a1d43cc6da4407069093437a9d58bc632c2c08ab0ab0e38a6cb84d1c4e240acf

Analysis

max time kernel
153s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 21:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a1d43cc6da4407069093437a9d58bc632c2c08ab0ab0e38a6cb84d1c4e240acf.exe
Size

192KB
MD5

bd117ac1a92a5e2e606b0303f072c10c
SHA1

c882434b4f67b5490b4c288d163fb009962414cf
SHA256

a1d43cc6da4407069093437a9d58bc632c2c08ab0ab0e38a6cb84d1c4e240acf
SHA512

c0ccb6e1628bc7c323f8a8bb1bc02c26a32a1a5210d6c97cde96e8d3080fc217c433b3d1213c6998efd6bf57d7374348d1fbe041fb8419cad918a31207e0932a
SSDEEP

3072:tdU+leuWsAqJfnRigyYq4YJH681+jq2832dp5Xp+7+10K0k7SS6S+psBB6sS:X5MDsfnRBTsa81+jq4peBK02SjSM0zS

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Napjdpcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lobjni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iijaka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddadpdmn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjdjoane.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qhlkilba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cimmggfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lppbkgcj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcdala32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adfnofpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hiacacpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iinjhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmeede32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kckqbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nhbfff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cobkhb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Codhnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmoiqneg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmdcfidg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Joekag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjhbfd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nopfpgip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajjokd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nibbqicm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agbkmijg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Okchnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmpqfq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gblbca32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Plkpcfal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fgbfhmll.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bckkca32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcigeooj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgfapd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nndjndbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oidofh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ganldgib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmidnm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnfamjqg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfogeb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Faenpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jqlefl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fimodc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jqiipljg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mhfppabl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffclcgfn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgfdmlcm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfjgaq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehhpla32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpjjac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmcdffmq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjmfjj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjdebfnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnfihkqm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iohejo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgphpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgphpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfcabp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alcfei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkmkkjko.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pmoiqneg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffnknafg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fnipbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Joqafgni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ciihjmcj.exe

Executes dropped EXE 64 IoCs

pid	Process
1588	Cdcoim32.exe
4840	Cnicfe32.exe
2388	Ceckcp32.exe
4072	Cjpckf32.exe
3412	Ceehho32.exe
1536	Cegdnopg.exe
3544	Dfiafg32.exe
3012	Danecp32.exe
4776	Dfnjafap.exe
2476	Dogogcpo.exe
5108	Deagdn32.exe
1652	Dknpmdfc.exe
1112	Eecdjmfi.exe
3064	Eajeon32.exe
4764	Edknqiho.exe
2604	Emcbio32.exe
3112	Ehiffh32.exe
960	Edpgli32.exe
5000	Eoekia32.exe
1516	Foghnabl.exe
4824	Fddqghpd.exe
2576	Fnmepn32.exe
4452	Fgeihcme.exe
2340	Fdijbg32.exe
4084	Fdkggg32.exe
4828	Fkeodaai.exe
4048	Gkglja32.exe
3324	Gaadfkgc.exe
4912	Ggnlobej.exe
2116	Gadqlkep.exe
1280	Gddinf32.exe
2240	Ghbbcd32.exe
2320	Hdicienl.exe
4332	Hbmcbime.exe
4324	Hoadkn32.exe
1580	Hdnldd32.exe
4068	Hnfamjqg.exe
1592	Hhlejcpm.exe
2712	Hninbj32.exe
3164	Hhnbpb32.exe
1472	Ibffhhek.exe
1528	Ikokan32.exe
840	Ifdonfka.exe
1100	Iickkbje.exe
4736	Inpccihl.exe
936	Iiehpahb.exe
1576	Ioopml32.exe
1096	Ifihif32.exe
4384	Ioambknl.exe
1524	Ifleoe32.exe
3192	Iijaka32.exe
3616	Jngjch32.exe
696	Jkkjmlan.exe
4624	Jkmgblok.exe
4596	Jeekkafl.exe
2684	Jnnpdg32.exe
4792	Jgfdmlcm.exe
4468	Jblijebc.exe
3740	Kldmckic.exe
1180	Kpbfii32.exe
2196	Khmknk32.exe
5100	Kimghn32.exe
208	Knippe32.exe
2444	Kiodmn32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Dooaccfg.dll	Ccmcgcmp.exe
File opened for modification	C:\Windows\SysWOW64\Danecp32.exe	Dfiafg32.exe
File created	C:\Windows\SysWOW64\Aijnep32.exe	Acnemi32.exe
File created	C:\Windows\SysWOW64\Moqeaphi.dll	Fpeafcfa.exe
File opened for modification	C:\Windows\SysWOW64\Fpmggb32.exe	Fmnkkg32.exe
File opened for modification	C:\Windows\SysWOW64\Lajagj32.exe	Knflpoqf.exe
File opened for modification	C:\Windows\SysWOW64\Aoofle32.exe	Akcjkfij.exe
File created	C:\Windows\SysWOW64\Ghpkld32.dll	Aiplmq32.exe
File opened for modification	C:\Windows\SysWOW64\Ilccoh32.exe	Ikbfgppo.exe
File opened for modification	C:\Windows\SysWOW64\Bnfihkqm.exe	Alelqb32.exe
File opened for modification	C:\Windows\SysWOW64\Ckbncapd.exe	Cgfbbb32.exe
File opened for modification	C:\Windows\SysWOW64\Hnfjbdmk.exe	Hkgnfhnh.exe
File opened for modification	C:\Windows\SysWOW64\Fjhacf32.exe	Elgaeolp.exe
File opened for modification	C:\Windows\SysWOW64\Ljfhqh32.exe	Lqndhcdc.exe
File created	C:\Windows\SysWOW64\Ieojgc32.exe	Ibqnkh32.exe
File opened for modification	C:\Windows\SysWOW64\Monjjgkb.exe	Mmmqhl32.exe
File opened for modification	C:\Windows\SysWOW64\Iickkbje.exe	Ifdonfka.exe
File opened for modification	C:\Windows\SysWOW64\Fielph32.exe	Fhdohp32.exe
File opened for modification	C:\Windows\SysWOW64\Ghpocngo.exe	Gklnjj32.exe
File created	C:\Windows\SysWOW64\Micoommd.dll	Cjgpfk32.exe
File opened for modification	C:\Windows\SysWOW64\Bheplb32.exe	Bakgoh32.exe
File created	C:\Windows\SysWOW64\Gahamgib.dll	Dnbakghm.exe
File created	C:\Windows\SysWOW64\Hpqldc32.exe	Hmbphg32.exe
File opened for modification	C:\Windows\SysWOW64\Lfjjga32.exe	Lppbkgcj.exe
File opened for modification	C:\Windows\SysWOW64\Lmgabcge.exe	Lgjijmin.exe
File created	C:\Windows\SysWOW64\Npiiffqe.exe	Nmkmjjaa.exe
File opened for modification	C:\Windows\SysWOW64\Jekjcaef.exe	Jblmgf32.exe
File opened for modification	C:\Windows\SysWOW64\Opadhb32.exe	Olehhc32.exe
File opened for modification	C:\Windows\SysWOW64\Ffpicn32.exe	Fpeafcfa.exe
File created	C:\Windows\SysWOW64\Fdakcc32.dll	Cgfbbb32.exe
File created	C:\Windows\SysWOW64\Comjoclk.dll	Jjoiil32.exe
File opened for modification	C:\Windows\SysWOW64\Bnmoijje.exe	Bhpfqcln.exe
File opened for modification	C:\Windows\SysWOW64\Jpgdai32.exe	Jafdcbge.exe
File created	C:\Windows\SysWOW64\Dmhidbhg.dll	Akcjkfij.exe
File created	C:\Windows\SysWOW64\Binnimfj.dll	Dckdjomg.exe
File created	C:\Windows\SysWOW64\Akcaoeoo.dll	Eoideh32.exe
File opened for modification	C:\Windows\SysWOW64\Pofjpl32.exe	Pjgebf32.exe
File created	C:\Windows\SysWOW64\Eejlephc.dll	Dmglcj32.exe
File opened for modification	C:\Windows\SysWOW64\Ebnfbcbc.exe	Eppjfgcp.exe
File created	C:\Windows\SysWOW64\Jilfifme.exe	Jcanll32.exe
File created	C:\Windows\SysWOW64\Capqggce.dll	Bhoqeibl.exe
File created	C:\Windows\SysWOW64\Kckqbj32.exe	Kegpifod.exe
File created	C:\Windows\SysWOW64\Eajeon32.exe	Eecdjmfi.exe
File created	C:\Windows\SysWOW64\Bmmpfn32.exe	Bfchidda.exe
File opened for modification	C:\Windows\SysWOW64\Hhiajmod.exe	Haoimcgg.exe
File created	C:\Windows\SysWOW64\Mjneln32.exe	Meamcg32.exe
File opened for modification	C:\Windows\SysWOW64\Ikdcmpnl.exe	Icnklbmj.exe
File created	C:\Windows\SysWOW64\Kmieae32.exe	Kqbdldnq.exe
File created	C:\Windows\SysWOW64\Kncaec32.exe	Kjgeedch.exe
File opened for modification	C:\Windows\SysWOW64\Qljcoj32.exe	Qepkbpak.exe
File created	C:\Windows\SysWOW64\Igajal32.exe	Iojbpo32.exe
File created	C:\Windows\SysWOW64\Dcigeooj.exe	Dbjkkl32.exe
File opened for modification	C:\Windows\SysWOW64\Bqmeal32.exe	Bifmqo32.exe
File created	C:\Windows\SysWOW64\Aokkdnic.dll	Indfca32.exe
File created	C:\Windows\SysWOW64\Kibeoo32.exe	Kolabf32.exe
File opened for modification	C:\Windows\SysWOW64\Cnicfe32.exe	Cdcoim32.exe
File opened for modification	C:\Windows\SysWOW64\Npchgdcd.exe	Mpqkad32.exe
File created	C:\Windows\SysWOW64\Pqfkck32.dll	Falcae32.exe
File created	C:\Windows\SysWOW64\Kpanan32.exe	Kncaec32.exe
File created	C:\Windows\SysWOW64\Jcoiaikp.dll	Iehmmb32.exe
File created	C:\Windows\SysWOW64\Bcidlo32.dll	Cpljehpo.exe
File opened for modification	C:\Windows\SysWOW64\Cpogkhnl.exe	Calfpk32.exe
File created	C:\Windows\SysWOW64\Gmflgn32.dll	Fielph32.exe
File opened for modification	C:\Windows\SysWOW64\Bfchidda.exe	Boipmj32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8220	8824	WerFault.exe	858

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfogpg32.dll"	Efffmo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpfjma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pedlgbkh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mfqlfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpehef32.dll"	Geanfelc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Falcae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ihnkel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nclikl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cdolgfbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pofjpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkcocace.dll"	Maodigil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbaffgag.dll"	Hgmgqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Blgifbil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qklmpalf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nholna32.dll"	Ghbbcd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Alcfei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eidlnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkmkkjko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ffnknafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibingd32.dll"	Fnipbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Igfclkdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcanll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dphefd32.dll"	Jkjcbe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiohdo32.dll"	Hmnmgnoh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kjmfjj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Anaomkdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pafpga32.dll"	Qapnmopa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ionqbdem.dll"	Aokcklid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akcjkfij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aajohjon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpgind32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jblijebc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Indfca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agchinmk.dll"	Bepmoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hnibokbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Embkoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jqiipljg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfombjbg.dll"	Knflpoqf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogjembbd.dll"	Llodgnja.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Halhfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Edjgfcec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmgabcge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnkbcj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chnbbqpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cegdnopg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ioambknl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djfjpgfm.dll"	Ehhpla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cmmbbejp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlkipgpe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kcbnnpka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hefnkkkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mlelal32.dll"	Ipjoja32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Epagkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqjmdflo.dll"	Kqfngd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pjinodke.dll"	Anaomkdb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekkkoj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dclkee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccemjbpf.dll"	Giqkkf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kndojobi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hmlpaoaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dinmhkke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Knbbep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmlephen.dll"	Cbpajgmf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Deagdn32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3964 wrote to memory of 1588	3964	a1d43cc6da4407069093437a9d58bc632c2c08ab0ab0e38a6cb84d1c4e240acf.exe	88
PID 3964 wrote to memory of 1588	3964	a1d43cc6da4407069093437a9d58bc632c2c08ab0ab0e38a6cb84d1c4e240acf.exe	88
PID 3964 wrote to memory of 1588	3964	a1d43cc6da4407069093437a9d58bc632c2c08ab0ab0e38a6cb84d1c4e240acf.exe	88
PID 1588 wrote to memory of 4840	1588	Cdcoim32.exe	89
PID 1588 wrote to memory of 4840	1588	Cdcoim32.exe	89
PID 1588 wrote to memory of 4840	1588	Cdcoim32.exe	89
PID 4840 wrote to memory of 2388	4840	Cnicfe32.exe	90
PID 4840 wrote to memory of 2388	4840	Cnicfe32.exe	90
PID 4840 wrote to memory of 2388	4840	Cnicfe32.exe	90
PID 2388 wrote to memory of 4072	2388	Ceckcp32.exe	91
PID 2388 wrote to memory of 4072	2388	Ceckcp32.exe	91
PID 2388 wrote to memory of 4072	2388	Ceckcp32.exe	91
PID 4072 wrote to memory of 3412	4072	Cjpckf32.exe	93
PID 4072 wrote to memory of 3412	4072	Cjpckf32.exe	93
PID 4072 wrote to memory of 3412	4072	Cjpckf32.exe	93
PID 3412 wrote to memory of 1536	3412	Ceehho32.exe	94
PID 3412 wrote to memory of 1536	3412	Ceehho32.exe	94
PID 3412 wrote to memory of 1536	3412	Ceehho32.exe	94
PID 1536 wrote to memory of 3544	1536	Cegdnopg.exe	95
PID 1536 wrote to memory of 3544	1536	Cegdnopg.exe	95
PID 1536 wrote to memory of 3544	1536	Cegdnopg.exe	95
PID 3544 wrote to memory of 3012	3544	Dfiafg32.exe	96
PID 3544 wrote to memory of 3012	3544	Dfiafg32.exe	96
PID 3544 wrote to memory of 3012	3544	Dfiafg32.exe	96
PID 3012 wrote to memory of 4776	3012	Danecp32.exe	98
PID 3012 wrote to memory of 4776	3012	Danecp32.exe	98
PID 3012 wrote to memory of 4776	3012	Danecp32.exe	98
PID 4776 wrote to memory of 2476	4776	Dfnjafap.exe	99
PID 4776 wrote to memory of 2476	4776	Dfnjafap.exe	99
PID 4776 wrote to memory of 2476	4776	Dfnjafap.exe	99
PID 2476 wrote to memory of 5108	2476	Dogogcpo.exe	100
PID 2476 wrote to memory of 5108	2476	Dogogcpo.exe	100
PID 2476 wrote to memory of 5108	2476	Dogogcpo.exe	100
PID 5108 wrote to memory of 1652	5108	Deagdn32.exe	101
PID 5108 wrote to memory of 1652	5108	Deagdn32.exe	101
PID 5108 wrote to memory of 1652	5108	Deagdn32.exe	101
PID 1652 wrote to memory of 1112	1652	Dknpmdfc.exe	103
PID 1652 wrote to memory of 1112	1652	Dknpmdfc.exe	103
PID 1652 wrote to memory of 1112	1652	Dknpmdfc.exe	103
PID 1112 wrote to memory of 3064	1112	Eecdjmfi.exe	104
PID 1112 wrote to memory of 3064	1112	Eecdjmfi.exe	104
PID 1112 wrote to memory of 3064	1112	Eecdjmfi.exe	104
PID 3064 wrote to memory of 4764	3064	Eajeon32.exe	105
PID 3064 wrote to memory of 4764	3064	Eajeon32.exe	105
PID 3064 wrote to memory of 4764	3064	Eajeon32.exe	105
PID 4764 wrote to memory of 2604	4764	Edknqiho.exe	106
PID 4764 wrote to memory of 2604	4764	Edknqiho.exe	106
PID 4764 wrote to memory of 2604	4764	Edknqiho.exe	106
PID 2604 wrote to memory of 3112	2604	Emcbio32.exe	107
PID 2604 wrote to memory of 3112	2604	Emcbio32.exe	107
PID 2604 wrote to memory of 3112	2604	Emcbio32.exe	107
PID 3112 wrote to memory of 960	3112	Ehiffh32.exe	108
PID 3112 wrote to memory of 960	3112	Ehiffh32.exe	108
PID 3112 wrote to memory of 960	3112	Ehiffh32.exe	108
PID 960 wrote to memory of 5000	960	Edpgli32.exe	109
PID 960 wrote to memory of 5000	960	Edpgli32.exe	109
PID 960 wrote to memory of 5000	960	Edpgli32.exe	109
PID 5000 wrote to memory of 1516	5000	Eoekia32.exe	110
PID 5000 wrote to memory of 1516	5000	Eoekia32.exe	110
PID 5000 wrote to memory of 1516	5000	Eoekia32.exe	110
PID 1516 wrote to memory of 4824	1516	Foghnabl.exe	111
PID 1516 wrote to memory of 4824	1516	Foghnabl.exe	111
PID 1516 wrote to memory of 4824	1516	Foghnabl.exe	111
PID 4824 wrote to memory of 2576	4824	Fddqghpd.exe	112

C:\Users\Admin\AppData\Local\Temp\a1d43cc6da4407069093437a9d58bc632c2c08ab0ab0e38a6cb84d1c4e240acf.exe
"C:\Users\Admin\AppData\Local\Temp\a1d43cc6da4407069093437a9d58bc632c2c08ab0ab0e38a6cb84d1c4e240acf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Windows\SysWOW64\Cdcoim32.exe
  C:\Windows\system32\Cdcoim32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Windows\SysWOW64\Cnicfe32.exe
    C:\Windows\system32\Cnicfe32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Windows\SysWOW64\Ceckcp32.exe
      C:\Windows\system32\Ceckcp32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2388
    - - C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4072
      - C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3412
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1536
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3544
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2476
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5108
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\SysWOW64\Eecdjmfi.exe
        
        C:\Windows\system32\Eecdjmfi.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1112
        
        C:\Windows\SysWOW64\Eajeon32.exe
        
        C:\Windows\system32\Eajeon32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3064
        
        C:\Windows\SysWOW64\Edknqiho.exe
        
        C:\Windows\system32\Edknqiho.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4764
        
        C:\Windows\SysWOW64\Emcbio32.exe
        
        C:\Windows\system32\Emcbio32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2604
        
        C:\Windows\SysWOW64\Ehiffh32.exe
        
        C:\Windows\system32\Ehiffh32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3112
        
        C:\Windows\SysWOW64\Edpgli32.exe
        
        C:\Windows\system32\Edpgli32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:960
        
        C:\Windows\SysWOW64\Eoekia32.exe
        
        C:\Windows\system32\Eoekia32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Windows\SysWOW64\Foghnabl.exe
        
        C:\Windows\system32\Foghnabl.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1516
        
        C:\Windows\SysWOW64\Fddqghpd.exe
        
        C:\Windows\system32\Fddqghpd.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4824
        
        C:\Windows\SysWOW64\Fnmepn32.exe
        
        C:\Windows\system32\Fnmepn32.exe
        23⤵
        Executes dropped EXE
        
        PID:2576
        
        C:\Windows\SysWOW64\Fgeihcme.exe
        
        C:\Windows\system32\Fgeihcme.exe
        24⤵
        Executes dropped EXE
        
        PID:4452
        
        C:\Windows\SysWOW64\Fdijbg32.exe
        
        C:\Windows\system32\Fdijbg32.exe
        25⤵
        Executes dropped EXE
        
        PID:2340
        
        C:\Windows\SysWOW64\Fdkggg32.exe
        
        C:\Windows\system32\Fdkggg32.exe
        26⤵
        Executes dropped EXE
        
        PID:4084
        
        C:\Windows\SysWOW64\Fkeodaai.exe
        
        C:\Windows\system32\Fkeodaai.exe
        27⤵
        Executes dropped EXE
        
        PID:4828
        
        C:\Windows\SysWOW64\Gkglja32.exe
        
        C:\Windows\system32\Gkglja32.exe
        28⤵
        Executes dropped EXE
        
        PID:4048
        
        C:\Windows\SysWOW64\Gaadfkgc.exe
        
        C:\Windows\system32\Gaadfkgc.exe
        29⤵
        Executes dropped EXE
        
        PID:3324
        
        C:\Windows\SysWOW64\Ggnlobej.exe
        
        C:\Windows\system32\Ggnlobej.exe
        30⤵
        Executes dropped EXE
        
        PID:4912
        
        C:\Windows\SysWOW64\Gadqlkep.exe
        
        C:\Windows\system32\Gadqlkep.exe
        31⤵
        Executes dropped EXE
        
        PID:2116
        
        C:\Windows\SysWOW64\Gddinf32.exe
        
        C:\Windows\system32\Gddinf32.exe
        32⤵
        Executes dropped EXE
        
        PID:1280
        
        C:\Windows\SysWOW64\Ghbbcd32.exe
        
        C:\Windows\system32\Ghbbcd32.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2240
        
        C:\Windows\SysWOW64\Hdicienl.exe
        
        C:\Windows\system32\Hdicienl.exe
        34⤵
        Executes dropped EXE
        
        PID:2320
        
        C:\Windows\SysWOW64\Hbmcbime.exe
        
        C:\Windows\system32\Hbmcbime.exe
        35⤵
        Executes dropped EXE
        
        PID:4332
        
        C:\Windows\SysWOW64\Hoadkn32.exe
        
        C:\Windows\system32\Hoadkn32.exe
        36⤵
        Executes dropped EXE
        
        PID:4324
        
        C:\Windows\SysWOW64\Hdnldd32.exe
        
        C:\Windows\system32\Hdnldd32.exe
        37⤵
        Executes dropped EXE
        
        PID:1580
        
        C:\Windows\SysWOW64\Hnfamjqg.exe
        
        C:\Windows\system32\Hnfamjqg.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4068
        
        C:\Windows\SysWOW64\Hhlejcpm.exe
        
        C:\Windows\system32\Hhlejcpm.exe
        39⤵
        Executes dropped EXE
        
        PID:1592
        
        C:\Windows\SysWOW64\Hninbj32.exe
        
        C:\Windows\system32\Hninbj32.exe
        40⤵
        Executes dropped EXE
        
        PID:2712
        
        C:\Windows\SysWOW64\Hhnbpb32.exe
        
        C:\Windows\system32\Hhnbpb32.exe
        41⤵
        Executes dropped EXE
        
        PID:3164
        
        C:\Windows\SysWOW64\Ibffhhek.exe
        
        C:\Windows\system32\Ibffhhek.exe
        42⤵
        Executes dropped EXE
        
        PID:1472
        
        C:\Windows\SysWOW64\Ikokan32.exe
        
        C:\Windows\system32\Ikokan32.exe
        43⤵
        Executes dropped EXE
        
        PID:1528
        
        C:\Windows\SysWOW64\Ifdonfka.exe
        
        C:\Windows\system32\Ifdonfka.exe
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:840
        
        C:\Windows\SysWOW64\Iickkbje.exe
        
        C:\Windows\system32\Iickkbje.exe
        45⤵
        Executes dropped EXE
        
        PID:1100
        
        C:\Windows\SysWOW64\Inpccihl.exe
        
        C:\Windows\system32\Inpccihl.exe
        46⤵
        Executes dropped EXE
        
        PID:4736
        
        C:\Windows\SysWOW64\Iiehpahb.exe
        
        C:\Windows\system32\Iiehpahb.exe
        47⤵
        Executes dropped EXE
        
        PID:936
        
        C:\Windows\SysWOW64\Ioopml32.exe
        
        C:\Windows\system32\Ioopml32.exe
        48⤵
        Executes dropped EXE
        
        PID:1576
        
        C:\Windows\SysWOW64\Ifihif32.exe
        
        C:\Windows\system32\Ifihif32.exe
        49⤵
        Executes dropped EXE
        
        PID:1096
        
        C:\Windows\SysWOW64\Ioambknl.exe
        
        C:\Windows\system32\Ioambknl.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4384
        
        C:\Windows\SysWOW64\Ifleoe32.exe
        
        C:\Windows\system32\Ifleoe32.exe
        51⤵
        Executes dropped EXE
        
        PID:1524
        
        C:\Windows\SysWOW64\Iijaka32.exe
        
        C:\Windows\system32\Iijaka32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3192
        
        C:\Windows\SysWOW64\Jngjch32.exe
        
        C:\Windows\system32\Jngjch32.exe
        53⤵
        Executes dropped EXE
        
        PID:3616
        
        C:\Windows\SysWOW64\Jkkjmlan.exe
        
        C:\Windows\system32\Jkkjmlan.exe
        54⤵
        Executes dropped EXE
        
        PID:696
        
        C:\Windows\SysWOW64\Jkmgblok.exe
        
        C:\Windows\system32\Jkmgblok.exe
        55⤵
        Executes dropped EXE
        
        PID:4624
        
        C:\Windows\SysWOW64\Jeekkafl.exe
        
        C:\Windows\system32\Jeekkafl.exe
        56⤵
        Executes dropped EXE
        
        PID:4596
        
        C:\Windows\SysWOW64\Jnnpdg32.exe
        
        C:\Windows\system32\Jnnpdg32.exe
        57⤵
        Executes dropped EXE
        
        PID:2684
        
        C:\Windows\SysWOW64\Jgfdmlcm.exe
        
        C:\Windows\system32\Jgfdmlcm.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4792
        
        C:\Windows\SysWOW64\Jblijebc.exe
        
        C:\Windows\system32\Jblijebc.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4468
        
        C:\Windows\SysWOW64\Kldmckic.exe
        
        C:\Windows\system32\Kldmckic.exe
        60⤵
        Executes dropped EXE
        
        PID:3740
        
        C:\Windows\SysWOW64\Kpbfii32.exe
        
        C:\Windows\system32\Kpbfii32.exe
        61⤵
        Executes dropped EXE
        
        PID:1180
        
        C:\Windows\SysWOW64\Khmknk32.exe
        
        C:\Windows\system32\Khmknk32.exe
        62⤵
        Executes dropped EXE
        
        PID:2196
        
        C:\Windows\SysWOW64\Kimghn32.exe
        
        C:\Windows\system32\Kimghn32.exe
        63⤵
        Executes dropped EXE
        
        PID:5100
        
        C:\Windows\SysWOW64\Knippe32.exe
        
        C:\Windows\system32\Knippe32.exe
        64⤵
        Executes dropped EXE
        
        PID:208
        
        C:\Windows\SysWOW64\Kiodmn32.exe
        
        C:\Windows\system32\Kiodmn32.exe
        65⤵
        Executes dropped EXE
        
        PID:2444
        
        C:\Windows\SysWOW64\Kiaqcnpb.exe
        
        C:\Windows\system32\Kiaqcnpb.exe
        66⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\Lpkiph32.exe
        
        C:\Windows\system32\Lpkiph32.exe
        67⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\Lehaho32.exe
        
        C:\Windows\system32\Lehaho32.exe
        68⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Lppbkgcj.exe
        
        C:\Windows\system32\Lppbkgcj.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2292
        
        C:\Windows\SysWOW64\Lfjjga32.exe
        
        C:\Windows\system32\Lfjjga32.exe
        70⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\Lbqklb32.exe
        
        C:\Windows\system32\Lbqklb32.exe
        71⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\Leadnm32.exe
        
        C:\Windows\system32\Leadnm32.exe
        72⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\Mojhgbdl.exe
        
        C:\Windows\system32\Mojhgbdl.exe
        73⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\Mlnipg32.exe
        
        C:\Windows\system32\Mlnipg32.exe
        74⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Mlpeff32.exe
        
        C:\Windows\system32\Mlpeff32.exe
        75⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\Mhgfkg32.exe
        
        C:\Windows\system32\Mhgfkg32.exe
        76⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Mfhfhong.exe
        
        C:\Windows\system32\Mfhfhong.exe
        77⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Mpqkad32.exe
        
        C:\Windows\system32\Mpqkad32.exe
        78⤵
        Drops file in System32 directory
        
        PID:5176
        
        C:\Windows\SysWOW64\Npchgdcd.exe
        
        C:\Windows\system32\Npchgdcd.exe
        79⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Ngmpcn32.exe
        
        C:\Windows\system32\Ngmpcn32.exe
        80⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Nhnlkfpp.exe
        
        C:\Windows\system32\Nhnlkfpp.exe
        81⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Nohehq32.exe
        
        C:\Windows\system32\Nohehq32.exe
        82⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Niniei32.exe
        
        C:\Windows\system32\Niniei32.exe
        83⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Nojanpej.exe
        
        C:\Windows\system32\Nojanpej.exe
        84⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Nhbfff32.exe
        
        C:\Windows\system32\Nhbfff32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5468
        
        C:\Windows\SysWOW64\Nchjdo32.exe
        
        C:\Windows\system32\Nchjdo32.exe
        86⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Nibbqicm.exe
        
        C:\Windows\system32\Nibbqicm.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5556
        
        C:\Windows\SysWOW64\Nlqomd32.exe
        
        C:\Windows\system32\Nlqomd32.exe
        88⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Oidofh32.exe
        
        C:\Windows\system32\Oidofh32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5644
        
        C:\Windows\SysWOW64\Oghppm32.exe
        
        C:\Windows\system32\Oghppm32.exe
        90⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Oekpkigo.exe
        
        C:\Windows\system32\Oekpkigo.exe
        91⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Olehhc32.exe
        
        C:\Windows\system32\Olehhc32.exe
        92⤵
        Drops file in System32 directory
        
        PID:5772
        
        C:\Windows\SysWOW64\Opadhb32.exe
        
        C:\Windows\system32\Opadhb32.exe
        93⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Oenlqi32.exe
        
        C:\Windows\system32\Oenlqi32.exe
        94⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Ocamjm32.exe
        
        C:\Windows\system32\Ocamjm32.exe
        95⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Ohnebd32.exe
        
        C:\Windows\system32\Ohnebd32.exe
        96⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Ogpepl32.exe
        
        C:\Windows\system32\Ogpepl32.exe
        97⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Ookjdn32.exe
        
        C:\Windows\system32\Ookjdn32.exe
        98⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Pjpobg32.exe
        
        C:\Windows\system32\Pjpobg32.exe
        99⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Ppjgoaoj.exe
        
        C:\Windows\system32\Ppjgoaoj.exe
        100⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Pcicklnn.exe
        
        C:\Windows\system32\Pcicklnn.exe
        101⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Pfgogh32.exe
        
        C:\Windows\system32\Pfgogh32.exe
        102⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Phelcc32.exe
        
        C:\Windows\system32\Phelcc32.exe
        103⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Ppmcdq32.exe
        
        C:\Windows\system32\Ppmcdq32.exe
        104⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Pckppl32.exe
        
        C:\Windows\system32\Pckppl32.exe
        105⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Pjehmfch.exe
        
        C:\Windows\system32\Pjehmfch.exe
        106⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Phhhhc32.exe
        
        C:\Windows\system32\Phhhhc32.exe
        107⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Poaqemao.exe
        
        C:\Windows\system32\Poaqemao.exe
        108⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Pgihfj32.exe
        
        C:\Windows\system32\Pgihfj32.exe
        109⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Pjgebf32.exe
        
        C:\Windows\system32\Pjgebf32.exe
        110⤵
        Drops file in System32 directory
        
        PID:5808
        
        C:\Windows\SysWOW64\Pofjpl32.exe
        
        C:\Windows\system32\Pofjpl32.exe
        111⤵
        Modifies registry class
        
        PID:5856
        
        C:\Windows\SysWOW64\Qfpbmfdf.exe
        
        C:\Windows\system32\Qfpbmfdf.exe
        112⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Qgpogili.exe
        
        C:\Windows\system32\Qgpogili.exe
        113⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Qhakoa32.exe
        
        C:\Windows\system32\Qhakoa32.exe
        114⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Aokcklid.exe
        
        C:\Windows\system32\Aokcklid.exe
        115⤵
        Modifies registry class
        
        PID:6120
        
        C:\Windows\SysWOW64\Agbkmijg.exe
        
        C:\Windows\system32\Agbkmijg.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5192
        
        C:\Windows\SysWOW64\Aqkpeopg.exe
        
        C:\Windows\system32\Aqkpeopg.exe
        117⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Agdhbi32.exe
        
        C:\Windows\system32\Agdhbi32.exe
        118⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Amaqjp32.exe
        
        C:\Windows\system32\Amaqjp32.exe
        119⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Ackigjmh.exe
        
        C:\Windows\system32\Ackigjmh.exe
        120⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Ajeadd32.exe
        
        C:\Windows\system32\Ajeadd32.exe
        121⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Amcmpodi.exe
        
        C:\Windows\system32\Amcmpodi.exe
        122⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Acnemi32.exe
        
        C:\Windows\system32\Acnemi32.exe
        123⤵
        Drops file in System32 directory
        
        PID:6004
        
        C:\Windows\SysWOW64\Aijnep32.exe
        
        C:\Windows\system32\Aijnep32.exe
        124⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Aodfajaj.exe
        
        C:\Windows\system32\Aodfajaj.exe
        125⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Aglnbhal.exe
        
        C:\Windows\system32\Aglnbhal.exe
        126⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Bfqkddfd.exe
        
        C:\Windows\system32\Bfqkddfd.exe
        127⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Boipmj32.exe
        
        C:\Windows\system32\Boipmj32.exe
        128⤵
        Drops file in System32 directory
        
        PID:4448
        
        C:\Windows\SysWOW64\Bfchidda.exe
        
        C:\Windows\system32\Bfchidda.exe
        129⤵
        Drops file in System32 directory
        
        PID:5972
        
        C:\Windows\SysWOW64\Bmmpfn32.exe
        
        C:\Windows\system32\Bmmpfn32.exe
        130⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Bgbdcgld.exe
        
        C:\Windows\system32\Bgbdcgld.exe
        131⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Bqkill32.exe
        
        C:\Windows\system32\Bqkill32.exe
        132⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Bciehh32.exe
        
        C:\Windows\system32\Bciehh32.exe
        133⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Bjcmebie.exe
        
        C:\Windows\system32\Bjcmebie.exe
        134⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Bifmqo32.exe
        
        C:\Windows\system32\Bifmqo32.exe
        135⤵
        Drops file in System32 directory
        
        PID:5696
        
        C:\Windows\SysWOW64\Bqmeal32.exe
        
        C:\Windows\system32\Bqmeal32.exe
        136⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Bggnof32.exe
        
        C:\Windows\system32\Bggnof32.exe
        137⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Cmdfgm32.exe
        
        C:\Windows\system32\Cmdfgm32.exe
        138⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Ccnncgmc.exe
        
        C:\Windows\system32\Ccnncgmc.exe
        139⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Cikglnkj.exe
        
        C:\Windows\system32\Cikglnkj.exe
        140⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Cpeohh32.exe
        
        C:\Windows\system32\Cpeohh32.exe
        141⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Cfogeb32.exe
        
        C:\Windows\system32\Cfogeb32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6264
        
        C:\Windows\SysWOW64\Cmipblaq.exe
        
        C:\Windows\system32\Cmipblaq.exe
        143⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Cpglnhad.exe
        
        C:\Windows\system32\Cpglnhad.exe
        144⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Cjmpkqqj.exe
        
        C:\Windows\system32\Cjmpkqqj.exe
        145⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Caghhk32.exe
        
        C:\Windows\system32\Caghhk32.exe
        146⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Cceddf32.exe
        
        C:\Windows\system32\Cceddf32.exe
        147⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Cfcqpa32.exe
        
        C:\Windows\system32\Cfcqpa32.exe
        148⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Cmniml32.exe
        
        C:\Windows\system32\Cmniml32.exe
        149⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Cpleig32.exe
        
        C:\Windows\system32\Cpleig32.exe
        150⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Cgcmjd32.exe
        
        C:\Windows\system32\Cgcmjd32.exe
        151⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Cidjbmcp.exe
        
        C:\Windows\system32\Cidjbmcp.exe
        152⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Dakacjdb.exe
        
        C:\Windows\system32\Dakacjdb.exe
        153⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Dgejpd32.exe
        
        C:\Windows\system32\Dgejpd32.exe
        154⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        155⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Dclkee32.exe
        
        C:\Windows\system32\Dclkee32.exe
        156⤵
        Modifies registry class
        
        PID:6880
        
        C:\Windows\SysWOW64\Dfjgaq32.exe
        
        C:\Windows\system32\Dfjgaq32.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6924
        
        C:\Windows\SysWOW64\Dmdonkgc.exe
        
        C:\Windows\system32\Dmdonkgc.exe
        158⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Dpckjfgg.exe
        
        C:\Windows\system32\Dpckjfgg.exe
        159⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Djhpgofm.exe
        
        C:\Windows\system32\Djhpgofm.exe
        160⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Dmglcj32.exe
        
        C:\Windows\system32\Dmglcj32.exe
        161⤵
        Drops file in System32 directory
        
        PID:7100
        
        C:\Windows\SysWOW64\Ddadpdmn.exe
        
        C:\Windows\system32\Ddadpdmn.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7144
        
        C:\Windows\SysWOW64\Dfoplpla.exe
        
        C:\Windows\system32\Dfoplpla.exe
        163⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Dinmhkke.exe
        
        C:\Windows\system32\Dinmhkke.exe
        164⤵
        Modifies registry class
        
        PID:6256
        
        C:\Windows\SysWOW64\Daediilg.exe
        
        C:\Windows\system32\Daediilg.exe
        165⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Dhomfc32.exe
        
        C:\Windows\system32\Dhomfc32.exe
        166⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Epjajeqo.exe
        
        C:\Windows\system32\Epjajeqo.exe
        167⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        168⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Ejpfhnpe.exe
        
        C:\Windows\system32\Ejpfhnpe.exe
        169⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Emnbdioi.exe
        
        C:\Windows\system32\Emnbdioi.exe
        170⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Eplnpeol.exe
        
        C:\Windows\system32\Eplnpeol.exe
        171⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        172⤵
        Modifies registry class
        
        PID:6804
        
        C:\Windows\SysWOW64\Empoiimf.exe
        
        C:\Windows\system32\Empoiimf.exe
        173⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Edjgfcec.exe
        
        C:\Windows\system32\Edjgfcec.exe
        174⤵
        Modifies registry class
        
        PID:6936
        
        C:\Windows\SysWOW64\Embkoi32.exe
        
        C:\Windows\system32\Embkoi32.exe
        175⤵
        Modifies registry class
        
        PID:6988
        
        C:\Windows\SysWOW64\Epagkd32.exe
        
        C:\Windows\system32\Epagkd32.exe
        176⤵
        Modifies registry class
        
        PID:7040
        
        C:\Windows\SysWOW64\Ehhpla32.exe
        
        C:\Windows\system32\Ehhpla32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7128
        
        C:\Windows\SysWOW64\Eaqdegaj.exe
        
        C:\Windows\system32\Eaqdegaj.exe
        178⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Edopabqn.exe
        
        C:\Windows\system32\Edopabqn.exe
        179⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Efmmmn32.exe
        
        C:\Windows\system32\Efmmmn32.exe
        180⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Filiii32.exe
        
        C:\Windows\system32\Filiii32.exe
        181⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Fpeafcfa.exe
        
        C:\Windows\system32\Fpeafcfa.exe
        182⤵
        Drops file in System32 directory
        
        PID:6728
        
        C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        183⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Fineoi32.exe
        
        C:\Windows\system32\Fineoi32.exe
        184⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Faenpf32.exe
        
        C:\Windows\system32\Faenpf32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7056
        
        C:\Windows\SysWOW64\Fgbfhmll.exe
        
        C:\Windows\system32\Fgbfhmll.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7156
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        187⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Fpjjac32.exe
        
        C:\Windows\system32\Fpjjac32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6412
        
        C:\Windows\SysWOW64\Fkpool32.exe
        
        C:\Windows\system32\Fkpool32.exe
        189⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Fmnkkg32.exe
        
        C:\Windows\system32\Fmnkkg32.exe
        190⤵
        Drops file in System32 directory
        
        PID:6776
        
        C:\Windows\SysWOW64\Fpmggb32.exe
        
        C:\Windows\system32\Fpmggb32.exe
        191⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Fhdohp32.exe
        
        C:\Windows\system32\Fhdohp32.exe
        192⤵
        Drops file in System32 directory
        
        PID:7140
        
        C:\Windows\SysWOW64\Fielph32.exe
        
        C:\Windows\system32\Fielph32.exe
        193⤵
        Drops file in System32 directory
        
        PID:6376
        
        C:\Windows\SysWOW64\Falcae32.exe
        
        C:\Windows\system32\Falcae32.exe
        194⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6716
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        195⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6596
        
        C:\Windows\SysWOW64\Gilapgqb.exe
        
        C:\Windows\system32\Gilapgqb.exe
        197⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Gpfjma32.exe
        
        C:\Windows\system32\Gpfjma32.exe
        198⤵
        Modifies registry class
        
        PID:7180
        
        C:\Windows\SysWOW64\Ghmbno32.exe
        
        C:\Windows\system32\Ghmbno32.exe
        199⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Gklnjj32.exe
        
        C:\Windows\system32\Gklnjj32.exe
        200⤵
        Drops file in System32 directory
        
        PID:7280
        
        C:\Windows\SysWOW64\Ghpocngo.exe
        
        C:\Windows\system32\Ghpocngo.exe
        201⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Giqkkf32.exe
        
        C:\Windows\system32\Giqkkf32.exe
        202⤵
        Modifies registry class
        
        PID:7384
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        203⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Hgelek32.exe
        
        C:\Windows\system32\Hgelek32.exe
        204⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Hnodaecc.exe
        
        C:\Windows\system32\Hnodaecc.exe
        205⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Hpmpnp32.exe
        
        C:\Windows\system32\Hpmpnp32.exe
        206⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Hhdhon32.exe
        
        C:\Windows\system32\Hhdhon32.exe
        207⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Hjedffig.exe
        
        C:\Windows\system32\Hjedffig.exe
        208⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Hpomcp32.exe
        
        C:\Windows\system32\Hpomcp32.exe
        209⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Hkeaqi32.exe
        
        C:\Windows\system32\Hkeaqi32.exe
        210⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Haoimcgg.exe
        
        C:\Windows\system32\Haoimcgg.exe
        211⤵
        Drops file in System32 directory
        
        PID:7772
        
        C:\Windows\SysWOW64\Hhiajmod.exe
        
        C:\Windows\system32\Hhiajmod.exe
        212⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Hkgnfhnh.exe
        
        C:\Windows\system32\Hkgnfhnh.exe
        213⤵
        Drops file in System32 directory
        
        PID:7860
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        214⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Hhknpmma.exe
        
        C:\Windows\system32\Hhknpmma.exe
        215⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Hjlkge32.exe
        
        C:\Windows\system32\Hjlkge32.exe
        216⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Hacbhb32.exe
        
        C:\Windows\system32\Hacbhb32.exe
        217⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Ihnkel32.exe
        
        C:\Windows\system32\Ihnkel32.exe
        218⤵
        Modifies registry class
        
        PID:8080
        
        C:\Windows\SysWOW64\Injcmc32.exe
        
        C:\Windows\system32\Injcmc32.exe
        219⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Iddljmpc.exe
        
        C:\Windows\system32\Iddljmpc.exe
        220⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Ikndgg32.exe
        
        C:\Windows\system32\Ikndgg32.exe
        221⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Iqklon32.exe
        
        C:\Windows\system32\Iqklon32.exe
        222⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        223⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        224⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Iggaah32.exe
        
        C:\Windows\system32\Iggaah32.exe
        225⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Ijfnmc32.exe
        
        C:\Windows\system32\Ijfnmc32.exe
        226⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Ibmeoq32.exe
        
        C:\Windows\system32\Ibmeoq32.exe
        227⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Ihgnkkbd.exe
        
        C:\Windows\system32\Ihgnkkbd.exe
        228⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Indfca32.exe
        
        C:\Windows\system32\Indfca32.exe
        229⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7940
        
        C:\Windows\SysWOW64\Iqbbpm32.exe
        
        C:\Windows\system32\Iqbbpm32.exe
        230⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Jglklggl.exe
        
        C:\Windows\system32\Jglklggl.exe
        231⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Jnfcia32.exe
        
        C:\Windows\system32\Jnfcia32.exe
        232⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        233⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Jkjcbe32.exe
        
        C:\Windows\system32\Jkjcbe32.exe
        234⤵
        Modifies registry class
        
        PID:7464
        
        C:\Windows\SysWOW64\Jbdlop32.exe
        
        C:\Windows\system32\Jbdlop32.exe
        235⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Jdbhkk32.exe
        
        C:\Windows\system32\Jdbhkk32.exe
        236⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Jgadgf32.exe
        
        C:\Windows\system32\Jgadgf32.exe
        237⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Jnkldqkc.exe
        
        C:\Windows\system32\Jnkldqkc.exe
        238⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Jqiipljg.exe
        
        C:\Windows\system32\Jqiipljg.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7316
        
        C:\Windows\SysWOW64\Jgcamf32.exe
        
        C:\Windows\system32\Jgcamf32.exe
        240⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7912
        
        C:\Windows\SysWOW64\Jgenbfoa.exe
        
        C:\Windows\system32\Jgenbfoa.exe
        242⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Jjdjoane.exe
        
        C:\Windows\system32\Jjdjoane.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7532
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        244⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Knbbep32.exe
        
        C:\Windows\system32\Knbbep32.exe
        245⤵
        Modifies registry class
        
        PID:7460
        
        C:\Windows\SysWOW64\Kiggbhda.exe
        
        C:\Windows\system32\Kiggbhda.exe
        246⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Kkfcndce.exe
        
        C:\Windows\system32\Kkfcndce.exe
        247⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Kndojobi.exe
        
        C:\Windows\system32\Kndojobi.exe
        248⤵
        Modifies registry class
        
        PID:8236
        
        C:\Windows\SysWOW64\Kenggi32.exe
        
        C:\Windows\system32\Kenggi32.exe
        249⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Kgmcce32.exe
        
        C:\Windows\system32\Kgmcce32.exe
        250⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Knflpoqf.exe
        
        C:\Windows\system32\Knflpoqf.exe
        251⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8360
        
        C:\Windows\SysWOW64\Lajagj32.exe
        
        C:\Windows\system32\Lajagj32.exe
        252⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Liqihglg.exe
        
        C:\Windows\system32\Liqihglg.exe
        253⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Lkofdbkj.exe
        
        C:\Windows\system32\Lkofdbkj.exe
        254⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Lnnbqnjn.exe
        
        C:\Windows\system32\Lnnbqnjn.exe
        255⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Lgffic32.exe
        
        C:\Windows\system32\Lgffic32.exe
        256⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        257⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Lnbklm32.exe
        
        C:\Windows\system32\Lnbklm32.exe
        258⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Lelchgne.exe
        
        C:\Windows\system32\Lelchgne.exe
        259⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        260⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        261⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Mngegmbc.exe
        
        C:\Windows\system32\Mngegmbc.exe
        262⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        263⤵
        Drops file in System32 directory
        
        PID:8872
        
        C:\Windows\SysWOW64\Mjneln32.exe
        
        C:\Windows\system32\Mjneln32.exe
        264⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Miofjepg.exe
        
        C:\Windows\system32\Miofjepg.exe
        265⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Mnlnbl32.exe
        
        C:\Windows\system32\Mnlnbl32.exe
        266⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Mhdckaeo.exe
        
        C:\Windows\system32\Mhdckaeo.exe
        267⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Mhfppabl.exe
        
        C:\Windows\system32\Mhfppabl.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9088
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        269⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Maodigil.exe
        
        C:\Windows\system32\Maodigil.exe
        270⤵
        Modifies registry class
        
        PID:9164
        
        C:\Windows\SysWOW64\Mejpje32.exe
        
        C:\Windows\system32\Mejpje32.exe
        271⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        272⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        273⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        274⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        275⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Nbcjnilj.exe
        
        C:\Windows\system32\Nbcjnilj.exe
        276⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Nimbkc32.exe
        
        C:\Windows\system32\Nimbkc32.exe
        277⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Nojjcj32.exe
        
        C:\Windows\system32\Nojjcj32.exe
        278⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Nefped32.exe
        
        C:\Windows\system32\Nefped32.exe
        279⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8824
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        281⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Oaompd32.exe
        
        C:\Windows\system32\Oaompd32.exe
        282⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        283⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        284⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        285⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        286⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Olijhmgj.exe
        
        C:\Windows\system32\Olijhmgj.exe
        287⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        288⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        289⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        290⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        291⤵
        Modifies registry class
        
        PID:8740
        
        C:\Windows\SysWOW64\Phbhcmjl.exe
        
        C:\Windows\system32\Phbhcmjl.exe
        292⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Polppg32.exe
        
        C:\Windows\system32\Polppg32.exe
        293⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Phedhmhi.exe
        
        C:\Windows\system32\Phedhmhi.exe
        294⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        295⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Pidabppl.exe
        
        C:\Windows\system32\Pidabppl.exe
        296⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Pkenjh32.exe
        
        C:\Windows\system32\Pkenjh32.exe
        297⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        298⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Pifnhpmi.exe
        
        C:\Windows\system32\Pifnhpmi.exe
        299⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        300⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        301⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        302⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8200
        
        C:\Windows\SysWOW64\Qcaofebg.exe
        
        C:\Windows\system32\Qcaofebg.exe
        303⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        304⤵
        Drops file in System32 directory
        
        PID:8692
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        305⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Qohpkf32.exe
        
        C:\Windows\system32\Qohpkf32.exe
        306⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Ajndioga.exe
        
        C:\Windows\system32\Ajndioga.exe
        307⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Allpejfe.exe
        
        C:\Windows\system32\Allpejfe.exe
        308⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Akamff32.exe
        
        C:\Windows\system32\Akamff32.exe
        309⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\Aakebqbj.exe
        
        C:\Windows\system32\Aakebqbj.exe
        310⤵
        
        PID:4216
        
        C:\Windows\SysWOW64\Ajbmdn32.exe
        
        C:\Windows\system32\Ajbmdn32.exe
        311⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        312⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8384
        
        C:\Windows\SysWOW64\Aoofle32.exe
        
        C:\Windows\system32\Aoofle32.exe
        313⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        314⤵
        
        PID:336
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        315⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Alcfei32.exe
        
        C:\Windows\system32\Alcfei32.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2336
        
        C:\Windows\SysWOW64\Aoabad32.exe
        
        C:\Windows\system32\Aoabad32.exe
        317⤵
        
        PID:4024
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        318⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\Akhcfe32.exe
        
        C:\Windows\system32\Akhcfe32.exe
        319⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        320⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        321⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Bhoqeibl.exe
        
        C:\Windows\system32\Bhoqeibl.exe
        322⤵
        Drops file in System32 directory
        
        PID:9336
        
        C:\Windows\SysWOW64\Bohibc32.exe
        
        C:\Windows\system32\Bohibc32.exe
        323⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        324⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        325⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        326⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Bckkca32.exe
        
        C:\Windows\system32\Bckkca32.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9544
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        328⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9648
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        330⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        331⤵
        Drops file in System32 directory
        
        PID:9756
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        332⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9844
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        334⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Cimmggfl.exe
        
        C:\Windows\system32\Cimmggfl.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9960
        
        C:\Windows\SysWOW64\Ckkiccep.exe
        
        C:\Windows\system32\Ckkiccep.exe
        336⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Cfqmpl32.exe
        
        C:\Windows\system32\Cfqmpl32.exe
        337⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        338⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        339⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Cbgnemjj.exe
        
        C:\Windows\system32\Cbgnemjj.exe
        340⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        341⤵
        Modifies registry class
        
        PID:6628
        
        C:\Windows\SysWOW64\Coknoaic.exe
        
        C:\Windows\system32\Coknoaic.exe
        342⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Dbjkkl32.exe
        
        C:\Windows\system32\Dbjkkl32.exe
        343⤵
        Drops file in System32 directory
        
        PID:9332
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9444
        
        C:\Windows\SysWOW64\Dfgcakon.exe
        
        C:\Windows\system32\Dfgcakon.exe
        345⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        346⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        347⤵
        Drops file in System32 directory
        
        PID:9688
        
        C:\Windows\SysWOW64\Dfjpfj32.exe
        
        C:\Windows\system32\Dfjpfj32.exe
        348⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        349⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Dlghoa32.exe
        
        C:\Windows\system32\Dlghoa32.exe
        350⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        351⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Dikihe32.exe
        
        C:\Windows\system32\Dikihe32.exe
        352⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Dpdaepai.exe
        
        C:\Windows\system32\Dpdaepai.exe
        353⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        354⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        355⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        356⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        357⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        358⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        359⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        360⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        361⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        362⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        363⤵
        Modifies registry class
        
        PID:9364
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        364⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        365⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        366⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        367⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        368⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        369⤵
        Drops file in System32 directory
        
        PID:9816
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        370⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        371⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        372⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        373⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10232
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        374⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        375⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9552
        
        C:\Windows\SysWOW64\Fbjmhh32.exe
        
        C:\Windows\system32\Fbjmhh32.exe
        376⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10304
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        378⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        379⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        380⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        381⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        382⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        383⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        384⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        385⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        386⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        387⤵
        Modifies registry class
        
        PID:10740
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        388⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        389⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        390⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        391⤵
        Modifies registry class
        
        PID:10904
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        392⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        393⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10992
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        394⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        395⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        396⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        397⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        398⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        399⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        400⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        401⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        402⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\Hpcodihc.exe
        
        C:\Windows\system32\Hpcodihc.exe
        403⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        404⤵
        Modifies registry class
        
        PID:10548
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        405⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        406⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        407⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        408⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        409⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        410⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        411⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        412⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Ipjedh32.exe
        
        C:\Windows\system32\Ipjedh32.exe
        413⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        414⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        415⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        416⤵
        Drops file in System32 directory
        
        PID:10376
        
        C:\Windows\SysWOW64\Ilccoh32.exe
        
        C:\Windows\system32\Ilccoh32.exe
        417⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        418⤵
        Drops file in System32 directory
        
        PID:10448
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        419⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        420⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        421⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        422⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        423⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        424⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        425⤵
        Modifies registry class
        
        PID:10272
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        426⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6656
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        427⤵
        Drops file in System32 directory
        
        PID:7236
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        428⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        429⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        430⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        431⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        432⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        433⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        434⤵
        Drops file in System32 directory
        
        PID:10688
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        435⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        436⤵
        Modifies registry class
        
        PID:10264
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        437⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10452
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        438⤵
        Modifies registry class
        
        PID:10644
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        439⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        440⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        441⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        442⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        443⤵
        
        PID:11296
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        444⤵
        Drops file in System32 directory
        
        PID:11340
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        445⤵
        
        PID:11376
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        446⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        447⤵
        Drops file in System32 directory
        
        PID:11472
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        448⤵
        Modifies registry class
        
        PID:11520
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        449⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        450⤵
        
        PID:11604
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        451⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11648
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        452⤵
        
        PID:11688
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11728
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        454⤵
        Modifies registry class
        
        PID:11772
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11820
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        456⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        457⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        458⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11948
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        459⤵
        
        PID:11992
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        460⤵
        
        PID:12032
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        461⤵
        
        PID:12076
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        462⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        463⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        464⤵
        
        PID:12204
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        465⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        466⤵
        
        PID:12284
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        467⤵
        
        PID:11324
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        468⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        469⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        470⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11500
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        471⤵
        
        PID:11556
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        472⤵
        
        PID:11632
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        473⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10332
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        474⤵
        
        PID:11760
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        475⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        476⤵
        
        PID:11892
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        477⤵
        
        PID:11956
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        478⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        479⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        480⤵
        
        PID:12160
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        481⤵
        Modifies registry class
        
        PID:12236
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        482⤵
        
        PID:11288
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        483⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        484⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        485⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11588
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        486⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        487⤵
        Modifies registry class
        
        PID:11804
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        488⤵
        Modifies registry class
        
        PID:11912
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        489⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        490⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        491⤵
        Drops file in System32 directory
        
        PID:12272
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        492⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11368
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        493⤵
        Modifies registry class
        
        PID:11548
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        494⤵
        Modifies registry class
        
        PID:11784
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        495⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        496⤵
        Modifies registry class
        
        PID:12140
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        497⤵
        Drops file in System32 directory
        
        PID:11780
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        498⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        499⤵
        
        PID:11528
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        500⤵
        Drops file in System32 directory
        
        PID:9232
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        501⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        502⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        503⤵
        
        PID:12000
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        504⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        505⤵
        Modifies registry class
        
        PID:11844
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        506⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        507⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        508⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        509⤵
        Modifies registry class
        
        PID:3024
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        510⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        511⤵
        
        PID:12336
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        512⤵
        
        PID:12380
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        513⤵
        
        PID:12420
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        514⤵
        
        PID:12460
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        515⤵
        
        PID:12504
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        516⤵
        
        PID:12552
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        517⤵
        
        PID:12592
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        518⤵
        Drops file in System32 directory
        
        PID:12640
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        519⤵
        
        PID:12680
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        520⤵
        
        PID:12720
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        521⤵
        
        PID:12764
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        522⤵
        
        PID:12804
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        523⤵
        
        PID:12840
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        524⤵
        
        PID:12892
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        525⤵
        
        PID:12936
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        526⤵
        Modifies registry class
        
        PID:12972
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        527⤵
        
        PID:13008
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        528⤵
        
        PID:13056
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        529⤵
        Drops file in System32 directory
        
        PID:13096
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        530⤵
        
        PID:13144
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        531⤵
        
        PID:13180
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        532⤵
        
        PID:13232
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        533⤵
        
        PID:13276
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        534⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        535⤵
        
        PID:12328
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        536⤵
        
        PID:12388
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        537⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        538⤵
        Drops file in System32 directory
        
        PID:4328
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        539⤵
        
        PID:12540
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        540⤵
        
        PID:12576
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        541⤵
        
        PID:12648
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        542⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2348
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        543⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        544⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12792
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        545⤵
        
        PID:12824
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        546⤵
        
        PID:12880
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        547⤵
        
        PID:12956
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        548⤵
        
        PID:13004
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        549⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13052
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        550⤵
        
        PID:13104
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        551⤵
        
        PID:13140
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        552⤵
        
        PID:13212
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        553⤵
        
        PID:13272
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        554⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12300
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        555⤵
        
        PID:12368
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        556⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        557⤵
        
        PID:12484
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        558⤵
        Modifies registry class
        
        PID:3064
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        559⤵
        
        PID:2260
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        560⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        561⤵
        
        PID:12756
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        562⤵
        Modifies registry class
        
        PID:3020
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        563⤵
        
        PID:12868
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        564⤵
        
        PID:12964
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        565⤵
        Drops file in System32 directory
        
        PID:5000
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        566⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        567⤵
        
        PID:13064
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        568⤵
        
        PID:13132
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        569⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        570⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13260
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        571⤵
        
        PID:12320
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        572⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1420
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        573⤵
        
        PID:12416
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        574⤵
        Drops file in System32 directory
        
        PID:12448
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        575⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        576⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        577⤵
        Modifies registry class
        
        PID:1956
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        578⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        579⤵
        
        PID:12812
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        580⤵
        Modifies registry class
        
        PID:2800
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        581⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        582⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        583⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        584⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        585⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        586⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        587⤵
        
        PID:12360
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        588⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        589⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2100
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        590⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1608
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        591⤵
        
        PID:896
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        592⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        593⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        594⤵
        
        PID:12852
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        595⤵
        
        PID:960
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        596⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        597⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        598⤵
        Drops file in System32 directory
        
        PID:840
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        599⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13172
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        600⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        601⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        602⤵
        Drops file in System32 directory
        
        PID:1448
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        603⤵
        Drops file in System32 directory
        
        PID:2084
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        604⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        605⤵
        
        PID:12728
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        606⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        607⤵
        
        PID:3980
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        608⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        609⤵
        
        PID:13036
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        610⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        611⤵
        Modifies registry class
        
        PID:4476
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        612⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        613⤵
        
        PID:3736
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        614⤵
        
        PID:12580
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        615⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        616⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        617⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        618⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        619⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2232
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        620⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        621⤵
        Modifies registry class
        
        PID:2196
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        622⤵
        
        PID:13264
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        623⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        624⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2444
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        625⤵
        Drops file in System32 directory
        
        PID:3324
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        626⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        627⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        628⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        629⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        630⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5100
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        631⤵
        
        PID:208
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        632⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        633⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        634⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        635⤵
        
        PID:64
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        636⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        637⤵
        
        PID:13176
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        638⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        639⤵
        Drops file in System32 directory
        
        PID:4832
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        640⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        641⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4464
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        642⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        643⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        644⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4588
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        645⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        646⤵
        
        PID:12836
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        647⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        648⤵
        Modifies registry class
        
        PID:5400
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        649⤵
        Modifies registry class
        
        PID:5516
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        650⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        651⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        652⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        653⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5864
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        654⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        655⤵
        Modifies registry class
        
        PID:6124
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        656⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Hejqldci.exe
        
        C:\Windows\system32\Hejqldci.exe
        657⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        658⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        659⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        660⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        661⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        662⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Ipbaol32.exe
        
        C:\Windows\system32\Ipbaol32.exe
        663⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Ibqnkh32.exe
        
        C:\Windows\system32\Ibqnkh32.exe
        664⤵
        Drops file in System32 directory
        
        PID:6060
        
        C:\Windows\SysWOW64\Ieojgc32.exe
        
        C:\Windows\system32\Ieojgc32.exe
        665⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        666⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\Ibcjqgnm.exe
        
        C:\Windows\system32\Ibcjqgnm.exe
        667⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        668⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        669⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        670⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        671⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        672⤵
        Drops file in System32 directory
        
        PID:6352
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        673⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6488
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        674⤵
        Drops file in System32 directory
        
        PID:6616
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        675⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        676⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Jppnpjel.exe
        
        C:\Windows\system32\Jppnpjel.exe
        677⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        678⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        679⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        680⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        681⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6256
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        682⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        683⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        684⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        685⤵
        Drops file in System32 directory
        
        PID:6904
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        686⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        687⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        688⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        689⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        690⤵
        Drops file in System32 directory
        
        PID:4276
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        691⤵
        
        PID:448
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        692⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        693⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        694⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        695⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Kifojnol.exe
        
        C:\Windows\system32\Kifojnol.exe
        696⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Qiiflaoo.exe
        
        C:\Windows\system32\Qiiflaoo.exe
        697⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Qapnmopa.exe
        
        C:\Windows\system32\Qapnmopa.exe
        698⤵
        Modifies registry class
        
        PID:4228
        
        C:\Windows\SysWOW64\Qcnjijoe.exe
        
        C:\Windows\system32\Qcnjijoe.exe
        699⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        700⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Qjhbfd32.exe
        
        C:\Windows\system32\Qjhbfd32.exe
        701⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5780
        
        C:\Windows\SysWOW64\Acqgojmb.exe
        
        C:\Windows\system32\Acqgojmb.exe
        702⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Afockelf.exe
        
        C:\Windows\system32\Afockelf.exe
        703⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Ajjokd32.exe
        
        C:\Windows\system32\Ajjokd32.exe
        704⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7384
        
        C:\Windows\SysWOW64\Amikgpcc.exe
        
        C:\Windows\system32\Amikgpcc.exe
        705⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Apggckbf.exe
        
        C:\Windows\system32\Apggckbf.exe
        706⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Afappe32.exe
        
        C:\Windows\system32\Afappe32.exe
        707⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Aiplmq32.exe
        
        C:\Windows\system32\Aiplmq32.exe
        708⤵
        Drops file in System32 directory
        
        PID:5704
        
        C:\Windows\SysWOW64\Aagdnn32.exe
        
        C:\Windows\system32\Aagdnn32.exe
        709⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Aibibp32.exe
        
        C:\Windows\system32\Aibibp32.exe
        710⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Amnebo32.exe
        
        C:\Windows\system32\Amnebo32.exe
        711⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Adgmoigj.exe
        
        C:\Windows\system32\Adgmoigj.exe
        712⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Affikdfn.exe
        
        C:\Windows\system32\Affikdfn.exe
        713⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Aidehpea.exe
        
        C:\Windows\system32\Aidehpea.exe
        714⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Aalmimfd.exe
        
        C:\Windows\system32\Aalmimfd.exe
        715⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Abmjqe32.exe
        
        C:\Windows\system32\Abmjqe32.exe
        716⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Ajdbac32.exe
        
        C:\Windows\system32\Ajdbac32.exe
        717⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Bmbnnn32.exe
        
        C:\Windows\system32\Bmbnnn32.exe
        718⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Bpqjjjjl.exe
        
        C:\Windows\system32\Bpqjjjjl.exe
        719⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Bdlfjh32.exe
        
        C:\Windows\system32\Bdlfjh32.exe
        720⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Bfkbfd32.exe
        
        C:\Windows\system32\Bfkbfd32.exe
        721⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Bapgdm32.exe
        
        C:\Windows\system32\Bapgdm32.exe
        722⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        723⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Bbaclegm.exe
        
        C:\Windows\system32\Bbaclegm.exe
        724⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\Bjhkmbho.exe
        
        C:\Windows\system32\Bjhkmbho.exe
        725⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Bmggingc.exe
        
        C:\Windows\system32\Bmggingc.exe
        726⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        727⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Bdapehop.exe
        
        C:\Windows\system32\Bdapehop.exe
        728⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Bkkhbb32.exe
        
        C:\Windows\system32\Bkkhbb32.exe
        729⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Bmidnm32.exe
        
        C:\Windows\system32\Bmidnm32.exe
        730⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6516
        
        C:\Windows\SysWOW64\Bphqji32.exe
        
        C:\Windows\system32\Bphqji32.exe
        731⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Bbfmgd32.exe
        
        C:\Windows\system32\Bbfmgd32.exe
        732⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Bipecnkd.exe
        
        C:\Windows\system32\Bipecnkd.exe
        733⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Bagmdllg.exe
        
        C:\Windows\system32\Bagmdllg.exe
        734⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\Bdeiqgkj.exe
        
        C:\Windows\system32\Bdeiqgkj.exe
        735⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Bgdemb32.exe
        
        C:\Windows\system32\Bgdemb32.exe
        736⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\Cibain32.exe
        
        C:\Windows\system32\Cibain32.exe
        737⤵
        
        PID:2980
        
        C:\Windows\SysWOW64\Cpljehpo.exe
        
        C:\Windows\system32\Cpljehpo.exe
        738⤵
        Drops file in System32 directory
        
        PID:4292
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        739⤵
        Drops file in System32 directory
        
        PID:6908
        
        C:\Windows\SysWOW64\Ckbncapd.exe
        
        C:\Windows\system32\Ckbncapd.exe
        740⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Calfpk32.exe
        
        C:\Windows\system32\Calfpk32.exe
        741⤵
        Drops file in System32 directory
        
        PID:3508
        
        C:\Windows\SysWOW64\Cpogkhnl.exe
        
        C:\Windows\system32\Cpogkhnl.exe
        742⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Ccmcgcmp.exe
        
        C:\Windows\system32\Ccmcgcmp.exe
        743⤵
        Drops file in System32 directory
        
        PID:8372
        
        C:\Windows\SysWOW64\Ckdkhq32.exe
        
        C:\Windows\system32\Ckdkhq32.exe
        744⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Cmbgdl32.exe
        
        C:\Windows\system32\Cmbgdl32.exe
        745⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\Cancekeo.exe
        
        C:\Windows\system32\Cancekeo.exe
        746⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Ccppmc32.exe
        
        C:\Windows\system32\Ccppmc32.exe
        747⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Cgklmacf.exe
        
        C:\Windows\system32\Cgklmacf.exe
        748⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Ciihjmcj.exe
        
        C:\Windows\system32\Ciihjmcj.exe
        749⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8668
        
        C:\Windows\SysWOW64\Caqpkjcl.exe
        
        C:\Windows\system32\Caqpkjcl.exe
        750⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Cdolgfbp.exe
        
        C:\Windows\system32\Cdolgfbp.exe
        751⤵
        Modifies registry class
        
        PID:8260
        
        C:\Windows\SysWOW64\Ccblbb32.exe
        
        C:\Windows\system32\Ccblbb32.exe
        752⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Ckidcpjl.exe
        
        C:\Windows\system32\Ckidcpjl.exe
        753⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Cacmpj32.exe
        
        C:\Windows\system32\Cacmpj32.exe
        754⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Dkkaiphj.exe
        
        C:\Windows\system32\Dkkaiphj.exe
        755⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Dphiaffa.exe
        
        C:\Windows\system32\Dphiaffa.exe
        756⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Dcffnbee.exe
        
        C:\Windows\system32\Dcffnbee.exe
        757⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Diqnjl32.exe
        
        C:\Windows\system32\Diqnjl32.exe
        758⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8824 -s 400
        759⤵
        Program crash
        
        PID:8220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 8824 -ip 8824
1⤵
PID:8972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Anaomkdb.exe

Filesize
64KB

MD5
7573aaad5b417933d7acdcc97c11a5e4

SHA1
7cfdf95e710a89ea9d8ba1cf5d945aadb2228907

SHA256
8696596b7eec3f6d96cb02d6f330f3d1acd2bb5195eb22a2889bc07cb88ed5d1

SHA512
e5bb1bbdf1a8b1282a2664391749df0f3c84e22e03ab33bd1c05d72dbc3bc7f5d8e08bc42114a79643fd2df2134b8c868c7415ec5a1dcb54717fde139770985d

Download Submit
C:\Windows\SysWOW64\Bckkca32.exe

Filesize
192KB

MD5
5347934007c1a77ba9721f2a9d19c0c3

SHA1
4c77dff2017aa9392765e803f3e7399ef9f27062

SHA256
33d90b52ccec40fd82a61d7cd307b2f7ce897cd8852985b7ba4eb081dff1b341

SHA512
99f30420b8dd11e68ac854b58059b4e2b2456801170671f50135361613fe7dd3436887f403ee23c30a4e0dddacd1120239bb2bd552d287b23956af42360798d9

Download Submit
C:\Windows\SysWOW64\Bmlilh32.exe

Filesize
192KB

MD5
1b4b60b5dccc3ebc8fe7e596769817bf

SHA1
6bdff46d336f74a776c11ca814f05c9ff761e3d7

SHA256
7509cf4fa49ab2c6cb3f2623f3d29968d7f5a288fd81d7afce8ef903a9e6e493

SHA512
59b3567f76cceec03660a652c5cc901b69340c7a8845ae5040c828df29d869c11c56d1a094bcfc605927343160cf52b51be4a573a7a7f16c543e97a3bdce804d

Download Submit
C:\Windows\SysWOW64\Ccnncgmc.exe

Filesize
192KB

MD5
ceec9db999c9ea4fc02bf411c32e203d

SHA1
483ce4669c278e12c59f972260ee8c82ada5c486

SHA256
da96a7dcc115ad3ba69ec78f9af5d32ee7a5747f2eabeee69f3a2fe416dfb942

SHA512
e266196dc4cc363c8717b9ca4af601010d95c8112da0adeae4f71177dd355acf30cbd49bd1d45a2f2a80f038757f57866cc9c8043a14377e058b2aaa021dbf08

Download Submit
C:\Windows\SysWOW64\Cdcoim32.exe

Filesize
192KB

MD5
a8645aadf5a6d55deb04b51a9f06e084

SHA1
0184d569161a8b12e6126f4534597cb1eb45eb5c

SHA256
c1bc132866c0ed8c4002d4ce048061994afa1bc250add7fbe79f8c8213c6a86b

SHA512
3489216a44805a96e7b717403e4142b3c545676400b77c2bfc8ba3193703854e0bbdde063bd657447abec0dc5e14733dd0418fa10c6aada34dca4acece28b38e

Download Submit
C:\Windows\SysWOW64\Cdpjlb32.exe

Filesize
192KB

MD5
9ac0372e0692f9a77c403270a57e9216

SHA1
9dcff44b886ba93d16814a1b492111a4355d5045

SHA256
480cb63e22c927a3663fde737dcb1d4fab09c6f43b6e1bd3e5f909abb43707b5

SHA512
edb146aa3816e430d9f4d2f3b0abe4fa8abe4ce3aa97c90d902faf883b4fc94e45bbbc6296b38b09019fc64da935313cd387ffd3c8a1f781b16b8442466ac5f8

Download Submit
C:\Windows\SysWOW64\Ceckcp32.exe

Filesize
192KB

MD5
a5271ffcfb3c01a0faa703e9ae30fdca

SHA1
5b0f07f01d0d2781165a38b1654c691effba3bf5

SHA256
c9272b1a8eada3d2a8b6d544c87af419544b24ecb787ad48873fcc7f235f6889

SHA512
4a80e4d1bd6e20e1fef87a073201e822511f385705eaa9c64cc5050fdaee27b726c5414c10fb8fbcdca16d2385a3702c2a4f293fd74dfddb39084f117674889e

Download Submit
C:\Windows\SysWOW64\Ceehho32.exe

Filesize
192KB

MD5
b4f246a45bf4f9b3cc9372f67d773c53

SHA1
cf778349010d14d37efd064a06a081ae337f2fea

SHA256
0d5fad3e58119bfffac7d2c40cd00a1d88c3785036dd10a23cfb9507d5712069

SHA512
fa09d9169551b077789af9d048c500c15a593b001bcba1a2902e796f7259743e07b4428e956d90714cba0434d85eaa78a2b42416b99a4bf7f47cb80aef7b0800

Download Submit
C:\Windows\SysWOW64\Cegdnopg.exe

Filesize
192KB

MD5
75ad331108d0a3a4d5acab5abbca9728

SHA1
dfd0658f45214ef29107e77b05ad1cd6e7d43b2e

SHA256
0c3f8edc027a4e2dbf11c254191dc22811ad6346de11e3c7c284bb42e2045629

SHA512
2177af4e3ffcbee319efba9d4130b9cba579f854d0aebeca5892307dbe9f72463d00dd98bc6da1a1b0bcfa3dd5e0e07820bc27be1dc3467aef6b082a6a2477fe

Download Submit
C:\Windows\SysWOW64\Cjpckf32.exe

Filesize
192KB

MD5
8345000899e9a57cc282cf49231f22bc

SHA1
ca12a395781a51ba8a3c4979c431d2c62147888b

SHA256
9206138cfb2f6c4fb877481b3fca3edfa646cf34eef2c212feabb406ceb6fcb9

SHA512
e56760344bf5e1ccfb2ab2dd0f59c21d6f1f991c6c54c5a2d1a0abe5fb8198ffb803f09b20fc8cb97320012db7aa41563d306a4c605124fa2d1d5dee52115bc7

Download Submit
C:\Windows\SysWOW64\Cnicfe32.exe

Filesize
192KB

MD5
722f92707f98a68de555d430915d257e

SHA1
cbf43ba2e0c3d015d25e56c448479e408a5388a3

SHA256
5a680f248659fd450901396724f7bcf319769528f4879d4a764dba5b709c230b

SHA512
2032692e72a9f71b43c2c4c416369bece934e566ed211a661614355c4519f8846669a8ba314063aad30999c6fbe3345e1235a78f6092c1e8bf8f8d7c754e94f4

Download Submit
C:\Windows\SysWOW64\Danecp32.exe

Filesize
192KB

MD5
8889ab3e1bb6df9a862042636b7120fc

SHA1
2d3021878236176cfef3de56ffe64b4448eab4bb

SHA256
018ad28854c22f1dbcd1b0fe76fe0b11b4e92e79d4ebd29a7ff7f3d237bd6c75

SHA512
e165d851f46ed74d9a896d03d023103e719c0897c53ef46e7423ce2cd7304c72f47f147836ae95b23a32a5551135b4945856fc16a9c5c3c1cf44cbf2198a7790

Download Submit
C:\Windows\SysWOW64\Deagdn32.exe

Filesize
192KB

MD5
72d290b7f07daaf52c76e76143a921df

SHA1
2161c8a8dd9088e554ff16ac4a247f09ceb21d4b

SHA256
d65ed53662fef2392c7df57f53324eadc8e9a2fecd688c9261b76eaaff51f3fd

SHA512
92cb7fd8ef99e1b196c3e82d8017f3050eac62223cb024c9d230307fdb565fd1ee08361fa1c657e353e29cc4f1ae057721a84b8d95b7ec03361c42e0282de386

Download Submit
C:\Windows\SysWOW64\Dfiafg32.exe

Filesize
192KB

MD5
ce0e5c223fff1318a0c00b9ffdcc50cf

SHA1
26f1f281cfbc21599f108b83ca59be367f71dc78

SHA256
a3ca44a0553e54f1f67db6e42055244f04d58e900a8e050b867ebcb3a631e5db

SHA512
c18d4096ca93a8b7c41c857ce114398691879187ea463a77b89919c2dfcb2e563dcf89b6385e933429166f5efe56361974213d0b937af9fbf8095b6382f4995c

Download Submit
C:\Windows\SysWOW64\Dfnjafap.exe

Filesize
192KB

MD5
b8dd2d563e7a9b45c04ce5bc7888d3c9

SHA1
c39ffb477186eee198f462d8b7a09fb16909ec34

SHA256
3a517ecb9c0833cce714a68472d2c003dd068bd43535805241fc950a30b6321f

SHA512
8e2b02184036190ae2ca169029839a4e8198c1f3a59eb3bb835093c43e580746c72c884aad219e39afbf474bba5905c090e40c76f4cbf0aa3c42de56d0bba51f

Download Submit
C:\Windows\SysWOW64\Dknpmdfc.exe

Filesize
192KB

MD5
ef475bd10aad3674a66bf7447714b4e8

SHA1
8969212489830fec3ce890e992a86df9c20116ee

SHA256
87a3cdf9a06bc2d774584ba3162d0b8cd9f0eb1efe1da6e420edcbc57f93d420

SHA512
a14ad6a7625bffb231dfd4c2069760c3179a4c9258d5c4d5c24eb2f929b5dbe98633bde8a85776225319e445c5bbca46ca2318afbe31ba9a4b8b3dfbc32eb654

Download Submit
C:\Windows\SysWOW64\Dogogcpo.exe

Filesize
192KB

MD5
5430c745c6ab86d76450b7e9982aed44

SHA1
017b3534167839bb8afa6923ce55941bb04a9e76

SHA256
82e061501d539ca2f9aa0e1b56adcd1513d9cfab1506f239b73f97146d37dadb

SHA512
f5f3a04fa1ceb01478c8bf2e98e3da6e827bb5cd6e672c511d3bf42a4179b8038094d82d69044ecf557a49a34665705357de254bc0a53a52356bc54131dba445

Download Submit
C:\Windows\SysWOW64\Eajeon32.exe

Filesize
192KB

MD5
eea05730d8c19f9ea01903c7647b6b66

SHA1
27822314daefce3a7148ed5f417b73fd093cc0b3

SHA256
9cf5ac3090f7e44da1f402d9743d918f30abb31f4a0d24350aaa07ca941b63a9

SHA512
316c33550bfaa6efb995a2f4b0739ee204b999d7c6c9cb10f03ccb1815d0a2df602ce7c1807ef3f4b27585feb938db071c7024bc26d0225f9808daf70d2fdda6

Download Submit
C:\Windows\SysWOW64\Edknqiho.exe

Filesize
192KB

MD5
1b9640dedf3e67e1a7a2cf61d6e05565

SHA1
3773b9f743476804518214e6c4f926648f3bbc3f

SHA256
0ec99d8aff3272648c788b0e6a4212af4f9637b558e8daafbfd69b3e390fa6bc

SHA512
127447331b25ec0cc459144b7f99473e0f81e45b28edbbf6d88a5733f47df4462460bf61a26e2545904503e62d6a2ca99709f5c364de460ef11694e6384d1bf8

Download Submit
C:\Windows\SysWOW64\Edpgli32.exe

Filesize
192KB

MD5
2b74783408f0460d19b3bcaf125d97f8

SHA1
701f00abcdeacaabc6fc60453ab2dc8bea05fe56

SHA256
d3f092f616157b6e95814236bfce5d63468891f5c5178519b18c309d30aab0b2

SHA512
155958d0d038776823fd5a6f39e671e129ba64cc20254f1cf3fc90afd02eb709bd8aa60c9407cca03c6cdae2b8157543ff0ef635bb2af915fe12ae1b322ff13f

Download Submit
C:\Windows\SysWOW64\Eecdjmfi.exe

Filesize
192KB

MD5
e0c434715dc31593956ebfc7238a5c24

SHA1
a353623271c5478f36fea1973b7926898c21551c

SHA256
a23b0da842551386a6964b618fb6a66cb4e2214eb38efc6041557990f3fffed1

SHA512
106b8ab88ab8e2e4859d5d735aa6d2fe6cb70d13bf0ec071dde11704b215078e2b0e9a868eb6eb5750ad0d23c7daa77ee6ec016e4bf4925ccd58ac92484835cb

Download Submit
C:\Windows\SysWOW64\Ehiffh32.exe

Filesize
192KB

MD5
3ddd966b8f2e962043ef727a3166cf62

SHA1
1b548857b7499ba69c6ca8125b486c9172403df9

SHA256
e1a926fa11a3afa5d42102f5fd4a81ee284543aa334a0a404b28da4b656fcf56

SHA512
d4c006b7d9fa3b7b259b5074bb19e5be0b283bb471630d706c0f552ac12dea4af5c0e23d1a3909e78e112049468fcab2a22fcc4aedf88aa19c5e98a1ea803d94

Download Submit
C:\Windows\SysWOW64\Emcbio32.exe

Filesize
192KB

MD5
401e4773cf5a71bb9672e3f32a2d4ba5

SHA1
b325bb8c2fc84b4592ccbce87333f3f04fc2cda9

SHA256
b8d4951b5780bef5e7feb9f96add8fe03f77204cd0fcfbdbcc96b02a256d4871

SHA512
6cf00073e98e7f81b8ce3b7bbae9ec9cf741859b116b2baa9e352f2964f73077ce12d6e5878c8502d182d3c61fd777a70abbf52c6faf620b08cd6dc671c0e5cc

Download Submit
C:\Windows\SysWOW64\Eoekia32.exe

Filesize
192KB

MD5
4d7ae5df3037d1100c9bf7400dc82e10

SHA1
2a368c6271f93144da825a7555c80e2b0a96b1c2

SHA256
781cce07254a9ce9f705a1c92669ea40052bf03ecadea89dd37aef6b881cfa52

SHA512
45047c7d677a87f19c5b96c7898504a8de843cac38d8f60c1d0b61b77a96ebdc2b6f1f9aa0702c8b0899acd04b656e1c6c31cefc5c179d5213d762655f59baa8

Download Submit
C:\Windows\SysWOW64\Fddqghpd.exe

Filesize
192KB

MD5
bfa1a9abf52880afde6fa7a656dc51b9

SHA1
b3fe51d5a8f8343d4fa9e1eed2fb19381400d739

SHA256
99750e28f9a1fcb2ce203686980f22289d4b39f214e66ff09386256128a699f0

SHA512
dc9de7dc11ad27c600c2931e7052a3422b34f5698dcd28aec0600684e38fd21a97629054133dabd5fc40a58f043f1f4c07bb1adc56d4b683d96907ec26bfff0e

Download Submit
C:\Windows\SysWOW64\Fdijbg32.exe

Filesize
192KB

MD5
853e9489ba2c924dc574f639d00a5714

SHA1
98323bfa0e05452311e24f7dcb9c5e4f0366d919

SHA256
bc87b7b3dd088caa685625a55cfa34ee6939726b9da5df6cc055bec7fdfc7b5a

SHA512
0d74b3280b894d3789cffbb2cdae8c3f6298ef46cadb127e52b35f18c3462876bf41088eca93b2ff67c91cc83d51f21364c63892180c95a4b2886683327ee2a8

Download Submit
C:\Windows\SysWOW64\Fdkggg32.exe

Filesize
192KB

MD5
3faca3bfa08e97828915cbbfab6a7e73

SHA1
91d428dbf0b4326ac0c09bd0d294593b81e906be

SHA256
ab5b481e917a09e23384415f9515335da0287de22969d2dda6e9b59a63e2eac1

SHA512
d94845abb1394b2cbf97b71500733f62998e1945e568d67ddcd4845b07a146c83f1260e964a7734c60732b9340472004159d3d6c72cb87209e9c55bb2c2cf755

Download Submit
C:\Windows\SysWOW64\Fgeihcme.exe

Filesize
192KB

MD5
21346119a7e6d43799dde474fdece680

SHA1
8aaa322ef2cd03df65fbb789b360c07eb9be643b

SHA256
914856371f79921e81960e42710eb0db4e435d6e7095845b35fefe9ed30bd6e8

SHA512
270e31331586d7b5c983f6621594555e9aa5cd1947058d05392cd44f005498e840601ef524a4ea52ac5f121126029fa705e8e263499d2513520a453d1afeafc2

Download Submit
C:\Windows\SysWOW64\Fkeodaai.exe

Filesize
192KB

MD5
13ea28f49a4c4ab36e02dac49a45367c

SHA1
58c9838a55b6761745f2daef884bf2a82dcbe6d4

SHA256
071aa5fcc41c801a562aa81be993e078aeb2f335336425942b71992964d6fabb

SHA512
b815b335db01093cd0a33c74e5b88caf99ac74705adc3c025cfdbf9116846340dd849d7a61c33debd1ed1eebffe7ce236e3116ffac1774624e641c91d201fd39

Download Submit
C:\Windows\SysWOW64\Fneggdhg.exe

Filesize
192KB

MD5
d5d0f8b3cc582f3c06a6d357b81a6e86

SHA1
fc72aae4706e8c46867ff23f2363b0ee49a29927

SHA256
5d217edb4acab434f230ff298dc9f98c6634f219ae274ab3a5fbdf2254d0ecd7

SHA512
b6d87a6a90592b77fb919cefa22ce1948a37986a3e084204f2bcd9ec41ebc3a1fd2a41363eada78c9666240057c0e9f0dc08504857c444d966b8b424d8e2d31a

Download Submit
C:\Windows\SysWOW64\Fnmepn32.exe

Filesize
192KB

MD5
fca01e1f2e04d5bd929f0b842224126b

SHA1
89ffb0edb95bef2998b23d11347125d6f55ed8ca

SHA256
673590e7588b7f7da6dbd5c0982ae94ae65488fe8228d3d32b713cb9be061aad

SHA512
596c8cc7daa1033400cbfe236d1617ba729fbd05e001ddef7ba71040e024dae2fd7f80058056ac6cc50ffe4cb7d03d51ad41a7c32236ba89de5866a52a6e0faf

Download Submit
C:\Windows\SysWOW64\Foghnabl.exe

Filesize
192KB

MD5
06b2d006bb820caf78a72cb56f61a8f7

SHA1
63a9318bcff43ef61fb045010c828815d4d54ba2

SHA256
ed11dd5dfc91466f7825daa0c01c04538d26d5eab95fc6c8d4be454747178849

SHA512
f76d25b3df0cc3c7bdb34b8b5db1df43ac8bdb8c4cdb57deefeb1271f6b9247869073bfc14f7e43cbc344906cddfe250daa29a46fe4318015a02e552e9326105

Download Submit
C:\Windows\SysWOW64\Fpkibf32.exe

Filesize
192KB

MD5
4340815645d024273db498b021003b03

SHA1
51bc4daf851cb7b022d7c2f46c2adb947b51eb31

SHA256
f38d818d659c1b23ebe9c6aca67baa93ea2e2c891a2e7960cdd74298efe8b677

SHA512
3403be63e7d2b20ffb7507b8e3b5a91317252d3e15f01575496e5f52b8c0eb228faa2b5b1c9e092841c1ce99ae9ffe8281f3447573e218132ec468c5b7824c42

Download Submit
C:\Windows\SysWOW64\Gaadfkgc.exe

Filesize
192KB

MD5
e33663cb9185fe6a999e5255ea970c66

SHA1
b847e22cc50cc3aad2adefdd0dfb57a3c043cd93

SHA256
7f280046f92aeec441b93bdde17dfab105791d4e1854b7b2cb22d8dcbf0c8c0d

SHA512
168dbf8b1c1307079e2b27fb6e0d8c2adaaeef56e3971ea1385cef94c32ecd8fc16b38246b35132809c8c17d869f432bb6f3c6e6c904a6911229d7f827d8f9df

Download Submit
C:\Windows\SysWOW64\Gadqlkep.exe

Filesize
192KB

MD5
86b60e345c7e5bfc19e8ee08ae8c2da1

SHA1
c06c259ee5611b61aa3537d0544b6a2fb51b0df6

SHA256
315157cace5e86fd5c738a2e355f4da811678b948f3c8491b98553e832f28ed1

SHA512
25884281ed3d3dd2a1371f2f4002bf126325ed5dd8ae263861216b128440f7bd9de3d6b94932c7819a786143202106914133018b613a3e28e8eb1fa029ab99cb

Download Submit
C:\Windows\SysWOW64\Gddinf32.exe

Filesize
192KB

MD5
1002cf70c4a89b89b93bfe98a2c629ab

SHA1
a90f27feeaabafaaceb56d104adf0fd14e619a6e

SHA256
110124cabe019d4200691e8cc3c5b947647be65bc9c2f2ac6a9eafec3cff81ad

SHA512
38b332c4360532c49b858d9f60ddbf45366249725ba59b8a60e2ebab8da11abb59b5f76d8b502b19f5cbb18fd401d05b2898954f9f2ae485d3de0683c9682e63

Download Submit
C:\Windows\SysWOW64\Ggnlobej.exe

Filesize
192KB

MD5
8f6cd8abcb257d0af8ac8fc5996afa8f

SHA1
833c7e16dafbd9c99a82a2d4fdd39fef280a314c

SHA256
6b5b070cfa5aaa5f0c06884bcc4fc15d4253d5bc2717339763e9c8f896e8584b

SHA512
b77ed02fa3e0db2d2fc6fde7b372a705509c978365a1f6c85549e8f27ec2f3f3f85e9e697b02e3dd3d49b1fbd418122534562f10fa47508433246e283905f204

Download Submit
C:\Windows\SysWOW64\Ghbbcd32.exe

Filesize
192KB

MD5
1bd14a6c26ed56ca8b90d1e5db1b6a51

SHA1
bf42b74871e7517d06c3c6615a56b74871ec00f6

SHA256
b91943e922f28d272de8eff77f865e5a96c45afc6603151b97d0739ea465b135

SHA512
24f6d90aa05cfbf4a5eb9e0fb100464404374270b16529310b479630f052ee5428e6cafb2759eef0faed57d0fff6921eb775f235bf2ba4e5f8c68c01131a23ed

Download Submit
C:\Windows\SysWOW64\Gkglja32.exe

Filesize
192KB

MD5
1c5c976c306f9a3651440bd629800394

SHA1
90fabf128a77143f1975fa5b06236609a559454e

SHA256
ae285cd99ed20b319cced930f46fbb05e77f927ecd9e577f34f817c5bc04ef0e

SHA512
e390d497e0d0811b1cd9e7ecffbe84493a5d12f0f59fc38c5339339862252bf815ec97cfdf0ca7b370764cfcf8e969e65f451fc79dab3f09f3a4b4be8e35ea6b

Download Submit
C:\Windows\SysWOW64\Gmcdffmq.exe

Filesize
192KB

MD5
c31023594dc608a6d97b25b939fe390a

SHA1
4880cdc94b5a42767dee6604eb9aa7d5a36338b3

SHA256
c0f849479d6054ca803bd0a177bb629f7a857d03962ff96adae79e12a98e36b3

SHA512
61913474d6ba75787f11f38973d78be97c6d6964280538bae02edcc8b2ef90ca2250c66f576ab31f82d48b16c101a7c089183ef77fd373c2bac9b2aca631dd69

Download Submit
C:\Windows\SysWOW64\Hdicienl.exe

Filesize
192KB

MD5
6cefc6dfbf1cccfceb4486c678f774a7

SHA1
a9a5f573c0b0fbfca0281e7396a45fc4420d3083

SHA256
1c59fe9190fd4d191d087c2a38294d68b5918b374ce6d9383f0a253d4e22904d

SHA512
80c92f3a69332bfb71f9fd659e6bcaf8fca5185f199ed485bdce55f7cb67c75bc3c922cb6cb66b668980fa3e76a5c6ed4f1d4ee68c725ffb70c37d3a434ebeb7

Download Submit
C:\Windows\SysWOW64\Ikokan32.exe

Filesize
192KB

MD5
5cfcd8b128dd3584e8b81d04ebaeda0e

SHA1
4f9a2bc1a1cc6c020be4d02a063fd69d1a60fffe

SHA256
f6d3700943b95b9ce90161eb220c94cd750c5947a5bbdcfa0f82667224f5b3eb

SHA512
27ea38fbbb2b124cd62ff508c5c46abbcdee505805016269a57fae923878c242bc3af4a28d498124b54454454418d2c33617a73a89dcc6e76dbdb48bb93c84cd

Download Submit
C:\Windows\SysWOW64\Jngjch32.exe

Filesize
179KB

MD5
60546fa6222f92915c934ace14aea91c

SHA1
2ac48117a34f3ea42627c90bff89a79f9583d543

SHA256
0823041e63849f4a2960299e10d4e5d440e3c63e5d966c579e9b0c7e395b4a3d

SHA512
d31c82780496a3573b89e8914363df8d37aad438fcef1ac36356d6510f4b1ad955067e4e6bd818a4578c4f7db29dc0b3a3a4c036476634e0d53c47c572888d80

Download Submit
C:\Windows\SysWOW64\Kcbnnpka.exe

Filesize
192KB

MD5
4d767389910f868e4f3838457fb81873

SHA1
4b5a26fde473b4e1eb7a7db6377e4a97465f5e59

SHA256
ccc0c3fc05f0281df745e05c5f97ce9b47132ac73243b0116234f2a751e8ba98

SHA512
8bef23089f5b6e1412c6749a52c89eeb50d9a55a4f96238a8e4e2c2536eb3a46d1fe9e5eb8032415a983f584129c18b501705c2fb96bc1752de6cd41ed5d6f65

Download Submit
C:\Windows\SysWOW64\Kggcnoic.exe

Filesize
192KB

MD5
144e09252cee0ae48534d7713c3c79b4

SHA1
e7d7efab2fb2c41e6794cb08c1081a82495696ec

SHA256
91c0366ffcb1721a6c00dea55efbf66186f8d7f1e3e9fc31e5527c1da94525f4

SHA512
d77b83a0dd39463a4d45f5b7f145cc43e84d4bfba23ab4561a1611b0115c766d0b86735fcd08a17775251a6b77c38f0d2f55af2d5a80a9133a2594cf42126a9e

Download Submit
C:\Windows\SysWOW64\Kldmckic.exe

Filesize
192KB

MD5
31b1c8f442eee30007b85a90439522bd

SHA1
88cf43c2ee56f6be71951276505a27d76d02a507

SHA256
c55abf08ef85e6a1fd4591c2aaca6289ecc4afe79ed9d372140e3edc8f44edbe

SHA512
de0c040b915af6ca628d393f4453a8d5d231a676caf7ff786e8ebed9a999c400b355440bdcc0f3568d3bbea7f1d76395fb7e6d36836f3535100dfe9add00f522

Download Submit
C:\Windows\SysWOW64\Lbqklb32.exe

Filesize
192KB

MD5
b9748871b29e78b1af905d25c5b05834

SHA1
1d1fab465eb6ac9d96faa12e30005f627437cd76

SHA256
2702a54f285212818e4aeb61b3e97e1e3798f0396d0acb612300d5ccb5e1b898

SHA512
91f40d41241fe08975e398f3ca002542c3aa91a68de8b320f3defab2ac4598977634811d4bdaa0fb7a66be0e2fbc8f3502922f5b7f6928b482d2ed5f3eb48125

Download Submit
C:\Windows\SysWOW64\Mhdckaeo.exe

Filesize
192KB

MD5
27dba3adac37329090c47c9e0adcacad

SHA1
5c683ec183a54750865b56bc1c25727708b7b34e

SHA256
6f61f5afe28aa59f11555c4cd474d3cca1150171ef5f3121b9fb7b725279e548

SHA512
874eadd3c1b458e9ec7d65a72bcb7fed456a4cdf94c639e64cfe7df40ce47c590f9c5ebc8227e5201093ff9e99537a5f46178aff771183a0179236d83842bf68

Download Submit
C:\Windows\SysWOW64\Mjellmbp.exe

Filesize
192KB

MD5
156ddd371738332f600664b71d6991fe

SHA1
753fb5084457ae4f695999a41a06b450ac05da7f

SHA256
0e83170503f883099f533348c0735bd5836459f57cf90139d2114c9b1839ba29

SHA512
7d7629ccf0e2f00659f40be9109143fd93f5bb402196abd07a3f12cb1c27e3efce50c2d92a8dde19974489bab561773daec80620703a6b55d87cc45dcc6eb167

Download Submit
C:\Windows\SysWOW64\Mjneln32.exe

Filesize
192KB

MD5
05cc4751eba82ae41c7aa11b46985d0a

SHA1
a58d434d7b8d50d26d601bc0faf371699eb8adb9

SHA256
2e4279aa8655ac5c7388d151ecd676401fadb4bf517521622c0773a0a58e1aa2

SHA512
419af2769b817e9e63b2f57741a4cb56f2a5f7e24bfca80dcccbb3f2637a9fb11d9c0e7d2e948ea9a666eb3c0cdd2c4ca00d91accb350c0c5c0ad94eee812ba3

Download Submit
C:\Windows\SysWOW64\Mkmkkjko.exe

Filesize
192KB

MD5
be3769bcddcfbaa69e2458f9677eefa2

SHA1
ca26096c175712584e8ab7b7546730fe5d58ee28

SHA256
68981739d734db718dfbadf06f24faa242eb9fb09186bae7a2b108859cb6df82

SHA512
6ee1090f4e32d2abf69e54de461e80d5fe8b2d71f5cb1a6d289d700f126db2e6403e15de09997a91a55bae6636837cc506e1bcac6ef09c76d2fe844bb421fb2a

Download Submit
C:\Windows\SysWOW64\Mlpeff32.exe

Filesize
192KB

MD5
6672888b6d11d78bb55a76f489e08d61

SHA1
41b84e3ae80a58f168f79387022621535b82d616

SHA256
b38d317ae4f5a2c2d90d93ec9ee0cba7d619f3fb80e134d6eae1567fbc9f0f65

SHA512
cac87477989b17a415116b6e4894aeef2a5428a882f57e479e522d0c17a178bd065c141f561063650c3c205c09691104c33642d6f918f55d4bcda167e6b72945

Download Submit
C:\Windows\SysWOW64\Mpqkad32.exe

Filesize
128KB

MD5
b6eaf1d9a1809059e839a26bcb4ea2a9

SHA1
7dae80282aaa59b74a5c921610e0a37829b93678

SHA256
6801a358871d03688ba096b26a59e049aab8932948d95675bbbbaf8329be4d78

SHA512
d58965a0cd17e2433e1b3d78f6ce538d038e6d264deaa4918a0b8db1764bd5361fa488090358c913e1fe5b3caef53dac72682f764a4ce8eded074d88ef57f98e

Download Submit
C:\Windows\SysWOW64\Olijhmgj.exe

Filesize
192KB

MD5
c6c5f7bba91cbf54acb9a5d7f4d62f86

SHA1
22d318209e870e7bf0262109db4695daa8caadfa

SHA256
7f21b0e3098b8506e46f3d0343cd3836b93378d0d877e3baf0c0111a0e4e07cd

SHA512
5f7a13505f9e6aea60b9fdf2927a7b3195dda6094a9d4af500f030dee659e67997ba8b58846512c35f71d73b468160b0a3986d84bad7d2974a88e82ad05f4538

Download Submit
memory/696-384-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/840-324-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/936-346-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/960-145-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1096-354-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1100-330-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1112-105-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1180-426-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1280-250-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1472-312-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1516-165-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1524-366-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1528-318-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1536-48-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1576-348-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1580-282-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1588-13-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1592-294-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1652-98-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2116-242-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2196-432-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2240-258-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2320-264-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2340-194-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2388-25-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2476-86-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2576-178-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2604-130-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2684-402-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2712-300-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3012-65-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3064-113-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3112-138-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3164-306-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3192-372-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3324-226-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3412-41-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3544-57-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3616-378-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3740-420-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3964-81-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3964-5-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3964-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4048-217-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4068-292-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4072-32-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4084-206-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4324-276-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4332-270-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4384-360-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4452-188-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4468-414-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4596-396-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4624-390-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4736-336-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4764-122-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4776-73-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4792-408-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4824-174-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4828-209-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4840-17-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4912-238-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5000-154-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5108-90-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads