1e6dd4596e40e57222ce34748afd0f6a9cbae5858f2ec6421815e774fbb7dc7e

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e6dd4596e40e57222ce34748afd0f6a9cbae5858f2ec6421815e774fbb7dc7e.exe
Size

79KB
MD5

02421ab9814f0ff8c1fe8a69b4243eef
SHA1

4dbf62e4d8be04280aee1b94e32f63abbdb2cc96
SHA256

1e6dd4596e40e57222ce34748afd0f6a9cbae5858f2ec6421815e774fbb7dc7e
SHA512

e169943187b0c26f2b8f5e7018c2648c339a97087bc9e5537fbdf2e942ef7f0e7470c04e070a0825674ee0ea19b8b54e57a4e2dae1d3e5fdfcb18fc871394bae
SSDEEP

1536:gbEZVNuatwprCsoC5ACFjn3UEqiFkSIgiItKq9v6DK:KKUlr7oZCBn3UEqixtBtKq9vV

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iiopca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojcpdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Coknoaic.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Igdgglfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jniood32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dggbcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mniallpq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lojmcdgl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cajjjk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgdpni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbojlfdp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeocna32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpiqfima.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcbohigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qhlkilba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecbjkngo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dbicpfdk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bqmeal32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okjnnj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbgbnkfm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnbeeiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jkgpbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipdndloi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojemig32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qbonoghb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhgonidg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lllagh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajhniccb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmabggdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjnffjkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Flngfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Glfmgp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hnnljj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lohqnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dflfac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gnpphljo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjlkge32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lghcocol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onnmdcjm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohmhmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hnbeeiji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kedlip32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cibmlmeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bfgjjm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pajeam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bphgeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ggmmlamj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfiokmkc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfagighf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajhniccb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdinljnk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lghcocol.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmlddqem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kcapicdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	1e6dd4596e40e57222ce34748afd0f6a9cbae5858f2ec6421815e774fbb7dc7e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dmdhcddh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pkpmdbfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hoaojp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bokehc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlkgmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akglloai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Glkmmefl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ennqfenp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ebnfbcbc.exe

Executes dropped EXE 64 IoCs

pid	Process
1156	Ajhniccb.exe
1008	Aodfajaj.exe
1428	Ajjjocap.exe
1476	Bcbohigp.exe
4936	Boipmj32.exe
2608	Bjodjb32.exe
4676	Boklbi32.exe
1092	Bmomlnjk.exe
4716	Bfhadc32.exe
5112	Bqmeal32.exe
5004	Bfjnjcni.exe
3416	Cmdfgm32.exe
1080	Ccnncgmc.exe
3272	Cpeohh32.exe
4616	Cmipblaq.exe
3496	Cippgm32.exe
3472	Cibmlmeb.exe
2544	Cjaifp32.exe
4048	Dpnbog32.exe
4456	Dannij32.exe
456	Dfjgaq32.exe
2748	Dpckjfgg.exe
4588	Dpehof32.exe
3936	Dhomfc32.exe
4540	Eipinkib.exe
4756	Ehailbaa.exe
1736	Ehcfaboo.exe
1572	Ehfcfb32.exe
4624	Edmclccp.exe
3940	Eiildjag.exe
4120	Efmmmn32.exe
5060	Fhmigagd.exe
4752	Fineoi32.exe
1548	Fphnlcdo.exe
1820	Fgbfhmll.exe
752	Fpjjac32.exe
4720	Fkpool32.exe
2012	Fajgkfio.exe
1896	Fkbkdkpp.exe
3896	Fmqgpgoc.exe
620	Fdkpma32.exe
2552	Gmcdffmq.exe
116	Ggkiol32.exe
3176	Gmeakf32.exe
2920	Ghkeio32.exe
2172	Gnhnaf32.exe
224	Giqkkf32.exe
228	Gpkchqdj.exe
2244	Hkpheidp.exe
4036	Hnodaecc.exe
3700	Hgghjjid.exe
4632	Hnaqgd32.exe
4160	Hdkidohn.exe
4112	Hncmmd32.exe
3364	Hglaej32.exe
1536	Hdpbon32.exe
1228	Hjlkge32.exe
3144	Igqkqiai.exe
3064	Ijadbdoj.exe
4872	Iakiia32.exe
1852	Iggaah32.exe
2572	Iqpfjnba.exe
4392	Ijhjcchb.exe
3012	Iqbbpm32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bcodim32.dll	Nknobkje.exe
File opened for modification	C:\Windows\SysWOW64\Baadiiif.exe	Akglloai.exe
File opened for modification	C:\Windows\SysWOW64\Coegoe32.exe	Cgnomg32.exe
File created	C:\Windows\SysWOW64\Gbpedjnb.exe	Glfmgp32.exe
File created	C:\Windows\SysWOW64\Kafkmp32.dll	Jihbip32.exe
File opened for modification	C:\Windows\SysWOW64\Pciqnk32.exe	Pjaleemj.exe
File created	C:\Windows\SysWOW64\Polcjq32.dll	Abfdpfaj.exe
File opened for modification	C:\Windows\SysWOW64\Efafgifc.exe	Ecbjkngo.exe
File created	C:\Windows\SysWOW64\Mmddqemj.dll	Ojigdcll.exe
File created	C:\Windows\SysWOW64\Efpomccg.exe	Dbbffdlq.exe
File created	C:\Windows\SysWOW64\Njjdho32.exe	Nmfcok32.exe
File created	C:\Windows\SysWOW64\Hlhefcoo.dll	Ppgegd32.exe
File opened for modification	C:\Windows\SysWOW64\Cnjdpaki.exe	Cklhcfle.exe
File created	C:\Windows\SysWOW64\Khlklj32.exe	Kocgbend.exe
File created	C:\Windows\SysWOW64\Jdnoeb32.dll	Apeknk32.exe
File opened for modification	C:\Windows\SysWOW64\Hnaqgd32.exe	Hgghjjid.exe
File created	C:\Windows\SysWOW64\Jbkfjo32.dll	Maiccajf.exe
File created	C:\Windows\SysWOW64\Eobkhf32.dll	Aolblopj.exe
File opened for modification	C:\Windows\SysWOW64\Chqogq32.exe	Ckmonl32.exe
File opened for modification	C:\Windows\SysWOW64\Gkaclqkk.exe	Ggfglb32.exe
File created	C:\Windows\SysWOW64\Giljfddl.exe	Gaebef32.exe
File created	C:\Windows\SysWOW64\Hjaqmkhl.dll	Jlgoek32.exe
File created	C:\Windows\SysWOW64\Cpeohh32.exe	Ccnncgmc.exe
File created	C:\Windows\SysWOW64\Kbbhqn32.exe	Kkhpdcab.exe
File created	C:\Windows\SysWOW64\Ejalcgkg.exe	Eplgeokq.exe
File opened for modification	C:\Windows\SysWOW64\Ppgegd32.exe	Ofmdio32.exe
File opened for modification	C:\Windows\SysWOW64\Akglloai.exe	Alelqb32.exe
File opened for modification	C:\Windows\SysWOW64\Gbchdp32.exe	Gpelhd32.exe
File opened for modification	C:\Windows\SysWOW64\Eqncnj32.exe	Enpfan32.exe
File created	C:\Windows\SysWOW64\Dmdhcddh.exe	Dfjpfj32.exe
File created	C:\Windows\SysWOW64\Qfgllk32.dll	Hpqldc32.exe
File opened for modification	C:\Windows\SysWOW64\Babcil32.exe	Biklho32.exe
File created	C:\Windows\SysWOW64\Glgcbf32.exe	Gfjkjo32.exe
File created	C:\Windows\SysWOW64\Lfmmaj32.dll	Gbchdp32.exe
File created	C:\Windows\SysWOW64\Ikgbdnie.dll	Imiehfao.exe
File created	C:\Windows\SysWOW64\Dkhgod32.exe	Dkekjdck.exe
File created	C:\Windows\SysWOW64\Ehfomc32.dll	Kpiqfima.exe
File created	C:\Windows\SysWOW64\Mnfgko32.dll	Lljdai32.exe
File opened for modification	C:\Windows\SysWOW64\Mcaipa32.exe	Mfnhfm32.exe
File created	C:\Windows\SysWOW64\Oifdaage.dll	Mldhfpib.exe
File opened for modification	C:\Windows\SysWOW64\Ffmfchle.exe	Eiieicml.exe
File created	C:\Windows\SysWOW64\Dgnkfj32.dll	Hcmbee32.exe
File created	C:\Windows\SysWOW64\Ipjijkpg.dll	Dojqjdbl.exe
File created	C:\Windows\SysWOW64\Bkfmmb32.dll	Njbgmjgl.exe
File opened for modification	C:\Windows\SysWOW64\Papfgbmg.exe	Pidabppl.exe
File opened for modification	C:\Windows\SysWOW64\Ibgdlg32.exe	Iiopca32.exe
File opened for modification	C:\Windows\SysWOW64\Fmqgpgoc.exe	Fkbkdkpp.exe
File created	C:\Windows\SysWOW64\Jipegn32.dll	Enpmld32.exe
File created	C:\Windows\SysWOW64\Gcmjja32.dll	Jldbpl32.exe
File created	C:\Windows\SysWOW64\Lcmodajm.exe	Lpochfji.exe
File created	C:\Windows\SysWOW64\Heeeiopa.dll	Cnfaohbj.exe
File created	C:\Windows\SysWOW64\Mjpbam32.exe	Miofjepg.exe
File created	C:\Windows\SysWOW64\Hmlephen.dll	Clchbqoo.exe
File created	C:\Windows\SysWOW64\Ickglm32.exe	Ilqoobdd.exe
File opened for modification	C:\Windows\SysWOW64\Eqdpgk32.exe	Enfckp32.exe
File opened for modification	C:\Windows\SysWOW64\Edmclccp.exe	Ehfcfb32.exe
File created	C:\Windows\SysWOW64\Mnnkgl32.exe	Mlpokp32.exe
File created	C:\Windows\SysWOW64\Oghdfilo.dll	Ecbjkngo.exe
File opened for modification	C:\Windows\SysWOW64\Cklhcfle.exe	Cgqlcg32.exe
File opened for modification	C:\Windows\SysWOW64\Abhqefpg.exe	Apjdikqd.exe
File opened for modification	C:\Windows\SysWOW64\Ejalcgkg.exe	Eplgeokq.exe
File created	C:\Windows\SysWOW64\Blgifbil.exe	Baadiiif.exe
File opened for modification	C:\Windows\SysWOW64\Ekajec32.exe	Edgbii32.exe
File created	C:\Windows\SysWOW64\Dccfme32.dll	Ccdihbgg.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6452	5972	WerFault.exe	803

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mqnbqh32.dll"	Bphgeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipckmjqi.dll"	Dfjpfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ojqhdcii.dll"	Mhckcgpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qljcoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nmlddqem.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Opnbae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ciipkkdj.dll"	Bhblllfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbpedjnb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kedlip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kednfemc.dll"	Efmmmn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkofga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hdmoohbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcnobqph.dll"	Jkhgmf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aodogdmn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adfokn32.dll"	Geohklaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dibkjmof.dll"	Gmfplibd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Doepmnag.dll"	Jniood32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akpoaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eqncnj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cjaifp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ccdihbgg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Babcil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nafjjf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dcigeooj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdmmeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mqhfoebo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpfmlghd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ddcebe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ccmgiaig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpjqcaao.dll"	Emkndc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdepoj32.dll"	Ebifmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkkbik32.dll"	Jbiejoaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akglloai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nklinjmj.dll"	Dbnmke32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ohnohn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdmdnadc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ggmmlamj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gakbde32.dll"	Hehdfdek.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hoaojp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gejain32.dll"	Omnjojpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dpehof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcgnbaeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fbgihaji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nckkfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipjedh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hapfpelh.dll"	Khiofk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjnmpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhnjoi32.dll"	Ffnknafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaejqcdo.dll"	Jblmgf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jekjcaef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkjbip32.dll"	Iakiia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jeapcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdlfjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oondnini.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiilcp32.dll"	Pidabppl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlfndjhh.dll"	Gingkqkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hllbndih.dll"	Hgdejd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmlephen.dll"	Clchbqoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cocjiehd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cknmplfo.dll"	Omopjcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aonhqi32.dll"	Aodfajaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oidhlb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eplgeokq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cglbhhga.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 1156	1404	1e6dd4596e40e57222ce34748afd0f6a9cbae5858f2ec6421815e774fbb7dc7e.exe	87
PID 1404 wrote to memory of 1156	1404	1e6dd4596e40e57222ce34748afd0f6a9cbae5858f2ec6421815e774fbb7dc7e.exe	87
PID 1404 wrote to memory of 1156	1404	1e6dd4596e40e57222ce34748afd0f6a9cbae5858f2ec6421815e774fbb7dc7e.exe	87
PID 1156 wrote to memory of 1008	1156	Ajhniccb.exe	88
PID 1156 wrote to memory of 1008	1156	Ajhniccb.exe	88
PID 1156 wrote to memory of 1008	1156	Ajhniccb.exe	88
PID 1008 wrote to memory of 1428	1008	Aodfajaj.exe	89
PID 1008 wrote to memory of 1428	1008	Aodfajaj.exe	89
PID 1008 wrote to memory of 1428	1008	Aodfajaj.exe	89
PID 1428 wrote to memory of 1476	1428	Ajjjocap.exe	90
PID 1428 wrote to memory of 1476	1428	Ajjjocap.exe	90
PID 1428 wrote to memory of 1476	1428	Ajjjocap.exe	90
PID 1476 wrote to memory of 4936	1476	Bcbohigp.exe	91
PID 1476 wrote to memory of 4936	1476	Bcbohigp.exe	91
PID 1476 wrote to memory of 4936	1476	Bcbohigp.exe	91
PID 4936 wrote to memory of 2608	4936	Boipmj32.exe	92
PID 4936 wrote to memory of 2608	4936	Boipmj32.exe	92
PID 4936 wrote to memory of 2608	4936	Boipmj32.exe	92
PID 2608 wrote to memory of 4676	2608	Bjodjb32.exe	93
PID 2608 wrote to memory of 4676	2608	Bjodjb32.exe	93
PID 2608 wrote to memory of 4676	2608	Bjodjb32.exe	93
PID 4676 wrote to memory of 1092	4676	Boklbi32.exe	94
PID 4676 wrote to memory of 1092	4676	Boklbi32.exe	94
PID 4676 wrote to memory of 1092	4676	Boklbi32.exe	94
PID 1092 wrote to memory of 4716	1092	Bmomlnjk.exe	95
PID 1092 wrote to memory of 4716	1092	Bmomlnjk.exe	95
PID 1092 wrote to memory of 4716	1092	Bmomlnjk.exe	95
PID 4716 wrote to memory of 5112	4716	Bfhadc32.exe	96
PID 4716 wrote to memory of 5112	4716	Bfhadc32.exe	96
PID 4716 wrote to memory of 5112	4716	Bfhadc32.exe	96
PID 5112 wrote to memory of 5004	5112	Bqmeal32.exe	97
PID 5112 wrote to memory of 5004	5112	Bqmeal32.exe	97
PID 5112 wrote to memory of 5004	5112	Bqmeal32.exe	97
PID 5004 wrote to memory of 3416	5004	Bfjnjcni.exe	98
PID 5004 wrote to memory of 3416	5004	Bfjnjcni.exe	98
PID 5004 wrote to memory of 3416	5004	Bfjnjcni.exe	98
PID 3416 wrote to memory of 1080	3416	Cmdfgm32.exe	100
PID 3416 wrote to memory of 1080	3416	Cmdfgm32.exe	100
PID 3416 wrote to memory of 1080	3416	Cmdfgm32.exe	100
PID 1080 wrote to memory of 3272	1080	Ccnncgmc.exe	101
PID 1080 wrote to memory of 3272	1080	Ccnncgmc.exe	101
PID 1080 wrote to memory of 3272	1080	Ccnncgmc.exe	101
PID 3272 wrote to memory of 4616	3272	Cpeohh32.exe	102
PID 3272 wrote to memory of 4616	3272	Cpeohh32.exe	102
PID 3272 wrote to memory of 4616	3272	Cpeohh32.exe	102
PID 4616 wrote to memory of 3496	4616	Cmipblaq.exe	103
PID 4616 wrote to memory of 3496	4616	Cmipblaq.exe	103
PID 4616 wrote to memory of 3496	4616	Cmipblaq.exe	103
PID 3496 wrote to memory of 3472	3496	Cippgm32.exe	104
PID 3496 wrote to memory of 3472	3496	Cippgm32.exe	104
PID 3496 wrote to memory of 3472	3496	Cippgm32.exe	104
PID 3472 wrote to memory of 2544	3472	Cibmlmeb.exe	106
PID 3472 wrote to memory of 2544	3472	Cibmlmeb.exe	106
PID 3472 wrote to memory of 2544	3472	Cibmlmeb.exe	106
PID 2544 wrote to memory of 4048	2544	Cjaifp32.exe	107
PID 2544 wrote to memory of 4048	2544	Cjaifp32.exe	107
PID 2544 wrote to memory of 4048	2544	Cjaifp32.exe	107
PID 4048 wrote to memory of 4456	4048	Dpnbog32.exe	108
PID 4048 wrote to memory of 4456	4048	Dpnbog32.exe	108
PID 4048 wrote to memory of 4456	4048	Dpnbog32.exe	108
PID 4456 wrote to memory of 456	4456	Dannij32.exe	109
PID 4456 wrote to memory of 456	4456	Dannij32.exe	109
PID 4456 wrote to memory of 456	4456	Dannij32.exe	109
PID 456 wrote to memory of 2748	456	Dfjgaq32.exe	110

C:\Users\Admin\AppData\Local\Temp\1e6dd4596e40e57222ce34748afd0f6a9cbae5858f2ec6421815e774fbb7dc7e.exe
"C:\Users\Admin\AppData\Local\Temp\1e6dd4596e40e57222ce34748afd0f6a9cbae5858f2ec6421815e774fbb7dc7e.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\Ajhniccb.exe
  C:\Windows\system32\Ajhniccb.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\SysWOW64\Aodfajaj.exe
    C:\Windows\system32\Aodfajaj.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1008
  - - C:\Windows\SysWOW64\Ajjjocap.exe
      C:\Windows\system32\Ajjjocap.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1428
    - - C:\Windows\SysWOW64\Bcbohigp.exe
        
        C:\Windows\system32\Bcbohigp.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1476
      - C:\Windows\SysWOW64\Boipmj32.exe
        
        C:\Windows\system32\Boipmj32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\SysWOW64\Bjodjb32.exe
        
        C:\Windows\system32\Bjodjb32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2608
        
        C:\Windows\SysWOW64\Boklbi32.exe
        
        C:\Windows\system32\Boklbi32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Windows\SysWOW64\Bmomlnjk.exe
        
        C:\Windows\system32\Bmomlnjk.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1092
        
        C:\Windows\SysWOW64\Bfhadc32.exe
        
        C:\Windows\system32\Bfhadc32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4716
        
        C:\Windows\SysWOW64\Bqmeal32.exe
        
        C:\Windows\system32\Bqmeal32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Windows\SysWOW64\Bfjnjcni.exe
        
        C:\Windows\system32\Bfjnjcni.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5004
        
        C:\Windows\SysWOW64\Cmdfgm32.exe
        
        C:\Windows\system32\Cmdfgm32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3416
        
        C:\Windows\SysWOW64\Ccnncgmc.exe
        
        C:\Windows\system32\Ccnncgmc.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1080
        
        C:\Windows\SysWOW64\Cpeohh32.exe
        
        C:\Windows\system32\Cpeohh32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3272
        
        C:\Windows\SysWOW64\Cmipblaq.exe
        
        C:\Windows\system32\Cmipblaq.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4616
        
        C:\Windows\SysWOW64\Cippgm32.exe
        
        C:\Windows\system32\Cippgm32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3496
        
        C:\Windows\SysWOW64\Cibmlmeb.exe
        
        C:\Windows\system32\Cibmlmeb.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3472
        
        C:\Windows\SysWOW64\Cjaifp32.exe
        
        C:\Windows\system32\Cjaifp32.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2544
        
        C:\Windows\SysWOW64\Dpnbog32.exe
        
        C:\Windows\system32\Dpnbog32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4048
        
        C:\Windows\SysWOW64\Dannij32.exe
        
        C:\Windows\system32\Dannij32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4456
        
        C:\Windows\SysWOW64\Dfjgaq32.exe
        
        C:\Windows\system32\Dfjgaq32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:456
        
        C:\Windows\SysWOW64\Dpckjfgg.exe
        
        C:\Windows\system32\Dpckjfgg.exe
        23⤵
        Executes dropped EXE
        
        PID:2748
        
        C:\Windows\SysWOW64\Dpehof32.exe
        
        C:\Windows\system32\Dpehof32.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4588
        
        C:\Windows\SysWOW64\Dhomfc32.exe
        
        C:\Windows\system32\Dhomfc32.exe
        25⤵
        Executes dropped EXE
        
        PID:3936
        
        C:\Windows\SysWOW64\Eipinkib.exe
        
        C:\Windows\system32\Eipinkib.exe
        26⤵
        Executes dropped EXE
        
        PID:4540
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        27⤵
        Executes dropped EXE
        
        PID:4756
        
        C:\Windows\SysWOW64\Ehcfaboo.exe
        
        C:\Windows\system32\Ehcfaboo.exe
        28⤵
        Executes dropped EXE
        
        PID:1736
        
        C:\Windows\SysWOW64\Ehfcfb32.exe
        
        C:\Windows\system32\Ehfcfb32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1572
        
        C:\Windows\SysWOW64\Edmclccp.exe
        
        C:\Windows\system32\Edmclccp.exe
        30⤵
        Executes dropped EXE
        
        PID:4624
        
        C:\Windows\SysWOW64\Eiildjag.exe
        
        C:\Windows\system32\Eiildjag.exe
        31⤵
        Executes dropped EXE
        
        PID:3940
        
        C:\Windows\SysWOW64\Efmmmn32.exe
        
        C:\Windows\system32\Efmmmn32.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4120
        
        C:\Windows\SysWOW64\Fhmigagd.exe
        
        C:\Windows\system32\Fhmigagd.exe
        33⤵
        Executes dropped EXE
        
        PID:5060
        
        C:\Windows\SysWOW64\Fineoi32.exe
        
        C:\Windows\system32\Fineoi32.exe
        34⤵
        Executes dropped EXE
        
        PID:4752
        
        C:\Windows\SysWOW64\Fphnlcdo.exe
        
        C:\Windows\system32\Fphnlcdo.exe
        35⤵
        Executes dropped EXE
        
        PID:1548
        
        C:\Windows\SysWOW64\Fgbfhmll.exe
        
        C:\Windows\system32\Fgbfhmll.exe
        36⤵
        Executes dropped EXE
        
        PID:1820
        
        C:\Windows\SysWOW64\Fpjjac32.exe
        
        C:\Windows\system32\Fpjjac32.exe
        37⤵
        Executes dropped EXE
        
        PID:752
        
        C:\Windows\SysWOW64\Fkpool32.exe
        
        C:\Windows\system32\Fkpool32.exe
        38⤵
        Executes dropped EXE
        
        PID:4720
        
        C:\Windows\SysWOW64\Fajgkfio.exe
        
        C:\Windows\system32\Fajgkfio.exe
        39⤵
        Executes dropped EXE
        
        PID:2012
        
        C:\Windows\SysWOW64\Fkbkdkpp.exe
        
        C:\Windows\system32\Fkbkdkpp.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1896
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        41⤵
        Executes dropped EXE
        
        PID:3896
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        42⤵
        Executes dropped EXE
        
        PID:620
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        43⤵
        Executes dropped EXE
        
        PID:2552
        
        C:\Windows\SysWOW64\Ggkiol32.exe
        
        C:\Windows\system32\Ggkiol32.exe
        44⤵
        Executes dropped EXE
        
        PID:116
        
        C:\Windows\SysWOW64\Gmeakf32.exe
        
        C:\Windows\system32\Gmeakf32.exe
        45⤵
        Executes dropped EXE
        
        PID:3176
        
        C:\Windows\SysWOW64\Ghkeio32.exe
        
        C:\Windows\system32\Ghkeio32.exe
        46⤵
        Executes dropped EXE
        
        PID:2920
        
        C:\Windows\SysWOW64\Gnhnaf32.exe
        
        C:\Windows\system32\Gnhnaf32.exe
        47⤵
        Executes dropped EXE
        
        PID:2172
        
        C:\Windows\SysWOW64\Giqkkf32.exe
        
        C:\Windows\system32\Giqkkf32.exe
        48⤵
        Executes dropped EXE
        
        PID:224
        
        C:\Windows\SysWOW64\Gpkchqdj.exe
        
        C:\Windows\system32\Gpkchqdj.exe
        49⤵
        Executes dropped EXE
        
        PID:228
        
        C:\Windows\SysWOW64\Hkpheidp.exe
        
        C:\Windows\system32\Hkpheidp.exe
        50⤵
        Executes dropped EXE
        
        PID:2244
        
        C:\Windows\SysWOW64\Hnodaecc.exe
        
        C:\Windows\system32\Hnodaecc.exe
        51⤵
        Executes dropped EXE
        
        PID:4036
        
        C:\Windows\SysWOW64\Hgghjjid.exe
        
        C:\Windows\system32\Hgghjjid.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3700
        
        C:\Windows\SysWOW64\Hnaqgd32.exe
        
        C:\Windows\system32\Hnaqgd32.exe
        53⤵
        Executes dropped EXE
        
        PID:4632
        
        C:\Windows\SysWOW64\Hdkidohn.exe
        
        C:\Windows\system32\Hdkidohn.exe
        54⤵
        Executes dropped EXE
        
        PID:4160
        
        C:\Windows\SysWOW64\Hncmmd32.exe
        
        C:\Windows\system32\Hncmmd32.exe
        55⤵
        Executes dropped EXE
        
        PID:4112
        
        C:\Windows\SysWOW64\Hglaej32.exe
        
        C:\Windows\system32\Hglaej32.exe
        56⤵
        Executes dropped EXE
        
        PID:3364
        
        C:\Windows\SysWOW64\Hdpbon32.exe
        
        C:\Windows\system32\Hdpbon32.exe
        57⤵
        Executes dropped EXE
        
        PID:1536
        
        C:\Windows\SysWOW64\Hjlkge32.exe
        
        C:\Windows\system32\Hjlkge32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1228
        
        C:\Windows\SysWOW64\Igqkqiai.exe
        
        C:\Windows\system32\Igqkqiai.exe
        59⤵
        Executes dropped EXE
        
        PID:3144
        
        C:\Windows\SysWOW64\Ijadbdoj.exe
        
        C:\Windows\system32\Ijadbdoj.exe
        60⤵
        Executes dropped EXE
        
        PID:3064
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4872
        
        C:\Windows\SysWOW64\Iggaah32.exe
        
        C:\Windows\system32\Iggaah32.exe
        62⤵
        Executes dropped EXE
        
        PID:1852
        
        C:\Windows\SysWOW64\Iqpfjnba.exe
        
        C:\Windows\system32\Iqpfjnba.exe
        63⤵
        Executes dropped EXE
        
        PID:2572
        
        C:\Windows\SysWOW64\Ijhjcchb.exe
        
        C:\Windows\system32\Ijhjcchb.exe
        64⤵
        Executes dropped EXE
        
        PID:4392
        
        C:\Windows\SysWOW64\Iqbbpm32.exe
        
        C:\Windows\system32\Iqbbpm32.exe
        65⤵
        Executes dropped EXE
        
        PID:3012
        
        C:\Windows\SysWOW64\Jkhgmf32.exe
        
        C:\Windows\system32\Jkhgmf32.exe
        66⤵
        Modifies registry class
        
        PID:1196
        
        C:\Windows\SysWOW64\Jbaojpgb.exe
        
        C:\Windows\system32\Jbaojpgb.exe
        67⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        68⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\Jbdlop32.exe
        
        C:\Windows\system32\Jbdlop32.exe
        69⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Jgadgf32.exe
        
        C:\Windows\system32\Jgadgf32.exe
        70⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        71⤵
        Modifies registry class
        
        PID:2596
        
        C:\Windows\SysWOW64\Jdgafjpn.exe
        
        C:\Windows\system32\Jdgafjpn.exe
        72⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\Jgenbfoa.exe
        
        C:\Windows\system32\Jgenbfoa.exe
        73⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        74⤵
        
        PID:208
        
        C:\Windows\SysWOW64\Kqnbkl32.exe
        
        C:\Windows\system32\Kqnbkl32.exe
        75⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Kdinljnk.exe
        
        C:\Windows\system32\Kdinljnk.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4972
        
        C:\Windows\SysWOW64\Kjffdalb.exe
        
        C:\Windows\system32\Kjffdalb.exe
        77⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        78⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Kenggi32.exe
        
        C:\Windows\system32\Kenggi32.exe
        79⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Kkhpdcab.exe
        
        C:\Windows\system32\Kkhpdcab.exe
        80⤵
        Drops file in System32 directory
        
        PID:5248
        
        C:\Windows\SysWOW64\Kbbhqn32.exe
        
        C:\Windows\system32\Kbbhqn32.exe
        81⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Kkjlic32.exe
        
        C:\Windows\system32\Kkjlic32.exe
        82⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        83⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Kgamnded.exe
        
        C:\Windows\system32\Kgamnded.exe
        84⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Knkekn32.exe
        
        C:\Windows\system32\Knkekn32.exe
        85⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Liqihglg.exe
        
        C:\Windows\system32\Liqihglg.exe
        86⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Ljbfpo32.exe
        
        C:\Windows\system32\Ljbfpo32.exe
        87⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Lbinam32.exe
        
        C:\Windows\system32\Lbinam32.exe
        88⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        89⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Lghcocol.exe
        
        C:\Windows\system32\Lghcocol.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5740
        
        C:\Windows\SysWOW64\Lnbklm32.exe
        
        C:\Windows\system32\Lnbklm32.exe
        91⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Lgkpdcmi.exe
        
        C:\Windows\system32\Lgkpdcmi.exe
        92⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Lndham32.exe
        
        C:\Windows\system32\Lndham32.exe
        93⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Maeachag.exe
        
        C:\Windows\system32\Maeachag.exe
        94⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Mhoipb32.exe
        
        C:\Windows\system32\Mhoipb32.exe
        95⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6004
        
        C:\Windows\SysWOW64\Mahnhhod.exe
        
        C:\Windows\system32\Mahnhhod.exe
        97⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Miofjepg.exe
        
        C:\Windows\system32\Miofjepg.exe
        98⤵
        Drops file in System32 directory
        
        PID:6092
        
        C:\Windows\SysWOW64\Mjpbam32.exe
        
        C:\Windows\system32\Mjpbam32.exe
        99⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Majjng32.exe
        
        C:\Windows\system32\Majjng32.exe
        100⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Miaboe32.exe
        
        C:\Windows\system32\Miaboe32.exe
        101⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Mlpokp32.exe
        
        C:\Windows\system32\Mlpokp32.exe
        102⤵
        Drops file in System32 directory
        
        PID:5336
        
        C:\Windows\SysWOW64\Mnnkgl32.exe
        
        C:\Windows\system32\Mnnkgl32.exe
        103⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Mehcdfch.exe
        
        C:\Windows\system32\Mehcdfch.exe
        104⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Mhfppabl.exe
        
        C:\Windows\system32\Mhfppabl.exe
        105⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        106⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Maodigil.exe
        
        C:\Windows\system32\Maodigil.exe
        107⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Mldhfpib.exe
        
        C:\Windows\system32\Mldhfpib.exe
        108⤵
        Drops file in System32 directory
        
        PID:5896
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        109⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Nemmoe32.exe
        
        C:\Windows\system32\Nemmoe32.exe
        110⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        111⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Noeahkfc.exe
        
        C:\Windows\system32\Noeahkfc.exe
        112⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        113⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        114⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        115⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Nafjjf32.exe
        
        C:\Windows\system32\Nafjjf32.exe
        116⤵
        Modifies registry class
        
        PID:5936
        
        C:\Windows\SysWOW64\Nhpbfpka.exe
        
        C:\Windows\system32\Nhpbfpka.exe
        117⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        118⤵
        Drops file in System32 directory
        
        PID:5276
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        119⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Niooqcad.exe
        
        C:\Windows\system32\Niooqcad.exe
        120⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        121⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        122⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Oondnini.exe
        
        C:\Windows\system32\Oondnini.exe
        123⤵
        Modifies registry class
        
        PID:6128
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        124⤵
        Modifies registry class
        
        PID:5908
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        125⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Oaompd32.exe
        
        C:\Windows\system32\Oaompd32.exe
        126⤵
        
        PID:4760
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6160
        
        C:\Windows\SysWOW64\Oeoblb32.exe
        
        C:\Windows\system32\Oeoblb32.exe
        128⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        129⤵
        Modifies registry class
        
        PID:6240
        
        C:\Windows\SysWOW64\Oklkdi32.exe
        
        C:\Windows\system32\Oklkdi32.exe
        130⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Oafcqcea.exe
        
        C:\Windows\system32\Oafcqcea.exe
        131⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Ohpkmn32.exe
        
        C:\Windows\system32\Ohpkmn32.exe
        132⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Plndcl32.exe
        
        C:\Windows\system32\Plndcl32.exe
        133⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Phedhmhi.exe
        
        C:\Windows\system32\Phedhmhi.exe
        134⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        135⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Pidabppl.exe
        
        C:\Windows\system32\Pidabppl.exe
        136⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6560
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        137⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Pifnhpmi.exe
        
        C:\Windows\system32\Pifnhpmi.exe
        138⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Pkhjph32.exe
        
        C:\Windows\system32\Pkhjph32.exe
        139⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Pcobaedj.exe
        
        C:\Windows\system32\Pcobaedj.exe
        140⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Pemomqcn.exe
        
        C:\Windows\system32\Pemomqcn.exe
        141⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6816
        
        C:\Windows\SysWOW64\Qkjgegae.exe
        
        C:\Windows\system32\Qkjgegae.exe
        143⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Qcaofebg.exe
        
        C:\Windows\system32\Qcaofebg.exe
        144⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        145⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        146⤵
        Modifies registry class
        
        PID:7000
        
        C:\Windows\SysWOW64\Ajndioga.exe
        
        C:\Windows\system32\Ajndioga.exe
        147⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Aojlaeei.exe
        
        C:\Windows\system32\Aojlaeei.exe
        148⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Aeddnp32.exe
        
        C:\Windows\system32\Aeddnp32.exe
        149⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Ahcajk32.exe
        
        C:\Windows\system32\Ahcajk32.exe
        150⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Akamff32.exe
        
        C:\Windows\system32\Akamff32.exe
        151⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Aakebqbj.exe
        
        C:\Windows\system32\Aakebqbj.exe
        152⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Alqjpi32.exe
        
        C:\Windows\system32\Alqjpi32.exe
        153⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        154⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Akffafgg.exe
        
        C:\Windows\system32\Akffafgg.exe
        155⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Aleckinj.exe
        
        C:\Windows\system32\Aleckinj.exe
        156⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        157⤵
        Modifies registry class
        
        PID:6592
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        158⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Bbgeno32.exe
        
        C:\Windows\system32\Bbgeno32.exe
        159⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Bjnmpl32.exe
        
        C:\Windows\system32\Bjnmpl32.exe
        160⤵
        Modifies registry class
        
        PID:6856
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        161⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Bokehc32.exe
        
        C:\Windows\system32\Bokehc32.exe
        162⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6984
        
        C:\Windows\SysWOW64\Bbiado32.exe
        
        C:\Windows\system32\Bbiado32.exe
        163⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\Bfgjjm32.exe
        
        C:\Windows\system32\Bfgjjm32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7116
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6136
        
        C:\Windows\SysWOW64\Ckfphc32.exe
        
        C:\Windows\system32\Ckfphc32.exe
        166⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        167⤵
        Modifies registry class
        
        PID:6324
        
        C:\Windows\SysWOW64\Cfldelik.exe
        
        C:\Windows\system32\Cfldelik.exe
        168⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        169⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        170⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Cfqmpl32.exe
        
        C:\Windows\system32\Cfqmpl32.exe
        171⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        172⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7056
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        174⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Coknoaic.exe
        
        C:\Windows\system32\Coknoaic.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3296
        
        C:\Windows\SysWOW64\Dbjkkl32.exe
        
        C:\Windows\system32\Dbjkkl32.exe
        176⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        177⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        178⤵
        Modifies registry class
        
        PID:6512
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        179⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        180⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Dfjpfj32.exe
        
        C:\Windows\system32\Dfjpfj32.exe
        181⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7040
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7152
        
        C:\Windows\SysWOW64\Djhimica.exe
        
        C:\Windows\system32\Djhimica.exe
        183⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        184⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Dbcmakpl.exe
        
        C:\Windows\system32\Dbcmakpl.exe
        185⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\Dimenegi.exe
        
        C:\Windows\system32\Dimenegi.exe
        186⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6412
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        188⤵
        
        PID:3244
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        189⤵
        Modifies registry class
        
        PID:4932
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        190⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        191⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Eplgeokq.exe
        
        C:\Windows\system32\Eplgeokq.exe
        192⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7216
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        193⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        194⤵
        Drops file in System32 directory
        
        PID:7304
        
        C:\Windows\SysWOW64\Ffmfchle.exe
        
        C:\Windows\system32\Ffmfchle.exe
        195⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        196⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        197⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        198⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7508
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        200⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        201⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        202⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        203⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Gfheof32.exe
        
        C:\Windows\system32\Gfheof32.exe
        204⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        205⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        206⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        207⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        208⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        209⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Gkhkjd32.exe
        
        C:\Windows\system32\Gkhkjd32.exe
        210⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        211⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        212⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        213⤵
        Modifies registry class
        
        PID:8172
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        214⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        215⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        216⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        217⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        218⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Hgdejd32.exe
        
        C:\Windows\system32\Hgdejd32.exe
        219⤵
        Modifies registry class
        
        PID:7624
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        220⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        221⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        222⤵
        Drops file in System32 directory
        
        PID:7896
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        223⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        224⤵
        Modifies registry class
        
        PID:8068
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        225⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        226⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        227⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Ipjedh32.exe
        
        C:\Windows\system32\Ipjedh32.exe
        228⤵
        Modifies registry class
        
        PID:7460
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        229⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        230⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        231⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8020
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        233⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        234⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        235⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        236⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        237⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        238⤵
        Modifies registry class
        
        PID:7424
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        239⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        240⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        241⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        242⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        243⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        244⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        245⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        246⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        247⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        248⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        249⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        250⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        251⤵
        
        PID:984
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        252⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        253⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        254⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        255⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        256⤵
        
        PID:8248
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        257⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        258⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        259⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        260⤵
        Drops file in System32 directory
        
        PID:8416
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        261⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        262⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        263⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        264⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        265⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        266⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        267⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        268⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        269⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8852
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        271⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8896
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        272⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8984
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        274⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        275⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        276⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        277⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        278⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        279⤵
        Drops file in System32 directory
        
        PID:8244
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        280⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8276
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        282⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8384
        
        C:\Windows\SysWOW64\Pajeam32.exe
        
        C:\Windows\system32\Pajeam32.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8472
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        285⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        286⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        287⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        288⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        289⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        290⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        291⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        292⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        293⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        294⤵
        Drops file in System32 directory
        
        PID:9148
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        295⤵
        
        PID:436
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        296⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        297⤵
        Drops file in System32 directory
        
        PID:8272
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8392
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        299⤵
        Drops file in System32 directory
        
        PID:8456
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        300⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        301⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        302⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        303⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        304⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        305⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        306⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        307⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        308⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8480
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        309⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        310⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        311⤵
        Drops file in System32 directory
        
        PID:9036
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        312⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        313⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        314⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        315⤵
        Drops file in System32 directory
        
        PID:8864
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        316⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        317⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8736
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        319⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        320⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        321⤵
        Modifies registry class
        
        PID:8968
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        322⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        323⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9300
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        325⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        326⤵
        Drops file in System32 directory
        
        PID:9384
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        327⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        328⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        329⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Ennqfenp.exe
        
        C:\Windows\system32\Ennqfenp.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9548
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        331⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        332⤵
        Drops file in System32 directory
        
        PID:9636
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        333⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Ekdnei32.exe
        
        C:\Windows\system32\Ekdnei32.exe
        334⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9768
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        336⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        337⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        338⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        339⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        340⤵
        Modifies registry class
        
        PID:9980
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        341⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        342⤵
        Modifies registry class
        
        PID:10064
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        343⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        344⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        345⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        346⤵
        Drops file in System32 directory
        
        PID:8588
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        347⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        348⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        349⤵
        Modifies registry class
        
        PID:9396
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        350⤵
        Modifies registry class
        
        PID:9452
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        351⤵
        Drops file in System32 directory
        
        PID:9528
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        352⤵
        Drops file in System32 directory
        
        PID:9580
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9676
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        354⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        355⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        356⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        357⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        358⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        359⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        360⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        361⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9236
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        363⤵
        Drops file in System32 directory
        
        PID:9364
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        364⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        365⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        366⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        367⤵
        Drops file in System32 directory
        
        PID:9836
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        368⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        369⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        370⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10160
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        371⤵
        
        PID:9272
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        372⤵
        Drops file in System32 directory
        
        PID:9464
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        373⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        374⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        375⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        376⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        377⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        378⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        379⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        380⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        381⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        382⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Jniood32.exe
        
        C:\Windows\system32\Jniood32.exe
        383⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9240
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        384⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        385⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        386⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        387⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        388⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10408
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        389⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        390⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        391⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        392⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        393⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        394⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        395⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        396⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        397⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        398⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        399⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        400⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        401⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        402⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        403⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        404⤵
        
        PID:11108
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        405⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        406⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        407⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        408⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        409⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        410⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        411⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        412⤵
        Drops file in System32 directory
        
        PID:10524
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        413⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        414⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        415⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        416⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        417⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        418⤵
        Modifies registry class
        
        PID:10968
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        419⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        420⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        421⤵
        Modifies registry class
        
        PID:11140
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        422⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        423⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        424⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        425⤵
        Drops file in System32 directory
        
        PID:10512
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        426⤵
        Drops file in System32 directory
        
        PID:10564
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        427⤵
        
        PID:10704
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        428⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        429⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        430⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        431⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        432⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        433⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        434⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        435⤵
        Modifies registry class
        
        PID:10820
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        436⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        437⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        438⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        439⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        440⤵
        Modifies registry class
        
        PID:10828
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        441⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        442⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        443⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        444⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        445⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        446⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        447⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        448⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        449⤵
        Modifies registry class
        
        PID:11304
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        450⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        451⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        452⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        453⤵
        
        PID:11472
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        454⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        455⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        456⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11604
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        457⤵
        
        PID:11644
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        458⤵
        
        PID:11688
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        459⤵
        Modifies registry class
        
        PID:11724
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        460⤵
        
        PID:11776
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        461⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        462⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        463⤵
        
        PID:11896
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        464⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        465⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        466⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Cpbjkn32.exe
        
        C:\Windows\system32\Cpbjkn32.exe
        467⤵
        
        PID:12080
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        468⤵
        Modifies registry class
        
        PID:12120
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        469⤵
        Modifies registry class
        
        PID:12164
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        470⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        471⤵
        Drops file in System32 directory
        
        PID:12248
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        472⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        473⤵
        Drops file in System32 directory
        
        PID:11340
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        474⤵
        Drops file in System32 directory
        
        PID:11400
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        475⤵
        
        PID:11428
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        476⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        477⤵
        Drops file in System32 directory
        
        PID:11544
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        478⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        479⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\Dnonkq32.exe
        
        C:\Windows\system32\Dnonkq32.exe
        480⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        481⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11700
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        482⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        483⤵
        
        PID:376
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        484⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11848
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        485⤵
        Drops file in System32 directory
        
        PID:11936
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        486⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        487⤵
        Drops file in System32 directory
        
        PID:3112
        
        C:\Windows\SysWOW64\Eqdpgk32.exe
        
        C:\Windows\system32\Eqdpgk32.exe
        488⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        489⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        490⤵
        
        PID:12200
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        491⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        492⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        493⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        494⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        495⤵
        Modifies registry class
        
        PID:11540
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        496⤵
        Drops file in System32 directory
        
        PID:2292
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        497⤵
        
        PID:11612
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        498⤵
        Drops file in System32 directory
        
        PID:11652
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        499⤵
        Modifies registry class
        
        PID:4440
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        500⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        501⤵
        
        PID:1408
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        502⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        503⤵
        
        PID:11940
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        504⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\Fbbicl32.exe
        
        C:\Windows\system32\Fbbicl32.exe
        505⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        506⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        507⤵
        
        PID:12240
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        508⤵
        
        PID:11328
        
        C:\Windows\SysWOW64\Fganqbgg.exe
        
        C:\Windows\system32\Fganqbgg.exe
        509⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\Fohfbpgi.exe
        
        C:\Windows\system32\Fohfbpgi.exe
        510⤵
        
        PID:11484
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        511⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:508
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        512⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        513⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        514⤵
        Modifies registry class
        
        PID:11748
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        515⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        516⤵
        Drops file in System32 directory
        
        PID:3436
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        517⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        518⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4456
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        519⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        520⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        521⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        522⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        523⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3272
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        524⤵
        Modifies registry class
        
        PID:11592
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        525⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\Ggmmlamj.exe
        
        C:\Windows\system32\Ggmmlamj.exe
        526⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1548
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        527⤵
        
        PID:1160
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        528⤵
        Drops file in System32 directory
        
        PID:1580
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        529⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        530⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        531⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        532⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        533⤵
        
        PID:11376
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        534⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3216
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        535⤵
        Modifies registry class
        
        PID:3896
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        536⤵
        
        PID:11684
        
        C:\Windows\SysWOW64\Hejqldci.exe
        
        C:\Windows\system32\Hejqldci.exe
        537⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        538⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        539⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2096
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        540⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        541⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        542⤵
        
        PID:11292
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        543⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1992
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        544⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        545⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        546⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3760
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        547⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        548⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        549⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        550⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        551⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        552⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        553⤵
        Modifies registry class
        
        PID:1336
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        554⤵
        Modifies registry class
        
        PID:2244
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        555⤵
        Drops file in System32 directory
        
        PID:2040
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        556⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        557⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4140
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        558⤵
        Drops file in System32 directory
        
        PID:716
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        559⤵
        Drops file in System32 directory
        
        PID:2852
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        560⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        561⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        562⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4840
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        563⤵
        
        PID:448
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        564⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        565⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        566⤵
        Modifies registry class
        
        PID:12088
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        567⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        568⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        569⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        570⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3064
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        571⤵
        
        PID:928
        
        C:\Windows\SysWOW64\Kpiqfima.exe
        
        C:\Windows\system32\Kpiqfima.exe
        572⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:368
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        573⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        574⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        575⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        576⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        577⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        578⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        579⤵
        
        PID:12300
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        580⤵
        Modifies registry class
        
        PID:12356
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        581⤵
        Drops file in System32 directory
        
        PID:12392
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        582⤵
        
        PID:12440
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        583⤵
        
        PID:12480
        
        C:\Windows\SysWOW64\Kcapicdj.exe
        
        C:\Windows\system32\Kcapicdj.exe
        584⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12528
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        585⤵
        
        PID:12564
        
        C:\Windows\SysWOW64\Lljdai32.exe
        
        C:\Windows\system32\Lljdai32.exe
        586⤵
        Drops file in System32 directory
        
        PID:12612
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        587⤵
        
        PID:12652
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        588⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12696
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        589⤵
        
        PID:12736
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        590⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12772
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        591⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12816
        
        C:\Windows\SysWOW64\Ledepn32.exe
        
        C:\Windows\system32\Ledepn32.exe
        592⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        593⤵
        
        PID:12896
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        594⤵
        
        PID:12948
        
        C:\Windows\SysWOW64\Lfiokmkc.exe
        
        C:\Windows\system32\Lfiokmkc.exe
        595⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12984
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        596⤵
        
        PID:13028
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        597⤵
        
        PID:13064
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        598⤵
        Drops file in System32 directory
        
        PID:13108
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        599⤵
        
        PID:13152
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        600⤵
        
        PID:13196
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        601⤵
        
        PID:13236
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        602⤵
        
        PID:13268
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        603⤵
        Drops file in System32 directory
        
        PID:4872
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        604⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        605⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        606⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        607⤵
        
        PID:12364
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        608⤵
        
        PID:12372
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        609⤵
        Modifies registry class
        
        PID:12448
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        610⤵
        Modifies registry class
        
        PID:11052
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        611⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        612⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        613⤵
        Drops file in System32 directory
        
        PID:12560
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        614⤵
        Modifies registry class
        
        PID:12636
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        615⤵
        
        PID:12704
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        616⤵
        
        PID:12720
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        617⤵
        
        PID:12800
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        618⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        619⤵
        
        PID:12880
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        620⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        621⤵
        
        PID:12940
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        622⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Nfqnbjfi.exe
        
        C:\Windows\system32\Nfqnbjfi.exe
        623⤵
        
        PID:13044
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        624⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        625⤵
        
        PID:13144
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        626⤵
        
        PID:13176
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        627⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        628⤵
        
        PID:13288
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        629⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        630⤵
        
        PID:12320
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        631⤵
        Modifies registry class
        
        PID:4712
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        632⤵
        
        PID:12352
        
        C:\Windows\SysWOW64\Ocihgnam.exe
        
        C:\Windows\system32\Ocihgnam.exe
        633⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        634⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        635⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6012
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        636⤵
        
        PID:12512
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        637⤵
        
        PID:12524
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        638⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        639⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        640⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5848
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        641⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        642⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        643⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        644⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        645⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        646⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        647⤵
        
        PID:13016
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        648⤵
        
        PID:13060
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        649⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        650⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6132
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        651⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        652⤵
        
        PID:13232
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        653⤵
        
        PID:13304
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        654⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        655⤵
        
        PID:2596
        
        C:\Windows\SysWOW64\Pjaleemj.exe
        
        C:\Windows\system32\Pjaleemj.exe
        656⤵
        Drops file in System32 directory
        
        PID:12340
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        657⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        658⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Qppaclio.exe
        
        C:\Windows\system32\Qppaclio.exe
        659⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Qbonoghb.exe
        
        C:\Windows\system32\Qbonoghb.exe
        660⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6016
        
        C:\Windows\SysWOW64\Qiiflaoo.exe
        
        C:\Windows\system32\Qiiflaoo.exe
        661⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Qbajeg32.exe
        
        C:\Windows\system32\Qbajeg32.exe
        662⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Qjhbfd32.exe
        
        C:\Windows\system32\Qjhbfd32.exe
        663⤵
        
        PID:12684
        
        C:\Windows\SysWOW64\Aabkbono.exe
        
        C:\Windows\system32\Aabkbono.exe
        664⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Apeknk32.exe
        
        C:\Windows\system32\Apeknk32.exe
        665⤵
        Drops file in System32 directory
        
        PID:6128
        
        C:\Windows\SysWOW64\Afockelf.exe
        
        C:\Windows\system32\Afockelf.exe
        666⤵
        
        PID:12828
        
        C:\Windows\SysWOW64\Aadghn32.exe
        
        C:\Windows\system32\Aadghn32.exe
        667⤵
        
        PID:12912
        
        C:\Windows\SysWOW64\Abfdpfaj.exe
        
        C:\Windows\system32\Abfdpfaj.exe
        668⤵
        Drops file in System32 directory
        
        PID:5952
        
        C:\Windows\SysWOW64\Amkhmoap.exe
        
        C:\Windows\system32\Amkhmoap.exe
        669⤵
        
        PID:13052
        
        C:\Windows\SysWOW64\Apjdikqd.exe
        
        C:\Windows\system32\Apjdikqd.exe
        670⤵
        Drops file in System32 directory
        
        PID:13100
        
        C:\Windows\SysWOW64\Abhqefpg.exe
        
        C:\Windows\system32\Abhqefpg.exe
        671⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Ajohfcpj.exe
        
        C:\Windows\system32\Ajohfcpj.exe
        672⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Amnebo32.exe
        
        C:\Windows\system32\Amnebo32.exe
        673⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Aplaoj32.exe
        
        C:\Windows\system32\Aplaoj32.exe
        674⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Abjmkf32.exe
        
        C:\Windows\system32\Abjmkf32.exe
        675⤵
        
        PID:384
        
        C:\Windows\SysWOW64\Aidehpea.exe
        
        C:\Windows\system32\Aidehpea.exe
        676⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Apnndj32.exe
        
        C:\Windows\system32\Apnndj32.exe
        677⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Abmjqe32.exe
        
        C:\Windows\system32\Abmjqe32.exe
        678⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Bmbnnn32.exe
        
        C:\Windows\system32\Bmbnnn32.exe
        679⤵
        
        PID:12432
        
        C:\Windows\SysWOW64\Bdlfjh32.exe
        
        C:\Windows\system32\Bdlfjh32.exe
        680⤵
        Modifies registry class
        
        PID:12468
        
        C:\Windows\SysWOW64\Bjfogbjb.exe
        
        C:\Windows\system32\Bjfogbjb.exe
        681⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        682⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Biklho32.exe
        
        C:\Windows\system32\Biklho32.exe
        683⤵
        Drops file in System32 directory
        
        PID:12692
        
        C:\Windows\SysWOW64\Babcil32.exe
        
        C:\Windows\system32\Babcil32.exe
        684⤵
        Modifies registry class
        
        PID:12716
        
        C:\Windows\SysWOW64\Bdapehop.exe
        
        C:\Windows\system32\Bdapehop.exe
        685⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Bfolacnc.exe
        
        C:\Windows\system32\Bfolacnc.exe
        686⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Binhnomg.exe
        
        C:\Windows\system32\Binhnomg.exe
        687⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Baepolni.exe
        
        C:\Windows\system32\Baepolni.exe
        688⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Bbfmgd32.exe
        
        C:\Windows\system32\Bbfmgd32.exe
        689⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Bfaigclq.exe
        
        C:\Windows\system32\Bfaigclq.exe
        690⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Bipecnkd.exe
        
        C:\Windows\system32\Bipecnkd.exe
        691⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Bagmdllg.exe
        
        C:\Windows\system32\Bagmdllg.exe
        692⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Cajjjk32.exe
        
        C:\Windows\system32\Cajjjk32.exe
        693⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6636
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        694⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Cienon32.exe
        
        C:\Windows\system32\Cienon32.exe
        695⤵
        
        PID:12336
        
        C:\Windows\SysWOW64\Cpogkhnl.exe
        
        C:\Windows\system32\Cpogkhnl.exe
        696⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Cgiohbfi.exe
        
        C:\Windows\system32\Cgiohbfi.exe
        697⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Cdmoafdb.exe
        
        C:\Windows\system32\Cdmoafdb.exe
        698⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Ckggnp32.exe
        
        C:\Windows\system32\Ckggnp32.exe
        699⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Cpcpfg32.exe
        
        C:\Windows\system32\Cpcpfg32.exe
        700⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Cildom32.exe
        
        C:\Windows\system32\Cildom32.exe
        701⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Cacmpj32.exe
        
        C:\Windows\system32\Cacmpj32.exe
        702⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Cpfmlghd.exe
        
        C:\Windows\system32\Cpfmlghd.exe
        703⤵
        Modifies registry class
        
        PID:6468
        
        C:\Windows\SysWOW64\Ccdihbgg.exe
        
        C:\Windows\system32\Ccdihbgg.exe
        704⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5988
        
        C:\Windows\SysWOW64\Dinael32.exe
        
        C:\Windows\system32\Dinael32.exe
        705⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Ddcebe32.exe
        
        C:\Windows\system32\Ddcebe32.exe
        706⤵
        Modifies registry class
        
        PID:4648
        
        C:\Windows\SysWOW64\Diqnjl32.exe
        
        C:\Windows\system32\Diqnjl32.exe
        707⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5972 -s 404
        708⤵
        Program crash
        
        PID:6452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5972 -ip 5972
1⤵
PID:6640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Afbgkl32.exe

Filesize
79KB

MD5
56a33b9577a58ddb656458a2e517b217

SHA1
585e9370f81f03a88ae67d436590126f63a20c21

SHA256
d31ea23226205acbc5a6575f37f19bb9c5cd98c96366d65de49ff9fa862ba403

SHA512
9136df38ac3b68bf6f76993a8d48c0a6e94c76d6ccb5a8ab0a693190b5411dfb95ea86e4a46e04bcc6d49c3fa1189ec97eb86df2df38c16aa5f3b6e87c16dcd6

Download Submit
C:\Windows\SysWOW64\Ajhniccb.exe

Filesize
79KB

MD5
f5c09176ccc51067af387bbd996f7d68

SHA1
ff2f53af63196151ec2019c3cdbc611cf8c818df

SHA256
a33632db8f000489772f9665a81db9d4c4d327f49aa08a5cc4c05cd4a880dfd8

SHA512
d0d11b4330071f95f587682c4f460193e8a781ac5274e00c76057cea1875402bfdcbcbfef92b60f6d28011caccfc87ec4e67210d4bd4d633c4c783cfd4679719

Download Submit
C:\Windows\SysWOW64\Ajjjocap.exe

Filesize
79KB

MD5
aa851b1cce209bbae5f17a35b9a7207a

SHA1
cc020cc575e824f07f345e2f1c8489fe57be8000

SHA256
5cd28ec2c762033cc9d25611a8a38d989b9abc842ae7b36353444a65647cb674

SHA512
41f8c8a303c83c4e9b6dc78cc698ff0e4e63ab7eff21c0ccd49835c23d58579ce07c52486b2697dd1ae2f95870c4f401e041daf6bfe8b212d383b6900b915888

Download Submit
C:\Windows\SysWOW64\Aodfajaj.exe

Filesize
79KB

MD5
da12f3adb818ac1f0c4284ab804f2d07

SHA1
827060cd49a3a2c06d010ba970c002009b7290b0

SHA256
96bf8b4e43ea0998b1edac66fedea8c2d219a600e5d146e9f00965cebcfa2cd0

SHA512
c0de0e49db0e4a1b22f36a006f1be2023959bb7425317ef83b8db3f8751132f326761e7cdb8744df0ef7cde6699cb0e0e170953484c984df05e0f6eefb2bfd4b

Download Submit
C:\Windows\SysWOW64\Bcbohigp.exe

Filesize
79KB

MD5
617191b683b7009e8ee11b6ff6cc0433

SHA1
8a50febab669db3c5e383ba25973adb474c6db6c

SHA256
fe1089945a2436c1ed6fabf4a593c31273999a20bdd01cd0b454dc8db4d300de

SHA512
f689a4db9c503cf11ddf99b15a1d31c2e96803ef2b8dc7cb798f5a08edaa70a96ec6a78a4cf3ecea5dc1170f930c648578e0dec69363ae6bce4a71d166e4a3c5

Download Submit
C:\Windows\SysWOW64\Bfhadc32.exe

Filesize
79KB

MD5
f0ea1f8e206057839a5de743edcfe9e7

SHA1
9e67db6d40079ea4d0cd00858d0c50fa34e81f35

SHA256
d1b9b8dd0e3887e851ac1a27fbd15f684f1ef3265a8bc1908341610da391af17

SHA512
97e7ca58b8c42329c026e5f7730486957b6174ba7e09bb479e6c18404e2310027c7a4be0c910cb2df3e1e0910994ccb9e1b78fad0a15959965ca1de30f13eb40

Download Submit
C:\Windows\SysWOW64\Bfjnjcni.exe

Filesize
79KB

MD5
030b9b027ea3bbf526950d5eaf9c712d

SHA1
9e10118b008b5bc3d1fcda5026c7f1269e38ad63

SHA256
97d296aa41eea0a3d374033da9b08db87ee62a2a94427d07ae3e6150dfcb2efb

SHA512
c757f397e9708d859de65fe6a4dac20bf5f95de5d4d1487dae38414f99b138a3e4ec3008f935ebb4887abb88f8a16d685e92b7ea5baaf26b3babd641f86879fb

Download Submit
C:\Windows\SysWOW64\Bfpdin32.exe

Filesize
79KB

MD5
613071e76827f283d8be06a18da6dc01

SHA1
31d7f46fb05ec66dde195f033b4f7616f207f0d8

SHA256
a0aa70ae8bf1204efbb294451a23cee58603f16d85fb57cd393d17afdcfc3d66

SHA512
1888cb048670999aa4bf68ee5cef23349d8752fbbc39a23ad3dc25ecbc85503b7fe0e5d7a067cdeb687fd215697210a248ec9fab0096411fb43669ebcf512247

Download Submit
C:\Windows\SysWOW64\Bjodjb32.exe

Filesize
79KB

MD5
a3229be41910f0010b8ed1d030e57365

SHA1
dd778cd1111a21d7e30356cd98d356b174808cd1

SHA256
d720b0bfb530f0bcc54aefb78d098523d5ea0b8484735b914e1198ec51696af5

SHA512
fe9b6ae81c9c48475ffeea44a128f83f4493d941393b223ead32262ac69b664298da19ea66dfab5c256d56a830926fbc8b061eaf05e045a6876fd6f530b6644a

Download Submit
C:\Windows\SysWOW64\Bmomlnjk.exe

Filesize
79KB

MD5
884efcc90c2c40cc04bc79bc53cecfb2

SHA1
53669793db69df42f35ba8cc585c5bc6fcdeb81e

SHA256
619bcf3f7a856e2c2711d331c55dd3faa669578c5146a085e2d24ff9314babfd

SHA512
d0dddfe35582237351d91c4b7f697998a154cc452e4a549a7b9c447b122d0202a357e99787103f9ac88432ab995841eed2fccb559518209dd197ff6ffa9438f9

Download Submit
C:\Windows\SysWOW64\Boipmj32.exe

Filesize
79KB

MD5
a80382deef76cd6fb1e170a3027b36d6

SHA1
cff4b64c2de3dd5d0468451573be4293a75b32f8

SHA256
5924c2da0f3604f9d5305742974dee0d1b7f6288f3b6b095a62844037f006933

SHA512
dce4d163e19cc817a6459621aa12e1083ed402398e80aad19bbb3ea0c15603eeb305f75e114160f05e6ec6393cee4cd03718a664546f5abe9beaf225a3ab866d

Download Submit
C:\Windows\SysWOW64\Boklbi32.exe

Filesize
79KB

MD5
3034527cccc510f9183642bd598e16f3

SHA1
e926a4e0a74d4ac24b5e2d3f80ec4d0ac0a02e2d

SHA256
0f803bf5e8be0e0cad2b6a6c5581723f5a9d6768477843b62af4f7116cc584fa

SHA512
3027318c263b57d1115c3c1927876728fc34975e1079b00df8c2a9221eec5e130a3921a27c1fc4ae3f81f52e0b645083a2033dfcdb943fed3bd0345468ed2cd4

Download Submit
C:\Windows\SysWOW64\Bqmeal32.exe

Filesize
79KB

MD5
e065488b9f3166ee313b7d8251f3e8cf

SHA1
064603ce457bc84541966c0058b24da8af93f916

SHA256
f89dc0922abaf83c7ebb038658ca6d83cf27b1796f514f1ab1d5a85da7f428fb

SHA512
5fdf3352e7b194589ab5a1e03505dd7739446b99c66074bd2714bc4c285e17225500e8acc29b84394accaba56b70c765050cb4e61f5907f5dc40ca73e758c714

Download Submit
C:\Windows\SysWOW64\Ccnncgmc.exe

Filesize
79KB

MD5
9c593d34dba23e2eb41a4b1264b4a7ab

SHA1
ee6f6e2f93bb61abf6adf79a05f9f4651dcdf7ce

SHA256
76df5b53eac8bc8adc14ec78d5e3d34f11e6fe5872d817d0bda47349daee15dc

SHA512
63942f45275261010a57d5e741699d88368510f147960674b6a0abc9dab30967f6fdc91a1c2cf9f22eb9cd3ce9cbe5b418f9e61ddb3a0424a5ece9c4d82f1fdb

Download Submit
C:\Windows\SysWOW64\Cibmlmeb.exe

Filesize
79KB

MD5
209ac3d410a6fed46eef6ee6d2b1d3f9

SHA1
96f3d7ed4edd4ca19c4f06052ba4f641c63897a7

SHA256
7fe0a5fe43cec76b743c5c884490f1aa99b0ea1e1d0fe9c95ffa78bd6ce88573

SHA512
a76c0e72803ef0e651b6ba990e3bb817c20df5a13a617ce6dcbb0b418d9692b80540c5491889974c6d702c73d5841b4a788f1dbb361e7b3fa3d7977fa3125292

Download Submit
C:\Windows\SysWOW64\Cippgm32.exe

Filesize
79KB

MD5
6f1f5f0970827e49364200d252414b80

SHA1
c98207de383443f0bd55c8d6943a8817a73ed97d

SHA256
e4068e83d04d5d2741bc856b224eb1fcbd25370bf8cb3c111010652fd97d5af6

SHA512
52ba609e2832fe423f76800ca6c1b546b2cd9adbd9c1d10c66ae7829288dab9237de9b6a24fe76ae894e2a54e7391ccb0638476e842bf3a326a83c431ee74208

Download Submit
C:\Windows\SysWOW64\Cjaifp32.exe

Filesize
79KB

MD5
65aa1383b9de5b9d97035356a4355895

SHA1
cfe0c9439bdb855fdfb7dc6203140e75493456e6

SHA256
f8e1e3198d26626c92a7714f707ab00bb100e6db400ef9bf7eb0cd663e277157

SHA512
625dc002cc8b760659edbb334112676484f3be91d705639a82d381f1aa587984daafc7d999c4e0a4e338fc479a32ffe061b4eaf1ceb8e5f17dede6f13fe61082

Download Submit
C:\Windows\SysWOW64\Cmdfgm32.exe

Filesize
79KB

MD5
26bac4c77e41a549b78f4010f6752e64

SHA1
fdbc28cd233ee142a455c0fcc52dc96ae35da068

SHA256
8941acd3f813b2c4a99e6c7e0a3c61efb77aadbae077a14c5e8f1409295eec7f

SHA512
7840625e039a1bd5f6eb995f9fffb0a4ad2c3bf849bf9d39d5adaa490594db8ec71a679171ef34eb65954342891ecb2abc83348acf01483e4ab7ad1283194fd0

Download Submit
C:\Windows\SysWOW64\Cmipblaq.exe

Filesize
79KB

MD5
a516c75dcef0260c16c2cfdc294b10a6

SHA1
8fb3c2e849cce674a77ebe59f811610999d84cad

SHA256
ab3d19c76e3613e83ceecf9dce53d43d3f45319e0033a85d861ed160417bbd12

SHA512
986c0eb74e21012c1a21ecb81192fbdeb0a8bd16e9741778b7a38cef9c80bf85974c2213e56ac44914423e14c2eab713423c3cdd181d201ec584402d8146507c

Download Submit
C:\Windows\SysWOW64\Cpeohh32.exe

Filesize
79KB

MD5
c4ba27ed9942b97df4eae2263a334c12

SHA1
53591f134675272f98467594a7e3cbdbf9d99787

SHA256
a1a539b21d14333d59cf1105121780a1232c1de65e07a0e3654a867e8617bdcc

SHA512
d8b2d335bac2fdd0cbf302db1a9fde539db8897b3e9c07e7d9344fecda4022fe1f3de8f6717dcd345c93f1d8618ce1f4779e05ad07ddcded732dbf30bd488046

Download Submit
C:\Windows\SysWOW64\Dannij32.exe

Filesize
79KB

MD5
fd5a5339e0b18e46428905006b26d6f0

SHA1
8c3e5071755a3a7e7f6a388921d02fe12f40b731

SHA256
c5f5a8e2fb22eda800d9366a2de93ebc5fe374a8fe0ce19970f26b43cc5b6f0b

SHA512
0c7f5a059debb5c33c9fff4b003df6bbce1e9f762fee410565fd7fc29e12aed4c7d7082caef1555d87658b7d52321ca50a13fd44891860ae39c48296e81edce6

Download Submit
C:\Windows\SysWOW64\Ddgplado.exe

Filesize
79KB

MD5
24b5106712fc77adfcd24318bb81dd39

SHA1
70362b5c5fa1f6964224a622e37db0dff905bffe

SHA256
ec8bc4fb8c53ba9cf140312e40d7fb1fe10c2f8abbfa89b2def01308e6551262

SHA512
cc53b8025e64a3edbb13c6ae5b3134e6a710be4643d6df116066810144697f563a9efa8549abb87022e99b7d79e2696663c637ff6cd95b648066dac84c24d7d3

Download Submit
C:\Windows\SysWOW64\Dfjgaq32.exe

Filesize
79KB

MD5
b1ec6e7d1b6da6d03cf9eb887753f92e

SHA1
7511cef47b5177174d50332867d52ab7d5211ccb

SHA256
1661df87cfa72f1431c635148ae64a19ee53078f13532584f23c29f0a175b8fb

SHA512
7febf9d8d783dc6979094e022956cccf9b481a692cd8bb84c75123f47e51b29523959cf5f94abe1842f767c5e73380bfde68c4b8e082ee869d7836de734b7ae0

Download Submit
C:\Windows\SysWOW64\Dhomfc32.exe

Filesize
79KB

MD5
053442aa84c4a49f3523c60a55c7e7f6

SHA1
266dd8465896053f1cea3d51d7ad2af3c8a54d0c

SHA256
b86441ddb900a26eb6b22a3a6802a158ab1d2bb76b88d86c884ae156eff13379

SHA512
2704ffe0e69e738ca2263b31bb8cd22cf38bee80254a4fd8f26d75161c00ad6c65c94af1b4bfb7bf1330624369cbf6dbfed1b347342c32ebbca071c1ab38640e

Download Submit
C:\Windows\SysWOW64\Djhimica.exe

Filesize
79KB

MD5
21d268355e9a0d7969a04c3e50fb990b

SHA1
b4a90ab9430db593dfbb53b29987664e36472451

SHA256
48939823fddff46eba46b3f7d2a605ca6b93b8394f134059d5d396a7e21537a3

SHA512
86ef59641f6a430aea849e145dc4b35b192fde12de72725499a5c193d305191ee498fa637a1f50d3f8c80ff2e80a75ebee6805f92edde6bd51cc6b394a19baa0

Download Submit
C:\Windows\SysWOW64\Dnonkq32.exe

Filesize
79KB

MD5
0a6c9e29e57b1c17dbe9fbb235651d11

SHA1
63fa7d9cdb33f1663fddc32f38d1fe541cf430a4

SHA256
dc1ac92656ccbaeb9332bb21ac7f3ad3924f0f063a83b4eca7e19d0d46626ccb

SHA512
dc31df01be2c2136343d52d1c644c84b2b9d35509abca340ee9eddb0e50f6bbadd3df6372a18d5242e3539ea9fac4e9cfdbfd87a2b79fcac320274a741e732b1

Download Submit
C:\Windows\SysWOW64\Dpckjfgg.exe

Filesize
79KB

MD5
9f6ccffb695320c125726438e73d424f

SHA1
e51aee32fdee8ede4c5d56c290cc8a8c262da2c2

SHA256
03db6596c0182be1c4bffc9643fedb3dd2b612251c490e1956532318f9c2a8a2

SHA512
87e8da1c4a460cdfdbb2530c0847ca5db10568582bcd8d7c16ebf8496ccc012b24e8cef4044fa586ea22b17457a4fcb4e5c8067f58a717eaa1dc7ae8d694aceb

Download Submit
C:\Windows\SysWOW64\Dpehof32.exe

Filesize
79KB

MD5
9d9ea1ae855347a2faf27bbcbc4bd46f

SHA1
06d0359232fd2cd3e71b263af4002f9aa52be4c2

SHA256
4280edebc3734b8fe2ed295e6766996189cc5604055ff4bb5651e7a08fd718f5

SHA512
098b44a226b5361fdf414cbdd9ecd2880e313eaf1c6169c1e81cdfad6d5aeb03194248d01ec053641dca0d09576271db278d774b5285b9e41c473390826d85c1

Download Submit
C:\Windows\SysWOW64\Dpnbog32.exe

Filesize
79KB

MD5
93b4823a16b217a4cb7ba4f242d11b73

SHA1
9aa82e9d71e1efdfad0deb947684e8c59713d00e

SHA256
592bc46a43542222ac1c7b8b4b25d67bc8f18c9d07518b4e6aabd126073753fc

SHA512
b710fc02697be4baacf41ba47e9fa6b5e707f33f55e6559ad2ebe7a5f57b28de45a8d098b09b33011cf9de6a22bac0d0ac54c1071ca4a22440fd545f439ebada

Download Submit
C:\Windows\SysWOW64\Edmclccp.exe

Filesize
79KB

MD5
ac28ff78af24e897a782299399e625ca

SHA1
39aab097dc20b9562ea51be21cfb4b6e6f63ddb0

SHA256
00df14320d40ce7190edfc1fff001c833bfad1b67350643d3e9a9cfe56944a5d

SHA512
6df09314dffb02b72a5f1a061a06906390c68de6028a891ecb730ced74c05ef6018e9b22dd5cd7e67e6e1823d878f741b3c14db64e5d8de562a4116ee457d925

Download Submit
C:\Windows\SysWOW64\Efmmmn32.exe

Filesize
79KB

MD5
99c4076c56b9d7963606bd921db6a04a

SHA1
124d5aa7371084493138b8240f428763460dc29d

SHA256
e652451bd7449bbd2b740e51d186fe1e0bef6adc86104b21f8312b6f65397d6c

SHA512
5722e4ba0a4a0d69a1a05f24316273f328c76ac61c370c3b876c4998acef283ad9cf3d3a7cbdca900a5eaca8f9b0beb3ee67813879f2da7c5865e95e744f94fd

Download Submit
C:\Windows\SysWOW64\Efpomccg.exe

Filesize
79KB

MD5
efe70a3653bd8e426f95aa44ef6edf69

SHA1
1cb58e551f307ab5b46bbe0daa8bd650222eda9a

SHA256
ce80f15ba25a7ee40c3b44d0fe9834852ef416a5c0ad001a90b02dd5cb192b13

SHA512
6b759b342b7fc52587b4ee25bf23bc4f329db3733b80631a5a0e1a179e5e2c9c43da1132dd1a31e2a88586151d9d51716ddbcdf42e1aec8b0c81eb06da03fbed

Download Submit
C:\Windows\SysWOW64\Ehailbaa.exe

Filesize
79KB

MD5
7fbf0c8c8eb5f39f3ba5cef08281fab6

SHA1
b1db4bdbbf1eb21f2a550999522fc59e5b79a044

SHA256
ba81d7940f8f39849c8701b75b5e774c09b3ab6070e123770daa2c962022c1b0

SHA512
5544d61f4e2a58dc86b6cd54abb9a9e42960645b82e8e039cd6a07f9df9fdcd29da0f5519925e5027f5a3a6ca3168744f9a5dbaa0c4dba99b5cf94e3adf4a3c5

Download Submit
C:\Windows\SysWOW64\Ehcfaboo.exe

Filesize
79KB

MD5
07cea76dab26e89c01fb5dd7715d0238

SHA1
a33d6dca9307fa46719408ab77f31b2d31940500

SHA256
e239b17c151b42fbb7235476a6fbf143ec4f21d8af35e83d0963980fa15a378a

SHA512
2c708580ce4b2232543cc3a7b869d94f7bb22130e244204b85866d20d1e14e9ace665bfa462f35bed16e8440438c0dae61f9373584171815c2c5bc36aa3aaf93

Download Submit
C:\Windows\SysWOW64\Ehfcfb32.exe

Filesize
79KB

MD5
9a9d5f7eb5a33e89a47df791f0a9ee40

SHA1
c766a2389f8806ce78098e639bef2c757ad22490

SHA256
0ef9b53f37f941b19e98b1c36174438bcec8cd2956d45c50f7a75a8aa7bab279

SHA512
30d7827fce5eee9e69f2d73cf94252ec9a2ab151c09c832a92a258df9c78a8f814812a4045ad15d740773bd884ad3264d9efe18a4a00b6aea8905fb09efcb241

Download Submit
C:\Windows\SysWOW64\Eiildjag.exe

Filesize
79KB

MD5
c2d8955c970eb93cb08cb535fd89d33d

SHA1
3cc5e9f3b15664df28ec12ea881928ec87c6fa9e

SHA256
ff0b55c26a8596ab508542321dbe8bdc5b14b16066c8c4bbe6c7657dd6e9dba8

SHA512
75e18dbb930aeaa86ed2fb15357491c1fc6ae53895ba1b99081d57426993b053ed80d9fc910cda96d9fe218e73c35a30b0e49db2d10134c06069cfa7f10082ab

Download Submit
C:\Windows\SysWOW64\Eipinkib.exe

Filesize
79KB

MD5
a8b5c9ca69b88a84fb584b38cddee9e0

SHA1
24d5e59c2de95766ddd1383d8e27ec441f1af458

SHA256
2a9da989ca9f5249acd01c7d4a6ebfc6145f6bb085fe937df66e8cbac54bb30e

SHA512
8d6d29e08adfbb1ddfa9e2114ad34176f5bce17219f2882ccabefd534e666b7fe3aa561e319af246558b723b7147d497fb35b9b159b26a871a1927b111d1c69d

Download Submit
C:\Windows\SysWOW64\Fbfcmhpg.exe

Filesize
79KB

MD5
dbadbcdd38a6ee09cf10d63732491608

SHA1
eca766b33c4375a9b87e6427cbf4264029d94d60

SHA256
ce1d8ee8dc3e9a1184d338620a5a69e5ff2fde2095f8b9c8b3d751ae0063b857

SHA512
95ed876ad1f9c3e2138674c3a0639974265a50ed3e470ce4409447111cde2a17f23be0b5a50b25535994b6feae6f6ce21b383876ee35f56d046c7f4c89ef0a43

Download Submit
C:\Windows\SysWOW64\Fhmigagd.exe

Filesize
79KB

MD5
2ebe39d4a998fd648aa9d6b93e4ec792

SHA1
935fa5d7c0c56db967fc7c03b298398eb2e9e41c

SHA256
cb3e9853c8f561b1b65c152ddcbe7158a384db6ebdb2b458c692b2b9dbdae75a

SHA512
bfe946add2032af90c9aa227948297ad2a11d7db4414584a765dd13b7f1e13cfe8687957ce6d3df8b048d2eaf0f5635fa426e718a3bfe8371d30bf691dec8d98

Download Submit
C:\Windows\SysWOW64\Flngfn32.exe

Filesize
79KB

MD5
581710880492c729ad28c345680ff79b

SHA1
5ee704bf4e65116db114c801450360aa1a3647cf

SHA256
1242764fc098f9a9a92ab930ed19e74847b182d32233bed611faed74f04a2faf

SHA512
65fbfc550443bf8327e263ba2945fe49428497b76f34c78a444db2f43b78be2c312d4e99081e34e882d7960f15c8622c2b5ae7e10262b3fa909228b60c091ab1

Download Submit
C:\Windows\SysWOW64\Gmeakf32.exe

Filesize
79KB

MD5
6570d8dcdaefdbdbb3b70e347c174eaa

SHA1
14b843f435efe996565eb92b739eace75be070dc

SHA256
18458dca8d925a8102a7d38bf51018102f9a9b85b85ecea0eef4c85814bda699

SHA512
a41cf2f7abf9b7d7655abf916a6405996e0a3a70d1d2f141ac902bb15238e5936998e4b03e0a46ab32730466ae5c8aa4068e21f3ab90a3aadd54160685337f5f

Download Submit
C:\Windows\SysWOW64\Hdmoohbo.exe

Filesize
79KB

MD5
f971499e5000c33e6d8dbbe25a41e1f2

SHA1
51282e7d61b4b5ba348e2946c5bdb940f1904175

SHA256
2dfd7c2f3d1776bd24246270ba6291e1f2873dd93bb6ac457059a7b7fcb27bcd

SHA512
7e7d69880129d77f10324b0cfac86f1971a9d945ba27a3c7ef95c523691e18d48128f8d438af1386fae4866592b2bab2ad90434072ef34e519cd2883d484d076

Download Submit
C:\Windows\SysWOW64\Hncmmd32.exe

Filesize
79KB

MD5
4d778b53b8952106f9b6b50a6f7db4c3

SHA1
03cbb4329d222d757c970817162edbf05a09b81e

SHA256
292588f796fb54f4193801bfb0f71f0cdc30b9c570d78b2e5d11da05c3a32138

SHA512
8c95c48f598acf3da3af21be718d5cbe153fd1f8ed7fa763f07249406a20b3a36f731383bab1197c4bd96f815ce6730c08e6cd0efcad0a2d6206d069187e65ac

Download Submit
C:\Windows\SysWOW64\Hpqldc32.exe

Filesize
79KB

MD5
fb82a74d93f9abbb50222abb2695659b

SHA1
2a5cd392b4bb1ed5aa984eb07ee049bf864da37a

SHA256
a870b69a5d2588af69be3537d2335d95419c77f60554e45be66b5ac2d27b8a99

SHA512
4acaa6c31e5c5c240e0e97a2c7dafb73759ac82f303914c97509bd7b157b538f601ebeb4dffeca14b347f03872ed706ec21af4989b8befe5b276bb1fa7aec71f

Download Submit
C:\Windows\SysWOW64\Jiglnf32.exe

Filesize
79KB

MD5
e3bd98b8c9818100cc9bb0af324e81ee

SHA1
83aca8f532f2c9453bcafa24a614549448f5237c

SHA256
04b27db003868cd4e443d24fd81263ed89b0c580a4766d1f2170af69e01f66ea

SHA512
c0974c5cda64da3a1fd4f8135650f660d7fcf66fcbbc3fd3a2e94b20636a24ff42ce81810b5159ed947a4282aea42d92c6e72d9a786bd91caa0301153ae78deb

Download Submit
C:\Windows\SysWOW64\Kcapicdj.exe

Filesize
79KB

MD5
7e1b7c246d1262748dbdf530fef0469c

SHA1
cf6c913039ff1b6acccdb1e61819cce7f0a3e56f

SHA256
a2aebf011338e495b0054596d998b4d4f29ed8fda9f8dd64ebecfa934644b1e5

SHA512
b8912627ccfb1252f25adf20f5b372e636d3938fd16deb5a805db6b9c52d6c7335413079d5bc0bbb713652a95b5484a611978705b3cee7b4b6e0d2a284453756

Download Submit
C:\Windows\SysWOW64\Kjgeedch.exe

Filesize
79KB

MD5
027e85afae4e55ce350b054716826abe

SHA1
90d86dc0d228d291bbeb2097938317d8f42ed524

SHA256
aeccb14a9d3f6dc71f062dc02828c543f4b73eaa3b1ce0ef449c02442aaa3db1

SHA512
4d4a927321545c845e0e48cee0205f41b62d329b6cc6a79e8d14552fd20a7e1ee4a02d6069b1fb9f7a168f5827c6b0e6451f92b8cc4900e55b39f398f4f5a515

Download Submit
C:\Windows\SysWOW64\Knhakh32.exe

Filesize
79KB

MD5
1360c539e3701f57f57f363357d6c1d4

SHA1
7187053ce3744631ea4e20b75eccc3ef39cdf00a

SHA256
eaeaf7737a84f0154995ae7000fcbbc7e1328908e493e3572fab83cfb3c89c3f

SHA512
26abddcafe476e88d5956f9c539b6ea3aa169dec504acafbae3cf8bb5d3f4f24b1dfb7ca62799ab56b065cf314fb436cc8b43781495f43e1a00cb04089a54fa8

Download Submit
C:\Windows\SysWOW64\Mgbefe32.exe

Filesize
79KB

MD5
4108b3df3759191569bbce5ec77e6e2e

SHA1
dc3cd6080ba887186d7e757ba5fd5deb18633fc9

SHA256
fb5c0b53abf21f8100c8512550adf1532aa6ec9280478b3bd7dfeed08815a31d

SHA512
a191c169d46e66d5fa5f1461c5dac8dfcabf9c76b4fc3a6eefb1454c29e1f4b71f6ff56b4b3bd3330aca189a4df4a148aff95d4ebcf2d164c4b5096b442c5624

Download Submit
C:\Windows\SysWOW64\Ngndaccj.exe

Filesize
79KB

MD5
4eb36b713b7e23d6b6a29118ba59ae8b

SHA1
1a3575b5ebdb909c403c0855542ed367ed8687eb

SHA256
653b3a483baaec10e583cd404064fcc7bf5b50481dcc6ac1dcedb13c232586a5

SHA512
5d73969b3ee50cd951604ada79ee75c6508a186e5b98c1cd1d403d06699ea59beab8f55d14eef60904ee093c309365bbcb5dd8a67f5677ccc8421ddb42f73501

Download Submit
C:\Windows\SysWOW64\Ohmhmh32.exe

Filesize
79KB

MD5
0487329305f12d572d0f5c433aea05ef

SHA1
cd691f64150d05c72a4dcbfd2ee2ea9d15192262

SHA256
fb8c507a38d54eec50ae49263679b329f88e002eb8eff531d10f0f150a929532

SHA512
602c17eb31c99e98ac472e3df8c6c7db8cdfe00322a5fb907d78dbced03d33b93f1167ae1ad0db74942376f840ff55d7807c3fd3e2f28bea5436d19722308b51

Download Submit
C:\Windows\SysWOW64\Opnbae32.exe

Filesize
79KB

MD5
fe00181aea0bc13f0bfb5fbcf92e516b

SHA1
6b74f281e849dd7b774f0627527c0583e616945d

SHA256
b81ae09f6f0dd8ab99114bcd7bdff6ff6c9d7da75bb7ac4fe9ddfcd8cb318c85

SHA512
f3b0e6d41fce4896c8b91ef360dc1b7e44d8c1b794fdbb18c7f08b073068d296eb0ee5758f4403400af3100a6c0eee3274ccceb1d37855721a577e635a1356b2

Download Submit
C:\Windows\SysWOW64\Pamiaboj.exe

Filesize
79KB

MD5
f7254788ca29c349cffc5798d56bd6d7

SHA1
a40c06bd1bd1a843adaecd0c0134f5105eba6ba5

SHA256
dcc5a8b678b490b25ffba075c65a075fa5ac09edc2d3115d18fa6e009ed37444

SHA512
4899f17ec6626c75685f31a97e82e7fb80b667d66bf956efe5ba70019874de090f93b6ace0a6fef743fc637ab2410d01368f8f56cf6e1b2f36d79c0be7d8fa33

Download Submit
memory/116-324-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/224-348-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/228-354-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/456-170-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/620-312-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/752-282-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1008-17-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1080-107-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1092-64-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1156-9-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1228-408-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1404-1-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1404-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1404-81-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1428-25-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1476-32-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1536-402-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1548-270-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1572-226-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1736-217-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1820-276-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1852-432-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1896-300-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2012-294-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2172-342-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2244-363-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2544-145-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2552-318-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2608-49-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2748-178-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2920-336-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3064-420-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3144-414-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3176-330-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3272-113-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3364-396-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3416-99-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3472-138-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3496-129-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3700-372-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3896-306-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3936-198-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3940-241-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4036-366-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4048-153-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4112-390-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4120-249-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4160-384-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4456-162-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4540-202-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4588-185-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4616-122-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4624-234-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4632-382-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4676-56-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4716-73-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4720-288-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4752-264-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4756-209-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4872-426-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4936-41-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5004-90-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5060-258-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5112-86-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads