653b226f143a46cf214be93547c702a0a36a26bfcb95828c5882ff7bd5464e2b029248f849a62ba4b4ee7a3880ee1555ba5901b6ccca0c58d05bf9fbdc

Download Submit
C:\Windows\SysWOW64\Mbhamajc.exe

Filesize
182KB

MD5
f969637cb56bcff2a27875891460a2a9

SHA1
98065823db53711dbb61e0a4571c78ddb48da9d2

SHA256
d29edfff6b883a1f96097100ad118aa81b15b7e39be65b8d2aebdb878ed38d69

SHA512
03b561ea69f8bc76d276cd72f5582b71809a266e41a0dd224716624f151bd5e637b46cf9490ecf6419a512f2878eb16660a16c4deefd39916404da9ff24f0b70

Download Submit
C:\Windows\SysWOW64\Medqcmki.exe

Filesize
182KB

MD5
55fdb8b788fc8d30ea977a698e5919f5

SHA1
c9f6104e790d76f90c4832f1151d959e232c41f5

SHA256
a701f88411eee70b10c91d0d22c2e424a3f6dda030984401e9e4d2cebfe03c33

SHA512
7b53c9ff2dc0ed0a28c4b6170d2c86030a131757b95fdd8241762587bed5c0feb2cc2f4895c8b12b26bb0da1b1e609c61fa1e3f12804398faf469beaf7ac2779

Download Submit
C:\Windows\SysWOW64\Mehjol32.exe

Filesize
182KB

MD5
863bbb0ef8d75339e674a4a964746aa0

SHA1
39ee2dab0525ea86f7ed61942f9a1c464a2bc593

SHA256
8c6d04af889e1b77f291b6399354183dc500c89e573b33da3e59306a2db9fba6

SHA512
581cc34250aec5fb8c4ae05320512307ddbbdb184cedcaaf28ba6925257f931b96b7d0d45190c57a0316636e148b6c64279012ba00a31bc6c28e36fe409874a4

Download Submit
C:\Windows\SysWOW64\Mekgdl32.exe

Filesize
182KB

MD5
82fa80ca87b74950a69fcafa461f005d

SHA1
2dccd00138dbd4130c6c82ff1ef171a52b3b82d4

SHA256
8187056cc54d405a3e177ae30c58ad5cbae9303a6f72665ac34a4862b033c9d3

SHA512
ab9edd7b8eea9b44a5d56b5762d85bfabcbf43b381ecc9632feec64e1e1e7e8738add0d5aaa01a7294e47ee621902318e2191de856c8c83148cbac241930ff73

Download Submit
C:\Windows\SysWOW64\Mhdjehhj.exe

Filesize
182KB

MD5
cfc90c61c544f0ddd5894ca6d16e9df0

SHA1
d2de3e363019157ed4a860710a1733199a1864a6

SHA256
3a9ea3eff599bd0f84f1567bdd0d0b3bc5c6614a1a0fa1ecbbfeeb7c10339d8f

SHA512
a14ad84b8cb234c07600705a8b6953122b784065a8d582f01a161083213a671e2fd4b4abc64af975dddfd3e101b038e11a7f4f988982887c54dd7d53fda11b8d

Download Submit
C:\Windows\SysWOW64\Mpghkf32.exe

Filesize
182KB

MD5
165ec51152fac4ee38fdef3f14e27af6

SHA1
c760e285726583ab7bcfd40bc33bd9d3ae42267b

SHA256
04775b5745d42bf357c27977ba84dc4d8a01ac9016b42b5c5e3012b2568b0ec1

SHA512
c0045211de656daf031f8069e6cc0e69dfe1c235a347425b1a8dcaa84105e4ab6082d9637e29669800acd0701d1b5fcaef63658b1cfde8979974a2b90933dfca

Download Submit
C:\Windows\SysWOW64\Nedjjj32.exe

Filesize
182KB

MD5
7268cb8af6abfdb586767376b5724b71

SHA1
e07d2de26eab9a999f7e6d87667342b34573433e

SHA256
0f957c908f0b5c66af42610e477f5f85c3a30255b692f0ba66f5968ae3cbf878

SHA512
4a8906875fccc3142e96665b56df4f2266edf03815087636c93ff08a2ca9e1638829d9aea8998ec47dfff45ef666ef316a9dcdf26a466737c70deaabf973e82d

Download Submit
C:\Windows\SysWOW64\Nhlpfgbb.exe

Filesize
182KB

MD5
5ea4084e316c802163574437a269ac13

SHA1
f5cc77dda378a3f102c9356e1326ca306350db2b

SHA256
27b8193637723f15c720439e85c16f7fc438267feb97f6e32690d4ba9ace9f60

SHA512
cf30b0b25d35a4198d527c7eb3575e110939c62b89bf777547b3965c29362f39d065655a7ab77800ce5c5fbe23583945b4342446878d087aebfdfe1e367807b5

Download Submit
C:\Windows\SysWOW64\Nomncpcg.exe

Filesize
182KB

MD5
fbb4f4808e0ede1ea6d7cc2c10fb0683

SHA1
fbd1254cda0354f461705799e1d7c0ab4f60a674

SHA256
6f2da736e0aed7459c4fd862cc01967736212dda558e4ab59f7609e716a894de

SHA512
5a8b900e252e3eeba78e763db44cb21d741bf4b8fd16e93965ae318e9b7eb069fb32a9c7cc12d3b66dea9df2f0f3c546c2b627107b0aff2e5fbe211fdb01ae11

Download Submit
C:\Windows\SysWOW64\Npedmdab.exe

Filesize
182KB

MD5
f79146734727dc1e55a7998bfe4c8c8b

SHA1
fe305c5599cbc0d80e8c44f3a6f197146b6db68a

SHA256
9397a7c376bb4c9e5eae4514b1527726e27624d550737f91dc5fddc975199a01

SHA512
45693e1eb7b1c0a13d256aedd712354990e9fb32fe5846c15b4fe23530f0316027a48d0b2a1b32a3a2edc847a2fd5a64b7f451be9e34a1aeff3a17052e19c60c

Download Submit
C:\Windows\SysWOW64\Npgabc32.exe

Filesize
182KB

MD5
dab61d51559602c2ad68de47a076e2ac

SHA1
8a47b8b70f8e000026829356bc645e793abeb5cf

SHA256
f4e684255160cab52703279c7dcf89c7f5c3b8ca5cf3e348e82ff148d3633aad

SHA512
945d75ef560c7498eb8d78b9aff24a0355ea8e05ae86ff485a4e64f06c4cb0cc2e42d3b0c6e391d2ec079bde7850781d4beec5c4218fbd64df0f17e97773be46

Download Submit
C:\Windows\SysWOW64\Nplkmckj.exe

Filesize
182KB

MD5
b775878a5fac14cdfe604a5a767e14a8

SHA1
64ac17a964ff4f131f34334149674903818d0482

SHA256
286265fd96a871a3b71d974a349cf6b6e65f876b3a69001501b7de3e5eb6609b

SHA512
abc69d4c975bff6bad62f4bc709cbcf542982c6cc15da4d3476c49e88ee489930d607d1a21e910a3eb57d42cfa5591fc4eeff8e3e50123b5f770e37851e3669c

Download Submit
C:\Windows\SysWOW64\Oeicejia.exe

Filesize
182KB

MD5
334e3039a8009f207aced6c4f926d40c

SHA1
9f3b003e2adba9fe9f4a8ffe2fd2148804d3f044

SHA256
7bbb43d27f0a53d4012b5f1609b38df0971abce5f2c4fff37cbbdc11a9bbc486

SHA512
735d9a1188e562858694fbe372617d288759c9c3c424933f440f7e9ee1897993d23e9acd5f40eed73de045e15d42610cdd88572781efe42b8ed2373c55c45991

Download Submit
C:\Windows\SysWOW64\Qcclld32.exe

Filesize
182KB

MD5
e812c3eeee2c9b4d78ba0c8b587147f9

SHA1
a43f162690fa107cbbe341fc81c47ccd4efc2de5

SHA256
54f5394d71d99aad590c78ad93e9b25a28b357cb3907c95e1f89b59987fecdb4

SHA512
c944fb4b3842adfb4a479e090b9496a603d48d7b34da6b37a83d3124c9820019d2823422405eef61fee83f5bb0e4716b34cf5c701d237de8d531e746ddd4fb74

Download Submit
memory/224-199-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/336-168-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/548-382-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/556-72-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/732-370-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/860-48-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/864-252-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1000-232-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1032-151-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1160-239-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1164-268-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1240-394-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1256-175-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1260-442-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1376-310-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1460-191-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1604-8-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1680-120-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1984-304-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2012-183-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2104-340-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2136-215-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2172-418-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2256-280-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2300-31-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2312-292-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2332-298-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2400-405-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2556-406-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2680-424-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2796-436-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2936-39-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3020-327-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3076-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3204-346-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3244-332-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3264-96-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3308-256-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3388-223-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3392-286-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3432-435-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3488-274-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3696-334-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3948-112-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3968-412-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4004-376-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4048-160-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4052-144-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4076-135-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4084-393-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4192-352-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4372-262-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4440-106-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4508-358-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4644-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4652-208-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4684-364-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4760-320-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4792-128-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4856-88-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4952-68-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4992-79-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5044-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5060-23-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads