cac8d95226e138e3f4057fd771b8e6006694058bbbaa28bb53e00e04afa814ce

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cac8d95226e138e3f4057fd771b8e6006694058bbbaa28bb53e00e04afa814ce.exe
Size

113KB
MD5

a21bfe70d9c1be8c119f91d4e456e569
SHA1

2404a8b800da64a5c4c077c55ae4815d8635c206
SHA256

cac8d95226e138e3f4057fd771b8e6006694058bbbaa28bb53e00e04afa814ce
SHA512

8d80a35c13c67597f78b768ed14d66d4556c1461f9f9fb139a914973d6a6cb439df074a89c8554e2fc18cfd73979595fd791bded671eade67446791b50cc5284
SSDEEP

3072:eTsG/N+J9lu5VzugCe8uvQa7gRj9/S2Kn:c1AezISMRNF

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikaggmii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Joiccj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebdcld32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Piijno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmlcbbcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngdfdmdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ohqbhdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfdodjhm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmemac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgdokkfg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbqklb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnoknihb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qaqegecm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgehcmmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhlejcpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qcdbfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlmbfqoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhkfkmmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpbjkn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppahmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpneegel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdhcgaic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fpgpgfmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Midfokpm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddadpdmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odapnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibobdqid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbphdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fnlmhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnohlgep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npcoakfp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbchba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bddcenpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cpbjkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hdhedh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmjocp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iigdfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ophjiaql.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bahdob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mgagbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jgadgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Phedhmhi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lgepom32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Malpia32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bochmn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdmnlj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqknig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kijchhbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjaabq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emcbio32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klmpiiai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcikgacl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbpchb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hoclopne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pjpobg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcjmel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hekgfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgphpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akblfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlqomd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cikglnkj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nglhld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kmaopfjm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cndeii32.exe

Executes dropped EXE 64 IoCs

pid	Process
2056	Jcllonma.exe
4356	Kdnidn32.exe
2712	Kikame32.exe
828	Kbceejpf.exe
4628	Kmijbcpl.exe
5068	Kdcbom32.exe
3840	Kipkhdeq.exe
4768	Kdeoemeg.exe
3244	Kefkme32.exe
1324	Kmncnb32.exe
1240	Lffhfh32.exe
4784	Lmppcbjd.exe
3724	Ldjhpl32.exe
400	Lmbmibhb.exe
3732	Liimncmf.exe
1736	Ldoaklml.exe
3320	Likjcbkc.exe
2172	Lbdolh32.exe
3832	Mdckfk32.exe
3444	Mgagbf32.exe
4320	Mdehlk32.exe
1056	Mibpda32.exe
404	Mlampmdo.exe
3064	Mgfqmfde.exe
4444	Mpoefk32.exe
3164	Migjoaaf.exe
3528	Mdmnlj32.exe
4316	Miifeq32.exe
436	Npcoakfp.exe
396	Nilcjp32.exe
2700	Npfkgjdn.exe
1316	Nnjlpo32.exe
2188	Ndcdmikd.exe
5032	Njqmepik.exe
4092	Ncianepl.exe
4816	Ndhmhh32.exe
3912	Olcbmj32.exe
1084	Ocnjidkf.exe
2580	Olfobjbg.exe
3644	Onhhamgg.exe
4312	Odapnf32.exe
1820	Ocdqjceo.exe
4424	Oqhacgdh.exe
4600	Ogbipa32.exe
1336	Pqknig32.exe
3100	Pmannhhj.exe
5044	Pclgkb32.exe
2872	Pjeoglgc.exe
788	Pdkcde32.exe
2336	Pjhlml32.exe
5084	Pmfhig32.exe
1440	Pcppfaka.exe
2440	Pmidog32.exe
4656	Pcbmka32.exe
3248	Pjmehkqk.exe
4668	Qqfmde32.exe
2132	Qnjnnj32.exe
4472	Qcgffqei.exe
3656	Anmjcieo.exe
1320	Acjclpcf.exe
1388	Aclpap32.exe
3396	Ajfhnjhq.exe
3700	Aqppkd32.exe
4576	Afmhck32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Pdmdnadc.exe	Ppahmb32.exe
File opened for modification	C:\Windows\SysWOW64\Amqhbe32.exe	Akblfj32.exe
File created	C:\Windows\SysWOW64\Pokhnl32.dll	Lifjnm32.exe
File opened for modification	C:\Windows\SysWOW64\Bmomlnjk.exe	Bjaqpbkh.exe
File opened for modification	C:\Windows\SysWOW64\Bbiado32.exe	Bmlilh32.exe
File opened for modification	C:\Windows\SysWOW64\Lekmnajj.exe	Lmdemd32.exe
File opened for modification	C:\Windows\SysWOW64\Ljhefhha.exe	Lgjijmin.exe
File opened for modification	C:\Windows\SysWOW64\Aafemk32.exe	Qklmpalf.exe
File created	C:\Windows\SysWOW64\Iqbmml32.dll	Jfgdkd32.exe
File created	C:\Windows\SysWOW64\Kqbgfn32.dll	Lfealaol.exe
File created	C:\Windows\SysWOW64\Kikdcj32.dll	Mjahlgpf.exe
File opened for modification	C:\Windows\SysWOW64\Mdckfk32.exe	Lbdolh32.exe
File created	C:\Windows\SysWOW64\Qcgffqei.exe	Qnjnnj32.exe
File created	C:\Windows\SysWOW64\Jcnmjgff.dll	Ghklce32.exe
File created	C:\Windows\SysWOW64\Ecjbbo32.dll	Dgejpd32.exe
File created	C:\Windows\SysWOW64\Jhglpo32.dll	Clchbqoo.exe
File created	C:\Windows\SysWOW64\Mlbbkfoq.exe	Midfokpm.exe
File created	C:\Windows\SysWOW64\Edjgfcec.exe	Empoiimf.exe
File opened for modification	C:\Windows\SysWOW64\Gaopfe32.exe	Gigheh32.exe
File created	C:\Windows\SysWOW64\Jgqjbf32.dll	Mqfpckhm.exe
File created	C:\Windows\SysWOW64\Medqcmki.exe	Mojhgbdl.exe
File opened for modification	C:\Windows\SysWOW64\Ngdfdmdi.exe	Nomncpcg.exe
File opened for modification	C:\Windows\SysWOW64\Phedhmhi.exe	Pojcjh32.exe
File created	C:\Windows\SysWOW64\Hkajlm32.dll	Aeaanjkl.exe
File created	C:\Windows\SysWOW64\Liabph32.dll	Lgbloglj.exe
File opened for modification	C:\Windows\SysWOW64\Iigdfa32.exe	Ifihif32.exe
File created	C:\Windows\SysWOW64\Agdgdlac.dll	Mpieqeko.exe
File created	C:\Windows\SysWOW64\Qqhcpo32.exe	Qhakoa32.exe
File created	C:\Windows\SysWOW64\Ddhpmfbl.dll	Bemqih32.exe
File created	C:\Windows\SysWOW64\Cnfaohbj.exe	Cleegp32.exe
File created	C:\Windows\SysWOW64\Pjdpelnc.exe	Pfiddm32.exe
File created	C:\Windows\SysWOW64\Opclldhj.exe	Omdppiif.exe
File opened for modification	C:\Windows\SysWOW64\Akdilipp.exe	Adkqoohc.exe
File opened for modification	C:\Windows\SysWOW64\Dodbbdbb.exe	Dfnjafap.exe
File created	C:\Windows\SysWOW64\Bnoeha32.dll	Hpmpnp32.exe
File created	C:\Windows\SysWOW64\Iqklon32.exe	Ikndgg32.exe
File created	C:\Windows\SysWOW64\Ejjlbppk.dll	Jhlgfj32.exe
File created	C:\Windows\SysWOW64\Ipoopgnf.exe	Inqbclob.exe
File created	C:\Windows\SysWOW64\Hekgfj32.exe	Hfhgkmpj.exe
File created	C:\Windows\SysWOW64\Nhbfff32.exe	Ngaionfl.exe
File created	C:\Windows\SysWOW64\Kjpijpdg.exe	Kinmcg32.exe
File created	C:\Windows\SysWOW64\Njiegl32.exe	Nihipdhl.exe
File opened for modification	C:\Windows\SysWOW64\Eofgpikj.exe	Emhkdmlg.exe
File opened for modification	C:\Windows\SysWOW64\Eaakpm32.exe	Ekgbccni.exe
File created	C:\Windows\SysWOW64\Cdpagn32.dll	Gkaopp32.exe
File created	C:\Windows\SysWOW64\Fqokaeco.dll	Medqcmki.exe
File created	C:\Windows\SysWOW64\Cppnfc32.dll	Gaopfe32.exe
File opened for modification	C:\Windows\SysWOW64\Ebnfbcbc.exe	Eppjfgcp.exe
File opened for modification	C:\Windows\SysWOW64\Qfmmplad.exe	Qhjmdp32.exe
File opened for modification	C:\Windows\SysWOW64\Pqknig32.exe	Ogbipa32.exe
File created	C:\Windows\SysWOW64\Gaadfkgc.exe	Gkglja32.exe
File opened for modification	C:\Windows\SysWOW64\Jpmlnjco.exe	Jicdap32.exe
File created	C:\Windows\SysWOW64\Ophjiaql.exe	Ohqbhdpj.exe
File created	C:\Windows\SysWOW64\Aflaie32.exe	Acnemi32.exe
File created	C:\Windows\SysWOW64\Dpqodfij.exe	Dmbbhkjf.exe
File opened for modification	C:\Windows\SysWOW64\Opclldhj.exe	Omdppiif.exe
File created	C:\Windows\SysWOW64\Ennamn32.dll	Cklhcfle.exe
File created	C:\Windows\SysWOW64\Mmnbeadp.dll	Bmemac32.exe
File created	C:\Windows\SysWOW64\Jpmlnjco.exe	Jicdap32.exe
File created	C:\Windows\SysWOW64\Dlgaff32.dll	Anaomkdb.exe
File created	C:\Windows\SysWOW64\Pfiddm32.exe	Pdjgha32.exe
File created	C:\Windows\SysWOW64\Liijiqcd.dll	Knippe32.exe
File created	C:\Windows\SysWOW64\Gbhhlfgd.dll	Bahdob32.exe
File opened for modification	C:\Windows\SysWOW64\Likjcbkc.exe	Ldoaklml.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7240	2204	WerFault.exe	872

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hdhedh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnfaohbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Enkdaepb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnoddcef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbikpjdg.dll"	Hhihdcbp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ophjiaql.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ppahmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laphko32.dll"	Agdhbi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ogjdmbil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibclmgdb.dll"	Cbphdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfojjf32.dll"	Jgnqgqan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bddcenpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ealadnik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imjfmjln.dll"	Jglklggl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jgamgpme.dll"	Ljbfpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmgabj32.dll"	Odapnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Liijiqcd.dll"	Knippe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nggmhj32.dll"	Epagkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akpoaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glbandkm.dll"	Bebblb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qqffjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnhjohkb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjddphlq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdgfce32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfogpg32.dll"	Ehcfaboo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Malpia32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bffcpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oolpjdob.dll"	Lmbmibhb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjmjdbam.dll"	Pcppfaka.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fnaokmco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Noekdfjb.dll"	Khmknk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aflaie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdckfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdhpgj32.dll"	Ddjejl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Piijno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjjhhfnd.dll"	Bkaobnio.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gidnkkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Amnlme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fknicb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Conjbj32.dll"	Fahaplon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ogekbb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jglklggl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eofgpikj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hoogfnnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jqlefl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmonnmjm.dll"	Fnjhjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fefjfked.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ngdcpk32.dll"	Phelcc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aleckinj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hleoiomo.dll"	Kclgmq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iafphi32.dll"	Pjdpelnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dakipgan.dll"	Kefkme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Acjclpcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Piomhofd.dll"	Injcmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hedafk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgijpe32.dll"	Bddcenpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	cac8d95226e138e3f4057fd771b8e6006694058bbbaa28bb53e00e04afa814ce.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hnhghcki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kechmoil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlcagc32.dll"	Gacjadad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adfnba32.dll"	Npgmpf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nagiji32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nilcjp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfgdkd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2056	1888	cac8d95226e138e3f4057fd771b8e6006694058bbbaa28bb53e00e04afa814ce.exe	92
PID 1888 wrote to memory of 2056	1888	cac8d95226e138e3f4057fd771b8e6006694058bbbaa28bb53e00e04afa814ce.exe	92
PID 1888 wrote to memory of 2056	1888	cac8d95226e138e3f4057fd771b8e6006694058bbbaa28bb53e00e04afa814ce.exe	92
PID 2056 wrote to memory of 4356	2056	Jcllonma.exe	93
PID 2056 wrote to memory of 4356	2056	Jcllonma.exe	93
PID 2056 wrote to memory of 4356	2056	Jcllonma.exe	93
PID 4356 wrote to memory of 2712	4356	Kdnidn32.exe	94
PID 4356 wrote to memory of 2712	4356	Kdnidn32.exe	94
PID 4356 wrote to memory of 2712	4356	Kdnidn32.exe	94
PID 2712 wrote to memory of 828	2712	Kikame32.exe	95
PID 2712 wrote to memory of 828	2712	Kikame32.exe	95
PID 2712 wrote to memory of 828	2712	Kikame32.exe	95
PID 828 wrote to memory of 4628	828	Kbceejpf.exe	96
PID 828 wrote to memory of 4628	828	Kbceejpf.exe	96
PID 828 wrote to memory of 4628	828	Kbceejpf.exe	96
PID 4628 wrote to memory of 5068	4628	Kmijbcpl.exe	97
PID 4628 wrote to memory of 5068	4628	Kmijbcpl.exe	97
PID 4628 wrote to memory of 5068	4628	Kmijbcpl.exe	97
PID 5068 wrote to memory of 3840	5068	Kdcbom32.exe	98
PID 5068 wrote to memory of 3840	5068	Kdcbom32.exe	98
PID 5068 wrote to memory of 3840	5068	Kdcbom32.exe	98
PID 3840 wrote to memory of 4768	3840	Kipkhdeq.exe	99
PID 3840 wrote to memory of 4768	3840	Kipkhdeq.exe	99
PID 3840 wrote to memory of 4768	3840	Kipkhdeq.exe	99
PID 4768 wrote to memory of 3244	4768	Kdeoemeg.exe	100
PID 4768 wrote to memory of 3244	4768	Kdeoemeg.exe	100
PID 4768 wrote to memory of 3244	4768	Kdeoemeg.exe	100
PID 3244 wrote to memory of 1324	3244	Kefkme32.exe	101
PID 3244 wrote to memory of 1324	3244	Kefkme32.exe	101
PID 3244 wrote to memory of 1324	3244	Kefkme32.exe	101
PID 1324 wrote to memory of 1240	1324	Kmncnb32.exe	102
PID 1324 wrote to memory of 1240	1324	Kmncnb32.exe	102
PID 1324 wrote to memory of 1240	1324	Kmncnb32.exe	102
PID 1240 wrote to memory of 4784	1240	Lffhfh32.exe	103
PID 1240 wrote to memory of 4784	1240	Lffhfh32.exe	103
PID 1240 wrote to memory of 4784	1240	Lffhfh32.exe	103
PID 4784 wrote to memory of 3724	4784	Lmppcbjd.exe	104
PID 4784 wrote to memory of 3724	4784	Lmppcbjd.exe	104
PID 4784 wrote to memory of 3724	4784	Lmppcbjd.exe	104
PID 3724 wrote to memory of 400	3724	Ldjhpl32.exe	105
PID 3724 wrote to memory of 400	3724	Ldjhpl32.exe	105
PID 3724 wrote to memory of 400	3724	Ldjhpl32.exe	105
PID 400 wrote to memory of 3732	400	Lmbmibhb.exe	106
PID 400 wrote to memory of 3732	400	Lmbmibhb.exe	106
PID 400 wrote to memory of 3732	400	Lmbmibhb.exe	106
PID 3732 wrote to memory of 1736	3732	Liimncmf.exe	107
PID 3732 wrote to memory of 1736	3732	Liimncmf.exe	107
PID 3732 wrote to memory of 1736	3732	Liimncmf.exe	107
PID 1736 wrote to memory of 3320	1736	Ldoaklml.exe	108
PID 1736 wrote to memory of 3320	1736	Ldoaklml.exe	108
PID 1736 wrote to memory of 3320	1736	Ldoaklml.exe	108
PID 3320 wrote to memory of 2172	3320	Likjcbkc.exe	109
PID 3320 wrote to memory of 2172	3320	Likjcbkc.exe	109
PID 3320 wrote to memory of 2172	3320	Likjcbkc.exe	109
PID 2172 wrote to memory of 3832	2172	Lbdolh32.exe	110
PID 2172 wrote to memory of 3832	2172	Lbdolh32.exe	110
PID 2172 wrote to memory of 3832	2172	Lbdolh32.exe	110
PID 3832 wrote to memory of 3444	3832	Mdckfk32.exe	111
PID 3832 wrote to memory of 3444	3832	Mdckfk32.exe	111
PID 3832 wrote to memory of 3444	3832	Mdckfk32.exe	111
PID 3444 wrote to memory of 4320	3444	Mgagbf32.exe	112
PID 3444 wrote to memory of 4320	3444	Mgagbf32.exe	112
PID 3444 wrote to memory of 4320	3444	Mgagbf32.exe	112
PID 4320 wrote to memory of 1056	4320	Mdehlk32.exe	113

C:\Users\Admin\AppData\Local\Temp\cac8d95226e138e3f4057fd771b8e6006694058bbbaa28bb53e00e04afa814ce.exe
"C:\Users\Admin\AppData\Local\Temp\cac8d95226e138e3f4057fd771b8e6006694058bbbaa28bb53e00e04afa814ce.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\Jcllonma.exe
  C:\Windows\system32\Jcllonma.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\SysWOW64\Kdnidn32.exe
    C:\Windows\system32\Kdnidn32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Windows\SysWOW64\Kikame32.exe
      C:\Windows\system32\Kikame32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:828
      - C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3840
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4768
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3244
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1324
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1240
        
        C:\Windows\SysWOW64\Lmppcbjd.exe
        
        C:\Windows\system32\Lmppcbjd.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4784
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3724
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:400
        
        C:\Windows\SysWOW64\Liimncmf.exe
        
        C:\Windows\system32\Liimncmf.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3732
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1736
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3320
        
        C:\Windows\SysWOW64\Lbdolh32.exe
        
        C:\Windows\system32\Lbdolh32.exe
        19⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3832
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3444
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        23⤵
        Executes dropped EXE
        
        PID:1056
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        24⤵
        Executes dropped EXE
        
        PID:404
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        25⤵
        Executes dropped EXE
        
        PID:3064
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        26⤵
        Executes dropped EXE
        
        PID:4444
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        27⤵
        Executes dropped EXE
        
        PID:3164
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3528
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        29⤵
        Executes dropped EXE
        
        PID:4316
        
        C:\Windows\SysWOW64\Npcoakfp.exe
        
        C:\Windows\system32\Npcoakfp.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:436
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        31⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:396
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        32⤵
        Executes dropped EXE
        
        PID:2700
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        33⤵
        Executes dropped EXE
        
        PID:1316
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        34⤵
        Executes dropped EXE
        
        PID:2188
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        35⤵
        Executes dropped EXE
        
        PID:5032
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        36⤵
        Executes dropped EXE
        
        PID:4092
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        37⤵
        Executes dropped EXE
        
        PID:4816
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        38⤵
        Executes dropped EXE
        
        PID:3912
        
        C:\Windows\SysWOW64\Ocnjidkf.exe
        
        C:\Windows\system32\Ocnjidkf.exe
        39⤵
        Executes dropped EXE
        
        PID:1084
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        40⤵
        Executes dropped EXE
        
        PID:2580
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        41⤵
        Executes dropped EXE
        
        PID:3644
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4312
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        43⤵
        Executes dropped EXE
        
        PID:1820
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        44⤵
        Executes dropped EXE
        
        PID:4424
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4600
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1336
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        47⤵
        Executes dropped EXE
        
        PID:3100
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        48⤵
        Executes dropped EXE
        
        PID:5044
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        49⤵
        Executes dropped EXE
        
        PID:2872
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        50⤵
        Executes dropped EXE
        
        PID:788
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        51⤵
        Executes dropped EXE
        
        PID:2336
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        52⤵
        Executes dropped EXE
        
        PID:5084
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1440
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        54⤵
        Executes dropped EXE
        
        PID:2440
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        55⤵
        Executes dropped EXE
        
        PID:4656
        
        C:\Windows\SysWOW64\Pjmehkqk.exe
        
        C:\Windows\system32\Pjmehkqk.exe
        56⤵
        Executes dropped EXE
        
        PID:3248
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        57⤵
        Executes dropped EXE
        
        PID:4668
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2132
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        59⤵
        Executes dropped EXE
        
        PID:4472
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        60⤵
        Executes dropped EXE
        
        PID:3656
        
        C:\Windows\SysWOW64\Acjclpcf.exe
        
        C:\Windows\system32\Acjclpcf.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1320
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        62⤵
        Executes dropped EXE
        
        PID:1388
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        63⤵
        Executes dropped EXE
        
        PID:3396
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        64⤵
        Executes dropped EXE
        
        PID:3700
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        65⤵
        Executes dropped EXE
        
        PID:4576
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        66⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        67⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        68⤵
        
        PID:784
        
        C:\Windows\SysWOW64\Ajkaii32.exe
        
        C:\Windows\system32\Ajkaii32.exe
        69⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\Aepefb32.exe
        
        C:\Windows\system32\Aepefb32.exe
        70⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\Bfabnjjp.exe
        
        C:\Windows\system32\Bfabnjjp.exe
        71⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        72⤵
        Modifies registry class
        
        PID:3776
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        73⤵
        Modifies registry class
        
        PID:5128
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5172
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        75⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        76⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        77⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5332
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        79⤵
        Modifies registry class
        
        PID:5372
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        80⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        81⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5528
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        83⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        84⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        85⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        86⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        87⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        88⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        89⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5888
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        91⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        92⤵
        Modifies registry class
        
        PID:6008
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        93⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        94⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        95⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\Dfknkg32.exe
        
        C:\Windows\system32\Dfknkg32.exe
        96⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        97⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Dfnjafap.exe
        
        C:\Windows\system32\Dfnjafap.exe
        98⤵
        Drops file in System32 directory
        
        PID:5396
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        99⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        100⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        101⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5700
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        103⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        104⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Edfdej32.exe
        
        C:\Windows\system32\Edfdej32.exe
        105⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Egdqae32.exe
        
        C:\Windows\system32\Egdqae32.exe
        106⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Eolhbc32.exe
        
        C:\Windows\system32\Eolhbc32.exe
        107⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\Eefaomcg.exe
        
        C:\Windows\system32\Eefaomcg.exe
        108⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Ekbihd32.exe
        
        C:\Windows\system32\Ekbihd32.exe
        109⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Ealadnik.exe
        
        C:\Windows\system32\Ealadnik.exe
        110⤵
        Modifies registry class
        
        PID:5520
        
        C:\Windows\SysWOW64\Ekefmc32.exe
        
        C:\Windows\system32\Ekefmc32.exe
        111⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Emcbio32.exe
        
        C:\Windows\system32\Emcbio32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5820
        
        C:\Windows\SysWOW64\Edmjfifl.exe
        
        C:\Windows\system32\Edmjfifl.exe
        113⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Ekgbccni.exe
        
        C:\Windows\system32\Ekgbccni.exe
        114⤵
        Drops file in System32 directory
        
        PID:6108
        
        C:\Windows\SysWOW64\Eaakpm32.exe
        
        C:\Windows\system32\Eaakpm32.exe
        115⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Egnchd32.exe
        
        C:\Windows\system32\Egnchd32.exe
        116⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Emhldnkj.exe
        
        C:\Windows\system32\Emhldnkj.exe
        117⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Fdbdah32.exe
        
        C:\Windows\system32\Fdbdah32.exe
        118⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Fgppmd32.exe
        
        C:\Windows\system32\Fgppmd32.exe
        119⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Fnjhjn32.exe
        
        C:\Windows\system32\Fnjhjn32.exe
        120⤵
        Modifies registry class
        
        PID:5284
        
        C:\Windows\SysWOW64\Feapkk32.exe
        
        C:\Windows\system32\Feapkk32.exe
        121⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Fknicb32.exe
        
        C:\Windows\system32\Fknicb32.exe
        122⤵
        Modifies registry class
        
        PID:6164
        
        C:\Windows\SysWOW64\Fahaplon.exe
        
        C:\Windows\system32\Fahaplon.exe
        123⤵
        Modifies registry class
        
        PID:6216
        
        C:\Windows\SysWOW64\Fhbimf32.exe
        
        C:\Windows\system32\Fhbimf32.exe
        124⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Folaiqng.exe
        
        C:\Windows\system32\Folaiqng.exe
        125⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Fefjfked.exe
        
        C:\Windows\system32\Fefjfked.exe
        126⤵
        Modifies registry class
        
        PID:6380
        
        C:\Windows\SysWOW64\Fggfnc32.exe
        
        C:\Windows\system32\Fggfnc32.exe
        127⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Fnaokmco.exe
        
        C:\Windows\system32\Fnaokmco.exe
        128⤵
        Modifies registry class
        
        PID:6476
        
        C:\Windows\SysWOW64\Fehfljca.exe
        
        C:\Windows\system32\Fehfljca.exe
        129⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Fhgbhfbe.exe
        
        C:\Windows\system32\Fhgbhfbe.exe
        130⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Foqkdp32.exe
        
        C:\Windows\system32\Foqkdp32.exe
        131⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Gaogak32.exe
        
        C:\Windows\system32\Gaogak32.exe
        132⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Gdncmghi.exe
        
        C:\Windows\system32\Gdncmghi.exe
        133⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Gkglja32.exe
        
        C:\Windows\system32\Gkglja32.exe
        134⤵
        Drops file in System32 directory
        
        PID:6748
        
        C:\Windows\SysWOW64\Gaadfkgc.exe
        
        C:\Windows\system32\Gaadfkgc.exe
        135⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Ghklce32.exe
        
        C:\Windows\system32\Ghklce32.exe
        136⤵
        Drops file in System32 directory
        
        PID:6840
        
        C:\Windows\SysWOW64\Gnhdkl32.exe
        
        C:\Windows\system32\Gnhdkl32.exe
        137⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Gojnko32.exe
        
        C:\Windows\system32\Gojnko32.exe
        138⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Gdgfce32.exe
        
        C:\Windows\system32\Gdgfce32.exe
        139⤵
        Modifies registry class
        
        PID:6996
        
        C:\Windows\SysWOW64\Gkaopp32.exe
        
        C:\Windows\system32\Gkaopp32.exe
        140⤵
        Drops file in System32 directory
        
        PID:7040
        
        C:\Windows\SysWOW64\Hakgmjoh.exe
        
        C:\Windows\system32\Hakgmjoh.exe
        141⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Hheoid32.exe
        
        C:\Windows\system32\Hheoid32.exe
        142⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Hoogfnnb.exe
        
        C:\Windows\system32\Hoogfnnb.exe
        143⤵
        Modifies registry class
        
        PID:5536
        
        C:\Windows\SysWOW64\Hfipbh32.exe
        
        C:\Windows\system32\Hfipbh32.exe
        144⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Hgjljpkm.exe
        
        C:\Windows\system32\Hgjljpkm.exe
        145⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Hnddgjbj.exe
        
        C:\Windows\system32\Hnddgjbj.exe
        146⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Hfklhhcl.exe
        
        C:\Windows\system32\Hfklhhcl.exe
        147⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Hhihdcbp.exe
        
        C:\Windows\system32\Hhihdcbp.exe
        148⤵
        Modifies registry class
        
        PID:6500
        
        C:\Windows\SysWOW64\Hbbmmi32.exe
        
        C:\Windows\system32\Hbbmmi32.exe
        149⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Hhlejcpm.exe
        
        C:\Windows\system32\Hhlejcpm.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6652
        
        C:\Windows\SysWOW64\Hofmfmhj.exe
        
        C:\Windows\system32\Hofmfmhj.exe
        151⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Hbdjchgn.exe
        
        C:\Windows\system32\Hbdjchgn.exe
        152⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Hhnbpb32.exe
        
        C:\Windows\system32\Hhnbpb32.exe
        153⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\Ikokan32.exe
        
        C:\Windows\system32\Ikokan32.exe
        154⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Ibicnh32.exe
        
        C:\Windows\system32\Ibicnh32.exe
        155⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Iickkbje.exe
        
        C:\Windows\system32\Iickkbje.exe
        156⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Ikaggmii.exe
        
        C:\Windows\system32\Ikaggmii.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7148
        
        C:\Windows\SysWOW64\Ibkpcg32.exe
        
        C:\Windows\system32\Ibkpcg32.exe
        158⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Ifihif32.exe
        
        C:\Windows\system32\Ifihif32.exe
        159⤵
        Drops file in System32 directory
        
        PID:6364
        
        C:\Windows\SysWOW64\Iigdfa32.exe
        
        C:\Windows\system32\Iigdfa32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6396
        
        C:\Windows\SysWOW64\Ikfabm32.exe
        
        C:\Windows\system32\Ikfabm32.exe
        161⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Ibpiogmp.exe
        
        C:\Windows\system32\Ibpiogmp.exe
        162⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Igmagnkg.exe
        
        C:\Windows\system32\Igmagnkg.exe
        163⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Jnifigpa.exe
        
        C:\Windows\system32\Jnifigpa.exe
        164⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\Joiccj32.exe
        
        C:\Windows\system32\Joiccj32.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6916
        
        C:\Windows\SysWOW64\Jicdap32.exe
        
        C:\Windows\system32\Jicdap32.exe
        166⤵
        Drops file in System32 directory
        
        PID:7024
        
        C:\Windows\SysWOW64\Jpmlnjco.exe
        
        C:\Windows\system32\Jpmlnjco.exe
        167⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Jfgdkd32.exe
        
        C:\Windows\system32\Jfgdkd32.exe
        168⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6348
        
        C:\Windows\SysWOW64\Kihnmohm.exe
        
        C:\Windows\system32\Kihnmohm.exe
        169⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Kflnfcgg.exe
        
        C:\Windows\system32\Kflnfcgg.exe
        170⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Khmknk32.exe
        
        C:\Windows\system32\Khmknk32.exe
        171⤵
        Modifies registry class
        
        PID:444
        
        C:\Windows\SysWOW64\Kngcje32.exe
        
        C:\Windows\system32\Kngcje32.exe
        172⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Keakgpko.exe
        
        C:\Windows\system32\Keakgpko.exe
        173⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Knippe32.exe
        
        C:\Windows\system32\Knippe32.exe
        174⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6412
        
        C:\Windows\SysWOW64\Kechmoil.exe
        
        C:\Windows\system32\Kechmoil.exe
        175⤵
        Modifies registry class
        
        PID:6548
        
        C:\Windows\SysWOW64\Klmpiiai.exe
        
        C:\Windows\system32\Klmpiiai.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6884
        
        C:\Windows\SysWOW64\Knlleepl.exe
        
        C:\Windows\system32\Knlleepl.exe
        177⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Kefdbo32.exe
        
        C:\Windows\system32\Kefdbo32.exe
        178⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Llpmoiof.exe
        
        C:\Windows\system32\Llpmoiof.exe
        179⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Lnnikdnj.exe
        
        C:\Windows\system32\Lnnikdnj.exe
        180⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Lfealaol.exe
        
        C:\Windows\system32\Lfealaol.exe
        181⤵
        Drops file in System32 directory
        
        PID:5020
        
        C:\Windows\SysWOW64\Lhfmdj32.exe
        
        C:\Windows\system32\Lhfmdj32.exe
        182⤵
        
        PID:3684
        
        C:\Windows\SysWOW64\Lpneegel.exe
        
        C:\Windows\system32\Lpneegel.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6320
        
        C:\Windows\SysWOW64\Lfhnaa32.exe
        
        C:\Windows\system32\Lfhnaa32.exe
        184⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Lifjnm32.exe
        
        C:\Windows\system32\Lifjnm32.exe
        185⤵
        Drops file in System32 directory
        
        PID:7248
        
        C:\Windows\SysWOW64\Lldfjh32.exe
        
        C:\Windows\system32\Lldfjh32.exe
        186⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Locbfd32.exe
        
        C:\Windows\system32\Locbfd32.exe
        187⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Lfjjga32.exe
        
        C:\Windows\system32\Lfjjga32.exe
        188⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Lhkgoiqe.exe
        
        C:\Windows\system32\Lhkgoiqe.exe
        189⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Lpbopfag.exe
        
        C:\Windows\system32\Lpbopfag.exe
        190⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Lbqklb32.exe
        
        C:\Windows\system32\Lbqklb32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7508
        
        C:\Windows\SysWOW64\Likcilhh.exe
        
        C:\Windows\system32\Likcilhh.exe
        192⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Llipehgk.exe
        
        C:\Windows\system32\Llipehgk.exe
        193⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Lbchba32.exe
        
        C:\Windows\system32\Lbchba32.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7636
        
        C:\Windows\SysWOW64\Leadnm32.exe
        
        C:\Windows\system32\Leadnm32.exe
        195⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Mlklkgei.exe
        
        C:\Windows\system32\Mlklkgei.exe
        196⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Mojhgbdl.exe
        
        C:\Windows\system32\Mojhgbdl.exe
        197⤵
        Drops file in System32 directory
        
        PID:7756
        
        C:\Windows\SysWOW64\Medqcmki.exe
        
        C:\Windows\system32\Medqcmki.exe
        198⤵
        Drops file in System32 directory
        
        PID:7800
        
        C:\Windows\SysWOW64\Mpieqeko.exe
        
        C:\Windows\system32\Mpieqeko.exe
        199⤵
        Drops file in System32 directory
        
        PID:7840
        
        C:\Windows\SysWOW64\Mefmimif.exe
        
        C:\Windows\system32\Mefmimif.exe
        200⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Midfokpm.exe
        
        C:\Windows\system32\Midfokpm.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7920
        
        C:\Windows\SysWOW64\Mlbbkfoq.exe
        
        C:\Windows\system32\Mlbbkfoq.exe
        202⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Mblkhq32.exe
        
        C:\Windows\system32\Mblkhq32.exe
        203⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Mekgdl32.exe
        
        C:\Windows\system32\Mekgdl32.exe
        204⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Mleoafmn.exe
        
        C:\Windows\system32\Mleoafmn.exe
        205⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Mfjcnold.exe
        
        C:\Windows\system32\Mfjcnold.exe
        206⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Niipjj32.exe
        
        C:\Windows\system32\Niipjj32.exe
        207⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Nlglfe32.exe
        
        C:\Windows\system32\Nlglfe32.exe
        208⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Nbadcpbh.exe
        
        C:\Windows\system32\Nbadcpbh.exe
        209⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Neppokal.exe
        
        C:\Windows\system32\Neppokal.exe
        210⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Nhnlkfpp.exe
        
        C:\Windows\system32\Nhnlkfpp.exe
        211⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Nohehq32.exe
        
        C:\Windows\system32\Nohehq32.exe
        212⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Nebmekoi.exe
        
        C:\Windows\system32\Nebmekoi.exe
        213⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Nlleaeff.exe
        
        C:\Windows\system32\Nlleaeff.exe
        214⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Nojanpej.exe
        
        C:\Windows\system32\Nojanpej.exe
        215⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Ngaionfl.exe
        
        C:\Windows\system32\Ngaionfl.exe
        216⤵
        Drops file in System32 directory
        
        PID:7752
        
        C:\Windows\SysWOW64\Nhbfff32.exe
        
        C:\Windows\system32\Nhbfff32.exe
        217⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Nomncpcg.exe
        
        C:\Windows\system32\Nomncpcg.exe
        218⤵
        Drops file in System32 directory
        
        PID:7864
        
        C:\Windows\SysWOW64\Ngdfdmdi.exe
        
        C:\Windows\system32\Ngdfdmdi.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7928
        
        C:\Windows\SysWOW64\Nibbqicm.exe
        
        C:\Windows\system32\Nibbqicm.exe
        220⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\Nlqomd32.exe
        
        C:\Windows\system32\Nlqomd32.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8016
        
        C:\Windows\SysWOW64\Ncjginjn.exe
        
        C:\Windows\system32\Ncjginjn.exe
        222⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Oeicejia.exe
        
        C:\Windows\system32\Oeicejia.exe
        223⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Ohgoaehe.exe
        
        C:\Windows\system32\Ohgoaehe.exe
        224⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Opogbbig.exe
        
        C:\Windows\system32\Opogbbig.exe
        225⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Ocmconhk.exe
        
        C:\Windows\system32\Ocmconhk.exe
        226⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Ocopdn32.exe
        
        C:\Windows\system32\Ocopdn32.exe
        227⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Oofaiokl.exe
        
        C:\Windows\system32\Oofaiokl.exe
        228⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Oepifi32.exe
        
        C:\Windows\system32\Oepifi32.exe
        229⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Oljaccjf.exe
        
        C:\Windows\system32\Oljaccjf.exe
        230⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Ocdjpmac.exe
        
        C:\Windows\system32\Ocdjpmac.exe
        231⤵
        
        PID:3744
        
        C:\Windows\SysWOW64\Ohqbhdpj.exe
        
        C:\Windows\system32\Ohqbhdpj.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8044
        
        C:\Windows\SysWOW64\Ophjiaql.exe
        
        C:\Windows\system32\Ophjiaql.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6688
        
        C:\Windows\SysWOW64\Pgbbek32.exe
        
        C:\Windows\system32\Pgbbek32.exe
        234⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Pjpobg32.exe
        
        C:\Windows\system32\Pjpobg32.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7580
        
        C:\Windows\SysWOW64\Ploknb32.exe
        
        C:\Windows\system32\Ploknb32.exe
        236⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Pomgjn32.exe
        
        C:\Windows\system32\Pomgjn32.exe
        237⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\Pgdokkfg.exe
        
        C:\Windows\system32\Pgdokkfg.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7272
        
        C:\Windows\SysWOW64\Phelcc32.exe
        
        C:\Windows\system32\Phelcc32.exe
        239⤵
        Modifies registry class
        
        PID:7596
        
        C:\Windows\SysWOW64\Ppmcdq32.exe
        
        C:\Windows\system32\Ppmcdq32.exe
        240⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Pgflqkdd.exe
        
        C:\Windows\system32\Pgflqkdd.exe
        241⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Plcdiabk.exe
        
        C:\Windows\system32\Plcdiabk.exe
        242⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Pgihfj32.exe
        
        C:\Windows\system32\Pgihfj32.exe
        243⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Phjenbhp.exe
        
        C:\Windows\system32\Phjenbhp.exe
        244⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Pcpikkge.exe
        
        C:\Windows\system32\Pcpikkge.exe
        245⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Phlacbfm.exe
        
        C:\Windows\system32\Phlacbfm.exe
        246⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Pofjpl32.exe
        
        C:\Windows\system32\Pofjpl32.exe
        247⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Qfpbmfdf.exe
        
        C:\Windows\system32\Qfpbmfdf.exe
        248⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Qhonib32.exe
        
        C:\Windows\system32\Qhonib32.exe
        249⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Qqffjo32.exe
        
        C:\Windows\system32\Qqffjo32.exe
        250⤵
        Modifies registry class
        
        PID:8528
        
        C:\Windows\SysWOW64\Qcdbfk32.exe
        
        C:\Windows\system32\Qcdbfk32.exe
        251⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8572
        
        C:\Windows\SysWOW64\Qfbobf32.exe
        
        C:\Windows\system32\Qfbobf32.exe
        252⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Qhakoa32.exe
        
        C:\Windows\system32\Qhakoa32.exe
        253⤵
        Drops file in System32 directory
        
        PID:8656
        
        C:\Windows\SysWOW64\Qqhcpo32.exe
        
        C:\Windows\system32\Qqhcpo32.exe
        254⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Agbkmijg.exe
        
        C:\Windows\system32\Agbkmijg.exe
        255⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Ajqgidij.exe
        
        C:\Windows\system32\Ajqgidij.exe
        256⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Amodep32.exe
        
        C:\Windows\system32\Amodep32.exe
        257⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Aompak32.exe
        
        C:\Windows\system32\Aompak32.exe
        258⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Agdhbi32.exe
        
        C:\Windows\system32\Agdhbi32.exe
        259⤵
        Modifies registry class
        
        PID:8908
        
        C:\Windows\SysWOW64\Ajcdnd32.exe
        
        C:\Windows\system32\Ajcdnd32.exe
        260⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Amaqjp32.exe
        
        C:\Windows\system32\Amaqjp32.exe
        261⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Aqmlknnd.exe
        
        C:\Windows\system32\Aqmlknnd.exe
        262⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Aggegh32.exe
        
        C:\Windows\system32\Aggegh32.exe
        263⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Ajeadd32.exe
        
        C:\Windows\system32\Ajeadd32.exe
        264⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Aqoiqn32.exe
        
        C:\Windows\system32\Aqoiqn32.exe
        265⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Acnemi32.exe
        
        C:\Windows\system32\Acnemi32.exe
        266⤵
        Drops file in System32 directory
        
        PID:9208
        
        C:\Windows\SysWOW64\Aflaie32.exe
        
        C:\Windows\system32\Aflaie32.exe
        267⤵
        Modifies registry class
        
        PID:8260
        
        C:\Windows\SysWOW64\Aijnep32.exe
        
        C:\Windows\system32\Aijnep32.exe
        268⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Aodfajaj.exe
        
        C:\Windows\system32\Aodfajaj.exe
        269⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Ajjjocap.exe
        
        C:\Windows\system32\Ajjjocap.exe
        270⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Aimkjp32.exe
        
        C:\Windows\system32\Aimkjp32.exe
        271⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Bqdblmhl.exe
        
        C:\Windows\system32\Bqdblmhl.exe
        272⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Bcbohigp.exe
        
        C:\Windows\system32\Bcbohigp.exe
        273⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Bfqkddfd.exe
        
        C:\Windows\system32\Bfqkddfd.exe
        274⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Bmkcqn32.exe
        
        C:\Windows\system32\Bmkcqn32.exe
        275⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Boipmj32.exe
        
        C:\Windows\system32\Boipmj32.exe
        276⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Bfchidda.exe
        
        C:\Windows\system32\Bfchidda.exe
        277⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Biadeoce.exe
        
        C:\Windows\system32\Biadeoce.exe
        278⤵
        
        PID:372
        
        C:\Windows\SysWOW64\Boklbi32.exe
        
        C:\Windows\system32\Boklbi32.exe
        279⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Bgbdcgld.exe
        
        C:\Windows\system32\Bgbdcgld.exe
        280⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Bjaqpbkh.exe
        
        C:\Windows\system32\Bjaqpbkh.exe
        281⤵
        Drops file in System32 directory
        
        PID:9188
        
        C:\Windows\SysWOW64\Bmomlnjk.exe
        
        C:\Windows\system32\Bmomlnjk.exe
        282⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Bciehh32.exe
        
        C:\Windows\system32\Bciehh32.exe
        283⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\Bjcmebie.exe
        
        C:\Windows\system32\Bjcmebie.exe
        284⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Bppfmigl.exe
        
        C:\Windows\system32\Bppfmigl.exe
        285⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Bggnof32.exe
        
        C:\Windows\system32\Bggnof32.exe
        286⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Bihjfnmm.exe
        
        C:\Windows\system32\Bihjfnmm.exe
        287⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Cpbbch32.exe
        
        C:\Windows\system32\Cpbbch32.exe
        288⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Cikglnkj.exe
        
        C:\Windows\system32\Cikglnkj.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8972
        
        C:\Windows\SysWOW64\Cabomkll.exe
        
        C:\Windows\system32\Cabomkll.exe
        290⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Ccqkigkp.exe
        
        C:\Windows\system32\Ccqkigkp.exe
        291⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Cglgjeci.exe
        
        C:\Windows\system32\Cglgjeci.exe
        292⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Cadlbk32.exe
        
        C:\Windows\system32\Cadlbk32.exe
        293⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Ccchof32.exe
        
        C:\Windows\system32\Ccchof32.exe
        294⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Cjmpkqqj.exe
        
        C:\Windows\system32\Cjmpkqqj.exe
        295⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Cmklglpn.exe
        
        C:\Windows\system32\Cmklglpn.exe
        296⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Cpihcgoa.exe
        
        C:\Windows\system32\Cpihcgoa.exe
        297⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Cibmlmeb.exe
        
        C:\Windows\system32\Cibmlmeb.exe
        298⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Cpleig32.exe
        
        C:\Windows\system32\Cpleig32.exe
        299⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Cffmfadl.exe
        
        C:\Windows\system32\Cffmfadl.exe
        300⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Dmpfbk32.exe
        
        C:\Windows\system32\Dmpfbk32.exe
        301⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Dpnbog32.exe
        
        C:\Windows\system32\Dpnbog32.exe
        302⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Dgejpd32.exe
        
        C:\Windows\system32\Dgejpd32.exe
        303⤵
        Drops file in System32 directory
        
        PID:8920
        
        C:\Windows\SysWOW64\Djdflp32.exe
        
        C:\Windows\system32\Djdflp32.exe
        304⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Dmbbhkjf.exe
        
        C:\Windows\system32\Dmbbhkjf.exe
        305⤵
        Drops file in System32 directory
        
        PID:9072
        
        C:\Windows\SysWOW64\Dpqodfij.exe
        
        C:\Windows\system32\Dpqodfij.exe
        306⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\Dhhfedil.exe
        
        C:\Windows\system32\Dhhfedil.exe
        307⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Djfcaohp.exe
        
        C:\Windows\system32\Djfcaohp.exe
        308⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Dmdonkgc.exe
        
        C:\Windows\system32\Dmdonkgc.exe
        309⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Dpckjfgg.exe
        
        C:\Windows\system32\Dpckjfgg.exe
        310⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Dhjckcgi.exe
        
        C:\Windows\system32\Dhjckcgi.exe
        311⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Djhpgofm.exe
        
        C:\Windows\system32\Djhpgofm.exe
        312⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Dmglcj32.exe
        
        C:\Windows\system32\Dmglcj32.exe
        313⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Dabhdinj.exe
        
        C:\Windows\system32\Dabhdinj.exe
        314⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Ddadpdmn.exe
        
        C:\Windows\system32\Ddadpdmn.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9584
        
        C:\Windows\SysWOW64\Dmihij32.exe
        
        C:\Windows\system32\Dmihij32.exe
        316⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Dpgeee32.exe
        
        C:\Windows\system32\Dpgeee32.exe
        317⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Dfamapjo.exe
        
        C:\Windows\system32\Dfamapjo.exe
        318⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Emlenj32.exe
        
        C:\Windows\system32\Emlenj32.exe
        319⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Epjajeqo.exe
        
        C:\Windows\system32\Epjajeqo.exe
        320⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Eaindh32.exe
        
        C:\Windows\system32\Eaindh32.exe
        321⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Ehcfaboo.exe
        
        C:\Windows\system32\Ehcfaboo.exe
        322⤵
        Modifies registry class
        
        PID:9880
        
        C:\Windows\SysWOW64\Empoiimf.exe
        
        C:\Windows\system32\Empoiimf.exe
        323⤵
        Drops file in System32 directory
        
        PID:9920
        
        C:\Windows\SysWOW64\Edjgfcec.exe
        
        C:\Windows\system32\Edjgfcec.exe
        324⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Ejdocm32.exe
        
        C:\Windows\system32\Ejdocm32.exe
        325⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Embkoi32.exe
        
        C:\Windows\system32\Embkoi32.exe
        326⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Epagkd32.exe
        
        C:\Windows\system32\Epagkd32.exe
        327⤵
        Modifies registry class
        
        PID:10084
        
        C:\Windows\SysWOW64\Ehhpla32.exe
        
        C:\Windows\system32\Ehhpla32.exe
        328⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Efkphnbd.exe
        
        C:\Windows\system32\Efkphnbd.exe
        329⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Eiildjag.exe
        
        C:\Windows\system32\Eiildjag.exe
        330⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Eaqdegaj.exe
        
        C:\Windows\system32\Eaqdegaj.exe
        331⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Ehjlaaig.exe
        
        C:\Windows\system32\Ehjlaaig.exe
        332⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Fkihnmhj.exe
        
        C:\Windows\system32\Fkihnmhj.exe
        333⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Fmgejhgn.exe
        
        C:\Windows\system32\Fmgejhgn.exe
        334⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Fpeafcfa.exe
        
        C:\Windows\system32\Fpeafcfa.exe
        335⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        336⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Fineoi32.exe
        
        C:\Windows\system32\Fineoi32.exe
        337⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Fmjaphek.exe
        
        C:\Windows\system32\Fmjaphek.exe
        338⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Fgbfhmll.exe
        
        C:\Windows\system32\Fgbfhmll.exe
        339⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        340⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Fdffbake.exe
        
        C:\Windows\system32\Fdffbake.exe
        341⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Fkpool32.exe
        
        C:\Windows\system32\Fkpool32.exe
        342⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Fdhcgaic.exe
        
        C:\Windows\system32\Fdhcgaic.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9928
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        344⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        345⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Gigheh32.exe
        
        C:\Windows\system32\Gigheh32.exe
        346⤵
        Drops file in System32 directory
        
        PID:10132
        
        C:\Windows\SysWOW64\Gaopfe32.exe
        
        C:\Windows\system32\Gaopfe32.exe
        347⤵
        Drops file in System32 directory
        
        PID:10196
        
        C:\Windows\SysWOW64\Ggkiol32.exe
        
        C:\Windows\system32\Ggkiol32.exe
        348⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Gmeakf32.exe
        
        C:\Windows\system32\Gmeakf32.exe
        349⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Ghkeio32.exe
        
        C:\Windows\system32\Ghkeio32.exe
        350⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Gacjadad.exe
        
        C:\Windows\system32\Gacjadad.exe
        351⤵
        Modifies registry class
        
        PID:9552
        
        C:\Windows\SysWOW64\Ggpbjkpl.exe
        
        C:\Windows\system32\Ggpbjkpl.exe
        352⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Ginnfgop.exe
        
        C:\Windows\system32\Ginnfgop.exe
        353⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Ghpocngo.exe
        
        C:\Windows\system32\Ghpocngo.exe
        354⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Hhbkinel.exe
        
        C:\Windows\system32\Hhbkinel.exe
        355⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Hpmpnp32.exe
        
        C:\Windows\system32\Hpmpnp32.exe
        356⤵
        Drops file in System32 directory
        
        PID:10012
        
        C:\Windows\SysWOW64\Hjedffig.exe
        
        C:\Windows\system32\Hjedffig.exe
        357⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Hdkidohn.exe
        
        C:\Windows\system32\Hdkidohn.exe
        358⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Hkjjlhle.exe
        
        C:\Windows\system32\Hkjjlhle.exe
        359⤵
        
        PID:9328
        
        C:\Windows\SysWOW64\Hnhghcki.exe
        
        C:\Windows\system32\Hnhghcki.exe
        360⤵
        Modifies registry class
        
        PID:9516
        
        C:\Windows\SysWOW64\Hpfcdojl.exe
        
        C:\Windows\system32\Hpfcdojl.exe
        361⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Ihnkel32.exe
        
        C:\Windows\system32\Ihnkel32.exe
        362⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        363⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Injcmc32.exe
        
        C:\Windows\system32\Injcmc32.exe
        364⤵
        Modifies registry class
        
        PID:10152
        
        C:\Windows\SysWOW64\Iddljmpc.exe
        
        C:\Windows\system32\Iddljmpc.exe
        365⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Ikndgg32.exe
        
        C:\Windows\system32\Ikndgg32.exe
        366⤵
        Drops file in System32 directory
        
        PID:9620
        
        C:\Windows\SysWOW64\Iqklon32.exe
        
        C:\Windows\system32\Iqklon32.exe
        367⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        368⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Iqmidndd.exe
        
        C:\Windows\system32\Iqmidndd.exe
        369⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Ijfnmc32.exe
        
        C:\Windows\system32\Ijfnmc32.exe
        370⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Ibobdqid.exe
        
        C:\Windows\system32\Ibobdqid.exe
        371⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9260
        
        C:\Windows\SysWOW64\Jglklggl.exe
        
        C:\Windows\system32\Jglklggl.exe
        372⤵
        Modifies registry class
        
        PID:6024
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        373⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        374⤵
        Drops file in System32 directory
        
        PID:5952
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        375⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Jqglkmlj.exe
        
        C:\Windows\system32\Jqglkmlj.exe
        376⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Jgadgf32.exe
        
        C:\Windows\system32\Jgadgf32.exe
        377⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10356
        
        C:\Windows\SysWOW64\Jnkldqkc.exe
        
        C:\Windows\system32\Jnkldqkc.exe
        378⤵
        
        PID:10396
        
        C:\Windows\SysWOW64\Jqiipljg.exe
        
        C:\Windows\system32\Jqiipljg.exe
        379⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Jhpqaiji.exe
        
        C:\Windows\system32\Jhpqaiji.exe
        380⤵
        
        PID:10484
        
        C:\Windows\SysWOW64\Jjamia32.exe
        
        C:\Windows\system32\Jjamia32.exe
        381⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        382⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        383⤵
        Modifies registry class
        
        PID:10612
        
        C:\Windows\SysWOW64\Jjdjoane.exe
        
        C:\Windows\system32\Jjdjoane.exe
        384⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        385⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        386⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Kbmoen32.exe
        
        C:\Windows\system32\Kbmoen32.exe
        387⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        388⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Kkfcndce.exe
        
        C:\Windows\system32\Kkfcndce.exe
        389⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Kndojobi.exe
        
        C:\Windows\system32\Kndojobi.exe
        390⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Kbpkkn32.exe
        
        C:\Windows\system32\Kbpkkn32.exe
        391⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        392⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10984
        
        C:\Windows\SysWOW64\Kgopidgf.exe
        
        C:\Windows\system32\Kgopidgf.exe
        393⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        394⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Kinmcg32.exe
        
        C:\Windows\system32\Kinmcg32.exe
        395⤵
        Drops file in System32 directory
        
        PID:11104
        
        C:\Windows\SysWOW64\Kjpijpdg.exe
        
        C:\Windows\system32\Kjpijpdg.exe
        396⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Liqihglg.exe
        
        C:\Windows\system32\Liqihglg.exe
        397⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Ljbfpo32.exe
        
        C:\Windows\system32\Ljbfpo32.exe
        398⤵
        Modifies registry class
        
        PID:11240
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        399⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Lgffic32.exe
        
        C:\Windows\system32\Lgffic32.exe
        400⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        401⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        402⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        403⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Lnbklm32.exe
        
        C:\Windows\system32\Lnbklm32.exe
        404⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        405⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        406⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Lijlof32.exe
        
        C:\Windows\system32\Lijlof32.exe
        407⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Mbenmk32.exe
        
        C:\Windows\system32\Mbenmk32.exe
        408⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Mlmbfqoj.exe
        
        C:\Windows\system32\Mlmbfqoj.exe
        409⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10912
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        410⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        411⤵
        Drops file in System32 directory
        
        PID:11088
        
        C:\Windows\SysWOW64\Njiegl32.exe
        
        C:\Windows\system32\Njiegl32.exe
        412⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        413⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        414⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Oemefcap.exe
        
        C:\Windows\system32\Oemefcap.exe
        415⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Pojcjh32.exe
        
        C:\Windows\system32\Pojcjh32.exe
        416⤵
        Drops file in System32 directory
        
        PID:10460
        
        C:\Windows\SysWOW64\Phedhmhi.exe
        
        C:\Windows\system32\Phedhmhi.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10560
        
        C:\Windows\SysWOW64\Piijno32.exe
        
        C:\Windows\system32\Piijno32.exe
        418⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10680
        
        C:\Windows\SysWOW64\Qikgco32.exe
        
        C:\Windows\system32\Qikgco32.exe
        419⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        420⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        421⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\Acmobchj.exe
        
        C:\Windows\system32\Acmobchj.exe
        422⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        423⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Aleckinj.exe
        
        C:\Windows\system32\Aleckinj.exe
        424⤵
        Modifies registry class
        
        PID:10996
        
        C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        425⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Bcddcbab.exe
        
        C:\Windows\system32\Bcddcbab.exe
        426⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        427⤵
        Drops file in System32 directory
        
        PID:10432
        
        C:\Windows\SysWOW64\Bbiado32.exe
        
        C:\Windows\system32\Bbiado32.exe
        428⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\Cfigpm32.exe
        
        C:\Windows\system32\Cfigpm32.exe
        429⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Cmcolgbj.exe
        
        C:\Windows\system32\Cmcolgbj.exe
        430⤵
        
        PID:3496
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        431⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10928
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        432⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Cmhigf32.exe
        
        C:\Windows\system32\Cmhigf32.exe
        433⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        434⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        435⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        436⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        437⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11060
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        438⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        439⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        440⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        441⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        442⤵
        
        PID:264
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        443⤵
        Drops file in System32 directory
        
        PID:4920
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        444⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        445⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        446⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        447⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        448⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        449⤵
        
        PID:11476
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        450⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        451⤵
        Modifies registry class
        
        PID:11564
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        452⤵
        
        PID:11612
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        453⤵
        
        PID:11652
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        454⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11736
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        456⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        457⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11828
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        458⤵
        
        PID:11872
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        459⤵
        Modifies registry class
        
        PID:11916
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        460⤵
        
        PID:11964
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        461⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\Kqphfe32.exe
        
        C:\Windows\system32\Kqphfe32.exe
        462⤵
        
        PID:12048
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        463⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        464⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        465⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        466⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        467⤵
        
        PID:12248
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        468⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        469⤵
        
        PID:11316
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        470⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        471⤵
        
        PID:11428
        
        C:\Windows\SysWOW64\Lcggio32.exe
        
        C:\Windows\system32\Lcggio32.exe
        472⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        473⤵
        
        PID:11576
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        474⤵
        
        PID:11644
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        475⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11708
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        476⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11812
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        478⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        479⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        480⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        481⤵
        Drops file in System32 directory
        
        PID:12076
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        482⤵
        
        PID:12124
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        483⤵
        Drops file in System32 directory
        
        PID:12172
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        484⤵
        
        PID:12200
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        485⤵
        
        PID:12280
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        486⤵
        
        PID:11296
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        487⤵
        
        PID:1640
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        488⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        489⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        490⤵
        
        PID:11624
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        491⤵
        
        PID:3108
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        492⤵
        
        PID:11796
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        493⤵
        
        PID:2232
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        494⤵
        
        PID:11924
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        495⤵
        
        PID:11992
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        496⤵
        
        PID:12072
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        497⤵
        
        PID:12136
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        498⤵
        Drops file in System32 directory
        
        PID:12188
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        499⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1128
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        500⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11356
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        501⤵
        
        PID:11460
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        502⤵
        
        PID:828
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        503⤵
        
        PID:11632
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        504⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        505⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        506⤵
        
        PID:11900
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        507⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        508⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        509⤵
        
        PID:12108
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        510⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        511⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        512⤵
        
        PID:948
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        513⤵
        Drops file in System32 directory
        
        PID:4412
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        514⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        515⤵
        Drops file in System32 directory
        
        PID:5108
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        516⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        517⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        518⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        519⤵
        
        PID:3912
        
        C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        520⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        521⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        522⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        523⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        524⤵
        Drops file in System32 directory
        
        PID:11604
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        525⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        526⤵
        
        PID:4068
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        527⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        528⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        529⤵
        
        PID:376
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        530⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        531⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2336
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        532⤵
        Drops file in System32 directory
        
        PID:2464
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        533⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        534⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        535⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        536⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        537⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        538⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        539⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        540⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        541⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        542⤵
        
        PID:11744
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        543⤵
        
        PID:932
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        544⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        545⤵
        Modifies registry class
        
        PID:12028
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        546⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5004
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        547⤵
        Modifies registry class
        
        PID:3544
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        548⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        549⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        550⤵
        Drops file in System32 directory
        
        PID:2812
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        551⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3020
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        552⤵
        
        PID:748
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        553⤵
        Drops file in System32 directory
        
        PID:5312
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        554⤵
        Modifies registry class
        
        PID:2092
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        555⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        556⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        557⤵
        
        PID:3936
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        558⤵
        
        PID:11820
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        559⤵
        Drops file in System32 directory
        
        PID:4472
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        560⤵
        Modifies registry class
        
        PID:5056
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        561⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4868
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        562⤵
        
        PID:11336
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        563⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        564⤵
        Modifies registry class
        
        PID:5224
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        565⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        566⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        567⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        568⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        569⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        570⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        571⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        572⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        573⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        574⤵
        Drops file in System32 directory
        
        PID:5644
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        575⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        576⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        577⤵
        
        PID:900
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        578⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11864
        
        C:\Windows\SysWOW64\Feoodn32.exe
        
        C:\Windows\system32\Feoodn32.exe
        579⤵
        
        PID:2824
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        580⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        581⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        582⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        583⤵
        
        PID:5008
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        584⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4076
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        585⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        586⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        587⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4376
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        588⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        589⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        590⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        591⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        592⤵
        Modifies registry class
        
        PID:5512
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        593⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        594⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        595⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        596⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        597⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        598⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        599⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        600⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        601⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        602⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        603⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        604⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        605⤵
        Modifies registry class
        
        PID:5236
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        606⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        607⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        608⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        609⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        610⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        611⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        612⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        613⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        614⤵
        
        PID:12152
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        615⤵
        Drops file in System32 directory
        
        PID:6480
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        616⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6524
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        617⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        618⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6424
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        619⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        620⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        621⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        622⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        623⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        624⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        625⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        626⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        627⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        628⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        629⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        630⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        631⤵
        
        PID:12236
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        632⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        633⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        634⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        635⤵
        Drops file in System32 directory
        
        PID:6256
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        636⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        637⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        638⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        639⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        640⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        641⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        642⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        643⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        644⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        645⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        646⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        647⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        648⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        649⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        650⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        651⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        652⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        653⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        654⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        655⤵
        Drops file in System32 directory
        
        PID:6512
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        656⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        657⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6960
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        658⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        659⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        660⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        661⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        662⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6400
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        663⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        664⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        665⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        666⤵
        
        PID:224
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        667⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        668⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        669⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Nflkbanj.exe
        
        C:\Windows\system32\Nflkbanj.exe
        670⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        671⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        672⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        673⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2964
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        674⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        675⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        676⤵
        Modifies registry class
        
        PID:7984
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        677⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        678⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        679⤵
        Modifies registry class
        
        PID:6436
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        680⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        681⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        682⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        683⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        684⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        685⤵
        Modifies registry class
        
        PID:7344
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        686⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        687⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        688⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        689⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        690⤵
        Drops file in System32 directory
        
        PID:7252
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        691⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        692⤵
        Modifies registry class
        
        PID:7816
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        693⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        694⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        695⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        696⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        697⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        698⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        699⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        700⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        701⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        702⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        703⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        704⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        705⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        706⤵
        Drops file in System32 directory
        
        PID:7824
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        707⤵
        Drops file in System32 directory
        
        PID:3920
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        708⤵
        Modifies registry class
        
        PID:7692
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        709⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        710⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:5496
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        711⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        712⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        713⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        714⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8032
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        715⤵
        Drops file in System32 directory
        
        PID:6332
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        716⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        717⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        718⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        719⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        720⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        721⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        722⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        723⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        724⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        725⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        726⤵
        Modifies registry class
        
        PID:2708
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        727⤵
        Modifies registry class
        
        PID:8152
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        728⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        729⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7852
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        730⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        731⤵
        Drops file in System32 directory
        
        PID:8036
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        732⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        733⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        734⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        735⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        736⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        737⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7756
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        738⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        739⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        740⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        741⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        742⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        743⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        744⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7476
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        745⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        746⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8908
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        747⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        748⤵
        Modifies registry class
        
        PID:6416
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        749⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        750⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        751⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        752⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7540
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        753⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        754⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        755⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        756⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        757⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        758⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        759⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        760⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        761⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        762⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        763⤵
        Drops file in System32 directory
        
        PID:2396
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        764⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        765⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        766⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        767⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        768⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        769⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        770⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 408
        771⤵
        Program crash
        
        PID:7240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2204 -ip 2204
1⤵
PID:7292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bfdodjhm.exe

Filesize
113KB

MD5
fa27719750ba18cece62bb7cb96c4e49

SHA1
95a1a631f13f5367370b716717db76d4c84ef341

SHA256
cfd122a9b85051d04bdbef5d2e87b4ec80de3fa493af88b003aa3c532fcca61c

SHA512
4f426c7a3509e15bead855b659436813004b2d1c7211a1516a88b387de5ae5dcebf3588bd64e9f942de6fb22a616af89a6c86857a1f0ee9594621b6de3862e3a

Download Submit
C:\Windows\SysWOW64\Cmhigf32.exe

Filesize
113KB

MD5
99f09860efd74f92f337faa24818bcf1

SHA1
794482f979a040bc02e9a214771978c95be72082

SHA256
d4414b9d05b6b0b6aa175d761042ca4e2e8925756809f246e229b8d60a33230f

SHA512
e845b0aef1538536c0e54aa0bb3c392f6cca9c158f4c55dcc488d26efc9d7051081ec497560711806422620dea23c3416d0d869a75f3e8bed1e68c4d6bd2b5eb

Download Submit
C:\Windows\SysWOW64\Eaindh32.exe

Filesize
113KB

MD5
79eb27b0fdf7aac9e9be505e38f9058a

SHA1
18bcb62dcec9d1a69c8dab785ea552747f546280

SHA256
0e048e3e13760591fa823e0591c3f8678033a79d9b9a00d0adde08fdba0e806e

SHA512
970e128a32aa48bf4c9b49488bc37a84a0d8dabdc78ea7fe3c8bc8effef0f7db2e8f07bf8a57b3557f35ac0fe27ba0405e0eb676268392388de5c6462a960ab6

Download Submit
C:\Windows\SysWOW64\Ekbihd32.exe

Filesize
113KB

MD5
85e272699c05d3c03b7e6e71589ad1b5

SHA1
a9401f7ac790036c9da8c2424e1f8559e22c345b

SHA256
c445c2094c6a3486adc7a27bc590404fc630fbc213f553e92101db8212c02172

SHA512
b3120bffab6e946d7e7eb0b35d3187959e2f650830f188dd595833961e7d6e67b7262d74576ea03127322c59e297921b040911af5ca1bc4c367aca1039b64c9c

Download Submit
C:\Windows\SysWOW64\Fmlneg32.exe

Filesize
64KB

MD5
e163393240f53cdbf65aaa285ca00580

SHA1
5d9cc1aa720fe7d9b2d0f7abbe45f903513e065b

SHA256
f47b92aa4e65be329ef380025adcb67a3800a2c7c96f04c377d1ffc38d40679e

SHA512
303844d17ab070a42d54b852a4f6819ca01683e24735d8091f6a4cb2425efbadb722622293af53f3d049e6792d202e711b44326b8b30bbe4e40678e785d3d760

Download Submit
C:\Windows\SysWOW64\Ikndgg32.exe

Filesize
113KB

MD5
a2e120111f29d8df04ac3c75424d9c90

SHA1
7e92c9b6812862a7251e0f9546627f03e65b0eb0

SHA256
109b606195863cf19c28393ad6e70a0c07d184fa311f0abcb410f3abde0d37ac

SHA512
deca761e4b1c6a23c163e3177a51a3d5ccd6780b3d01cba69db54741d057d8dd367dc7459a90734cc0d44c9c39b11c888ee69f56c9f623f2aae6f9d5d980d9dc

Download Submit
C:\Windows\SysWOW64\Ikqqlgem.exe

Filesize
113KB

MD5
3cd505f6fe43460881d2e5f224590d64

SHA1
f024a9a62c2bc38b3a99e801fa87d3c9b9e698e9

SHA256
a3ed7c957a1a52462c93562c381b0c2f89e32eac47834048dba131eae9a01c76

SHA512
bf3531a030829210e1a256aa925b496bb078e8ffbbca0506a6fcc7f297026ab880f102a615bc5774880936f5c032ef0c974285bd4b1896c9b15a3b7b4d3fac2c

Download Submit
C:\Windows\SysWOW64\Jcllonma.exe

Filesize
113KB

MD5
b6495c15490dee65b7ba20de06beae8b

SHA1
a554a89e1def907923acf2c7c67470eafd5f99d3

SHA256
ebd45615e6f070560bb8fcd8fdb840f00981bb7f816d612f94fb3f857e34755f

SHA512
5f6652392fb1e02bcdea57fb5f1ab6608174b1818b208e633f505e02717605f15d5f77f1f044951bee6297d53c724abea343d12c55568c49b6f11abea3097c37

Download Submit
C:\Windows\SysWOW64\Kbceejpf.exe

Filesize
113KB

MD5
9bd9fefbbdc86be714c0132419c67ce3

SHA1
3b55804f508c551ccbfcd9626d5c71d2cb52f386

SHA256
098c58addb3221fe38fd038ac7123ea9adc9b376817fc49f461c1a6739e2b938

SHA512
e24dc6404eea83ab8ab0e3ed1d925aa2ce594b14f2f1529f49dc9e3737b17a55495d32c6981d6d68e6641d6a2758c595944b54dd99274ce1cadee2121ffce1af

Download Submit
C:\Windows\SysWOW64\Kdcbom32.exe

Filesize
113KB

MD5
8a2961a436186173b73f198ff2d491ad

SHA1
6c1c86adbb5f3fc2e6464422e5db03f0fbd4d7af

SHA256
5ca825d5124df1d8fe34f0c4d01408276e04bdffa5ea5066e80e1da6029bd09e

SHA512
266c0dde17f3b7753394ee220e92dd6fa9d44f471f6c34949b96b0af7420b2f5505f8dbc9b45c0c45c9d47b8090861f73dbe0878a2efcaee2f3b2e2d11c03965

Download Submit
C:\Windows\SysWOW64\Kdeoemeg.exe

Filesize
113KB

MD5
42f8f0655afcc8f16a90e509c3231194

SHA1
24bcf6d7ca0c5c9db37111f2b99f89e0ffd557f3

SHA256
5bba79272027a28ceed1a2eb05ffb1fdbdf0ec2b7479465cc56440203225ace7

SHA512
298e3073857853fea4451c53337f94bd43b4a565cf64a858664dd86a02c5d469de90072eaafd6b0145d8863da5b3ce95bec7daf7ac47474b114c20e6a01c6ddd

Download Submit
C:\Windows\SysWOW64\Kdnidn32.exe

Filesize
113KB

MD5
985364a8b31cbaf9762b8427f33acf07

SHA1
c1ef3172a37f099b63d6041e4fd367e414024f33

SHA256
b803f0abd2044b35ea09b11b0b669cfe4865260c638523cc8704c2905ebb2035

SHA512
9ad9dcacc27076778aedc0154e10e86fd43182c28ea1f00608226694bbefd8a5d4965315ba2e235912ee0cf4e0e64be0b7007435ac9e539e32958f6fd1b8db95

Download Submit
C:\Windows\SysWOW64\Kefkme32.exe

Filesize
113KB

MD5
bf097643767a35c2126f06e8230ac584

SHA1
472a2a015af7a911602a3408a11794f911c75393

SHA256
555879d21c99f9d370527b4a426d6796b6874041c0a401a151b71d74757cf522

SHA512
87d5e7778064902883ae189134ae1bb003283829d621eb1b6371ee324351d769444f8e62b336ce3d4980f343c956ba1daa3d4cc73a7cc4eabf7c07e73be08f48

Download Submit
C:\Windows\SysWOW64\Kikame32.exe

Filesize
113KB

MD5
502713371f2f576da5e4abc26792d4ac

SHA1
7d7bd71c0ed1c4e5227cfa3084fe62e0de36d2c8

SHA256
76a6f50fcebaa2d3498ba81ff1130965c8a86eb671c0ad2b8d02d03ca6de0c32

SHA512
75f8c1ea1545e44d9c0d73c019be342fab42e6bb638c96d8668febbe589dc2257bfa3436d02b237043f1953c925d5cae6d0b651dc1e934b781ec197e40bff814

Download Submit
C:\Windows\SysWOW64\Kipkhdeq.exe

Filesize
113KB

MD5
93ef8dd6630a8a6b5dd97966f5bf9fc6

SHA1
98c029dad5446a7ecb4454e4e827c00683b1cf27

SHA256
919c3ee00f88f244adbf4cec353b8b8c6cfbe5dd9cece1e477d47a38df5a9148

SHA512
54262f6a45209ed2dc51cd9df73b859d851bcd589945e56f41e959d06f7947be02f2a53310f3bf65409ae801da66431ebc01a458cde0fba8b07498a11f1fde76

Download Submit
C:\Windows\SysWOW64\Kmijbcpl.exe

Filesize
113KB

MD5
9fab632bdf8b8c1e5bfe5ba30377d13c

SHA1
90d78087b433588d69cf78b7b01427ac4b09999d

SHA256
25c992ac92c6987a4581ed881b76d0a4f5aab4b71e2f971bb613059656032cf2

SHA512
ceff897ff186bcb4aa57e43181c0c93775a152a0262e87e4182adf4f0826e0bca148bd86dd3e4bcef8ae1728a2ccba171dd9126b1cc2449e6f0cda786b6f3f1e

Download Submit
C:\Windows\SysWOW64\Kmncnb32.exe

Filesize
113KB

MD5
13320ae54ed9cbe5ae1e6a90a500fc9c

SHA1
1c5028564a6275f2fa6365ca4e236d932712f0ad

SHA256
c56f823a0c5e1c77b24521f88aaf56b2b887bf5a87e1facb6808c00f7ad0fadc

SHA512
09886af5fd625d453ce122b2f95923b9d0037a8ac3a688ce1771014f2063b39932f480e70d48cf397e51e234b75d67b0f1797c4be01543007adb8badb0bad0bb

Download Submit
C:\Windows\SysWOW64\Lbdolh32.exe

Filesize
113KB

MD5
42b2c60ff2df5eaeb02f5f5964520eff

SHA1
5bad0300dc94318ac530d9a0c234c01f6c858c91

SHA256
ca49c84538d4938edca95931d8e0fec152ffd47ab3e6f92886d4595731a2f736

SHA512
3ae21fdaaf08e495fe04b3ee5d16be837fdcff99288f39f073f265ad9a8bec1bac8db7b2d7e289975ca94a70eabbdc7d569b11790b4b76fa00563d4614b6b0eb

Download Submit
C:\Windows\SysWOW64\Ldjhpl32.exe

Filesize
113KB

MD5
d6d22ed189df361342c6f6db3b72b566

SHA1
0cd4ffe79a548356794518521c2f13432999e9ca

SHA256
ae5200afb0fee301aa10c81fc9265d2c86b42eea6ca4b5e108d9355ef19b905e

SHA512
6a028316fa3429e1e467689883155b82eda0e45c7d0624fb80705b5ea7b9450825d9b40b1d35ccf6d8b8383eb3bbf1bd078767be644d655292fac151fcdc692b

Download Submit
C:\Windows\SysWOW64\Ldoaklml.exe

Filesize
113KB

MD5
b84c939ae1ed1e8211c4a87a3fb8f71d

SHA1
e7b0b540fd316c1927380f923763ec8e205e9d1a

SHA256
d803f3fe1a53886d5700bb900d381ad3a4257c30c7513046530bff4a614f5928

SHA512
69d1754ab09c1565341caf244b5ea10944b7361873701239a900a8bc15789e506b578fb1ef7fc3c3a843ac94b5b37190015f8883bd1934fab1451f7bb2540c3d

Download Submit
C:\Windows\SysWOW64\Lffhfh32.exe

Filesize
113KB

MD5
db4f49ab3a3ba8ed109de487ab9e7a50

SHA1
e717a520e7ff2697fb4a52fbbfb0aa1590b7edd2

SHA256
d39b1a003625384d00322f6c7f6f0d46dc084ba9f4f9e988590250c2c0f5e70a

SHA512
5e1a58c866c57f15e55fc29c8c9d426fcc40ccbaf6eb2d2d248d3d31bef2cd86635f906c4cf0bd7224b190093fdc61b9c5c46d5c439864a7736b905bb6d3ba95

Download Submit
C:\Windows\SysWOW64\Liimncmf.exe

Filesize
113KB

MD5
254bbea6e673b25d85accbac1dc49b3d

SHA1
f42a6ad8d63c5b451cdc75d9ff7a75143a441da1

SHA256
6619d6d8ebd71a0296771f378daeb0837af4dc0ba43b2fd33b826c2229b3d47f

SHA512
accd670e097e81f304164e18a2296f6131e3f31a386264c506563ceb1d59d3957e613a66cae34735c534c9be25dafb50e3b1ca43e8170199449b48e8e1b6c813

Download Submit
C:\Windows\SysWOW64\Lijlof32.exe

Filesize
113KB

MD5
6f7897e28ee05ff7f469407395e23719

SHA1
24b2002bb2f41519bb42a89c8de6fa8490200607

SHA256
93e73d12b53186c74b0d0df9e0681876e2b0bbbd01a95e78b68d0e4f17f25df0

SHA512
2d1a7e750c5a3b5c39c195d59ce902671b6e3e7b8c38a0093740bc044aac5ca8c0b13a0f2196216fd47219f3da83d5ae904e7b113393240ca4131f8085020a58

Download Submit
C:\Windows\SysWOW64\Likjcbkc.exe

Filesize
113KB

MD5
435c1d1a8108c9fea5b49036018dd11c

SHA1
5aff7383fd55e560e568156a37c51c7eeee919dd

SHA256
9bf0b352fb04d94032390759946ca9534d25a2a977e827579f174a0f1a49f313

SHA512
de3bc1c0cac82884d17c44dc9e8ba0f6f66d7050d4c72c3f70467341d5e35ffa590a1b3a8c9992a20f32ffe9e323921ac272f0a7ac5a1a677fd11f78b64fac0e

Download Submit
C:\Windows\SysWOW64\Lmbmibhb.exe

Filesize
113KB

MD5
306d3efdba8825adb001d577960ba576

SHA1
9ddfedeb7c0d8861851588d0151795b8c4d1ebd9

SHA256
2fd5ba8b4ed40de919b8681e30abff41bb587ad93541cd3e3839b427ac208021

SHA512
3f105a0bc3ae280a6b3a088622059a0dd4a3eb0cb095ccab4a48d0aec5e0cbdb363c27672e821ae4cd34edbb4edcea9429e580843d380c84c11b50fd334b7a7f

Download Submit
C:\Windows\SysWOW64\Lmppcbjd.exe

Filesize
113KB

MD5
bea9ba2334e517ccb2f4cce24e71d45b

SHA1
9afdd1974352adbc29792c0dd26d35afeff48003

SHA256
c31f7525c927cebe7aeea6d485ee179065d260255c4df38be4ecc3f7365a1bb2

SHA512
850477f16834c9019cd770db5f15a69927502a4bdeb49cce4141d96f6220a5a8d5129deef06d6484c5d8b74002a3ced15d1156516c099b9e3c2d45efef6039a1

Download Submit
C:\Windows\SysWOW64\Lpneegel.exe

Filesize
113KB

MD5
9d57288994837d883d6ed6b06739e5fe

SHA1
4a1b023a65455f7089171b11d47fe9c3e30caa2d

SHA256
c94111084f780a09c1c06e529f70fc0397e55cd89484785a2d8b132680b209a5

SHA512
4e6854b781c1cfc4220874696c518f7bc23db77c67c4d477a0541ed0292251084fd335c04434ec0b5cedb12b3bdd9cff6701ecbbaea252938d24cc39a2b05272

Download Submit
C:\Windows\SysWOW64\Mdckfk32.exe

Filesize
113KB

MD5
2182958109fe25341832da633c7059f9

SHA1
037363b096872314c3a11e45b96bdf58229c3324

SHA256
7b67f0d1f5e69540abcd3ac681126db9aba3387f451abcf8c37e9a2a4ef3d4a6

SHA512
cc9700cb9a2389e6a345dac30a6d1a3945a89f28ef6ff9c8d1ed0454616d4b8289a057f47a4f7555a61e6ef835a74d80c292eede0e9bc706f7442dc3d31a467b

Download Submit
C:\Windows\SysWOW64\Mdehlk32.exe

Filesize
113KB

MD5
23cf7eb4e11ac511cbde07fa5f66f24e

SHA1
dc1f60e569678ff93c6d39a1ea671a438aeecc03

SHA256
97b0ef4f7e575affd2d98c97766ff4e2fc1590b5f6f27f16e262cdc71659cc78

SHA512
dfcfb9c8547cba05c78e7d59f81a105da2b6f45421bf3b360c0c2a2b300e8c6c6a9c2cc7d1a56a4c869852e5e4cb0617ffb3405d52dceb83c0bc094156a33383

Download Submit
C:\Windows\SysWOW64\Mdmnlj32.exe

Filesize
113KB

MD5
23941a00ead256c49dd187c433905153

SHA1
6057338756e3a209f810aaa3523ac4fd2374a585

SHA256
927bbde0686706632519daf28e3a951ce08081236011928f1c862526c46bab85

SHA512
e02e005968c7d86e646b8e3cc038b6eba91ec9a74115e5437f4b79e8cd4bc048e12a2f495eaba70cc3b634c54d16a7319992f96274cff0ad1961f23f2179e6dd

Download Submit
C:\Windows\SysWOW64\Mgagbf32.exe

Filesize
113KB

MD5
7677d9b3a56ffce5c49ae6f22fefa25e

SHA1
941a43a88044a1c1c852a574cec7e872b82c8ae2

SHA256
44118755212a2d60db72d77bf294ab509e6db444a29ecfa035527a2639318ec9

SHA512
138b99f5e53d6f892d5a0fc2ae03f830da188585fd74fa90c707fb5c847d9bd4770ebb7d5fc58a9d7ecdfc812d88804e1b885e33c4779b9793020289f55d7995

Download Submit
C:\Windows\SysWOW64\Mgfqmfde.exe

Filesize
113KB

MD5
56bcaec5454ce693ce241308edcab79c

SHA1
3b63f4d000059394d454a159a8a876ab10c0fec2

SHA256
4079c96d430ea1f50723bbcd5ebf3f9aa3a28dd8365371c0ce15d26caee485df

SHA512
a5763b0582639d637499362215d8d6011cbadefdbd520b4f4c82dda687e3e0ca734714e483c1d1ab06e1bd1e15622155b53305ce81d240369219ed5c84d5f40b

Download Submit
C:\Windows\SysWOW64\Mibpda32.exe

Filesize
113KB

MD5
236c387b1bbc4d35997a3f2891cc6621

SHA1
5453309eff743dbd6f0697c19a1730ea1bd1b826

SHA256
83bdf6f33b834dd00cb2f4a333309a5f96e43bdc01b05b0ef5eef699a5bab685

SHA512
335ef010827d2437005a93a5979ded47805effd7a56515f6679b2fa30026cf93925bdb5d42b51619a82b2230d0822ee5fbd1afeb8912e76182002994774bfb8c

Download Submit
C:\Windows\SysWOW64\Migjoaaf.exe

Filesize
113KB

MD5
a7d34735322c234ffa7ec2647825dff3

SHA1
ee1487767aadea55ac0c2e70b3a252749085f8af

SHA256
08cdd41378e6236d16c077bea002baffacfec3e4e5646d76b7671cb004c37a7d

SHA512
f58396a6bd328b9ec15fe4e77ee86bc61264e95036bbdba5ff0eca997e1d7880011189872e3a19070ed17e7d94c41fa528c6d7a822d03b51dfb6688b76d4820a

Download Submit
C:\Windows\SysWOW64\Miifeq32.exe

Filesize
113KB

MD5
a6773e78135451cc2b3ab60c5c0c3366

SHA1
a2515a79d642719bd78df1176b8e9c73543d666a

SHA256
3bf86496b5c44bae0d09f0713c8da4889c4f91532b326ed22a65197038ad8c3e

SHA512
4f2f2d3f08f9e5283cf9461f9ef9ce18de2761debdc868107d47a9ef313a415d5bbfb8ac8a7a15652fd427e34f76e565857bf80623d9996b0f02c007f32f6c5c

Download Submit
C:\Windows\SysWOW64\Mlampmdo.exe

Filesize
113KB

MD5
4fd92950e4d007ad1e7bbb824143c4c6

SHA1
a8553b6b50a19b6ec1167af831eca08dc6a373b6

SHA256
030cd3f1887d980fea6f6e1a31c9adbfcfbd8444f6772382d611e502cdfa98e7

SHA512
620e136699cc2056c66e5e67136f18cd15057b7dc32892ca18437ff2ef8d34d0ef8f5aad02d203da66daa486e15654743faaaa61779f0dee1d2feda14487707d

Download Submit
C:\Windows\SysWOW64\Mleoafmn.exe

Filesize
113KB

MD5
8c14b4092a205453a88e387452c5e158

SHA1
5019be071ffa10be934ce3c7a03f90cc0ba6a0d3

SHA256
99e0d0123182d0821461aad69ec22d5337cd92f5a2252de546b15a6b31aed016

SHA512
5988437fdc1d5eb1830cdb3b3e4a87780fa8c830fa6002d3b3950c15ae5d661055187096868a11093a67e55ee2fefb963364a4e41a534138a08c66def0c0859c

Download Submit
C:\Windows\SysWOW64\Mpoefk32.exe

Filesize
113KB

MD5
86ae411b57d6edc52cbd31981748dc27

SHA1
81634fd767f3d9aa3f8d46db4fd9b4108d1513a9

SHA256
52605de6aacfe47934b32f58c7a7b5101e97ac00614a125573e19c49b3298c30

SHA512
42f996ab9060200e6d0fc0d38da8900a43c9b29d24c915a15c41882472cd3c43d6bee793456ccc32dfa6b855f8810c34e00ea69a1446e23a53d46da2b9eba23e

Download Submit
C:\Windows\SysWOW64\Neppokal.exe

Filesize
113KB

MD5
339721c4dc64672a12077390bbd37463

SHA1
3aa7836b0deed8fcdcde009bfbc55f97904f869a

SHA256
d783e1ce9578b51a52df7ccf585dd4e3738a6973c99e72852704fe4e204d1f3e

SHA512
f956a77fd475f900d38a4c64ed16ce2e97ec08f93b8fe4c7e683abfb7e1dfbb11f821f846b8cf3c62b7e002400eb574710fd21fcb8bd66b11a1a9fe228da7945

Download Submit
C:\Windows\SysWOW64\Nilcjp32.exe

Filesize
113KB

MD5
39dd4c283550b83daf9576a4500b560a

SHA1
6a3d4b08f3d34d0b6446b4fe02192d2d565a6384

SHA256
31d3ef389db4d5613da287394fbb8f3fd680605e7cd99eaa910a3ddb79f5c1b0

SHA512
9e9d7f2f5f4db0f4b437fac5afe31deb7403e3ce575383b85ada687db3de01541d4bf95e617b2c47c64c9b34c5ea403b23029d837b922ab457f98526e323fc20

Download Submit
C:\Windows\SysWOW64\Nnjlpo32.exe

Filesize
113KB

MD5
3ec10b41e39c72868a58a8417353833e

SHA1
dd7e3113872881a7884f54f79c58dc393f2cead6

SHA256
5be5e3ef222a725a2280eb0daf0af581504478f1c82f3a9b357447a3349913ff

SHA512
347351781e375d9e92769e292290e8d62e3bb344f400980080448e06a17b3b35117a5ff048dee327e36b9acae90600bc6e6b97b7bc43b2987176124b4a27a605

Download Submit
C:\Windows\SysWOW64\Npcoakfp.exe

Filesize
113KB

MD5
a9e9a56a7774f017c7d7f5215ea84708

SHA1
f7de4c978a3f3f7099a6953bcc73707f9bdfce04

SHA256
a8fc60921d2dab4b8752c9d4fb3f9b08aa6c949bfcf4da2da2da93aeeb383a12

SHA512
555c106bbc1bf51c1e8b6f1d58a915b9d3689d8289f609c39b62ed1779c0c8e7c8a1dbb20e8a4fa9d943ddc1341e240bc663fb13b3e8151d17ae39398aec33f1

Download Submit
C:\Windows\SysWOW64\Npfkgjdn.exe

Filesize
113KB

MD5
c207917dd7d1c6c39b7f82572c26a26d

SHA1
aed6e6a874737983a5bc90b9421bf4f9b38fbc1c

SHA256
6c3bdfbf4ac3a743a73320cc6e027fb21ab05f9dcfdb58a255b14d9b7373310d

SHA512
db7b520895d242fdc788aef8e7de9a8e00896c339946a2fbdecdfea44c29ae5c8b77391b09ed4dbeb22f59f7ebaba8bfec4b8ca64324ca720e51c7220ed0f7fa

Download Submit
C:\Windows\SysWOW64\Ppjbmc32.exe

Filesize
113KB

MD5
a9701a908f2388815616d859cd5b1d45

SHA1
fdd0bc9ac3858a81f63b1d5a102849b4a23fb443

SHA256
ab3dc221b4f68fe02c1f28d1d383980ab8932073b53aa97fcdddfa8d1b3d6f80

SHA512
c881b64735c4f7deb497cb8de90f0167a859866c13feee89501fe91a841d0bed19ef2ea1f4649155a04f7fc11f2e1bf18fd23796543e5702de190b7d876cedc4

Download Submit
memory/396-246-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/400-114-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/404-186-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/436-234-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/788-364-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/828-33-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1056-182-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1084-294-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1240-95-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1316-257-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1320-426-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1324-87-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1336-336-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1388-432-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1440-378-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1736-130-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1820-318-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1888-81-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1888-1-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1888-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2056-9-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2132-408-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2172-145-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2188-268-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2336-370-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2440-388-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2580-300-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2700-262-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2712-25-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2872-354-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3064-193-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3100-342-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3164-214-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3244-73-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3248-396-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3320-143-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3444-161-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3528-218-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3644-306-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3656-420-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3724-106-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3732-122-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3832-154-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3840-57-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3912-288-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4092-276-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4312-312-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4316-226-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4320-169-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4356-17-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4424-324-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4444-201-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4472-414-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4600-330-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4628-41-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4656-390-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4668-402-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4768-69-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4784-102-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4816-282-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5032-270-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5044-348-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5068-49-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5084-372-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads