851868951f7f035c4aa9b16f97f56c6afb2b63f2541d37b172fc4a762665c977

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

851868951f7f035c4aa9b16f97f56c6afb2b63f2541d37b172fc4a762665c977.exe
Size

768KB
MD5

132620559609f6f69e09f0ae8b1af15b
SHA1

e967c0f4d614cb837fe0959c0ca7aa0ad7cae10e
SHA256

851868951f7f035c4aa9b16f97f56c6afb2b63f2541d37b172fc4a762665c977
SHA512

44d4a3ceaa4fcd245f83a02e1ed3b1830cf26e3b6441578d6d3b1da733852ddc49167c80c23ecb29653ca8f3ec821572c98a272420cfb3139d90cc1c79805ddb
SSDEEP

12288:Divv6IveDVqvQ6IvYvc6IveDVqvQ6IvBaSHaMaZRBEYyqmaf2qwiHPKgRC4gvGZX:yq5h3q5htaSHFaZRBEYyqmaf2qwiHPKu

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecbjkngo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdnmfclj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knqepc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ofhknodl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adkqoohc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kcoccc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oekiqccc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cofecami.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adfnofpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eehicoel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibhkfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgdpni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kflide32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmnkkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ihnkel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Miofjepg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmohno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qpcecb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhckcgpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Faenpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibnccmbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpjcdn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okgaijaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfendmoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfnfjehl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Haodle32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	851868951f7f035c4aa9b16f97f56c6afb2b63f2541d37b172fc4a762665c977.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jqglkmlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akhcfe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkbmqb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icknfcol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilcldb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kboljk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alkijdci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbdoof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmgejhgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ffpicn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcobaedj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahgjejhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aolblopj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klimip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmabggdm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdbnjdfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qjiipk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkhgmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ligqhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpqjglii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gjfnedho.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjahlgpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmdlmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iipfmggc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcoljagj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfmepi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hkmefd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eaindh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hglaej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmoohe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnfgcd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Efgemb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqmmmmph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ghlcnk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nglhld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eiieicml.exe

Executes dropped EXE 64 IoCs

pid	Process
1260	Edihepnm.exe
4244	Ecjhcg32.exe
848	Ecmeig32.exe
4604	Elgfgl32.exe
1624	Fojlngce.exe
4512	Fckajehi.exe
4052	Fkffog32.exe
3524	Gkhbdg32.exe
2076	Gbbkaako.exe
1072	Ghlcnk32.exe
4552	Gcagkdba.exe
3600	Ghopckpi.exe
1628	Gohhpe32.exe
1604	Gdeqhl32.exe
4396	Gkoiefmj.exe
996	Gbiaapdf.exe
3680	Gicinj32.exe
4648	Gkaejf32.exe
1940	Gblngpbd.exe
3280	Hkdbpe32.exe
3544	Hbnjmp32.exe
5100	Hmcojh32.exe
2884	Hobkfd32.exe
1200	Hijooifk.exe
464	Hodgkc32.exe
1688	Hfnphn32.exe
212	Himldi32.exe
4332	Hofdacke.exe
4744	Hecmijim.exe
1540	Hkmefd32.exe
4172	Hfcicmqp.exe
3464	Iiaephpc.exe
1836	Ikpaldog.exe
2452	Iehfdi32.exe
2552	Ikbnacmd.exe
4444	Iblfnn32.exe
3168	Iifokh32.exe
5108	Ildkgc32.exe
3160	Ibnccmbo.exe
3924	Iemppiab.exe
2428	Ilghlc32.exe
4060	Icnpmp32.exe
4492	Ifllil32.exe
1228	Imfdff32.exe
4760	Icplcpgo.exe
3384	Jimekgff.exe
4336	Jlkagbej.exe
3324	Jfaedkdp.exe
2748	Jmknaell.exe
3668	Jpijnqkp.exe
2316	Jfcbjk32.exe
3484	Jlpkba32.exe
4400	Jcgbco32.exe
2844	Jfeopj32.exe
3068	Jmpgldhg.exe
2940	Jcioiood.exe
632	Jfhlejnh.exe
1100	Jmbdbd32.exe
4740	Kboljk32.exe
4540	Kemhff32.exe
3308	Klgqcqkl.exe
4592	Kdnidn32.exe
5156	Kfmepi32.exe
5196	Kikame32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Njohbh32.dll	Ikpaldog.exe
File opened for modification	C:\Windows\SysWOW64\Ikbnacmd.exe	Iehfdi32.exe
File created	C:\Windows\SysWOW64\Nmdgikhi.exe	Nclbpf32.exe
File created	C:\Windows\SysWOW64\Fndpmndl.exe	Figgdg32.exe
File opened for modification	C:\Windows\SysWOW64\Pibdmp32.exe	Pakllc32.exe
File created	C:\Windows\SysWOW64\Jhdnigno.dll	Icknfcol.exe
File created	C:\Windows\SysWOW64\Ldipha32.exe	Ldgccb32.exe
File created	C:\Windows\SysWOW64\Hkpnbd32.dll	Aahbbkaq.exe
File created	C:\Windows\SysWOW64\Qohpkf32.exe	Qljcoj32.exe
File created	C:\Windows\SysWOW64\Ckhain32.dll	Glldgljg.exe
File created	C:\Windows\SysWOW64\Qfkjii32.dll	Jdpkflfe.exe
File created	C:\Windows\SysWOW64\Keqdmihc.exe	Knflpoqf.exe
File created	C:\Windows\SysWOW64\Jipegn32.dll	Enpmld32.exe
File opened for modification	C:\Windows\SysWOW64\Hkbdki32.exe	Hpmpnp32.exe
File created	C:\Windows\SysWOW64\Bjicdmmd.exe	Acokhc32.exe
File created	C:\Windows\SysWOW64\Djqblj32.exe	Ccgjopal.exe
File created	C:\Windows\SysWOW64\Mdgmickl.dll	Pmoiqneg.exe
File created	C:\Windows\SysWOW64\Igchfiof.exe	Iqipio32.exe
File created	C:\Windows\SysWOW64\Kageaj32.exe	Kkjlic32.exe
File opened for modification	C:\Windows\SysWOW64\Pdkoch32.exe	Pmaffnce.exe
File opened for modification	C:\Windows\SysWOW64\Pdenmbkk.exe	Pnifekmd.exe
File opened for modification	C:\Windows\SysWOW64\Dpqodfij.exe	Ligqhc32.exe
File created	C:\Windows\SysWOW64\Bdbnjdfg.exe	Badanigc.exe
File opened for modification	C:\Windows\SysWOW64\Dfamapjo.exe	Dinmhkke.exe
File opened for modification	C:\Windows\SysWOW64\Hlbcnd32.exe	Hffken32.exe
File opened for modification	C:\Windows\SysWOW64\Jjgchm32.exe	Icnklbmj.exe
File opened for modification	C:\Windows\SysWOW64\Embkoi32.exe	Ejdocm32.exe
File created	C:\Windows\SysWOW64\Iikmbh32.exe	Ifmqfm32.exe
File created	C:\Windows\SysWOW64\Pmhkafda.dll	Iebngial.exe
File created	C:\Windows\SysWOW64\Ombcji32.exe	Ofhknodl.exe
File created	C:\Windows\SysWOW64\Efkphnbd.exe	Epagkd32.exe
File opened for modification	C:\Windows\SysWOW64\Elnoopdj.exe	Eiobceef.exe
File created	C:\Windows\SysWOW64\Kpjgaoqm.exe	Jjpode32.exe
File opened for modification	C:\Windows\SysWOW64\Koodbl32.exe	Kjblje32.exe
File opened for modification	C:\Windows\SysWOW64\Ilibdmgp.exe	Ieojgc32.exe
File created	C:\Windows\SysWOW64\Bhefclee.dll	Elnoopdj.exe
File created	C:\Windows\SysWOW64\Oqadgkdb.dll	Cdecgbfa.exe
File created	C:\Windows\SysWOW64\Aknhkd32.dll	Gfeaopqo.exe
File created	C:\Windows\SysWOW64\Klqcmdnk.dll	Hffken32.exe
File created	C:\Windows\SysWOW64\Emlmcm32.dll	Lebijnak.exe
File opened for modification	C:\Windows\SysWOW64\Mbibfm32.exe	Mokfja32.exe
File created	C:\Windows\SysWOW64\Gbiaapdf.exe	Gkoiefmj.exe
File created	C:\Windows\SysWOW64\Clgbhl32.dll	Cljobphg.exe
File created	C:\Windows\SysWOW64\Dohjem32.dll	Kjlopc32.exe
File created	C:\Windows\SysWOW64\Eohmkb32.exe	Egaejeej.exe
File created	C:\Windows\SysWOW64\Linjpeof.dll	851868951f7f035c4aa9b16f97f56c6afb2b63f2541d37b172fc4a762665c977.exe
File opened for modification	C:\Windows\SysWOW64\Iqipio32.exe	Injcmc32.exe
File created	C:\Windows\SysWOW64\Eofgpikj.exe	Emhkdmlg.exe
File created	C:\Windows\SysWOW64\Lacdmh32.exe	Ljilqnlm.exe
File created	C:\Windows\SysWOW64\Leifdf32.dll	Aolblopj.exe
File created	C:\Windows\SysWOW64\Iccbgbmg.dll	Iblfnn32.exe
File created	C:\Windows\SysWOW64\Eodolnaf.dll	Fneggdhg.exe
File created	C:\Windows\SysWOW64\Haodle32.exe	Hbihjifh.exe
File opened for modification	C:\Windows\SysWOW64\Lebijnak.exe	Kcapicdj.exe
File opened for modification	C:\Windows\SysWOW64\Nahgoe32.exe	Nknobkje.exe
File created	C:\Windows\SysWOW64\Bnhpfjhc.dll	Obcceg32.exe
File created	C:\Windows\SysWOW64\Iknmmg32.dll	Mqfpckhm.exe
File created	C:\Windows\SysWOW64\Mokfja32.exe	Mlljnf32.exe
File opened for modification	C:\Windows\SysWOW64\Mlljnf32.exe	Mhoahh32.exe
File opened for modification	C:\Windows\SysWOW64\Igchfiof.exe	Iqipio32.exe
File created	C:\Windows\SysWOW64\Hankellh.dll	Ijqmhnko.exe
File created	C:\Windows\SysWOW64\Baaelkfn.dll	Fbbpmb32.exe
File created	C:\Windows\SysWOW64\Dahmfpap.exe	Dojqjdbl.exe
File created	C:\Windows\SysWOW64\Lbbfpo32.dll	Akhcfe32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6524	4584	WerFault.exe	783

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnnkgl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nliaao32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckbemgcp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hhknpmma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acpklg32.dll"	Ckilmcgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gkgmdnki.dll"	Dmohno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Icnpmp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kfankifm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Elnoopdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Flmqlg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phgibp32.dll"	Nmjfodne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gnbcohkd.dll"	Eidlnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Chkolm32.dll"	Mmnhcb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nndjndbh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kggcnoic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofhknodl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eohmkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbnkjc32.dll"	Kfmepi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lojkhk32.dll"	Qebhhp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ccpdoqgd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dngjff32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gpmomo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hfcicmqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kijchhbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiikaj32.dll"	Nognnj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Blhpqhlh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pcobaedj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qofcff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ocgmoc32.dll"	Ahgjejhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gohhpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oihmedma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dikihe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndflak32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bochmn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfpffeaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hoaojp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqkqhm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qacameaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hkmefd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oheihn32.dll"	Ejdocm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Legjmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlgkbp32.dll"	Poomegpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qdhogopn.dll"	Bdbnjdfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lcdciiec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Laqhhi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gbnoiqdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eklikcef.dll"	Gbalopbn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gblngpbd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ehfcfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahgjejhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdnmfclj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cogddd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpccmhdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klinjgke.dll"	Akamff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gigaka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Maggnali.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjcgfjdk.dll"	Napjdpcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbnjmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Debbhd32.dll"	Embkoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckpbnb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Noeahkfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpggodfg.dll"	Gdjibj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Idahjg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omegjomb.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4624 wrote to memory of 1260	4624	851868951f7f035c4aa9b16f97f56c6afb2b63f2541d37b172fc4a762665c977.exe	88
PID 4624 wrote to memory of 1260	4624	851868951f7f035c4aa9b16f97f56c6afb2b63f2541d37b172fc4a762665c977.exe	88
PID 4624 wrote to memory of 1260	4624	851868951f7f035c4aa9b16f97f56c6afb2b63f2541d37b172fc4a762665c977.exe	88
PID 1260 wrote to memory of 4244	1260	Edihepnm.exe	89
PID 1260 wrote to memory of 4244	1260	Edihepnm.exe	89
PID 1260 wrote to memory of 4244	1260	Edihepnm.exe	89
PID 4244 wrote to memory of 848	4244	Ecjhcg32.exe	90
PID 4244 wrote to memory of 848	4244	Ecjhcg32.exe	90
PID 4244 wrote to memory of 848	4244	Ecjhcg32.exe	90
PID 848 wrote to memory of 4604	848	Ecmeig32.exe	91
PID 848 wrote to memory of 4604	848	Ecmeig32.exe	91
PID 848 wrote to memory of 4604	848	Ecmeig32.exe	91
PID 4604 wrote to memory of 1624	4604	Elgfgl32.exe	93
PID 4604 wrote to memory of 1624	4604	Elgfgl32.exe	93
PID 4604 wrote to memory of 1624	4604	Elgfgl32.exe	93
PID 1624 wrote to memory of 4512	1624	Fojlngce.exe	94
PID 1624 wrote to memory of 4512	1624	Fojlngce.exe	94
PID 1624 wrote to memory of 4512	1624	Fojlngce.exe	94
PID 4512 wrote to memory of 4052	4512	Fckajehi.exe	96
PID 4512 wrote to memory of 4052	4512	Fckajehi.exe	96
PID 4512 wrote to memory of 4052	4512	Fckajehi.exe	96
PID 4052 wrote to memory of 3524	4052	Fkffog32.exe	97
PID 4052 wrote to memory of 3524	4052	Fkffog32.exe	97
PID 4052 wrote to memory of 3524	4052	Fkffog32.exe	97
PID 3524 wrote to memory of 2076	3524	Gkhbdg32.exe	98
PID 3524 wrote to memory of 2076	3524	Gkhbdg32.exe	98
PID 3524 wrote to memory of 2076	3524	Gkhbdg32.exe	98
PID 2076 wrote to memory of 1072	2076	Gbbkaako.exe	99
PID 2076 wrote to memory of 1072	2076	Gbbkaako.exe	99
PID 2076 wrote to memory of 1072	2076	Gbbkaako.exe	99
PID 1072 wrote to memory of 4552	1072	Ghlcnk32.exe	100
PID 1072 wrote to memory of 4552	1072	Ghlcnk32.exe	100
PID 1072 wrote to memory of 4552	1072	Ghlcnk32.exe	100
PID 4552 wrote to memory of 3600	4552	Gcagkdba.exe	101
PID 4552 wrote to memory of 3600	4552	Gcagkdba.exe	101
PID 4552 wrote to memory of 3600	4552	Gcagkdba.exe	101
PID 3600 wrote to memory of 1628	3600	Ghopckpi.exe	102
PID 3600 wrote to memory of 1628	3600	Ghopckpi.exe	102
PID 3600 wrote to memory of 1628	3600	Ghopckpi.exe	102
PID 1628 wrote to memory of 1604	1628	Gohhpe32.exe	103
PID 1628 wrote to memory of 1604	1628	Gohhpe32.exe	103
PID 1628 wrote to memory of 1604	1628	Gohhpe32.exe	103
PID 1604 wrote to memory of 4396	1604	Gdeqhl32.exe	104
PID 1604 wrote to memory of 4396	1604	Gdeqhl32.exe	104
PID 1604 wrote to memory of 4396	1604	Gdeqhl32.exe	104
PID 4396 wrote to memory of 996	4396	Gkoiefmj.exe	105
PID 4396 wrote to memory of 996	4396	Gkoiefmj.exe	105
PID 4396 wrote to memory of 996	4396	Gkoiefmj.exe	105
PID 996 wrote to memory of 3680	996	Gbiaapdf.exe	106
PID 996 wrote to memory of 3680	996	Gbiaapdf.exe	106
PID 996 wrote to memory of 3680	996	Gbiaapdf.exe	106
PID 3680 wrote to memory of 4648	3680	Gicinj32.exe	107
PID 3680 wrote to memory of 4648	3680	Gicinj32.exe	107
PID 3680 wrote to memory of 4648	3680	Gicinj32.exe	107
PID 4648 wrote to memory of 1940	4648	Gkaejf32.exe	108
PID 4648 wrote to memory of 1940	4648	Gkaejf32.exe	108
PID 4648 wrote to memory of 1940	4648	Gkaejf32.exe	108
PID 1940 wrote to memory of 3280	1940	Gblngpbd.exe	109
PID 1940 wrote to memory of 3280	1940	Gblngpbd.exe	109
PID 1940 wrote to memory of 3280	1940	Gblngpbd.exe	109
PID 3280 wrote to memory of 3544	3280	Hkdbpe32.exe	110
PID 3280 wrote to memory of 3544	3280	Hkdbpe32.exe	110
PID 3280 wrote to memory of 3544	3280	Hkdbpe32.exe	110
PID 3544 wrote to memory of 5100	3544	Hbnjmp32.exe	111

C:\Users\Admin\AppData\Local\Temp\851868951f7f035c4aa9b16f97f56c6afb2b63f2541d37b172fc4a762665c977.exe
"C:\Users\Admin\AppData\Local\Temp\851868951f7f035c4aa9b16f97f56c6afb2b63f2541d37b172fc4a762665c977.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\SysWOW64\Edihepnm.exe
  C:\Windows\system32\Edihepnm.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1260
- - C:\Windows\SysWOW64\Ecjhcg32.exe
    C:\Windows\system32\Ecjhcg32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\Windows\SysWOW64\Ecmeig32.exe
      C:\Windows\system32\Ecmeig32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:848
    - - C:\Windows\SysWOW64\Elgfgl32.exe
        
        C:\Windows\system32\Elgfgl32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4604
      - C:\Windows\SysWOW64\Fojlngce.exe
        
        C:\Windows\system32\Fojlngce.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1624
        
        C:\Windows\SysWOW64\Fckajehi.exe
        
        C:\Windows\system32\Fckajehi.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4052
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3524
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2076
        
        C:\Windows\SysWOW64\Ghlcnk32.exe
        
        C:\Windows\system32\Ghlcnk32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1072
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3600
        
        C:\Windows\SysWOW64\Gohhpe32.exe
        
        C:\Windows\system32\Gohhpe32.exe
        14⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1628
        
        C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1604
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4396
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:996
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3680
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4648
        
        C:\Windows\SysWOW64\Gblngpbd.exe
        
        C:\Windows\system32\Gblngpbd.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3280
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3544
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        23⤵
        Executes dropped EXE
        
        PID:5100
        
        C:\Windows\SysWOW64\Hobkfd32.exe
        
        C:\Windows\system32\Hobkfd32.exe
        24⤵
        Executes dropped EXE
        
        PID:2884
        
        C:\Windows\SysWOW64\Hijooifk.exe
        
        C:\Windows\system32\Hijooifk.exe
        25⤵
        Executes dropped EXE
        
        PID:1200
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        26⤵
        Executes dropped EXE
        
        PID:464
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        27⤵
        Executes dropped EXE
        
        PID:1688
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        28⤵
        Executes dropped EXE
        
        PID:212
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        29⤵
        Executes dropped EXE
        
        PID:4332
        
        C:\Windows\SysWOW64\Hecmijim.exe
        
        C:\Windows\system32\Hecmijim.exe
        30⤵
        Executes dropped EXE
        
        PID:4744
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1540
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4172
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        33⤵
        Executes dropped EXE
        
        PID:3464
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1836
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2452
        
        C:\Windows\SysWOW64\Ikbnacmd.exe
        
        C:\Windows\system32\Ikbnacmd.exe
        36⤵
        Executes dropped EXE
        
        PID:2552
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4444
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        38⤵
        Executes dropped EXE
        
        PID:3168
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        39⤵
        Executes dropped EXE
        
        PID:5108
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3160
        
        C:\Windows\SysWOW64\Iemppiab.exe
        
        C:\Windows\system32\Iemppiab.exe
        41⤵
        Executes dropped EXE
        
        PID:3924
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        42⤵
        Executes dropped EXE
        
        PID:2428
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        43⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4060
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        44⤵
        Executes dropped EXE
        
        PID:4492
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        45⤵
        Executes dropped EXE
        
        PID:1228
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        46⤵
        Executes dropped EXE
        
        PID:4760
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        47⤵
        Executes dropped EXE
        
        PID:3384
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        48⤵
        Executes dropped EXE
        
        PID:4336
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        49⤵
        Executes dropped EXE
        
        PID:3324
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        50⤵
        Executes dropped EXE
        
        PID:2748
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        51⤵
        Executes dropped EXE
        
        PID:3668
        
        C:\Windows\SysWOW64\Jfcbjk32.exe
        
        C:\Windows\system32\Jfcbjk32.exe
        52⤵
        Executes dropped EXE
        
        PID:2316
        
        C:\Windows\SysWOW64\Jlpkba32.exe
        
        C:\Windows\system32\Jlpkba32.exe
        53⤵
        Executes dropped EXE
        
        PID:3484
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        54⤵
        Executes dropped EXE
        
        PID:4400
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        55⤵
        Executes dropped EXE
        
        PID:2844
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        56⤵
        Executes dropped EXE
        
        PID:3068
        
        C:\Windows\SysWOW64\Jcioiood.exe
        
        C:\Windows\system32\Jcioiood.exe
        57⤵
        Executes dropped EXE
        
        PID:2940
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        58⤵
        Executes dropped EXE
        
        PID:632
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        59⤵
        Executes dropped EXE
        
        PID:1100
        
        C:\Windows\SysWOW64\Kboljk32.exe
        
        C:\Windows\system32\Kboljk32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4740
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        61⤵
        Executes dropped EXE
        
        PID:4540
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        62⤵
        Executes dropped EXE
        
        PID:3308
        
        C:\Windows\SysWOW64\Kdnidn32.exe
        
        C:\Windows\system32\Kdnidn32.exe
        63⤵
        Executes dropped EXE
        
        PID:4592
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:5156
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        65⤵
        Executes dropped EXE
        
        PID:5196
        
        C:\Windows\SysWOW64\Klimip32.exe
        
        C:\Windows\system32\Klimip32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5228
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        67⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        68⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        69⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        70⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        71⤵
        Modifies registry class
        
        PID:5412
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        72⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5484
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        74⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        75⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        76⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        77⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        78⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Llcpoo32.exe
        
        C:\Windows\system32\Llcpoo32.exe
        79⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        80⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        81⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5804
        
        C:\Windows\SysWOW64\Dpqodfij.exe
        
        C:\Windows\system32\Dpqodfij.exe
        83⤵
        
        PID:716
        
        C:\Windows\SysWOW64\Dapkni32.exe
        
        C:\Windows\system32\Dapkni32.exe
        84⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\Ddadpdmn.exe
        
        C:\Windows\system32\Ddadpdmn.exe
        85⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Dinmhkke.exe
        
        C:\Windows\system32\Dinmhkke.exe
        86⤵
        Drops file in System32 directory
        
        PID:5276
        
        C:\Windows\SysWOW64\Dfamapjo.exe
        
        C:\Windows\system32\Dfamapjo.exe
        87⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\Eagaoh32.exe
        
        C:\Windows\system32\Eagaoh32.exe
        88⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Edemkd32.exe
        
        C:\Windows\system32\Edemkd32.exe
        89⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Efdjgo32.exe
        
        C:\Windows\system32\Efdjgo32.exe
        90⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Eibfck32.exe
        
        C:\Windows\system32\Eibfck32.exe
        91⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Eaindh32.exe
        
        C:\Windows\system32\Eaindh32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2412
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        93⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Empoiimf.exe
        
        C:\Windows\system32\Empoiimf.exe
        94⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Epokedmj.exe
        
        C:\Windows\system32\Epokedmj.exe
        95⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Ehfcfb32.exe
        
        C:\Windows\system32\Ehfcfb32.exe
        96⤵
        Modifies registry class
        
        PID:5920
        
        C:\Windows\SysWOW64\Ejdocm32.exe
        
        C:\Windows\system32\Ejdocm32.exe
        97⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5976
        
        C:\Windows\SysWOW64\Embkoi32.exe
        
        C:\Windows\system32\Embkoi32.exe
        98⤵
        Modifies registry class
        
        PID:6032
        
        C:\Windows\SysWOW64\Epagkd32.exe
        
        C:\Windows\system32\Epagkd32.exe
        99⤵
        Drops file in System32 directory
        
        PID:6072
        
        C:\Windows\SysWOW64\Efkphnbd.exe
        
        C:\Windows\system32\Efkphnbd.exe
        100⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Emehdh32.exe
        
        C:\Windows\system32\Emehdh32.exe
        101⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\Epcdqd32.exe
        
        C:\Windows\system32\Epcdqd32.exe
        102⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\Fkihnmhj.exe
        
        C:\Windows\system32\Fkihnmhj.exe
        103⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\Fmgejhgn.exe
        
        C:\Windows\system32\Fmgejhgn.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2920
        
        C:\Windows\SysWOW64\Fdamgb32.exe
        
        C:\Windows\system32\Fdamgb32.exe
        105⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:232
        
        C:\Windows\SysWOW64\Faenpf32.exe
        
        C:\Windows\system32\Faenpf32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3212
        
        C:\Windows\SysWOW64\Fdcjlb32.exe
        
        C:\Windows\system32\Fdcjlb32.exe
        108⤵
        
        PID:744
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        109⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Fhabbp32.exe
        
        C:\Windows\system32\Fhabbp32.exe
        110⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\Fkpool32.exe
        
        C:\Windows\system32\Fkpool32.exe
        111⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Fmnkkg32.exe
        
        C:\Windows\system32\Fmnkkg32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5512
        
        C:\Windows\SysWOW64\Fdhcgaic.exe
        
        C:\Windows\system32\Fdhcgaic.exe
        113⤵
        
        PID:224
        
        C:\Windows\SysWOW64\Fggocmhf.exe
        
        C:\Windows\system32\Fggocmhf.exe
        114⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Falcae32.exe
        
        C:\Windows\system32\Falcae32.exe
        115⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        116⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        117⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        118⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Gkgeoklj.exe
        
        C:\Windows\system32\Gkgeoklj.exe
        119⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Gkiaej32.exe
        
        C:\Windows\system32\Gkiaej32.exe
        120⤵
        
        PID:3736
        
        C:\Windows\SysWOW64\Gnhnaf32.exe
        
        C:\Windows\system32\Gnhnaf32.exe
        121⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\Ggpbjkpl.exe
        
        C:\Windows\system32\Ggpbjkpl.exe
        122⤵
        
        PID:64
        
        C:\Windows\SysWOW64\Gphgbafl.exe
        
        C:\Windows\system32\Gphgbafl.exe
        123⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\Gknkpjfb.exe
        
        C:\Windows\system32\Gknkpjfb.exe
        124⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\Gnlgleef.exe
        
        C:\Windows\system32\Gnlgleef.exe
        125⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        126⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Hjchaf32.exe
        
        C:\Windows\system32\Hjchaf32.exe
        127⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\Hpmpnp32.exe
        
        C:\Windows\system32\Hpmpnp32.exe
        128⤵
        Drops file in System32 directory
        
        PID:5892
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        129⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Hgiepjga.exe
        
        C:\Windows\system32\Hgiepjga.exe
        130⤵
        
        PID:812
        
        C:\Windows\SysWOW64\Hncmmd32.exe
        
        C:\Windows\system32\Hncmmd32.exe
        131⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        132⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Hglaej32.exe
        
        C:\Windows\system32\Hglaej32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5320
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        134⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\Hhknpmma.exe
        
        C:\Windows\system32\Hhknpmma.exe
        135⤵
        Modifies registry class
        
        PID:5912
        
        C:\Windows\SysWOW64\Ihnkel32.exe
        
        C:\Windows\system32\Ihnkel32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1860
        
        C:\Windows\SysWOW64\Injcmc32.exe
        
        C:\Windows\system32\Injcmc32.exe
        137⤵
        Drops file in System32 directory
        
        PID:1824
        
        C:\Windows\SysWOW64\Iqipio32.exe
        
        C:\Windows\system32\Iqipio32.exe
        138⤵
        Drops file in System32 directory
        
        PID:5288
        
        C:\Windows\SysWOW64\Igchfiof.exe
        
        C:\Windows\system32\Igchfiof.exe
        139⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Ijadbdoj.exe
        
        C:\Windows\system32\Ijadbdoj.exe
        140⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\Iqklon32.exe
        
        C:\Windows\system32\Iqklon32.exe
        141⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        142⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        143⤵
        
        PID:316
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        144⤵
        
        PID:640
        
        C:\Windows\SysWOW64\Iggaah32.exe
        
        C:\Windows\system32\Iggaah32.exe
        145⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Ijfnmc32.exe
        
        C:\Windows\system32\Ijfnmc32.exe
        146⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Iqpfjnba.exe
        
        C:\Windows\system32\Iqpfjnba.exe
        147⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        148⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Ibobdqid.exe
        
        C:\Windows\system32\Ibobdqid.exe
        149⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Jkhgmf32.exe
        
        C:\Windows\system32\Jkhgmf32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6316
        
        C:\Windows\SysWOW64\Jbaojpgb.exe
        
        C:\Windows\system32\Jbaojpgb.exe
        151⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Jdpkflfe.exe
        
        C:\Windows\system32\Jdpkflfe.exe
        152⤵
        Drops file in System32 directory
        
        PID:6428
        
        C:\Windows\SysWOW64\Jkjcbe32.exe
        
        C:\Windows\system32\Jkjcbe32.exe
        153⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Jqglkmlj.exe
        
        C:\Windows\system32\Jqglkmlj.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6516
        
        C:\Windows\SysWOW64\Jklphekp.exe
        
        C:\Windows\system32\Jklphekp.exe
        155⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Jnkldqkc.exe
        
        C:\Windows\system32\Jnkldqkc.exe
        156⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Jdedak32.exe
        
        C:\Windows\system32\Jdedak32.exe
        157⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Jgcamf32.exe
        
        C:\Windows\system32\Jgcamf32.exe
        158⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        159⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Jibmgi32.exe
        
        C:\Windows\system32\Jibmgi32.exe
        160⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        161⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Kghjhemo.exe
        
        C:\Windows\system32\Kghjhemo.exe
        162⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Knbbep32.exe
        
        C:\Windows\system32\Knbbep32.exe
        163⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        164⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Kgjgne32.exe
        
        C:\Windows\system32\Kgjgne32.exe
        165⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        166⤵
        Modifies registry class
        
        PID:7020
        
        C:\Windows\SysWOW64\Kkhpdcab.exe
        
        C:\Windows\system32\Kkhpdcab.exe
        167⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Knflpoqf.exe
        
        C:\Windows\system32\Knflpoqf.exe
        168⤵
        Drops file in System32 directory
        
        PID:7104
        
        C:\Windows\SysWOW64\Keqdmihc.exe
        
        C:\Windows\system32\Keqdmihc.exe
        169⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Kkjlic32.exe
        
        C:\Windows\system32\Kkjlic32.exe
        170⤵
        Drops file in System32 directory
        
        PID:6160
        
        C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        171⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Leenhhdn.exe
        
        C:\Windows\system32\Leenhhdn.exe
        172⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Lgcjdd32.exe
        
        C:\Windows\system32\Lgcjdd32.exe
        173⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Lbinam32.exe
        
        C:\Windows\system32\Lbinam32.exe
        174⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        175⤵
        Modifies registry class
        
        PID:6588
        
        C:\Windows\SysWOW64\Lkabjbih.exe
        
        C:\Windows\system32\Lkabjbih.exe
        176⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Lejgch32.exe
        
        C:\Windows\system32\Lejgch32.exe
        177⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        178⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Lnbklm32.exe
        
        C:\Windows\system32\Lnbklm32.exe
        179⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Laqhhi32.exe
        
        C:\Windows\system32\Laqhhi32.exe
        180⤵
        Modifies registry class
        
        PID:6928
        
        C:\Windows\SysWOW64\Lgkpdcmi.exe
        
        C:\Windows\system32\Lgkpdcmi.exe
        181⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        182⤵
        Drops file in System32 directory
        
        PID:7056
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        183⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Mbbagk32.exe
        
        C:\Windows\system32\Mbbagk32.exe
        184⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Mjneln32.exe
        
        C:\Windows\system32\Mjneln32.exe
        185⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Mahnhhod.exe
        
        C:\Windows\system32\Mahnhhod.exe
        186⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Miofjepg.exe
        
        C:\Windows\system32\Miofjepg.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6808
        
        C:\Windows\SysWOW64\Mlmbfqoj.exe
        
        C:\Windows\system32\Mlmbfqoj.exe
        188⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Mnlnbl32.exe
        
        C:\Windows\system32\Mnlnbl32.exe
        189⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Majjng32.exe
        
        C:\Windows\system32\Majjng32.exe
        190⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Miaboe32.exe
        
        C:\Windows\system32\Miaboe32.exe
        191⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Mnnkgl32.exe
        
        C:\Windows\system32\Mnnkgl32.exe
        192⤵
        Modifies registry class
        
        PID:6768
        
        C:\Windows\SysWOW64\Mehcdfch.exe
        
        C:\Windows\system32\Mehcdfch.exe
        193⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Mlbkap32.exe
        
        C:\Windows\system32\Mlbkap32.exe
        194⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Mblcnj32.exe
        
        C:\Windows\system32\Mblcnj32.exe
        195⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Mifljdjo.exe
        
        C:\Windows\system32\Mifljdjo.exe
        196⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Njghbl32.exe
        
        C:\Windows\system32\Njghbl32.exe
        197⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        198⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        199⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Noeahkfc.exe
        
        C:\Windows\system32\Noeahkfc.exe
        200⤵
        Modifies registry class
        
        PID:7224
        
        C:\Windows\SysWOW64\Neoieenp.exe
        
        C:\Windows\system32\Neoieenp.exe
        201⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        202⤵
        Modifies registry class
        
        PID:7312
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        203⤵
        Modifies registry class
        
        PID:7352
        
        C:\Windows\SysWOW64\Nimbkc32.exe
        
        C:\Windows\system32\Nimbkc32.exe
        204⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        205⤵
        Drops file in System32 directory
        
        PID:7432
        
        C:\Windows\SysWOW64\Nahgoe32.exe
        
        C:\Windows\system32\Nahgoe32.exe
        206⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        207⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        208⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        209⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Nlphbnoe.exe
        
        C:\Windows\system32\Nlphbnoe.exe
        210⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        211⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Ohghgodi.exe
        
        C:\Windows\system32\Ohghgodi.exe
        212⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        213⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Oekiqccc.exe
        
        C:\Windows\system32\Oekiqccc.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7904
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        215⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7984
        
        C:\Windows\SysWOW64\Oboijgbl.exe
        
        C:\Windows\system32\Oboijgbl.exe
        217⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        218⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8168
        
        C:\Windows\SysWOW64\Oadfkdgd.exe
        
        C:\Windows\system32\Oadfkdgd.exe
        220⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Olijhmgj.exe
        
        C:\Windows\system32\Olijhmgj.exe
        221⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        222⤵
        Drops file in System32 directory
        
        PID:7320
        
        C:\Windows\SysWOW64\Oeaoab32.exe
        
        C:\Windows\system32\Oeaoab32.exe
        223⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Ohpkmn32.exe
        
        C:\Windows\system32\Ohpkmn32.exe
        224⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Pojcjh32.exe
        
        C:\Windows\system32\Pojcjh32.exe
        225⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Piphgq32.exe
        
        C:\Windows\system32\Piphgq32.exe
        226⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Pkadoiip.exe
        
        C:\Windows\system32\Pkadoiip.exe
        227⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        228⤵
        Drops file in System32 directory
        
        PID:7848
        
        C:\Windows\SysWOW64\Pibdmp32.exe
        
        C:\Windows\system32\Pibdmp32.exe
        229⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        230⤵
        Modifies registry class
        
        PID:8028
        
        C:\Windows\SysWOW64\Peieba32.exe
        
        C:\Windows\system32\Peieba32.exe
        231⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Pcobaedj.exe
        
        C:\Windows\system32\Pcobaedj.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6436
        
        C:\Windows\SysWOW64\Piijno32.exe
        
        C:\Windows\system32\Piijno32.exe
        233⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Qofcff32.exe
        
        C:\Windows\system32\Qofcff32.exe
        234⤵
        Modifies registry class
        
        PID:7416
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        235⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        236⤵
        Drops file in System32 directory
        
        PID:7672
        
        C:\Windows\SysWOW64\Qohpkf32.exe
        
        C:\Windows\system32\Qohpkf32.exe
        237⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Qebhhp32.exe
        
        C:\Windows\system32\Qebhhp32.exe
        238⤵
        Modifies registry class
        
        PID:7964
        
        C:\Windows\SysWOW64\Ahqddk32.exe
        
        C:\Windows\system32\Ahqddk32.exe
        239⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Aojlaeei.exe
        
        C:\Windows\system32\Aojlaeei.exe
        240⤵
        
        PID:1128
        
        C:\Windows\SysWOW64\Aeddnp32.exe
        
        C:\Windows\system32\Aeddnp32.exe
        241⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Ahcajk32.exe
        
        C:\Windows\system32\Ahcajk32.exe
        242⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Akamff32.exe
        
        C:\Windows\system32\Akamff32.exe
        243⤵
        Modifies registry class
        
        PID:7880
        
        C:\Windows\SysWOW64\Aakebqbj.exe
        
        C:\Windows\system32\Aakebqbj.exe
        244⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Ajbmdn32.exe
        
        C:\Windows\system32\Ajbmdn32.exe
        245⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Alqjpi32.exe
        
        C:\Windows\system32\Alqjpi32.exe
        246⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Afinioip.exe
        
        C:\Windows\system32\Afinioip.exe
        247⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6964
        
        C:\Windows\SysWOW64\Akffafgg.exe
        
        C:\Windows\system32\Akffafgg.exe
        249⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Abponp32.exe
        
        C:\Windows\system32\Abponp32.exe
        250⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        251⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Akhcfe32.exe
        
        C:\Windows\system32\Akhcfe32.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7912
        
        C:\Windows\SysWOW64\Acokhc32.exe
        
        C:\Windows\system32\Acokhc32.exe
        253⤵
        Drops file in System32 directory
        
        PID:8212
        
        C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        254⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Blhpqhlh.exe
        
        C:\Windows\system32\Blhpqhlh.exe
        255⤵
        Modifies registry class
        
        PID:8300
        
        C:\Windows\SysWOW64\Bbdhiojo.exe
        
        C:\Windows\system32\Bbdhiojo.exe
        256⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Bohibc32.exe
        
        C:\Windows\system32\Bohibc32.exe
        257⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        258⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Bfendmoc.exe
        
        C:\Windows\system32\Bfendmoc.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8480
        
        C:\Windows\SysWOW64\Bmofagfp.exe
        
        C:\Windows\system32\Bmofagfp.exe
        260⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Bombmcec.exe
        
        C:\Windows\system32\Bombmcec.exe
        261⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8600
        
        C:\Windows\SysWOW64\Bckkca32.exe
        
        C:\Windows\system32\Bckkca32.exe
        263⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Ckfphc32.exe
        
        C:\Windows\system32\Ckfphc32.exe
        264⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        265⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        266⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        267⤵
        Modifies registry class
        
        PID:8852
        
        C:\Windows\SysWOW64\Ccpdoqgd.exe
        
        C:\Windows\system32\Ccpdoqgd.exe
        268⤵
        Modifies registry class
        
        PID:8896
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        269⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9000
        
        C:\Windows\SysWOW64\Cfqmpl32.exe
        
        C:\Windows\system32\Cfqmpl32.exe
        271⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Cfcjfk32.exe
        
        C:\Windows\system32\Cfcjfk32.exe
        272⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Ckpbnb32.exe
        
        C:\Windows\system32\Ckpbnb32.exe
        273⤵
        Modifies registry class
        
        PID:9140
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        274⤵
        Drops file in System32 directory
        
        PID:9192
        
        C:\Windows\SysWOW64\Djqblj32.exe
        
        C:\Windows\system32\Djqblj32.exe
        275⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6384
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        277⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        278⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        279⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        280⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Dlghoa32.exe
        
        C:\Windows\system32\Dlghoa32.exe
        281⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Dikihe32.exe
        
        C:\Windows\system32\Dikihe32.exe
        282⤵
        Modifies registry class
        
        PID:8632
        
        C:\Windows\SysWOW64\Dpdaepai.exe
        
        C:\Windows\system32\Dpdaepai.exe
        283⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        284⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8860
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        286⤵
        Drops file in System32 directory
        
        PID:8920
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        287⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9028
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        288⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        289⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        290⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        291⤵
        Modifies registry class
        
        PID:8456
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        292⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Ejchhgid.exe
        
        C:\Windows\system32\Ejchhgid.exe
        293⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        294⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        295⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8844
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        297⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        298⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Fmfnpa32.exe
        
        C:\Windows\system32\Fmfnpa32.exe
        299⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Fpejlmcf.exe
        
        C:\Windows\system32\Fpejlmcf.exe
        300⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        301⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        302⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        303⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        304⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        305⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        306⤵
        Modifies registry class
        
        PID:6388
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        307⤵
        Modifies registry class
        
        PID:8544
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8708
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        309⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4428
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        310⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        311⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        312⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        313⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8872
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        315⤵
        
        PID:776
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        316⤵
        Drops file in System32 directory
        
        PID:2472
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        317⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        318⤵
        
        PID:2740
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8916
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        320⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        321⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        322⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        323⤵
        Modifies registry class
        
        PID:1244
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        324⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        325⤵
        Drops file in System32 directory
        
        PID:4600
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2292
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        327⤵
        Drops file in System32 directory
        
        PID:1348
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        328⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        329⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        330⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        331⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        332⤵
        
        PID:1240
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        333⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        334⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        335⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        336⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        337⤵
        Modifies registry class
        
        PID:4172
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        338⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        339⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        340⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        341⤵
        
        PID:3292
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        342⤵
        Drops file in System32 directory
        
        PID:5172
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        343⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        344⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        345⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        346⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        347⤵
        
        PID:536
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        348⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        349⤵
        Modifies registry class
        
        PID:5676
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        350⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        351⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        352⤵
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        353⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5488
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        355⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        356⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        357⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        358⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        359⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        360⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        361⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        362⤵
        Modifies registry class
        
        PID:1396
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        363⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        364⤵
        Modifies registry class
        
        PID:5096
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        365⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        366⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4828
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        368⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        369⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        370⤵
        
        PID:632
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        371⤵
        Modifies registry class
        
        PID:4060
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        372⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        373⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        374⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        375⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        376⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        377⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        378⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        379⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        380⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        381⤵
        Modifies registry class
        
        PID:3228
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        382⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        383⤵
        
        PID:2844
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        384⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        385⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        386⤵
        
        PID:840
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        387⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        388⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        389⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        390⤵
        Drops file in System32 directory
        
        PID:9336
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        391⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        392⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        393⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        394⤵
        Drops file in System32 directory
        
        PID:9524
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        395⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        396⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        397⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        398⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        399⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        400⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        401⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        402⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9876
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        403⤵
        Drops file in System32 directory
        
        PID:9920
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9964
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        405⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        406⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10044
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        407⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        408⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        409⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        410⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        411⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        412⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        413⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        414⤵
        Modifies registry class
        
        PID:8664
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        415⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        416⤵
        Drops file in System32 directory
        
        PID:9488
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9564
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        418⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        419⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        420⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        421⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        422⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        423⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        424⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        425⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        426⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        427⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        428⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        429⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9628
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        430⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        431⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        432⤵
        Modifies registry class
        
        PID:9680
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        433⤵
        Drops file in System32 directory
        
        PID:6840
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        434⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        435⤵
        Drops file in System32 directory
        
        PID:9904
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        436⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        437⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Dmohno32.exe
        
        C:\Windows\system32\Dmohno32.exe
        438⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9252
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        439⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        440⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        441⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        442⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        443⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        444⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        445⤵
        Modifies registry class
        
        PID:9280
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        446⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        447⤵
        Drops file in System32 directory
        
        PID:9612
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        448⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        449⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        450⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        451⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        452⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9860
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        454⤵
        Drops file in System32 directory
        
        PID:8164
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9540
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        456⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        457⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        458⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        459⤵
        Drops file in System32 directory
        
        PID:10368
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        460⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        461⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        462⤵
        Drops file in System32 directory
        
        PID:10500
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        463⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        464⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        465⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        466⤵
        Modifies registry class
        
        PID:10696
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        467⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        468⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        469⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        470⤵
        Drops file in System32 directory
        
        PID:10852
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        471⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        472⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        473⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        474⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        475⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        476⤵
        Modifies registry class
        
        PID:11104
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        477⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        478⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        479⤵
        Modifies registry class
        
        PID:11220
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        480⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        481⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        482⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        483⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        484⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        485⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        486⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        487⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        488⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        489⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        490⤵
        Drops file in System32 directory
        
        PID:10880
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        491⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        492⤵
        Modifies registry class
        
        PID:11028
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        493⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        494⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        495⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        496⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10276
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        497⤵
        
        PID:10432
        
        C:\Windows\SysWOW64\Ifmqfm32.exe
        
        C:\Windows\system32\Ifmqfm32.exe
        498⤵
        Drops file in System32 directory
        
        PID:10488
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        499⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        500⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        501⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        502⤵
        Drops file in System32 directory
        
        PID:10944
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        503⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        504⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11168
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        505⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9828
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        506⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        507⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        508⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        509⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10984
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        510⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        511⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        512⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        513⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        514⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        515⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        516⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        517⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        518⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        519⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        520⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        521⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        522⤵
        Drops file in System32 directory
        
        PID:11392
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        523⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        524⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11480
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        525⤵
        Drops file in System32 directory
        
        PID:11520
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        526⤵
        
        PID:11560
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        527⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        528⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11636
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        529⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        530⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11724
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        531⤵
        
        PID:11764
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        532⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11808
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        533⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        534⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        535⤵
        Drops file in System32 directory
        
        PID:11928
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        536⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        537⤵
        Modifies registry class
        
        PID:12020
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        538⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        539⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        540⤵
        Modifies registry class
        
        PID:12148
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        541⤵
        
        PID:12200
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        542⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12240
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        543⤵
        
        PID:12284
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        544⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        545⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        546⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        547⤵
        Drops file in System32 directory
        
        PID:11508
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        548⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        549⤵
        
        PID:11632
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        550⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        551⤵
        Drops file in System32 directory
        
        PID:11788
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        552⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        553⤵
        
        PID:11920
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        554⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        555⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12060
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        556⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        557⤵
        
        PID:12192
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        558⤵
        
        PID:12280
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        559⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        560⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:11424
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        561⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        562⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        563⤵
        Drops file in System32 directory
        
        PID:11780
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        564⤵
        
        PID:11884
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        565⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        566⤵
        
        PID:12092
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        567⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        568⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        569⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11468
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        570⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3336
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        571⤵
        Modifies registry class
        
        PID:6044
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        572⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        573⤵
        
        PID:11712
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        574⤵
        
        PID:11936
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        575⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        576⤵
        
        PID:11284
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        577⤵
        
        PID:11408
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        578⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        579⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11544
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        580⤵
        
        PID:11840
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        581⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        582⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        583⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        584⤵
        Modifies registry class
        
        PID:11756
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        585⤵
        
        PID:11368
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        586⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        587⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        588⤵
        
        PID:12076
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        589⤵
        Modifies registry class
        
        PID:11644
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        590⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        591⤵
        Drops file in System32 directory
        
        PID:4456
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        592⤵
        
        PID:880
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        593⤵
        
        PID:12328
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        594⤵
        
        PID:12364
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        595⤵
        
        PID:12404
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        596⤵
        
        PID:12448
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        597⤵
        
        PID:12500
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        598⤵
        Drops file in System32 directory
        
        PID:12548
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        599⤵
        Modifies registry class
        
        PID:12596
        
        C:\Windows\SysWOW64\Ebfign32.exe
        
        C:\Windows\system32\Ebfign32.exe
        600⤵
        
        PID:12644
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        601⤵
        
        PID:12688
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        602⤵
        
        PID:12736
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        603⤵
        
        PID:12780
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        604⤵
        
        PID:12828
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        605⤵
        
        PID:12872
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        606⤵
        
        PID:12924
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        607⤵
        Drops file in System32 directory
        
        PID:12976
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        608⤵
        
        PID:13020
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        609⤵
        
        PID:13080
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        610⤵
        
        PID:13132
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        611⤵
        
        PID:13188
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        612⤵
        
        PID:13244
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        613⤵
        
        PID:13300
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        614⤵
        
        PID:12308
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        615⤵
        Modifies registry class
        
        PID:1720
        
        C:\Windows\SysWOW64\Gejhef32.exe
        
        C:\Windows\system32\Gejhef32.exe
        616⤵
        
        PID:12392
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        617⤵
        
        PID:12436
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        618⤵
        
        PID:12472
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        619⤵
        
        PID:12532
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        620⤵
        
        PID:12584
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        621⤵
        
        PID:12652
        
        C:\Windows\SysWOW64\Hahokfag.exe
        
        C:\Windows\system32\Hahokfag.exe
        622⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        623⤵
        
        PID:12708
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        624⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        625⤵
        
        PID:12880
        
        C:\Windows\SysWOW64\Hbihjifh.exe
        
        C:\Windows\system32\Hbihjifh.exe
        626⤵
        Drops file in System32 directory
        
        PID:5608
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        627⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12916
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        628⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Ipbaol32.exe
        
        C:\Windows\system32\Ipbaol32.exe
        629⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\Ieojgc32.exe
        
        C:\Windows\system32\Ieojgc32.exe
        630⤵
        Drops file in System32 directory
        
        PID:13060
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        631⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        632⤵
        
        PID:13152
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        633⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        634⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        635⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        636⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        637⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        638⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        639⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        640⤵
        
        PID:3140
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        641⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        642⤵
        
        PID:12520
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        643⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        644⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        645⤵
        
        PID:12664
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        646⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12724
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        647⤵
        Modifies registry class
        
        PID:1864
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        648⤵
        Drops file in System32 directory
        
        PID:3616
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        649⤵
        Drops file in System32 directory
        
        PID:1360
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        650⤵
        
        PID:12920
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        651⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        652⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Lakfeodm.exe
        
        C:\Windows\system32\Lakfeodm.exe
        653⤵
        
        PID:12992
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        654⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        655⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        656⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        657⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5188
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        658⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        659⤵
        
        PID:13156
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        660⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        661⤵
        Drops file in System32 directory
        
        PID:6332
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        662⤵
        Drops file in System32 directory
        
        PID:2000
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        663⤵
        Drops file in System32 directory
        
        PID:5220
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        664⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        665⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5824
        
        C:\Windows\SysWOW64\Nmaciefp.exe
        
        C:\Windows\system32\Nmaciefp.exe
        666⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        667⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        668⤵
        
        PID:1920
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        669⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        670⤵
        
        PID:12484
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        671⤵
        Modifies registry class
        
        PID:716
        
        C:\Windows\SysWOW64\Ocgkan32.exe
        
        C:\Windows\system32\Ocgkan32.exe
        672⤵
        
        PID:12608
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        673⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Ocihgnam.exe
        
        C:\Windows\system32\Ocihgnam.exe
        674⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        675⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        676⤵
        
        PID:12676
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        677⤵
        Modifies registry class
        
        PID:6040
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        678⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        679⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        680⤵
        
        PID:64
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        681⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        682⤵
        
        PID:12936
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        683⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        684⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4584 -s 400
        685⤵
        Program crash
        
        PID:6524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4584 -ip 4584
1⤵
PID:6256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Amlogfel.exe

Filesize
768KB

MD5
957e895e60df9822a52ce165b0952548

SHA1
c559f70f7433bd87a901c9118b1c8954ffe60a7c

SHA256
8dc7dd42b7d50cd332e0aad0040a18a4fdfef6f6cb67843151ef9f8b2ff39ff1

SHA512
55943ebe5c295e72c8bf68475d51339f9601ddafa0576e091229c450ce9ee9e69c03ffd0d15e330d9c1cc174bf28bf49206b15ae3cc3a2492e53dd829662a6c4

Download Submit
C:\Windows\SysWOW64\Aonoao32.exe

Filesize
768KB

MD5
82224c4d9490e184f2fb7d6dcabcc3b6

SHA1
1a344d38baaa8d93ad4425f1c3e87df316c2fa5e

SHA256
2165485188c7d4b88394cb8a5000f93b0795339e9efc9af3e6e6f5d89a70bc48

SHA512
f3d8a8684ba087c001a6bce81c6377f96c42f03479b018af130d0518f093598e9a1cfffe5fe01e1d7ab13b7473eeec5464d7b6eb53a722ddad5dcf68475cc031

Download Submit
C:\Windows\SysWOW64\Baannc32.exe

Filesize
768KB

MD5
a535e5f52aee0b0395dea5c22687fd93

SHA1
a0fde41c1eb82e18f393bf5da2b79e9fdb303577

SHA256
63747d7c790ac63e9ce4bc923916a2fe857902ded16e68fb7a7a756d51bc10f0

SHA512
cbb90596796dfab8214f8454ad539c1edaea5eb0361fdd28a6624642f5915d6408b1ed31cce45d4d70402a58741b7acfb88c9cb0d4a02146beb5294ca18f27e4

Download Submit
C:\Windows\SysWOW64\Bombmcec.exe

Filesize
768KB

MD5
f76c3a4d41aeed5ad078975d98e0dc65

SHA1
905c044baf46c74c56581d44d230841117e57262

SHA256
70d554e36c0132078a94983d9186b4fd39fe3528f298a4692b88cb759e21abac

SHA512
226a6078e76430828f529733b77be7a4a85502e083b5bd390282a0e72f792ff881d72a8d22cf65a8e7328f914d284acd3d9c19b588a935caa4743b300bbfbb4b

Download Submit
C:\Windows\SysWOW64\Dlghoa32.exe

Filesize
768KB

MD5
72ac3853dd5b1145eeec96b09c0436cb

SHA1
a7445c1b5606f24187fae0251915090e35592859

SHA256
4ddefa617cfa454f8673a199f04f0837bdc9ed00ea25c0da0f42ca4fbb43bed2

SHA512
0afb44689762be5534996c83848cf3c9dcc36b13d5957f444bcf5531c08d35f5991a83bc4330a4d82c6d2a12e3156f883141bd5ee5d2ba6117c171ea4cf516cc

Download Submit
C:\Windows\SysWOW64\Ecjhcg32.exe

Filesize
768KB

MD5
6a6cc36b01015edfb0b5b29f81d3ba47

SHA1
98a6f30e00771bd56d4a3720f2e844be77c75440

SHA256
51d806cfb6fa476b32407fb388512b5a72afe4395c2be6c90981c80d6f254212

SHA512
3230a6be7522ed966b8bad9353b263acec78f133b662ba284375c0444ccd406d349a3ec9cdb7592409d33b0146a8a9efb485af1fbc446f90c6a68d042711467f

Download Submit
C:\Windows\SysWOW64\Ecmeig32.exe

Filesize
768KB

MD5
4cbbd57f847e255eb51be8f0ce8f882c

SHA1
c2833d991d9e750750faae777d0fad9d5d2d3a39

SHA256
bdac2487815bbd443236083d7e081b39e9dfff088544b4b0c5d2757e481ae3b5

SHA512
1f764a0491179d03e7e6da2ca712d709d3bec77579f6cc0ab05d7e697d306d0972d291bd6f0146a227faa31d77a51e4d90f8049ebac84edcfac3982db2e7e291

Download Submit
C:\Windows\SysWOW64\Edihepnm.exe

Filesize
768KB

MD5
15e68f3854d3bd3df833d7bfc5660790

SHA1
da8f3bf419bf3e732d90990e35795143349b709b

SHA256
9a31d9043abec0d42a320329c31df6c9be98e1e2c51a6ac464272508282100cd

SHA512
7170b02cd1103f3ee1600a265a7c7d676c272b44903335cc03f3352708bef4eb559fd858a457098e308d9024b08de45d4706336484c8504f89df80843083691c

Download Submit
C:\Windows\SysWOW64\Eeelnp32.exe

Filesize
768KB

MD5
0232ae18e5742b9c9d4125ea29bcfe5c

SHA1
735c6d0a9aec4193e280a6a598ec55cc96604ed1

SHA256
2b1f2e15d8e0912e7b71eb17525e2a322f926fb53fe07d64b64268ca509f4b45

SHA512
286b26e9efd29a44d19216cee0c7409ae9b4de562e2668999fb4a4e833a9376a5be84f81e88bad88bf4de94b1e5d9a98dac6cf267566b99a41d381d09fd45c11

Download Submit
C:\Windows\SysWOW64\Elgfgl32.exe

Filesize
768KB

MD5
a181bc1f4c88a0aa1e7353b33cdd387a

SHA1
8ddfb8c88b10a3110d57c5f7cfde6ec98cb0203e

SHA256
95f21d3a5e1ebba93218062fcc28aeb0c6b648a62ba41b0f99e9445e471f3031

SHA512
af8592bcc75d5f029462330c7ebc27f7c29c8e18f2c0b6bf21495912f0116a1fad28649912b75e050eb6479832aa240de705bd3cdf4f2b21ee9060a2f6b8be40

Download Submit
C:\Windows\SysWOW64\Fckajehi.exe

Filesize
768KB

MD5
fc8bdfa4b8f109c48b126f4676d32fe0

SHA1
3a8190606a6b6fac6ba3e525127e21ab3c150208

SHA256
361a8f57dd1c4a34507a2eb5bafab176de567989d9d0191444272d9b91fdd176

SHA512
b4a1e1b060697ad5211898307cd7dafe2b293cfbe9160aa5290cfb385b155dc04b14ba348e0d9de2a427f4ce45896c1f5c4df04d3ab92bfbbcae280c91ab1861

Download Submit
C:\Windows\SysWOW64\Fkffog32.exe

Filesize
768KB

MD5
3939a349377d20c862e96509016168d7

SHA1
9104a13d18349c968c8fa4b78714d3add4b3e232

SHA256
5ba4102a95198f33ab2b9629ac69b2f163c26410d971c99c1c8cecaaf4c4630e

SHA512
27db403ac1d531d53240794d8067232f62b2662ab3fb8e543549dc15ec37d070c5c5870aa3eee8758df6f6d4dbe5067af5a2305ec04a0bc58617fc04615e9bd5

Download Submit
C:\Windows\SysWOW64\Fojlngce.exe

Filesize
576KB

MD5
3cf4aae2b78142f027af172bc698afcb

SHA1
22febdd07306d5b6e94689117f27bffd09a76184

SHA256
de7968c812f77a2adf693688bfd463fdca3b36fe50893df0e58e3fd54a2ba92b

SHA512
d4058f6e986be74023cf5bb2c40e92727c76a5105dc1358597d29ca5f64cab9c79c3106333a5e3376de536274608f765d773ec2350cd6ce9098694305f2910c2

Download Submit
C:\Windows\SysWOW64\Fojlngce.exe

Filesize
768KB

MD5
9bbb6db9791c72ba116f412499436b7d

SHA1
6f8c322da1e5620d5a2cb7251933c14239bd06f6

SHA256
4102cdeef0ebeaa417c04e069ba409e22b9cb9089da1902db3538e312f603847

SHA512
a4aed1a39fe12bb8ba28a002caf2bf7fe2a5fb0ad3972a5e7b148a05b8447d2b5c71de307821f765148ddde8f5ab5f39fa5b797266f8698d523023efd9d69513

Download Submit
C:\Windows\SysWOW64\Gbbkaako.exe

Filesize
768KB

MD5
442c69ac807fdaadefa15c8e67f89ba9

SHA1
2297d4002f64d93886b50790ece670c96c4722a1

SHA256
d2977df86aebf27423043ac84e727529fc0df86e6df01cdd75a76e16f4f51496

SHA512
e0ffddfc83f3292a55755e4aecbed643904a70ff9cb0ff5e4f8c1c1da4463b30c2e0212f30bc573d949114bf574030e6ee62f3063c556b52403454ec02ee452f

Download Submit
C:\Windows\SysWOW64\Gbiaapdf.exe

Filesize
768KB

MD5
f561f1ccdbfc030403fc52a39d2eb66b

SHA1
222ca65bddbcd7571b3c7129371ea1c5c7559542

SHA256
46a669ebe2e31395e496500d52226063ea303bc31cde2dbbf7c2cd46563f85f7

SHA512
862e0b35d1cb54456569f44abb64f7a8fc2bda15533e5eeb820fe77399e857064e5d2d0f8a2eabc1f368de49db180385824d4b2afbf08b95731f59bbd0a90049

Download Submit
C:\Windows\SysWOW64\Gblngpbd.exe

Filesize
768KB

MD5
adf65e559863b0bfa7aa0e17356ce79c

SHA1
89b4b5093e3e21a90bcb6261aa7193b9d6598191

SHA256
e5be3542c6d428d482737d507ef2c2519761dbc626639d255d5950cd8a87fddb

SHA512
215e811113d7eaf897d48d0f6b89ad4ace4887d5ba0f7c62019217cf67bea3a4c600634939ee81cd57fb4b739af07f92d3eae385d7d711818c5e2d3dd8088218

Download Submit
C:\Windows\SysWOW64\Gcagkdba.exe

Filesize
768KB

MD5
ad971d349e5ba3b1a28bba9eb49ce713

SHA1
9de5ce4a6c8f0f48e0da4a80e5fe761ae0d99126

SHA256
ff29c58d08368e1d14f062ac1537239e9288a2fdecc49e144c829d85127457db

SHA512
1a9bac65f4c1a2ca56718ef35e39c334686c58d981c4629fec557bc5d6100bbe59e7051378cffcabe9088f42dfcb2fde3bd9b393955dd4b5e7835d8986975639

Download Submit
C:\Windows\SysWOW64\Gdeqhl32.exe

Filesize
768KB

MD5
b69ff461175f9f6c666dc69c0145afd0

SHA1
d7f90abdb55e0a972ffc4e8e81fb04c630c50bc6

SHA256
8538f18a0464a0269d033e74fedb3221becf0b88616ca54793e2ae84d40c2ab1

SHA512
853b032aa68a684e71b8dd688c74ef369ea49ea45244a9cdce6f58f7beb82463306e8a3d564873b8cf81f3f28f78a89890b411a59006f134b9a70f27ba08988c

Download Submit
C:\Windows\SysWOW64\Gdeqhl32.exe

Filesize
687KB

MD5
29e788d423ce31b280ab13d2cba4ccac

SHA1
ee6e593053d0764aabeb33e6501708454ce0592f

SHA256
9639761398df32a9c15c19cc1492052319c1dca729c705d64e2afa93d9f18030

SHA512
3f0be1388a802c8e665a065d68e49cf86c9e943dbb431800f21c888293905991c0a30ec23e89ff7e918ce36bb0030ee3e6e016059eb31cfc56f3504c6c0e286c

Download Submit
C:\Windows\SysWOW64\Gdfoio32.exe

Filesize
768KB

MD5
41b59281ad5637274c156830d9905f18

SHA1
2ace2d8ebffda24e2587a7db3c177f377c3a787e

SHA256
e086561cebbfddbcf1a32c0f59251077ec4e784c50c171d3f88b9155cdf38b87

SHA512
fc0bd05b9dc30e775034b5723f0fdb9f5a2caba9d73cf2a260c2c8e8aa6df017d4d2656d0e2587b426b1e2b40fd8c7e01baf0de7ed2df79b53eca7dad2a4a73f

Download Submit
C:\Windows\SysWOW64\Ghlcnk32.exe

Filesize
768KB

MD5
ced755288433ab8062c14bd15594e62f

SHA1
f9a565116721b6e4b253739286b8f6f2fa58a1ab

SHA256
3c82708f36b3666ad6f8654bac9045db24f1767b5a65f682e9ac49a9879fbf73

SHA512
8171de8e6c5eeaeecd43733901ff70cdbd3608b4198ef65537bc2b05a69fc4bf2c58e115a1b67dd442ecb96405b1581250bcbb718ad3575d82ef75f6b235cf68

Download Submit
C:\Windows\SysWOW64\Ghopckpi.exe

Filesize
768KB

MD5
a7d24195e0b548e6f6acf1df93f4fa53

SHA1
f36cc939e46ee1d8b336c2c54963424ac9eac84f

SHA256
79d70e96373b35342088cc01173fee557946c1fe016d273376f85c6e183b9561

SHA512
07451d23883fdbdd0b78a0ac2cc59e19909cadd8b5a735be3df1abfdd7e30dff95976ad733a6e130cd521d339a79c7f8dc954f453d10c4b0eb1217dda554c36b

Download Submit
C:\Windows\SysWOW64\Gicinj32.exe

Filesize
768KB

MD5
4e723dc14614813b0962282ff4f76fb9

SHA1
fcc29ce256492a498b30e2a66443bc0ee25c5125

SHA256
0413572370edde9e3c69c9495f10d45b84ed6fa103af031f366452c8467bae3e

SHA512
dce9f36e1905d2154dfaa1e5f7fe2a50c3dcefaacbdcef6139e22a84a2d848cd05e45ab7dea6bf1c137b4ff0287dda51b5369d6e5f5c7a20d410d08044b2ee9c

Download Submit
C:\Windows\SysWOW64\Gkaejf32.exe

Filesize
768KB

MD5
371f46a3fbc6b471db9f89f434dd34af

SHA1
f563ae8796df287660d83dc46cec4920aaf16b88

SHA256
c36ab1bd8dd6521e6dedbda2ec9ba189519421b05fd3f921a29dbd96865d2045

SHA512
7f5c1fe9c7cb5496a204d633341ecc0fa2856fe8d2839266f1efbd6199df49e12bb09a7e1f2f192bb545ea0e6fae6e0a75e667b957c5f92d8325c3ede9341e6d

Download Submit
C:\Windows\SysWOW64\Gkgeoklj.exe

Filesize
768KB

MD5
31436367c2df03b13dede8f209fb501b

SHA1
f6406aa98bd85ab131facb729f9e0f527e48cb50

SHA256
c23f1fcccef1749365b9588f2fa27702f44edaf0f8051b927bba80f5a4bd0054

SHA512
ec382ba879cd319952e84e9274927293293abcbcbfca19b82f4f5558fb06cb7cd86f4bf502c782bfeb3163ab1f8d7d1ca94fb53ba8d4029fe511a38bda0da06d

Download Submit
C:\Windows\SysWOW64\Gkhbdg32.exe

Filesize
768KB

MD5
4182dd5992b15ed67483e59ffcd89b42

SHA1
4c9081d6f3d89ec65efbbad67378e1a48a693266

SHA256
1b2bf56b5624dd6021ff4ad68de44584708db1d01f3fa2f0cc81121faa8da8db

SHA512
c2a2b5d3b1be9235d4928302e94b8a02bb4a7e1fb1ef4372081a65a44ed89bd03c3069d9587329aaaedc2b1426d34d8d37975df24f4523ebe62a4422e6e294a2

Download Submit
C:\Windows\SysWOW64\Gkoiefmj.exe

Filesize
768KB

MD5
a1bb3745e008733463d4433ad3fa2868

SHA1
1b9bc90237f02e775a669a7f87b09679e02f679d

SHA256
c4e7e97e69e0d0ed1b6640f5f55756de8113149ca16fac2a820b767a64c4a1a9

SHA512
1429c7ee0ab5a9d64feabbccd4c2485f3b62e6cf48c327854098785ce93bfc8093cac8e4f02b042386a529ded0e5ebf92d368a7d325f876214b4db3df438a9a5

Download Submit
C:\Windows\SysWOW64\Gkoiefmj.exe

Filesize
640KB

MD5
e416ebdd5a4b67b317cc3bd7dc317b71

SHA1
1f7ab28edb136b7b45a12e9b9d5ddf3ac01064f4

SHA256
f1a90bd8691ee9752baa58b546a0ca731922d7a06427f3dd36a31efad3c0c609

SHA512
6584a1d86f8da29bbcc17fa8e814fe577986d19ab4cf5b922e709fd76a695ffe3c1d68b2811b1b170c1306dcf3f84793e8372b5a872910781cb0ff81ac2c7758

Download Submit
C:\Windows\SysWOW64\Gohhpe32.exe

Filesize
768KB

MD5
924bf01028478b4c964767b470d6610d

SHA1
0f41336c95e77f59b1eeed33b1d584496d23ffbe

SHA256
673975f8d5dcc122b1fe2bf52a5426f3987a3016587716710246b559a99b11a5

SHA512
b7edd880dab9d21a2b319cb8b0be842e027ae462d7e43835e8f59604582b5b0e32d8b298a4d765e220bf38260b81bf2848ac5a964acb0db316d6abdbb6d75126

Download Submit
C:\Windows\SysWOW64\Hbnjmp32.exe

Filesize
768KB

MD5
0b4cc9690ec7f885c77e9d946b27df6c

SHA1
e24747303703c12934bc6c6b95bfef01abe82bf9

SHA256
5396086bd16781b69a7fea14898af0ae03912da2bdca2f5c905a4cc53d0fd4a9

SHA512
db18970bb4379fdc4692a992777769ad33c624125a04b35be68d5a59ca41d6897e2c65edd72b5b8e03be286722147f1be69fe8009494fb697516554dfb6ade41

Download Submit
C:\Windows\SysWOW64\Hbnjmp32.exe

Filesize
256KB

MD5
10f3afc2008bb54e186f18dffe6ec75f

SHA1
492f23b29eddc8cdacda277dedbe8f8151092bbe

SHA256
f199f1e6a4d9b22756cc4222fcadacae9bad24d49a6492e25ef75f0e6a107b8b

SHA512
f12ba6cfe29a19ecef8d704d4df0bf0ed4f5602adb5d4111af0b2a3324e5e5a2de4e86ac702ce53023938b1c0253bca907fe6a3694e4cc25ddafd905625ca41b

Download Submit
C:\Windows\SysWOW64\Hecmijim.exe

Filesize
768KB

MD5
96fa9c522385ce4bb0d0fe92f851a2bc

SHA1
cd0a2e2009d264a0496ad51c9b1838347a913ba5

SHA256
f11ed51fcdaba9c6ba451c4d93495ecbe5aeeb05f138f06cb05d17f9a6ddc73c

SHA512
4a0e3fee9c3c817b0a26f8610df6550724155d82f626a4ac75b5868cef36c841727c7e342d806c9dd8c6338d5838c7df0daeca790af2aaa4d4f1e632573f1e73

Download Submit
C:\Windows\SysWOW64\Hfcicmqp.exe

Filesize
768KB

MD5
c26319a9d7208438b261e0bbdcaef366

SHA1
8003aa9085df818f8ae25f940c1c9e0d0be9d481

SHA256
bdae4f060ddeaf8986b2be957ae883cceae4e784f5bb2e7f185036f71bc0500d

SHA512
7493dae04b3f07dd24f8f1f54b4c80a06c8a9e18f37698d5fd8e06e1d692efeaa66e5561efdef8d5d9a8ba90b84da2801d4f90625061a7c66541c449a82d2650

Download Submit
C:\Windows\SysWOW64\Hfnphn32.exe

Filesize
768KB

MD5
71781fb4ba9153ec08bb6fc6f709fa1c

SHA1
a285e9dc924aa363c1e2077da000c13216c53e95

SHA256
edeed2f60bd1a507ed079a48d839209dc98ff93fb92914a65383cfdfe36dfa7c

SHA512
4f05397ebaae693627ccae6f4224e498c9edc1893a85c9fb8883474047aac78efedc87d75e39d77f97a5cbdd2945b1f6e3e53c39971c365ca42a3ef3c0341109

Download Submit
C:\Windows\SysWOW64\Hhknpmma.exe

Filesize
768KB

MD5
8b886279d70bc04827ea077b3120ec19

SHA1
16951262393bd44e302bd29c6b7ea61a5c78f91d

SHA256
ecf47f36d0a3c9df43d887ac4e5f194f1af5e34a5c3e293d338fbbe021b71740

SHA512
cb2aad63be9861ae4e5e186ffeda1d8ab24dee8ab4302be3be39b7864cdc0fc2044d341aa523bfd32b0880bb32eed85836ac0459e091e4f33d08e93153d95264

Download Submit
C:\Windows\SysWOW64\Hijooifk.exe

Filesize
768KB

MD5
34f76278a85716ca18929187aeed14c2

SHA1
164aaf13251cdb1ad7e26ceab5c846f5289ade1d

SHA256
376ca61e7966084bd44a6375e9628e1993ddf23fd8fb51ee7a78783a3e0d5e3f

SHA512
8c1d821609b3fb043aebac93633e509f83859dbef3fa7914a2f9d034ccef7e4995fac415bda98665387cc539c4c5d7fced04807e4b4f59af7dfd4cf40f4456d6

Download Submit
C:\Windows\SysWOW64\Himldi32.exe

Filesize
768KB

MD5
fab6ff3380d649e7725970c7b24546c6

SHA1
2b5fcd6fdc52b7709b1ca03d4a896d053e764335

SHA256
2dfd0eb54bef4162bc029b1d46b57e983788f5de3c0a02acd00db0ca08696b96

SHA512
eebec447246ad3fe000df81c44f1d101ca6d319fca3780ac34bfb065a974c83c005d1e81d132e7a880b6ff726c91f660b763b6f088514fbf28287a10822965ea

Download Submit
C:\Windows\SysWOW64\Himldi32.exe

Filesize
115KB

MD5
89c2c0a9882ce087daa1894c417cbb9f

SHA1
55b58ac6a8e32aeae3bbc6614fd34af931f845e4

SHA256
84163f5b40465327530b979ab55fd6179270d4de2809eb1c55b55f3fdd235d53

SHA512
1c40a2c955fab5287cc18905323a26187a4a391027a5736d06004543123b2a3feb14269c46221c776876046c66f4e3be78d54b0778975ffb7c129666c307ce93

Download Submit
C:\Windows\SysWOW64\Hkdbpe32.exe

Filesize
320KB

MD5
458af5a6dd4e299e14bc171a37286500

SHA1
1c108a2b6f303fd17118de9f70167e652ff9096b

SHA256
0a5561174f2089a583e0c566e97667b1cea57972e9576dde2d8ae9f627fdb0bc

SHA512
f1c7d4c7194bb570b66b48dce366615531e0622965ce205a869db2f6c4584a78413b3e1fd350f5f84ea3739f78233c9b0558c6b3b5a07952d69ffcad19c58d27

Download Submit
C:\Windows\SysWOW64\Hkdbpe32.exe

Filesize
768KB

MD5
57e6f3636ecd497c126b31d992d7d065

SHA1
a1efe57ead39c7768f30eeae5b7b5e8eda74dd11

SHA256
cc88a2e94156c148b994d2e1dc0e161f3e64801654088c84fcf7c1481d85ebb8

SHA512
d950f00709a9ef31c79c34c3df149e940078175a1b30f134a4c699282401ce7381689a51c2640ba9beb89965ef5eb27e9ea89250ee2658039d311be8f87e50e0

Download Submit
C:\Windows\SysWOW64\Hkmefd32.exe

Filesize
768KB

MD5
04ac26473ac3a9d3b2486632141e8dde

SHA1
b245cd37fa2db96fc79e1c1f5a7525a887bedab5

SHA256
172f5f276f3af9847018bcdc4c3059d0fe2a3baa025f0225aa42d00e9bfeef80

SHA512
07d950657d06b9fdf22587c3ee43d1a4b3351464ee8a717798d61b93e70bae3720d80e0a571ca1ccfcbc2eae0d65e7c6933988a654e8305cce432831a22c919d

Download Submit
C:\Windows\SysWOW64\Hmcojh32.exe

Filesize
768KB

MD5
6ce36d5cd8f6b0f9520bfedbc729adab

SHA1
afc305339483e2510cafe0a693a640c00b2f538e

SHA256
3146f0d97caa8974eff16c9ffc471c26b4e043e9d7996a3275626059031b0a40

SHA512
29a07077b3009e1ccc4b02911bb8bd11e3eab80b5452a42e3beef2ce937c95b6506e3e72355bf742df850301f7b006fbdc7552c997d20e555702868b539a26f9

Download Submit
C:\Windows\SysWOW64\Hobkfd32.exe

Filesize
768KB

MD5
741cfdc6e3eafe9def95fff43a418363

SHA1
baf06d609aa24896467412d5ab5f6b0aa2749524

SHA256
6965a9f8e87921efafef7d0c3cc91058a2653ebaaf198c054c142478fa9f3235

SHA512
6acd0c5717f51be865f6bddbda77a1fb5811db2aed7d7a3abc3091c9ebe0dcdc71386df24d08e2653253582972bd5e9838ddae96cd0e12e7626c709cf1c4e054

Download Submit
C:\Windows\SysWOW64\Hobkfd32.exe

Filesize
192KB

MD5
5f7d14db04a7771080beefa3267063a3

SHA1
4691444f7da5e2ff96e061dd27c629cdf527139b

SHA256
0bd58b6d9e22a1a161341c93535780c2f821186c93760e2e1dd54f701bc31d4e

SHA512
ec4e7812e0c7ed89891dd08654faafeaa2328fb808dba496da5745a299ebe558cf4684da25d7ecdc0cdfc47a51836cf8c285e4ac04fc69caaae00890b647edb6

Download Submit
C:\Windows\SysWOW64\Hodgkc32.exe

Filesize
768KB

MD5
6bce6a6874d58c1ed6b568689c49aeb8

SHA1
f36613a7d3f7f35fed1811ce3a6fe9f454beba83

SHA256
b2709aa322b426c1f8ae16e87c2f740cf870ac9260745b29185d0b419579244f

SHA512
975007b501fbd99d591ae931055d26013cbdb6e6a9e53c9bb927870fdca3c485a861288352f3dd5b34d6381c1774367c6a7da6c14040364893b8119213ab832c

Download Submit
C:\Windows\SysWOW64\Hofdacke.exe

Filesize
768KB

MD5
5939d09ae1e6a1247a484db495dce64b

SHA1
340e32c46c58774d7a6dbcdc0e852e328bc62af8

SHA256
7a8d7cf1544b4e8c5291a10b7d9c82e6330a5eb0fde075ecca9218d79e7cb82a

SHA512
9cf2d9364e540b2a181628ddf18b4f63f36cee04708aae81994958a5a50200491c278cc295a8fca811e3bc33cbcc184d60d621d6d264605d20717fbbe79a57df

Download Submit
C:\Windows\SysWOW64\Ibobdqid.exe

Filesize
768KB

MD5
a6daf9caafc0b7682dad1f8b132d4503

SHA1
ded13ddc1342f0ea4048c214e80338f10ee277a4

SHA256
70fb7c7ff069f2b158cc521f53d38717a9c905645596a8b75f64738c587623f7

SHA512
618b8dfca8d42f2cabcc2da9da903ad79680c8bcc27b156b725897ebedc4d2a1d68c6fa2e763d77d808e297b717745bf504cc3a1b725bb467f32ca58b4b2e4ef

Download Submit
C:\Windows\SysWOW64\Iiaephpc.exe

Filesize
768KB

MD5
645147ceb3c74fd1ad1bd02e16819255

SHA1
f1ec0e632471d777da3b66d5c2adbdde3b3fe3cd

SHA256
e1120c197a616c9e111769466ffba16dc818a58f9a51ace99c5b36f6fa82ddee

SHA512
1b1a8b59c90c7de90d6a00550c1a6399f5b7c120475348429d28ef373e0f95b453b4ef3becf0fc57b3b0abaab4008cb796c170ca2560525bc7f9951d89020d5a

Download Submit
C:\Windows\SysWOW64\Iiaephpc.exe

Filesize
42KB

MD5
e489be07d35e2f613492100beeb3cbed

SHA1
b49ec011fa13e36991830406ac6d2192c28b06fa

SHA256
a6484045913e92431d17e9aba4d1f5443ad1b9726c657e9b372dfb18473e208f

SHA512
b87e8203436f7a22120f9be7330b11b47b3bd8f90c9c36a70b783929549551255ddb8f3dcc20d6af07c384c25e4ae9f4996c22803ce97f0047f1acb5409ea0ff

Download Submit
C:\Windows\SysWOW64\Ipgbdbqb.exe

Filesize
768KB

MD5
6320bb31153642d3ca15bd2aa9c273f4

SHA1
5c0645477ad7b4159d9b0fd407d410b4f3f428ad

SHA256
167b6aacc6e9edcbb73dc1f1843eb9a0ae7ea2c33e349334f2bb4fa7d4fc4ced

SHA512
d55631d9cfecb79b0fe74581edefa3b205af2bd9ca64eaddcbc61758569576634375bfea2b6dca4580128700096b1275ed792ff977e680d44a054b8014c59143

Download Submit
C:\Windows\SysWOW64\Lcdciiec.exe

Filesize
768KB

MD5
d2ad70b391459241b9d6441b8386ee7f

SHA1
299bdc9a76eae01cdf27e07dffabdb3df95562a5

SHA256
8e5948dc23f31f0c32fbe86c42b088032c13cebc701313e6d5334aff71f43a27

SHA512
76f7482ca5d10507565797085c82ad183f414c8473fe3af2ea7de8117f264f366acbab3ddd93cd6d8f208103abeb593ce0e6e14c7b85ceec04ec9a8f79c9d2f2

Download Submit
C:\Windows\SysWOW64\Lggejg32.exe

Filesize
768KB

MD5
22ee53f5bcf5e2cbd0ed642751e8ca57

SHA1
746ef8635cba0b989615a28e4f5ba219c50306c9

SHA256
cd40ca9d0a6da0ad3fceb8e9453b6f89a1d05c2bd504f8071937038ec985ef54

SHA512
e893cee8375a1a77dbcbc0fb3cc8812e0c40e65fd9ebca529ec9d31ddb365deedef0406ce478869d29a9e868e64052ce966ccc95ad4b0e398b53497da95f0925

Download Submit
C:\Windows\SysWOW64\Mbbagk32.exe

Filesize
768KB

MD5
e34bd64de2ccf76f1f329fa3c89b6440

SHA1
320f502c72d6cb27e3fd95d8ae6f92cab96fd481

SHA256
b604416007e3abc7ca8781c6f790bfeb333d064ec82d11c636cb8403f1f77c6f

SHA512
3db8013072725653502e197d30b1278c3788088c26dc50af0bc5d661bff17d095b3984340b071b4b1896cb45bfcc00000ce5f4d4e9bbd56038e2ccc33d74c08f

Download Submit
C:\Windows\SysWOW64\Mmmqhl32.exe

Filesize
768KB

MD5
47f8fd8553a98af9f50bf2ba667e6f72

SHA1
ed97ef8c1df43e59e47842bb452f23ace5f220b4

SHA256
e7072f1d186435f4800410160545517e2794e9a3f73702b706c9f6a49a1a6660

SHA512
a797b3f2bb180b1d31cf68818cf43be8fe1e77a9dc7426be8f29e0f8f4364a9f8018154480e2d3e4ae559b908b186298e6ac5a6d1f401dd57f4157988a9bafc7

Download Submit
C:\Windows\SysWOW64\Nglhld32.exe

Filesize
768KB

MD5
33b6b97eab4a83b5eaad195b382bb56a

SHA1
b3744bab3df0571c8c449837471f382532684c4f

SHA256
8388dfd7563c46e0be14bb4220a4807ec7e9297b791d6bb210eb144cbe02fda3

SHA512
dd6856d72a21429992a26f9de0a85bce6d4b6f2d7afdc3e0a403cfc56ee87d2afef714496de4c0fe53a955c278779448481e8144a47c2b17e9e94a9366d842e4

Download Submit
C:\Windows\SysWOW64\Ocgbld32.exe

Filesize
768KB

MD5
2ecba1ebe7e5e08abe1222e9d5296f46

SHA1
231e3705afc03dfbd3d889480c8b5c385ddd63b1

SHA256
b686d6818ede4ed36a2f27f6cba3fd5806969cb59f9336ba189cc32f36db9447

SHA512
a359831a1f315af9563a94be5c3ba8b71568b94a0dd2408a58f2a92c4c1955f6019fe98cbde0cc76af59510a73b960fe47b4153f8206299e9a832b91919fcbc4

Download Submit
C:\Windows\SysWOW64\Palklf32.exe

Filesize
64KB

MD5
f397a56286bebe93d100a1a534baf564

SHA1
c6cc5386207a325378fa51a93458d8774a29127a

SHA256
7b65feaefae06a389e79b104ec0f69bec7c2a9ad03bb58a255e92d589e5b8087

SHA512
b759f3e389d055c3943e0d0eb24c263240dd2b8a5184e6a89be4e3e2b89d7f0c176b6df60542b40e7a970306d01688f075f6f96611e66435710f4d988b80331e

Download Submit
C:\Windows\SysWOW64\Pdenmbkk.exe

Filesize
768KB

MD5
f6a2445bdc7cd39c501fc47ca5eb95b0

SHA1
a364f514bfa896fb10abf34d4bbe97c60e68a4cc

SHA256
c4bb1ba96b15acbfaef5b1e25b7c846f50c3930b9b0e3fda7f42237b9bd15120

SHA512
8d41e6e6a50728663ccee1ea5e600ef6a1892b75f40672ad4d978cc6b78c375d73ba486db2d7ae595b9abd92208a11e795bb3ec9d2048040296f8ccd49feb328

Download Submit
memory/212-494-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/464-492-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/632-524-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/848-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/848-558-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/996-483-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1100-525-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1200-491-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1228-511-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1260-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1260-553-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1540-497-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1604-481-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1624-562-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1624-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1628-480-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1688-493-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1836-500-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1940-486-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2076-571-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2076-77-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2316-518-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2428-508-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2452-501-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2552-502-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2748-516-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2844-521-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2884-490-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2940-523-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3068-522-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3160-506-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3168-504-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3280-487-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3308-528-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3324-515-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3384-513-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3464-499-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3484-519-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3524-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3524-570-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3544-488-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3668-517-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3680-484-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3924-507-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4052-61-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4060-509-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4172-498-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4244-557-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4244-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4332-495-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4336-514-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4396-482-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4400-520-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4444-503-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4492-510-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4512-563-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4512-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4540-527-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4552-479-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4552-577-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4592-529-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4604-561-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4604-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4624-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4624-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4648-485-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4740-526-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4744-496-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4760-512-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5100-489-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5108-505-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5156-530-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5196-531-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads