f3f3cf52b14f8af02165bff93d5e2c6eb5641fc37ca2bb936c0e322f9bb01dd5

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2024 22:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3f3cf52b14f8af02165bff93d5e2c6eb5641fc37ca2bb936c0e322f9bb01dd5.exe
Size

256KB
MD5

148c7fc65261e3d3103353d3f363c1e3
SHA1

853408d35e5a57c304635090d30913b9746140ff
SHA256

f3f3cf52b14f8af02165bff93d5e2c6eb5641fc37ca2bb936c0e322f9bb01dd5
SHA512

d19e5ab825bf7f5acaa89369d5abbe18e36411f582a6a7959d695cdd416ba65094ebee1acbbae2a7199f4262c9230319bf75191a3c0a5ff95955f80e70b0e5be
SSDEEP

6144:BBrITpYDfhAkgTLp103ETiZ0moGP/2dga1mcywM:BeTK7afpScXwuR1mKM

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kanidd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Embdofop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Piapkbeg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Haidfpki.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjgkab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmddihfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qnpgdmjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Obhlkjaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eciilj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Imgbdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehbnigjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fofilp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lhcali32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gokmfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nofefp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hghfnioq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jmopmalc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ocnabm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmidnm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kdmlkfjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cmdhnhkp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qibfdkgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pdmdnadc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fnbcgn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gnpphljo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Calbnnkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkjbgooi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eennefib.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngnppfgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pahpee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iofpnhmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aifpoj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncmhko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pfncia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Icklhnop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjabdo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cgbfka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Abodhpic.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ieagmcmq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Apggckbf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecbeip32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kjbdbjbi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocnabm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkpjdo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Janpnfee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mmokpglb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Blqlgdhi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnaaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cehdib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kmaooihb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lnkgbibj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hldiinke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihbponja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Abmjqe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qhekaejj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lajmmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fjjjgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pcbdcf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pgoigcip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ggafgo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnpbgajc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dcnqkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Amgekh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bfjllnnm.exe

Executes dropped EXE 64 IoCs

pid	Process
1252	Mgloefco.exe
3572	Mcelpggq.exe
1400	Mnmmboed.exe
2364	Mfhbga32.exe
2152	Njhgbp32.exe
3452	Nglhld32.exe
4440	Ncchae32.exe
1516	Nagiji32.exe
664	Ocgbld32.exe
3052	Ompfej32.exe
3796	Opqofe32.exe
3244	Ojfcdnjc.exe
4016	Opeiadfg.exe
4364	Pmiikh32.exe
4752	Pnifekmd.exe
1132	Paiogf32.exe
2376	Pdjgha32.exe
3256	Pdmdnadc.exe
4000	Qmgelf32.exe
3348	Aphnnafb.exe
4808	Amlogfel.exe
4392	Aokkahlo.exe
4004	Ahdpjn32.exe
4056	Agimkk32.exe
824	Bdmmeo32.exe
3648	Bmhocd32.exe
3800	Bgpcliao.exe
4580	Bddcenpi.exe
3760	Bkphhgfc.exe
3400	Chdialdl.exe
2756	Cnaaib32.exe
4464	Cglbhhga.exe
748	Ckjknfnh.exe
1128	Chnlgjlb.exe
4720	Dkndie32.exe
4248	Dpkmal32.exe
1772	Dakikoom.exe
2128	Doojec32.exe
1104	Ddkbmj32.exe
1408	Doagjc32.exe
892	Ddnobj32.exe
2108	Ebaplnie.exe
4320	Egohdegl.exe
1636	Ehndnh32.exe
5164	Ebfign32.exe
5208	Ehpadhll.exe
5248	Ehbnigjj.exe
5292	Edionhpn.exe
5332	Fnbcgn32.exe
5372	Fgjhpcmo.exe
5412	Fqbliicp.exe
5452	Fkhpfbce.exe
5492	Fofilp32.exe
5532	Fkmjaa32.exe
5572	Gokbgpeg.exe
5608	Gnpphljo.exe
5656	Gnblnlhl.exe
5696	Gihpkd32.exe
5736	Geoapenf.exe
5772	Gngeik32.exe
5816	Gaebef32.exe
5860	Hnibokbd.exe
5900	Hlmchoan.exe
5940	Hlppno32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Gqagkjne.exe	Gjhonp32.exe
File opened for modification	C:\Windows\SysWOW64\Ihgnfnjl.exe	Hakidd32.exe
File opened for modification	C:\Windows\SysWOW64\Hbiapb32.exe	Hgcmbj32.exe
File created	C:\Windows\SysWOW64\Hoffjidl.dll	Gjebiq32.exe
File opened for modification	C:\Windows\SysWOW64\Niblafgi.exe	Nbefolao.exe
File created	C:\Windows\SysWOW64\Kdlmhj32.dll	Lahbei32.exe
File opened for modification	C:\Windows\SysWOW64\Cfjeckpj.exe	Cleqfb32.exe
File created	C:\Windows\SysWOW64\Nkpijfgf.exe	Mknlef32.exe
File opened for modification	C:\Windows\SysWOW64\Mablfnne.exe	Mledmg32.exe
File created	C:\Windows\SysWOW64\Okailj32.exe	Obidcdfo.exe
File created	C:\Windows\SysWOW64\Oknnanhj.exe	Nhhldc32.exe
File created	C:\Windows\SysWOW64\Nfcpipdb.dll	Lkcaeige.exe
File created	C:\Windows\SysWOW64\Dgpeha32.exe	Cacmpj32.exe
File opened for modification	C:\Windows\SysWOW64\Hjmodffo.exe	Gbbkocid.exe
File created	C:\Windows\SysWOW64\Bdelednc.dll	Hannao32.exe
File created	C:\Windows\SysWOW64\Hgpchp32.dll	Hghfnioq.exe
File opened for modification	C:\Windows\SysWOW64\Noqofdlj.exe	Namnmp32.exe
File created	C:\Windows\SysWOW64\Mnmmboed.exe	Mcelpggq.exe
File opened for modification	C:\Windows\SysWOW64\Likhem32.exe	Kcoccc32.exe
File created	C:\Windows\SysWOW64\Dgpamjnb.dll	Geoapenf.exe
File opened for modification	C:\Windows\SysWOW64\Bmhibi32.exe	Blflmj32.exe
File created	C:\Windows\SysWOW64\Obhmcdfq.dll	Dnqcfjae.exe
File created	C:\Windows\SysWOW64\Pnkehf32.dll	Dhpdkm32.exe
File created	C:\Windows\SysWOW64\Nnfcfl32.dll	Bdkghg32.exe
File created	C:\Windows\SysWOW64\Cagaaleo.dll	Nppfnige.exe
File created	C:\Windows\SysWOW64\Icklacqn.dll	Belemd32.exe
File created	C:\Windows\SysWOW64\Imdjadgk.dll	Dgliapic.exe
File created	C:\Windows\SysWOW64\Fgjhpcmo.exe	Fnbcgn32.exe
File created	C:\Windows\SysWOW64\Joekag32.exe	Jhkbdmbg.exe
File opened for modification	C:\Windows\SysWOW64\Jfkhfmdm.exe	Janpnfee.exe
File created	C:\Windows\SysWOW64\Nppfnige.exe	Nblfee32.exe
File created	C:\Windows\SysWOW64\Fbjbac32.dll	Ejojljqa.exe
File created	C:\Windows\SysWOW64\Dejfbl32.dll	Gqagkjne.exe
File created	C:\Windows\SysWOW64\Onempd32.dll	Lfpkhjae.exe
File created	C:\Windows\SysWOW64\Ogqmee32.exe	Ngnppfgb.exe
File created	C:\Windows\SysWOW64\Eblgon32.exe	Dbdano32.exe
File created	C:\Windows\SysWOW64\Bdhkchlg.exe	Bdfnmhnj.exe
File created	C:\Windows\SysWOW64\Iadhpj32.dll	Hjkigojc.exe
File opened for modification	C:\Windows\SysWOW64\Ebfign32.exe	Ehndnh32.exe
File opened for modification	C:\Windows\SysWOW64\Hgnlmdcp.exe	Hmhhpkcj.exe
File opened for modification	C:\Windows\SysWOW64\Mfhbga32.exe	Mnmmboed.exe
File opened for modification	C:\Windows\SysWOW64\Fnbcgn32.exe	Edionhpn.exe
File opened for modification	C:\Windows\SysWOW64\Hjdedepg.exe	Hegmlnbp.exe
File created	C:\Windows\SysWOW64\Dojlhg32.exe	Dhpdkm32.exe
File created	C:\Windows\SysWOW64\Qkqdnkge.exe	Pahpee32.exe
File created	C:\Windows\SysWOW64\Qibfdkgh.exe	Pikqcl32.exe
File created	C:\Windows\SysWOW64\Nffaen32.dll	Pimfpc32.exe
File created	C:\Windows\SysWOW64\Apjdikqd.exe	Amkhmoap.exe
File created	C:\Windows\SysWOW64\Ohqpjo32.exe	Oohkai32.exe
File created	C:\Windows\SysWOW64\Glagpmgi.dll	Mkadam32.exe
File created	C:\Windows\SysWOW64\Aohcbiop.dll	Knenffqf.exe
File created	C:\Windows\SysWOW64\Mqimdomb.exe	Loecgfjf.exe
File created	C:\Windows\SysWOW64\Klekfinp.exe	Jimldogg.exe
File opened for modification	C:\Windows\SysWOW64\Lagepl32.exe	Lccdghmc.exe
File created	C:\Windows\SysWOW64\Ahinbo32.exe	Qhddgofo.exe
File created	C:\Windows\SysWOW64\Bdkghg32.exe	Bdhkchlg.exe
File opened for modification	C:\Windows\SysWOW64\Belemd32.exe	Bghddp32.exe
File opened for modification	C:\Windows\SysWOW64\Joekag32.exe	Jhkbdmbg.exe
File created	C:\Windows\SysWOW64\Fkcpql32.exe	Enopghee.exe
File opened for modification	C:\Windows\SysWOW64\Hjolie32.exe	Hcedmkmp.exe
File opened for modification	C:\Windows\SysWOW64\Kiomnk32.exe	Kmhlijpm.exe
File created	C:\Windows\SysWOW64\Ibgfkq32.dll	Llpofd32.exe
File opened for modification	C:\Windows\SysWOW64\Emikpeig.exe	Ecafgo32.exe
File created	C:\Windows\SysWOW64\Aijlgkjq.exe	Abpcja32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10364	11084	WerFault.exe	746

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bnphag32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cglbhhga.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Piaiqlak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eblgon32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oecego32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Edfknb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efhodebp.dll"	Mlbpma32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fjcjpb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfjddb32.dll"	Hfmqapcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pmkofa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Opkfjgmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pfbmge32.dll"	Lagepl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqqkagjo.dll"	Nbefolao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ojfcdnjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kfidgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oddmoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cfjnhe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cajjjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plbeef32.dll"	Fmbnfcam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gmimll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eekcho32.dll"	Jhocgqjj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gngeik32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hfnpca32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mehafq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Odhppclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ehpadhll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jmopmalc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Khjeei32.dll"	Gojgkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nfllgl32.dll"	Cnlhme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lhqefjpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Khdoqefq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lhbkac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnjhjpin.dll"	Kanbjn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icelfhmg.dll"	Jgdphm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kkgdhp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lfpkhjae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Googaaej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fplimi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jfkhfmdm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lndfchdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Eemgkpef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjeonlkj.dll"	Blqlgdhi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qifbll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dkedonpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Blobgill.dll"	Lpelqj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Liellh32.dll"	Glkdejcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cpmifkgd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bdkghg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hnblmnfa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cmgjee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iifmbajf.dll"	Llmbqdfb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dgliapic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imdjadgk.dll"	Dgliapic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imffkelf.dll"	Egohdegl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nfnamjhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bgdemb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Flghognq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kebodc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qhddgofo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bddcenpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Djalnkbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlhkja32.dll"	Debnjgcp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Embdofop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ihdjfhhc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 1252	1504	f3f3cf52b14f8af02165bff93d5e2c6eb5641fc37ca2bb936c0e322f9bb01dd5.exe	96
PID 1504 wrote to memory of 1252	1504	f3f3cf52b14f8af02165bff93d5e2c6eb5641fc37ca2bb936c0e322f9bb01dd5.exe	96
PID 1504 wrote to memory of 1252	1504	f3f3cf52b14f8af02165bff93d5e2c6eb5641fc37ca2bb936c0e322f9bb01dd5.exe	96
PID 1252 wrote to memory of 3572	1252	Mgloefco.exe	97
PID 1252 wrote to memory of 3572	1252	Mgloefco.exe	97
PID 1252 wrote to memory of 3572	1252	Mgloefco.exe	97
PID 3572 wrote to memory of 1400	3572	Mcelpggq.exe	98
PID 3572 wrote to memory of 1400	3572	Mcelpggq.exe	98
PID 3572 wrote to memory of 1400	3572	Mcelpggq.exe	98
PID 1400 wrote to memory of 2364	1400	Mnmmboed.exe	99
PID 1400 wrote to memory of 2364	1400	Mnmmboed.exe	99
PID 1400 wrote to memory of 2364	1400	Mnmmboed.exe	99
PID 2364 wrote to memory of 2152	2364	Mfhbga32.exe	100
PID 2364 wrote to memory of 2152	2364	Mfhbga32.exe	100
PID 2364 wrote to memory of 2152	2364	Mfhbga32.exe	100
PID 2152 wrote to memory of 3452	2152	Njhgbp32.exe	101
PID 2152 wrote to memory of 3452	2152	Njhgbp32.exe	101
PID 2152 wrote to memory of 3452	2152	Njhgbp32.exe	101
PID 3452 wrote to memory of 4440	3452	Nglhld32.exe	102
PID 3452 wrote to memory of 4440	3452	Nglhld32.exe	102
PID 3452 wrote to memory of 4440	3452	Nglhld32.exe	102
PID 4440 wrote to memory of 1516	4440	Ncchae32.exe	104
PID 4440 wrote to memory of 1516	4440	Ncchae32.exe	104
PID 4440 wrote to memory of 1516	4440	Ncchae32.exe	104
PID 1516 wrote to memory of 664	1516	Nagiji32.exe	106
PID 1516 wrote to memory of 664	1516	Nagiji32.exe	106
PID 1516 wrote to memory of 664	1516	Nagiji32.exe	106
PID 664 wrote to memory of 3052	664	Ocgbld32.exe	107
PID 664 wrote to memory of 3052	664	Ocgbld32.exe	107
PID 664 wrote to memory of 3052	664	Ocgbld32.exe	107
PID 3052 wrote to memory of 3796	3052	Ompfej32.exe	108
PID 3052 wrote to memory of 3796	3052	Ompfej32.exe	108
PID 3052 wrote to memory of 3796	3052	Ompfej32.exe	108
PID 3796 wrote to memory of 3244	3796	Opqofe32.exe	109
PID 3796 wrote to memory of 3244	3796	Opqofe32.exe	109
PID 3796 wrote to memory of 3244	3796	Opqofe32.exe	109
PID 3244 wrote to memory of 4016	3244	Ojfcdnjc.exe	110
PID 3244 wrote to memory of 4016	3244	Ojfcdnjc.exe	110
PID 3244 wrote to memory of 4016	3244	Ojfcdnjc.exe	110
PID 4016 wrote to memory of 4364	4016	Opeiadfg.exe	111
PID 4016 wrote to memory of 4364	4016	Opeiadfg.exe	111
PID 4016 wrote to memory of 4364	4016	Opeiadfg.exe	111
PID 4364 wrote to memory of 4752	4364	Pmiikh32.exe	112
PID 4364 wrote to memory of 4752	4364	Pmiikh32.exe	112
PID 4364 wrote to memory of 4752	4364	Pmiikh32.exe	112
PID 4752 wrote to memory of 1132	4752	Pnifekmd.exe	113
PID 4752 wrote to memory of 1132	4752	Pnifekmd.exe	113
PID 4752 wrote to memory of 1132	4752	Pnifekmd.exe	113
PID 1132 wrote to memory of 2376	1132	Paiogf32.exe	114
PID 1132 wrote to memory of 2376	1132	Paiogf32.exe	114
PID 1132 wrote to memory of 2376	1132	Paiogf32.exe	114
PID 2376 wrote to memory of 3256	2376	Pdjgha32.exe	115
PID 2376 wrote to memory of 3256	2376	Pdjgha32.exe	115
PID 2376 wrote to memory of 3256	2376	Pdjgha32.exe	115
PID 3256 wrote to memory of 4000	3256	Pdmdnadc.exe	116
PID 3256 wrote to memory of 4000	3256	Pdmdnadc.exe	116
PID 3256 wrote to memory of 4000	3256	Pdmdnadc.exe	116
PID 4000 wrote to memory of 3348	4000	Qmgelf32.exe	118
PID 4000 wrote to memory of 3348	4000	Qmgelf32.exe	118
PID 4000 wrote to memory of 3348	4000	Qmgelf32.exe	118
PID 3348 wrote to memory of 4808	3348	Aphnnafb.exe	119
PID 3348 wrote to memory of 4808	3348	Aphnnafb.exe	119
PID 3348 wrote to memory of 4808	3348	Aphnnafb.exe	119
PID 4808 wrote to memory of 4392	4808	Amlogfel.exe	120

C:\Users\Admin\AppData\Local\Temp\f3f3cf52b14f8af02165bff93d5e2c6eb5641fc37ca2bb936c0e322f9bb01dd5.exe
"C:\Users\Admin\AppData\Local\Temp\f3f3cf52b14f8af02165bff93d5e2c6eb5641fc37ca2bb936c0e322f9bb01dd5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Windows\SysWOW64\Mgloefco.exe
  C:\Windows\system32\Mgloefco.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\SysWOW64\Mcelpggq.exe
    C:\Windows\system32\Mcelpggq.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:3572
  - - C:\Windows\SysWOW64\Mnmmboed.exe
      C:\Windows\system32\Mnmmboed.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1400
    - - C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2364
      - C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3452
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4440
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1516
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:664
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3052
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3796
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3244
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4016
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4364
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4752
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2376
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4000
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3348
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4808
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        23⤵
        Executes dropped EXE
        
        PID:4392
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        24⤵
        Executes dropped EXE
        
        PID:4004
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        25⤵
        Executes dropped EXE
        
        PID:4056
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        26⤵
        Executes dropped EXE
        
        PID:824
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        27⤵
        Executes dropped EXE
        
        PID:3648
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        28⤵
        Executes dropped EXE
        
        PID:3800
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4580
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        30⤵
        Executes dropped EXE
        
        PID:3760
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        31⤵
        Executes dropped EXE
        
        PID:3400
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2756
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4464
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        34⤵
        Executes dropped EXE
        
        PID:748
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        35⤵
        Executes dropped EXE
        
        PID:1128
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        36⤵
        Executes dropped EXE
        
        PID:4720
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        37⤵
        Executes dropped EXE
        
        PID:4248
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        38⤵
        Executes dropped EXE
        
        PID:1772
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        39⤵
        Executes dropped EXE
        
        PID:2128
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        40⤵
        Executes dropped EXE
        
        PID:1104
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        41⤵
        Executes dropped EXE
        
        PID:1408
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        42⤵
        Executes dropped EXE
        
        PID:892
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        43⤵
        Executes dropped EXE
        
        PID:2108
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4320
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1636
        
        C:\Windows\SysWOW64\Ebfign32.exe
        
        C:\Windows\system32\Ebfign32.exe
        46⤵
        Executes dropped EXE
        
        PID:5164
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5208
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5248
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5292
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5332
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        51⤵
        Executes dropped EXE
        
        PID:5372
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        52⤵
        Executes dropped EXE
        
        PID:5412
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        53⤵
        Executes dropped EXE
        
        PID:5452
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5492
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        55⤵
        Executes dropped EXE
        
        PID:5532
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        56⤵
        Executes dropped EXE
        
        PID:5572
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5608
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        58⤵
        Executes dropped EXE
        
        PID:5656
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        59⤵
        Executes dropped EXE
        
        PID:5696
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5736
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5772
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        62⤵
        Executes dropped EXE
        
        PID:5816
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        63⤵
        Executes dropped EXE
        
        PID:5860
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        64⤵
        Executes dropped EXE
        
        PID:5900
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        65⤵
        Executes dropped EXE
        
        PID:5940
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        66⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6016
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        68⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        69⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Ieojgc32.exe
        
        C:\Windows\system32\Ieojgc32.exe
        70⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        71⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5276
        
        C:\Windows\SysWOW64\Ilkoim32.exe
        
        C:\Windows\system32\Ilkoim32.exe
        73⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        74⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5428
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        76⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        77⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        78⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        79⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        80⤵
        Drops file in System32 directory
        
        PID:5708
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        81⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        82⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        83⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        84⤵
        Drops file in System32 directory
        
        PID:6040
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        85⤵
        
        PID:1136
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        86⤵
        Drops file in System32 directory
        
        PID:5288
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        87⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        88⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        89⤵
        Modifies registry class
        
        PID:5092
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5756
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        91⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        92⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        93⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        94⤵
        Drops file in System32 directory
        
        PID:5548
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        95⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        96⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        97⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        98⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        99⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        100⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Momcpa32.exe
        
        C:\Windows\system32\Momcpa32.exe
        101⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        102⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Nmaciefp.exe
        
        C:\Windows\system32\Nmaciefp.exe
        103⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        104⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        105⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6452
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        107⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        108⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        109⤵
        Modifies registry class
        
        PID:6592
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6636
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        111⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        112⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        113⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        114⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        115⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        116⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6968
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        118⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        119⤵
        Drops file in System32 directory
        
        PID:7056
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        120⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        121⤵
        Modifies registry class
        
        PID:7136
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6148
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        123⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        124⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        125⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        126⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Qbonoghb.exe
        
        C:\Windows\system32\Qbonoghb.exe
        127⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Qmdblp32.exe
        
        C:\Windows\system32\Qmdblp32.exe
        128⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Qcnjijoe.exe
        
        C:\Windows\system32\Qcnjijoe.exe
        129⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Aabkbono.exe
        
        C:\Windows\system32\Aabkbono.exe
        130⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Afockelf.exe
        
        C:\Windows\system32\Afockelf.exe
        131⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Apggckbf.exe
        
        C:\Windows\system32\Apggckbf.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6904
        
        C:\Windows\SysWOW64\Amkhmoap.exe
        
        C:\Windows\system32\Amkhmoap.exe
        133⤵
        Drops file in System32 directory
        
        PID:6996
        
        C:\Windows\SysWOW64\Apjdikqd.exe
        
        C:\Windows\system32\Apjdikqd.exe
        134⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Ajohfcpj.exe
        
        C:\Windows\system32\Ajohfcpj.exe
        135⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Amnebo32.exe
        
        C:\Windows\system32\Amnebo32.exe
        136⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        137⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Abmjqe32.exe
        
        C:\Windows\system32\Abmjqe32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6404
        
        C:\Windows\SysWOW64\Bapgdm32.exe
        
        C:\Windows\system32\Bapgdm32.exe
        139⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Bjhkmbho.exe
        
        C:\Windows\system32\Bjhkmbho.exe
        140⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Bdapehop.exe
        
        C:\Windows\system32\Bdapehop.exe
        141⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Bmidnm32.exe
        
        C:\Windows\system32\Bmidnm32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6912
        
        C:\Windows\SysWOW64\Bdcmkgmm.exe
        
        C:\Windows\system32\Bdcmkgmm.exe
        143⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Bkmeha32.exe
        
        C:\Windows\system32\Bkmeha32.exe
        144⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Bagmdllg.exe
        
        C:\Windows\system32\Bagmdllg.exe
        145⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Bgdemb32.exe
        
        C:\Windows\system32\Bgdemb32.exe
        146⤵
        Modifies registry class
        
        PID:6356
        
        C:\Windows\SysWOW64\Cajjjk32.exe
        
        C:\Windows\system32\Cajjjk32.exe
        147⤵
        Modifies registry class
        
        PID:6524
        
        C:\Windows\SysWOW64\Cbkfbcpb.exe
        
        C:\Windows\system32\Cbkfbcpb.exe
        148⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Cienon32.exe
        
        C:\Windows\system32\Cienon32.exe
        149⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Cpogkhnl.exe
        
        C:\Windows\system32\Cpogkhnl.exe
        150⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Cmbgdl32.exe
        
        C:\Windows\system32\Cmbgdl32.exe
        151⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Ckggnp32.exe
        
        C:\Windows\system32\Ckggnp32.exe
        152⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Ccblbb32.exe
        
        C:\Windows\system32\Ccblbb32.exe
        153⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Cacmpj32.exe
        
        C:\Windows\system32\Cacmpj32.exe
        154⤵
        Drops file in System32 directory
        
        PID:7052
        
        C:\Windows\SysWOW64\Dgpeha32.exe
        
        C:\Windows\system32\Dgpeha32.exe
        155⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Daeifj32.exe
        
        C:\Windows\system32\Daeifj32.exe
        156⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Dcffnbee.exe
        
        C:\Windows\system32\Dcffnbee.exe
        157⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\Dnljkk32.exe
        
        C:\Windows\system32\Dnljkk32.exe
        158⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Dcibca32.exe
        
        C:\Windows\system32\Dcibca32.exe
        159⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Dkpjdo32.exe
        
        C:\Windows\system32\Dkpjdo32.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7212
        
        C:\Windows\SysWOW64\Dpmcmf32.exe
        
        C:\Windows\system32\Dpmcmf32.exe
        161⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Dckoia32.exe
        
        C:\Windows\system32\Dckoia32.exe
        162⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Dnqcfjae.exe
        
        C:\Windows\system32\Dnqcfjae.exe
        163⤵
        Drops file in System32 directory
        
        PID:7336
        
        C:\Windows\SysWOW64\Ddklbd32.exe
        
        C:\Windows\system32\Ddklbd32.exe
        164⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Dkedonpo.exe
        
        C:\Windows\system32\Dkedonpo.exe
        165⤵
        Modifies registry class
        
        PID:7416
        
        C:\Windows\SysWOW64\Daollh32.exe
        
        C:\Windows\system32\Daollh32.exe
        166⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Ecbeip32.exe
        
        C:\Windows\system32\Ecbeip32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7512
        
        C:\Windows\SysWOW64\Eaceghcg.exe
        
        C:\Windows\system32\Eaceghcg.exe
        168⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Ejojljqa.exe
        
        C:\Windows\system32\Ejojljqa.exe
        169⤵
        Drops file in System32 directory
        
        PID:7592
        
        C:\Windows\SysWOW64\Eddnic32.exe
        
        C:\Windows\system32\Eddnic32.exe
        170⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Ejagaj32.exe
        
        C:\Windows\system32\Ejagaj32.exe
        171⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Edfknb32.exe
        
        C:\Windows\system32\Edfknb32.exe
        172⤵
        Modifies registry class
        
        PID:7708
        
        C:\Windows\SysWOW64\Enopghee.exe
        
        C:\Windows\system32\Enopghee.exe
        173⤵
        Drops file in System32 directory
        
        PID:7748
        
        C:\Windows\SysWOW64\Fkcpql32.exe
        
        C:\Windows\system32\Fkcpql32.exe
        174⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Fgiaemic.exe
        
        C:\Windows\system32\Fgiaemic.exe
        175⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Fdmaoahm.exe
        
        C:\Windows\system32\Fdmaoahm.exe
        176⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Fjjjgh32.exe
        
        C:\Windows\system32\Fjjjgh32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7980
        
        C:\Windows\SysWOW64\Fcbnpnme.exe
        
        C:\Windows\system32\Fcbnpnme.exe
        178⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        179⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Fdbkja32.exe
        
        C:\Windows\system32\Fdbkja32.exe
        180⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Fklcgk32.exe
        
        C:\Windows\system32\Fklcgk32.exe
        181⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Ggccllai.exe
        
        C:\Windows\system32\Ggccllai.exe
        182⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Gdgdeppb.exe
        
        C:\Windows\system32\Gdgdeppb.exe
        183⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Gjcmngnj.exe
        
        C:\Windows\system32\Gjcmngnj.exe
        184⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Gdiakp32.exe
        
        C:\Windows\system32\Gdiakp32.exe
        185⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Gdknpp32.exe
        
        C:\Windows\system32\Gdknpp32.exe
        186⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Gjhfif32.exe
        
        C:\Windows\system32\Gjhfif32.exe
        187⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Gbbkocid.exe
        
        C:\Windows\system32\Gbbkocid.exe
        188⤵
        Drops file in System32 directory
        
        PID:7580
        
        C:\Windows\SysWOW64\Hjmodffo.exe
        
        C:\Windows\system32\Hjmodffo.exe
        189⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Hcedmkmp.exe
        
        C:\Windows\system32\Hcedmkmp.exe
        190⤵
        Drops file in System32 directory
        
        PID:7736
        
        C:\Windows\SysWOW64\Hjolie32.exe
        
        C:\Windows\system32\Hjolie32.exe
        191⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Haidfpki.exe
        
        C:\Windows\system32\Haidfpki.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7928
        
        C:\Windows\SysWOW64\Hgcmbj32.exe
        
        C:\Windows\system32\Hgcmbj32.exe
        193⤵
        Drops file in System32 directory
        
        PID:8032
        
        C:\Windows\SysWOW64\Hbiapb32.exe
        
        C:\Windows\system32\Hbiapb32.exe
        194⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Hegmlnbp.exe
        
        C:\Windows\system32\Hegmlnbp.exe
        195⤵
        Drops file in System32 directory
        
        PID:7048
        
        C:\Windows\SysWOW64\Hjdedepg.exe
        
        C:\Windows\system32\Hjdedepg.exe
        196⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Hannao32.exe
        
        C:\Windows\system32\Hannao32.exe
        197⤵
        Drops file in System32 directory
        
        PID:7412
        
        C:\Windows\SysWOW64\Hghfnioq.exe
        
        C:\Windows\system32\Hghfnioq.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7500
        
        C:\Windows\SysWOW64\Ibnjkbog.exe
        
        C:\Windows\system32\Ibnjkbog.exe
        199⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Ielfgmnj.exe
        
        C:\Windows\system32\Ielfgmnj.exe
        200⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Iabglnco.exe
        
        C:\Windows\system32\Iabglnco.exe
        201⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Infhebbh.exe
        
        C:\Windows\system32\Infhebbh.exe
        202⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Ieqpbm32.exe
        
        C:\Windows\system32\Ieqpbm32.exe
        203⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Ijmhkchl.exe
        
        C:\Windows\system32\Ijmhkchl.exe
        204⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Icfmci32.exe
        
        C:\Windows\system32\Icfmci32.exe
        205⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Jdmcdhhe.exe
        
        C:\Windows\system32\Jdmcdhhe.exe
        206⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Jjgkab32.exe
        
        C:\Windows\system32\Jjgkab32.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8012
        
        C:\Windows\SysWOW64\Jelonkph.exe
        
        C:\Windows\system32\Jelonkph.exe
        208⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Jnedgq32.exe
        
        C:\Windows\system32\Jnedgq32.exe
        209⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Jjkdlall.exe
        
        C:\Windows\system32\Jjkdlall.exe
        210⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Kbeibo32.exe
        
        C:\Windows\system32\Kbeibo32.exe
        211⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Khdoqefq.exe
        
        C:\Windows\system32\Khdoqefq.exe
        212⤵
        Modifies registry class
        
        PID:7428
        
        C:\Windows\SysWOW64\Kbjbnnfg.exe
        
        C:\Windows\system32\Kbjbnnfg.exe
        213⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Kdkoef32.exe
        
        C:\Windows\system32\Kdkoef32.exe
        214⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Kopcbo32.exe
        
        C:\Windows\system32\Kopcbo32.exe
        215⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Kdmlkfjb.exe
        
        C:\Windows\system32\Kdmlkfjb.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8280
        
        C:\Windows\SysWOW64\Kkgdhp32.exe
        
        C:\Windows\system32\Kkgdhp32.exe
        217⤵
        Modifies registry class
        
        PID:8328
        
        C:\Windows\SysWOW64\Khkdad32.exe
        
        C:\Windows\system32\Khkdad32.exe
        218⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Lacijjgi.exe
        
        C:\Windows\system32\Lacijjgi.exe
        219⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Lhmafcnf.exe
        
        C:\Windows\system32\Lhmafcnf.exe
        220⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Logicn32.exe
        
        C:\Windows\system32\Logicn32.exe
        221⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Lddble32.exe
        
        C:\Windows\system32\Lddble32.exe
        222⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Lknjhokg.exe
        
        C:\Windows\system32\Lknjhokg.exe
        223⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Lahbei32.exe
        
        C:\Windows\system32\Lahbei32.exe
        224⤵
        Drops file in System32 directory
        
        PID:8608
        
        C:\Windows\SysWOW64\Lhbkac32.exe
        
        C:\Windows\system32\Lhbkac32.exe
        225⤵
        Modifies registry class
        
        PID:8648
        
        C:\Windows\SysWOW64\Lolcnman.exe
        
        C:\Windows\system32\Lolcnman.exe
        226⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Lhdggb32.exe
        
        C:\Windows\system32\Lhdggb32.exe
        227⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Lcjldk32.exe
        
        C:\Windows\system32\Lcjldk32.exe
        228⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Mlbpma32.exe
        
        C:\Windows\system32\Mlbpma32.exe
        229⤵
        Modifies registry class
        
        PID:8808
        
        C:\Windows\SysWOW64\Mekdffee.exe
        
        C:\Windows\system32\Mekdffee.exe
        230⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Mcabej32.exe
        
        C:\Windows\system32\Mcabej32.exe
        231⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Mlifnphl.exe
        
        C:\Windows\system32\Mlifnphl.exe
        232⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Mebkge32.exe
        
        C:\Windows\system32\Mebkge32.exe
        233⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Mojopk32.exe
        
        C:\Windows\system32\Mojopk32.exe
        234⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Mdghhb32.exe
        
        C:\Windows\system32\Mdghhb32.exe
        235⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Ndidna32.exe
        
        C:\Windows\system32\Ndidna32.exe
        236⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Nooikj32.exe
        
        C:\Windows\system32\Nooikj32.exe
        237⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Nfiagd32.exe
        
        C:\Windows\system32\Nfiagd32.exe
        238⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Nkeipk32.exe
        
        C:\Windows\system32\Nkeipk32.exe
        239⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Nfknmd32.exe
        
        C:\Windows\system32\Nfknmd32.exe
        240⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Nlefjnno.exe
        
        C:\Windows\system32\Nlefjnno.exe
        241⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Nhlfoodc.exe
        
        C:\Windows\system32\Nhlfoodc.exe
        242⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Odbgdp32.exe
        
        C:\Windows\system32\Odbgdp32.exe
        243⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Oohkai32.exe
        
        C:\Windows\system32\Oohkai32.exe
        244⤵
        Drops file in System32 directory
        
        PID:5868
        
        C:\Windows\SysWOW64\Ohqpjo32.exe
        
        C:\Windows\system32\Ohqpjo32.exe
        245⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Obidcdfo.exe
        
        C:\Windows\system32\Obidcdfo.exe
        246⤵
        Drops file in System32 directory
        
        PID:8596
        
        C:\Windows\SysWOW64\Okailj32.exe
        
        C:\Windows\system32\Okailj32.exe
        247⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Ofgmib32.exe
        
        C:\Windows\system32\Ofgmib32.exe
        248⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Ocknbglo.exe
        
        C:\Windows\system32\Ocknbglo.exe
        249⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Odljjo32.exe
        
        C:\Windows\system32\Odljjo32.exe
        250⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Okfbgiij.exe
        
        C:\Windows\system32\Okfbgiij.exe
        251⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Pijcpmhc.exe
        
        C:\Windows\system32\Pijcpmhc.exe
        252⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Podkmgop.exe
        
        C:\Windows\system32\Podkmgop.exe
        253⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Pfncia32.exe
        
        C:\Windows\system32\Pfncia32.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9132
        
        C:\Windows\SysWOW64\Pcbdcf32.exe
        
        C:\Windows\system32\Pcbdcf32.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9168
        
        C:\Windows\SysWOW64\Pcdqhecd.exe
        
        C:\Windows\system32\Pcdqhecd.exe
        256⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Piaiqlak.exe
        
        C:\Windows\system32\Piaiqlak.exe
        257⤵
        Modifies registry class
        
        PID:8356
        
        C:\Windows\SysWOW64\Pcfmneaa.exe
        
        C:\Windows\system32\Pcfmneaa.exe
        258⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Piceflpi.exe
        
        C:\Windows\system32\Piceflpi.exe
        259⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Qifbll32.exe
        
        C:\Windows\system32\Qifbll32.exe
        260⤵
        Modifies registry class
        
        PID:8552
        
        C:\Windows\SysWOW64\Qfjcep32.exe
        
        C:\Windows\system32\Qfjcep32.exe
        261⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Qmckbjdl.exe
        
        C:\Windows\system32\Qmckbjdl.exe
        262⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Abpcja32.exe
        
        C:\Windows\system32\Abpcja32.exe
        263⤵
        Drops file in System32 directory
        
        PID:8904
        
        C:\Windows\SysWOW64\Aijlgkjq.exe
        
        C:\Windows\system32\Aijlgkjq.exe
        264⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Aimhmkgn.exe
        
        C:\Windows\system32\Aimhmkgn.exe
        265⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Abemep32.exe
        
        C:\Windows\system32\Abemep32.exe
        266⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Aecialmb.exe
        
        C:\Windows\system32\Aecialmb.exe
        267⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Almanf32.exe
        
        C:\Windows\system32\Almanf32.exe
        268⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Abjfqpji.exe
        
        C:\Windows\system32\Abjfqpji.exe
        269⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Albkieqj.exe
        
        C:\Windows\system32\Albkieqj.exe
        270⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Bejobk32.exe
        
        C:\Windows\system32\Bejobk32.exe
        271⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Bldgoeog.exe
        
        C:\Windows\system32\Bldgoeog.exe
        272⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Bfjllnnm.exe
        
        C:\Windows\system32\Bfjllnnm.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8336
        
        C:\Windows\SysWOW64\Bmddihfj.exe
        
        C:\Windows\system32\Bmddihfj.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2388
        
        C:\Windows\SysWOW64\Beoimjce.exe
        
        C:\Windows\system32\Beoimjce.exe
        275⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Bbcignbo.exe
        
        C:\Windows\system32\Bbcignbo.exe
        276⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Bfabmmhe.exe
        
        C:\Windows\system32\Bfabmmhe.exe
        277⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Cmmgof32.exe
        
        C:\Windows\system32\Cmmgof32.exe
        278⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Cbjogmlf.exe
        
        C:\Windows\system32\Cbjogmlf.exe
        279⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Cbmlmmjd.exe
        
        C:\Windows\system32\Cbmlmmjd.exe
        280⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Cleqfb32.exe
        
        C:\Windows\system32\Cleqfb32.exe
        281⤵
        Drops file in System32 directory
        
        PID:8924
        
        C:\Windows\SysWOW64\Cfjeckpj.exe
        
        C:\Windows\system32\Cfjeckpj.exe
        282⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Cpcila32.exe
        
        C:\Windows\system32\Cpcila32.exe
        283⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Cmgjee32.exe
        
        C:\Windows\system32\Cmgjee32.exe
        284⤵
        Modifies registry class
        
        PID:9308
        
        C:\Windows\SysWOW64\Debnjgcp.exe
        
        C:\Windows\system32\Debnjgcp.exe
        285⤵
        Modifies registry class
        
        PID:9360
        
        C:\Windows\SysWOW64\Dbfoclai.exe
        
        C:\Windows\system32\Dbfoclai.exe
        286⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Dgdgijhp.exe
        
        C:\Windows\system32\Dgdgijhp.exe
        287⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Dpllbp32.exe
        
        C:\Windows\system32\Dpllbp32.exe
        288⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Dlcmgqdd.exe
        
        C:\Windows\system32\Dlcmgqdd.exe
        289⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Digmqe32.exe
        
        C:\Windows\system32\Digmqe32.exe
        290⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Eennefib.exe
        
        C:\Windows\system32\Eennefib.exe
        291⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9648
        
        C:\Windows\SysWOW64\Epcbbohh.exe
        
        C:\Windows\system32\Epcbbohh.exe
        292⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Eilfldoi.exe
        
        C:\Windows\system32\Eilfldoi.exe
        293⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Eebgqe32.exe
        
        C:\Windows\system32\Eebgqe32.exe
        294⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Eeddfe32.exe
        
        C:\Windows\system32\Eeddfe32.exe
        295⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Ecidpiad.exe
        
        C:\Windows\system32\Ecidpiad.exe
        296⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Fnnimbaj.exe
        
        C:\Windows\system32\Fnnimbaj.exe
        297⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Fckaeioa.exe
        
        C:\Windows\system32\Fckaeioa.exe
        298⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Fjeibc32.exe
        
        C:\Windows\system32\Fjeibc32.exe
        299⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Fgijkgeh.exe
        
        C:\Windows\system32\Fgijkgeh.exe
        300⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Fneoma32.exe
        
        C:\Windows\system32\Fneoma32.exe
        301⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Fcbgfhii.exe
        
        C:\Windows\system32\Fcbgfhii.exe
        302⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Fjlpbb32.exe
        
        C:\Windows\system32\Fjlpbb32.exe
        303⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Fcddkggf.exe
        
        C:\Windows\system32\Fcddkggf.exe
        304⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Glmhdm32.exe
        
        C:\Windows\system32\Glmhdm32.exe
        305⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Gfemmb32.exe
        
        C:\Windows\system32\Gfemmb32.exe
        306⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\Gqkajk32.exe
        
        C:\Windows\system32\Gqkajk32.exe
        307⤵
        
        PID:9292
        
        C:\Windows\SysWOW64\Gcimfg32.exe
        
        C:\Windows\system32\Gcimfg32.exe
        308⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Gnoacp32.exe
        
        C:\Windows\system32\Gnoacp32.exe
        309⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Gqmnpk32.exe
        
        C:\Windows\system32\Gqmnpk32.exe
        310⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Gjebiq32.exe
        
        C:\Windows\system32\Gjebiq32.exe
        311⤵
        Drops file in System32 directory
        
        PID:9608
        
        C:\Windows\SysWOW64\Gdkffi32.exe
        
        C:\Windows\system32\Gdkffi32.exe
        312⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Gjhonp32.exe
        
        C:\Windows\system32\Gjhonp32.exe
        313⤵
        Drops file in System32 directory
        
        PID:9708
        
        C:\Windows\SysWOW64\Gqagkjne.exe
        
        C:\Windows\system32\Gqagkjne.exe
        314⤵
        Drops file in System32 directory
        
        PID:9812
        
        C:\Windows\SysWOW64\Hfnpca32.exe
        
        C:\Windows\system32\Hfnpca32.exe
        315⤵
        Modifies registry class
        
        PID:9876
        
        C:\Windows\SysWOW64\Hmhhpkcj.exe
        
        C:\Windows\system32\Hmhhpkcj.exe
        316⤵
        Drops file in System32 directory
        
        PID:9960
        
        C:\Windows\SysWOW64\Hgnlmdcp.exe
        
        C:\Windows\system32\Hgnlmdcp.exe
        317⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Hmkeekag.exe
        
        C:\Windows\system32\Hmkeekag.exe
        318⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Hnjaonij.exe
        
        C:\Windows\system32\Hnjaonij.exe
        319⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Hddilh32.exe
        
        C:\Windows\system32\Hddilh32.exe
        320⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Hjabdo32.exe
        
        C:\Windows\system32\Hjabdo32.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4452
        
        C:\Windows\SysWOW64\Hgebnc32.exe
        
        C:\Windows\system32\Hgebnc32.exe
        322⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Hdicggla.exe
        
        C:\Windows\system32\Hdicggla.exe
        323⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Iqpclh32.exe
        
        C:\Windows\system32\Iqpclh32.exe
        324⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Ijhhenhf.exe
        
        C:\Windows\system32\Ijhhenhf.exe
        325⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Icqmncof.exe
        
        C:\Windows\system32\Icqmncof.exe
        326⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Ijjekn32.exe
        
        C:\Windows\system32\Ijjekn32.exe
        327⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Iepihf32.exe
        
        C:\Windows\system32\Iepihf32.exe
        328⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Ijmapm32.exe
        
        C:\Windows\system32\Ijmapm32.exe
        329⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Iebfmfdg.exe
        
        C:\Windows\system32\Iebfmfdg.exe
        330⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Ijonfmbn.exe
        
        C:\Windows\system32\Ijonfmbn.exe
        331⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Iedbcebd.exe
        
        C:\Windows\system32\Iedbcebd.exe
        332⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Jakchf32.exe
        
        C:\Windows\system32\Jakchf32.exe
        333⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Janpnfee.exe
        
        C:\Windows\system32\Janpnfee.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10044
        
        C:\Windows\SysWOW64\Jfkhfmdm.exe
        
        C:\Windows\system32\Jfkhfmdm.exe
        335⤵
        Modifies registry class
        
        PID:10220
        
        C:\Windows\SysWOW64\Jelhcd32.exe
        
        C:\Windows\system32\Jelhcd32.exe
        336⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Jabiie32.exe
        
        C:\Windows\system32\Jabiie32.exe
        337⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Jglaepim.exe
        
        C:\Windows\system32\Jglaepim.exe
        338⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Jnfjbj32.exe
        
        C:\Windows\system32\Jnfjbj32.exe
        339⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Jepbodhg.exe
        
        C:\Windows\system32\Jepbodhg.exe
        340⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Knifging.exe
        
        C:\Windows\system32\Knifging.exe
        341⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Kebodc32.exe
        
        C:\Windows\system32\Kebodc32.exe
        342⤵
        Modifies registry class
        
        PID:10268
        
        C:\Windows\SysWOW64\Knkcmild.exe
        
        C:\Windows\system32\Knkcmild.exe
        343⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Kjbdbjbi.exe
        
        C:\Windows\system32\Kjbdbjbi.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10344
        
        C:\Windows\SysWOW64\Kfidgk32.exe
        
        C:\Windows\system32\Kfidgk32.exe
        345⤵
        Modifies registry class
        
        PID:10384
        
        C:\Windows\SysWOW64\Kanidd32.exe
        
        C:\Windows\system32\Kanidd32.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10424
        
        C:\Windows\SysWOW64\Kdmeqo32.exe
        
        C:\Windows\system32\Kdmeqo32.exe
        347⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Knbinhfl.exe
        
        C:\Windows\system32\Knbinhfl.exe
        348⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Lelajb32.exe
        
        C:\Windows\system32\Lelajb32.exe
        349⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Lndfchdj.exe
        
        C:\Windows\system32\Lndfchdj.exe
        350⤵
        Modifies registry class
        
        PID:10576
        
        C:\Windows\SysWOW64\Lfpkhjae.exe
        
        C:\Windows\system32\Lfpkhjae.exe
        351⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10612
        
        C:\Windows\SysWOW64\Laeoec32.exe
        
        C:\Windows\system32\Laeoec32.exe
        352⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Lhogamih.exe
        
        C:\Windows\system32\Lhogamih.exe
        353⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Lmlpjdgo.exe
        
        C:\Windows\system32\Lmlpjdgo.exe
        354⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Lfddci32.exe
        
        C:\Windows\system32\Lfddci32.exe
        355⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Loniiflo.exe
        
        C:\Windows\system32\Loniiflo.exe
        356⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Mehafq32.exe
        
        C:\Windows\system32\Mehafq32.exe
        357⤵
        Modifies registry class
        
        PID:10856
        
        C:\Windows\SysWOW64\Mkdiog32.exe
        
        C:\Windows\system32\Mkdiog32.exe
        358⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Mhhjhlqm.exe
        
        C:\Windows\system32\Mhhjhlqm.exe
        359⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Meljappg.exe
        
        C:\Windows\system32\Meljappg.exe
        360⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Mdagbl32.exe
        
        C:\Windows\system32\Mdagbl32.exe
        361⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Mknlef32.exe
        
        C:\Windows\system32\Mknlef32.exe
        362⤵
        Drops file in System32 directory
        
        PID:11076
        
        C:\Windows\SysWOW64\Nkpijfgf.exe
        
        C:\Windows\system32\Nkpijfgf.exe
        363⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Nhdicjfp.exe
        
        C:\Windows\system32\Nhdicjfp.exe
        364⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Namnmp32.exe
        
        C:\Windows\system32\Namnmp32.exe
        365⤵
        Drops file in System32 directory
        
        PID:11204
        
        C:\Windows\SysWOW64\Noqofdlj.exe
        
        C:\Windows\system32\Noqofdlj.exe
        366⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Ngnppfgb.exe
        
        C:\Windows\system32\Ngnppfgb.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10276
        
        C:\Windows\SysWOW64\Ogqmee32.exe
        
        C:\Windows\system32\Ogqmee32.exe
        368⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Oddmoj32.exe
        
        C:\Windows\system32\Oddmoj32.exe
        369⤵
        Modifies registry class
        
        PID:10400
        
        C:\Windows\SysWOW64\Okqbac32.exe
        
        C:\Windows\system32\Okqbac32.exe
        370⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Okeklcen.exe
        
        C:\Windows\system32\Okeklcen.exe
        371⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Pdnpeh32.exe
        
        C:\Windows\system32\Pdnpeh32.exe
        372⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Pocdba32.exe
        
        C:\Windows\system32\Pocdba32.exe
        373⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Pgoigcip.exe
        
        C:\Windows\system32\Pgoigcip.exe
        374⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9412
        
        C:\Windows\SysWOW64\Pklamb32.exe
        
        C:\Windows\system32\Pklamb32.exe
        375⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Phpbffnp.exe
        
        C:\Windows\system32\Phpbffnp.exe
        376⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Phbolflm.exe
        
        C:\Windows\system32\Phbolflm.exe
        377⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Qnpgdmjd.exe
        
        C:\Windows\system32\Qnpgdmjd.exe
        378⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11140
        
        C:\Windows\SysWOW64\Qhekaejj.exe
        
        C:\Windows\system32\Qhekaejj.exe
        379⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11256
        
        C:\Windows\SysWOW64\Akfdcq32.exe
        
        C:\Windows\system32\Akfdcq32.exe
        380⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Abpmpkoh.exe
        
        C:\Windows\system32\Abpmpkoh.exe
        381⤵
        
        PID:4540
        
        C:\Windows\SysWOW64\Akjnnpcf.exe
        
        C:\Windows\system32\Akjnnpcf.exe
        382⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Ainnhdbp.exe
        
        C:\Windows\system32\Ainnhdbp.exe
        383⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Abipfifn.exe
        
        C:\Windows\system32\Abipfifn.exe
        384⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\Bkadoo32.exe
        
        C:\Windows\system32\Bkadoo32.exe
        385⤵
        
        PID:896
        
        C:\Windows\SysWOW64\Bfghlhmd.exe
        
        C:\Windows\system32\Bfghlhmd.exe
        386⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Bghddp32.exe
        
        C:\Windows\system32\Bghddp32.exe
        387⤵
        Drops file in System32 directory
        
        PID:10788
        
        C:\Windows\SysWOW64\Belemd32.exe
        
        C:\Windows\system32\Belemd32.exe
        388⤵
        Drops file in System32 directory
        
        PID:1980
        
        C:\Windows\SysWOW64\Bndjfjhl.exe
        
        C:\Windows\system32\Bndjfjhl.exe
        389⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Bngfli32.exe
        
        C:\Windows\system32\Bngfli32.exe
        390⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Bgokdomj.exe
        
        C:\Windows\system32\Bgokdomj.exe
        391⤵
        
        PID:4744
        
        C:\Windows\SysWOW64\Bfpkbfdi.exe
        
        C:\Windows\system32\Bfpkbfdi.exe
        392⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Clmckmcq.exe
        
        C:\Windows\system32\Clmckmcq.exe
        393⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\Cehdib32.exe
        
        C:\Windows\system32\Cehdib32.exe
        394⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4568
        
        C:\Windows\SysWOW64\Cpmifkgd.exe
        
        C:\Windows\system32\Cpmifkgd.exe
        395⤵
        Modifies registry class
        
        PID:9996
        
        C:\Windows\SysWOW64\Cifmoa32.exe
        
        C:\Windows\system32\Cifmoa32.exe
        396⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\Cfjnhe32.exe
        
        C:\Windows\system32\Cfjnhe32.exe
        397⤵
        Modifies registry class
        
        PID:3664
        
        C:\Windows\SysWOW64\Clffalkf.exe
        
        C:\Windows\system32\Clffalkf.exe
        398⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\Dbckcf32.exe
        
        C:\Windows\system32\Dbckcf32.exe
        399⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\Dhpdkm32.exe
        
        C:\Windows\system32\Dhpdkm32.exe
        400⤵
        Drops file in System32 directory
        
        PID:10680
        
        C:\Windows\SysWOW64\Dojlhg32.exe
        
        C:\Windows\system32\Dojlhg32.exe
        401⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\Diamko32.exe
        
        C:\Windows\system32\Diamko32.exe
        402⤵
        
        PID:640
        
        C:\Windows\SysWOW64\Dhgjll32.exe
        
        C:\Windows\system32\Dhgjll32.exe
        403⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Doqbifpl.exe
        
        C:\Windows\system32\Doqbifpl.exe
        404⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Eekjep32.exe
        
        C:\Windows\system32\Eekjep32.exe
        405⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\Eemgkpef.exe
        
        C:\Windows\system32\Eemgkpef.exe
        406⤵
        Modifies registry class
        
        PID:11144
        
        C:\Windows\SysWOW64\Elgohj32.exe
        
        C:\Windows\system32\Elgohj32.exe
        407⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Eimlgnij.exe
        
        C:\Windows\system32\Eimlgnij.exe
        408⤵
        
        PID:10260
        
        C:\Windows\SysWOW64\Epgdch32.exe
        
        C:\Windows\system32\Epgdch32.exe
        409⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\Elnehifk.exe
        
        C:\Windows\system32\Elnehifk.exe
        410⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Flpbnh32.exe
        
        C:\Windows\system32\Flpbnh32.exe
        411⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\Fidbgm32.exe
        
        C:\Windows\system32\Fidbgm32.exe
        412⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\Flekihpc.exe
        
        C:\Windows\system32\Flekihpc.exe
        413⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\Flghognq.exe
        
        C:\Windows\system32\Flghognq.exe
        414⤵
        Modifies registry class
        
        PID:4000
        
        C:\Windows\SysWOW64\Fikihlmj.exe
        
        C:\Windows\system32\Fikihlmj.exe
        415⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Gohapb32.exe
        
        C:\Windows\system32\Gohapb32.exe
        416⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Ggafgo32.exe
        
        C:\Windows\system32\Ggafgo32.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1848
        
        C:\Windows\SysWOW64\Ggdbmoho.exe
        
        C:\Windows\system32\Ggdbmoho.exe
        418⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Gheodg32.exe
        
        C:\Windows\system32\Gheodg32.exe
        419⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Googaaej.exe
        
        C:\Windows\system32\Googaaej.exe
        420⤵
        Modifies registry class
        
        PID:912
        
        C:\Windows\SysWOW64\Hofmaq32.exe
        
        C:\Windows\system32\Hofmaq32.exe
        421⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\Hphfac32.exe
        
        C:\Windows\system32\Hphfac32.exe
        422⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\Hjbhph32.exe
        
        C:\Windows\system32\Hjbhph32.exe
        423⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\Icklhnop.exe
        
        C:\Windows\system32\Icklhnop.exe
        424⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3476
        
        C:\Windows\SysWOW64\Ihheqd32.exe
        
        C:\Windows\system32\Ihheqd32.exe
        425⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Ifleji32.exe
        
        C:\Windows\system32\Ifleji32.exe
        426⤵
        
        PID:1636
        
        C:\Windows\SysWOW64\Icbbimih.exe
        
        C:\Windows\system32\Icbbimih.exe
        427⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\Ijlkfg32.exe
        
        C:\Windows\system32\Ijlkfg32.exe
        428⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Icdoolge.exe
        
        C:\Windows\system32\Icdoolge.exe
        429⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Jmopmalc.exe
        
        C:\Windows\system32\Jmopmalc.exe
        430⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5416
        
        C:\Windows\SysWOW64\Jfokff32.exe
        
        C:\Windows\system32\Jfokff32.exe
        431⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\Kpgoolbl.exe
        
        C:\Windows\system32\Kpgoolbl.exe
        432⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Kgcqlh32.exe
        
        C:\Windows\system32\Kgcqlh32.exe
        433⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\Kanbjn32.exe
        
        C:\Windows\system32\Kanbjn32.exe
        434⤵
        Modifies registry class
        
        PID:5268
        
        C:\Windows\SysWOW64\Kfjjbd32.exe
        
        C:\Windows\system32\Kfjjbd32.exe
        435⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Lpbokjho.exe
        
        C:\Windows\system32\Lpbokjho.exe
        436⤵
        
        PID:10340
        
        C:\Windows\SysWOW64\Likcdpop.exe
        
        C:\Windows\system32\Likcdpop.exe
        437⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Lpelqj32.exe
        
        C:\Windows\system32\Lpelqj32.exe
        438⤵
        Modifies registry class
        
        PID:1400
        
        C:\Windows\SysWOW64\Ljjpnb32.exe
        
        C:\Windows\system32\Ljjpnb32.exe
        439⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\Ladhkmno.exe
        
        C:\Windows\system32\Ladhkmno.exe
        440⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Lccdghmc.exe
        
        C:\Windows\system32\Lccdghmc.exe
        441⤵
        Drops file in System32 directory
        
        PID:3380
        
        C:\Windows\SysWOW64\Lagepl32.exe
        
        C:\Windows\system32\Lagepl32.exe
        442⤵
        Modifies registry class
        
        PID:5484
        
        C:\Windows\SysWOW64\Ljoiibbm.exe
        
        C:\Windows\system32\Ljoiibbm.exe
        443⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Ldgnbg32.exe
        
        C:\Windows\system32\Ldgnbg32.exe
        444⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Mjdbda32.exe
        
        C:\Windows\system32\Mjdbda32.exe
        445⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Miklkm32.exe
        
        C:\Windows\system32\Miklkm32.exe
        446⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Mdaqhf32.exe
        
        C:\Windows\system32\Mdaqhf32.exe
        447⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Mdcmnfop.exe
        
        C:\Windows\system32\Mdcmnfop.exe
        448⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Nmlafk32.exe
        
        C:\Windows\system32\Nmlafk32.exe
        449⤵
        
        PID:4720
        
        C:\Windows\SysWOW64\Nalgbi32.exe
        
        C:\Windows\system32\Nalgbi32.exe
        450⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\Nhhldc32.exe
        
        C:\Windows\system32\Nhhldc32.exe
        451⤵
        Drops file in System32 directory
        
        PID:5188
        
        C:\Windows\SysWOW64\Oknnanhj.exe
        
        C:\Windows\system32\Oknnanhj.exe
        452⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\Odhppclh.exe
        
        C:\Windows\system32\Odhppclh.exe
        453⤵
        Modifies registry class
        
        PID:1504
        
        C:\Windows\SysWOW64\Paomog32.exe
        
        C:\Windows\system32\Paomog32.exe
        454⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Phkaqqoi.exe
        
        C:\Windows\system32\Phkaqqoi.exe
        455⤵
        
        PID:892
        
        C:\Windows\SysWOW64\Pahpee32.exe
        
        C:\Windows\system32\Pahpee32.exe
        456⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6040
        
        C:\Windows\SysWOW64\Qkqdnkge.exe
        
        C:\Windows\system32\Qkqdnkge.exe
        457⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Qhddgofo.exe
        
        C:\Windows\system32\Qhddgofo.exe
        458⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5900
        
        C:\Windows\SysWOW64\Ahinbo32.exe
        
        C:\Windows\system32\Ahinbo32.exe
        459⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Aqdbfa32.exe
        
        C:\Windows\system32\Aqdbfa32.exe
        460⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Bkhceh32.exe
        
        C:\Windows\system32\Bkhceh32.exe
        461⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Cnhlgc32.exe
        
        C:\Windows\system32\Cnhlgc32.exe
        462⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Cgaqphgl.exe
        
        C:\Windows\system32\Cgaqphgl.exe
        463⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\Calbnnkj.exe
        
        C:\Windows\system32\Calbnnkj.exe
        464⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5712
        
        C:\Windows\SysWOW64\Cnpbgajc.exe
        
        C:\Windows\system32\Cnpbgajc.exe
        465⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6668
        
        C:\Windows\SysWOW64\Dijppjfd.exe
        
        C:\Windows\system32\Dijppjfd.exe
        466⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Dbdano32.exe
        
        C:\Windows\system32\Dbdano32.exe
        467⤵
        Drops file in System32 directory
        
        PID:6856
        
        C:\Windows\SysWOW64\Eblgon32.exe
        
        C:\Windows\system32\Eblgon32.exe
        468⤵
        Modifies registry class
        
        PID:5876
        
        C:\Windows\SysWOW64\Eihlahjd.exe
        
        C:\Windows\system32\Eihlahjd.exe
        469⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\Foqdem32.exe
        
        C:\Windows\system32\Foqdem32.exe
        470⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\Gikbneio.exe
        
        C:\Windows\system32\Gikbneio.exe
        471⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Gaffbg32.exe
        
        C:\Windows\system32\Gaffbg32.exe
        472⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Gojgkl32.exe
        
        C:\Windows\system32\Gojgkl32.exe
        473⤵
        Modifies registry class
        
        PID:6932
        
        C:\Windows\SysWOW64\Gajpmg32.exe
        
        C:\Windows\system32\Gajpmg32.exe
        474⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Glbapoqh.exe
        
        C:\Windows\system32\Glbapoqh.exe
        475⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Hkjjfkcm.exe
        
        C:\Windows\system32\Hkjjfkcm.exe
        476⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Hhnkppbf.exe
        
        C:\Windows\system32\Hhnkppbf.exe
        477⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Hafpiehg.exe
        
        C:\Windows\system32\Hafpiehg.exe
        478⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Hcflch32.exe
        
        C:\Windows\system32\Hcflch32.exe
        479⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Hlnqln32.exe
        
        C:\Windows\system32\Hlnqln32.exe
        480⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Hakidd32.exe
        
        C:\Windows\system32\Hakidd32.exe
        481⤵
        Drops file in System32 directory
        
        PID:3232
        
        C:\Windows\SysWOW64\Ihgnfnjl.exe
        
        C:\Windows\system32\Ihgnfnjl.exe
        482⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Iofpnhmc.exe
        
        C:\Windows\system32\Iofpnhmc.exe
        483⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6924
        
        C:\Windows\SysWOW64\Jkomhhae.exe
        
        C:\Windows\system32\Jkomhhae.exe
        484⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Jhejgl32.exe
        
        C:\Windows\system32\Jhejgl32.exe
        485⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Jflgfpkc.exe
        
        C:\Windows\system32\Jflgfpkc.exe
        486⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Kcphpdil.exe
        
        C:\Windows\system32\Kcphpdil.exe
        487⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Kmhlijpm.exe
        
        C:\Windows\system32\Kmhlijpm.exe
        488⤵
        Drops file in System32 directory
        
        PID:6624
        
        C:\Windows\SysWOW64\Kiomnk32.exe
        
        C:\Windows\system32\Kiomnk32.exe
        489⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Kjnihnmd.exe
        
        C:\Windows\system32\Kjnihnmd.exe
        490⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Kjqfmn32.exe
        
        C:\Windows\system32\Kjqfmn32.exe
        491⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Kmaooihb.exe
        
        C:\Windows\system32\Kmaooihb.exe
        492⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6284
        
        C:\Windows\SysWOW64\Lkflpe32.exe
        
        C:\Windows\system32\Lkflpe32.exe
        493⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Ljglnmdi.exe
        
        C:\Windows\system32\Ljglnmdi.exe
        494⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Limioiia.exe
        
        C:\Windows\system32\Limioiia.exe
        495⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\Llmbqdfb.exe
        
        C:\Windows\system32\Llmbqdfb.exe
        496⤵
        Modifies registry class
        
        PID:7628
        
        C:\Windows\SysWOW64\Llpofd32.exe
        
        C:\Windows\system32\Llpofd32.exe
        497⤵
        Drops file in System32 directory
        
        PID:4132
        
        C:\Windows\SysWOW64\Mmokpglb.exe
        
        C:\Windows\system32\Mmokpglb.exe
        498⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7028
        
        C:\Windows\SysWOW64\Mldhacpj.exe
        
        C:\Windows\system32\Mldhacpj.exe
        499⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Mbcjimda.exe
        
        C:\Windows\system32\Mbcjimda.exe
        500⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Nbefolao.exe
        
        C:\Windows\system32\Nbefolao.exe
        501⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7068
        
        C:\Windows\SysWOW64\Niblafgi.exe
        
        C:\Windows\system32\Niblafgi.exe
        502⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Nfhipj32.exe
        
        C:\Windows\system32\Nfhipj32.exe
        503⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Olgnnqpe.exe
        
        C:\Windows\system32\Olgnnqpe.exe
        504⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Oinkmdml.exe
        
        C:\Windows\system32\Oinkmdml.exe
        505⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Obhlkjaj.exe
        
        C:\Windows\system32\Obhlkjaj.exe
        506⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5144
        
        C:\Windows\SysWOW64\Obkiqi32.exe
        
        C:\Windows\system32\Obkiqi32.exe
        507⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Pidamcgd.exe
        
        C:\Windows\system32\Pidamcgd.exe
        508⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Pkdngf32.exe
        
        C:\Windows\system32\Pkdngf32.exe
        509⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Ppepkmhi.exe
        
        C:\Windows\system32\Ppepkmhi.exe
        510⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Qmlmjq32.exe
        
        C:\Windows\system32\Qmlmjq32.exe
        511⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Qkpmcddi.exe
        
        C:\Windows\system32\Qkpmcddi.exe
        512⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Admkgifd.exe
        
        C:\Windows\system32\Admkgifd.exe
        513⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Apfhajjf.exe
        
        C:\Windows\system32\Apfhajjf.exe
        514⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Bgbmdd32.exe
        
        C:\Windows\system32\Bgbmdd32.exe
        515⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Bdfnmhnj.exe
        
        C:\Windows\system32\Bdfnmhnj.exe
        516⤵
        Drops file in System32 directory
        
        PID:7440
        
        C:\Windows\SysWOW64\Bdhkchlg.exe
        
        C:\Windows\system32\Bdhkchlg.exe
        517⤵
        Drops file in System32 directory
        
        PID:7828
        
        C:\Windows\SysWOW64\Bdkghg32.exe
        
        C:\Windows\system32\Bdkghg32.exe
        518⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6260
        
        C:\Windows\SysWOW64\Blflmj32.exe
        
        C:\Windows\system32\Blflmj32.exe
        519⤵
        Drops file in System32 directory
        
        PID:6584
        
        C:\Windows\SysWOW64\Bmhibi32.exe
        
        C:\Windows\system32\Bmhibi32.exe
        520⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Cgbfka32.exe
        
        C:\Windows\system32\Cgbfka32.exe
        521⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7124
        
        C:\Windows\SysWOW64\Cqmgigfk.exe
        
        C:\Windows\system32\Cqmgigfk.exe
        522⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Cmdhnhkp.exe
        
        C:\Windows\system32\Cmdhnhkp.exe
        523⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1964
        
        C:\Windows\SysWOW64\Dcnqkb32.exe
        
        C:\Windows\system32\Dcnqkb32.exe
        524⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6828
        
        C:\Windows\SysWOW64\Dmfecgim.exe
        
        C:\Windows\system32\Dmfecgim.exe
        525⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Dgliapic.exe
        
        C:\Windows\system32\Dgliapic.exe
        526⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7364
        
        C:\Windows\SysWOW64\Dkjbgooi.exe
        
        C:\Windows\system32\Dkjbgooi.exe
        527⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5492
        
        C:\Windows\SysWOW64\Dqigee32.exe
        
        C:\Windows\system32\Dqigee32.exe
        528⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Djalnkbo.exe
        
        C:\Windows\system32\Djalnkbo.exe
        529⤵
        Modifies registry class
        
        PID:8388
        
        C:\Windows\SysWOW64\Embdofop.exe
        
        C:\Windows\system32\Embdofop.exe
        530⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8464
        
        C:\Windows\SysWOW64\Ecafgo32.exe
        
        C:\Windows\system32\Ecafgo32.exe
        531⤵
        Drops file in System32 directory
        
        PID:8644
        
        C:\Windows\SysWOW64\Emikpeig.exe
        
        C:\Windows\system32\Emikpeig.exe
        532⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Eljknl32.exe
        
        C:\Windows\system32\Eljknl32.exe
        533⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Flmhclod.exe
        
        C:\Windows\system32\Flmhclod.exe
        534⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Fhfenmbe.exe
        
        C:\Windows\system32\Fhfenmbe.exe
        535⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Fmbnfcam.exe
        
        C:\Windows\system32\Fmbnfcam.exe
        536⤵
        Modifies registry class
        
        PID:6444
        
        C:\Windows\SysWOW64\Felbmqpl.exe
        
        C:\Windows\system32\Felbmqpl.exe
        537⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Fndgfffm.exe
        
        C:\Windows\system32\Fndgfffm.exe
        538⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Glhgojef.exe
        
        C:\Windows\system32\Glhgojef.exe
        539⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Geqlhp32.exe
        
        C:\Windows\system32\Geqlhp32.exe
        540⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Glkdejcd.exe
        
        C:\Windows\system32\Glkdejcd.exe
        541⤵
        Modifies registry class
        
        PID:8692
        
        C:\Windows\SysWOW64\Gechnpid.exe
        
        C:\Windows\system32\Gechnpid.exe
        542⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Gokmfe32.exe
        
        C:\Windows\system32\Gokmfe32.exe
        543⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6636
        
        C:\Windows\SysWOW64\Glajeiml.exe
        
        C:\Windows\system32\Glajeiml.exe
        544⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Hhkgpjqn.exe
        
        C:\Windows\system32\Hhkgpjqn.exe
        545⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Hoglbc32.exe
        
        C:\Windows\system32\Hoglbc32.exe
        546⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Ihdjfhhc.exe
        
        C:\Windows\system32\Ihdjfhhc.exe
        547⤵
        Modifies registry class
        
        PID:9060
        
        C:\Windows\SysWOW64\Ikgpmc32.exe
        
        C:\Windows\system32\Ikgpmc32.exe
        548⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Jddnah32.exe
        
        C:\Windows\system32\Jddnah32.exe
        549⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Khimhefk.exe
        
        C:\Windows\system32\Khimhefk.exe
        550⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Klloichl.exe
        
        C:\Windows\system32\Klloichl.exe
        551⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Lnfngj32.exe
        
        C:\Windows\system32\Lnfngj32.exe
        552⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Lnkgbibj.exe
        
        C:\Windows\system32\Lnkgbibj.exe
        553⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8752
        
        C:\Windows\SysWOW64\Mkadam32.exe
        
        C:\Windows\system32\Mkadam32.exe
        554⤵
        Drops file in System32 directory
        
        PID:8868
        
        C:\Windows\SysWOW64\Mnbnchlb.exe
        
        C:\Windows\system32\Mnbnchlb.exe
        555⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Meobeb32.exe
        
        C:\Windows\system32\Meobeb32.exe
        556⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Nkkggl32.exe
        
        C:\Windows\system32\Nkkggl32.exe
        557⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Nmjdaoni.exe
        
        C:\Windows\system32\Nmjdaoni.exe
        558⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Nblfee32.exe
        
        C:\Windows\system32\Nblfee32.exe
        559⤵
        Drops file in System32 directory
        
        PID:7656
        
        C:\Windows\SysWOW64\Nppfnige.exe
        
        C:\Windows\system32\Nppfnige.exe
        560⤵
        Drops file in System32 directory
        
        PID:7468
        
        C:\Windows\SysWOW64\Oeoklp32.exe
        
        C:\Windows\system32\Oeoklp32.exe
        561⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Ofnhfbjl.exe
        
        C:\Windows\system32\Ofnhfbjl.exe
        562⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Onjmjegg.exe
        
        C:\Windows\system32\Onjmjegg.exe
        563⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Oecego32.exe
        
        C:\Windows\system32\Oecego32.exe
        564⤵
        Modifies registry class
        
        PID:8592
        
        C:\Windows\SysWOW64\Opkfjgmh.exe
        
        C:\Windows\system32\Opkfjgmh.exe
        565⤵
        Modifies registry class
        
        PID:8232
        
        C:\Windows\SysWOW64\Plbfohbl.exe
        
        C:\Windows\system32\Plbfohbl.exe
        566⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Pblolb32.exe
        
        C:\Windows\system32\Pblolb32.exe
        567⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\Pmbcik32.exe
        
        C:\Windows\system32\Pmbcik32.exe
        568⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Pmdpok32.exe
        
        C:\Windows\system32\Pmdpok32.exe
        569⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Pikqcl32.exe
        
        C:\Windows\system32\Pikqcl32.exe
        570⤵
        Drops file in System32 directory
        
        PID:8736
        
        C:\Windows\SysWOW64\Qibfdkgh.exe
        
        C:\Windows\system32\Qibfdkgh.exe
        571⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9564
        
        C:\Windows\SysWOW64\Abmhbplf.exe
        
        C:\Windows\system32\Abmhbplf.exe
        572⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Aifpoj32.exe
        
        C:\Windows\system32\Aifpoj32.exe
        573⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9276
        
        C:\Windows\SysWOW64\Abodhpic.exe
        
        C:\Windows\system32\Abodhpic.exe
        574⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6480
        
        C:\Windows\SysWOW64\Acaanp32.exe
        
        C:\Windows\system32\Acaanp32.exe
        575⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Amgekh32.exe
        
        C:\Windows\system32\Amgekh32.exe
        576⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7392
        
        C:\Windows\SysWOW64\Aebjokda.exe
        
        C:\Windows\system32\Aebjokda.exe
        577⤵
        
        PID:452
        
        C:\Windows\SysWOW64\Bojohp32.exe
        
        C:\Windows\system32\Bojohp32.exe
        578⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Bedgejbo.exe
        
        C:\Windows\system32\Bedgejbo.exe
        579⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Bomknp32.exe
        
        C:\Windows\system32\Bomknp32.exe
        580⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Blqlgdhi.exe
        
        C:\Windows\system32\Blqlgdhi.exe
        581⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10084
        
        C:\Windows\SysWOW64\Bnphag32.exe
        
        C:\Windows\system32\Bnphag32.exe
        582⤵
        Modifies registry class
        
        PID:7096
        
        C:\Windows\SysWOW64\Bgimjmfl.exe
        
        C:\Windows\system32\Bgimjmfl.exe
        583⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Cpcnhbjj.exe
        
        C:\Windows\system32\Cpcnhbjj.exe
        584⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Cngnbfid.exe
        
        C:\Windows\system32\Cngnbfid.exe
        585⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\Cnlhme32.exe
        
        C:\Windows\system32\Cnlhme32.exe
        586⤵
        Modifies registry class
        
        PID:9152
        
        C:\Windows\SysWOW64\Copajm32.exe
        
        C:\Windows\system32\Copajm32.exe
        587⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Djeegf32.exe
        
        C:\Windows\system32\Djeegf32.exe
        588⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Dcmjpl32.exe
        
        C:\Windows\system32\Dcmjpl32.exe
        589⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Dgkbfjeg.exe
        
        C:\Windows\system32\Dgkbfjeg.exe
        590⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Dofgklcb.exe
        
        C:\Windows\system32\Dofgklcb.exe
        591⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Dnhgidka.exe
        
        C:\Windows\system32\Dnhgidka.exe
        592⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Doidql32.exe
        
        C:\Windows\system32\Doidql32.exe
        593⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\Eciilj32.exe
        
        C:\Windows\system32\Eciilj32.exe
        594⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8516
        
        C:\Windows\SysWOW64\Enajobbf.exe
        
        C:\Windows\system32\Enajobbf.exe
        595⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Egiohh32.exe
        
        C:\Windows\system32\Egiohh32.exe
        596⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Ecblbi32.exe
        
        C:\Windows\system32\Ecblbi32.exe
        597⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Fplimi32.exe
        
        C:\Windows\system32\Fplimi32.exe
        598⤵
        Modifies registry class
        
        PID:9964
        
        C:\Windows\SysWOW64\Fakfglhm.exe
        
        C:\Windows\system32\Fakfglhm.exe
        599⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Fjcjpb32.exe
        
        C:\Windows\system32\Fjcjpb32.exe
        600⤵
        Modifies registry class
        
        PID:9712
        
        C:\Windows\SysWOW64\Fggkifmg.exe
        
        C:\Windows\system32\Fggkifmg.exe
        601⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Gablgk32.exe
        
        C:\Windows\system32\Gablgk32.exe
        602⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Gmimll32.exe
        
        C:\Windows\system32\Gmimll32.exe
        603⤵
        Modifies registry class
        
        PID:7980
        
        C:\Windows\SysWOW64\Gcceifof.exe
        
        C:\Windows\system32\Gcceifof.exe
        604⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\Gagebknp.exe
        
        C:\Windows\system32\Gagebknp.exe
        605⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Gnkflo32.exe
        
        C:\Windows\system32\Gnkflo32.exe
        606⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Gffkpa32.exe
        
        C:\Windows\system32\Gffkpa32.exe
        607⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Hnblmnfa.exe
        
        C:\Windows\system32\Hnblmnfa.exe
        608⤵
        Modifies registry class
        
        PID:3804
        
        C:\Windows\SysWOW64\Hfmqapcl.exe
        
        C:\Windows\system32\Hfmqapcl.exe
        609⤵
        Modifies registry class
        
        PID:9816
        
        C:\Windows\SysWOW64\Habeni32.exe
        
        C:\Windows\system32\Habeni32.exe
        610⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\Hjkigojc.exe
        
        C:\Windows\system32\Hjkigojc.exe
        611⤵
        Drops file in System32 directory
        
        PID:6188
        
        C:\Windows\SysWOW64\Hphbpehj.exe
        
        C:\Windows\system32\Hphbpehj.exe
        612⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Ihagfb32.exe
        
        C:\Windows\system32\Ihagfb32.exe
        613⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Ionlhlld.exe
        
        C:\Windows\system32\Ionlhlld.exe
        614⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Ifipmo32.exe
        
        C:\Windows\system32\Ifipmo32.exe
        615⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Imgbdh32.exe
        
        C:\Windows\system32\Imgbdh32.exe
        616⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4700
        
        C:\Windows\SysWOW64\Jhocgqjj.exe
        
        C:\Windows\system32\Jhocgqjj.exe
        617⤵
        Modifies registry class
        
        PID:11048
        
        C:\Windows\SysWOW64\Jmlkpgia.exe
        
        C:\Windows\system32\Jmlkpgia.exe
        618⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Jgdphm32.exe
        
        C:\Windows\system32\Jgdphm32.exe
        619⤵
        Modifies registry class
        
        PID:7940
        
        C:\Windows\SysWOW64\Jopaejlo.exe
        
        C:\Windows\system32\Jopaejlo.exe
        620⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Knenffqf.exe
        
        C:\Windows\system32\Knenffqf.exe
        621⤵
        Drops file in System32 directory
        
        PID:7372
        
        C:\Windows\SysWOW64\Kdpfbp32.exe
        
        C:\Windows\system32\Kdpfbp32.exe
        622⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Kgpodk32.exe
        
        C:\Windows\system32\Kgpodk32.exe
        623⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Koggehff.exe
        
        C:\Windows\system32\Koggehff.exe
        624⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Kphdma32.exe
        
        C:\Windows\system32\Kphdma32.exe
        625⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Lajmmc32.exe
        
        C:\Windows\system32\Lajmmc32.exe
        626⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11204
        
        C:\Windows\SysWOW64\Lkcaeige.exe
        
        C:\Windows\system32\Lkcaeige.exe
        627⤵
        Drops file in System32 directory
        
        PID:8836
        
        C:\Windows\SysWOW64\Lppjnpem.exe
        
        C:\Windows\system32\Lppjnpem.exe
        628⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Lncjgddf.exe
        
        C:\Windows\system32\Lncjgddf.exe
        629⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Laacmbkm.exe
        
        C:\Windows\system32\Laacmbkm.exe
        630⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Loecgfjf.exe
        
        C:\Windows\system32\Loecgfjf.exe
        631⤵
        Drops file in System32 directory
        
        PID:2300
        
        C:\Windows\SysWOW64\Mqimdomb.exe
        
        C:\Windows\system32\Mqimdomb.exe
        632⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\Mhbakk32.exe
        
        C:\Windows\system32\Mhbakk32.exe
        633⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Mdloelpc.exe
        
        C:\Windows\system32\Mdloelpc.exe
        634⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Mkegbfgp.exe
        
        C:\Windows\system32\Mkegbfgp.exe
        635⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Ndphpk32.exe
        
        C:\Windows\system32\Ndphpk32.exe
        636⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Nofmndkd.exe
        
        C:\Windows\system32\Nofmndkd.exe
        637⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Nkojheoe.exe
        
        C:\Windows\system32\Nkojheoe.exe
        638⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Nieggill.exe
        
        C:\Windows\system32\Nieggill.exe
        639⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Okfpid32.exe
        
        C:\Windows\system32\Okfpid32.exe
        640⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11084 -s 416
        641⤵
        Program crash
        
        PID:10364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4396 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
1⤵
PID:336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 11084 -ip 11084
1⤵
PID:9360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abjfqpji.exe

Filesize
256KB

MD5
310fb5fdcbf1433d8ab66d9a63407f6e

SHA1
c0c94e4539c87f7396f2680b381eb19dfb99bff5

SHA256
48846e8d448aaaf6117a24b81a9b8f657d5f47ae0445b723c06892662bff8783

SHA512
325156a6e5d8d874397e224dd38d8da5e762f3739bdb8216493713a01e9b1a325817b85c1a7ec235c1e3aaf407aedfca58ee482894670f37db61f8e2edbf668a

Download Submit
C:\Windows\SysWOW64\Agimkk32.exe

Filesize
256KB

MD5
6e846f37f93837687a1a879f40074b8c

SHA1
ae5e07b28295646086cab30b440f2cd28ef81fbe

SHA256
6b46053d16abcefb72090c57c4e7c1b8430b4cc7afa48a839b91cd3c758e13df

SHA512
0e13bf7899f2dafed7ef6d28a97fb2fec9e37445dab3a54067c01336fb8295080901148c926a1c648b462015cf14521218545f248ff2f45d3d3559dc933af52b

Download Submit
C:\Windows\SysWOW64\Ahdpjn32.exe

Filesize
256KB

MD5
1d3480013e6de33289a8dc293214414e

SHA1
3030f234575f98a4985afb4bf922d0456e997aa8

SHA256
7d8f6dfc03201f9cef03def030e53efc6591a3086a15a4f6acf40fb0e629a998

SHA512
517e704721277ab860ad73db2209f04cd3cb3e1624f3eff5d89d771e8d63f59622389b5d5b6954e7b42939ee7c4c5af567ed993cb8614d78a5d78036c5e34b85

Download Submit
C:\Windows\SysWOW64\Amlogfel.exe

Filesize
256KB

MD5
7061198539b837746ac2ee4204afbc45

SHA1
6f0b8a092a57ae966d23a3ef3b6fa110820c9aad

SHA256
7fcfdf1c53797b391b7f9017deed1083785cef124bed46424f2d02a108425d0c

SHA512
215c2ef891389be29756ed01412c215afb85fb697d9bcd05133876fcb5178a72bb818d61bcb5e91a88e4e4a43529ce9a3d2fe493d4fac0170497f7447891ec17

Download Submit
C:\Windows\SysWOW64\Aokkahlo.exe

Filesize
256KB

MD5
6108a35be03b900dfb5045276b89efd1

SHA1
f70a1469b6a38ab403584fbf4f328aa503c0fc41

SHA256
a191c9000917f52241ab5be6219d7ada4a735754682a96258199257bc462ca7c

SHA512
5c9a5bc95166b31c2e64a35a04d8c87a3f622dc11f6b3a5251864066b6618d9179953d163316006f1a21c808dbc3e6fd12bdd65c437c6845ac5b40e1f563d41a

Download Submit
C:\Windows\SysWOW64\Aphnnafb.exe

Filesize
256KB

MD5
ac2888ce72bd2fce791f45a02c4479da

SHA1
08b4bf10d1d9a3e68154297e0857278608a7dfad

SHA256
d0b9d79f30612f8b41430069b617ead38bbae37d2172414f6b07f14c92b8e5ca

SHA512
36c993a8548295708a46db8590ea01bdd70ff58c850944b7d94fc744efd0c50018bf202d99de6838d473a9b418d7558fbae044bec81b3b999654eb16c729aac1

Download Submit
C:\Windows\SysWOW64\Bddcenpi.exe

Filesize
256KB

MD5
f69eda8de0028a10f2b9b3a4b023edcf

SHA1
7afcd536d1c2a02ccb0bad82dbfbe41f630e4d9b

SHA256
8fd57097564703c8799d359dedd355977975b2978542f91f0dfb6316ee8aad7f

SHA512
ec2af7b05c93dc76de9a65dd5ae508ad30bbc303db48c813488293d1a6cd0ba7013ab0d94e728b3d619686a39e9f41f28072ce60deab235018900373ad2e7379

Download Submit
C:\Windows\SysWOW64\Bdmmeo32.exe

Filesize
256KB

MD5
4e139aebe3c7fe2ea70d8214849a2497

SHA1
89ea2e5c3b0ca6065f249f46cd8e8b3f25cfaddc

SHA256
a4453682f4612846b71371417e5450295534b5c4d4e9afa70d63c165fd8557ce

SHA512
6ec1a32557d7082cfc9aed60ccf60d47264852def751531b634ffe4fb5446d9e39269fa814bc7ad2a50f44d497fe66dd53bb7f4860c2fcfeb16a6e48aa711dd8

Download Submit
C:\Windows\SysWOW64\Bgpcliao.exe

Filesize
256KB

MD5
253aa25ee9364ca27eb2cebc9e7fc7fa

SHA1
0f5b27d3908fd05350ca2a0e422013768e73c168

SHA256
6d18ba40dd58ff511f2b55246901de082350bb2926e941d520ef87ba4c947b3c

SHA512
ec1c9a6a8744d4cef9974688f18a0b133712a0ac1d94686fd99ea83b2de7611af3adeed2adb2ff20732c91f6b3a3e5dd3a8e4b025883bb6126b9e86e6ff05362

Download Submit
C:\Windows\SysWOW64\Bkphhgfc.exe

Filesize
256KB

MD5
8cdc5b36c5a6a5b32d9f840761e61cf5

SHA1
917f3a4b0d0fbb30f7d4bcf237c1443f1a221b55

SHA256
4869887417f83df0410b54ce14a150d861c60be59ac5269042e6a8b55d143da0

SHA512
ae1c42f31b79d74d74801ac771488008802672d32a0e8bfb4c86672c1903918eac0344cfa307f2a32170969374e8fb3f3936c1723b6ebdd7238fd0f9b5085dd5

Download Submit
C:\Windows\SysWOW64\Bmhocd32.exe

Filesize
256KB

MD5
bbd0a2179e3383df3fb54f4903060b6b

SHA1
f17d60476e2369d9df07a1f647dbdc6dfffb8404

SHA256
e4eb6dcfa35c6764657f61f2e99d0cc60e78002357df71358d8ab9cc6bb553a9

SHA512
e11593c719efd42d352a8327e4056235f3daa7d54b8107472a8c7a8f5c8517ccd0aaf8320e2f9fceba8bfa6e02bcfffc433fccb8deeff47901f5310ab241819f

Download Submit
C:\Windows\SysWOW64\Cglbhhga.exe

Filesize
256KB

MD5
292509d111fda01257e0173a55621d97

SHA1
7f78346599121966b4fc241e1b3045044cc984e1

SHA256
f31624ccf832165da5d0c23137aed4d1a43a634526ac4ca3d2f577b0b655185f

SHA512
a29bb446092c685ed6d5d76a29a503c58e80b96d971a5ca8081ee716d872d9dd4665da2c3fec23e1c1b2baf0672cedda09a0138b765e905c7c0bb938dba57195

Download Submit
C:\Windows\SysWOW64\Chdialdl.exe

Filesize
256KB

MD5
7d5d118fbb850b45e1b68cb9846e0ed6

SHA1
25eceedc8d2594a37a2229da548d072d6321fef4

SHA256
abeee75daf8f64ad2fa73f6bebdc257a42cbcdecd4d3390cf70cd22b9943f3d7

SHA512
7367c8b081e573f9997978736b3b398dd7af01d076d1dd2578b9139d2e06f10a727792e8a65321b1f393f258a994d38c36b038966417e152a04fa230b2ea9bfa

Download Submit
C:\Windows\SysWOW64\Cnaaib32.exe

Filesize
256KB

MD5
2a3299c44639ec15df826125eb2a0188

SHA1
dcb1e6f27ec0c69bdbab8aefab49aad978ebcab5

SHA256
f536a422720551e674fe3794ac4400da98af69ec1c859d875a469496ed56021c

SHA512
c93f3bcfbae746c8e7f911b2c735d6332797c5db56fbb4e28ae5e9dd590b6c1ec923acd37dd99e90e895b2aa6a221a9e6f9726d579cc70e760b116ff2d76bb78

Download Submit
C:\Windows\SysWOW64\Dkndie32.exe

Filesize
256KB

MD5
d5b58863cbd2136f4d47d3746f67c2ac

SHA1
b90c0b2e9a39932b65d10cdcc096e07c2b51fe42

SHA256
bf696c67cf83d37adac8b1a0eed98acfe5983a3f980913795c4c6bf1b039c3ab

SHA512
0c7c35db2c6ea0295eb4caf1e682cc777dff089031efdc3c15a7890eab9aa0cdbfa84207770a65fdb0b6709889dc0401576185dce538a87daa8141dcb19d13c0

Download Submit
C:\Windows\SysWOW64\Eilfldoi.exe

Filesize
256KB

MD5
23c18968d704ab5774afcd97f5d9ec03

SHA1
f2e8532d58e5865fd94fee62d0ee3babe7dc7316

SHA256
8114ce04366fb743b95026587ccc049c5907e280d96555d40a4c7777ddf4d2f4

SHA512
f79a3957e8712843d771d31194664d06228d45b9a5efaa872e33ff97792f94ed7b67af0581a4feb6e193c11d0cadb06496d348d98728e4ad74027360440dd8b8

Download Submit
C:\Windows\SysWOW64\Fkhpfbce.exe

Filesize
256KB

MD5
329ce3e3eaac24a3d39decbeab320c0e

SHA1
098b59ed4ad73dedbc8ad8f2bf3ac7bffd833ae1

SHA256
15abd31738a68da092492c4aa0c35bbc7c2efc1f653a8faf50608099bba3a25d

SHA512
9e12c3b46f374d12cdf4959e5664f7c42df99007ead7e990247ac7663d3bbc2ced6035188068cf62817915db514bc7fe6c9e542dcda6472ee041c2b78986c9fb

Download Submit
C:\Windows\SysWOW64\Hhfpbpdo.exe

Filesize
256KB

MD5
fa801285fa46f24c09b826ffa7e69940

SHA1
b9da71cc0db3febe483619873b39fd906fe2beb7

SHA256
95400311496717088ab99213fe75de0af775f0f6e469ea545af55e964031472f

SHA512
b1068a4f69c81998e695565c9d53ecf724b040b39474c22e9dc1f313d42e1518dbd33f5cae1b73ca3e30794b4703da85cf14f9752e6560bfeb777e23d650edd4

Download Submit
C:\Windows\SysWOW64\Ilkoim32.exe

Filesize
256KB

MD5
b0adb686894eb1eba6d30b0a760bc8b3

SHA1
13a163d8d8d3181589604b839ce1d8b50b6ed243

SHA256
218c172384e74e6b6789c66fa45dc0f5ff0d31c858a123a214f9fdff7aba2ca9

SHA512
21e3dc66673c44d47e0bfb88b8b713bea31e43c9459eeb5e1a10ee4a58c2b097ea689f89a19021612a09990df6ee82b3a0c820c2ea6cfa9fedc17327ca4283fd

Download Submit
C:\Windows\SysWOW64\Jcleff32.dll

Filesize
7KB

MD5
b3a871e3a1e5156d0918cfbf0b543fa4

SHA1
7b65769294e38da74f5d0719dbb265018ec39fd2

SHA256
7765495ede59c5b9ac6c18c2a681d6c2b58e55de6d890389c5fcd1794fedf2fc

SHA512
f30ad5c9f765b8e9de1542ab46169482d21517a4f91bf41932c5bf8eed30275588f4761c4a32cd1a9a55b02f9414217672ccc74c29e17f79aa2eeb04d3165c52

Download Submit
C:\Windows\SysWOW64\Jnedgq32.exe

Filesize
256KB

MD5
29340684e5ddd3ee4036e582e96913a4

SHA1
ca4f2816f665d27aeb02d6e617d589a4d51344e2

SHA256
a1ef07027d17f46e22c103463c015d89d4321b101bb25c9afbffa0e90da00104

SHA512
3a6f73f39b4731e2dc196db7e05d7468250158fec97f35b0636b7fd45fb3e9a31f06fd5568e79f8b7bf6ed90b302daf7041929c3e596044d0475bd5405d90982

Download Submit
C:\Windows\SysWOW64\Kbeibo32.exe

Filesize
256KB

MD5
78ade915e9f3a5f335ee49acde0da4a9

SHA1
75b609faa621f4b58f081c39f1acc067030ff721

SHA256
7e5c192d92d11a3e063a8a52b837bc67245a35dc9acd8b748841217ec477ce68

SHA512
b3f28fa705f86449985724ab7c5a5f2ee6d820704270de43695b319d5d9af48860c37aa55118299e8f783f2f39bd8ae9acce1e8d56723046cf08cb555dc6c45a

Download Submit
C:\Windows\SysWOW64\Kjbdbjbi.exe

Filesize
256KB

MD5
acf0d7a5a3f38873d4086bf1f3a2d656

SHA1
04e9791151b5d3cfcb1e2269e5d1a2b278208a0e

SHA256
9312207ba2a3babced16bf5023268b36b27c6dec301c02dd735ff0277dd7c583

SHA512
cd1cb8ade59285474ce0db5f65428309c4355239c983f2c2ab2490e4aaec94542553739b562593f8a304291f9b2087caf5433003f96fd423252e2985e19c35a2

Download Submit
C:\Windows\SysWOW64\Knkcmild.exe

Filesize
256KB

MD5
da59cb89fd39f99815c89f3e62176855

SHA1
967fc933db7250c1550ecf3a82e9e9d769536afd

SHA256
4269271d7f0f31243893b44181d6bdbe5670a0da1271a46178a2923bfa795a14

SHA512
0fd2415f80decd1a9fc69325b14a3b169512ff3eba9f878c132fdd6ee1e7172af8aacd776463aaad1e54533f3b4dd5a0b1a49400ccc8fdf2ea3837fef8fc988c

Download Submit
C:\Windows\SysWOW64\Mcelpggq.exe

Filesize
256KB

MD5
f72155cf37e3dde046b58e21950fc931

SHA1
a16a6d969bbd41bf58f8ab22e51240fbd5695b0d

SHA256
2b6778d2585d9f29e8c7ba57a674e957952c2afd29c4ac28db89a9f2ee862e93

SHA512
737b0e5d9804f91c8057072a95e8b5f17f60a2d8911ceafc29cb18d61ef8904db45d01cb4aeef8cba37701940030d6c77582221e5a2aa2e91f67e98a93f78fd6

Download Submit
C:\Windows\SysWOW64\Mfhbga32.exe

Filesize
256KB

MD5
4aa9abd1a79fa0aa2c48a157f13c0177

SHA1
8c09f9654d87b5d20c5bdf028c6dd4827a452d06

SHA256
fd87e38644aaabcb7f271c9427b4a88938bd92e84f664d90c4cb981733589724

SHA512
48a0202360fc12ed655af89d7746ceb246bbe30fa182c724459ddc093c56a995352a7cb4dd80919ce0fca0aadc4b66feaef0f2916dd8e7374f866c3ecb520868

Download Submit
C:\Windows\SysWOW64\Mgloefco.exe

Filesize
256KB

MD5
a71da0dd1e6fec418ac9a070be3213c1

SHA1
e82622d67876edbb2a26b8e2a89fa7ba76e11123

SHA256
935d5be721effd27b8fde3550d83d7293ace0e10bd3cfbee25bee933c1cd65b1

SHA512
cffaef307346f6cda86bc542748b24099f80b805be485b30aec09efca3471a2eaca72113f9931040c11d4cde3b35ff38ebdf6e0ff3b89753d48c9c573f2fffb8

Download Submit
C:\Windows\SysWOW64\Mhhjhlqm.exe

Filesize
34KB

MD5
ff8ab648b85c9eccc582d268caa403aa

SHA1
3c445c15144fd8b2d43495a967bc32a9d62aa162

SHA256
5f0900862088a175ba8fc4b6f8de80688197e176a33ee510a4083886920e6131

SHA512
92fb051f51932befe4ecb9a5d18d8257659bbe8d01c17a4873363e66920894e964bf0f2e48dbd60b237a4157f47b6968873fd9c0debabf386c11e0cdddb6ddbe

Download Submit
C:\Windows\SysWOW64\Mnmmboed.exe

Filesize
256KB

MD5
23dcbfbf9f548bab0a85230d4f490204

SHA1
4070cd6dade0c443308b70cabd7b4f6252f02ea1

SHA256
879f0926d3e65fdb083ea8c198a0b2e819bea84c64602dfd8d6d31f12c51312c

SHA512
9998499d4c7b10e3608b5a320689b3a39ab103e2afcdd4c6af109924a4d5d0f74d2b8012ab53a1195e3bac3cc2a53c8c651ff45d302d15cfd0b721e7a779155a

Download Submit
C:\Windows\SysWOW64\Nagiji32.exe

Filesize
256KB

MD5
8382fdda3cb93c5d42292bb2088026f6

SHA1
e09014ea8e69f92ebcc4cfc1a99e9d9f3b33342f

SHA256
7c550e2acb200933206bb59b311dfdc75779dff4e2e69d3fdc421b8340e0332b

SHA512
33efdeee0dbd0f29f5cff08262fc7e8a94c670ae431b4cfe69ecac17d2f0869bfaba46655f905703b04151a8303acc48b90c0f541b1f54db19045bc4c1e1c4da

Download Submit
C:\Windows\SysWOW64\Ncchae32.exe

Filesize
256KB

MD5
037d2a759fca5985e098ebc406c554b1

SHA1
6a6f8050939a315c339266d93698bb6332878a0f

SHA256
d22d1f60b05d6fd8a5ccb47a21b81915c36275f632a7515be7512c5c74c16fd8

SHA512
9e8ef438733be578877405f4d629c2d06627439a02b5eca2e604a32020f6b83452e2c6052b016e874e9266507dae4e595a03f169f74a67d631eeb633b045b376

Download Submit
C:\Windows\SysWOW64\Nglhld32.exe

Filesize
256KB

MD5
c163f43d7ab3be35ad298e828ba02180

SHA1
d4f2f8a38150823537dc8c804b88a44c71841f29

SHA256
de1f4d86221aeb6b8e21f18b3306315e8614a2fca0039ce855a38b9844c1c70d

SHA512
64dc27b4e616c771134dd6ffe03d36e895e7b5bdb6e44e845fd8ed11ed7ee8a412e663f5f891553f8eda1ccfd0adea6a6aaf82c894bf427f915f259dc4463951

Download Submit
C:\Windows\SysWOW64\Njhgbp32.exe

Filesize
256KB

MD5
db4b0dbbcfebda452250804bf9d7cd10

SHA1
fdd2342c12f3cf9e44c4c78ec80d9389077caf28

SHA256
44820f28bf06491132f44b5834169842eac152133b75bed8799402e8ba56e362

SHA512
96a3b8cd7ede4eb4d9f2daf272a8c834ecfa28fe8e95c20ba90cf25a3f2465645c79c09b645ced21e205ec3f7aacf8491e47d2f4df1cc83abf5fc3a03d099b08

Download Submit
C:\Windows\SysWOW64\Ocgbld32.exe

Filesize
256KB

MD5
ccde79bccab78eb487492cc8aca40be6

SHA1
dc7d536f7f2e8b397873ea9ddae78fe33cf3a29d

SHA256
d6cf3bf47955624a76854a525ab823574b82bd5abf33c0b6ffb05184f8345596

SHA512
844d5e2f8d29bb1b4f68354b0bbfd20ce31294c7df17efd96cf4783a81e98ee1038ec145ec48a2b8dfb7b7e5721bc30b22907e39a9255ad66ddc08fa848a0a7c

Download Submit
C:\Windows\SysWOW64\Ojfcdnjc.exe

Filesize
256KB

MD5
8cbdc00e270e5fb8d6a64f4127e02f44

SHA1
82c309d714687be9cdbe4a446d23e3289a444e5c

SHA256
d81913c3a48542ee36a2f48d759ef9a4d3fb1fb93440c3421a378553c7edde14

SHA512
3ec27e18364e55ec25073d8d4f82040e642e993f70d43adf10ccc7257248cb53a8f3abf021766b39dfff9d1aa946c92787ea04ec6dc8f16a414ea6c27c483468

Download Submit
C:\Windows\SysWOW64\Ompfej32.exe

Filesize
256KB

MD5
042b1fe9b4a29d5fcb1a5916facdf151

SHA1
61e07f95af0c4880fa45049a679c92cb91115d11

SHA256
1a2418689067e42bcd92318b7e9b99e65e1608afb4efd258ef9fce6b26fff923

SHA512
468f71b2edae338090988a777ff1b3abe0993d59de24b8ebd293c9bdbcc945d53990879e416b2192abad15ae27be15b2d9a37c9343ac4bd341a7953966bbbb84

Download Submit
C:\Windows\SysWOW64\Opeiadfg.exe

Filesize
256KB

MD5
6d01cfffb0c4bfddd42efbc815e93da8

SHA1
9c29d7f84ad705a3e56dc59eeb308ae3a077e490

SHA256
ef637aaa6e6718d6fb3e0dca0624b24e2c4089c1c547e731f05a872f007f3ca4

SHA512
2f21db611712325312f7f05699abb5b315d5ff85effccd207caa1261e549af20425c855613f23cf0b9be2bf65e35d98018f74af75a79b8b01b7c2f6b84aeb4c2

Download Submit
C:\Windows\SysWOW64\Opqofe32.exe

Filesize
256KB

MD5
3b89b1aed08ed55966db4901195b89e1

SHA1
823b53adf33122d6af4de7ab922c4cd83ebd0375

SHA256
443e5a2c9c3dd42f0428b5e4e17992d80f9c8752b183e996b9a315eea3e0141a

SHA512
0c822bdec89ab478d96945f699061fcad2bdc96faadf94c367c3e0a474b57c55bfdb7ab5f1cfc535cbc5aae8878014260dd50a25b4bb5b0471c3f33a1f599ff2

Download Submit
C:\Windows\SysWOW64\Paiogf32.exe

Filesize
256KB

MD5
4fe3d59b405711321517c4ee2254596a

SHA1
c85e8b84479abc1c046a51b894a911f31177cd44

SHA256
a0de9c33f7be166dea80d9c217d89f94ee42561678727013ccf2819a1c9a3ce6

SHA512
2f14997e0a9c379e202f85ad699f0a0c702a7964f695b8f7756703438827f2d8c35e87554752feaf577533d5279fc10765a3d5a338b22d8952c5d27862bf4ca6

Download Submit
C:\Windows\SysWOW64\Pdjgha32.exe

Filesize
256KB

MD5
608383efd51749c66626ea0cfc8e92db

SHA1
af79f62c65b13e6b21113417a889731c4f490c61

SHA256
3d839a1070333a852aed8cdea3226a767b31980a9d1ec8df749324149116ca39

SHA512
20b5f308a4b0867ddd222b20ade46aef3fde969a8b1820e218a7b6cf7691386adccdd81429cd101c919fd14396518f1e0168afafa343f1d1cf01245ec9b8a5a3

Download Submit
C:\Windows\SysWOW64\Pdmdnadc.exe

Filesize
256KB

MD5
b3403c73b9ac85c0f24e2b71f2cf6e46

SHA1
dd4547da03aa226f0553cf8a7ad5e292c9f613bb

SHA256
cf35b21132a79255c2f779745f3df87853d66f31a06b1c3f8fcc0cf20e1153ff

SHA512
3baa448b302ef26f0201d5a6ed811f1aca0450e4711dbb4c0f517c31cb0fc7d55d461b6d348ce7f0132502c58ebe1c33b2813d2957d11fa783d71a6ca75672ba

Download Submit
C:\Windows\SysWOW64\Pmiikh32.exe

Filesize
256KB

MD5
c6967ff74ca9748d492ffb27dc86eb6e

SHA1
8afe8079c2df992820bb8679a1fe9c9e0aed27e0

SHA256
39383ff41d1f78696c259bcdddba65a30aa0b73ecb3392e5edee06eee4d3b806

SHA512
537a787259b5df505211595a84e6135c4c75c2951850dbfe991fb943c6bcf7f0b9674137a90b0212cccd4bb0512b6425730255309f2daf72be590ddad1432a7b

Download Submit
C:\Windows\SysWOW64\Pnifekmd.exe

Filesize
256KB

MD5
3aa27ab05ae4f0f9a291c880fe779a23

SHA1
7e64500804695ee01bcd1d3e62d44500e778145a

SHA256
c9c0f4a9a3c3b6bfe69e942a9241e63143c52c1866cda05a24514594dfef3c5d

SHA512
e417424aad514ec85388a2a50ddaec2333dbd5ee755a42655a0294a04881eaf9896a0c0a17e8e36684c9ec0aff8a54d3947a9fcdd2253b7e76347c380eccefce

Download Submit
C:\Windows\SysWOW64\Qmgelf32.exe

Filesize
256KB

MD5
aeead9dbfa8097ea1758605445e72b8f

SHA1
420385a594034b5af35b609fb74eeafb45b1afc2

SHA256
44a2f282286cdfee55df8c2e7b101851dc3ffa44593b169e288c37a1af66281b

SHA512
0cb9c481e36e846f8362235c44e206820aaf4d3c004204e29893a72e6bb65027ecfa8cd6d14049eb5e71e359ece5ac87e693c894fcee3339ad5a72949db693f3

Download Submit
memory/664-72-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/824-199-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/892-309-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1104-297-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1128-267-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1132-128-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1252-7-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1400-23-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1408-303-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1504-0-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1516-63-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1636-327-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/1772-285-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2108-315-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2128-291-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2152-39-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2364-31-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2376-136-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/2756-247-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3052-79-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3244-95-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3256-143-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3348-160-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3400-240-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3452-47-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3572-15-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3648-208-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3760-232-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3796-88-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/3800-220-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4000-151-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4004-183-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4016-104-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4056-192-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4248-279-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4320-321-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4364-116-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4392-180-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4440-56-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4464-256-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4580-223-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4720-277-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4752-124-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/4808-168-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5164-333-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5208-345-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5248-346-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5292-352-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5332-361-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5372-364-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5412-370-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5452-376-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5492-382-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5532-388-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5572-394-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5608-400-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5656-406-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5696-412-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5736-423-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5772-428-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5816-430-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5860-436-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5900-442-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download
memory/5976-453-0x0000000000400000-0x0000000000457000-memory.dmp

Filesize
348KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads