f0301ef452c4e1e50bf7b3787e9fc4a4f927f7e65bee2b79f73a89c855066bcf

Analysis

max time kernel
147s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2024 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0301ef452c4e1e50bf7b3787e9fc4a4f927f7e65bee2b79f73a89c855066bcf.exe
Size

273KB
MD5

23efc80fd5f207eb3dc73dd4f2a49b83
SHA1

d3237aa3c28d9d04eccdd2c69450be047629e855
SHA256

f0301ef452c4e1e50bf7b3787e9fc4a4f927f7e65bee2b79f73a89c855066bcf
SHA512

d38e43ab3924e2e895ca86cab84ac949d736873721b654fbe996da242d17c75bccade6e397c30b7486ff14678a527569b8848e433332a0364d0e984c9c5a113f
SSDEEP

6144:42HMSvcibfvlsZRkTebwBhGv4dC+1R8pvBgL0eXkUbGKl9veOPSV3uo97fQ6uPgC:FHMO

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajjjocap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajjjocap.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbgalmej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Flmqlg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aadifclh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhkjej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kppici32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbgalmej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qljcoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adfgdpmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdkcde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gohaeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpekef32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbadcpbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgpgng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omegjomb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkpnga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oncofm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnifigpa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nemcjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djfcaohp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Facqkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdoihpbk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nelfeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dokgdkeh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ldjhpl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kocphojh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Foghnabl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inbqhhfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahgjejhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nenbjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kemhei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gcimkc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oiihahme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmkcqn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfoplpla.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aoabad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnicid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnkpnclp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qhhpop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnddgjbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehdmlhcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bciehh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gijekg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmenca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdiakp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojjolnaq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oidofh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hammhcij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkcadhgm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qqijje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgjljpkm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klfjijgq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbpbed32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpiljh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npchgdcd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ogklelna.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmfclm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hflcbngh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klpjad32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ledoegkm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ldfoad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eiobceef.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fahaplon.exe

Executes dropped EXE 64 IoCs

pid	Process
4824	Gcojed32.exe
2336	Gdqgmmjb.exe
1136	Ghopckpi.exe
624	Gbgdlq32.exe
1164	Gdeqhl32.exe
3376	Gkoiefmj.exe
764	Gbiaapdf.exe
4844	Gdhmnlcj.exe
2588	Gkaejf32.exe
4960	Gcimkc32.exe
2184	Hiefcj32.exe
4852	Hkdbpe32.exe
3368	Hbnjmp32.exe
5052	Helfik32.exe
4800	Hkfoeega.exe
3508	Hflcbngh.exe
4408	Hodgkc32.exe
3732	Hfnphn32.exe
4516	Himldi32.exe
2236	Hofdacke.exe
2492	Hkmefd32.exe
2748	Hcdmga32.exe
4532	Iiaephpc.exe
3840	Ikpaldog.exe
3460	Ibjjhn32.exe
672	Iehfdi32.exe
2424	Imoneg32.exe
4696	Icifbang.exe
4648	Iifokh32.exe
2732	Ildkgc32.exe
2796	Ibnccmbo.exe
4320	Iihkpg32.exe
2056	Ilghlc32.exe
3704	Icnpmp32.exe
3496	Ifllil32.exe
1832	Imfdff32.exe
2076	Icplcpgo.exe
1772	Jfoiokfb.exe
4120	Jeaikh32.exe
3716	Jmhale32.exe
3372	Jlkagbej.exe
3880	Jbeidl32.exe
3388	Jioaqfcc.exe
4348	Jcefno32.exe
1664	Jianff32.exe
4264	Jfeopj32.exe
2744	Jlednamo.exe
3692	Kiidgeki.exe
4440	Kbaipkbi.exe
3244	Kpgfooop.exe
552	Kibgmdcn.exe
3292	Lbjlfi32.exe
2272	Ldjhpl32.exe
232	Ligqhc32.exe
4968	Lpqiemge.exe
1316	Lenamdem.exe
2472	Likjcbkc.exe
4336	Lpebpm32.exe
4676	Nlaegk32.exe
996	Nckndeni.exe
3184	Oponmilc.exe
1988	Oncofm32.exe
640	Ojjolnaq.exe
928	Ocbddc32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Hkfoeega.exe	Helfik32.exe
File created	C:\Windows\SysWOW64\Egdeookg.dll	Micoed32.exe
File opened for modification	C:\Windows\SysWOW64\Fmpqfq32.exe	Fpjcgm32.exe
File created	C:\Windows\SysWOW64\Gbgdlq32.exe	Ghopckpi.exe
File created	C:\Windows\SysWOW64\Ehjhee32.dll	Famjkl32.exe
File created	C:\Windows\SysWOW64\Micoed32.exe	Malgcg32.exe
File created	C:\Windows\SysWOW64\Ajlgckkf.dll	Oimkbaed.exe
File opened for modification	C:\Windows\SysWOW64\Qcclld32.exe	Qohpkf32.exe
File created	C:\Windows\SysWOW64\Foghnabl.exe	Fgppmd32.exe
File created	C:\Windows\SysWOW64\Fmhgok32.dll	Epokedmj.exe
File created	C:\Windows\SysWOW64\Iahlcaol.exe	Ijadbdoj.exe
File opened for modification	C:\Windows\SysWOW64\Nhpbfpka.exe	Nbcjnilj.exe
File created	C:\Windows\SysWOW64\Nefped32.exe	Najceeoo.exe
File created	C:\Windows\SysWOW64\Cbbnpg32.exe	Cocacl32.exe
File opened for modification	C:\Windows\SysWOW64\Icfmci32.exe	Ijmhkchl.exe
File created	C:\Windows\SysWOW64\Hhodke32.dll	Khabke32.exe
File created	C:\Windows\SysWOW64\Jclhkbae.dll	Nckndeni.exe
File created	C:\Windows\SysWOW64\Mkankndb.dll	Kngcje32.exe
File created	C:\Windows\SysWOW64\Dajkgl32.dll	Jbfheo32.exe
File created	C:\Windows\SysWOW64\Oimkbaed.exe	Oklkdi32.exe
File created	C:\Windows\SysWOW64\Kahdohfm.dll	Dogogcpo.exe
File opened for modification	C:\Windows\SysWOW64\Lbqklb32.exe	Lhkgoiqe.exe
File created	C:\Windows\SysWOW64\Gdilpd32.dll	Ogklelna.exe
File opened for modification	C:\Windows\SysWOW64\Pomgjn32.exe	Pjpobg32.exe
File created	C:\Windows\SysWOW64\Cfadkb32.exe	Cpglnhad.exe
File opened for modification	C:\Windows\SysWOW64\Fkpool32.exe	Fhabbp32.exe
File created	C:\Windows\SysWOW64\Cmkjoj32.dll	Jbppgona.exe
File opened for modification	C:\Windows\SysWOW64\Khpgckkb.exe	Kfnkkb32.exe
File created	C:\Windows\SysWOW64\Ogpmjb32.exe	Olkhmi32.exe
File created	C:\Windows\SysWOW64\Cfikmcdh.dll	Kpgodhkd.exe
File created	C:\Windows\SysWOW64\Cpjdachc.dll	Dmihij32.exe
File created	C:\Windows\SysWOW64\Ihoofe32.dll	Iihkpg32.exe
File created	C:\Windows\SysWOW64\Pnpban32.dll	Kijchhbo.exe
File created	C:\Windows\SysWOW64\Majjng32.exe	Mnlnbl32.exe
File opened for modification	C:\Windows\SysWOW64\Bnoknihb.exe	Bnmoijje.exe
File created	C:\Windows\SysWOW64\Gjhfif32.exe	Gkefmjcj.exe
File opened for modification	C:\Windows\SysWOW64\Hqdkkp32.exe	Gjkbnfha.exe
File created	C:\Windows\SysWOW64\Pfogpg32.dll	Ejbbmnnb.exe
File created	C:\Windows\SysWOW64\Fcmpdfhi.dll	Licfngjd.exe
File created	C:\Windows\SysWOW64\Pomfkgml.dll	Jjihfbno.exe
File created	C:\Windows\SysWOW64\Nlnbgddc.exe	Nipekiep.exe
File created	C:\Windows\SysWOW64\Fbgnfajk.dll	Kbpbed32.exe
File opened for modification	C:\Windows\SysWOW64\Pqcjepfo.exe	Pfnegggi.exe
File created	C:\Windows\SysWOW64\Eplgeokq.exe	Eiaoid32.exe
File created	C:\Windows\SysWOW64\Eoaedogc.dll	Pkegpb32.exe
File created	C:\Windows\SysWOW64\Qhhpop32.exe	Pnkbkk32.exe
File opened for modification	C:\Windows\SysWOW64\Jjihfbno.exe	Jjgkab32.exe
File opened for modification	C:\Windows\SysWOW64\Gaogak32.exe	Foqkdp32.exe
File opened for modification	C:\Windows\SysWOW64\Gcimkc32.exe	Gkaejf32.exe
File created	C:\Windows\SysWOW64\Dhmgki32.exe	Daconoae.exe
File created	C:\Windows\SysWOW64\Oocmii32.exe	Oldamm32.exe
File created	C:\Windows\SysWOW64\Phedhmhi.exe	Pefhlaie.exe
File opened for modification	C:\Windows\SysWOW64\Gbgdlq32.exe	Ghopckpi.exe
File created	C:\Windows\SysWOW64\Hiefcj32.exe	Gcimkc32.exe
File created	C:\Windows\SysWOW64\Oponmilc.exe	Nckndeni.exe
File created	C:\Windows\SysWOW64\Ceifibod.dll	Qljcoj32.exe
File opened for modification	C:\Windows\SysWOW64\Pdhbmh32.exe	Pkpmdbfd.exe
File created	C:\Windows\SysWOW64\Gkaejf32.exe	Gdhmnlcj.exe
File opened for modification	C:\Windows\SysWOW64\Nemcjk32.exe	Mbognp32.exe
File created	C:\Windows\SysWOW64\Agdhbi32.exe	Amodep32.exe
File created	C:\Windows\SysWOW64\Bkmmaeap.exe	Bfpdin32.exe
File created	C:\Windows\SysWOW64\Bnoknihb.exe	Bnmoijje.exe
File opened for modification	C:\Windows\SysWOW64\Lobjni32.exe	Lqhdbm32.exe
File created	C:\Windows\SysWOW64\Clhgbgki.dll	Gjficg32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7772	12188	WerFault.exe	858

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dleglm32.dll"	Opemca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laniklje.dll"	Dpehof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfamapjo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hnhghcki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfbghcbm.dll"	Majjng32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gkkgpc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iokgal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiqhki32.dll"	Npchgdcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmkjoj32.dll"	Jbppgona.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkpnga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lenamdem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clghdi32.dll"	Hdmein32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlpokp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fccfqqkf.dll"	Bfpdin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cijpahho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lapmnano.dll"	Hnhkdd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Llfgke32.dll"	Khfkfedn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ccemjbpf.dll"	Gpkchqdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Leopnglc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gjaphgpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhoilahe.dll"	Jfeopj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nlnbgddc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Keceoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Onjegled.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pefhlaie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcgmfg32.dll"	Lcnmin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mjokgg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibpgqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfbkeh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jqdoem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ooiolbic.dll"	Qqffjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpglnhad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oihoif32.dll"	Eaqdegaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jbfheo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nenbjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hhihdcbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Neppokal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hkpheidp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Micfao32.dll"	Kbpkkn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qhhpop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qfcfml32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Neppokal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ibpiogmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mblkhq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnphmkji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iadenp32.dll"	Nolgijpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfnqklgh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Afhohlbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hhgloc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cbdjeg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iaedanal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bbiado32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hlambk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hgcmbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afjeceml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ajdjin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkkahahf.dll"	Nohehq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfghpl32.dll"	Deagdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lhkgoiqe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iedjmioj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhpbkngk.dll"	Najmjokc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gnqfcbnj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Okchnk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aeaanjkl.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 4824	460	f0301ef452c4e1e50bf7b3787e9fc4a4f927f7e65bee2b79f73a89c855066bcf.exe	89
PID 460 wrote to memory of 4824	460	f0301ef452c4e1e50bf7b3787e9fc4a4f927f7e65bee2b79f73a89c855066bcf.exe	89
PID 460 wrote to memory of 4824	460	f0301ef452c4e1e50bf7b3787e9fc4a4f927f7e65bee2b79f73a89c855066bcf.exe	89
PID 4824 wrote to memory of 2336	4824	Gcojed32.exe	90
PID 4824 wrote to memory of 2336	4824	Gcojed32.exe	90
PID 4824 wrote to memory of 2336	4824	Gcojed32.exe	90
PID 2336 wrote to memory of 1136	2336	Gdqgmmjb.exe	91
PID 2336 wrote to memory of 1136	2336	Gdqgmmjb.exe	91
PID 2336 wrote to memory of 1136	2336	Gdqgmmjb.exe	91
PID 1136 wrote to memory of 624	1136	Ghopckpi.exe	92
PID 1136 wrote to memory of 624	1136	Ghopckpi.exe	92
PID 1136 wrote to memory of 624	1136	Ghopckpi.exe	92
PID 624 wrote to memory of 1164	624	Gbgdlq32.exe	93
PID 624 wrote to memory of 1164	624	Gbgdlq32.exe	93
PID 624 wrote to memory of 1164	624	Gbgdlq32.exe	93
PID 1164 wrote to memory of 3376	1164	Gdeqhl32.exe	94
PID 1164 wrote to memory of 3376	1164	Gdeqhl32.exe	94
PID 1164 wrote to memory of 3376	1164	Gdeqhl32.exe	94
PID 3376 wrote to memory of 764	3376	Gkoiefmj.exe	95
PID 3376 wrote to memory of 764	3376	Gkoiefmj.exe	95
PID 3376 wrote to memory of 764	3376	Gkoiefmj.exe	95
PID 764 wrote to memory of 4844	764	Gbiaapdf.exe	96
PID 764 wrote to memory of 4844	764	Gbiaapdf.exe	96
PID 764 wrote to memory of 4844	764	Gbiaapdf.exe	96
PID 4844 wrote to memory of 2588	4844	Gdhmnlcj.exe	97
PID 4844 wrote to memory of 2588	4844	Gdhmnlcj.exe	97
PID 4844 wrote to memory of 2588	4844	Gdhmnlcj.exe	97
PID 2588 wrote to memory of 4960	2588	Gkaejf32.exe	98
PID 2588 wrote to memory of 4960	2588	Gkaejf32.exe	98
PID 2588 wrote to memory of 4960	2588	Gkaejf32.exe	98
PID 4960 wrote to memory of 2184	4960	Gcimkc32.exe	99
PID 4960 wrote to memory of 2184	4960	Gcimkc32.exe	99
PID 4960 wrote to memory of 2184	4960	Gcimkc32.exe	99
PID 2184 wrote to memory of 4852	2184	Hiefcj32.exe	100
PID 2184 wrote to memory of 4852	2184	Hiefcj32.exe	100
PID 2184 wrote to memory of 4852	2184	Hiefcj32.exe	100
PID 4852 wrote to memory of 3368	4852	Hkdbpe32.exe	101
PID 4852 wrote to memory of 3368	4852	Hkdbpe32.exe	101
PID 4852 wrote to memory of 3368	4852	Hkdbpe32.exe	101
PID 3368 wrote to memory of 5052	3368	Hbnjmp32.exe	102
PID 3368 wrote to memory of 5052	3368	Hbnjmp32.exe	102
PID 3368 wrote to memory of 5052	3368	Hbnjmp32.exe	102
PID 5052 wrote to memory of 4800	5052	Helfik32.exe	103
PID 5052 wrote to memory of 4800	5052	Helfik32.exe	103
PID 5052 wrote to memory of 4800	5052	Helfik32.exe	103
PID 4800 wrote to memory of 3508	4800	Hkfoeega.exe	104
PID 4800 wrote to memory of 3508	4800	Hkfoeega.exe	104
PID 4800 wrote to memory of 3508	4800	Hkfoeega.exe	104
PID 3508 wrote to memory of 4408	3508	Hflcbngh.exe	105
PID 3508 wrote to memory of 4408	3508	Hflcbngh.exe	105
PID 3508 wrote to memory of 4408	3508	Hflcbngh.exe	105
PID 4408 wrote to memory of 3732	4408	Hodgkc32.exe	106
PID 4408 wrote to memory of 3732	4408	Hodgkc32.exe	106
PID 4408 wrote to memory of 3732	4408	Hodgkc32.exe	106
PID 3732 wrote to memory of 4516	3732	Hfnphn32.exe	107
PID 3732 wrote to memory of 4516	3732	Hfnphn32.exe	107
PID 3732 wrote to memory of 4516	3732	Hfnphn32.exe	107
PID 4516 wrote to memory of 2236	4516	Himldi32.exe	108
PID 4516 wrote to memory of 2236	4516	Himldi32.exe	108
PID 4516 wrote to memory of 2236	4516	Himldi32.exe	108
PID 2236 wrote to memory of 2492	2236	Hofdacke.exe	109
PID 2236 wrote to memory of 2492	2236	Hofdacke.exe	109
PID 2236 wrote to memory of 2492	2236	Hofdacke.exe	109
PID 2492 wrote to memory of 2748	2492	Hkmefd32.exe	110

C:\Users\Admin\AppData\Local\Temp\f0301ef452c4e1e50bf7b3787e9fc4a4f927f7e65bee2b79f73a89c855066bcf.exe
"C:\Users\Admin\AppData\Local\Temp\f0301ef452c4e1e50bf7b3787e9fc4a4f927f7e65bee2b79f73a89c855066bcf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:460
- C:\Windows\SysWOW64\Gcojed32.exe
  C:\Windows\system32\Gcojed32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\SysWOW64\Gdqgmmjb.exe
    C:\Windows\system32\Gdqgmmjb.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Windows\SysWOW64\Ghopckpi.exe
      C:\Windows\system32\Ghopckpi.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1136
    - - C:\Windows\SysWOW64\Gbgdlq32.exe
        
        C:\Windows\system32\Gbgdlq32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:624
      - C:\Windows\SysWOW64\Gdeqhl32.exe
        
        C:\Windows\system32\Gdeqhl32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1164
        
        C:\Windows\SysWOW64\Gkoiefmj.exe
        
        C:\Windows\system32\Gkoiefmj.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3376
        
        C:\Windows\SysWOW64\Gbiaapdf.exe
        
        C:\Windows\system32\Gbiaapdf.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:764
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4844
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2588
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4960
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2184
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Windows\SysWOW64\Hbnjmp32.exe
        
        C:\Windows\system32\Hbnjmp32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3368
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3508
        
        C:\Windows\SysWOW64\Hodgkc32.exe
        
        C:\Windows\system32\Hodgkc32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4408
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3732
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4516
        
        C:\Windows\SysWOW64\Hofdacke.exe
        
        C:\Windows\system32\Hofdacke.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2236
        
        C:\Windows\SysWOW64\Hkmefd32.exe
        
        C:\Windows\system32\Hkmefd32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2492
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        23⤵
        Executes dropped EXE
        
        PID:2748
        
        C:\Windows\SysWOW64\Iiaephpc.exe
        
        C:\Windows\system32\Iiaephpc.exe
        24⤵
        Executes dropped EXE
        
        PID:4532
        
        C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        25⤵
        Executes dropped EXE
        
        PID:3840
        
        C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        26⤵
        Executes dropped EXE
        
        PID:3460
        
        C:\Windows\SysWOW64\Iehfdi32.exe
        
        C:\Windows\system32\Iehfdi32.exe
        27⤵
        Executes dropped EXE
        
        PID:672
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        28⤵
        Executes dropped EXE
        
        PID:2424
        
        C:\Windows\SysWOW64\Icifbang.exe
        
        C:\Windows\system32\Icifbang.exe
        29⤵
        Executes dropped EXE
        
        PID:4696
        
        C:\Windows\SysWOW64\Iifokh32.exe
        
        C:\Windows\system32\Iifokh32.exe
        30⤵
        Executes dropped EXE
        
        PID:4648
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        31⤵
        Executes dropped EXE
        
        PID:2732
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        32⤵
        Executes dropped EXE
        
        PID:2796
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4320
        
        C:\Windows\SysWOW64\Ilghlc32.exe
        
        C:\Windows\system32\Ilghlc32.exe
        34⤵
        Executes dropped EXE
        
        PID:2056
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        35⤵
        Executes dropped EXE
        
        PID:3704
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        36⤵
        Executes dropped EXE
        
        PID:3496
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        37⤵
        Executes dropped EXE
        
        PID:1832
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        38⤵
        Executes dropped EXE
        
        PID:2076
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        39⤵
        Executes dropped EXE
        
        PID:1772
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        40⤵
        Executes dropped EXE
        
        PID:4120
        
        C:\Windows\SysWOW64\Jmhale32.exe
        
        C:\Windows\system32\Jmhale32.exe
        41⤵
        Executes dropped EXE
        
        PID:3716
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        42⤵
        Executes dropped EXE
        
        PID:3372
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        43⤵
        Executes dropped EXE
        
        PID:3880
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        44⤵
        Executes dropped EXE
        
        PID:3388
        
        C:\Windows\SysWOW64\Jcefno32.exe
        
        C:\Windows\system32\Jcefno32.exe
        45⤵
        Executes dropped EXE
        
        PID:4348
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        46⤵
        Executes dropped EXE
        
        PID:1664
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        47⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4264
        
        C:\Windows\SysWOW64\Jlednamo.exe
        
        C:\Windows\system32\Jlednamo.exe
        48⤵
        Executes dropped EXE
        
        PID:2744
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        49⤵
        Executes dropped EXE
        
        PID:3692
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        50⤵
        Executes dropped EXE
        
        PID:4440
        
        C:\Windows\SysWOW64\Kpgfooop.exe
        
        C:\Windows\system32\Kpgfooop.exe
        51⤵
        Executes dropped EXE
        
        PID:3244
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        52⤵
        Executes dropped EXE
        
        PID:552
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        53⤵
        Executes dropped EXE
        
        PID:3292
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2272
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        55⤵
        Executes dropped EXE
        
        PID:232
        
        C:\Windows\SysWOW64\Lpqiemge.exe
        
        C:\Windows\system32\Lpqiemge.exe
        56⤵
        Executes dropped EXE
        
        PID:4968
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1316
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        58⤵
        Executes dropped EXE
        
        PID:2472
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        59⤵
        Executes dropped EXE
        
        PID:4336
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        60⤵
        Executes dropped EXE
        
        PID:4676
        
        C:\Windows\SysWOW64\Nckndeni.exe
        
        C:\Windows\system32\Nckndeni.exe
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:996
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        62⤵
        Executes dropped EXE
        
        PID:3184
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1988
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:640
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        65⤵
        Executes dropped EXE
        
        PID:928
        
        C:\Windows\SysWOW64\Olkhmi32.exe
        
        C:\Windows\system32\Olkhmi32.exe
        66⤵
        Drops file in System32 directory
        
        PID:4724
        
        C:\Windows\SysWOW64\Ogpmjb32.exe
        
        C:\Windows\system32\Ogpmjb32.exe
        67⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\Onjegled.exe
        
        C:\Windows\system32\Onjegled.exe
        68⤵
        Modifies registry class
        
        PID:4940
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        69⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        70⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        71⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        72⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        73⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4520
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        75⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        76⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\Pqdqof32.exe
        
        C:\Windows\system32\Pqdqof32.exe
        77⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        78⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        79⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\Qqfmde32.exe
        
        C:\Windows\system32\Qqfmde32.exe
        80⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        81⤵
        Modifies registry class
        
        PID:2728
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4216
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        83⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        84⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        85⤵
        Modifies registry class
        
        PID:5236
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        86⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Afjlnk32.exe
        
        C:\Windows\system32\Afjlnk32.exe
        87⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        88⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        89⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Aglemn32.exe
        
        C:\Windows\system32\Aglemn32.exe
        90⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5508
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        92⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        93⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        94⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        95⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        96⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        97⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        98⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        99⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Cabfga32.exe
        
        C:\Windows\system32\Cabfga32.exe
        100⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        101⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        102⤵
        Modifies registry class
        
        PID:6004
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        103⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        104⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        105⤵
        
        PID:932
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        106⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        107⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        108⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        109⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        110⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        111⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5660
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        113⤵
        Drops file in System32 directory
        
        PID:5696
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        114⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Dogogcpo.exe
        
        C:\Windows\system32\Dogogcpo.exe
        115⤵
        Drops file in System32 directory
        
        PID:5900
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        116⤵
        Modifies registry class
        
        PID:5988
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        117⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        118⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Ehapfiem.exe
        
        C:\Windows\system32\Ehapfiem.exe
        119⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Eolhbc32.exe
        
        C:\Windows\system32\Eolhbc32.exe
        120⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Ehdmlhcj.exe
        
        C:\Windows\system32\Ehdmlhcj.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5668
        
        C:\Windows\SysWOW64\Ekbihd32.exe
        
        C:\Windows\system32\Ekbihd32.exe
        122⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Emaedo32.exe
        
        C:\Windows\system32\Emaedo32.exe
        123⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Edknqiho.exe
        
        C:\Windows\system32\Edknqiho.exe
        124⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Ekefmc32.exe
        
        C:\Windows\system32\Ekefmc32.exe
        125⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Eaonjngh.exe
        
        C:\Windows\system32\Eaonjngh.exe
        126⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Ekgbccni.exe
        
        C:\Windows\system32\Ekgbccni.exe
        127⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Eaakpm32.exe
        
        C:\Windows\system32\Eaakpm32.exe
        128⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Egnchd32.exe
        
        C:\Windows\system32\Egnchd32.exe
        129⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Emhldnkj.exe
        
        C:\Windows\system32\Emhldnkj.exe
        130⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Fdbdah32.exe
        
        C:\Windows\system32\Fdbdah32.exe
        131⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Fgppmd32.exe
        
        C:\Windows\system32\Fgppmd32.exe
        132⤵
        Drops file in System32 directory
        
        PID:6288
        
        C:\Windows\SysWOW64\Foghnabl.exe
        
        C:\Windows\system32\Foghnabl.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6336
        
        C:\Windows\SysWOW64\Fhpmgg32.exe
        
        C:\Windows\system32\Fhpmgg32.exe
        134⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Fojedapj.exe
        
        C:\Windows\system32\Fojedapj.exe
        135⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Fahaplon.exe
        
        C:\Windows\system32\Fahaplon.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6472
        
        C:\Windows\SysWOW64\Fedmqk32.exe
        
        C:\Windows\system32\Fedmqk32.exe
        137⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Fnobem32.exe
        
        C:\Windows\system32\Fnobem32.exe
        138⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Fdijbg32.exe
        
        C:\Windows\system32\Fdijbg32.exe
        139⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Famjkl32.exe
        
        C:\Windows\system32\Famjkl32.exe
        140⤵
        Drops file in System32 directory
        
        PID:6680
        
        C:\Windows\SysWOW64\Fhgbhfbe.exe
        
        C:\Windows\system32\Fhgbhfbe.exe
        141⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Foqkdp32.exe
        
        C:\Windows\system32\Foqkdp32.exe
        142⤵
        Drops file in System32 directory
        
        PID:6780
        
        C:\Windows\SysWOW64\Gaogak32.exe
        
        C:\Windows\system32\Gaogak32.exe
        143⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Gglpibgm.exe
        
        C:\Windows\system32\Gglpibgm.exe
        144⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Gaadfkgc.exe
        
        C:\Windows\system32\Gaadfkgc.exe
        145⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Gohaeo32.exe
        
        C:\Windows\system32\Gohaeo32.exe
        146⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7012
        
        C:\Windows\SysWOW64\Gafmaj32.exe
        
        C:\Windows\system32\Gafmaj32.exe
        147⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Ghpendjj.exe
        
        C:\Windows\system32\Ghpendjj.exe
        148⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Gahjgj32.exe
        
        C:\Windows\system32\Gahjgj32.exe
        149⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Ghbbcd32.exe
        
        C:\Windows\system32\Ghbbcd32.exe
        150⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Goljqnpd.exe
        
        C:\Windows\system32\Goljqnpd.exe
        151⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Hakgmjoh.exe
        
        C:\Windows\system32\Hakgmjoh.exe
        152⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Hfipbh32.exe
        
        C:\Windows\system32\Hfipbh32.exe
        153⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Hhgloc32.exe
        
        C:\Windows\system32\Hhgloc32.exe
        154⤵
        Modifies registry class
        
        PID:6456
        
        C:\Windows\SysWOW64\Hgjljpkm.exe
        
        C:\Windows\system32\Hgjljpkm.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2308
        
        C:\Windows\SysWOW64\Hnddgjbj.exe
        
        C:\Windows\system32\Hnddgjbj.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6584
        
        C:\Windows\SysWOW64\Hbpphi32.exe
        
        C:\Windows\system32\Hbpphi32.exe
        157⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Hhihdcbp.exe
        
        C:\Windows\system32\Hhihdcbp.exe
        158⤵
        Modifies registry class
        
        PID:6712
        
        C:\Windows\SysWOW64\Hocqam32.exe
        
        C:\Windows\system32\Hocqam32.exe
        159⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Hbbmmi32.exe
        
        C:\Windows\system32\Hbbmmi32.exe
        160⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Hgoeep32.exe
        
        C:\Windows\system32\Hgoeep32.exe
        161⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Hbdjchgn.exe
        
        C:\Windows\system32\Hbdjchgn.exe
        162⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Hkmnln32.exe
        
        C:\Windows\system32\Hkmnln32.exe
        163⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Ibffhhek.exe
        
        C:\Windows\system32\Ibffhhek.exe
        164⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Ihqoeb32.exe
        
        C:\Windows\system32\Ihqoeb32.exe
        165⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Iokgal32.exe
        
        C:\Windows\system32\Iokgal32.exe
        166⤵
        Modifies registry class
        
        PID:6400
        
        C:\Windows\SysWOW64\Inmgmijo.exe
        
        C:\Windows\system32\Inmgmijo.exe
        167⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Ikaggmii.exe
        
        C:\Windows\system32\Ikaggmii.exe
        168⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Ighhln32.exe
        
        C:\Windows\system32\Ighhln32.exe
        169⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Inbqhhfj.exe
        
        C:\Windows\system32\Inbqhhfj.exe
        170⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1620
        
        C:\Windows\SysWOW64\Ifihif32.exe
        
        C:\Windows\system32\Ifihif32.exe
        171⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Ikfabm32.exe
        
        C:\Windows\system32\Ikfabm32.exe
        172⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Ibpiogmp.exe
        
        C:\Windows\system32\Ibpiogmp.exe
        173⤵
        Modifies registry class
        
        PID:7044
        
        C:\Windows\SysWOW64\Ienekbld.exe
        
        C:\Windows\system32\Ienekbld.exe
        174⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Jkhngl32.exe
        
        C:\Windows\system32\Jkhngl32.exe
        175⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Jngjch32.exe
        
        C:\Windows\system32\Jngjch32.exe
        176⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\Jfnbdecg.exe
        
        C:\Windows\system32\Jfnbdecg.exe
        177⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Jilnqqbj.exe
        
        C:\Windows\system32\Jilnqqbj.exe
        178⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Jkkjmlan.exe
        
        C:\Windows\system32\Jkkjmlan.exe
        179⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Jnifigpa.exe
        
        C:\Windows\system32\Jnifigpa.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7144
        
        C:\Windows\SysWOW64\Jiokfpph.exe
        
        C:\Windows\system32\Jiokfpph.exe
        181⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Jnkcogno.exe
        
        C:\Windows\system32\Jnkcogno.exe
        182⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Jgdhgmep.exe
        
        C:\Windows\system32\Jgdhgmep.exe
        183⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Jnnpdg32.exe
        
        C:\Windows\system32\Jnnpdg32.exe
        184⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Jbileede.exe
        
        C:\Windows\system32\Jbileede.exe
        185⤵
        
        PID:3196
        
        C:\Windows\SysWOW64\Jkaqnk32.exe
        
        C:\Windows\system32\Jkaqnk32.exe
        186⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Jieagojp.exe
        
        C:\Windows\system32\Jieagojp.exe
        187⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Kppici32.exe
        
        C:\Windows\system32\Kppici32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4460
        
        C:\Windows\SysWOW64\Kbnepe32.exe
        
        C:\Windows\system32\Kbnepe32.exe
        189⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\Kihnmohm.exe
        
        C:\Windows\system32\Kihnmohm.exe
        190⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Klfjijgq.exe
        
        C:\Windows\system32\Klfjijgq.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6536
        
        C:\Windows\SysWOW64\Kbpbed32.exe
        
        C:\Windows\system32\Kbpbed32.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6892
        
        C:\Windows\SysWOW64\Khmknk32.exe
        
        C:\Windows\system32\Khmknk32.exe
        193⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Kngcje32.exe
        
        C:\Windows\system32\Kngcje32.exe
        194⤵
        Drops file in System32 directory
        
        PID:7256
        
        C:\Windows\SysWOW64\Kfnkkb32.exe
        
        C:\Windows\system32\Kfnkkb32.exe
        195⤵
        Drops file in System32 directory
        
        PID:7296
        
        C:\Windows\SysWOW64\Khpgckkb.exe
        
        C:\Windows\system32\Khpgckkb.exe
        196⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Kpgodhkd.exe
        
        C:\Windows\system32\Kpgodhkd.exe
        197⤵
        Drops file in System32 directory
        
        PID:7376
        
        C:\Windows\SysWOW64\Kbekqdjh.exe
        
        C:\Windows\system32\Kbekqdjh.exe
        198⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Kiodmn32.exe
        
        C:\Windows\system32\Kiodmn32.exe
        199⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Kpiljh32.exe
        
        C:\Windows\system32\Kpiljh32.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7496
        
        C:\Windows\SysWOW64\Knlleepl.exe
        
        C:\Windows\system32\Knlleepl.exe
        201⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Kfcdfbqo.exe
        
        C:\Windows\system32\Kfcdfbqo.exe
        202⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Lhdqnj32.exe
        
        C:\Windows\system32\Lhdqnj32.exe
        203⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Lpkiph32.exe
        
        C:\Windows\system32\Lpkiph32.exe
        204⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Lfealaol.exe
        
        C:\Windows\system32\Lfealaol.exe
        205⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Lpneegel.exe
        
        C:\Windows\system32\Lpneegel.exe
        206⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Lfhnaa32.exe
        
        C:\Windows\system32\Lfhnaa32.exe
        207⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Locbfd32.exe
        
        C:\Windows\system32\Locbfd32.exe
        208⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Lhkgoiqe.exe
        
        C:\Windows\system32\Lhkgoiqe.exe
        209⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7872
        
        C:\Windows\SysWOW64\Lbqklb32.exe
        
        C:\Windows\system32\Lbqklb32.exe
        210⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Leoghn32.exe
        
        C:\Windows\system32\Leoghn32.exe
        211⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Lpekef32.exe
        
        C:\Windows\system32\Lpekef32.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8004
        
        C:\Windows\SysWOW64\Leadnm32.exe
        
        C:\Windows\system32\Leadnm32.exe
        213⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Mpghkf32.exe
        
        C:\Windows\system32\Mpghkf32.exe
        214⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Medqcmki.exe
        
        C:\Windows\system32\Medqcmki.exe
        215⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Mlnipg32.exe
        
        C:\Windows\system32\Mlnipg32.exe
        216⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Molelb32.exe
        
        C:\Windows\system32\Molelb32.exe
        217⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Mefmimif.exe
        
        C:\Windows\system32\Mefmimif.exe
        218⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Mlpeff32.exe
        
        C:\Windows\system32\Mlpeff32.exe
        219⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Moobbb32.exe
        
        C:\Windows\system32\Moobbb32.exe
        220⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Mffjcopi.exe
        
        C:\Windows\system32\Mffjcopi.exe
        221⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Mlbbkfoq.exe
        
        C:\Windows\system32\Mlbbkfoq.exe
        222⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Mblkhq32.exe
        
        C:\Windows\system32\Mblkhq32.exe
        223⤵
        Modifies registry class
        
        PID:7584
        
        C:\Windows\SysWOW64\Mifcejnj.exe
        
        C:\Windows\system32\Mifcejnj.exe
        224⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Mpqkad32.exe
        
        C:\Windows\system32\Mpqkad32.exe
        225⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Mbognp32.exe
        
        C:\Windows\system32\Mbognp32.exe
        226⤵
        Drops file in System32 directory
        
        PID:7780
        
        C:\Windows\SysWOW64\Nemcjk32.exe
        
        C:\Windows\system32\Nemcjk32.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7836
        
        C:\Windows\SysWOW64\Npchgdcd.exe
        
        C:\Windows\system32\Npchgdcd.exe
        228⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7900
        
        C:\Windows\SysWOW64\Nbadcpbh.exe
        
        C:\Windows\system32\Nbadcpbh.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7964
        
        C:\Windows\SysWOW64\Neppokal.exe
        
        C:\Windows\system32\Neppokal.exe
        230⤵
        Modifies registry class
        
        PID:8044
        
        C:\Windows\SysWOW64\Niklpj32.exe
        
        C:\Windows\system32\Niklpj32.exe
        231⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Nohehq32.exe
        
        C:\Windows\system32\Nohehq32.exe
        232⤵
        Modifies registry class
        
        PID:6256
        
        C:\Windows\SysWOW64\Nebmekoi.exe
        
        C:\Windows\system32\Nebmekoi.exe
        233⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Nhpiafnm.exe
        
        C:\Windows\system32\Nhpiafnm.exe
        234⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Npgabc32.exe
        
        C:\Windows\system32\Npgabc32.exe
        235⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Ncfmno32.exe
        
        C:\Windows\system32\Ncfmno32.exe
        236⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Ngaionfl.exe
        
        C:\Windows\system32\Ngaionfl.exe
        237⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Nipekiep.exe
        
        C:\Windows\system32\Nipekiep.exe
        238⤵
        Drops file in System32 directory
        
        PID:7812
        
        C:\Windows\SysWOW64\Nlnbgddc.exe
        
        C:\Windows\system32\Nlnbgddc.exe
        239⤵
        Modifies registry class
        
        PID:7944
        
        C:\Windows\SysWOW64\Nomncpcg.exe
        
        C:\Windows\system32\Nomncpcg.exe
        240⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Ngdfdmdi.exe
        
        C:\Windows\system32\Ngdfdmdi.exe
        241⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Nheble32.exe
        
        C:\Windows\system32\Nheble32.exe
        242⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Oidofh32.exe
        
        C:\Windows\system32\Oidofh32.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7600
        
        C:\Windows\SysWOW64\Olckbd32.exe
        
        C:\Windows\system32\Olckbd32.exe
        244⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Opogbbig.exe
        
        C:\Windows\system32\Opogbbig.exe
        245⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Ocmconhk.exe
        
        C:\Windows\system32\Ocmconhk.exe
        246⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Olehhc32.exe
        
        C:\Windows\system32\Olehhc32.exe
        247⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Oocddono.exe
        
        C:\Windows\system32\Oocddono.exe
        248⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Ogklelna.exe
        
        C:\Windows\system32\Ogklelna.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8236
        
        C:\Windows\SysWOW64\Oiihahme.exe
        
        C:\Windows\system32\Oiihahme.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8292
        
        C:\Windows\SysWOW64\Olgemcli.exe
        
        C:\Windows\system32\Olgemcli.exe
        251⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Ocamjm32.exe
        
        C:\Windows\system32\Ocamjm32.exe
        252⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Oepifi32.exe
        
        C:\Windows\system32\Oepifi32.exe
        253⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Opemca32.exe
        
        C:\Windows\system32\Opemca32.exe
        254⤵
        Modifies registry class
        
        PID:8504
        
        C:\Windows\SysWOW64\Pjpobg32.exe
        
        C:\Windows\system32\Pjpobg32.exe
        255⤵
        Drops file in System32 directory
        
        PID:8540
        
        C:\Windows\SysWOW64\Pomgjn32.exe
        
        C:\Windows\system32\Pomgjn32.exe
        256⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Phelcc32.exe
        
        C:\Windows\system32\Phelcc32.exe
        257⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Poodpmca.exe
        
        C:\Windows\system32\Poodpmca.exe
        258⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Pfillg32.exe
        
        C:\Windows\system32\Pfillg32.exe
        259⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Phhhhc32.exe
        
        C:\Windows\system32\Phhhhc32.exe
        260⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Pcmlfl32.exe
        
        C:\Windows\system32\Pcmlfl32.exe
        261⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Pleaoa32.exe
        
        C:\Windows\system32\Pleaoa32.exe
        262⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Pfnegggi.exe
        
        C:\Windows\system32\Pfnegggi.exe
        263⤵
        Drops file in System32 directory
        
        PID:8868
        
        C:\Windows\SysWOW64\Pqcjepfo.exe
        
        C:\Windows\system32\Pqcjepfo.exe
        264⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Qcbfakec.exe
        
        C:\Windows\system32\Qcbfakec.exe
        265⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Qfpbmfdf.exe
        
        C:\Windows\system32\Qfpbmfdf.exe
        266⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Qqffjo32.exe
        
        C:\Windows\system32\Qqffjo32.exe
        267⤵
        Modifies registry class
        
        PID:9028
        
        C:\Windows\SysWOW64\Qcdbfk32.exe
        
        C:\Windows\system32\Qcdbfk32.exe
        268⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Qfbobf32.exe
        
        C:\Windows\system32\Qfbobf32.exe
        269⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        270⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Acgolj32.exe
        
        C:\Windows\system32\Acgolj32.exe
        271⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Ajqgidij.exe
        
        C:\Windows\system32\Ajqgidij.exe
        272⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Amodep32.exe
        
        C:\Windows\system32\Amodep32.exe
        273⤵
        Drops file in System32 directory
        
        PID:8228
        
        C:\Windows\SysWOW64\Agdhbi32.exe
        
        C:\Windows\system32\Agdhbi32.exe
        274⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Ahfdjanb.exe
        
        C:\Windows\system32\Ahfdjanb.exe
        275⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Ackigjmh.exe
        
        C:\Windows\system32\Ackigjmh.exe
        276⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Afjeceml.exe
        
        C:\Windows\system32\Afjeceml.exe
        277⤵
        Modifies registry class
        
        PID:8484
        
        C:\Windows\SysWOW64\Aobilkcl.exe
        
        C:\Windows\system32\Aobilkcl.exe
        278⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Aijnep32.exe
        
        C:\Windows\system32\Aijnep32.exe
        279⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Aglnbhal.exe
        
        C:\Windows\system32\Aglnbhal.exe
        280⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Ajjjocap.exe
        
        C:\Windows\system32\Ajjjocap.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8780
        
        C:\Windows\SysWOW64\Bfqkddfd.exe
        
        C:\Windows\system32\Bfqkddfd.exe
        282⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Bmkcqn32.exe
        
        C:\Windows\system32\Bmkcqn32.exe
        283⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8916
        
        C:\Windows\SysWOW64\Boipmj32.exe
        
        C:\Windows\system32\Boipmj32.exe
        284⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Bgpgng32.exe
        
        C:\Windows\system32\Bgpgng32.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9060
        
        C:\Windows\SysWOW64\Biadeoce.exe
        
        C:\Windows\system32\Biadeoce.exe
        286⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Bqilgmdg.exe
        
        C:\Windows\system32\Bqilgmdg.exe
        287⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Bidqko32.exe
        
        C:\Windows\system32\Bidqko32.exe
        288⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Bciehh32.exe
        
        C:\Windows\system32\Bciehh32.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8332
        
        C:\Windows\SysWOW64\Bppfmigl.exe
        
        C:\Windows\system32\Bppfmigl.exe
        290⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Cmdfgm32.exe
        
        C:\Windows\system32\Cmdfgm32.exe
        291⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Cflkpblf.exe
        
        C:\Windows\system32\Cflkpblf.exe
        292⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Cmfclm32.exe
        
        C:\Windows\system32\Cmfclm32.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8816
        
        C:\Windows\SysWOW64\Cpeohh32.exe
        
        C:\Windows\system32\Cpeohh32.exe
        294⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Cglgjeci.exe
        
        C:\Windows\system32\Cglgjeci.exe
        295⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        296⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Cpglnhad.exe
        
        C:\Windows\system32\Cpglnhad.exe
        297⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1968
        
        C:\Windows\SysWOW64\Cfadkb32.exe
        
        C:\Windows\system32\Cfadkb32.exe
        298⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Cmklglpn.exe
        
        C:\Windows\system32\Cmklglpn.exe
        299⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Cpihcgoa.exe
        
        C:\Windows\system32\Cpihcgoa.exe
        300⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Cgqqdeod.exe
        
        C:\Windows\system32\Cgqqdeod.exe
        301⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Caienjfd.exe
        
        C:\Windows\system32\Caienjfd.exe
        302⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Cffmfadl.exe
        
        C:\Windows\system32\Cffmfadl.exe
        303⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Djdflp32.exe
        
        C:\Windows\system32\Djdflp32.exe
        304⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Dannij32.exe
        
        C:\Windows\system32\Dannij32.exe
        305⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Djfcaohp.exe
        
        C:\Windows\system32\Djfcaohp.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8252
        
        C:\Windows\SysWOW64\Dapkni32.exe
        
        C:\Windows\system32\Dapkni32.exe
        307⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Dhjckcgi.exe
        
        C:\Windows\system32\Dhjckcgi.exe
        308⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Dikpbl32.exe
        
        C:\Windows\system32\Dikpbl32.exe
        309⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Dpehof32.exe
        
        C:\Windows\system32\Dpehof32.exe
        310⤵
        Modifies registry class
        
        PID:5872
        
        C:\Windows\SysWOW64\Dfoplpla.exe
        
        C:\Windows\system32\Dfoplpla.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3876
        
        C:\Windows\SysWOW64\Dmihij32.exe
        
        C:\Windows\system32\Dmihij32.exe
        312⤵
        Drops file in System32 directory
        
        PID:5852
        
        C:\Windows\SysWOW64\Dpgeee32.exe
        
        C:\Windows\system32\Dpgeee32.exe
        313⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Dfamapjo.exe
        
        C:\Windows\system32\Dfamapjo.exe
        314⤵
        Modifies registry class
        
        PID:2100
        
        C:\Windows\SysWOW64\Emlenj32.exe
        
        C:\Windows\system32\Emlenj32.exe
        315⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        316⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Ejpfhnpe.exe
        
        C:\Windows\system32\Ejpfhnpe.exe
        317⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Edhjqc32.exe
        
        C:\Windows\system32\Edhjqc32.exe
        318⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Ejbbmnnb.exe
        
        C:\Windows\system32\Ejbbmnnb.exe
        319⤵
        Drops file in System32 directory
        
        PID:9400
        
        C:\Windows\SysWOW64\Empoiimf.exe
        
        C:\Windows\system32\Empoiimf.exe
        320⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Epokedmj.exe
        
        C:\Windows\system32\Epokedmj.exe
        321⤵
        Drops file in System32 directory
        
        PID:9480
        
        C:\Windows\SysWOW64\Ehfcfb32.exe
        
        C:\Windows\system32\Ehfcfb32.exe
        322⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Eigonjcj.exe
        
        C:\Windows\system32\Eigonjcj.exe
        323⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Edmclccp.exe
        
        C:\Windows\system32\Edmclccp.exe
        324⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Eiildjag.exe
        
        C:\Windows\system32\Eiildjag.exe
        325⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Eaqdegaj.exe
        
        C:\Windows\system32\Eaqdegaj.exe
        326⤵
        Modifies registry class
        
        PID:9676
        
        C:\Windows\SysWOW64\Edopabqn.exe
        
        C:\Windows\system32\Edopabqn.exe
        327⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Efmmmn32.exe
        
        C:\Windows\system32\Efmmmn32.exe
        328⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Filiii32.exe
        
        C:\Windows\system32\Filiii32.exe
        329⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Facqkg32.exe
        
        C:\Windows\system32\Facqkg32.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9840
        
        C:\Windows\SysWOW64\Fdamgb32.exe
        
        C:\Windows\system32\Fdamgb32.exe
        331⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        332⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Fineoi32.exe
        
        C:\Windows\system32\Fineoi32.exe
        333⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Faenpf32.exe
        
        C:\Windows\system32\Faenpf32.exe
        334⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Fdcjlb32.exe
        
        C:\Windows\system32\Fdcjlb32.exe
        335⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Fknbil32.exe
        
        C:\Windows\system32\Fknbil32.exe
        336⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Fhabbp32.exe
        
        C:\Windows\system32\Fhabbp32.exe
        337⤵
        Drops file in System32 directory
        
        PID:10116
        
        C:\Windows\SysWOW64\Fkpool32.exe
        
        C:\Windows\system32\Fkpool32.exe
        338⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Fmnkkg32.exe
        
        C:\Windows\system32\Fmnkkg32.exe
        339⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        340⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Fhflnpoi.exe
        
        C:\Windows\system32\Fhflnpoi.exe
        341⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Gigheh32.exe
        
        C:\Windows\system32\Gigheh32.exe
        342⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Gaopfe32.exe
        
        C:\Windows\system32\Gaopfe32.exe
        343⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Gijekg32.exe
        
        C:\Windows\system32\Gijekg32.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9464
        
        C:\Windows\SysWOW64\Gmeakf32.exe
        
        C:\Windows\system32\Gmeakf32.exe
        345⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Gdoihpbk.exe
        
        C:\Windows\system32\Gdoihpbk.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9596
        
        C:\Windows\SysWOW64\Ggnedlao.exe
        
        C:\Windows\system32\Ggnedlao.exe
        347⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Gnhnaf32.exe
        
        C:\Windows\system32\Gnhnaf32.exe
        348⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Gdafnpqh.exe
        
        C:\Windows\system32\Gdafnpqh.exe
        349⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Ginnfgop.exe
        
        C:\Windows\system32\Ginnfgop.exe
        350⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Gaefgd32.exe
        
        C:\Windows\system32\Gaefgd32.exe
        351⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Ghpocngo.exe
        
        C:\Windows\system32\Ghpocngo.exe
        352⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Gnlgleef.exe
        
        C:\Windows\system32\Gnlgleef.exe
        353⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Gpkchqdj.exe
        
        C:\Windows\system32\Gpkchqdj.exe
        354⤵
        Modifies registry class
        
        PID:10168
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        355⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\Hkpheidp.exe
        
        C:\Windows\system32\Hkpheidp.exe
        356⤵
        Modifies registry class
        
        PID:9308
        
        C:\Windows\SysWOW64\Hpmpnp32.exe
        
        C:\Windows\system32\Hpmpnp32.exe
        357⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Hgghjjid.exe
        
        C:\Windows\system32\Hgghjjid.exe
        358⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Hammhcij.exe
        
        C:\Windows\system32\Hammhcij.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9704
        
        C:\Windows\SysWOW64\Hdkidohn.exe
        
        C:\Windows\system32\Hdkidohn.exe
        360⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Hkeaqi32.exe
        
        C:\Windows\system32\Hkeaqi32.exe
        361⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        362⤵
        Modifies registry class
        
        PID:10072
        
        C:\Windows\SysWOW64\Hglaej32.exe
        
        C:\Windows\system32\Hglaej32.exe
        363⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        364⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Hpdfnolo.exe
        
        C:\Windows\system32\Hpdfnolo.exe
        365⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Hgnoki32.exe
        
        C:\Windows\system32\Hgnoki32.exe
        366⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Hjlkge32.exe
        
        C:\Windows\system32\Hjlkge32.exe
        367⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Hnhghcki.exe
        
        C:\Windows\system32\Hnhghcki.exe
        368⤵
        Modifies registry class
        
        PID:9972
        
        C:\Windows\SysWOW64\Hpfcdojl.exe
        
        C:\Windows\system32\Hpfcdojl.exe
        369⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Ihnkel32.exe
        
        C:\Windows\system32\Ihnkel32.exe
        370⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        371⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Iddljmpc.exe
        
        C:\Windows\system32\Iddljmpc.exe
        372⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Igchfiof.exe
        
        C:\Windows\system32\Igchfiof.exe
        373⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Ijadbdoj.exe
        
        C:\Windows\system32\Ijadbdoj.exe
        374⤵
        Drops file in System32 directory
        
        PID:9912
        
        C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        375⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Ihbdplfi.exe
        
        C:\Windows\system32\Ihbdplfi.exe
        376⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        377⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Ijcahd32.exe
        
        C:\Windows\system32\Ijcahd32.exe
        378⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        379⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        380⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Iggaah32.exe
        
        C:\Windows\system32\Iggaah32.exe
        381⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Ijfnmc32.exe
        
        C:\Windows\system32\Ijfnmc32.exe
        382⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Iqpfjnba.exe
        
        C:\Windows\system32\Iqpfjnba.exe
        383⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Idkbkl32.exe
        
        C:\Windows\system32\Idkbkl32.exe
        384⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        385⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Indfca32.exe
        
        C:\Windows\system32\Indfca32.exe
        386⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        387⤵
        Modifies registry class
        
        PID:10596
        
        C:\Windows\SysWOW64\Jgogbgei.exe
        
        C:\Windows\system32\Jgogbgei.exe
        388⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        389⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Jdbhkk32.exe
        
        C:\Windows\system32\Jdbhkk32.exe
        390⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Jgadgf32.exe
        
        C:\Windows\system32\Jgadgf32.exe
        391⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\Jjopcb32.exe
        
        C:\Windows\system32\Jjopcb32.exe
        392⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Jbfheo32.exe
        
        C:\Windows\system32\Jbfheo32.exe
        393⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10852
        
        C:\Windows\SysWOW64\Jhpqaiji.exe
        
        C:\Windows\system32\Jhpqaiji.exe
        394⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Jjamia32.exe
        
        C:\Windows\system32\Jjamia32.exe
        395⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        396⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Jdgafjpn.exe
        
        C:\Windows\system32\Jdgafjpn.exe
        397⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Jkaicd32.exe
        
        C:\Windows\system32\Jkaicd32.exe
        398⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        399⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Kghjhemo.exe
        
        C:\Windows\system32\Kghjhemo.exe
        400⤵
        
        PID:11136
        
        C:\Windows\SysWOW64\Knbbep32.exe
        
        C:\Windows\system32\Knbbep32.exe
        401⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        402⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Kjhcjq32.exe
        
        C:\Windows\system32\Kjhcjq32.exe
        403⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Kbpkkn32.exe
        
        C:\Windows\system32\Kbpkkn32.exe
        404⤵
        Modifies registry class
        
        PID:10280
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        405⤵
        Drops file in System32 directory
        
        PID:10312
        
        C:\Windows\SysWOW64\Kkhpdcab.exe
        
        C:\Windows\system32\Kkhpdcab.exe
        406⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Knflpoqf.exe
        
        C:\Windows\system32\Knflpoqf.exe
        407⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Keqdmihc.exe
        
        C:\Windows\system32\Keqdmihc.exe
        408⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Kilpmh32.exe
        
        C:\Windows\system32\Kilpmh32.exe
        409⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Kkjlic32.exe
        
        C:\Windows\system32\Kkjlic32.exe
        410⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        411⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Kecabifp.exe
        
        C:\Windows\system32\Kecabifp.exe
        412⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Kjpijpdg.exe
        
        C:\Windows\system32\Kjpijpdg.exe
        413⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Lbgalmej.exe
        
        C:\Windows\system32\Lbgalmej.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10956
        
        C:\Windows\SysWOW64\Liqihglg.exe
        
        C:\Windows\system32\Liqihglg.exe
        415⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Lnnbqnjn.exe
        
        C:\Windows\system32\Lnnbqnjn.exe
        416⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Licfngjd.exe
        
        C:\Windows\system32\Licfngjd.exe
        417⤵
        Drops file in System32 directory
        
        PID:11180
        
        C:\Windows\SysWOW64\Ljdceo32.exe
        
        C:\Windows\system32\Ljdceo32.exe
        418⤵
        
        PID:11244
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        419⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        420⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Ljgpkonp.exe
        
        C:\Windows\system32\Ljgpkonp.exe
        421⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Laqhhi32.exe
        
        C:\Windows\system32\Laqhhi32.exe
        422⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        423⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Lndham32.exe
        
        C:\Windows\system32\Lndham32.exe
        424⤵
        
        PID:10916
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        425⤵
        Modifies registry class
        
        PID:11080
        
        C:\Windows\SysWOW64\Mngegmbc.exe
        
        C:\Windows\system32\Mngegmbc.exe
        426⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        427⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Mhoipb32.exe
        
        C:\Windows\system32\Mhoipb32.exe
        428⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        429⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\Mecjif32.exe
        
        C:\Windows\system32\Mecjif32.exe
        430⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Miofjepg.exe
        
        C:\Windows\system32\Miofjepg.exe
        431⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Mnlnbl32.exe
        
        C:\Windows\system32\Mnlnbl32.exe
        432⤵
        Drops file in System32 directory
        
        PID:11240
        
        C:\Windows\SysWOW64\Majjng32.exe
        
        C:\Windows\system32\Majjng32.exe
        433⤵
        Modifies registry class
        
        PID:10628
        
        C:\Windows\SysWOW64\Mlpokp32.exe
        
        C:\Windows\system32\Mlpokp32.exe
        434⤵
        Modifies registry class
        
        PID:11060
        
        C:\Windows\SysWOW64\Mjbogmdb.exe
        
        C:\Windows\system32\Mjbogmdb.exe
        435⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Malgcg32.exe
        
        C:\Windows\system32\Malgcg32.exe
        436⤵
        Drops file in System32 directory
        
        PID:11036
        
        C:\Windows\SysWOW64\Micoed32.exe
        
        C:\Windows\system32\Micoed32.exe
        437⤵
        Drops file in System32 directory
        
        PID:10876
        
        C:\Windows\SysWOW64\Mlbkap32.exe
        
        C:\Windows\system32\Mlbkap32.exe
        438⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Mnphmkji.exe
        
        C:\Windows\system32\Mnphmkji.exe
        439⤵
        Modifies registry class
        
        PID:11340
        
        C:\Windows\SysWOW64\Maodigil.exe
        
        C:\Windows\system32\Maodigil.exe
        440⤵
        
        PID:11376
        
        C:\Windows\SysWOW64\Mejpje32.exe
        
        C:\Windows\system32\Mejpje32.exe
        441⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\Njghbl32.exe
        
        C:\Windows\system32\Njghbl32.exe
        442⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        443⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        444⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        445⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        446⤵
        
        PID:11616
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        447⤵
        
        PID:11656
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        448⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Nklbmllg.exe
        
        C:\Windows\system32\Nklbmllg.exe
        449⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\Nbcjnilj.exe
        
        C:\Windows\system32\Nbcjnilj.exe
        450⤵
        Drops file in System32 directory
        
        PID:11780
        
        C:\Windows\SysWOW64\Nhpbfpka.exe
        
        C:\Windows\system32\Nhpbfpka.exe
        451⤵
        
        PID:11820
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        452⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        453⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        454⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        455⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\Nolgijpk.exe
        
        C:\Windows\system32\Nolgijpk.exe
        456⤵
        Modifies registry class
        
        PID:12012
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        457⤵
        Drops file in System32 directory
        
        PID:12060
        
        C:\Windows\SysWOW64\Nefped32.exe
        
        C:\Windows\system32\Nefped32.exe
        458⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Nhdlao32.exe
        
        C:\Windows\system32\Nhdlao32.exe
        459⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        460⤵
        Modifies registry class
        
        PID:12192
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        461⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Ohghgodi.exe
        
        C:\Windows\system32\Ohghgodi.exe
        462⤵
        
        PID:12268
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        463⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        464⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Oifeab32.exe
        
        C:\Windows\system32\Oifeab32.exe
        465⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        466⤵
        Drops file in System32 directory
        
        PID:11440
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        467⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\Oemefcap.exe
        
        C:\Windows\system32\Oemefcap.exe
        468⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\Olgncmim.exe
        
        C:\Windows\system32\Olgncmim.exe
        469⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Ooejohhq.exe
        
        C:\Windows\system32\Ooejohhq.exe
        470⤵
        
        PID:11712
        
        C:\Windows\SysWOW64\Oadfkdgd.exe
        
        C:\Windows\system32\Oadfkdgd.exe
        471⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        472⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\Oklkdi32.exe
        
        C:\Windows\system32\Oklkdi32.exe
        473⤵
        Drops file in System32 directory
        
        PID:11924
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        474⤵
        Drops file in System32 directory
        
        PID:12000
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        475⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        476⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        477⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Plndcl32.exe
        
        C:\Windows\system32\Plndcl32.exe
        478⤵
        
        PID:12276
        
        C:\Windows\SysWOW64\Polppg32.exe
        
        C:\Windows\system32\Polppg32.exe
        479⤵
        
        PID:11400
        
        C:\Windows\SysWOW64\Pefhlaie.exe
        
        C:\Windows\system32\Pefhlaie.exe
        480⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10356
        
        C:\Windows\SysWOW64\Phedhmhi.exe
        
        C:\Windows\system32\Phedhmhi.exe
        481⤵
        
        PID:11652
        
        C:\Windows\SysWOW64\Pkcadhgm.exe
        
        C:\Windows\system32\Pkcadhgm.exe
        482⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11772
        
        C:\Windows\SysWOW64\Pcjiff32.exe
        
        C:\Windows\system32\Pcjiff32.exe
        483⤵
        
        PID:11884
        
        C:\Windows\SysWOW64\Peieba32.exe
        
        C:\Windows\system32\Peieba32.exe
        484⤵
        
        PID:11992
        
        C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        485⤵
        
        PID:12140
        
        C:\Windows\SysWOW64\Pcmeke32.exe
        
        C:\Windows\system32\Pcmeke32.exe
        486⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        487⤵
        
        PID:11704
        
        C:\Windows\SysWOW64\Pkhjph32.exe
        
        C:\Windows\system32\Pkhjph32.exe
        488⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Pcobaedj.exe
        
        C:\Windows\system32\Pcobaedj.exe
        489⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        490⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Qkjgegae.exe
        
        C:\Windows\system32\Qkjgegae.exe
        491⤵
        
        PID:12080
        
        C:\Windows\SysWOW64\Qadoba32.exe
        
        C:\Windows\system32\Qadoba32.exe
        492⤵
        
        PID:11864
        
        C:\Windows\SysWOW64\Qikgco32.exe
        
        C:\Windows\system32\Qikgco32.exe
        493⤵
        
        PID:11896
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        494⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12300
        
        C:\Windows\SysWOW64\Qohpkf32.exe
        
        C:\Windows\system32\Qohpkf32.exe
        495⤵
        Drops file in System32 directory
        
        PID:12344
        
        C:\Windows\SysWOW64\Qcclld32.exe
        
        C:\Windows\system32\Qcclld32.exe
        496⤵
        
        PID:12384
        
        C:\Windows\SysWOW64\Ajndioga.exe
        
        C:\Windows\system32\Ajndioga.exe
        497⤵
        
        PID:12424
        
        C:\Windows\SysWOW64\Aojlaeei.exe
        
        C:\Windows\system32\Aojlaeei.exe
        498⤵
        
        PID:12468
        
        C:\Windows\SysWOW64\Aeddnp32.exe
        
        C:\Windows\system32\Aeddnp32.exe
        499⤵
        
        PID:12508
        
        C:\Windows\SysWOW64\Akamff32.exe
        
        C:\Windows\system32\Akamff32.exe
        500⤵
        
        PID:12548
        
        C:\Windows\SysWOW64\Ahenokjf.exe
        
        C:\Windows\system32\Ahenokjf.exe
        501⤵
        
        PID:12588
        
        C:\Windows\SysWOW64\Aoofle32.exe
        
        C:\Windows\system32\Aoofle32.exe
        502⤵
        
        PID:12628
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        503⤵
        
        PID:12664
        
        C:\Windows\SysWOW64\Ajdjin32.exe
        
        C:\Windows\system32\Ajdjin32.exe
        504⤵
        Modifies registry class
        
        PID:12704
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        505⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12744
        
        C:\Windows\SysWOW64\Aoabad32.exe
        
        C:\Windows\system32\Aoabad32.exe
        506⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12780
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        507⤵
        
        PID:12820
        
        C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        508⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\Bhldpj32.exe
        
        C:\Windows\system32\Bhldpj32.exe
        509⤵
        
        PID:12900
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        510⤵
        
        PID:12940
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        511⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:12980
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        512⤵
        
        PID:13016
        
        C:\Windows\SysWOW64\Bjnmpl32.exe
        
        C:\Windows\system32\Bjnmpl32.exe
        513⤵
        
        PID:13056
        
        C:\Windows\SysWOW64\Bbiado32.exe
        
        C:\Windows\system32\Bbiado32.exe
        514⤵
        Modifies registry class
        
        PID:13096
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        515⤵
        
        PID:13132
        
        C:\Windows\SysWOW64\Bombmcec.exe
        
        C:\Windows\system32\Bombmcec.exe
        516⤵
        
        PID:13168
        
        C:\Windows\SysWOW64\Bblnindg.exe
        
        C:\Windows\system32\Bblnindg.exe
        517⤵
        
        PID:13212
        
        C:\Windows\SysWOW64\Bheffh32.exe
        
        C:\Windows\system32\Bheffh32.exe
        518⤵
        
        PID:13252
        
        C:\Windows\SysWOW64\Bkdcbd32.exe
        
        C:\Windows\system32\Bkdcbd32.exe
        519⤵
        
        PID:13296
        
        C:\Windows\SysWOW64\Bckkca32.exe
        
        C:\Windows\system32\Bckkca32.exe
        520⤵
        
        PID:12328
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        521⤵
        
        PID:12368
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        522⤵
        
        PID:12464
        
        C:\Windows\SysWOW64\Cfldelik.exe
        
        C:\Windows\system32\Cfldelik.exe
        523⤵
        
        PID:12516
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        524⤵
        Modifies registry class
        
        PID:12584
        
        C:\Windows\SysWOW64\Cfnqklgh.exe
        
        C:\Windows\system32\Cfnqklgh.exe
        525⤵
        Modifies registry class
        
        PID:12620
        
        C:\Windows\SysWOW64\Cjliajmo.exe
        
        C:\Windows\system32\Cjliajmo.exe
        526⤵
        
        PID:12692
        
        C:\Windows\SysWOW64\Ciafbg32.exe
        
        C:\Windows\system32\Ciafbg32.exe
        527⤵
        
        PID:12764
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        528⤵
        
        PID:12828
        
        C:\Windows\SysWOW64\Dkbocbog.exe
        
        C:\Windows\system32\Dkbocbog.exe
        529⤵
        
        PID:12880
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        530⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        531⤵
        
        PID:12996
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        532⤵
        
        PID:13084
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        533⤵
        
        PID:13196
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        534⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13284
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        535⤵
        
        PID:12420
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        536⤵
        Drops file in System32 directory
        
        PID:12504
        
        C:\Windows\SysWOW64\Eplgeokq.exe
        
        C:\Windows\system32\Eplgeokq.exe
        537⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        538⤵
        
        PID:12736
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        539⤵
        
        PID:12892
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        540⤵
        
        PID:13004
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        541⤵
        
        PID:13064
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        542⤵
        
        PID:13176
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        543⤵
        
        PID:12356
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        544⤵
        Drops file in System32 directory
        
        PID:12572
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        545⤵
        
        PID:12732
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        546⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        547⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        548⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        549⤵
        Modifies registry class
        
        PID:12920
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        550⤵
        
        PID:13044
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        551⤵
        
        PID:12408
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        552⤵
        
        PID:12684
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        553⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        554⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        555⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        556⤵
        Modifies registry class
        
        PID:460
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        557⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        558⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        559⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        560⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        561⤵
        
        PID:12928
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        562⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        563⤵
        
        PID:4164
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        564⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        565⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        566⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        567⤵
        Modifies registry class
        
        PID:4476
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        568⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        569⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        570⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        571⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        572⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        573⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        574⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        575⤵
        Modifies registry class
        
        PID:3444
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        576⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        577⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        578⤵
        
        PID:12712
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        579⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        580⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        581⤵
        
        PID:964
        
        C:\Windows\SysWOW64\Nmenca32.exe
        
        C:\Windows\system32\Nmenca32.exe
        582⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5080
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        583⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1184
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        584⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        585⤵
        
        PID:520
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        586⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        587⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1656
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        588⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        589⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\Nnfgcd32.exe
        
        C:\Windows\system32\Nnfgcd32.exe
        590⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        591⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        592⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        593⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        594⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4816
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        595⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        596⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        597⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4244
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        598⤵
        Modifies registry class
        
        PID:1160
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        599⤵
        
        PID:232
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        600⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        601⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        602⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        603⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        604⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:764
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        605⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        606⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        607⤵
        
        PID:3120
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        608⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        609⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        610⤵
        Drops file in System32 directory
        
        PID:2480
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        611⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        612⤵
        
        PID:788
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        613⤵
        Drops file in System32 directory
        
        PID:2748
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        614⤵
        
        PID:4024
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        615⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        616⤵
        
        PID:836
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        617⤵
        
        PID:13208
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        618⤵
        Modifies registry class
        
        PID:13220
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        619⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        620⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        621⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        622⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        623⤵
        Drops file in System32 directory
        
        PID:2960
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        624⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        625⤵
        
        PID:352
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        626⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        627⤵
        Drops file in System32 directory
        
        PID:1696
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        628⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        629⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        630⤵
        Modifies registry class
        
        PID:5420
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        631⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        632⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2556
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        633⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        634⤵
        
        PID:4860
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        635⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        636⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        637⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        638⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        639⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5800
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        640⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        641⤵
        Modifies registry class
        
        PID:5508
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        642⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        643⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        644⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        645⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        646⤵
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        647⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        648⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        649⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        650⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        651⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        652⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        653⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        654⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        655⤵
        Drops file in System32 directory
        
        PID:6436
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        656⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        657⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        658⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        659⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        660⤵
        Drops file in System32 directory
        
        PID:5500
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        661⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6316
        
        C:\Windows\SysWOW64\Adfgdpmi.exe
        
        C:\Windows\system32\Adfgdpmi.exe
        662⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6468
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        663⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        664⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        665⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        666⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        667⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        668⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        669⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        670⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        671⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        672⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        673⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        674⤵
        
        PID:2148
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        675⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Cancekeo.exe
        
        C:\Windows\system32\Cancekeo.exe
        676⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Ggccllai.exe
        
        C:\Windows\system32\Ggccllai.exe
        677⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Gjaphgpl.exe
        
        C:\Windows\system32\Gjaphgpl.exe
        678⤵
        Modifies registry class
        
        PID:8732
        
        C:\Windows\SysWOW64\Gbhhieao.exe
        
        C:\Windows\system32\Gbhhieao.exe
        679⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Gqkhda32.exe
        
        C:\Windows\system32\Gqkhda32.exe
        680⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Gkalbj32.exe
        
        C:\Windows\system32\Gkalbj32.exe
        681⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Gqnejaff.exe
        
        C:\Windows\system32\Gqnejaff.exe
        682⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Gdiakp32.exe
        
        C:\Windows\system32\Gdiakp32.exe
        683⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9184
        
        C:\Windows\SysWOW64\Gjficg32.exe
        
        C:\Windows\system32\Gjficg32.exe
        684⤵
        Drops file in System32 directory
        
        PID:8196
        
        C:\Windows\SysWOW64\Ggjjlk32.exe
        
        C:\Windows\system32\Ggjjlk32.exe
        685⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Gkefmjcj.exe
        
        C:\Windows\system32\Gkefmjcj.exe
        686⤵
        Drops file in System32 directory
        
        PID:6752
        
        C:\Windows\SysWOW64\Gjhfif32.exe
        
        C:\Windows\system32\Gjhfif32.exe
        687⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Gdnjfojj.exe
        
        C:\Windows\system32\Gdnjfojj.exe
        688⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Gjkbnfha.exe
        
        C:\Windows\system32\Gjkbnfha.exe
        689⤵
        Drops file in System32 directory
        
        PID:6632
        
        C:\Windows\SysWOW64\Hqdkkp32.exe
        
        C:\Windows\system32\Hqdkkp32.exe
        690⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Hccggl32.exe
        
        C:\Windows\system32\Hccggl32.exe
        691⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Hnhkdd32.exe
        
        C:\Windows\system32\Hnhkdd32.exe
        692⤵
        Modifies registry class
        
        PID:5308
        
        C:\Windows\SysWOW64\Hqghqpnl.exe
        
        C:\Windows\system32\Hqghqpnl.exe
        693⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Hebcao32.exe
        
        C:\Windows\system32\Hebcao32.exe
        694⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Hgapmj32.exe
        
        C:\Windows\system32\Hgapmj32.exe
        695⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Hjolie32.exe
        
        C:\Windows\system32\Hjolie32.exe
        696⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Hbfdjc32.exe
        
        C:\Windows\system32\Hbfdjc32.exe
        697⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Hgcmbj32.exe
        
        C:\Windows\system32\Hgcmbj32.exe
        698⤵
        Modifies registry class
        
        PID:8776
        
        C:\Windows\SysWOW64\Hegmlnbp.exe
        
        C:\Windows\system32\Hegmlnbp.exe
        699⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Hcjmhk32.exe
        
        C:\Windows\system32\Hcjmhk32.exe
        700⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Hkaeih32.exe
        
        C:\Windows\system32\Hkaeih32.exe
        701⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Hghfnioq.exe
        
        C:\Windows\system32\Hghfnioq.exe
        702⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Indkpcdk.exe
        
        C:\Windows\system32\Indkpcdk.exe
        703⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Ibpgqa32.exe
        
        C:\Windows\system32\Ibpgqa32.exe
        704⤵
        Modifies registry class
        
        PID:8252
        
        C:\Windows\SysWOW64\Iencmm32.exe
        
        C:\Windows\system32\Iencmm32.exe
        705⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Ilhkigcd.exe
        
        C:\Windows\system32\Ilhkigcd.exe
        706⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Ijkled32.exe
        
        C:\Windows\system32\Ijkled32.exe
        707⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Iaedanal.exe
        
        C:\Windows\system32\Iaedanal.exe
        708⤵
        Modifies registry class
        
        PID:6048
        
        C:\Windows\SysWOW64\Iccpniqp.exe
        
        C:\Windows\system32\Iccpniqp.exe
        709⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Iholohii.exe
        
        C:\Windows\system32\Iholohii.exe
        710⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Ijmhkchl.exe
        
        C:\Windows\system32\Ijmhkchl.exe
        711⤵
        Drops file in System32 directory
        
        PID:9844
        
        C:\Windows\SysWOW64\Icfmci32.exe
        
        C:\Windows\system32\Icfmci32.exe
        712⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Ilmedf32.exe
        
        C:\Windows\system32\Ilmedf32.exe
        713⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Inkaqb32.exe
        
        C:\Windows\system32\Inkaqb32.exe
        714⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Iajmmm32.exe
        
        C:\Windows\system32\Iajmmm32.exe
        715⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Idhiii32.exe
        
        C:\Windows\system32\Idhiii32.exe
        716⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\Ijbbfc32.exe
        
        C:\Windows\system32\Ijbbfc32.exe
        717⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Jbijgp32.exe
        
        C:\Windows\system32\Jbijgp32.exe
        718⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Jlanpfkj.exe
        
        C:\Windows\system32\Jlanpfkj.exe
        719⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Jejbhk32.exe
        
        C:\Windows\system32\Jejbhk32.exe
        720⤵
        
        PID:10308
        
        C:\Windows\SysWOW64\Jjgkab32.exe
        
        C:\Windows\system32\Jjgkab32.exe
        721⤵
        Drops file in System32 directory
        
        PID:10492
        
        C:\Windows\SysWOW64\Jjihfbno.exe
        
        C:\Windows\system32\Jjihfbno.exe
        722⤵
        Drops file in System32 directory
        
        PID:6576
        
        C:\Windows\SysWOW64\Jbppgona.exe
        
        C:\Windows\system32\Jbppgona.exe
        723⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7912
        
        C:\Windows\SysWOW64\Jlidpe32.exe
        
        C:\Windows\system32\Jlidpe32.exe
        724⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Jjkdlall.exe
        
        C:\Windows\system32\Jjkdlall.exe
        725⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Jaemilci.exe
        
        C:\Windows\system32\Jaemilci.exe
        726⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Jhoeef32.exe
        
        C:\Windows\system32\Jhoeef32.exe
        727⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Jlkafdco.exe
        
        C:\Windows\system32\Jlkafdco.exe
        728⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Kbeibo32.exe
        
        C:\Windows\system32\Kbeibo32.exe
        729⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Keceoj32.exe
        
        C:\Windows\system32\Keceoj32.exe
        730⤵
        Modifies registry class
        
        PID:5744
        
        C:\Windows\SysWOW64\Khabke32.exe
        
        C:\Windows\system32\Khabke32.exe
        731⤵
        Drops file in System32 directory
        
        PID:9896
        
        C:\Windows\SysWOW64\Kkpnga32.exe
        
        C:\Windows\system32\Kkpnga32.exe
        732⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11192
        
        C:\Windows\SysWOW64\Kajfdk32.exe
        
        C:\Windows\system32\Kajfdk32.exe
        733⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Khdoqefq.exe
        
        C:\Windows\system32\Khdoqefq.exe
        734⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Klpjad32.exe
        
        C:\Windows\system32\Klpjad32.exe
        735⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9848
        
        C:\Windows\SysWOW64\Kkbkmqed.exe
        
        C:\Windows\system32\Kkbkmqed.exe
        736⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Kalcik32.exe
        
        C:\Windows\system32\Kalcik32.exe
        737⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Khfkfedn.exe
        
        C:\Windows\system32\Khfkfedn.exe
        738⤵
        Modifies registry class
        
        PID:7396
        
        C:\Windows\SysWOW64\Kopcbo32.exe
        
        C:\Windows\system32\Kopcbo32.exe
        739⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Kblpcndd.exe
        
        C:\Windows\system32\Kblpcndd.exe
        740⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Kaopoj32.exe
        
        C:\Windows\system32\Kaopoj32.exe
        741⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Kocphojh.exe
        
        C:\Windows\system32\Kocphojh.exe
        742⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7764
        
        C:\Windows\SysWOW64\Kemhei32.exe
        
        C:\Windows\system32\Kemhei32.exe
        743⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8136
        
        C:\Windows\SysWOW64\Klgqabib.exe
        
        C:\Windows\system32\Klgqabib.exe
        744⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Loemnnhe.exe
        
        C:\Windows\system32\Loemnnhe.exe
        745⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Lbqinm32.exe
        
        C:\Windows\system32\Lbqinm32.exe
        746⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Leoejh32.exe
        
        C:\Windows\system32\Leoejh32.exe
        747⤵
        
        PID:10428
        
        C:\Windows\SysWOW64\Llimgb32.exe
        
        C:\Windows\system32\Llimgb32.exe
        748⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Lklnconj.exe
        
        C:\Windows\system32\Lklnconj.exe
        749⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Llkjmb32.exe
        
        C:\Windows\system32\Llkjmb32.exe
        750⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Lojfin32.exe
        
        C:\Windows\system32\Lojfin32.exe
        751⤵
        
        PID:11472
        
        C:\Windows\SysWOW64\Ledoegkm.exe
        
        C:\Windows\system32\Ledoegkm.exe
        752⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10620
        
        C:\Windows\SysWOW64\Ldfoad32.exe
        
        C:\Windows\system32\Ldfoad32.exe
        753⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:452
        
        C:\Windows\SysWOW64\Llngbabj.exe
        
        C:\Windows\system32\Llngbabj.exe
        754⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Lbhool32.exe
        
        C:\Windows\system32\Lbhool32.exe
        755⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\Lefkkg32.exe
        
        C:\Windows\system32\Lefkkg32.exe
        756⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\Ldikgdpe.exe
        
        C:\Windows\system32\Ldikgdpe.exe
        757⤵
        
        PID:12188
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12188 -s 408
        758⤵
        Program crash
        
        PID:7772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:10892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 12188 -ip 12188
  2⤵
  PID:10576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aobilkcl.exe

Filesize
273KB

MD5
288ee2725cadb502e75c9c0c94053a35

SHA1
6758b8d301eecab83f71e4df895fa6d7f65d7dd8

SHA256
0ee024715b61e0692dfeb244e02a2e726e5ac1c164a869f05688a4b73b8de19a

SHA512
246d212a152b28fde523a5d7cac29ddb4d38948c8396dc65e086c8d3c2e429ff840bdad7cc6c3b3244c86e26ac8499278783d9e65590b4270c0dfba10ae94978

Download Submit
C:\Windows\SysWOW64\Bckkca32.exe

Filesize
273KB

MD5
ebe95b5065b5e82a032ab4b7c67b4420

SHA1
8f9e0b61c4f123dc9e1c9ac00baa4fc4a7b10e08

SHA256
667e27500012f3967c44e0d1e1b1fb1f606d0c5046b7131caf4c6e0c62d48b6f

SHA512
a39a22f99cf3a309b014107dd0ff356933ca71d14c1ecba5983d85df75990bd6bb56655ea395908ce8d20041f101fd82f70b710e0214e9537b2c9c61728c18fc

Download Submit
C:\Windows\SysWOW64\Bgehcmmm.exe

Filesize
273KB

MD5
0e942934dab5fbf0ec9c966b4a7daac2

SHA1
2855d936e8496b99215b3d4afe18a886a18f009c

SHA256
528fed4c26dfaabe5e69ac86b6ab58b1196da6407f237c47ae6319bd20053712

SHA512
5b890cede8b2b78d2b91e2cd4acb10f547b25c9f890748287cb890b335fd9a5aafa966b16672e169ce1f93b0b9764200db3f42fa8c99be7ad8fcbca255797ce4

Download Submit
C:\Windows\SysWOW64\Bjfaeh32.exe

Filesize
273KB

MD5
0189b92a0eac91df25c0f29b595f87c2

SHA1
61e50e3e1d5be01c939e56fe66b5a4e3e11960af

SHA256
dd61d834c4b3a733f672bc82727515628b726c752f2504b658d34b19c83765f1

SHA512
602fb6026b85cac15be9d5ea01f13efabc15dcc5fe13497a2496ca46f967027cb402726f5b34d6663cd6fcd87883037ac28c6e41b17d99a11d1fae11806bdef7

Download Submit
C:\Windows\SysWOW64\Bjpjel32.exe

Filesize
273KB

MD5
0a6a20483d5061e79cdc3a4b7ef56a4f

SHA1
790a253dee43d10bc69bd162dbd105aac3ba65b5

SHA256
7728e6a79d2a27453188a3749d9cb5148549805cc7b4ab34022c1c0d241a77c3

SHA512
32598012ded86efab9580b829b2f88ff8fb9e1829b711a95b4e1b34c89678532427b58a831874bdeb1edfe29151fcfd6d5255dc052ce41735543e7be016b102a

Download Submit
C:\Windows\SysWOW64\Cfbkeh32.exe

Filesize
273KB

MD5
5e367847f59cd344063588cd83b2037d

SHA1
46e08795b41b171244698b132a8a3b6e5254fb47

SHA256
432d7567c106c88776c907a138212b07039ec97e9123b8a3e0f4900cfbbf4af3

SHA512
672be869bf92bcce038f0cd82c0358561ef0de6a90942e2f45f457e00b1f00b8f2d27fb89b7c016c41488af07cedd351fc9d3708afcc3e3b0b7f0fd2c7adc8a7

Download Submit
C:\Windows\SysWOW64\Cfnqklgh.exe

Filesize
273KB

MD5
4fa40d14078a03092c0da0f6836b4efe

SHA1
060e15a89d02d3a3cad60ca68a03874e5815e53b

SHA256
17b33bc164a342b41706d480af5325ed8b7fe5dc6b9c2993c85170ecbd60d119

SHA512
81efbf60bb5525176e5b79fcd02f7e3befde7914ab4f3f84d2672a92f0270f5b85e932d66ca43cd32ff56dd0abe415301174680748f9b8ca138d4e410bc42b53

Download Submit
C:\Windows\SysWOW64\Dbndfl32.exe

Filesize
273KB

MD5
935d11168a9e33b417c5627e5e39207d

SHA1
3806d796186bb2360678a6df8a617d63c7f89850

SHA256
ae81fc3c6b971229009aa666bdc7728d50b49fa4de30d0311e135513e5179790

SHA512
768fa0d8c0ee2370d96741277450fc456e1c00a89f03b1d2c410b44e216fc08a3be79d2ccc03ad4b7052f284a579ee5dfcdda407a779933aa86aa44c4514d67a

Download Submit
C:\Windows\SysWOW64\Dpehof32.exe

Filesize
273KB

MD5
87c6bcb8b39e485e137a9185362bb856

SHA1
20afa7ddd8d2c57246aeaa9b4c1ef8637a213fbe

SHA256
5c732f6857e67809a177c7c6c8ccc3ce17f3b6ac1d80c071462f5321256d4c9c

SHA512
ed69f8064e4e3cc3020eba84432ed28a1b1710863627f25aa96d074c2b25a528ce4f3654d29a8d3dab7b54259be43e70ef52f748c314ad5e4a4fb3764594933d

Download Submit
C:\Windows\SysWOW64\Ebhglj32.exe

Filesize
273KB

MD5
be36525b6d9304f5a26ee741de8a6590

SHA1
d9ea2dccd0577cb7b9587d3b96d37f7cdffe1efd

SHA256
b1b2e1688c93b4f3037573811a599179782524488eb38db26af4923271b1a914

SHA512
a3a231d86100f2547802be685e5d9a444dd419d60b3a787571fad060f9ceb131ba54a1e8294700482b6e25f3527a18fefbc4f8b834bccd592141f8063dccc8eb

Download Submit
C:\Windows\SysWOW64\Gbgdlq32.exe

Filesize
273KB

MD5
e1edc53be7318faa82f2239b236083eb

SHA1
05862834b9912e31eb8cc5c9667f1ca49906e97c

SHA256
2888926fd61465f07a9c46088e98d2dcedb8723ea632de86f57924d2cce9f0aa

SHA512
cd757b0aa07945dca7913e2148d4eb56d76668248513f1581819ffcf7a9597dfcbc0ce8968df0a06ab24520aa3478a89c8964bd740b7ddf42dc8bbddb6437196

Download Submit
C:\Windows\SysWOW64\Gbgdlq32.exe

Filesize
256KB

MD5
f0bafca4a6d10b9458d93c833035ab43

SHA1
2b25d2a23cc02b413bd3d7fc2b274a9dab689746

SHA256
cf765c2528b90b9594ff2dcbe06005ae6ca505ef657d770f9913227749478126

SHA512
342375e7618df2cb8480a554743f6663ab600b51abe1a4442d79c26d7245c2e3d5a41e880de0f1876ab45cd289590cb98b6f24d8447e5673d69cf4907cf03140

Download Submit
C:\Windows\SysWOW64\Gbiaapdf.exe

Filesize
273KB

MD5
deac149c7d7927280e95b848d10f0d52

SHA1
ae9811f3927175cd949680f0f8635d9c20de43ac

SHA256
1fc13e07499644cd40279e814f6dee7e0abccf983b72ae8e32588632d18e7cf8

SHA512
d3b29af2138de1c6dac0cb294dca3b781a501089770bc69237495bc4e47ee946c37f8e4b55ccdc2a5a6cfead729db40d6f4c4772c524ca6523466e1e20c093ca

Download Submit
C:\Windows\SysWOW64\Gbiaapdf.exe

Filesize
256KB

MD5
9affb0fabb01dfb5057cdb9a338ca7f4

SHA1
0d79b17f5581a39a19fbe446c774217b9d9a8903

SHA256
5b173f265d473ede30eea40726ea9a38778c0fec09b57225f5962f55587939df

SHA512
d21231b64f5c7cfa4117988487e7952d9d25e3f4c1d625d317c394a31ef3de1621b663ed1e6cf4611a9494391d0c23994af3adff5af857ff6e83e3a8adb2dca5

Download Submit
C:\Windows\SysWOW64\Gcimkc32.exe

Filesize
42KB

MD5
1f822f74960134ec491e415451a68729

SHA1
798c21a1e448aa2f138487332acdcf36c688f19c

SHA256
c0141dba817eddc4176a81a35a86ae382a957f2e7c7f5e0507931c7d3f5845ab

SHA512
52d3f170694328443931e9e3a7424553dbb2f59e434a90dac587a8b2879a17cdb5c0831ab529f0c8d39283f749a30ca651d6d9e6a53f9d45ffe0ef2edb1d10ac

Download Submit
C:\Windows\SysWOW64\Gcimkc32.exe

Filesize
273KB

MD5
710b9bb7c74a1a6494e294c714c742b9

SHA1
e1f500dc7b6214ef5a1148bbcb3e992169661f21

SHA256
88231a487253044346cbdd9a00932113c1808c998bbf238741dd8aa1048d3d7f

SHA512
c6fac90ffd17c6d30a92b3a966ac955b1a785d8723efbb1964af0ca390b7a8ae7b4a63d2258ac2d296299783678145648921f5d1d6ed6fb62e7b99f2d351d1f2

Download Submit
C:\Windows\SysWOW64\Gcojed32.exe

Filesize
273KB

MD5
fcd1a569fca25c875d297a169d2af4bc

SHA1
1dd3fad42660ba345dc646ae0e9ce7faba48b6c2

SHA256
54ff591522de78ae0a473e033fda3d6ca3e73d103cbf9bd0bd7e068449cd4762

SHA512
6a6066ec4b9359ccfcd66e381ee3686fdff056e4c89d3f278fc9bb290490964e592ec66bae48d20eb648b268dccab16d18843d5674ebcc9d5daa7be829ffe1ef

Download Submit
C:\Windows\SysWOW64\Gdeqhl32.exe

Filesize
273KB

MD5
40540cf570529bfaad0e4c7d4138c887

SHA1
2a993d028f9a79c1496b3748d824eda91e584f63

SHA256
504b4315c0dabb9448066421affa15adde48a33bd59c3efb0002611c86ebc819

SHA512
f2b7f4226d94f86d2c1c34f407d4794cec71383de1123b5ff4e5003edcf53b84c3c06a0a5a4ba19233bec196f158f5667e1be4455e62b0f699d7dafb9f93857e

Download Submit
C:\Windows\SysWOW64\Gdhmnlcj.exe

Filesize
273KB

MD5
fa6eed30432a79f56f984f56220c259e

SHA1
7c79206b28d6c1e764131f7a47c808b0090898e1

SHA256
084786cec4bbc6e6336e5cea2277b6f6365ab9f8f04ea73b88dc75b8d8bc7800

SHA512
ba80fcee045c58afeabc10b61b51850dbc4601ca9a7162798f1131bdabeb72123299f045d7d29c32a205c406dfce9984fa5bd885a470a6b8d51ede244f9fc51e

Download Submit
C:\Windows\SysWOW64\Gdhmnlcj.exe

Filesize
128KB

MD5
3ad86d8bdaf33628559832278892750c

SHA1
832d6515c13573d4e091f3608fe1bac695eb27fd

SHA256
ac2aa2f295a5b15e8b5a0b2324960bb1c928a5eb06613ece920d10d5fbaa1d5d

SHA512
cf5d51ca1da63ac42922c92ae915ac71dd2eea9387f34f75fc77bb17e29f350e882813de45c01bbea11528b383f50e65b00cfa2e98b1f89acc26ede88b3ba7a1

Download Submit
C:\Windows\SysWOW64\Gdqgmmjb.exe

Filesize
273KB

MD5
2270513d6a336eef527e5e010abab832

SHA1
a052787954269b24decf74af193f1eef56b4652a

SHA256
0245cbd4304ad9992fcd9533e2de622f018dd12a0aa4f144153172e65352074e

SHA512
afccb2e3725ddec6d008d93538e7b8141b7c995b6e222b6b9e79a12ed79c7804b102fddc7dd2a5e2ab038bfb51b89106d425db1b0bcbd73e3b0357f6a6b20ee7

Download Submit
C:\Windows\SysWOW64\Ghopckpi.exe

Filesize
273KB

MD5
4158f3a8fcc6e34f31382184a8f1adc6

SHA1
4d917b5c785d03419104321e95bdaa260dfebf38

SHA256
427109a50aa8c8f7dedd43d0b807ce7d18da3caa7fd468d02c9f75e84fafcb5d

SHA512
842ebf3db7e6420a91b35d0a06481603a55acb66130291011d9f6b3a0d8f645bb1d46c1b31d4ef723d8ad09b62db98000581463052400b2e7b77ed8a385ed4ab

Download Submit
C:\Windows\SysWOW64\Gkaejf32.exe

Filesize
273KB

MD5
e651d6a69b5369e7ad1635d342f0c4ad

SHA1
0df3ebf89bc62586dcd3172df3540d1a90e2698f

SHA256
2b8fe4ee686d0dfbdf38d60c48a472d6d3b7d3bb06b6fc848d9270fe89f69395

SHA512
64650334fe25f3a2dfbc61e4eeec4a3c45a1ff828577bcadbac851e7cd28654bd7f738e72baa4f781304eb1bd61ce783fb73c819645d7d0e0a26dc54cd24b76a

Download Submit
C:\Windows\SysWOW64\Gkaejf32.exe

Filesize
64KB

MD5
3f23d3b5b2c1178270620b6d3e8e8c0f

SHA1
4a6ac4f46bae107cd024e9c5595c3594ce7d4cf7

SHA256
728efa2e3ae9ec79fdb04ddefa4eeeab62f55b36de642be74aa765e8c78f813f

SHA512
9787b32661896c93d17d02ffde1f9ce1080282431238fd5c9aa221bc68617e04e93756bb7537ec11ebcf79cf063b1276f2213a5a76f670446b54875ecbcc4bb2

Download Submit
C:\Windows\SysWOW64\Gkoiefmj.exe

Filesize
273KB

MD5
a325f249a0e5bebde10bd3cee923400b

SHA1
56496259b1127988c14c147a1497ab40ab9b45a5

SHA256
58b20669ce1d57e2513ada0c33b3a7e8f144ee25e5f60f799110bab9699ec33e

SHA512
8df382694535bb76f931e063dfb608667adbcb1126564fe9f91d2124a24aebeefb1a5b4f1ff6bbfb68ffdce97e27f1af17adc68bf07ad1348d5a2d83b1c636c9

Download Submit
C:\Windows\SysWOW64\Hbnjmp32.exe

Filesize
273KB

MD5
0a2907dd313a79951ae7fc944e526ec3

SHA1
90010c51da53c15f60a9a393b507060803254cc7

SHA256
cdc8f38b04a9eebcc9cd19bf8d85eb12a71f65a2e59179af56433a6c469fa5f2

SHA512
8ffab234de9a928a02d8b0f6a9de9f1931cb8ad9928fdc658207fc607748c239c2f9a7d82c5e6ffe10b59d4c16be5ea5600a9ebb5738cf5b32ea9f6d0c2ce71e

Download Submit
C:\Windows\SysWOW64\Hcdmga32.exe

Filesize
273KB

MD5
85652ebc596ca41787a76c80539c2bd7

SHA1
8feb393722fc86270c09f3c7fa1c1f5fd999a044

SHA256
1ac55b667ff1d8a1aac97d43f2a48ceac99b3115d5fdf2a018740970a72d9d2c

SHA512
804c5e88b868ab783f9b1905eed21a0f0646b976b8d29bc0501fcf1a5b98ec8050e1c046a447c9f0f6aa20ad6a99a3b12b881ec64f906c52631b38c9dcb6320b

Download Submit
C:\Windows\SysWOW64\Helfik32.exe

Filesize
273KB

MD5
ea90b5098321327ac6a18b124657037f

SHA1
db19197f56bb4f810974ab6721b39016b6494acd

SHA256
55bf3b08acc52994516757731d4407cc5ffa4d7ebe1c53cda11e5ba20f869107

SHA512
070c22b04e65fbee8d0f1a95f55b7051cb88903db541dee47644f7764011bc3db6cb8ab82e58f966c8c0e4dce6ca4da6a5e8b201409e01e308a1ef2a7dfa59be

Download Submit
C:\Windows\SysWOW64\Hflcbngh.exe

Filesize
273KB

MD5
49e79e005860a79871bd03df290c8e49

SHA1
2fb8fab897737a1d2ea857055487ad925a53ff64

SHA256
568a5232b69b5791a54fa1ab84d61334946c030873820ed885857a03e1071d31

SHA512
4f9d7df10ddc51eb9e76e1246818b3ce506c08381db1096424d049eb38c8f0a343a87fc92bc9f0152a4d4090212cc55ec1f1ba58eb0d3a83dcd8b8d754081e0a

Download Submit
C:\Windows\SysWOW64\Hfnphn32.exe

Filesize
273KB

MD5
e3641e9c1a87054e4b9cb3a3750c4114

SHA1
6af0dbc483168553b99d6444d1195f4f8dd1893e

SHA256
f9506e67afc63b997fb8eae157f3e5d18d08eeb09bc2733236f69f8e2bdfe994

SHA512
dd8f7a4e600a3c0126ab12aa565b41db479e416f965db606bc2f9de5b95484049265e9e38b7685f9f6981a3cb286f34991355841b999e58eff70c8a0839d7bed

Download Submit
C:\Windows\SysWOW64\Hiefcj32.exe

Filesize
273KB

MD5
2a7f7955027259f56e84211547207632

SHA1
7f150f2c03209c6859c473dd68e4cdb0cd21a193

SHA256
19a02fd6233a19cedadb13b5b0ed449ea733022ef37e226e5ca6efb8474c8407

SHA512
f37ff359801b2f4efee1cd58531594c2555a0f4c344428cd5d440b07d8a94e320ab372c5c859cb95ac13313f84ea27561e350bf892751ed55e4a56634a1cf821

Download Submit
C:\Windows\SysWOW64\Himldi32.exe

Filesize
273KB

MD5
71fa0441d84cc6fd3652aed6d1617fa5

SHA1
bc44c39c353548c497e83779a25f5edf4b49820f

SHA256
667b7b0b573f0267190c8af342fe0a0baacf2978f2cdb15ad5792a06db9f2dc6

SHA512
43bddf507697b6e07323dd4fc57db2d1d499c9a6e1d534691c2879c0133b089c7064645f1334833a67a4e159a1abdce5478a1c970ba52c4665d004034da05005

Download Submit
C:\Windows\SysWOW64\Hkdbpe32.exe

Filesize
273KB

MD5
0738ea059dc9647c31c4b4a87f1bd3bf

SHA1
339d26286577320d6ddf404a2c742bec34520f30

SHA256
2b3c99e95eedb6bf1be9404dbed9e4b4f16ade4a84debc55da9d4d189938f072

SHA512
93c6c03d990a2a415e958caf7724cdb7112f1710582f6c04862d9423e7701c787b89b9d847471d3084b6c1131734d02b3e324a969311f6044ca4563fb46b5699

Download Submit
C:\Windows\SysWOW64\Hkfoeega.exe

Filesize
273KB

MD5
338eb3fff32d79408f9463576221b967

SHA1
3863aa05cc1525ecb2cbce31de7bf388b628d971

SHA256
302c43d4640ed19eb3911edb72d0991a5eb72268d72820e86867602abb218c8c

SHA512
6ebb5aabc7b5f5d2b7c6d4493164d25dc3d00b1da1c2e52a9cb8abd9245f1a95a69d55401978e5222dacdb44731f649502121b9fa34c313d071b48f848ccbc28

Download Submit
C:\Windows\SysWOW64\Hkmefd32.exe

Filesize
273KB

MD5
cd3c11ceaa15085d05f52c028e632dfd

SHA1
8378d7faac6ba3fc486960e3aa42ec1c7b7806cf

SHA256
8f67b947a6b1e3d9abff43623c5e09bfe2d8b5a25df72d69eb3086166fdcdc7d

SHA512
2a9403a530931e01464fd3f1f36d42bf907fdb5edda302ee6be1b5e93aa737d84ac2badd7fba1d98c60513800daea09f0845bd422525bdbea9a782052a003cd9

Download Submit
C:\Windows\SysWOW64\Hkpheidp.exe

Filesize
273KB

MD5
f7e21e87bca82e9310eb6a89f270adb9

SHA1
f192fdfb27824663a6f797893690018cd0fbaf25

SHA256
c9b8282841e0d96b2e4ec83a02cac349cef699273834c98d1894294c368188d8

SHA512
8523f1d00379d5da3bee2f83d96e7826c7e8afae468955e09acbd3269603d942ebd4aeede31a80d80f47b81b5450cd6ee48ae092bc0d92c44863544d6d6e63c6

Download Submit
C:\Windows\SysWOW64\Hodgkc32.exe

Filesize
273KB

MD5
6aa948a4a01a2195f4c215d32bc3192d

SHA1
0504171dd9c110c6c0af3358cf33a0a65d833c0e

SHA256
9cd8278953fb3700cf0df478dfe802010f173a03f4234ccf55c693fa6861cd36

SHA512
2842bf523df6f6acffc08c34f50f49e0677bf1e0e2e313d6ec294e52e824084c55f79d6eeeb7a3d407cbf86f1d9e99197533493dafc6b5ca81bfc758829f7bc2

Download Submit
C:\Windows\SysWOW64\Hofdacke.exe

Filesize
273KB

MD5
9a1180c8d6931c33b7c567f9b960c1d8

SHA1
9ac14adacab5dc2181e943112eb4141de490dbd0

SHA256
2cc86665a531ffde60d21fcb1162bc9ac1ac5feb26e3dfa27090beb068951170

SHA512
39de7a5ee9fd4511b0812f1ae838b449c3f50d35c672783f714ee3f4d79fbf10ef2dc4f8d0dd569e71111f695c7e349d222384ac4f397255eab975fd8d60630d

Download Submit
C:\Windows\SysWOW64\Ibjjhn32.exe

Filesize
273KB

MD5
f1f4d68eaa914448d183cf8b6a4ff015

SHA1
a15681539f49c3cdad87e40d6542bf753f0b595d

SHA256
100b725c4c11336896336914197f45b27a2e0aff4536138a3a839aee9f900820

SHA512
1bb7dfdd0ce8d27731a0eea005c854471bf7016d09574356a3395e3680ae80e05ae2e1259f7cba0f417ed4c32d0f40443485d6dc51adc548cece7189a2ff0ff2

Download Submit
C:\Windows\SysWOW64\Ibnccmbo.exe

Filesize
273KB

MD5
2e1a4a147d6d8e537edd85c4986f18d8

SHA1
ef2d739be8a9f0ea83c7295a32ac6c84e2dd120a

SHA256
e44c2b4bed6d9d2383aa36a80ca3da89a8fc6383e796c7f1f06c98e7abd32014

SHA512
4ded6f529a38bca79177e48eeee6b99545ca2f84201ecc3a5e021c4e19c2724aac08d3e900c74df071a6f7069f6ab78071fe3626a321b48c181068d3175010fb

Download Submit
C:\Windows\SysWOW64\Icifbang.exe

Filesize
273KB

MD5
c9acdd90768dbfb0cb2ec80e8d44c16e

SHA1
4e6db27cc011434a068ffa7edc1910d9ce983345

SHA256
ee1e153f34f95c3874c51cc9a80a1d996816217652075839141f3015de64667d

SHA512
75e957513c2d825b49b5b38451770ace405d0e24c9c529e97e28015727d788f0b5fdf7483e82b5b734d7a45afe9701d7f69ff09cb8ac8ff5e8e9e73521ecfa56

Download Submit
C:\Windows\SysWOW64\Iehfdi32.exe

Filesize
273KB

MD5
6d0a23695e4e8ea507fcfac5121524c3

SHA1
2775b8737faa0f28b8a67bdad34307bdae55b2d5

SHA256
c4333be0f6a218500cee5d0e62f9de436a796debbbe65c2a68e399533e101b06

SHA512
f0e0a1a2dbfff6199f8394a7f26d1c4ac5d5f70c3a7a9478ae384a1c32fe580000cd987cfffee5b7e05e0acda2f9785359180c516e6a2dfcd421731e81fe11bb

Download Submit
C:\Windows\SysWOW64\Iiaephpc.exe

Filesize
273KB

MD5
0ec70033da751360062d4b28866d7c62

SHA1
e3b2d65b95a959f816fe57525e682d7747206167

SHA256
f12109f595ce5b04824807bfc869b381c5bdf22b954c8e3d5687a1785e7e7719

SHA512
8ca6b3c38c9fa9790304aef7d56074ff83aa9fe461a46826913a243423cf6bd2c5b38657dbbf86b7aba1b5cc5aa55619a40b9427e576126a32b84eb586e207d4

Download Submit
C:\Windows\SysWOW64\Iifokh32.exe

Filesize
273KB

MD5
5e77192574a8affa21e8832fa9546509

SHA1
5b50a3100ee8fa0b80b194bbe11b88845cbc8f9a

SHA256
68230b609d2ff1faf395635d10f386bb43ee79b29a08e24f60594fee49bfbaf3

SHA512
07d5d40f8dedeaede8716f9627aee5a08ecda1057b74e9bd22f3e7acd814af62bd379e671264540249acf229c1fbc4a0964daaf16fc7460c002f156623655e03

Download Submit
C:\Windows\SysWOW64\Iihkpg32.exe

Filesize
273KB

MD5
641c91c28e1cd8d63c910db4429cb86f

SHA1
c6d24f1c070c97549658da8a746ff89520fae091

SHA256
38c21d1f2b2b5183a74ee41190796f5974d7c20d3e2b8f2ba752ed38f905865d

SHA512
0d8e7081fed46760606d738f39b72075fa24dd4f6012c9f0759ebb6ebeeedcd974ad6e15a47f74c294a7f261254bb7365834bba9cc5d7a4465ea7c21838b4c7c

Download Submit
C:\Windows\SysWOW64\Ikpaldog.exe

Filesize
273KB

MD5
114a1493b50846f12fddd8ed8726aaad

SHA1
4acf5b58617af6b63384d1c15e31c82858659cc3

SHA256
9327584e1a3458ceb90608d695fe3fbc2c2a241018010ff0789b9ff326ed3e35

SHA512
cfd3eab199e48f0ea0f78d6d5ef5a18ecfa05176abfb1e75b6000d9d37a8fcd6d1fcc6a0d3895666ce90861ec6b74fdcd70af13219f10686a31cca180062997f

Download Submit
C:\Windows\SysWOW64\Ildkgc32.exe

Filesize
273KB

MD5
811cc201b368035967a436149df310b4

SHA1
3b0b92e8c043d2074f6109789c8558e18a349a56

SHA256
6498ca02e2ca2e27a3c339dd0246638be0805eaa999300935f461b7a448c3774

SHA512
c812532634ea17a631bc045d8c9d60771a9176a2cd82b65e133269af0584ec56669145aa4db4b27f0fcc878958bddf9d078c3fba3458ff3fdf7fbb551d8baf06

Download Submit
C:\Windows\SysWOW64\Imoneg32.exe

Filesize
273KB

MD5
0565bac92dfba8d39395c3a15dc3541f

SHA1
68fda6612dd678da0e7cb7e7bd85ccf1bb0b87ca

SHA256
5968f18945bcd20c0c8818c98f8138a76fd10942983191e9ad90c304a8fa162e

SHA512
d026f652ada7b6aba722c01ca671e31bb778e3e1bbe2b271b3df5016a00830cdd74737f60deaf17902f1c4fb8e93d492d5ad997e58ae8d4497c871bd89fcf98d

Download Submit
C:\Windows\SysWOW64\Indfca32.exe

Filesize
273KB

MD5
67b5df2dbb45336e2971a647f0e230da

SHA1
b356e0ac5faf7d2c5b6a6930d3cf1c202ba1fb07

SHA256
f2754837862103d2307de209f8be1cab2306add4b7d6d4df62321bcfad307e0f

SHA512
a7be0779295c555aeff58bda20dbba5e24dbd5c78cef09f0bddfeadc5f2443d9f906a25771968d2cf5b1c4111d269b8013ca20dac8854739c9fed88af3d6b338

Download Submit
C:\Windows\SysWOW64\Kecabifp.exe

Filesize
273KB

MD5
73359b8725e2fba7c2cc19793a1714a9

SHA1
d484b3456ee46e2ee3740260180850cfceb7a4f7

SHA256
3114fb345e7fc5b17759f69b1aa9180b2a74b0f4aac82a426ecd1a357b4fcded

SHA512
d0fa13c4cbb136c98e482c70502f0b38b32d6cb5070f00c6e28d0359df3bc0f4214eba448a84f544d4e9b2a9aa6bb0c2032216683e70e7a5fc164cefb21a9ea2

Download Submit
C:\Windows\SysWOW64\Kelkaj32.exe

Filesize
273KB

MD5
e27698703179a6d178d1e29c05b01172

SHA1
028aab8a502fe5b5e8e7a8f07dab873b73c57cf7

SHA256
a03397a95dc076b53a8a2a58ecec23cd8d6b947a93506b97ead739460c71733b

SHA512
b9ce8c407c9f61ede767acb83d02fc73c0606e58cab5de07218c2f168315e7de6325c80fc3c4c180c106c070b82c7b1576e873d2af1a3ba500aa521b1c13a70a

Download Submit
C:\Windows\SysWOW64\Lfhnaa32.exe

Filesize
273KB

MD5
726347dae7e9028e2e2a0a1172d60969

SHA1
971bfe978f55f46bcffd72fac9dc73c7e1b5e238

SHA256
74c8ccec4f72420187841690fc682e9ce69368dfd255d9516a5141d79b789ef3

SHA512
85790013c4abc38450a65e2a70328f8a9d35363573c05d1bc55b92aa70df5264e18a95f693080d0de430f6a3543903ba09ac2380c750f1bae71d4d7e3c5da6c8

Download Submit
C:\Windows\SysWOW64\Ljdceo32.exe

Filesize
273KB

MD5
69125fcff2d6e0f32f34f1ecc00cc84e

SHA1
3551607f5552c7b40afeaf0e85fd34ef0f31118e

SHA256
7010998948463dbbe940d1bd1b9f69331408b8c02a9d10298199b579193a5e62

SHA512
948446a5684fd322d049d7e496cd0174df35f4fc1b715224737830675791dc8a53984864327efb0b78c320cbe0dad8c4361d9425101a8e9f3e918aa70fa24054

Download Submit
C:\Windows\SysWOW64\Pfhfan32.exe

Filesize
273KB

MD5
67aa968366e4c031eb8ce33f24a0da2c

SHA1
f303e0310789349d5dd15c888554f6ab1a4bda45

SHA256
be7372d96110fbc0283271edb0c4e404ecaaad2934ad5d89052d13683e04ee3a

SHA512
ae458e1a45687bc6abc3936cfa11543ecc872d1a7a8ae494cd58547c252a583fc8fa76107aba0cc59d0e41551f9b7eca11dff9163ee00387da2c57bed6289d23

Download Submit
memory/232-379-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/460-368-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/460-5-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/460-0-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/624-37-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/640-425-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/764-116-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/928-431-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/996-407-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1136-25-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1148-536-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1164-45-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1448-517-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1772-336-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1832-334-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/1988-419-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2076-335-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2184-290-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2336-17-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2424-324-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2492-315-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2584-507-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2588-278-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2712-519-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2732-332-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2744-354-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2748-317-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2796-333-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/2872-496-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3028-494-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3184-413-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3244-361-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3292-367-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3368-292-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3372-343-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3388-346-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3460-319-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3692-360-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3732-304-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3840-318-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/3880-345-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4120-342-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4216-534-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4264-353-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4336-395-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4348-351-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4408-344-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4516-305-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4520-484-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4552-460-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4564-466-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4616-478-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4676-405-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4696-326-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4724-441-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4824-12-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4844-124-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4852-291-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4860-443-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4940-449-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/4960-284-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/5016-472-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/5052-300-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download
memory/5188-542-0x0000000000400000-0x000000000046E000-memory.dmp

Filesize
440KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads