556c4e5d8c548da158ac795410faa497f650f9a16c1ff4cf09219cd82497c465

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2024, 18:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

556c4e5d8c548da158ac795410faa497f650f9a16c1ff4cf09219cd82497c465.exe
Size

482KB
MD5

002775a849e59ee48cb1d3fd2169d420
SHA1

3bc043805e719767547cee71a1e85e69fb369384
SHA256

556c4e5d8c548da158ac795410faa497f650f9a16c1ff4cf09219cd82497c465
SHA512

5dc31a8523dc5b8410992db31a062416882f9e59c9cfa6b2c39ebf5f1574103da6bf634537b51f0173e97925925278fe707d87969eb15d3547f51df2468a87d7
SSDEEP

6144:oJaOYn3sLl+wGXAF2PbgKLVGFM6234lKm3mo8Yvi4KsLTFM6234lKm3:ak8LMwGXAF5KLVGFB24lwR45FB24l

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pccahbmn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akblfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lmlpjdgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cihjeq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehifak32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcodfa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imakkfdg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phedhmhi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ihmnldib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gomkkagl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Hfniikha.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lknojl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kakmna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Bpbpecen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dbjade32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikejgf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qejfkmem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lalnmiia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dcibca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nocbfjmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Donecfao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndokbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Liqihglg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhilfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dnghhqdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Amcehdod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qppkhfec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdhlepkl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Loniiflo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibmeoq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cobkhb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aomifecf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elnoopdj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qhhpop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kihnmohm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kijjbofj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Paeelgnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncmaai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kdhlepkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qnpgdmjd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Plejdkmm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bebjdgmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Fofdkcmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Lbqklb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ikqqlgem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Qlggjk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fllkqn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icklhnop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdjagjco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oblmdhdo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kbpkkn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djmima32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ebdcld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Beoimjce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Jgenbfoa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hcmbee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ldhdlnli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmiciaaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghpocngo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Kfkamk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Baadiiif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Cbknhqbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Gmdjapgb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eokqkh32.exe

Executes dropped EXE 64 IoCs

pid	Process
2136	Iicbehnq.exe
4444	Imakkfdg.exe
1384	Ickchq32.exe
3432	Iihkpg32.exe
4548	Icnpmp32.exe
1544	Iikhfg32.exe
1904	Ilidbbgl.exe
5116	Jifhaenk.exe
648	Jcllonma.exe
3216	Kemhff32.exe
3596	Kmijbcpl.exe
1828	Kdcbom32.exe
4792	Kipkhdeq.exe
912	Kbhoqj32.exe
3344	Kmncnb32.exe
3560	Kplpjn32.exe
452	Lbjlfi32.exe
4424	Liddbc32.exe
3168	Lbmhlihl.exe
3388	Lenamdem.exe
4044	Llgjjnlj.exe
384	Lbabgh32.exe
4936	Lepncd32.exe
4928	Lljfpnjg.exe
3328	Lpebpm32.exe
4308	Lgokmgjm.exe
2616	Lmiciaaj.exe
208	Mdckfk32.exe
4616	Mgagbf32.exe
3628	Mpjlklok.exe
1976	Mchhggno.exe
2276	Mgddhf32.exe
4816	Mibpda32.exe
1728	Mdhdajea.exe
2132	Mgfqmfde.exe
1552	Miemjaci.exe
1376	Mdjagjco.exe
4736	Mgimcebb.exe
3540	Mmbfpp32.exe
1520	Mpablkhc.exe
2484	Mcpnhfhf.exe
1588	Miifeq32.exe
3928	Mlhbal32.exe
3452	Ndokbi32.exe
2612	Nepgjaeg.exe
1112	Npfkgjdn.exe
4072	Ngpccdlj.exe
1616	Nnjlpo32.exe
3716	Ndcdmikd.exe
3632	Neeqea32.exe
1512	Nnlhfn32.exe
4068	Npjebj32.exe
1348	Nnneknob.exe
1740	Nfjjppmm.exe
2744	Odkjng32.exe
1160	Ocbddc32.exe
5156	Ocgmpccl.exe
5200	Ofeilobp.exe
5232	Pmoahijl.exe
5284	Pfhfan32.exe
5320	Pqmjog32.exe
5372	Pjeoglgc.exe
5408	Pdkcde32.exe
5456	Pmfhig32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Fbcfhibj.exe	Eiieicml.exe
File created	C:\Windows\SysWOW64\Enhodk32.dll	Aknifq32.exe
File created	C:\Windows\SysWOW64\Hbohpn32.exe	Hoclopne.exe
File created	C:\Windows\SysWOW64\Akblfj32.exe	Aggpfkjj.exe
File created	C:\Windows\SysWOW64\Oenflo32.dll	Qejfkmem.exe
File opened for modification	C:\Windows\SysWOW64\Didjqoae.exe	Dehnpp32.exe
File opened for modification	C:\Windows\SysWOW64\Hgelek32.exe	Gdfoio32.exe
File created	C:\Windows\SysWOW64\Iohejo32.exe	Hbohpn32.exe
File created	C:\Windows\SysWOW64\Mioaanec.dll	Bhhiemoj.exe
File created	C:\Windows\SysWOW64\Onempd32.dll	Logbigbg.exe
File created	C:\Windows\SysWOW64\Bhgjcmfi.exe	Bnaffdfc.exe
File created	C:\Windows\SysWOW64\Kgjgne32.exe	Kelkaj32.exe
File created	C:\Windows\SysWOW64\Pagbaglh.exe	Pnifekmd.exe
File opened for modification	C:\Windows\SysWOW64\Jehhaaci.exe	Jkodhk32.exe
File created	C:\Windows\SysWOW64\Ahgcjddh.exe	Aehgnied.exe
File opened for modification	C:\Windows\SysWOW64\Icpecm32.exe	Iqaiga32.exe
File created	C:\Windows\SysWOW64\Gacbag32.dll	Dajnol32.exe
File created	C:\Windows\SysWOW64\Kceoppmo.exe	Knifging.exe
File created	C:\Windows\SysWOW64\Ehfjah32.exe	Deagdn32.exe
File created	C:\Windows\SysWOW64\Kbpbed32.exe	Klfjijgq.exe
File opened for modification	C:\Windows\SysWOW64\Gmdjapgb.exe	Gjfnedho.exe
File created	C:\Windows\SysWOW64\Empmffib.dll	Inqbclob.exe
File created	C:\Windows\SysWOW64\Bdbnjdfg.exe	Badanigc.exe
File created	C:\Windows\SysWOW64\Debaqh32.dll	Ocmjhfjl.exe
File created	C:\Windows\SysWOW64\Jjhalkjc.exe	Imnjbhaa.exe
File created	C:\Windows\SysWOW64\Daajam32.dll	Gheodg32.exe
File opened for modification	C:\Windows\SysWOW64\Mgimcebb.exe	Mdjagjco.exe
File created	C:\Windows\SysWOW64\Moqkim32.dll	Hhknpmma.exe
File opened for modification	C:\Windows\SysWOW64\Mhilfa32.exe	Mejpje32.exe
File created	C:\Windows\SysWOW64\Jcgnbaeo.exe	Jjoiil32.exe
File created	C:\Windows\SysWOW64\Bafndi32.exe	Bklfgo32.exe
File created	C:\Windows\SysWOW64\Dijbno32.exe	Dbpjaeoc.exe
File created	C:\Windows\SysWOW64\Ckoifgmb.exe	Ciqmjkno.exe
File opened for modification	C:\Windows\SysWOW64\Kbhoqj32.exe	Kipkhdeq.exe
File created	C:\Windows\SysWOW64\Kfcdfbqo.exe	Kpiljh32.exe
File created	C:\Windows\SysWOW64\Mnnkgl32.exe	Mlpokp32.exe
File created	C:\Windows\SysWOW64\Chlflabp.exe	Cfnjpfcl.exe
File created	C:\Windows\SysWOW64\Iikikigb.dll	Cfpffeaj.exe
File created	C:\Windows\SysWOW64\Kpibgp32.dll	Ojdgnn32.exe
File created	C:\Windows\SysWOW64\Elcmjaol.dll	Pdkcde32.exe
File created	C:\Windows\SysWOW64\Piomhofd.dll	Iafonaao.exe
File created	C:\Windows\SysWOW64\Bochmn32.exe	Akglloai.exe
File created	C:\Windows\SysWOW64\Nopkoobi.dll	Dhcfleff.exe
File opened for modification	C:\Windows\SysWOW64\Elaobdmm.exe	Dehgejep.exe
File created	C:\Windows\SysWOW64\Codqon32.dll	Nepgjaeg.exe
File created	C:\Windows\SysWOW64\Jieagojp.exe	Jnpmjf32.exe
File created	C:\Windows\SysWOW64\Chalkm32.dll	Olijhmgj.exe
File created	C:\Windows\SysWOW64\Fmplqd32.dll	Kgnbdh32.exe
File opened for modification	C:\Windows\SysWOW64\Ghcbohpp.exe	Gipbck32.exe
File created	C:\Windows\SysWOW64\Eaoimpil.dll	Cbknhqbl.exe
File created	C:\Windows\SysWOW64\Nahffe32.dll	Jgcamf32.exe
File created	C:\Windows\SysWOW64\Inqbclob.exe	Icknfcol.exe
File created	C:\Windows\SysWOW64\Oefaplcm.dll	Fcodfa32.exe
File created	C:\Windows\SysWOW64\Ckegbb32.dll	Jnpmjf32.exe
File opened for modification	C:\Windows\SysWOW64\Jkhgmf32.exe	Jhijqj32.exe
File created	C:\Windows\SysWOW64\Fpjqcaao.dll	Elnoopdj.exe
File created	C:\Windows\SysWOW64\Kaqejcep.exe	Kmeiie32.exe
File created	C:\Windows\SysWOW64\Mbedga32.exe	Mpghkf32.exe
File created	C:\Windows\SysWOW64\Ibgpcd32.dll	Leenhhdn.exe
File opened for modification	C:\Windows\SysWOW64\Badanigc.exe	Blgifbil.exe
File opened for modification	C:\Windows\SysWOW64\Qfjcep32.exe	Qppkhfec.exe
File opened for modification	C:\Windows\SysWOW64\Cjomldfp.exe	Cgaqphgl.exe
File created	C:\Windows\SysWOW64\Djmima32.exe	Dgomaf32.exe
File created	C:\Windows\SysWOW64\Kdcbom32.exe	Kmijbcpl.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8048	9644	WerFault.exe	1004

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Cjbpaf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcehifmk.dll"	Jbiejoaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdnjmc32.dll"	Lddgmbpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bldgoeog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Bkjpkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dehgejep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcoobn32.dll"	Obafpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Afqifo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ciefek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ocbddc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ndpjnq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Fekclnif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcdfimja.dll"	Iqaiga32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mehcdfch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Eeelnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gpjjpe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Cihjeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ndokbi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ibknda32.dll"	Bklfgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Abjfqpji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjdmlonn.dll"	Cpifeb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ikpnha32.dll"	Kfidgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Khhaanop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elcmjaol.dll"	Pdkcde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aalebkhm.dll"	Ljgpkonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oenqhaga.dll"	Efafgifc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbgcol32.dll"	Ehkcgkdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dgmpkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Pfhfan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Plejdkmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kakmna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kffhakjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mhhjhlqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nhkikq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Kjccdkki.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Efeihb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Gimqajgh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Qmanljfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dhdmfljb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kiljkifg.dll"	Miemjaci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ckegbb32.dll"	Jnpmjf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Hbenoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dcibca32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gnohnffc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agccao32.dll"	Bpbpecen.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Mnphmkji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Loniiflo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Eppobi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Gipbck32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Jfpojead.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glgokg32.dll"	Meamcg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Pfbmdabh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldacnaoi.dll"	Pbifol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Doqbifpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoahkfnb.dll"	Fiilblom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klkkgm32.dll"	Inainbcn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Plejdkmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Comjoclk.dll"	Jjoiil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Blgifbil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lcccepbd.dll"	Ahofoogd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejfcjp32.dll"	Dfcqod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jphopllo.dll"	Llgjjnlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Mdjagjco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Noeahkfc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2136	2628	556c4e5d8c548da158ac795410faa497f650f9a16c1ff4cf09219cd82497c465.exe	95
PID 2628 wrote to memory of 2136	2628	556c4e5d8c548da158ac795410faa497f650f9a16c1ff4cf09219cd82497c465.exe	95
PID 2628 wrote to memory of 2136	2628	556c4e5d8c548da158ac795410faa497f650f9a16c1ff4cf09219cd82497c465.exe	95
PID 2136 wrote to memory of 4444	2136	Iicbehnq.exe	96
PID 2136 wrote to memory of 4444	2136	Iicbehnq.exe	96
PID 2136 wrote to memory of 4444	2136	Iicbehnq.exe	96
PID 4444 wrote to memory of 1384	4444	Imakkfdg.exe	97
PID 4444 wrote to memory of 1384	4444	Imakkfdg.exe	97
PID 4444 wrote to memory of 1384	4444	Imakkfdg.exe	97
PID 1384 wrote to memory of 3432	1384	Ickchq32.exe	98
PID 1384 wrote to memory of 3432	1384	Ickchq32.exe	98
PID 1384 wrote to memory of 3432	1384	Ickchq32.exe	98
PID 3432 wrote to memory of 4548	3432	Iihkpg32.exe	99
PID 3432 wrote to memory of 4548	3432	Iihkpg32.exe	99
PID 3432 wrote to memory of 4548	3432	Iihkpg32.exe	99
PID 4548 wrote to memory of 1544	4548	Icnpmp32.exe	100
PID 4548 wrote to memory of 1544	4548	Icnpmp32.exe	100
PID 4548 wrote to memory of 1544	4548	Icnpmp32.exe	100
PID 1544 wrote to memory of 1904	1544	Iikhfg32.exe	101
PID 1544 wrote to memory of 1904	1544	Iikhfg32.exe	101
PID 1544 wrote to memory of 1904	1544	Iikhfg32.exe	101
PID 1904 wrote to memory of 5116	1904	Ilidbbgl.exe	102
PID 1904 wrote to memory of 5116	1904	Ilidbbgl.exe	102
PID 1904 wrote to memory of 5116	1904	Ilidbbgl.exe	102
PID 5116 wrote to memory of 648	5116	Jifhaenk.exe	103
PID 5116 wrote to memory of 648	5116	Jifhaenk.exe	103
PID 5116 wrote to memory of 648	5116	Jifhaenk.exe	103
PID 648 wrote to memory of 3216	648	Jcllonma.exe	104
PID 648 wrote to memory of 3216	648	Jcllonma.exe	104
PID 648 wrote to memory of 3216	648	Jcllonma.exe	104
PID 3216 wrote to memory of 3596	3216	Kemhff32.exe	105
PID 3216 wrote to memory of 3596	3216	Kemhff32.exe	105
PID 3216 wrote to memory of 3596	3216	Kemhff32.exe	105
PID 3596 wrote to memory of 1828	3596	Kmijbcpl.exe	106
PID 3596 wrote to memory of 1828	3596	Kmijbcpl.exe	106
PID 3596 wrote to memory of 1828	3596	Kmijbcpl.exe	106
PID 1828 wrote to memory of 4792	1828	Kdcbom32.exe	107
PID 1828 wrote to memory of 4792	1828	Kdcbom32.exe	107
PID 1828 wrote to memory of 4792	1828	Kdcbom32.exe	107
PID 4792 wrote to memory of 912	4792	Kipkhdeq.exe	108
PID 4792 wrote to memory of 912	4792	Kipkhdeq.exe	108
PID 4792 wrote to memory of 912	4792	Kipkhdeq.exe	108
PID 912 wrote to memory of 3344	912	Kbhoqj32.exe	109
PID 912 wrote to memory of 3344	912	Kbhoqj32.exe	109
PID 912 wrote to memory of 3344	912	Kbhoqj32.exe	109
PID 3344 wrote to memory of 3560	3344	Kmncnb32.exe	110
PID 3344 wrote to memory of 3560	3344	Kmncnb32.exe	110
PID 3344 wrote to memory of 3560	3344	Kmncnb32.exe	110
PID 3560 wrote to memory of 452	3560	Kplpjn32.exe	111
PID 3560 wrote to memory of 452	3560	Kplpjn32.exe	111
PID 3560 wrote to memory of 452	3560	Kplpjn32.exe	111
PID 452 wrote to memory of 4424	452	Lbjlfi32.exe	112
PID 452 wrote to memory of 4424	452	Lbjlfi32.exe	112
PID 452 wrote to memory of 4424	452	Lbjlfi32.exe	112
PID 4424 wrote to memory of 3168	4424	Liddbc32.exe	113
PID 4424 wrote to memory of 3168	4424	Liddbc32.exe	113
PID 4424 wrote to memory of 3168	4424	Liddbc32.exe	113
PID 3168 wrote to memory of 3388	3168	Lbmhlihl.exe	114
PID 3168 wrote to memory of 3388	3168	Lbmhlihl.exe	114
PID 3168 wrote to memory of 3388	3168	Lbmhlihl.exe	114
PID 3388 wrote to memory of 4044	3388	Lenamdem.exe	115
PID 3388 wrote to memory of 4044	3388	Lenamdem.exe	115
PID 3388 wrote to memory of 4044	3388	Lenamdem.exe	115
PID 4044 wrote to memory of 384	4044	Llgjjnlj.exe	116

C:\Users\Admin\AppData\Local\Temp\556c4e5d8c548da158ac795410faa497f650f9a16c1ff4cf09219cd82497c465.exe
"C:\Users\Admin\AppData\Local\Temp\556c4e5d8c548da158ac795410faa497f650f9a16c1ff4cf09219cd82497c465.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\Iicbehnq.exe
  C:\Windows\system32\Iicbehnq.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\Imakkfdg.exe
    C:\Windows\system32\Imakkfdg.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4444
  - - C:\Windows\SysWOW64\Ickchq32.exe
      C:\Windows\system32\Ickchq32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1384
    - - C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3432
      - C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4548
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1544
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1904
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:648
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3216
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3596
        
        C:\Windows\SysWOW64\Kdcbom32.exe
        
        C:\Windows\system32\Kdcbom32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1828
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4792
        
        C:\Windows\SysWOW64\Kbhoqj32.exe
        
        C:\Windows\system32\Kbhoqj32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:912
        
        C:\Windows\SysWOW64\Kmncnb32.exe
        
        C:\Windows\system32\Kmncnb32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3344
        
        C:\Windows\SysWOW64\Kplpjn32.exe
        
        C:\Windows\system32\Kplpjn32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3560
        
        C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:452
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4424
        
        C:\Windows\SysWOW64\Lbmhlihl.exe
        
        C:\Windows\system32\Lbmhlihl.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3168
        
        C:\Windows\SysWOW64\Lenamdem.exe
        
        C:\Windows\system32\Lenamdem.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3388
        
        C:\Windows\SysWOW64\Llgjjnlj.exe
        
        C:\Windows\system32\Llgjjnlj.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4044
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        23⤵
        Executes dropped EXE
        
        PID:384
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        24⤵
        Executes dropped EXE
        
        PID:4936
        
        C:\Windows\SysWOW64\Lljfpnjg.exe
        
        C:\Windows\system32\Lljfpnjg.exe
        25⤵
        Executes dropped EXE
        
        PID:4928
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        26⤵
        Executes dropped EXE
        
        PID:3328
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        27⤵
        Executes dropped EXE
        
        PID:4308
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2616
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        29⤵
        Executes dropped EXE
        
        PID:208
        
        C:\Windows\SysWOW64\Mgagbf32.exe
        
        C:\Windows\system32\Mgagbf32.exe
        30⤵
        Executes dropped EXE
        
        PID:4616
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        31⤵
        Executes dropped EXE
        
        PID:3628
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        32⤵
        Executes dropped EXE
        
        PID:1976
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        33⤵
        Executes dropped EXE
        
        PID:2276
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        34⤵
        Executes dropped EXE
        
        PID:4816
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        35⤵
        Executes dropped EXE
        
        PID:1728
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        36⤵
        Executes dropped EXE
        
        PID:2132
        
        C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1552
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1376
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        39⤵
        Executes dropped EXE
        
        PID:4736
        
        C:\Windows\SysWOW64\Mmbfpp32.exe
        
        C:\Windows\system32\Mmbfpp32.exe
        40⤵
        Executes dropped EXE
        
        PID:3540
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        41⤵
        Executes dropped EXE
        
        PID:1520
        
        C:\Windows\SysWOW64\Mcpnhfhf.exe
        
        C:\Windows\system32\Mcpnhfhf.exe
        42⤵
        Executes dropped EXE
        
        PID:2484
        
        C:\Windows\SysWOW64\Miifeq32.exe
        
        C:\Windows\system32\Miifeq32.exe
        43⤵
        Executes dropped EXE
        
        PID:1588
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        44⤵
        Executes dropped EXE
        
        PID:3928
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3452
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        46⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2612
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        47⤵
        Executes dropped EXE
        
        PID:1112
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        48⤵
        Executes dropped EXE
        
        PID:4072
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        49⤵
        Executes dropped EXE
        
        PID:1616
        
        C:\Windows\SysWOW64\Ndcdmikd.exe
        
        C:\Windows\system32\Ndcdmikd.exe
        50⤵
        Executes dropped EXE
        
        PID:3716
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        51⤵
        Executes dropped EXE
        
        PID:3632
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        52⤵
        Executes dropped EXE
        
        PID:1512
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        53⤵
        Executes dropped EXE
        
        PID:4068
        
        C:\Windows\SysWOW64\Nnneknob.exe
        
        C:\Windows\system32\Nnneknob.exe
        54⤵
        Executes dropped EXE
        
        PID:1348
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        55⤵
        Executes dropped EXE
        
        PID:1740
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        56⤵
        Executes dropped EXE
        
        PID:2744
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        57⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1160
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        58⤵
        Executes dropped EXE
        
        PID:5156
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        59⤵
        Executes dropped EXE
        
        PID:5200
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        60⤵
        Executes dropped EXE
        
        PID:5232
        
        C:\Windows\SysWOW64\Pfhfan32.exe
        
        C:\Windows\system32\Pfhfan32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5284
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        62⤵
        Executes dropped EXE
        
        PID:5320
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        63⤵
        Executes dropped EXE
        
        PID:5372
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        65⤵
        Executes dropped EXE
        
        PID:5456
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        66⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        67⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        68⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        69⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        70⤵
        Modifies registry class
        
        PID:5716
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        71⤵
        Drops file in System32 directory
        
        PID:5756
        
        C:\Windows\SysWOW64\Ehfjah32.exe
        
        C:\Windows\system32\Ehfjah32.exe
        72⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Eopbnbhd.exe
        
        C:\Windows\system32\Eopbnbhd.exe
        73⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Eobocb32.exe
        
        C:\Windows\system32\Eobocb32.exe
        74⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Ehkclgmb.exe
        
        C:\Windows\system32\Ehkclgmb.exe
        75⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Eoekia32.exe
        
        C:\Windows\system32\Eoekia32.exe
        76⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Ghpendjj.exe
        
        C:\Windows\system32\Ghpendjj.exe
        77⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Gnmnfkia.exe
        
        C:\Windows\system32\Gnmnfkia.exe
        78⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Ggeboaob.exe
        
        C:\Windows\system32\Ggeboaob.exe
        79⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Hdicienl.exe
        
        C:\Windows\system32\Hdicienl.exe
        80⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Hkckeo32.exe
        
        C:\Windows\system32\Hkckeo32.exe
        81⤵
        
        PID:432
        
        C:\Windows\SysWOW64\Hnagak32.exe
        
        C:\Windows\system32\Hnagak32.exe
        82⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Hfipbh32.exe
        
        C:\Windows\system32\Hfipbh32.exe
        83⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Hnddgjbj.exe
        
        C:\Windows\system32\Hnddgjbj.exe
        84⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Hkhdqoac.exe
        
        C:\Windows\system32\Hkhdqoac.exe
        85⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Hhlejcpm.exe
        
        C:\Windows\system32\Hhlejcpm.exe
        86⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Hofmfmhj.exe
        
        C:\Windows\system32\Hofmfmhj.exe
        87⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Hfpecg32.exe
        
        C:\Windows\system32\Hfpecg32.exe
        88⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\Hkmnln32.exe
        
        C:\Windows\system32\Hkmnln32.exe
        89⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Ifbbig32.exe
        
        C:\Windows\system32\Ifbbig32.exe
        90⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\Ihqoeb32.exe
        
        C:\Windows\system32\Ihqoeb32.exe
        91⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\Iokgal32.exe
        
        C:\Windows\system32\Iokgal32.exe
        92⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Iickkbje.exe
        
        C:\Windows\system32\Iickkbje.exe
        93⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Iomcgl32.exe
        
        C:\Windows\system32\Iomcgl32.exe
        94⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Iiehpahb.exe
        
        C:\Windows\system32\Iiehpahb.exe
        95⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Inbqhhfj.exe
        
        C:\Windows\system32\Inbqhhfj.exe
        96⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Ikfabm32.exe
        
        C:\Windows\system32\Ikfabm32.exe
        97⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\Ioambknl.exe
        
        C:\Windows\system32\Ioambknl.exe
        98⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Ibpiogmp.exe
        
        C:\Windows\system32\Ibpiogmp.exe
        99⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Ienekbld.exe
        
        C:\Windows\system32\Ienekbld.exe
        100⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Jkhngl32.exe
        
        C:\Windows\system32\Jkhngl32.exe
        101⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Jngjch32.exe
        
        C:\Windows\system32\Jngjch32.exe
        102⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Jfnbdecg.exe
        
        C:\Windows\system32\Jfnbdecg.exe
        103⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Jilnqqbj.exe
        
        C:\Windows\system32\Jilnqqbj.exe
        104⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Joffnk32.exe
        
        C:\Windows\system32\Joffnk32.exe
        105⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Jfpojead.exe
        
        C:\Windows\system32\Jfpojead.exe
        106⤵
        Modifies registry class
        
        PID:6520
        
        C:\Windows\SysWOW64\Jgakbm32.exe
        
        C:\Windows\system32\Jgakbm32.exe
        107⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Joiccj32.exe
        
        C:\Windows\system32\Joiccj32.exe
        108⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Jiaglp32.exe
        
        C:\Windows\system32\Jiaglp32.exe
        109⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Jkodhk32.exe
        
        C:\Windows\system32\Jkodhk32.exe
        110⤵
        Drops file in System32 directory
        
        PID:6664
        
        C:\Windows\SysWOW64\Jehhaaci.exe
        
        C:\Windows\system32\Jehhaaci.exe
        111⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Jgfdmlcm.exe
        
        C:\Windows\system32\Jgfdmlcm.exe
        112⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Jnpmjf32.exe
        
        C:\Windows\system32\Jnpmjf32.exe
        113⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6788
        
        C:\Windows\SysWOW64\Jieagojp.exe
        
        C:\Windows\system32\Jieagojp.exe
        114⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Kppici32.exe
        
        C:\Windows\system32\Kppici32.exe
        115⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Kbnepe32.exe
        
        C:\Windows\system32\Kbnepe32.exe
        116⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Kihnmohm.exe
        
        C:\Windows\system32\Kihnmohm.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6968
        
        C:\Windows\SysWOW64\Klfjijgq.exe
        
        C:\Windows\system32\Klfjijgq.exe
        118⤵
        Drops file in System32 directory
        
        PID:7008
        
        C:\Windows\SysWOW64\Kbpbed32.exe
        
        C:\Windows\system32\Kbpbed32.exe
        119⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Kijjbofj.exe
        
        C:\Windows\system32\Kijjbofj.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7084
        
        C:\Windows\SysWOW64\Kpdboimg.exe
        
        C:\Windows\system32\Kpdboimg.exe
        121⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Kfnkkb32.exe
        
        C:\Windows\system32\Kfnkkb32.exe
        122⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Klkcdj32.exe
        
        C:\Windows\system32\Klkcdj32.exe
        123⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Kfqgab32.exe
        
        C:\Windows\system32\Kfqgab32.exe
        124⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Khbdikip.exe
        
        C:\Windows\system32\Khbdikip.exe
        125⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Kpiljh32.exe
        
        C:\Windows\system32\Kpiljh32.exe
        126⤵
        Drops file in System32 directory
        
        PID:6404
        
        C:\Windows\SysWOW64\Kfcdfbqo.exe
        
        C:\Windows\system32\Kfcdfbqo.exe
        127⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Lpkiph32.exe
        
        C:\Windows\system32\Lpkiph32.exe
        128⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Lfealaol.exe
        
        C:\Windows\system32\Lfealaol.exe
        129⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Lidmhmnp.exe
        
        C:\Windows\system32\Lidmhmnp.exe
        130⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Lpneegel.exe
        
        C:\Windows\system32\Lpneegel.exe
        131⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Lblaabdp.exe
        
        C:\Windows\system32\Lblaabdp.exe
        132⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Lifjnm32.exe
        
        C:\Windows\system32\Lifjnm32.exe
        133⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Lldfjh32.exe
        
        C:\Windows\system32\Lldfjh32.exe
        134⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Locbfd32.exe
        
        C:\Windows\system32\Locbfd32.exe
        135⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Lemkcnaa.exe
        
        C:\Windows\system32\Lemkcnaa.exe
        136⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Llgcph32.exe
        
        C:\Windows\system32\Llgcph32.exe
        137⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Lbqklb32.exe
        
        C:\Windows\system32\Lbqklb32.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6296
        
        C:\Windows\SysWOW64\Likcilhh.exe
        
        C:\Windows\system32\Likcilhh.exe
        139⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Lpekef32.exe
        
        C:\Windows\system32\Lpekef32.exe
        140⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Lfodbqfa.exe
        
        C:\Windows\system32\Lfodbqfa.exe
        141⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Mimpolee.exe
        
        C:\Windows\system32\Mimpolee.exe
        142⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Mpghkf32.exe
        
        C:\Windows\system32\Mpghkf32.exe
        143⤵
        Drops file in System32 directory
        
        PID:6956
        
        C:\Windows\SysWOW64\Mbedga32.exe
        
        C:\Windows\system32\Mbedga32.exe
        144⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Miomdk32.exe
        
        C:\Windows\system32\Miomdk32.exe
        145⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Mlnipg32.exe
        
        C:\Windows\system32\Mlnipg32.exe
        146⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Ghkeio32.exe
        
        C:\Windows\system32\Ghkeio32.exe
        147⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Gilapgqb.exe
        
        C:\Windows\system32\Gilapgqb.exe
        148⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Gacjadad.exe
        
        C:\Windows\system32\Gacjadad.exe
        149⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Gdafnpqh.exe
        
        C:\Windows\system32\Gdafnpqh.exe
        150⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Ggpbjkpl.exe
        
        C:\Windows\system32\Ggpbjkpl.exe
        151⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\Ginnfgop.exe
        
        C:\Windows\system32\Ginnfgop.exe
        152⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\Gphgbafl.exe
        
        C:\Windows\system32\Gphgbafl.exe
        153⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Ghpocngo.exe
        
        C:\Windows\system32\Ghpocngo.exe
        154⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6872
        
        C:\Windows\SysWOW64\Giqkkf32.exe
        
        C:\Windows\system32\Giqkkf32.exe
        155⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\Gahcmd32.exe
        
        C:\Windows\system32\Gahcmd32.exe
        156⤵
        
        PID:212
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        157⤵
        Drops file in System32 directory
        
        PID:7212
        
        C:\Windows\SysWOW64\Hgelek32.exe
        
        C:\Windows\system32\Hgelek32.exe
        158⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Hjchaf32.exe
        
        C:\Windows\system32\Hjchaf32.exe
        159⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Hdilnojp.exe
        
        C:\Windows\system32\Hdilnojp.exe
        160⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Hgghjjid.exe
        
        C:\Windows\system32\Hgghjjid.exe
        161⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Hjedffig.exe
        
        C:\Windows\system32\Hjedffig.exe
        162⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Hhfedm32.exe
        
        C:\Windows\system32\Hhfedm32.exe
        163⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Hkeaqi32.exe
        
        C:\Windows\system32\Hkeaqi32.exe
        164⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Hncmmd32.exe
        
        C:\Windows\system32\Hncmmd32.exe
        165⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Hpbiip32.exe
        
        C:\Windows\system32\Hpbiip32.exe
        166⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Hhiajmod.exe
        
        C:\Windows\system32\Hhiajmod.exe
        167⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Hjjnae32.exe
        
        C:\Windows\system32\Hjjnae32.exe
        168⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Hpdfnolo.exe
        
        C:\Windows\system32\Hpdfnolo.exe
        169⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Hhknpmma.exe
        
        C:\Windows\system32\Hhknpmma.exe
        170⤵
        Drops file in System32 directory
        
        PID:7772
        
        C:\Windows\SysWOW64\Hgnoki32.exe
        
        C:\Windows\system32\Hgnoki32.exe
        171⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Hjlkge32.exe
        
        C:\Windows\system32\Hjlkge32.exe
        172⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Hpfcdojl.exe
        
        C:\Windows\system32\Hpfcdojl.exe
        173⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Igqkqiai.exe
        
        C:\Windows\system32\Igqkqiai.exe
        174⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Iafonaao.exe
        
        C:\Windows\system32\Iafonaao.exe
        175⤵
        Drops file in System32 directory
        
        PID:7972
        
        C:\Windows\SysWOW64\Iddljmpc.exe
        
        C:\Windows\system32\Iddljmpc.exe
        176⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Igchfiof.exe
        
        C:\Windows\system32\Igchfiof.exe
        177⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Inmpcc32.exe
        
        C:\Windows\system32\Inmpcc32.exe
        178⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Iqklon32.exe
        
        C:\Windows\system32\Iqklon32.exe
        179⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Ihbdplfi.exe
        
        C:\Windows\system32\Ihbdplfi.exe
        180⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7220
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        182⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Ihdafkdg.exe
        
        C:\Windows\system32\Ihdafkdg.exe
        183⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Ikcmbfcj.exe
        
        C:\Windows\system32\Ikcmbfcj.exe
        184⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Inainbcn.exe
        
        C:\Windows\system32\Inainbcn.exe
        185⤵
        Modifies registry class
        
        PID:7488
        
        C:\Windows\SysWOW64\Ibmeoq32.exe
        
        C:\Windows\system32\Ibmeoq32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7632
        
        C:\Windows\SysWOW64\Ihgnkkbd.exe
        
        C:\Windows\system32\Ihgnkkbd.exe
        187⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Ikejgf32.exe
        
        C:\Windows\system32\Ikejgf32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7744
        
        C:\Windows\SysWOW64\Indfca32.exe
        
        C:\Windows\system32\Indfca32.exe
        189⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Iqbbpm32.exe
        
        C:\Windows\system32\Iqbbpm32.exe
        190⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Jhijqj32.exe
        
        C:\Windows\system32\Jhijqj32.exe
        191⤵
        Drops file in System32 directory
        
        PID:7956
        
        C:\Windows\SysWOW64\Jkhgmf32.exe
        
        C:\Windows\system32\Jkhgmf32.exe
        192⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Jnfcia32.exe
        
        C:\Windows\system32\Jnfcia32.exe
        193⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        194⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        195⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\Jkjcbe32.exe
        
        C:\Windows\system32\Jkjcbe32.exe
        196⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        197⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Jqglkmlj.exe
        
        C:\Windows\system32\Jqglkmlj.exe
        198⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        199⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Jjopcb32.exe
        
        C:\Windows\system32\Jjopcb32.exe
        200⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Jgcamf32.exe
        
        C:\Windows\system32\Jgcamf32.exe
        201⤵
        Drops file in System32 directory
        
        PID:7924
        
        C:\Windows\SysWOW64\Jjamia32.exe
        
        C:\Windows\system32\Jjamia32.exe
        202⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        203⤵
        Modifies registry class
        
        PID:8124
        
        C:\Windows\SysWOW64\Jibmgi32.exe
        
        C:\Windows\system32\Jibmgi32.exe
        204⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Jgenbfoa.exe
        
        C:\Windows\system32\Jgenbfoa.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7516
        
        C:\Windows\SysWOW64\Jjdjoane.exe
        
        C:\Windows\system32\Jjdjoane.exe
        206⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        207⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Kdinljnk.exe
        
        C:\Windows\system32\Kdinljnk.exe
        208⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Kghjhemo.exe
        
        C:\Windows\system32\Kghjhemo.exe
        209⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        210⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Kbmoen32.exe
        
        C:\Windows\system32\Kbmoen32.exe
        211⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        212⤵
        Drops file in System32 directory
        
        PID:7236
        
        C:\Windows\SysWOW64\Kgjgne32.exe
        
        C:\Windows\system32\Kgjgne32.exe
        213⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Kndojobi.exe
        
        C:\Windows\system32\Kndojobi.exe
        214⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Kbpkkn32.exe
        
        C:\Windows\system32\Kbpkkn32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7996
        
        C:\Windows\SysWOW64\Kkhpdcab.exe
        
        C:\Windows\system32\Kkhpdcab.exe
        216⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Kbbhqn32.exe
        
        C:\Windows\system32\Kbbhqn32.exe
        217⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Leenhhdn.exe
        
        C:\Windows\system32\Leenhhdn.exe
        218⤵
        Drops file in System32 directory
        
        PID:8264
        
        C:\Windows\SysWOW64\Liqihglg.exe
        
        C:\Windows\system32\Liqihglg.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8304
        
        C:\Windows\SysWOW64\Ljbfpo32.exe
        
        C:\Windows\system32\Ljbfpo32.exe
        220⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Lalnmiia.exe
        
        C:\Windows\system32\Lalnmiia.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8400
        
        C:\Windows\SysWOW64\Licfngjd.exe
        
        C:\Windows\system32\Licfngjd.exe
        222⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        223⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        224⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        225⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Ljgpkonp.exe
        
        C:\Windows\system32\Ljgpkonp.exe
        226⤵
        Modifies registry class
        
        PID:8640
        
        C:\Windows\SysWOW64\Laqhhi32.exe
        
        C:\Windows\system32\Laqhhi32.exe
        227⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Lelchgne.exe
        
        C:\Windows\system32\Lelchgne.exe
        228⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        229⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Lndham32.exe
        
        C:\Windows\system32\Lndham32.exe
        230⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        231⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Lijlof32.exe
        
        C:\Windows\system32\Lijlof32.exe
        232⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Llhikacp.exe
        
        C:\Windows\system32\Llhikacp.exe
        233⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        234⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Mbbagk32.exe
        
        C:\Windows\system32\Mbbagk32.exe
        235⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        236⤵
        Modifies registry class
        
        PID:9088
        
        C:\Windows\SysWOW64\Milidebi.exe
        
        C:\Windows\system32\Milidebi.exe
        237⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Mlkepaam.exe
        
        C:\Windows\system32\Mlkepaam.exe
        238⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        239⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Mahnhhod.exe
        
        C:\Windows\system32\Mahnhhod.exe
        240⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Miofjepg.exe
        
        C:\Windows\system32\Miofjepg.exe
        241⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Mlmbfqoj.exe
        
        C:\Windows\system32\Mlmbfqoj.exe
        242⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        243⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Meefofek.exe
        
        C:\Windows\system32\Meefofek.exe
        244⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Mlpokp32.exe
        
        C:\Windows\system32\Mlpokp32.exe
        245⤵
        Drops file in System32 directory
        
        PID:8576
        
        C:\Windows\SysWOW64\Mnnkgl32.exe
        
        C:\Windows\system32\Mnnkgl32.exe
        246⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Mehcdfch.exe
        
        C:\Windows\system32\Mehcdfch.exe
        247⤵
        Modifies registry class
        
        PID:8744
        
        C:\Windows\SysWOW64\Mhfppabl.exe
        
        C:\Windows\system32\Mhfppabl.exe
        248⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        249⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Mnphmkji.exe
        
        C:\Windows\system32\Mnphmkji.exe
        250⤵
        Modifies registry class
        
        PID:8952
        
        C:\Windows\SysWOW64\Maodigil.exe
        
        C:\Windows\system32\Maodigil.exe
        251⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Mejpje32.exe
        
        C:\Windows\system32\Mejpje32.exe
        252⤵
        Drops file in System32 directory
        
        PID:9080
        
        C:\Windows\SysWOW64\Mhilfa32.exe
        
        C:\Windows\system32\Mhilfa32.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9128
        
        C:\Windows\SysWOW64\Njghbl32.exe
        
        C:\Windows\system32\Njghbl32.exe
        254⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        255⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Nhkikq32.exe
        
        C:\Windows\system32\Nhkikq32.exe
        256⤵
        Modifies registry class
        
        PID:8384
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        257⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Noeahkfc.exe
        
        C:\Windows\system32\Noeahkfc.exe
        258⤵
        Modifies registry class
        
        PID:6112
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        259⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        260⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Nhmeapmd.exe
        
        C:\Windows\system32\Nhmeapmd.exe
        261⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        262⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Nafjjf32.exe
        
        C:\Windows\system32\Nafjjf32.exe
        263⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Nhpbfpka.exe
        
        C:\Windows\system32\Nhpbfpka.exe
        264⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Nojjcj32.exe
        
        C:\Windows\system32\Nojjcj32.exe
        265⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        266⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Oehlkc32.exe
        
        C:\Windows\system32\Oehlkc32.exe
        267⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        268⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8772
        
        C:\Windows\SysWOW64\Oekiqccc.exe
        
        C:\Windows\system32\Oekiqccc.exe
        270⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        271⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        272⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Oaajed32.exe
        
        C:\Windows\system32\Oaajed32.exe
        273⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        274⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        275⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        276⤵
        Modifies registry class
        
        PID:8532
        
        C:\Windows\SysWOW64\Oadfkdgd.exe
        
        C:\Windows\system32\Oadfkdgd.exe
        277⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Oiknlagg.exe
        
        C:\Windows\system32\Oiknlagg.exe
        278⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Olijhmgj.exe
        
        C:\Windows\system32\Olijhmgj.exe
        279⤵
        Drops file in System32 directory
        
        PID:8764
        
        C:\Windows\SysWOW64\Oohgdhfn.exe
        
        C:\Windows\system32\Oohgdhfn.exe
        280⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Ohpkmn32.exe
        
        C:\Windows\system32\Ohpkmn32.exe
        281⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        282⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Polppg32.exe
        
        C:\Windows\system32\Polppg32.exe
        283⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Phedhmhi.exe
        
        C:\Windows\system32\Phedhmhi.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9424
        
        C:\Windows\SysWOW64\Peieba32.exe
        
        C:\Windows\system32\Peieba32.exe
        285⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        286⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        287⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        288⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9580
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        289⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Qlggjk32.exe
        
        C:\Windows\system32\Qlggjk32.exe
        290⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9656
        
        C:\Windows\SysWOW64\Qadoba32.exe
        
        C:\Windows\system32\Qadoba32.exe
        291⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Qhngolpo.exe
        
        C:\Windows\system32\Qhngolpo.exe
        292⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Qkmdkgob.exe
        
        C:\Windows\system32\Qkmdkgob.exe
        293⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Qaflgago.exe
        
        C:\Windows\system32\Qaflgago.exe
        294⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Ahqddk32.exe
        
        C:\Windows\system32\Ahqddk32.exe
        295⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Akoqpg32.exe
        
        C:\Windows\system32\Akoqpg32.exe
        296⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Alnmjjdb.exe
        
        C:\Windows\system32\Alnmjjdb.exe
        297⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Aomifecf.exe
        
        C:\Windows\system32\Aomifecf.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10000
        
        C:\Windows\SysWOW64\Afgacokc.exe
        
        C:\Windows\system32\Afgacokc.exe
        299⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        300⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Alcfei32.exe
        
        C:\Windows\system32\Alcfei32.exe
        301⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Ahjgjj32.exe
        
        C:\Windows\system32\Ahjgjj32.exe
        302⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Bjicdmmd.exe
        
        C:\Windows\system32\Bjicdmmd.exe
        303⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Bhldpj32.exe
        
        C:\Windows\system32\Bhldpj32.exe
        304⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Boflmdkk.exe
        
        C:\Windows\system32\Boflmdkk.exe
        305⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        306⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Bhoqeibl.exe
        
        C:\Windows\system32\Bhoqeibl.exe
        307⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Bcddcbab.exe
        
        C:\Windows\system32\Bcddcbab.exe
        308⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Bokehc32.exe
        
        C:\Windows\system32\Bokehc32.exe
        309⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        310⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Bombmcec.exe
        
        C:\Windows\system32\Bombmcec.exe
        311⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Bfgjjm32.exe
        
        C:\Windows\system32\Bfgjjm32.exe
        312⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Bopocbcq.exe
        
        C:\Windows\system32\Bopocbcq.exe
        313⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Cjecpkcg.exe
        
        C:\Windows\system32\Cjecpkcg.exe
        314⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10012
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        316⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        317⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Cjliajmo.exe
        
        C:\Windows\system32\Cjliajmo.exe
        318⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        319⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Coknoaic.exe
        
        C:\Windows\system32\Coknoaic.exe
        320⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        321⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Dfgcakon.exe
        
        C:\Windows\system32\Dfgcakon.exe
        322⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        323⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        324⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Djelgied.exe
        
        C:\Windows\system32\Djelgied.exe
        325⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        326⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        327⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        328⤵
        Modifies registry class
        
        PID:9316
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9560
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        330⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        331⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        332⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        333⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        334⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        335⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        336⤵
        Drops file in System32 directory
        
        PID:10192
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        337⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Fllkqn32.exe
        
        C:\Windows\system32\Fllkqn32.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4332
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        339⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        340⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        341⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        342⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Fjohde32.exe
        
        C:\Windows\system32\Fjohde32.exe
        343⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        344⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        345⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        346⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        347⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        348⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        349⤵
        Drops file in System32 directory
        
        PID:10588
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10632
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        351⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Gfmojenc.exe
        
        C:\Windows\system32\Gfmojenc.exe
        352⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        353⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        354⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        355⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        356⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Hgdejd32.exe
        
        C:\Windows\system32\Hgdejd32.exe
        357⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Hkbmqb32.exe
        
        C:\Windows\system32\Hkbmqb32.exe
        358⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        359⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        360⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11024
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        361⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        362⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        363⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        364⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        365⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        366⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        367⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        368⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        369⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        370⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        371⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Ijqmhnko.exe
        
        C:\Windows\system32\Ijqmhnko.exe
        372⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        373⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        374⤵
        
        PID:10816
        
        C:\Windows\SysWOW64\Ikpjbq32.exe
        
        C:\Windows\system32\Ikpjbq32.exe
        375⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        376⤵
        
        PID:10976
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        377⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        378⤵
        Drops file in System32 directory
        
        PID:11092
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        379⤵
        Drops file in System32 directory
        
        PID:11192
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        380⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        381⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        382⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        383⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        384⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10812
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        385⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        386⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        387⤵
        Modifies registry class
        
        PID:10160
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        388⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        389⤵
        
        PID:2460
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        390⤵
        
        PID:1860
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        391⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        392⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        393⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Kmieae32.exe
        
        C:\Windows\system32\Kmieae32.exe
        394⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        395⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        396⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        397⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        398⤵
        Modifies registry class
        
        PID:10704
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        399⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        400⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10532
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        401⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        402⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        403⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        404⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        405⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        406⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        407⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        408⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        409⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Nmenca32.exe
        
        C:\Windows\system32\Nmenca32.exe
        410⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        411⤵
        
        PID:2992
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        412⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        413⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        414⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        415⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        416⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        417⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        418⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        419⤵
        
        PID:3628
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        420⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        421⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        422⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        423⤵
        Drops file in System32 directory
        
        PID:4428
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        424⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        425⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        426⤵
        Drops file in System32 directory
        
        PID:11244
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        427⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        428⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        429⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        430⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        431⤵
        Drops file in System32 directory
        
        PID:2956
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        432⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        433⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3344
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        434⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        435⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        436⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5040
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        437⤵
        Drops file in System32 directory
        
        PID:4736
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        438⤵
        
        PID:756
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        439⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1520
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        440⤵
        
        PID:3928
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        441⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2612
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        442⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        443⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        444⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        445⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        446⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        447⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        448⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        449⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        450⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        451⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        452⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        453⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        454⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        455⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        456⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        457⤵
        Drops file in System32 directory
        
        PID:2532
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        458⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        459⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        460⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        461⤵
        Drops file in System32 directory
        
        PID:2544
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        462⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        463⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        464⤵
        
        PID:3436
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        465⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        466⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        467⤵
        
        PID:788
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        468⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        469⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        470⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        471⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        472⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        473⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        474⤵
        Drops file in System32 directory
        
        PID:2080
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        475⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        476⤵
        
        PID:11336
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        477⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        478⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11420
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        479⤵
        
        PID:11456
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        480⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        481⤵
        Modifies registry class
        
        PID:11540
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        482⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11592
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        483⤵
        
        PID:11632
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        484⤵
        Modifies registry class
        
        PID:11672
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        485⤵
        
        PID:11720
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        486⤵
        
        PID:11764
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        487⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        488⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        489⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        490⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        491⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        492⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        493⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        494⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        495⤵
        
        PID:12152
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        496⤵
        
        PID:12204
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        497⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        498⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        499⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        500⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        501⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        502⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        503⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        504⤵
        
        PID:11580
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        505⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        506⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        507⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        508⤵
        Modifies registry class
        
        PID:11836
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        509⤵
        
        PID:11908
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        510⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        511⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        512⤵
        
        PID:12060
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        513⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        514⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        515⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        516⤵
        
        PID:12280
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        517⤵
        
        PID:11376
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        518⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Hlbcnd32.exe
        
        C:\Windows\system32\Hlbcnd32.exe
        519⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        520⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        521⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        522⤵
        Drops file in System32 directory
        
        PID:11888
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        523⤵
        Drops file in System32 directory
        
        PID:11992
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        524⤵
        
        PID:12092
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        525⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        526⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        527⤵
        Drops file in System32 directory
        
        PID:5740
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        528⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        529⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        530⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        531⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        532⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        533⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        534⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        535⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        536⤵
        Drops file in System32 directory
        
        PID:6396
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        537⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        538⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        539⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        540⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        541⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        542⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        543⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        544⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        545⤵
        
        PID:12160
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        546⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12168
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        547⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6192
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        548⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        549⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        550⤵
        Drops file in System32 directory
        
        PID:6404
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        551⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        552⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        553⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        554⤵
        
        PID:11464
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        555⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        556⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        557⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        558⤵
        
        PID:11560
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        559⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        560⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        561⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        562⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        563⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11760
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        564⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        565⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        566⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        567⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        568⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        569⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        570⤵
        
        PID:12032
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        571⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        572⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        573⤵
        Modifies registry class
        
        PID:6940
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        574⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        575⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        576⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Akpoaj32.exe
        
        C:\Windows\system32\Akpoaj32.exe
        577⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        578⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        579⤵
        
        PID:4204
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        580⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        581⤵
        Drops file in System32 directory
        
        PID:6956
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        582⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5164
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        583⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        584⤵
        
        PID:11656
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        585⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6748
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        586⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        587⤵
        Drops file in System32 directory
        
        PID:7128
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        588⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        589⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        590⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        591⤵
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        592⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        593⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7412
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        594⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        595⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Aagdnn32.exe
        
        C:\Windows\system32\Aagdnn32.exe
        596⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Bfkbfd32.exe
        
        C:\Windows\system32\Bfkbfd32.exe
        597⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Dcibca32.exe
        
        C:\Windows\system32\Dcibca32.exe
        598⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6720
        
        C:\Windows\SysWOW64\Daollh32.exe
        
        C:\Windows\system32\Daollh32.exe
        599⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Ekqckmfb.exe
        
        C:\Windows\system32\Ekqckmfb.exe
        600⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        601⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Gnohnffc.exe
        
        C:\Windows\system32\Gnohnffc.exe
        602⤵
        Modifies registry class
        
        PID:8488
        
        C:\Windows\SysWOW64\Gjficg32.exe
        
        C:\Windows\system32\Gjficg32.exe
        603⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Hcedmkmp.exe
        
        C:\Windows\system32\Hcedmkmp.exe
        604⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Hjdedepg.exe
        
        C:\Windows\system32\Hjdedepg.exe
        605⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Hjfbjdnd.exe
        
        C:\Windows\system32\Hjfbjdnd.exe
        606⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Ilhkigcd.exe
        
        C:\Windows\system32\Ilhkigcd.exe
        607⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Iccpniqp.exe
        
        C:\Windows\system32\Iccpniqp.exe
        608⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Jdjfohjg.exe
        
        C:\Windows\system32\Jdjfohjg.exe
        609⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Jhhodg32.exe
        
        C:\Windows\system32\Jhhodg32.exe
        610⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Jacpcl32.exe
        
        C:\Windows\system32\Jacpcl32.exe
        611⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Kbeibo32.exe
        
        C:\Windows\system32\Kbeibo32.exe
        612⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Khdoqefq.exe
        
        C:\Windows\system32\Khdoqefq.exe
        613⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Kopcbo32.exe
        
        C:\Windows\system32\Kopcbo32.exe
        614⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Khihld32.exe
        
        C:\Windows\system32\Khihld32.exe
        615⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Klgqabib.exe
        
        C:\Windows\system32\Klgqabib.exe
        616⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Leoejh32.exe
        
        C:\Windows\system32\Leoejh32.exe
        617⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Lklnconj.exe
        
        C:\Windows\system32\Lklnconj.exe
        618⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Lojfin32.exe
        
        C:\Windows\system32\Lojfin32.exe
        619⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Lbhool32.exe
        
        C:\Windows\system32\Lbhool32.exe
        620⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Ldkhlcnb.exe
        
        C:\Windows\system32\Ldkhlcnb.exe
        621⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Maoifh32.exe
        
        C:\Windows\system32\Maoifh32.exe
        622⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Mddkbbfg.exe
        
        C:\Windows\system32\Mddkbbfg.exe
        623⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Mcfkpjng.exe
        
        C:\Windows\system32\Mcfkpjng.exe
        624⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Nheqnpjk.exe
        
        C:\Windows\system32\Nheqnpjk.exe
        625⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Nkcmjlio.exe
        
        C:\Windows\system32\Nkcmjlio.exe
        626⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Ncjdki32.exe
        
        C:\Windows\system32\Ncjdki32.exe
        627⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Namegfql.exe
        
        C:\Windows\system32\Namegfql.exe
        628⤵
        
        PID:3312
        
        C:\Windows\SysWOW64\Ncmaai32.exe
        
        C:\Windows\system32\Ncmaai32.exe
        629⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6412
        
        C:\Windows\SysWOW64\Nfknmd32.exe
        
        C:\Windows\system32\Nfknmd32.exe
        630⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Nocbfjmc.exe
        
        C:\Windows\system32\Nocbfjmc.exe
        631⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10048
        
        C:\Windows\SysWOW64\Nfnjbdep.exe
        
        C:\Windows\system32\Nfnjbdep.exe
        632⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Ndpjnq32.exe
        
        C:\Windows\system32\Ndpjnq32.exe
        633⤵
        Modifies registry class
        
        PID:10036
        
        C:\Windows\SysWOW64\Nkjckkcg.exe
        
        C:\Windows\system32\Nkjckkcg.exe
        634⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Ohncdobq.exe
        
        C:\Windows\system32\Ohncdobq.exe
        635⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Oohkai32.exe
        
        C:\Windows\system32\Oohkai32.exe
        636⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Ocdgahag.exe
        
        C:\Windows\system32\Ocdgahag.exe
        637⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Ofbdncaj.exe
        
        C:\Windows\system32\Ofbdncaj.exe
        638⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Ohqpjo32.exe
        
        C:\Windows\system32\Ohqpjo32.exe
        639⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Okolfj32.exe
        
        C:\Windows\system32\Okolfj32.exe
        640⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Ookhfigk.exe
        
        C:\Windows\system32\Ookhfigk.exe
        641⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Obidcdfo.exe
        
        C:\Windows\system32\Obidcdfo.exe
        642⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Ofdqcc32.exe
        
        C:\Windows\system32\Ofdqcc32.exe
        643⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Ohcmpn32.exe
        
        C:\Windows\system32\Ohcmpn32.exe
        644⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Okailj32.exe
        
        C:\Windows\system32\Okailj32.exe
        645⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Oomelheh.exe
        
        C:\Windows\system32\Oomelheh.exe
        646⤵
        
        PID:9332
        
        C:\Windows\SysWOW64\Obkahddl.exe
        
        C:\Windows\system32\Obkahddl.exe
        647⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Ofgmib32.exe
        
        C:\Windows\system32\Ofgmib32.exe
        648⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Odjmdocp.exe
        
        C:\Windows\system32\Odjmdocp.exe
        649⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Obnnnc32.exe
        
        C:\Windows\system32\Obnnnc32.exe
        650⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Ofijnbkb.exe
        
        C:\Windows\system32\Ofijnbkb.exe
        651⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Ohhfknjf.exe
        
        C:\Windows\system32\Ohhfknjf.exe
        652⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Omcbkl32.exe
        
        C:\Windows\system32\Omcbkl32.exe
        653⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\Ocmjhfjl.exe
        
        C:\Windows\system32\Ocmjhfjl.exe
        654⤵
        Drops file in System32 directory
        
        PID:9248
        
        C:\Windows\SysWOW64\Pdngpo32.exe
        
        C:\Windows\system32\Pdngpo32.exe
        655⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\Pbbgicnd.exe
        
        C:\Windows\system32\Pbbgicnd.exe
        656⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Pfncia32.exe
        
        C:\Windows\system32\Pfncia32.exe
        657⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Pkklbh32.exe
        
        C:\Windows\system32\Pkklbh32.exe
        658⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Pbddobla.exe
        
        C:\Windows\system32\Pbddobla.exe
        659⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Pecpknke.exe
        
        C:\Windows\system32\Pecpknke.exe
        660⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Pmjhlklg.exe
        
        C:\Windows\system32\Pmjhlklg.exe
        661⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Poidhg32.exe
        
        C:\Windows\system32\Poidhg32.exe
        662⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Pbgqdb32.exe
        
        C:\Windows\system32\Pbgqdb32.exe
        663⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Pfbmdabh.exe
        
        C:\Windows\system32\Pfbmdabh.exe
        664⤵
        Modifies registry class
        
        PID:7848
        
        C:\Windows\SysWOW64\Piaiqlak.exe
        
        C:\Windows\system32\Piaiqlak.exe
        665⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Pokanf32.exe
        
        C:\Windows\system32\Pokanf32.exe
        666⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Pbimjb32.exe
        
        C:\Windows\system32\Pbimjb32.exe
        667⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Pehjfm32.exe
        
        C:\Windows\system32\Pehjfm32.exe
        668⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Pmoagk32.exe
        
        C:\Windows\system32\Pmoagk32.exe
        669⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\Pkabbgol.exe
        
        C:\Windows\system32\Pkabbgol.exe
        670⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Qfgfpp32.exe
        
        C:\Windows\system32\Qfgfpp32.exe
        671⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Qejfkmem.exe
        
        C:\Windows\system32\Qejfkmem.exe
        672⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10568
        
        C:\Windows\SysWOW64\Qmanljfo.exe
        
        C:\Windows\system32\Qmanljfo.exe
        673⤵
        Modifies registry class
        
        PID:10708
        
        C:\Windows\SysWOW64\Qppkhfec.exe
        
        C:\Windows\system32\Qppkhfec.exe
        674⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8012
        
        C:\Windows\SysWOW64\Qfjcep32.exe
        
        C:\Windows\system32\Qfjcep32.exe
        675⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Qihoak32.exe
        
        C:\Windows\system32\Qihoak32.exe
        676⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Akihcfid.exe
        
        C:\Windows\system32\Akihcfid.exe
        677⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Afnlpohj.exe
        
        C:\Windows\system32\Afnlpohj.exe
        678⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Afqifo32.exe
        
        C:\Windows\system32\Afqifo32.exe
        679⤵
        Modifies registry class
        
        PID:11064
        
        C:\Windows\SysWOW64\Apimodmh.exe
        
        C:\Windows\system32\Apimodmh.exe
        680⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Abjfqpji.exe
        
        C:\Windows\system32\Abjfqpji.exe
        681⤵
        Modifies registry class
        
        PID:11184
        
        C:\Windows\SysWOW64\Afeban32.exe
        
        C:\Windows\system32\Afeban32.exe
        682⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\Aidomjaf.exe
        
        C:\Windows\system32\Aidomjaf.exe
        683⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Albkieqj.exe
        
        C:\Windows\system32\Albkieqj.exe
        684⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\Bcicjbal.exe
        
        C:\Windows\system32\Bcicjbal.exe
        685⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Bfhofnpp.exe
        
        C:\Windows\system32\Bfhofnpp.exe
        686⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Bldgoeog.exe
        
        C:\Windows\system32\Bldgoeog.exe
        687⤵
        Modifies registry class
        
        PID:8696
        
        C:\Windows\SysWOW64\Bboplo32.exe
        
        C:\Windows\system32\Bboplo32.exe
        688⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Bemlhj32.exe
        
        C:\Windows\system32\Bemlhj32.exe
        689⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Bihhhi32.exe
        
        C:\Windows\system32\Bihhhi32.exe
        690⤵
        
        PID:792
        
        C:\Windows\SysWOW64\Bpbpecen.exe
        
        C:\Windows\system32\Bpbpecen.exe
        691⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11216
        
        C:\Windows\SysWOW64\Beoimjce.exe
        
        C:\Windows\system32\Beoimjce.exe
        692⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10488
        
        C:\Windows\SysWOW64\Cpifeb32.exe
        
        C:\Windows\system32\Cpifeb32.exe
        693⤵
        Modifies registry class
        
        PID:10748
        
        C:\Windows\SysWOW64\Cidgdg32.exe
        
        C:\Windows\system32\Cidgdg32.exe
        694⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Ddhhbngi.exe
        
        C:\Windows\system32\Ddhhbngi.exe
        695⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Edoncm32.exe
        
        C:\Windows\system32\Edoncm32.exe
        696⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Fpmeimpn.exe
        
        C:\Windows\system32\Fpmeimpn.exe
        697⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Fpandm32.exe
        
        C:\Windows\system32\Fpandm32.exe
        698⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Ffcpgcfj.exe
        
        C:\Windows\system32\Ffcpgcfj.exe
        699⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Hmpnqj32.exe
        
        C:\Windows\system32\Hmpnqj32.exe
        700⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Imnjbhaa.exe
        
        C:\Windows\system32\Imnjbhaa.exe
        701⤵
        Drops file in System32 directory
        
        PID:9624
        
        C:\Windows\SysWOW64\Jjhalkjc.exe
        
        C:\Windows\system32\Jjhalkjc.exe
        702⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Jaefne32.exe
        
        C:\Windows\system32\Jaefne32.exe
        703⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\Jepbodhg.exe
        
        C:\Windows\system32\Jepbodhg.exe
        704⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Khonkogj.exe
        
        C:\Windows\system32\Khonkogj.exe
        705⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Kfanflne.exe
        
        C:\Windows\system32\Kfanflne.exe
        706⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Knifging.exe
        
        C:\Windows\system32\Knifging.exe
        707⤵
        Drops file in System32 directory
        
        PID:7676
        
        C:\Windows\SysWOW64\Kceoppmo.exe
        
        C:\Windows\system32\Kceoppmo.exe
        708⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Kfdklllb.exe
        
        C:\Windows\system32\Kfdklllb.exe
        709⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Knkcmild.exe
        
        C:\Windows\system32\Knkcmild.exe
        710⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Kmncif32.exe
        
        C:\Windows\system32\Kmncif32.exe
        711⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Keekjc32.exe
        
        C:\Windows\system32\Keekjc32.exe
        712⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Kdhlepkl.exe
        
        C:\Windows\system32\Kdhlepkl.exe
        713⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8976
        
        C:\Windows\SysWOW64\Kffhakjp.exe
        
        C:\Windows\system32\Kffhakjp.exe
        714⤵
        Modifies registry class
        
        PID:8756
        
        C:\Windows\SysWOW64\Knmpbi32.exe
        
        C:\Windows\system32\Knmpbi32.exe
        715⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Kmppneal.exe
        
        C:\Windows\system32\Kmppneal.exe
        716⤵
        
        PID:10476
        
        C:\Windows\SysWOW64\Kallod32.exe
        
        C:\Windows\system32\Kallod32.exe
        717⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Kfidgk32.exe
        
        C:\Windows\system32\Kfidgk32.exe
        718⤵
        Modifies registry class
        
        PID:9732
        
        C:\Windows\SysWOW64\Kjdqhjpf.exe
        
        C:\Windows\system32\Kjdqhjpf.exe
        719⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\Kmbmdeoj.exe
        
        C:\Windows\system32\Kmbmdeoj.exe
        720⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Kejeebpl.exe
        
        C:\Windows\system32\Kejeebpl.exe
        721⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Khhaanop.exe
        
        C:\Windows\system32\Khhaanop.exe
        722⤵
        Modifies registry class
        
        PID:8688
        
        C:\Windows\SysWOW64\Kfkamk32.exe
        
        C:\Windows\system32\Kfkamk32.exe
        723⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1540
        
        C:\Windows\SysWOW64\Kmeiie32.exe
        
        C:\Windows\system32\Kmeiie32.exe
        724⤵
        Drops file in System32 directory
        
        PID:8840
        
        C:\Windows\SysWOW64\Kaqejcep.exe
        
        C:\Windows\system32\Kaqejcep.exe
        725⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Ldoafodd.exe
        
        C:\Windows\system32\Ldoafodd.exe
        726⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Lmgfod32.exe
        
        C:\Windows\system32\Lmgfod32.exe
        727⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Lennpb32.exe
        
        C:\Windows\system32\Lennpb32.exe
        728⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Lfpkhjae.exe
        
        C:\Windows\system32\Lfpkhjae.exe
        729⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Logbigbg.exe
        
        C:\Windows\system32\Logbigbg.exe
        730⤵
        Drops file in System32 directory
        
        PID:10796
        
        C:\Windows\SysWOW64\Laeoec32.exe
        
        C:\Windows\system32\Laeoec32.exe
        731⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Lmlpjdgo.exe
        
        C:\Windows\system32\Lmlpjdgo.exe
        732⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7660
        
        C:\Windows\SysWOW64\Lechkaga.exe
        
        C:\Windows\system32\Lechkaga.exe
        733⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\Lhadgmge.exe
        
        C:\Windows\system32\Lhadgmge.exe
        734⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\Lkppchfi.exe
        
        C:\Windows\system32\Lkppchfi.exe
        735⤵
        
        PID:380
        
        C:\Windows\SysWOW64\Lmnlpcel.exe
        
        C:\Windows\system32\Lmnlpcel.exe
        736⤵
        
        PID:3736
        
        C:\Windows\SysWOW64\Ldhdlnli.exe
        
        C:\Windows\system32\Ldhdlnli.exe
        737⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8268
        
        C:\Windows\SysWOW64\Lfgahikm.exe
        
        C:\Windows\system32\Lfgahikm.exe
        738⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\Loniiflo.exe
        
        C:\Windows\system32\Loniiflo.exe
        739⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8264
        
        C:\Windows\SysWOW64\Mehafq32.exe
        
        C:\Windows\system32\Mehafq32.exe
        740⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\Mhfmbl32.exe
        
        C:\Windows\system32\Mhfmbl32.exe
        741⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Mkdiog32.exe
        
        C:\Windows\system32\Mkdiog32.exe
        742⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\Mmcfkc32.exe
        
        C:\Windows\system32\Mmcfkc32.exe
        743⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Mejnlpai.exe
        
        C:\Windows\system32\Mejnlpai.exe
        744⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Mhhjhlqm.exe
        
        C:\Windows\system32\Mhhjhlqm.exe
        745⤵
        Modifies registry class
        
        PID:8452
        
        C:\Windows\SysWOW64\Mkgfdgpq.exe
        
        C:\Windows\system32\Mkgfdgpq.exe
        746⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Maaoaa32.exe
        
        C:\Windows\system32\Maaoaa32.exe
        747⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Maehlqch.exe
        
        C:\Windows\system32\Maehlqch.exe
        748⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Pbifol32.exe
        
        C:\Windows\system32\Pbifol32.exe
        749⤵
        Modifies registry class
        
        PID:4688
        
        C:\Windows\SysWOW64\Qnpgdmjd.exe
        
        C:\Windows\system32\Qnpgdmjd.exe
        750⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5176
        
        C:\Windows\SysWOW64\Bpomem32.exe
        
        C:\Windows\system32\Bpomem32.exe
        751⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Cihjeq32.exe
        
        C:\Windows\system32\Cihjeq32.exe
        752⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10496
        
        C:\Windows\SysWOW64\Deagoa32.exe
        
        C:\Windows\system32\Deagoa32.exe
        753⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Dhpdkm32.exe
        
        C:\Windows\system32\Dhpdkm32.exe
        754⤵
        
        PID:1544
        
        C:\Windows\SysWOW64\Dojlhg32.exe
        
        C:\Windows\system32\Dojlhg32.exe
        755⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Dhbqalle.exe
        
        C:\Windows\system32\Dhbqalle.exe
        756⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Dfcqod32.exe
        
        C:\Windows\system32\Dfcqod32.exe
        757⤵
        Modifies registry class
        
        PID:4412
        
        C:\Windows\SysWOW64\Diamko32.exe
        
        C:\Windows\system32\Diamko32.exe
        758⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\Dhdmfljb.exe
        
        C:\Windows\system32\Dhdmfljb.exe
        759⤵
        Modifies registry class
        
        PID:10204
        
        C:\Windows\SysWOW64\Dpkehi32.exe
        
        C:\Windows\system32\Dpkehi32.exe
        760⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\Donecfao.exe
        
        C:\Windows\system32\Donecfao.exe
        761⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10652
        
        C:\Windows\SysWOW64\Dbjade32.exe
        
        C:\Windows\system32\Dbjade32.exe
        762⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10932
        
        C:\Windows\SysWOW64\Dehnpp32.exe
        
        C:\Windows\system32\Dehnpp32.exe
        763⤵
        Drops file in System32 directory
        
        PID:12272
        
        C:\Windows\SysWOW64\Didjqoae.exe
        
        C:\Windows\system32\Didjqoae.exe
        764⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Dlbfmjqi.exe
        
        C:\Windows\system32\Dlbfmjqi.exe
        765⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\Dpnbmi32.exe
        
        C:\Windows\system32\Dpnbmi32.exe
        766⤵
        
        PID:11468
        
        C:\Windows\SysWOW64\Doqbifpl.exe
        
        C:\Windows\system32\Doqbifpl.exe
        767⤵
        Modifies registry class
        
        PID:1404
        
        C:\Windows\SysWOW64\Efhjjcpo.exe
        
        C:\Windows\system32\Efhjjcpo.exe
        768⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\Ehifak32.exe
        
        C:\Windows\system32\Ehifak32.exe
        769⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:880
        
        C:\Windows\SysWOW64\Eppobi32.exe
        
        C:\Windows\system32\Eppobi32.exe
        770⤵
        Modifies registry class
        
        PID:11848
        
        C:\Windows\SysWOW64\Ebokodfc.exe
        
        C:\Windows\system32\Ebokodfc.exe
        771⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Ehkcgkdj.exe
        
        C:\Windows\system32\Ehkcgkdj.exe
        772⤵
        Modifies registry class
        
        PID:11696
        
        C:\Windows\SysWOW64\Elgohj32.exe
        
        C:\Windows\system32\Elgohj32.exe
        773⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Eoekde32.exe
        
        C:\Windows\system32\Eoekde32.exe
        774⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Ebagdddp.exe
        
        C:\Windows\system32\Ebagdddp.exe
        775⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\Eikpan32.exe
        
        C:\Windows\system32\Eikpan32.exe
        776⤵
        
        PID:12080
        
        C:\Windows\SysWOW64\Epehnhbj.exe
        
        C:\Windows\system32\Epehnhbj.exe
        777⤵
        
        PID:11764
        
        C:\Windows\SysWOW64\Efopjbjg.exe
        
        C:\Windows\system32\Efopjbjg.exe
        778⤵
        
        PID:11812
        
        C:\Windows\SysWOW64\Ellicihn.exe
        
        C:\Windows\system32\Ellicihn.exe
        779⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Eojeodga.exe
        
        C:\Windows\system32\Eojeodga.exe
        780⤵
        
        PID:11744
        
        C:\Windows\SysWOW64\Eedmlo32.exe
        
        C:\Windows\system32\Eedmlo32.exe
        781⤵
        
        PID:11324
        
        C:\Windows\SysWOW64\Ehbihj32.exe
        
        C:\Windows\system32\Ehbihj32.exe
        782⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Eoladdeo.exe
        
        C:\Windows\system32\Eoladdeo.exe
        783⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Fefjanml.exe
        
        C:\Windows\system32\Fefjanml.exe
        784⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Flpbnh32.exe
        
        C:\Windows\system32\Flpbnh32.exe
        785⤵
        
        PID:11580
        
        C:\Windows\SysWOW64\Foonjd32.exe
        
        C:\Windows\system32\Foonjd32.exe
        786⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Fidbgm32.exe
        
        C:\Windows\system32\Fidbgm32.exe
        787⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Flboch32.exe
        
        C:\Windows\system32\Flboch32.exe
        788⤵
        
        PID:9256
        
        C:\Windows\SysWOW64\Fpnkdfko.exe
        
        C:\Windows\system32\Fpnkdfko.exe
        789⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\Fghcqq32.exe
        
        C:\Windows\system32\Fghcqq32.exe
        790⤵
        
        PID:11704
        
        C:\Windows\SysWOW64\Fekclnif.exe
        
        C:\Windows\system32\Fekclnif.exe
        791⤵
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Flekihpc.exe
        
        C:\Windows\system32\Flekihpc.exe
        792⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Fochecog.exe
        
        C:\Windows\system32\Fochecog.exe
        793⤵
        
        PID:11940
        
        C:\Windows\SysWOW64\Fcodfa32.exe
        
        C:\Windows\system32\Fcodfa32.exe
        794⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12220
        
        C:\Windows\SysWOW64\Fiilblom.exe
        
        C:\Windows\system32\Fiilblom.exe
        795⤵
        Modifies registry class
        
        PID:9656
        
        C:\Windows\SysWOW64\Fhllni32.exe
        
        C:\Windows\system32\Fhllni32.exe
        796⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Fofdkcmd.exe
        
        C:\Windows\system32\Fofdkcmd.exe
        797⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10096
        
        C:\Windows\SysWOW64\Fgmllpng.exe
        
        C:\Windows\system32\Fgmllpng.exe
        798⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Fikihlmj.exe
        
        C:\Windows\system32\Fikihlmj.exe
        799⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Fljedg32.exe
        
        C:\Windows\system32\Fljedg32.exe
        800⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Gohapb32.exe
        
        C:\Windows\system32\Gohapb32.exe
        801⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Ggoiap32.exe
        
        C:\Windows\system32\Ggoiap32.exe
        802⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Ginenk32.exe
        
        C:\Windows\system32\Ginenk32.exe
        803⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Gllajf32.exe
        
        C:\Windows\system32\Gllajf32.exe
        804⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Gpgnjebd.exe
        
        C:\Windows\system32\Gpgnjebd.exe
        805⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Gcfjfqah.exe
        
        C:\Windows\system32\Gcfjfqah.exe
        806⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Ggafgo32.exe
        
        C:\Windows\system32\Ggafgo32.exe
        807⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Gipbck32.exe
        
        C:\Windows\system32\Gipbck32.exe
        808⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8112
        
        C:\Windows\SysWOW64\Ghcbohpp.exe
        
        C:\Windows\system32\Ghcbohpp.exe
        809⤵
        
        PID:4308
        
        C:\Windows\SysWOW64\Gpjjpe32.exe
        
        C:\Windows\system32\Gpjjpe32.exe
        810⤵
        Modifies registry class
        
        PID:10848
        
        C:\Windows\SysWOW64\Gomkkagl.exe
        
        C:\Windows\system32\Gomkkagl.exe
        811⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9648
        
        C:\Windows\SysWOW64\Ggdbmoho.exe
        
        C:\Windows\system32\Ggdbmoho.exe
        812⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\Gegchl32.exe
        
        C:\Windows\system32\Gegchl32.exe
        813⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Gheodg32.exe
        
        C:\Windows\system32\Gheodg32.exe
        814⤵
        Drops file in System32 directory
        
        PID:12200
        
        C:\Windows\SysWOW64\Ghgljg32.exe
        
        C:\Windows\system32\Ghgljg32.exe
        815⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Gpodkdll.exe
        
        C:\Windows\system32\Gpodkdll.exe
        816⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Ggilgn32.exe
        
        C:\Windows\system32\Ggilgn32.exe
        817⤵
        
        PID:1184
        
        C:\Windows\SysWOW64\Geklckkd.exe
        
        C:\Windows\system32\Geklckkd.exe
        818⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Gledpe32.exe
        
        C:\Windows\system32\Gledpe32.exe
        819⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Hpaqqdjj.exe
        
        C:\Windows\system32\Hpaqqdjj.exe
        820⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\Hgkimn32.exe
        
        C:\Windows\system32\Hgkimn32.exe
        821⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Hfniikha.exe
        
        C:\Windows\system32\Hfniikha.exe
        822⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11980
        
        C:\Windows\SysWOW64\Hjieii32.exe
        
        C:\Windows\system32\Hjieii32.exe
        823⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Hofmaq32.exe
        
        C:\Windows\system32\Hofmaq32.exe
        824⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\Hgmebnpd.exe
        
        C:\Windows\system32\Hgmebnpd.exe
        825⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\Hjlaoioh.exe
        
        C:\Windows\system32\Hjlaoioh.exe
        826⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Hljnkdnk.exe
        
        C:\Windows\system32\Hljnkdnk.exe
        827⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Hohjgpmo.exe
        
        C:\Windows\system32\Hohjgpmo.exe
        828⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Hcdfho32.exe
        
        C:\Windows\system32\Hcdfho32.exe
        829⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Hhaope32.exe
        
        C:\Windows\system32\Hhaope32.exe
        830⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Hgbonm32.exe
        
        C:\Windows\system32\Hgbonm32.exe
        831⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Hjpkjh32.exe
        
        C:\Windows\system32\Hjpkjh32.exe
        832⤵
        
        PID:12276
        
        C:\Windows\SysWOW64\Hcipcnac.exe
        
        C:\Windows\system32\Hcipcnac.exe
        833⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Hjbhph32.exe
        
        C:\Windows\system32\Hjbhph32.exe
        834⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Icklhnop.exe
        
        C:\Windows\system32\Icklhnop.exe
        835⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3480
        
        C:\Windows\SysWOW64\Ifihdi32.exe
        
        C:\Windows\system32\Ifihdi32.exe
        836⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Ihheqd32.exe
        
        C:\Windows\system32\Ihheqd32.exe
        837⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Iqombb32.exe
        
        C:\Windows\system32\Iqombb32.exe
        838⤵
        
        PID:12224
        
        C:\Windows\SysWOW64\Icminm32.exe
        
        C:\Windows\system32\Icminm32.exe
        839⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Ijgakgej.exe
        
        C:\Windows\system32\Ijgakgej.exe
        840⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Imfmgcdn.exe
        
        C:\Windows\system32\Imfmgcdn.exe
        841⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Iqaiga32.exe
        
        C:\Windows\system32\Iqaiga32.exe
        842⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6712
        
        C:\Windows\SysWOW64\Icpecm32.exe
        
        C:\Windows\system32\Icpecm32.exe
        843⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Igkadlcd.exe
        
        C:\Windows\system32\Igkadlcd.exe
        844⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Ihmnldib.exe
        
        C:\Windows\system32\Ihmnldib.exe
        845⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6276
        
        C:\Windows\SysWOW64\Anjpeelk.exe
        
        C:\Windows\system32\Anjpeelk.exe
        846⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\Bnaffdfc.exe
        
        C:\Windows\system32\Bnaffdfc.exe
        847⤵
        Drops file in System32 directory
        
        PID:6228
        
        C:\Windows\SysWOW64\Bhgjcmfi.exe
        
        C:\Windows\system32\Bhgjcmfi.exe
        848⤵
        
        PID:11416
        
        C:\Windows\SysWOW64\Bkefphem.exe
        
        C:\Windows\system32\Bkefphem.exe
        849⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Bndblcdq.exe
        
        C:\Windows\system32\Bndblcdq.exe
        850⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Bqbohocd.exe
        
        C:\Windows\system32\Bqbohocd.exe
        851⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\Biigildg.exe
        
        C:\Windows\system32\Biigildg.exe
        852⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Bkhceh32.exe
        
        C:\Windows\system32\Bkhceh32.exe
        853⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Bnfoac32.exe
        
        C:\Windows\system32\Bnfoac32.exe
        854⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Bqdlmo32.exe
        
        C:\Windows\system32\Bqdlmo32.exe
        855⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Bkjpkg32.exe
        
        C:\Windows\system32\Bkjpkg32.exe
        856⤵
        Modifies registry class
        
        PID:5188
        
        C:\Windows\SysWOW64\Cqghcn32.exe
        
        C:\Windows\system32\Cqghcn32.exe
        857⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\Cgaqphgl.exe
        
        C:\Windows\system32\Cgaqphgl.exe
        858⤵
        Drops file in System32 directory
        
        PID:3928
        
        C:\Windows\SysWOW64\Cjomldfp.exe
        
        C:\Windows\system32\Cjomldfp.exe
        859⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\Cbfema32.exe
        
        C:\Windows\system32\Cbfema32.exe
        860⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Ciqmjkno.exe
        
        C:\Windows\system32\Ciqmjkno.exe
        861⤵
        Drops file in System32 directory
        
        PID:5628
        
        C:\Windows\SysWOW64\Ckoifgmb.exe
        
        C:\Windows\system32\Ckoifgmb.exe
        862⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Cnmebblf.exe
        
        C:\Windows\system32\Cnmebblf.exe
        863⤵
        
        PID:5040
        
        C:\Windows\SysWOW64\Cbiabq32.exe
        
        C:\Windows\system32\Cbiabq32.exe
        864⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\Cicjokll.exe
        
        C:\Windows\system32\Cicjokll.exe
        865⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Cjdfgc32.exe
        
        C:\Windows\system32\Cjdfgc32.exe
        866⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\Cbknhqbl.exe
        
        C:\Windows\system32\Cbknhqbl.exe
        867⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10392
        
        C:\Windows\SysWOW64\Canocm32.exe
        
        C:\Windows\system32\Canocm32.exe
        868⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\Ciefek32.exe
        
        C:\Windows\system32\Ciefek32.exe
        869⤵
        Modifies registry class
        
        PID:11520
        
        C:\Windows\SysWOW64\Ckcbaf32.exe
        
        C:\Windows\system32\Ckcbaf32.exe
        870⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Cjfclcpg.exe
        
        C:\Windows\system32\Cjfclcpg.exe
        871⤵
        
        PID:3168
        
        C:\Windows\SysWOW64\Cbnknpqj.exe
        
        C:\Windows\system32\Cbnknpqj.exe
        872⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Cigcjj32.exe
        
        C:\Windows\system32\Cigcjj32.exe
        873⤵
        
        PID:11652
        
        C:\Windows\SysWOW64\Cgjcfgoa.exe
        
        C:\Windows\system32\Cgjcfgoa.exe
        874⤵
        
        PID:912
        
        C:\Windows\SysWOW64\Djipbbne.exe
        
        C:\Windows\system32\Djipbbne.exe
        875⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Dndlba32.exe
        
        C:\Windows\system32\Dndlba32.exe
        876⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\Dabhomea.exe
        
        C:\Windows\system32\Dabhomea.exe
        877⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Dijppjfd.exe
        
        C:\Windows\system32\Dijppjfd.exe
        878⤵
        
        PID:11336
        
        C:\Windows\SysWOW64\Dgmpkg32.exe
        
        C:\Windows\system32\Dgmpkg32.exe
        879⤵
        Modifies registry class
        
        PID:11408
        
        C:\Windows\SysWOW64\Djklgb32.exe
        
        C:\Windows\system32\Djklgb32.exe
        880⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Dnghhqdk.exe
        
        C:\Windows\system32\Dnghhqdk.exe
        881⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11724
        
        C:\Windows\SysWOW64\Daeddlco.exe
        
        C:\Windows\system32\Daeddlco.exe
        882⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Dilmeida.exe
        
        C:\Windows\system32\Dilmeida.exe
        883⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\Dgomaf32.exe
        
        C:\Windows\system32\Dgomaf32.exe
        884⤵
        Drops file in System32 directory
        
        PID:2268
        
        C:\Windows\SysWOW64\Djmima32.exe
        
        C:\Windows\system32\Djmima32.exe
        885⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11920
        
        C:\Windows\SysWOW64\Dbdano32.exe
        
        C:\Windows\system32\Dbdano32.exe
        886⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Decmjjie.exe
        
        C:\Windows\system32\Decmjjie.exe
        887⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\Dgaiffii.exe
        
        C:\Windows\system32\Dgaiffii.exe
        888⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\Dlmegd32.exe
        
        C:\Windows\system32\Dlmegd32.exe
        889⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Dnkbcp32.exe
        
        C:\Windows\system32\Dnkbcp32.exe
        890⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Dajnol32.exe
        
        C:\Windows\system32\Dajnol32.exe
        891⤵
        Drops file in System32 directory
        
        PID:12116
        
        C:\Windows\SysWOW64\Dhcfleff.exe
        
        C:\Windows\system32\Dhcfleff.exe
        892⤵
        Drops file in System32 directory
        
        PID:9424
        
        C:\Windows\SysWOW64\Djbbhafj.exe
        
        C:\Windows\system32\Djbbhafj.exe
        893⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Dbijinfl.exe
        
        C:\Windows\system32\Dbijinfl.exe
        894⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Dehgejep.exe
        
        C:\Windows\system32\Dehgejep.exe
        895⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11992
        
        C:\Windows\SysWOW64\Elaobdmm.exe
        
        C:\Windows\system32\Elaobdmm.exe
        896⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Enpknplq.exe
        
        C:\Windows\system32\Enpknplq.exe
        897⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Ehhpge32.exe
        
        C:\Windows\system32\Ehhpge32.exe
        898⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Eldlhckj.exe
        
        C:\Windows\system32\Eldlhckj.exe
        899⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9644 -s 420
        900⤵
        Program crash
        
        PID:8048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5080 --field-trial-handle=2272,i,1589057049575649654,2929151440327217574,262144 --variations-seed-version /prefetch:8
1⤵
PID:11296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 9644 -ip 9644
1⤵
PID:8424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ahjgjj32.exe

Filesize
482KB

MD5
ba9d534ac278cc790b8724978f7d474e

SHA1
14b35b092a9be258b052b0b4ec578819463fe2c0

SHA256
38f8c8c59cd18d6a3d7b3012946d8c26d62f918d07e5fc748e933d71dbd54ef1

SHA512
18228091f92bde1e9804629cafd2891925171a9c536b89f653680623699137d9beb9713fa27ad8f20703ba2d0b7b030b3ea39e875a17b7e3fa00ae87674b042d

Download Submit
C:\Windows\SysWOW64\Akoqpg32.exe

Filesize
482KB

MD5
d79a936ce6aec9adf1e4043836f08915

SHA1
55969b15b109d8649033e613c27d9d51212a1f82

SHA256
07f5acbe7da17251e1a20839618ff82a1bd06dfe48e92062e9091f97542b0f5e

SHA512
763e81e920ab4acdaeefaad36c53336d23f4c9f9973c8984319607a250ebbdf9b33015b1b552ae2f0b164cad4b5370a7c444acfd0317fe087a2a9c558a576ec7

Download Submit
C:\Windows\SysWOW64\Bcddcbab.exe

Filesize
482KB

MD5
32acb0ba89cf98a5480f84d487ea6863

SHA1
b6618611ba7ce3de3ae20c34ab7d602c6332ef48

SHA256
66bb00cf8613294576dbbfb6dacd5176b31cd78f37ff2012feb8fd3186c8dc2c

SHA512
30db7aad588c4e4892bd8849ee7bf318c325f7cd5b222c4adeedb6b5258709c1d03a590ff5ea89e3806ac0635bb0a538cba5bbe184ee97fbcf2cacd32b93fd24

Download Submit
C:\Windows\SysWOW64\Blgifbil.exe

Filesize
482KB

MD5
97e5dd066a31e2b138820f8c699617f7

SHA1
38b3e5e0eb365fa221e1648bd25dbcfc88d3db5b

SHA256
3cc9b0a9249513a26d4d6ab863a014a981cb080a16181f691ecd54f77fa333d4

SHA512
c8f05d73868ed16431119a32f284779bfdc9ac55bef82a26bfd02bb61f734625b587dd474680d1be99775dc408bb8c02c6de3d8c78ea7be6b1f83ca491fbd6ef

Download Submit
C:\Windows\SysWOW64\Dfoiaj32.exe

Filesize
482KB

MD5
3da36d296a59e5beda96ed025b1bcd00

SHA1
b75292ddcdbc40b11ddf0de6c4ad5304c580f25e

SHA256
5352c60e8799e47aead9429d28cfbddab63e393890e6f8111b45bc5c187c2eba

SHA512
faf1ab0f00b58a5d082413669c20136a06300f61087ccb4af485ec9fc75b77b183ce9e20376c66172aac83e7fedb0701b25e35a246b1ae7a62e18b87e5cbc9ad

Download Submit
C:\Windows\SysWOW64\Eciplm32.exe

Filesize
482KB

MD5
d5941a7b1e44621ccdfd2ca466c24398

SHA1
c715b21b6da339b71c7c3ae9e9cb62380d60a7e0

SHA256
bcf5e6a9c8d55dba49955c2987ba8b4926a33bb205dea3bc8ff2442d39b26673

SHA512
f0cfad9387f0e06b75e18e82d71aa377e15cc9b2a3f951f07003c058ee9efb3bd32af37fbcb63f21b72ab1b95cfc7bdc595109ee1ed18910f46364d77e040036

Download Submit
C:\Windows\SysWOW64\Eobocb32.exe

Filesize
482KB

MD5
b716cfd9eec0087896702ba257d41952

SHA1
d7f8b2487958ece3b29967a7dce5645d716f449e

SHA256
bcfd474f4d71ccbea89a2b0be078165fe2dcf9faba985c3d7945fb31d55a1ded

SHA512
b1edd85724f20994e9e76522d17c2867f733c444843833dcbd2bfdafdbd8661d1cd4d75a0697d77e29b780c5fca247446d36835467b9d23ceb83451988081f62

Download Submit
C:\Windows\SysWOW64\Eoekia32.exe

Filesize
482KB

MD5
11d05505fbaf60265282f98ec4c206bc

SHA1
5a2f04e11940683108c95c7fd9e276c1eaf1b993

SHA256
fcaef7592baa47d7e39352443dec8c4f279f538caf4554dbdc50e656ba4e85d0

SHA512
41f0e323dae1ab0efec4baef9d25fd0c4eba77fa948d57187e887fa2a1c878d4b315b6ddbe7842da36bd841fe1f04717bd383ecb9bbc09d48491f3e827b326f0

Download Submit
C:\Windows\SysWOW64\Fkgoikdb.dll

Filesize
7KB

MD5
ce17b451a765fc257d318ec4a2e43884

SHA1
820660888b2248adaf5395b918e4472ea3d67dfb

SHA256
a97f02ae9ead2dbf2c94d022b18a295d32eba358128f3f8d6f19bd380562c457

SHA512
65bb75c726dcc57b51deccb4026b244b96052fea2386ecc20ed12feb864d220673a951253f114baa130c27e601e4d1ac193cdf870e913fbe3d84d8970b4cf7ec

Download Submit
C:\Windows\SysWOW64\Ickchq32.exe

Filesize
482KB

MD5
b4574b7ac5d8fdecfde3e7b181218faa

SHA1
16792da0e4746f03cddc7a685f59e9bd59b65634

SHA256
0ef4b48dda604b77106ec1e44ad13dc9f2c5a320bc592a393a1c5e28b80df3a3

SHA512
d9e9832e8b97aaf4a9f2a05269a92e1bab860e27adb2fc59c44e98f23a90e727aeffc5bc2c854c6ce112e263ad1951ddfbbbc27775cdb4eeb7c659ad7d61e42a

Download Submit
C:\Windows\SysWOW64\Icnpmp32.exe

Filesize
482KB

MD5
dc40c2f0bcf18034c059c69be2a656ef

SHA1
303a2ac29702508eb66450dfaff94cb3599482b5

SHA256
22ef9518e2c974e8b77cc44999dd48878dedfc15977c846d7dba496f68d39e83

SHA512
4bcee38a06fd5a42b2d208a2433fe64cd6c0d63fcf0939ab9b17dbf47cace62a54e39a45cff63fff3141c8aa23c678fc2fab87f0f5ed3a1a21149b67b716acfb

Download Submit
C:\Windows\SysWOW64\Iicbehnq.exe

Filesize
482KB

MD5
6a5cf5bae7dbc2188e391233bfebfbf8

SHA1
6ee53e1bd3408694bd20e953d80840c47bef31df

SHA256
08c28deddb9b5abebdd88974de80ab1f70509dfc7ae74c6b1df2e40ccf4e00fd

SHA512
a9471d2072b0b73979b8dc863b9c17a3cfb12ef67ff9a624321fe1c86b24d1685c36fa9fa826b91ae6b580bd4879e1bb1b65b2f93b71c7750589423ef0ce858c

Download Submit
C:\Windows\SysWOW64\Iihkpg32.exe

Filesize
482KB

MD5
7e8d84b4a7366e6ee373f2cc85eb3688

SHA1
a8f1076c983e2436e95b36a520150d944f3a3447

SHA256
695e01b83446704db50b34a537658dc14eeb6b872fe930ccca177305ff3e2630

SHA512
8595aed801500c03f9e5bbf99a5713c162fd71c336d591f6062c3ad21b689dcf2ce651caea068b283214f8d88f55c24000a1f648fa17a2ecbbb9ef8027f2dbc5

Download Submit
C:\Windows\SysWOW64\Iikhfg32.exe

Filesize
482KB

MD5
cdd514e38e626c36397037ecd7435127

SHA1
ae94e0fe75af8299deea44bfa75ae135e19286bc

SHA256
7beece57bf1d009bbaa85319b2bcae1bd14f91918f9d86301dd9e05b599723aa

SHA512
103ab8736f994331ae6af31f5f8f227ad953e62b010d75fcb869d4e0e05a7fac86c4c9c1526c0ba7dee5a9397498aae084be2ec13cfbc6464b624b87caf81ebb

Download Submit
C:\Windows\SysWOW64\Ilidbbgl.exe

Filesize
482KB

MD5
8df47703e980a047c259c08974ed348d

SHA1
8cbb5576921e67925ccc073d41c29496c5a276d4

SHA256
7ffce135707d78db91e7dc4aaea62b6debf33ddde860c24c597921297ab02bb1

SHA512
4280b6f0421831834bc8a5dbde06cbad1c3ce0a3a960703fdc5f5718d246a47c03dcf4bfe7ae1febecef82e53c44a9d797c1ff4cba470f37c94413921c1a1888

Download Submit
C:\Windows\SysWOW64\Imakkfdg.exe

Filesize
482KB

MD5
9fad9ce79548d90e548c4aab0b2022ab

SHA1
cd8017f82bee4c4e4256abaec1575723a37302cd

SHA256
5e9eb000323e9c7b1a929a8592a759591991a326dbca3a955ae403359b98e600

SHA512
8220e2b93620102661358a8e2cc536fa11bef851d1f8b3cd2a5f032246433ff192f8a34e58fbd2932887c7a0ba8ed60656d8880d19591528d975fbce92850df2

Download Submit
C:\Windows\SysWOW64\Jcllonma.exe

Filesize
482KB

MD5
67fde03c3a57155786381b393113b0c3

SHA1
fc54bcdfd3585e59b87e98b49b86e954bfcd2608

SHA256
1b699b7860d42c8475b392b716af69c94e20cb5ddb3e2104a34de3fe0664ce09

SHA512
da3e5b7629b96451c9559846b56474271df7b53c6ce7bfd6dc72f0ee838a93708f93aadad4462d50a6a6259850c3c5ac5e11f645a048d577a7763149e3401b21

Download Submit
C:\Windows\SysWOW64\Jifhaenk.exe

Filesize
482KB

MD5
3aea1be0e6ffecef2a54878d9632e77a

SHA1
495657fb43f6a875b1b57434f34ba29e6f08b72f

SHA256
78ae8f1ab86aafd5e417efa8e1b3044296d89d45bb6a8fb66fa2ec1d44ea7dfa

SHA512
c273d5e794de334e5ca027e1d070934429c0f0a669d4c12a32061ab696b4f54a1a55289d854a2a1a65598b536e6d3fee57f92143b1d9f4df9c00900036e462ab

Download Submit
C:\Windows\SysWOW64\Kbhoqj32.exe

Filesize
482KB

MD5
3b38f147d90d08027491c126963ea71a

SHA1
306af17f95c069372905587a68156a1fda056829

SHA256
22ccf72d22cd645cd3ddcb9cd468ac982f739939099ffab81322a2d0dc1f7cac

SHA512
9e0d917fd2d8dd685cc75507aa0e03a31fbd6fb1da08af6c3914c6bc0aeb943af30fc15b69072f649f30f237b28df4745a1845fd9641a446f13a3d5d16fda91b

Download Submit
C:\Windows\SysWOW64\Kdcbom32.exe

Filesize
482KB

MD5
71bddb13cc1214a0369e364efb389666

SHA1
47e911027393ba1d62362948690485fc700323fb

SHA256
98a8a4f9db06fe08fe939dba5363535d8ecd118a7217e2ec4b6fa8c23c31c752

SHA512
41bb2468ff7017e8ccf986a16a64d59a1f0c67e853fee2146c7396bb0c5f381d9b0b446403bb7df92276d5ddc618caf6ec18b8f3b3bcf0fd70a44ce08715abad

Download Submit
C:\Windows\SysWOW64\Kemhff32.exe

Filesize
482KB

MD5
e343dcc8fe9fca6f0414209652ae316c

SHA1
49d2374c08e80f592533829d6e778f543743bdd0

SHA256
7799ec45209d5936e52cd433129d91baf7921783a46507510e746ffc4c1f10a1

SHA512
7faa34b6152ba8d58a419083234038fe7968fad665eb0c13aee459da36431285b4a1a617f660bc7e3beb7838a703e71d4f494100b44fae5adf8acbc2a7b13ff3

Download Submit
C:\Windows\SysWOW64\Kipkhdeq.exe

Filesize
482KB

MD5
2d9e7cade545b72f69588bcb2b11bd8e

SHA1
12c56c63ba4fcc26619b779896d4bda34b6ba735

SHA256
509dda069bfdba5bb6d67f27ac3d0f6518244d7bbc908948f0260228293caee5

SHA512
5dd03805c32813d4dda3377562bdf1bb88780a2af6316b2ce1d7e0954c9abf93b054c37e3d87dd68dfd0a6787254b2228c14221a1da5174b7486f5c639ee3c40

Download Submit
C:\Windows\SysWOW64\Kmijbcpl.exe

Filesize
482KB

MD5
9185c5729c991f6817e6f87fee9006b9

SHA1
08a9dcbde2f47e73cb1c5c7bcf114fd54a903460

SHA256
a76f3a5bda38f1488182f5767410d918943d393f9fb6250b65e74d2b35a7b87f

SHA512
6ece244b01729d532afb89fa7568668692d5a7853de280b55346774171524d61094539e50c0b75f068c7f64f3f7091eb7bd34cdb0bc29690b3ab6ca3ebfd5b70

Download Submit
C:\Windows\SysWOW64\Kmncnb32.exe

Filesize
482KB

MD5
eec292dbac28bd71c3965e4199a4a3c2

SHA1
fc29139522fb29d5886d2250b8e916ee1fc7cc57

SHA256
6e151953d1fde1e1b98e1ac8edfd967fc68439a62667a60b9b54d3423036ac4c

SHA512
90f80b40af662ba36d0d36063ddf9f0afbb83e30fc58bf43dd6ec0eb063aa1aa392a62f442350a7baf58e61100ce5aab5d87dad29dfdf81609f15d4b6ce51ad7

Download Submit
C:\Windows\SysWOW64\Kplpjn32.exe

Filesize
482KB

MD5
ae01db47386fc38da7a8712260ae7688

SHA1
1798d0300c1e0afd052aa9d8ae35b1d0fa246caa

SHA256
e060dd3c142f7df3ae853068532edc3043dc583f961dce23e69e691b9660fce6

SHA512
77813d486f47a19d09529329532ff5ce36937b62b616c3ea8604096a281fc61ca934b5dccf62f6ae74fe86c8d0e590db1e68a8e4b1d551a5ad524b291433b670

Download Submit
C:\Windows\SysWOW64\Lbabgh32.exe

Filesize
482KB

MD5
5055c0984707cf84143f2960f2a6dde7

SHA1
b2910adec84bc6d13561b64d6a494e3be9d2df22

SHA256
105704b2b49ce591dd1c9202747e6727bc7379ee4cb0de323fd6cab0e3a912cd

SHA512
afa57499d3ea7887f987237c32e8f370fd2a151c76531df9bc01c5c2656cce762ad7fc58857ba2ef635b93a14f754d06e936b24a5383a378beec38ee6e1e4d9b

Download Submit
C:\Windows\SysWOW64\Lbjlfi32.exe

Filesize
482KB

MD5
202227a820b4bcf10bb60154f944ac92

SHA1
6d29548834cfa1725366f99ea3bc5f3b5985c96c

SHA256
541f0e931221e4c913819c928c062ad48cce92e2fd59309fa8b25fac05a2d056

SHA512
afbd0cf7f283610df6ed889915cf852b7e252ff2fe00d32ffa7fd8283bf7e1589e2304fe206da59303c8887f9923797c83b8ad1052c4b1d6c0de90cf5d65282c

Download Submit
C:\Windows\SysWOW64\Lbjlfi32.exe

Filesize
384KB

MD5
c1d8ade4628cdea7f7de4eab70b1e035

SHA1
3d6a6190993694092a1d0f4fe3204ef71f7c1f17

SHA256
ec645dc08c2bbe2ceb39615982fe866d013a993454a5f4d94e0d8a103e217f07

SHA512
cc5f6aed2d05162d928136268570920c0f3932b19bfdc3e980f61d34df8fbd9a8e7e8faf92accef7863cd0ccc68887f5d79e5e75f8306311c2d65d7743229ef4

Download Submit
C:\Windows\SysWOW64\Lbmhlihl.exe

Filesize
482KB

MD5
80894faac851d065fbca4823f867d23c

SHA1
b964b8b55c2d13e3fc8bbdb44013d619a14063d9

SHA256
c87db77d041366a329cfc9c8c4538fb135938229328865eb9b8955cc96c35dcb

SHA512
0f5cd9eb7cfa297f7fc13988214ccd797bf75ef9be31e2364004db69f84419cd33c34c9aca7c4a4fe7d15e910b8e0a444420efb9b13ffca42f10be5c88c3e65f

Download Submit
C:\Windows\SysWOW64\Lbmhlihl.exe

Filesize
64KB

MD5
c67ec7b6eb852591b02cc3286f375771

SHA1
d84ebc8b255e2c819f94487778a7c220d2b3af72

SHA256
f9553820835c270b3f8649bd2a81bec12d8df637d3ae5af792201ebe4ab51fe8

SHA512
96f8b72e92628d9759089c3362238b178d5bbe61d17b2f5a55afbfb0f44076e9b044b1eb6fbb06c425dfbd4e9c562e2abd468c44a35ee6379ad3c060f39a449a

Download Submit
C:\Windows\SysWOW64\Lenamdem.exe

Filesize
482KB

MD5
1168f6ae6d64732077fd3f36f8b6b72d

SHA1
b5b243d4ca844fe5f1e143cd557a8064fffdb30a

SHA256
efada1b0ba4dca0a10a1fe6793adf6bdb932fc90c411dd02d34d40b9e7fb332a

SHA512
1fad7f009226a126d97f936a74fa22662a60b782dd4b519373811fd8dceceb8da41a241e66b64c833bac680beaa47f79b4a168839d87f47ea60ef917d29ccbf3

Download Submit
C:\Windows\SysWOW64\Lepncd32.exe

Filesize
482KB

MD5
35deb7fcc035f053c49297f3b7f0a716

SHA1
44a3a74ecef71bc4f2d62f5a824eb5f54742b583

SHA256
2dad44666037ce7b1949a308ee5f1825b9adbc02d79febe4ee0e47220ec4c547

SHA512
f654bb2f14caa11db910a1773167f8a8dac7ba6ed1c53503603a7a268dac585dd842524366c67f953420e21954f1f035fb9379858d6f9b03f3e15954667cfcbb

Download Submit
C:\Windows\SysWOW64\Lgokmgjm.exe

Filesize
482KB

MD5
c92961717250ad000fddd191111ce584

SHA1
2d99373eccbb828f98f6b649c53da266da75cdd7

SHA256
c1768f558dcc244fd898745979aecde48f200925ba1a34af6058cdd8fcb4a300

SHA512
aed28029c58c89e00ba791b6746b6652ca7071beb150e424c891e3aabb3e11d40f18bc34a813f59837c9b52be4b18e374bc75cf7d82a7328d447504c156a3126

Download Submit
C:\Windows\SysWOW64\Liddbc32.exe

Filesize
482KB

MD5
bb29dba47afd1cd1924fce67c8866071

SHA1
f991cd7ebc87a76260f5eae22486abe618165902

SHA256
8898bc346b5a75c06915e45d0a6dceb3cc8abcecfc039c74396d4d577cc87d97

SHA512
be7c43dac2137df09f6dab541b14f2079b59f508ece8e260cf8a965c5c21b0d40a9bb76711ba312e6ab65de6928dbb9c36879ec3b999fcd36490f3e46d5d8cb7

Download Submit
C:\Windows\SysWOW64\Llgjjnlj.exe

Filesize
482KB

MD5
e03b58746117356d165ad248d5a61700

SHA1
59f802cd8c290a918430e2e51730b9b970ae48f7

SHA256
6b986d1285faa9c3a6226f5ce4ac2b55d660833e13520eb1740d731ddd05e95e

SHA512
3f0a98ae071b5b1cc3b07391b7f889441dadd8d8695419cf0c7afedf2d5cd1eb2cfdfb0a3d6d1150c28a4a1047ca5cfd9dd9eeb8add94db08173c099087a6099

Download Submit
C:\Windows\SysWOW64\Lljfpnjg.exe

Filesize
482KB

MD5
825ae8f5916cc46fa7f1eba327bfda5c

SHA1
132bb47e2a23eacf8fca408cf1bc9257aa632556

SHA256
be1bc13713ac182fec088aac6257991f42a3cbb1cfd368e7ac630696b8d53e67

SHA512
1eb2dc96659a81e008a8b8c80875b46a5eea4c24e244808301b186d58655e093235a2548b6200ee02570bd97c6d4945c0f82952db066daafdd70417f049f8799

Download Submit
C:\Windows\SysWOW64\Lmiciaaj.exe

Filesize
482KB

MD5
834aa8537a6a95c4eb85b3965be77e99

SHA1
ea189b672fd8e73fe86722f1680d921c7daeb5c0

SHA256
9fd9eefa0da58c56a1062fbffba5c6d286a668d2855a0c46ab918210c4beb16e

SHA512
6762ba12c61545290981667f1e6c720e773b6c45c8639fbafa127958fb09303ca921d67aae2b1ed17fc073f107b8f569d4409f0dd8d8ffb5e39dbaadebd09d6b

Download Submit
C:\Windows\SysWOW64\Lpebpm32.exe

Filesize
482KB

MD5
f61463d91fd64dd4fc569df62bcedf71

SHA1
d4f24d2f47c9356a17c5367a97c571bb3fb95aa7

SHA256
1e8082aa5e3c45822efcfbeb34ee049541739c9e8922f8252ceb9bdfc8e7563d

SHA512
e1dd904105ec92649ff96a02e8f223134df6e09870c31d62ad34b7b49c11d9045929b930511f2c1bec663814801f608bfc5c97c116af8bcf0124a09246ff2eab

Download Submit
C:\Windows\SysWOW64\Mchhggno.exe

Filesize
482KB

MD5
b0b3cf7646f3dbc71c56bd72ede79a3c

SHA1
7376c778bdfab885411fdcc638adc99ff8f754c4

SHA256
0ef71adb9a689af3554c9a2f0617b7600d7e8715fbd89fda1c0c1748425fe01b

SHA512
b8f91d68a573d9b5510199562d90594dd730e86a5288dc48b8569472e1b12ab35e7d214ee5820d1abdf46ec70da1b9cc76b3a127916ff42ee2d624bed90360f0

Download Submit
C:\Windows\SysWOW64\Mdckfk32.exe

Filesize
482KB

MD5
065a5e0c8981883612793d1af4290e10

SHA1
b9b6ae5b67322674f9e215489a299be7544d13cc

SHA256
b5888e3a1786f127a955287f4823263021baef12e96f1e5a56b95e5f0b96ccab

SHA512
5f7017980773c6c1851222eb92eb08b224d984d5b549cc3d3d2e019480da3e51d96b96516b27272b1e7d87896c7880d021809c25e470799d8fa4a2abef045335

Download Submit
C:\Windows\SysWOW64\Mgagbf32.exe

Filesize
482KB

MD5
3ebaede823ad93e33769d72d20ca9085

SHA1
755cb05168d64d4841859ec2c9ceb0c252690858

SHA256
fa2c456651e75b55de731cf795f1d579c359c4115f1a1032d2f1f13468daf50a

SHA512
bfca877628737b0dc09f63301f88973f99c294cc94341fbff477c672c693183ecefaefa77006fc4314981c7133975663a9a6cfa6bcaff205517dcb31c9fb9f63

Download Submit
C:\Windows\SysWOW64\Mgddhf32.exe

Filesize
482KB

MD5
8aa17fc8ddac576bcbc052f59fab209c

SHA1
84b1416890afe2dc343bafcd8d17381e0f4f458b

SHA256
264f04e2d4d8424f93295caf1f6b40e1f35b8ca42804d6ab52693e7f101ab32f

SHA512
8e07f4eda512fadfb97ea24e6c98ec1e0c7659cc6585f804750c0555c8bdb32b63be264b2d570e3bad90aba987ea6f4898ec20eb78d104f9f8d589dc5d131468

Download Submit
C:\Windows\SysWOW64\Mpjlklok.exe

Filesize
482KB

MD5
704d5a69bca925e4a070f609f1fcd726

SHA1
bd2fd6821541208162113e4ab4980c9d53678ec3

SHA256
b314e20536f07d240aa06a6fecbe8b51bda73940f5f3d9d3b6bcb56dbb45e70a

SHA512
087049eddcd63d4ebab91871a76f64f482c3981fcfa21a72f168ab895efa4850deb3f223e39c1b4f79b069df8c0991c90172873a1233ce65dfae8ded6937ea5a

Download Submit
C:\Windows\SysWOW64\Qmeigg32.exe

Filesize
482KB

MD5
fef374723a970cadf352f5fdb16b90f0

SHA1
30e090f931bf36b44d166a521b3d084c29cff9aa

SHA256
326227ac236f949fc03b46fa0ae17bc238853a21b979fb37408c0661dbb32e41

SHA512
b5f1d927c1b18f5cc56a542b702486b571521c05f63c658b375f974110adbae55c46d9992cf206cb6c88cd9eaa9127c7d63e049b611d6b757d42c6b8e0d48a0d

Download Submit
memory/384-349-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/432-520-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/452-146-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/648-77-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/912-137-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1160-376-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1280-573-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1376-368-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1384-24-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1544-53-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1724-575-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1728-367-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1828-100-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1904-56-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/1976-365-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2136-7-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2616-358-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/2628-0-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3168-342-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3216-79-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3344-144-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3388-344-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3432-46-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3596-88-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/3716-374-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4308-357-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4424-148-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4444-20-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4548-52-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4616-364-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4736-373-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4792-104-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4816-366-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4928-356-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/4936-350-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5116-64-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5168-492-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5180-581-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5200-392-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5232-397-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5268-498-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5284-402-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5360-556-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5372-410-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5380-504-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5408-416-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5456-422-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5548-433-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5624-439-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5652-526-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5672-445-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5696-568-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5708-594-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5716-453-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5736-527-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5756-457-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5768-533-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5816-467-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5900-469-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5920-599-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5948-539-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/5976-475-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/6116-490-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/6132-546-0x0000000000400000-0x000000000046F000-memory.dmp

Filesize
444KB

Download
memory/10236-2018-0x0000000075AB2000-0x0000000075AB3000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads