975ce795a67de53a1d6f083d6bbce09e63271a6dbcfe0de228322f60f6c1bc17

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 03:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e0a19455c8d43d962890dbd5e05eb5b9.exe
Size

72KB
MD5

e0a19455c8d43d962890dbd5e05eb5b9
SHA1

18335076020b3ba3502413fa1d02971e02de206c
SHA256

975ce795a67de53a1d6f083d6bbce09e63271a6dbcfe0de228322f60f6c1bc17
SHA512

a5d3755a2b8f17846224423e75d240d279555e9b23277ce15134e28ddd7977a7771e21c5e90941aa1abb3fb97ebf817d55423144623b059a9e593413e23062ec
SSDEEP

768:Rxq+UVyQnwBJd1uxPHAEWNrEQwXJkKXK8/xtr1RCvXzHu3zSWEtnGNlyMspXbAvd:RxPS2EWO+Ka8wqjLNUpi

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Poodpmca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lnbklm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qjffpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Noehba32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmniml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kijchhbo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ajpqnneo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iakiia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lbinam32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffnknafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dnljkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccmgiaig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mchppmij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mgehfkop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmcpoedn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jkodhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pcpikkge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lbnngbbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dckdjomg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flpmagqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gmfplibd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nfaemp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mniallpq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dcnqpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jgbjbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fflohaij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmaamn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fbbpmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgmjmjnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Papfgbmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qoelkp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elpkep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bemqih32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iinjhh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jebfng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbebilli.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aadifclh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdfoio32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojcpdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ielfgmnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgoeep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nahgoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Imgicgca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pplobcpp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aknbkjfh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kahinkaf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pajeam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Abmjqe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbjelc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkjjlhle.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aakebqbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Anaomkdb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnhenj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fpgpgfmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hbjoeojc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dkndie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daeifj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hheoid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lbjelc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Knflpoqf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nihipdhl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnkkjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kbhmbdle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pfepdg32.exe

Executes dropped EXE 64 IoCs

pid	Process
4968	Afjlnk32.exe
1548	Agjhgngj.exe
5092	Andqdh32.exe
452	Aeniabfd.exe
1796	Afoeiklb.exe
4136	Aadifclh.exe
3900	Bnhjohkb.exe
1940	Bebblb32.exe
796	Bjokdipf.exe
1808	Bnmcjg32.exe
732	Bfhhoi32.exe
2368	Beihma32.exe
1064	Bnbmefbg.exe
4276	Bcoenmao.exe
400	Cndikf32.exe
2548	Cdabcm32.exe
2632	Cmiflbel.exe
3248	Cnicfe32.exe
4512	Cagobalc.exe
3468	Cfdhkhjj.exe
3356	Cajlhqjp.exe
116	Cffdpghg.exe
4000	Dhfajjoj.exe
2276	Dopigd32.exe
3964	Ddmaok32.exe
568	Dmefhako.exe
1436	Dkifae32.exe
3496	Dmgbnq32.exe
2708	Dhmgki32.exe
4104	Dmjocp32.exe
5036	Dddhpjof.exe
928	Dknpmdfc.exe
5080	Eecdjmfi.exe
4432	Ekpmbddq.exe
3752	Ehdmlhcj.exe
4192	Ekbihd32.exe
5000	Ealadnik.exe
1340	Eejjjl32.exe
4332	Emeoooml.exe
1356	Ehkclgmb.exe
3808	Fdbdah32.exe
4132	Fkllnbjc.exe
5160	Fnmepn32.exe
5204	Fgeihcme.exe
5248	Fnobem32.exe
5288	Fnckpmql.exe
5328	Gnfhfl32.exe
5368	Gepmlimi.exe
5412	Gnkaalkd.exe
5452	Ghpendjj.exe
5492	Gojnko32.exe
5532	Gkaopp32.exe
5572	Hheoid32.exe
5612	Hoogfnnb.exe
5652	Hfipbh32.exe
5692	Hnddgjbj.exe
5736	Hhihdcbp.exe
5784	Hnfamjqg.exe
5824	Hgoeep32.exe
5868	Hkmnln32.exe
5924	Ifbbig32.exe
5964	Igcoqocb.exe
6008	Ifdonfka.exe
6052	Ieliebnf.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nobdka32.dll	Gnkaalkd.exe
File opened for modification	C:\Windows\SysWOW64\Kiggbhda.exe	Kqpoakco.exe
File opened for modification	C:\Windows\SysWOW64\Knkekn32.exe	Kgamnded.exe
File created	C:\Windows\SysWOW64\Gjecbd32.dll	Bhmbqm32.exe
File opened for modification	C:\Windows\SysWOW64\Fncibg32.exe	Fcneeo32.exe
File created	C:\Windows\SysWOW64\Jkodhk32.exe	Jkmgblok.exe
File created	C:\Windows\SysWOW64\Ohnebd32.exe	Oofaiokl.exe
File created	C:\Windows\SysWOW64\Nbkdke32.dll	Kmdlffhj.exe
File created	C:\Windows\SysWOW64\Odhifjkg.exe	Neqopnhb.exe
File created	C:\Windows\SysWOW64\Hmkigh32.exe	Hfaajnfb.exe
File created	C:\Windows\SysWOW64\Phjenbhp.exe	Pcmlfl32.exe
File created	C:\Windows\SysWOW64\Nfenigce.dll	Mfpell32.exe
File opened for modification	C:\Windows\SysWOW64\Pbjddh32.exe	Pplhhm32.exe
File opened for modification	C:\Windows\SysWOW64\Ckggnp32.exe	Cgklmacf.exe
File created	C:\Windows\SysWOW64\Ohgohiia.dll	Ggepalof.exe
File opened for modification	C:\Windows\SysWOW64\Klmnkdal.exe	Kahinkaf.exe
File opened for modification	C:\Windows\SysWOW64\Igcoqocb.exe	Ifbbig32.exe
File opened for modification	C:\Windows\SysWOW64\Hcljmj32.exe	Hkaeih32.exe
File created	C:\Windows\SysWOW64\Bgnkhg32.exe	Bogcgj32.exe
File created	C:\Windows\SysWOW64\Okedcjcm.exe	Nhdlao32.exe
File created	C:\Windows\SysWOW64\Lknojl32.exe	Lqikmc32.exe
File created	C:\Windows\SysWOW64\Ndikch32.dll	Bphgeo32.exe
File opened for modification	C:\Windows\SysWOW64\Dnajppda.exe	Dakikoom.exe
File opened for modification	C:\Windows\SysWOW64\Fbdnne32.exe	Fcbnpnme.exe
File opened for modification	C:\Windows\SysWOW64\Igmoih32.exe	Iabglnco.exe
File opened for modification	C:\Windows\SysWOW64\Kbbhqn32.exe	Knflpoqf.exe
File created	C:\Windows\SysWOW64\Hgfapd32.exe	Hibafp32.exe
File opened for modification	C:\Windows\SysWOW64\Eiokinbk.exe	Enigke32.exe
File opened for modification	C:\Windows\SysWOW64\Oikjkc32.exe	Ocnabm32.exe
File created	C:\Windows\SysWOW64\Cmiflbel.exe	Cdabcm32.exe
File opened for modification	C:\Windows\SysWOW64\Mnlnbl32.exe	Mahnhhod.exe
File created	C:\Windows\SysWOW64\Jmheim32.dll	Elgaeolp.exe
File created	C:\Windows\SysWOW64\Eqkondfl.exe	Enlcahgh.exe
File created	C:\Windows\SysWOW64\Pdggmekl.dll	Hnfamjqg.exe
File created	C:\Windows\SysWOW64\Clfabmda.dll	Epcdqd32.exe
File created	C:\Windows\SysWOW64\Bjpjel32.exe	Bmlilh32.exe
File opened for modification	C:\Windows\SysWOW64\Ljbnfleo.exe	Lhcali32.exe
File opened for modification	C:\Windows\SysWOW64\Mhoipb32.exe	Meamcg32.exe
File created	C:\Windows\SysWOW64\Mieced32.dll	Mbighjdd.exe
File created	C:\Windows\SysWOW64\Ddooacnk.dll	Igpdfb32.exe
File created	C:\Windows\SysWOW64\Emjgim32.exe	Eiokinbk.exe
File opened for modification	C:\Windows\SysWOW64\Flkdfh32.exe	Ffnknafg.exe
File created	C:\Windows\SysWOW64\Dahcld32.dll	Igdgglfl.exe
File opened for modification	C:\Windows\SysWOW64\Lobjni32.exe	Lfjfecno.exe
File created	C:\Windows\SysWOW64\Fcbnpnme.exe	Fdpnda32.exe
File created	C:\Windows\SysWOW64\Fineoi32.exe	Ffpicn32.exe
File opened for modification	C:\Windows\SysWOW64\Iahlcaol.exe	Ikndgg32.exe
File created	C:\Windows\SysWOW64\Mcecjmkl.exe	Maggnali.exe
File opened for modification	C:\Windows\SysWOW64\Amnlme32.exe	Apjkcadp.exe
File created	C:\Windows\SysWOW64\Oikjkc32.exe	Ocnabm32.exe
File created	C:\Windows\SysWOW64\Fbfkceca.exe	Fnjocf32.exe
File opened for modification	C:\Windows\SysWOW64\Nlleaeff.exe	Nebmekoi.exe
File opened for modification	C:\Windows\SysWOW64\Pmaffnce.exe	Phdnngdn.exe
File created	C:\Windows\SysWOW64\Pjldplpd.dll	Bochmn32.exe
File opened for modification	C:\Windows\SysWOW64\Chnlgjlb.exe	Cpfcfmlp.exe
File created	C:\Windows\SysWOW64\Ghnllm32.dll	Nmcpoedn.exe
File created	C:\Windows\SysWOW64\Caaimlpo.dll	Bdlfjh32.exe
File created	C:\Windows\SysWOW64\Ephbhd32.exe	Egpnooan.exe
File created	C:\Windows\SysWOW64\Ccmgiaig.exe	Cfigpm32.exe
File opened for modification	C:\Windows\SysWOW64\Hgkkkcbc.exe	Hgfapd32.exe
File created	C:\Windows\SysWOW64\Jojdlfeo.exe	Jhplpl32.exe
File opened for modification	C:\Windows\SysWOW64\Abmjqe32.exe	Apnndj32.exe
File created	C:\Windows\SysWOW64\Gblnkg32.dll	Bfhhoi32.exe
File created	C:\Windows\SysWOW64\Hnddgjbj.exe	Hfipbh32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10948	9848	WerFault.exe	988

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Plhnda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ogfapnkp.dll"	Bcghch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kbbhqn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gdgdeppb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fmqgpgoc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cobhcgin.dll"	Mniallpq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knhcpa32.dll"	Oldamm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cmncbodd.dll"	Oboijgbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bcoenmao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Knbbep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Aajohjon.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iinjhh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lmaamn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bemqih32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pgflqkdd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fdccbl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gmdjapgb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nelfeo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qeodhjmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hdilnojp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fpgpgfmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jbojlfdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Affikdfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kamjda32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pbekii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ijmhkchl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kpdboimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jchbom32.dll"	Poodpmca.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Phaahggp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bdlhkf32.dll"	Cbbnpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlobem32.dll"	Chdialdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bbloam32.dll"	Cdabcm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ajcdnd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qodeajbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgijpe32.dll"	Bddcenpi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bggnof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ampaho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gcnnllcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ledoegkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebafce32.dll"	Efmmmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjjald32.dll"	Dopigd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjgobjmp.dll"	Nlfnaicd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eokqkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Khbiello.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ieliebnf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Glldgljg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bkaobnio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gflonn32.dll"	Oqmhqapg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jaonbc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Piapkbeg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gbeejp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jcanll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lnjgfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nadleilm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lihcbd32.dll"	Onkidm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmnbjama.dll"	Ppolhcnm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hkmnln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgklej32.dll"	Hncmmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Igliicdk.dll"	Akcjkfij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qhmqdemc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hefnkkkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gidbim32.dll"	Ddmaok32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iafonaao.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 4968	3328	e0a19455c8d43d962890dbd5e05eb5b9.exe	93
PID 3328 wrote to memory of 4968	3328	e0a19455c8d43d962890dbd5e05eb5b9.exe	93
PID 3328 wrote to memory of 4968	3328	e0a19455c8d43d962890dbd5e05eb5b9.exe	93
PID 4968 wrote to memory of 1548	4968	Afjlnk32.exe	94
PID 4968 wrote to memory of 1548	4968	Afjlnk32.exe	94
PID 4968 wrote to memory of 1548	4968	Afjlnk32.exe	94
PID 1548 wrote to memory of 5092	1548	Agjhgngj.exe	95
PID 1548 wrote to memory of 5092	1548	Agjhgngj.exe	95
PID 1548 wrote to memory of 5092	1548	Agjhgngj.exe	95
PID 5092 wrote to memory of 452	5092	Andqdh32.exe	96
PID 5092 wrote to memory of 452	5092	Andqdh32.exe	96
PID 5092 wrote to memory of 452	5092	Andqdh32.exe	96
PID 452 wrote to memory of 1796	452	Aeniabfd.exe	97
PID 452 wrote to memory of 1796	452	Aeniabfd.exe	97
PID 452 wrote to memory of 1796	452	Aeniabfd.exe	97
PID 1796 wrote to memory of 4136	1796	Afoeiklb.exe	98
PID 1796 wrote to memory of 4136	1796	Afoeiklb.exe	98
PID 1796 wrote to memory of 4136	1796	Afoeiklb.exe	98
PID 4136 wrote to memory of 3900	4136	Aadifclh.exe	99
PID 4136 wrote to memory of 3900	4136	Aadifclh.exe	99
PID 4136 wrote to memory of 3900	4136	Aadifclh.exe	99
PID 3900 wrote to memory of 1940	3900	Bnhjohkb.exe	100
PID 3900 wrote to memory of 1940	3900	Bnhjohkb.exe	100
PID 3900 wrote to memory of 1940	3900	Bnhjohkb.exe	100
PID 1940 wrote to memory of 796	1940	Bebblb32.exe	101
PID 1940 wrote to memory of 796	1940	Bebblb32.exe	101
PID 1940 wrote to memory of 796	1940	Bebblb32.exe	101
PID 796 wrote to memory of 1808	796	Bjokdipf.exe	103
PID 796 wrote to memory of 1808	796	Bjokdipf.exe	103
PID 796 wrote to memory of 1808	796	Bjokdipf.exe	103
PID 1808 wrote to memory of 732	1808	Bnmcjg32.exe	104
PID 1808 wrote to memory of 732	1808	Bnmcjg32.exe	104
PID 1808 wrote to memory of 732	1808	Bnmcjg32.exe	104
PID 732 wrote to memory of 2368	732	Bfhhoi32.exe	105
PID 732 wrote to memory of 2368	732	Bfhhoi32.exe	105
PID 732 wrote to memory of 2368	732	Bfhhoi32.exe	105
PID 2368 wrote to memory of 1064	2368	Beihma32.exe	106
PID 2368 wrote to memory of 1064	2368	Beihma32.exe	106
PID 2368 wrote to memory of 1064	2368	Beihma32.exe	106
PID 1064 wrote to memory of 4276	1064	Bnbmefbg.exe	107
PID 1064 wrote to memory of 4276	1064	Bnbmefbg.exe	107
PID 1064 wrote to memory of 4276	1064	Bnbmefbg.exe	107
PID 4276 wrote to memory of 400	4276	Bcoenmao.exe	109
PID 4276 wrote to memory of 400	4276	Bcoenmao.exe	109
PID 4276 wrote to memory of 400	4276	Bcoenmao.exe	109
PID 400 wrote to memory of 2548	400	Cndikf32.exe	110
PID 400 wrote to memory of 2548	400	Cndikf32.exe	110
PID 400 wrote to memory of 2548	400	Cndikf32.exe	110
PID 2548 wrote to memory of 2632	2548	Cdabcm32.exe	111
PID 2548 wrote to memory of 2632	2548	Cdabcm32.exe	111
PID 2548 wrote to memory of 2632	2548	Cdabcm32.exe	111
PID 2632 wrote to memory of 3248	2632	Cmiflbel.exe	113
PID 2632 wrote to memory of 3248	2632	Cmiflbel.exe	113
PID 2632 wrote to memory of 3248	2632	Cmiflbel.exe	113
PID 3248 wrote to memory of 4512	3248	Cnicfe32.exe	114
PID 3248 wrote to memory of 4512	3248	Cnicfe32.exe	114
PID 3248 wrote to memory of 4512	3248	Cnicfe32.exe	114
PID 4512 wrote to memory of 3468	4512	Cagobalc.exe	115
PID 4512 wrote to memory of 3468	4512	Cagobalc.exe	115
PID 4512 wrote to memory of 3468	4512	Cagobalc.exe	115
PID 3468 wrote to memory of 3356	3468	Cfdhkhjj.exe	116
PID 3468 wrote to memory of 3356	3468	Cfdhkhjj.exe	116
PID 3468 wrote to memory of 3356	3468	Cfdhkhjj.exe	116
PID 3356 wrote to memory of 116	3356	Cajlhqjp.exe	117

C:\Users\Admin\AppData\Local\Temp\e0a19455c8d43d962890dbd5e05eb5b9.exe
"C:\Users\Admin\AppData\Local\Temp\e0a19455c8d43d962890dbd5e05eb5b9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\SysWOW64\Afjlnk32.exe
  C:\Windows\system32\Afjlnk32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\SysWOW64\Agjhgngj.exe
    C:\Windows\system32\Agjhgngj.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1548
  - - C:\Windows\SysWOW64\Andqdh32.exe
      C:\Windows\system32\Andqdh32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5092
    - - C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:452
      - C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1796
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4136
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3900
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\SysWOW64\Bjokdipf.exe
        
        C:\Windows\system32\Bjokdipf.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:796
        
        C:\Windows\SysWOW64\Bnmcjg32.exe
        
        C:\Windows\system32\Bnmcjg32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1808
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:732
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2368
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1064
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4276
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:400
        
        C:\Windows\SysWOW64\Cdabcm32.exe
        
        C:\Windows\system32\Cdabcm32.exe
        17⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2548
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2632
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3248
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3468
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3356
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        23⤵
        Executes dropped EXE
        
        PID:116
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        24⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Dhfajjoj.exe
        
        C:\Windows\system32\Dhfajjoj.exe
        25⤵
        Executes dropped EXE
        
        PID:4000
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2276
        
        C:\Windows\SysWOW64\Ddmaok32.exe
        
        C:\Windows\system32\Ddmaok32.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3964
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        28⤵
        Executes dropped EXE
        
        PID:568
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        29⤵
        Executes dropped EXE
        
        PID:1436
        
        C:\Windows\SysWOW64\Dmgbnq32.exe
        
        C:\Windows\system32\Dmgbnq32.exe
        30⤵
        Executes dropped EXE
        
        PID:3496
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        31⤵
        Executes dropped EXE
        
        PID:2708
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        32⤵
        Executes dropped EXE
        
        PID:4104
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        33⤵
        Executes dropped EXE
        
        PID:5036
        
        C:\Windows\SysWOW64\Dknpmdfc.exe
        
        C:\Windows\system32\Dknpmdfc.exe
        34⤵
        Executes dropped EXE
        
        PID:928
        
        C:\Windows\SysWOW64\Eecdjmfi.exe
        
        C:\Windows\system32\Eecdjmfi.exe
        35⤵
        Executes dropped EXE
        
        PID:5080
        
        C:\Windows\SysWOW64\Ekpmbddq.exe
        
        C:\Windows\system32\Ekpmbddq.exe
        36⤵
        Executes dropped EXE
        
        PID:4432
        
        C:\Windows\SysWOW64\Ehdmlhcj.exe
        
        C:\Windows\system32\Ehdmlhcj.exe
        37⤵
        Executes dropped EXE
        
        PID:3752
        
        C:\Windows\SysWOW64\Ekbihd32.exe
        
        C:\Windows\system32\Ekbihd32.exe
        38⤵
        Executes dropped EXE
        
        PID:4192
        
        C:\Windows\SysWOW64\Ealadnik.exe
        
        C:\Windows\system32\Ealadnik.exe
        39⤵
        Executes dropped EXE
        
        PID:5000
        
        C:\Windows\SysWOW64\Eejjjl32.exe
        
        C:\Windows\system32\Eejjjl32.exe
        40⤵
        Executes dropped EXE
        
        PID:1340
        
        C:\Windows\SysWOW64\Emeoooml.exe
        
        C:\Windows\system32\Emeoooml.exe
        41⤵
        Executes dropped EXE
        
        PID:4332
        
        C:\Windows\SysWOW64\Ehkclgmb.exe
        
        C:\Windows\system32\Ehkclgmb.exe
        42⤵
        Executes dropped EXE
        
        PID:1356
        
        C:\Windows\SysWOW64\Fdbdah32.exe
        
        C:\Windows\system32\Fdbdah32.exe
        43⤵
        Executes dropped EXE
        
        PID:3808
        
        C:\Windows\SysWOW64\Fkllnbjc.exe
        
        C:\Windows\system32\Fkllnbjc.exe
        44⤵
        Executes dropped EXE
        
        PID:4132
        
        C:\Windows\SysWOW64\Fnmepn32.exe
        
        C:\Windows\system32\Fnmepn32.exe
        45⤵
        Executes dropped EXE
        
        PID:5160
        
        C:\Windows\SysWOW64\Fgeihcme.exe
        
        C:\Windows\system32\Fgeihcme.exe
        46⤵
        Executes dropped EXE
        
        PID:5204
        
        C:\Windows\SysWOW64\Fnobem32.exe
        
        C:\Windows\system32\Fnobem32.exe
        47⤵
        Executes dropped EXE
        
        PID:5248
        
        C:\Windows\SysWOW64\Fnckpmql.exe
        
        C:\Windows\system32\Fnckpmql.exe
        48⤵
        Executes dropped EXE
        
        PID:5288
        
        C:\Windows\SysWOW64\Gnfhfl32.exe
        
        C:\Windows\system32\Gnfhfl32.exe
        49⤵
        Executes dropped EXE
        
        PID:5328
        
        C:\Windows\SysWOW64\Gepmlimi.exe
        
        C:\Windows\system32\Gepmlimi.exe
        50⤵
        Executes dropped EXE
        
        PID:5368
        
        C:\Windows\SysWOW64\Gnkaalkd.exe
        
        C:\Windows\system32\Gnkaalkd.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5412
        
        C:\Windows\SysWOW64\Ghpendjj.exe
        
        C:\Windows\system32\Ghpendjj.exe
        52⤵
        Executes dropped EXE
        
        PID:5452
        
        C:\Windows\SysWOW64\Gojnko32.exe
        
        C:\Windows\system32\Gojnko32.exe
        53⤵
        Executes dropped EXE
        
        PID:5492
        
        C:\Windows\SysWOW64\Gkaopp32.exe
        
        C:\Windows\system32\Gkaopp32.exe
        54⤵
        Executes dropped EXE
        
        PID:5532
        
        C:\Windows\SysWOW64\Hheoid32.exe
        
        C:\Windows\system32\Hheoid32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5572
        
        C:\Windows\SysWOW64\Hoogfnnb.exe
        
        C:\Windows\system32\Hoogfnnb.exe
        56⤵
        Executes dropped EXE
        
        PID:5612
        
        C:\Windows\SysWOW64\Hfipbh32.exe
        
        C:\Windows\system32\Hfipbh32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5652
        
        C:\Windows\SysWOW64\Hnddgjbj.exe
        
        C:\Windows\system32\Hnddgjbj.exe
        58⤵
        Executes dropped EXE
        
        PID:5692
        
        C:\Windows\SysWOW64\Hhihdcbp.exe
        
        C:\Windows\system32\Hhihdcbp.exe
        59⤵
        Executes dropped EXE
        
        PID:5736
        
        C:\Windows\SysWOW64\Hnfamjqg.exe
        
        C:\Windows\system32\Hnfamjqg.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5784
        
        C:\Windows\SysWOW64\Hgoeep32.exe
        
        C:\Windows\system32\Hgoeep32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5824
        
        C:\Windows\SysWOW64\Hkmnln32.exe
        
        C:\Windows\system32\Hkmnln32.exe
        62⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5868
        
        C:\Windows\SysWOW64\Ifbbig32.exe
        
        C:\Windows\system32\Ifbbig32.exe
        63⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5924
        
        C:\Windows\SysWOW64\Igcoqocb.exe
        
        C:\Windows\system32\Igcoqocb.exe
        64⤵
        Executes dropped EXE
        
        PID:5964
        
        C:\Windows\SysWOW64\Ifdonfka.exe
        
        C:\Windows\system32\Ifdonfka.exe
        65⤵
        Executes dropped EXE
        
        PID:6008
        
        C:\Windows\SysWOW64\Ieliebnf.exe
        
        C:\Windows\system32\Ieliebnf.exe
        66⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:6052
        
        C:\Windows\SysWOW64\Ioambknl.exe
        
        C:\Windows\system32\Ioambknl.exe
        67⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Ifleoe32.exe
        
        C:\Windows\system32\Ifleoe32.exe
        68⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Jkhngl32.exe
        
        C:\Windows\system32\Jkhngl32.exe
        69⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Jfnbdecg.exe
        
        C:\Windows\system32\Jfnbdecg.exe
        70⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Jgonlm32.exe
        
        C:\Windows\system32\Jgonlm32.exe
        71⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Jfpojead.exe
        
        C:\Windows\system32\Jfpojead.exe
        72⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Jkmgblok.exe
        
        C:\Windows\system32\Jkmgblok.exe
        73⤵
        Drops file in System32 directory
        
        PID:5436
        
        C:\Windows\SysWOW64\Jkodhk32.exe
        
        C:\Windows\system32\Jkodhk32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5504
        
        C:\Windows\SysWOW64\Jicdap32.exe
        
        C:\Windows\system32\Jicdap32.exe
        75⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Jpmlnjco.exe
        
        C:\Windows\system32\Jpmlnjco.exe
        76⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Jblijebc.exe
        
        C:\Windows\system32\Jblijebc.exe
        77⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Jejefqaf.exe
        
        C:\Windows\system32\Jejefqaf.exe
        78⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Kbnepe32.exe
        
        C:\Windows\system32\Kbnepe32.exe
        79⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Klfjijgq.exe
        
        C:\Windows\system32\Klfjijgq.exe
        80⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Keonap32.exe
        
        C:\Windows\system32\Keonap32.exe
        81⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Kpdboimg.exe
        
        C:\Windows\system32\Kpdboimg.exe
        82⤵
        Modifies registry class
        
        PID:4816
        
        C:\Windows\SysWOW64\Kfnkkb32.exe
        
        C:\Windows\system32\Kfnkkb32.exe
        83⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Khpgckkb.exe
        
        C:\Windows\system32\Khpgckkb.exe
        84⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Lbjelc32.exe
        
        C:\Windows\system32\Lbjelc32.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5408
        
        C:\Windows\SysWOW64\Lifjnm32.exe
        
        C:\Windows\system32\Lifjnm32.exe
        86⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Lldfjh32.exe
        
        C:\Windows\system32\Lldfjh32.exe
        87⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Lbnngbbn.exe
        
        C:\Windows\system32\Lbnngbbn.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5768
        
        C:\Windows\SysWOW64\Lihfcm32.exe
        
        C:\Windows\system32\Lihfcm32.exe
        89⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Llgcph32.exe
        
        C:\Windows\system32\Llgcph32.exe
        90⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Lfodbqfa.exe
        
        C:\Windows\system32\Lfodbqfa.exe
        91⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\Mlklkgei.exe
        
        C:\Windows\system32\Mlklkgei.exe
        92⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Mojhgbdl.exe
        
        C:\Windows\system32\Mojhgbdl.exe
        93⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Mfaqhp32.exe
        
        C:\Windows\system32\Mfaqhp32.exe
        94⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Miomdk32.exe
        
        C:\Windows\system32\Miomdk32.exe
        95⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Mlnipg32.exe
        
        C:\Windows\system32\Mlnipg32.exe
        96⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\Mbhamajc.exe
        
        C:\Windows\system32\Mbhamajc.exe
        97⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\Mhdjehhj.exe
        
        C:\Windows\system32\Mhdjehhj.exe
        98⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Mfjcnold.exe
        
        C:\Windows\system32\Mfjcnold.exe
        99⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Nhlpfgbb.exe
        
        C:\Windows\system32\Nhlpfgbb.exe
        100⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\Noehba32.exe
        
        C:\Windows\system32\Noehba32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4984
        
        C:\Windows\SysWOW64\Nlihle32.exe
        
        C:\Windows\system32\Nlihle32.exe
        102⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Nebmekoi.exe
        
        C:\Windows\system32\Nebmekoi.exe
        103⤵
        Drops file in System32 directory
        
        PID:6228
        
        C:\Windows\SysWOW64\Nlleaeff.exe
        
        C:\Windows\system32\Nlleaeff.exe
        104⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Nedjjj32.exe
        
        C:\Windows\system32\Nedjjj32.exe
        105⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Npjnhc32.exe
        
        C:\Windows\system32\Npjnhc32.exe
        106⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Ngdfdmdi.exe
        
        C:\Windows\system32\Ngdfdmdi.exe
        107⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Nibbqicm.exe
        
        C:\Windows\system32\Nibbqicm.exe
        108⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Nplkmckj.exe
        
        C:\Windows\system32\Nplkmckj.exe
        109⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Ncjginjn.exe
        
        C:\Windows\system32\Ncjginjn.exe
        110⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Ogfcjm32.exe
        
        C:\Windows\system32\Ogfcjm32.exe
        111⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Olckbd32.exe
        
        C:\Windows\system32\Olckbd32.exe
        112⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Oghppm32.exe
        
        C:\Windows\system32\Oghppm32.exe
        113⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        114⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Oocddono.exe
        
        C:\Windows\system32\Oocddono.exe
        115⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Ogklelna.exe
        
        C:\Windows\system32\Ogklelna.exe
        116⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Ohlimd32.exe
        
        C:\Windows\system32\Ohlimd32.exe
        117⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Oofaiokl.exe
        
        C:\Windows\system32\Oofaiokl.exe
        118⤵
        Drops file in System32 directory
        
        PID:6980
        
        C:\Windows\SysWOW64\Ohnebd32.exe
        
        C:\Windows\system32\Ohnebd32.exe
        119⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Opemca32.exe
        
        C:\Windows\system32\Opemca32.exe
        120⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Oebflhaf.exe
        
        C:\Windows\system32\Oebflhaf.exe
        121⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Ohqbhdpj.exe
        
        C:\Windows\system32\Ohqbhdpj.exe
        122⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Phcomcng.exe
        
        C:\Windows\system32\Phcomcng.exe
        123⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Pgdokkfg.exe
        
        C:\Windows\system32\Pgdokkfg.exe
        124⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Poodpmca.exe
        
        C:\Windows\system32\Poodpmca.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6404
        
        C:\Windows\SysWOW64\Pgflqkdd.exe
        
        C:\Windows\system32\Pgflqkdd.exe
        126⤵
        Modifies registry class
        
        PID:6500
        
        C:\Windows\SysWOW64\Phhhhc32.exe
        
        C:\Windows\system32\Phhhhc32.exe
        127⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Pcmlfl32.exe
        
        C:\Windows\system32\Pcmlfl32.exe
        128⤵
        Drops file in System32 directory
        
        PID:6644
        
        C:\Windows\SysWOW64\Phjenbhp.exe
        
        C:\Windows\system32\Phjenbhp.exe
        129⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Pcpikkge.exe
        
        C:\Windows\system32\Pcpikkge.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6776
        
        C:\Windows\SysWOW64\Pjjahe32.exe
        
        C:\Windows\system32\Pjjahe32.exe
        131⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\Plhnda32.exe
        
        C:\Windows\system32\Plhnda32.exe
        132⤵
        Modifies registry class
        
        PID:6856
        
        C:\Windows\SysWOW64\Qcbfakec.exe
        
        C:\Windows\system32\Qcbfakec.exe
        133⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Qqhcpo32.exe
        
        C:\Windows\system32\Qqhcpo32.exe
        134⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Afelhf32.exe
        
        C:\Windows\system32\Afelhf32.exe
        135⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Amodep32.exe
        
        C:\Windows\system32\Amodep32.exe
        136⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Ajcdnd32.exe
        
        C:\Windows\system32\Ajcdnd32.exe
        137⤵
        Modifies registry class
        
        PID:6284
        
        C:\Windows\SysWOW64\Ahfdjanb.exe
        
        C:\Windows\system32\Ahfdjanb.exe
        138⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Ackigjmh.exe
        
        C:\Windows\system32\Ackigjmh.exe
        139⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Ajeadd32.exe
        
        C:\Windows\system32\Ajeadd32.exe
        140⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Aobilkcl.exe
        
        C:\Windows\system32\Aobilkcl.exe
        141⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Agiamhdo.exe
        
        C:\Windows\system32\Agiamhdo.exe
        142⤵
        
        PID:720
        
        C:\Windows\SysWOW64\Ajhniccb.exe
        
        C:\Windows\system32\Ajhniccb.exe
        143⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Aqaffn32.exe
        
        C:\Windows\system32\Aqaffn32.exe
        144⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Amhfkopc.exe
        
        C:\Windows\system32\Amhfkopc.exe
        145⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Bogcgj32.exe
        
        C:\Windows\system32\Bogcgj32.exe
        146⤵
        Drops file in System32 directory
        
        PID:6472
        
        C:\Windows\SysWOW64\Bgnkhg32.exe
        
        C:\Windows\system32\Bgnkhg32.exe
        147⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Bqfoamfj.exe
        
        C:\Windows\system32\Bqfoamfj.exe
        148⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Bqilgmdg.exe
        
        C:\Windows\system32\Bqilgmdg.exe
        149⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Bcghch32.exe
        
        C:\Windows\system32\Bcghch32.exe
        150⤵
        Modifies registry class
        
        PID:6408
        
        C:\Windows\SysWOW64\Bfedoc32.exe
        
        C:\Windows\system32\Bfedoc32.exe
        151⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Bidqko32.exe
        
        C:\Windows\system32\Bidqko32.exe
        152⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Bgeaifia.exe
        
        C:\Windows\system32\Bgeaifia.exe
        153⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Bjcmebie.exe
        
        C:\Windows\system32\Bjcmebie.exe
        154⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Bppfmigl.exe
        
        C:\Windows\system32\Bppfmigl.exe
        155⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Bggnof32.exe
        
        C:\Windows\system32\Bggnof32.exe
        156⤵
        Modifies registry class
        
        PID:3592
        
        C:\Windows\SysWOW64\Bjfjka32.exe
        
        C:\Windows\system32\Bjfjka32.exe
        157⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Cmdfgm32.exe
        
        C:\Windows\system32\Cmdfgm32.exe
        158⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Cflkpblf.exe
        
        C:\Windows\system32\Cflkpblf.exe
        159⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Cikglnkj.exe
        
        C:\Windows\system32\Cikglnkj.exe
        160⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Cabomkll.exe
        
        C:\Windows\system32\Cabomkll.exe
        161⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Cglgjeci.exe
        
        C:\Windows\system32\Cglgjeci.exe
        162⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Cjjcfabm.exe
        
        C:\Windows\system32\Cjjcfabm.exe
        163⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Cgndoeag.exe
        
        C:\Windows\system32\Cgndoeag.exe
        164⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Cceddf32.exe
        
        C:\Windows\system32\Cceddf32.exe
        165⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Cfcqpa32.exe
        
        C:\Windows\system32\Cfcqpa32.exe
        166⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Cmniml32.exe
        
        C:\Windows\system32\Cmniml32.exe
        167⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7604
        
        C:\Windows\SysWOW64\Cpleig32.exe
        
        C:\Windows\system32\Cpleig32.exe
        168⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Cgcmjd32.exe
        
        C:\Windows\system32\Cgcmjd32.exe
        169⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Cidjbmcp.exe
        
        C:\Windows\system32\Cidjbmcp.exe
        170⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Dakacjdb.exe
        
        C:\Windows\system32\Dakacjdb.exe
        171⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Dgejpd32.exe
        
        C:\Windows\system32\Dgejpd32.exe
        172⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Djdflp32.exe
        
        C:\Windows\system32\Djdflp32.exe
        173⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Dpqodfij.exe
        
        C:\Windows\system32\Dpqodfij.exe
        174⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Dclkee32.exe
        
        C:\Windows\system32\Dclkee32.exe
        175⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Dfjgaq32.exe
        
        C:\Windows\system32\Dfjgaq32.exe
        176⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Diicml32.exe
        
        C:\Windows\system32\Diicml32.exe
        177⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Dmdonkgc.exe
        
        C:\Windows\system32\Dmdonkgc.exe
        178⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Dapkni32.exe
        
        C:\Windows\system32\Dapkni32.exe
        179⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Dikpbl32.exe
        
        C:\Windows\system32\Dikpbl32.exe
        180⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Dabhdinj.exe
        
        C:\Windows\system32\Dabhdinj.exe
        181⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Dhlpqc32.exe
        
        C:\Windows\system32\Dhlpqc32.exe
        182⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Ddcqedkk.exe
        
        C:\Windows\system32\Ddcqedkk.exe
        183⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Eagaoh32.exe
        
        C:\Windows\system32\Eagaoh32.exe
        184⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        185⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Ealkjh32.exe
        
        C:\Windows\system32\Ealkjh32.exe
        186⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Efhcbodf.exe
        
        C:\Windows\system32\Efhcbodf.exe
        187⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Epagkd32.exe
        
        C:\Windows\system32\Epagkd32.exe
        188⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Edmclccp.exe
        
        C:\Windows\system32\Edmclccp.exe
        189⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Emehdh32.exe
        
        C:\Windows\system32\Emehdh32.exe
        190⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Epcdqd32.exe
        
        C:\Windows\system32\Epcdqd32.exe
        191⤵
        Drops file in System32 directory
        
        PID:7856
        
        C:\Windows\SysWOW64\Efmmmn32.exe
        
        C:\Windows\system32\Efmmmn32.exe
        192⤵
        Modifies registry class
        
        PID:7924
        
        C:\Windows\SysWOW64\Fdamgb32.exe
        
        C:\Windows\system32\Fdamgb32.exe
        193⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        194⤵
        Drops file in System32 directory
        
        PID:8072
        
        C:\Windows\SysWOW64\Fineoi32.exe
        
        C:\Windows\system32\Fineoi32.exe
        195⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Fdcjlb32.exe
        
        C:\Windows\system32\Fdcjlb32.exe
        196⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Fknbil32.exe
        
        C:\Windows\system32\Fknbil32.exe
        197⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        198⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Fhabbp32.exe
        
        C:\Windows\system32\Fhabbp32.exe
        199⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Fibojhim.exe
        
        C:\Windows\system32\Fibojhim.exe
        200⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Fhdohp32.exe
        
        C:\Windows\system32\Fhdohp32.exe
        201⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        202⤵
        Modifies registry class
        
        PID:7784
        
        C:\Windows\SysWOW64\Fpodlbng.exe
        
        C:\Windows\system32\Fpodlbng.exe
        203⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Fhflnpoi.exe
        
        C:\Windows\system32\Fhflnpoi.exe
        204⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Gkdhjknm.exe
        
        C:\Windows\system32\Gkdhjknm.exe
        205⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        206⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        207⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Gkgeoklj.exe
        
        C:\Windows\system32\Gkgeoklj.exe
        208⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Gpcmga32.exe
        
        C:\Windows\system32\Gpcmga32.exe
        209⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Gilapgqb.exe
        
        C:\Windows\system32\Gilapgqb.exe
        210⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Ghmbno32.exe
        
        C:\Windows\system32\Ghmbno32.exe
        211⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Gnjjfegi.exe
        
        C:\Windows\system32\Gnjjfegi.exe
        212⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        213⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7404
        
        C:\Windows\SysWOW64\Hjchaf32.exe
        
        C:\Windows\system32\Hjchaf32.exe
        215⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Hdilnojp.exe
        
        C:\Windows\system32\Hdilnojp.exe
        216⤵
        Modifies registry class
        
        PID:7884
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        217⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Hncmmd32.exe
        
        C:\Windows\system32\Hncmmd32.exe
        218⤵
        Modifies registry class
        
        PID:7540
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        219⤵
        
        PID:936
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        220⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Hkjjlhle.exe
        
        C:\Windows\system32\Hkjjlhle.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8280
        
        C:\Windows\SysWOW64\Ihnkel32.exe
        
        C:\Windows\system32\Ihnkel32.exe
        222⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        223⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Iafonaao.exe
        
        C:\Windows\system32\Iafonaao.exe
        224⤵
        Modifies registry class
        
        PID:8408
        
        C:\Windows\SysWOW64\Iddljmpc.exe
        
        C:\Windows\system32\Iddljmpc.exe
        225⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Igchfiof.exe
        
        C:\Windows\system32\Igchfiof.exe
        226⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Ikndgg32.exe
        
        C:\Windows\system32\Ikndgg32.exe
        227⤵
        Drops file in System32 directory
        
        PID:8552
        
        C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        228⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Igedlh32.exe
        
        C:\Windows\system32\Igedlh32.exe
        229⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8676
        
        C:\Windows\SysWOW64\Iggaah32.exe
        
        C:\Windows\system32\Iggaah32.exe
        231⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Inainbcn.exe
        
        C:\Windows\system32\Inainbcn.exe
        232⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Indfca32.exe
        
        C:\Windows\system32\Indfca32.exe
        233⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Jkhgmf32.exe
        
        C:\Windows\system32\Jkhgmf32.exe
        234⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Jjjghcfp.exe
        
        C:\Windows\system32\Jjjghcfp.exe
        235⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Jgogbgei.exe
        
        C:\Windows\system32\Jgogbgei.exe
        236⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Jjmcnbdm.exe
        
        C:\Windows\system32\Jjmcnbdm.exe
        237⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        238⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Jgenbfoa.exe
        
        C:\Windows\system32\Jgenbfoa.exe
        239⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        240⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        241⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Knbbep32.exe
        
        C:\Windows\system32\Knbbep32.exe
        242⤵
        Modifies registry class
        
        PID:8012
        
        C:\Windows\SysWOW64\Kqpoakco.exe
        
        C:\Windows\system32\Kqpoakco.exe
        243⤵
        Drops file in System32 directory
        
        PID:8268
        
        C:\Windows\SysWOW64\Kiggbhda.exe
        
        C:\Windows\system32\Kiggbhda.exe
        244⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\Kgjgne32.exe
        
        C:\Windows\system32\Kgjgne32.exe
        245⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Kjhcjq32.exe
        
        C:\Windows\system32\Kjhcjq32.exe
        246⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8512
        
        C:\Windows\SysWOW64\Knflpoqf.exe
        
        C:\Windows\system32\Knflpoqf.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8580
        
        C:\Windows\SysWOW64\Kbbhqn32.exe
        
        C:\Windows\system32\Kbbhqn32.exe
        249⤵
        Modifies registry class
        
        PID:8648
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        250⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Kgamnded.exe
        
        C:\Windows\system32\Kgamnded.exe
        251⤵
        Drops file in System32 directory
        
        PID:8772
        
        C:\Windows\SysWOW64\Knkekn32.exe
        
        C:\Windows\system32\Knkekn32.exe
        252⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Liqihglg.exe
        
        C:\Windows\system32\Liqihglg.exe
        253⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Lbinam32.exe
        
        C:\Windows\system32\Lbinam32.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8992
        
        C:\Windows\SysWOW64\Lgffic32.exe
        
        C:\Windows\system32\Lgffic32.exe
        255⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        256⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Lejgch32.exe
        
        C:\Windows\system32\Lejgch32.exe
        257⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\Lghcocol.exe
        
        C:\Windows\system32\Lghcocol.exe
        258⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Lnbklm32.exe
        
        C:\Windows\system32\Lnbklm32.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8404
        
        C:\Windows\SysWOW64\Lgkpdcmi.exe
        
        C:\Windows\system32\Lgkpdcmi.exe
        260⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        261⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Lbpdblmo.exe
        
        C:\Windows\system32\Lbpdblmo.exe
        262⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        263⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        264⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Mngegmbc.exe
        
        C:\Windows\system32\Mngegmbc.exe
        265⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Maeachag.exe
        
        C:\Windows\system32\Maeachag.exe
        266⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        267⤵
        Drops file in System32 directory
        
        PID:8548
        
        C:\Windows\SysWOW64\Mhoipb32.exe
        
        C:\Windows\system32\Mhoipb32.exe
        268⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Mlkepaam.exe
        
        C:\Windows\system32\Mlkepaam.exe
        269⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8276
        
        C:\Windows\SysWOW64\Mahnhhod.exe
        
        C:\Windows\system32\Mahnhhod.exe
        271⤵
        Drops file in System32 directory
        
        PID:8336
        
        C:\Windows\SysWOW64\Mnlnbl32.exe
        
        C:\Windows\system32\Mnlnbl32.exe
        272⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        273⤵
        Drops file in System32 directory
        
        PID:8252
        
        C:\Windows\SysWOW64\Mhfppabl.exe
        
        C:\Windows\system32\Mhfppabl.exe
        274⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Mldhfpib.exe
        
        C:\Windows\system32\Mldhfpib.exe
        275⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Nbnpcj32.exe
        
        C:\Windows\system32\Nbnpcj32.exe
        276⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9228
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        278⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        279⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Nhmeapmd.exe
        
        C:\Windows\system32\Nhmeapmd.exe
        280⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Nklbmllg.exe
        
        C:\Windows\system32\Nklbmllg.exe
        281⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Nimbkc32.exe
        
        C:\Windows\system32\Nimbkc32.exe
        282⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        283⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Nahgoe32.exe
        
        C:\Windows\system32\Nahgoe32.exe
        284⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9528
        
        C:\Windows\SysWOW64\Nkqkhk32.exe
        
        C:\Windows\system32\Nkqkhk32.exe
        285⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        286⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Nhdlao32.exe
        
        C:\Windows\system32\Nhdlao32.exe
        287⤵
        Drops file in System32 directory
        
        PID:9660
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        288⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Oaompd32.exe
        
        C:\Windows\system32\Oaompd32.exe
        289⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        290⤵
        Modifies registry class
        
        PID:9792
        
        C:\Windows\SysWOW64\Oboijgbl.exe
        
        C:\Windows\system32\Oboijgbl.exe
        291⤵
        Modifies registry class
        
        PID:9836
        
        C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        292⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Oeoblb32.exe
        
        C:\Windows\system32\Oeoblb32.exe
        293⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        294⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Pojcjh32.exe
        
        C:\Windows\system32\Pojcjh32.exe
        295⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Phbhcmjl.exe
        
        C:\Windows\system32\Phbhcmjl.exe
        296⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Pchlpfjb.exe
        
        C:\Windows\system32\Pchlpfjb.exe
        297⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        298⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        299⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10220
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        301⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        302⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Qcclld32.exe
        
        C:\Windows\system32\Qcclld32.exe
        303⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Akoqpg32.exe
        
        C:\Windows\system32\Akoqpg32.exe
        304⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Ajpqnneo.exe
        
        C:\Windows\system32\Ajpqnneo.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9516
        
        C:\Windows\SysWOW64\Aakebqbj.exe
        
        C:\Windows\system32\Aakebqbj.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6708
        
        C:\Windows\SysWOW64\Ajbmdn32.exe
        
        C:\Windows\system32\Ajbmdn32.exe
        307⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        308⤵
        Modifies registry class
        
        PID:2084
        
        C:\Windows\SysWOW64\Abponp32.exe
        
        C:\Windows\system32\Abponp32.exe
        309⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        310⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Aleckinj.exe
        
        C:\Windows\system32\Aleckinj.exe
        311⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Aodogdmn.exe
        
        C:\Windows\system32\Aodogdmn.exe
        312⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Acokhc32.exe
        
        C:\Windows\system32\Acokhc32.exe
        313⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Bohibc32.exe
        
        C:\Windows\system32\Bohibc32.exe
        314⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        315⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        316⤵
        Drops file in System32 directory
        
        PID:10164
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        317⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Bckkca32.exe
        
        C:\Windows\system32\Bckkca32.exe
        318⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Cfigpm32.exe
        
        C:\Windows\system32\Cfigpm32.exe
        319⤵
        Drops file in System32 directory
        
        PID:9368
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9468
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        321⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        322⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        323⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Ccpdoqgd.exe
        
        C:\Windows\system32\Ccpdoqgd.exe
        324⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        325⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        326⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        327⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Ciafbg32.exe
        
        C:\Windows\system32\Ciafbg32.exe
        328⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        329⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        330⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\Djqblj32.exe
        
        C:\Windows\system32\Djqblj32.exe
        331⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\Dblgpl32.exe
        
        C:\Windows\system32\Dblgpl32.exe
        332⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        333⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        334⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        335⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9480
        
        C:\Windows\SysWOW64\Dfjpfj32.exe
        
        C:\Windows\system32\Dfjpfj32.exe
        337⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\Dihlbf32.exe
        
        C:\Windows\system32\Dihlbf32.exe
        338⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Dlghoa32.exe
        
        C:\Windows\system32\Dlghoa32.exe
        339⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        340⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9300
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        341⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        342⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        343⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        344⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        345⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        346⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        347⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10328
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        349⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        350⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        351⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        352⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        353⤵
        Drops file in System32 directory
        
        PID:10552
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        354⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        355⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        356⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Fdccbl32.exe
        
        C:\Windows\system32\Fdccbl32.exe
        357⤵
        Modifies registry class
        
        PID:10716
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        358⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Fibhpbea.exe
        
        C:\Windows\system32\Fibhpbea.exe
        359⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        360⤵
        
        PID:10840
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        361⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        362⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        363⤵
        Modifies registry class
        
        PID:10964
        
        C:\Windows\SysWOW64\Gljgbllj.exe
        
        C:\Windows\system32\Gljgbllj.exe
        364⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        365⤵
        Modifies registry class
        
        PID:11052
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        366⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        367⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        368⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        369⤵
        Drops file in System32 directory
        
        PID:11224
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        370⤵
        Drops file in System32 directory
        
        PID:10120
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        371⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        372⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        373⤵
        Drops file in System32 directory
        
        PID:10452
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        374⤵
        
        PID:10516
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        375⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        376⤵
        
        PID:10660
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        377⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        378⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        379⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Ilccoh32.exe
        
        C:\Windows\system32\Ilccoh32.exe
        380⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        381⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        382⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        383⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11152
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        384⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Jqknkedi.exe
        
        C:\Windows\system32\Jqknkedi.exe
        385⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        386⤵
        
        PID:10384
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        387⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        388⤵
        Drops file in System32 directory
        
        PID:10644
        
        C:\Windows\SysWOW64\Kcndbp32.exe
        
        C:\Windows\system32\Kcndbp32.exe
        389⤵
        
        PID:10796
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        390⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        391⤵
        
        PID:10972
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        392⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        393⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        394⤵
        Drops file in System32 directory
        
        PID:9416
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        395⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        396⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        397⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        398⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        399⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        400⤵
        Drops file in System32 directory
        
        PID:11236
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        401⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        402⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        403⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11204
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        404⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        405⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10956
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        406⤵
        
        PID:10352
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        407⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        408⤵
        Modifies registry class
        
        PID:10504
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        409⤵
        Modifies registry class
        
        PID:11300
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        410⤵
        
        PID:11344
        
        C:\Windows\SysWOW64\Ncabfkqo.exe
        
        C:\Windows\system32\Ncabfkqo.exe
        411⤵
        
        PID:11384
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        412⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        413⤵
        Drops file in System32 directory
        
        PID:11464
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        414⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        415⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\Ohfami32.exe
        
        C:\Windows\system32\Ohfami32.exe
        416⤵
        
        PID:11624
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        417⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        418⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Ojgjndno.exe
        
        C:\Windows\system32\Ojgjndno.exe
        419⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        420⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        421⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        422⤵
        
        PID:11888
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        423⤵
        
        PID:11936
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        424⤵
        
        PID:11976
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        425⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        426⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        427⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        428⤵
        Modifies registry class
        
        PID:12148
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        429⤵
        
        PID:12196
        
        C:\Windows\SysWOW64\Pajeam32.exe
        
        C:\Windows\system32\Pajeam32.exe
        430⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12240
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        431⤵
        Drops file in System32 directory
        
        PID:12276
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        432⤵
        
        PID:11292
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        433⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        434⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        435⤵
        
        PID:11504
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11564
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        437⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        438⤵
        Modifies registry class
        
        PID:11724
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        439⤵
        Modifies registry class
        
        PID:11796
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        440⤵
        
        PID:11884
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        441⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        442⤵
        
        PID:12000
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        443⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        444⤵
        Modifies registry class
        
        PID:12160
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        445⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        446⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10572
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        447⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        448⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        449⤵
        
        PID:11620
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        450⤵
        
        PID:11712
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        451⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        452⤵
        Drops file in System32 directory
        
        PID:2820
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3336
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        454⤵
        
        PID:3516
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        455⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        456⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11268
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        457⤵
        
        PID:11420
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        458⤵
        
        PID:11560
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        459⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        460⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        461⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        462⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        463⤵
        Modifies registry class
        
        PID:2272
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        464⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        465⤵
        
        PID:11612
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        466⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        467⤵
        
        PID:440
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        468⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        469⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        470⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        471⤵
        Modifies registry class
        
        PID:1548
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        472⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        473⤵
        
        PID:11768
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        474⤵
        
        PID:3640
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        475⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2492
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        476⤵
        
        PID:3260
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        477⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        478⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        479⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        480⤵
        
        PID:2456
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        481⤵
        
        PID:368
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        482⤵
        Drops file in System32 directory
        
        PID:3248
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        483⤵
        Drops file in System32 directory
        
        PID:3468
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        484⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        485⤵
        
        PID:456
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        486⤵
        Modifies registry class
        
        PID:3564
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        487⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\Ebnfbcbc.exe
        
        C:\Windows\system32\Ebnfbcbc.exe
        488⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        489⤵
        
        PID:11876
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        490⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3652
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        491⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        492⤵
        
        PID:2708
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        493⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4832
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        494⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3948
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        495⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        496⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4844
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        497⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        498⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        499⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        500⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        501⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1284
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        502⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        503⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        504⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        505⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        506⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        507⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        508⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        509⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        510⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        511⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        512⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        513⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        514⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5240
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        515⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        516⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        517⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        518⤵
        Modifies registry class
        
        PID:5432
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        519⤵
        Drops file in System32 directory
        
        PID:5160
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        520⤵
        
        PID:12048
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        521⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        522⤵
        
        PID:4000
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        523⤵
        Modifies registry class
        
        PID:12296
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        524⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12348
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        525⤵
        
        PID:12396
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        526⤵
        
        PID:12448
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        527⤵
        
        PID:12492
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        528⤵
        
        PID:12540
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        529⤵
        
        PID:12584
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        530⤵
        
        PID:12628
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        531⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12696
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        532⤵
        
        PID:12736
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        533⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12788
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        534⤵
        
        PID:12828
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        535⤵
        
        PID:12896
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        536⤵
        
        PID:12940
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        537⤵
        
        PID:12984
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        538⤵
        Drops file in System32 directory
        
        PID:13024
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        539⤵
        
        PID:13084
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        540⤵
        
        PID:13132
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        541⤵
        
        PID:13180
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        542⤵
        
        PID:13220
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        543⤵
        
        PID:13268
        
        C:\Windows\SysWOW64\Jpaekqhh.exe
        
        C:\Windows\system32\Jpaekqhh.exe
        544⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        545⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        546⤵
        
        PID:12340
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        547⤵
        
        PID:12408
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        548⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        549⤵
        Modifies registry class
        
        PID:12520
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        550⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12580
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        551⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        552⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12656
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        553⤵
        
        PID:12712
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        554⤵
        
        PID:12776
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        555⤵
        
        PID:12836
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        556⤵
        
        PID:12908
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        557⤵
        
        PID:12996
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        558⤵
        
        PID:13040
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        559⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        560⤵
        
        PID:13112
        
        C:\Windows\SysWOW64\Klhnfo32.exe
        
        C:\Windows\system32\Klhnfo32.exe
        561⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        562⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        563⤵
        
        PID:13296
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        564⤵
        Modifies registry class
        
        PID:5332
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        565⤵
        
        PID:12384
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        566⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        567⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        568⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        569⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6092
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        570⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        571⤵
        Drops file in System32 directory
        
        PID:12676
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        572⤵
        
        PID:12744
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        573⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        574⤵
        
        PID:12804
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        575⤵
        
        PID:12920
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        576⤵
        
        PID:12992
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        577⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        578⤵
        
        PID:13140
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        579⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        580⤵
        
        PID:13212
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        581⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        582⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        583⤵
        
        PID:12332
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        584⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        585⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        586⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        587⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        588⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        589⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        590⤵
        
        PID:12884
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        591⤵
        Modifies registry class
        
        PID:12872
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        592⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5324
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        593⤵
        Modifies registry class
        
        PID:5908
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        594⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        595⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        596⤵
        
        PID:13208
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        597⤵
        
        PID:13256
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        598⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        599⤵
        
        PID:12344
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        600⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        601⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5616
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        602⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        603⤵
        Modifies registry class
        
        PID:5900
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        604⤵
        
        PID:12860
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        605⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        606⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        607⤵
        
        PID:12980
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        608⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        609⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        610⤵
        Modifies registry class
        
        PID:6228
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        611⤵
        
        PID:13204
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        612⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        613⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5684
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        614⤵
        Drops file in System32 directory
        
        PID:5396
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        615⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        616⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        617⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        618⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        619⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        620⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        621⤵
        
        PID:12600
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        622⤵
        
        PID:12760
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        623⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        624⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        625⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        626⤵
        Drops file in System32 directory
        
        PID:5768
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        627⤵
        Drops file in System32 directory
        
        PID:6860
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        628⤵
        Modifies registry class
        
        PID:5500
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        629⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        630⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        631⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        632⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        633⤵
        Modifies registry class
        
        PID:6748
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        634⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        635⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        636⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        637⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        638⤵
        Drops file in System32 directory
        
        PID:7112
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        639⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        640⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        641⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4904
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        642⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        643⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        644⤵
        Drops file in System32 directory
        
        PID:6416
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        645⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        646⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Dglkoeio.exe
        
        C:\Windows\system32\Dglkoeio.exe
        647⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        648⤵
        
        PID:13160
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        649⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        650⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        651⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        652⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        653⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        654⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        655⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        656⤵
        
        PID:12568
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        657⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Fganqbgg.exe
        
        C:\Windows\system32\Fganqbgg.exe
        658⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        659⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        660⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        661⤵
        
        PID:540
        
        C:\Windows\SysWOW64\Ggfglb32.exe
        
        C:\Windows\system32\Ggfglb32.exe
        662⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        663⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        664⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        665⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        666⤵
        
        PID:748
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        667⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        668⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        669⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        670⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        671⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        672⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        673⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        674⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        675⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        676⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        677⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        678⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        679⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        680⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        681⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Ieojgc32.exe
        
        C:\Windows\system32\Ieojgc32.exe
        682⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        683⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Ihpcinld.exe
        
        C:\Windows\system32\Ihpcinld.exe
        684⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        685⤵
        
        PID:12720
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        686⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        687⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        688⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        689⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        690⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        691⤵
        Modifies registry class
        
        PID:7132
        
        C:\Windows\SysWOW64\Jbojlfdp.exe
        
        C:\Windows\system32\Jbojlfdp.exe
        692⤵
        Modifies registry class
        
        PID:7680
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        693⤵
        
        PID:816
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        694⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        695⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        696⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        697⤵
        Drops file in System32 directory
        
        PID:7200
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        698⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        699⤵
        Modifies registry class
        
        PID:13308
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        700⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8136
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        701⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        702⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        703⤵
        Modifies registry class
        
        PID:6740
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        704⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        705⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Kcmfnd32.exe
        
        C:\Windows\system32\Kcmfnd32.exe
        706⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Kifojnol.exe
        
        C:\Windows\system32\Kifojnol.exe
        707⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        708⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        709⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        710⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        711⤵
        Drops file in System32 directory
        
        PID:3728
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        712⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        713⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        714⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        715⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        716⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        717⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Mfpell32.exe
        
        C:\Windows\system32\Mfpell32.exe
        718⤵
        Drops file in System32 directory
        
        PID:7308
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        719⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        720⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        721⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Nmaciefp.exe
        
        C:\Windows\system32\Nmaciefp.exe
        722⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        723⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        724⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        725⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7380
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        726⤵
        
        PID:8912
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        727⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        728⤵
        
        PID:316
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        729⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        730⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        731⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        732⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Nqfbpb32.exe
        
        C:\Windows\system32\Nqfbpb32.exe
        733⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        734⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        735⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        736⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\Ojcpdg32.exe
        
        C:\Windows\system32\Ojcpdg32.exe
        737⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8512
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        738⤵
        Modifies registry class
        
        PID:8736
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        739⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        740⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        741⤵
        Drops file in System32 directory
        
        PID:8436
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        742⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        743⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        744⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        745⤵
        Modifies registry class
        
        PID:9212
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        746⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        747⤵
        Modifies registry class
        
        PID:2880
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        748⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        749⤵
        Drops file in System32 directory
        
        PID:8676
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        750⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        751⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7432
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        752⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        753⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Qclmck32.exe
        
        C:\Windows\system32\Qclmck32.exe
        754⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Qfjjpf32.exe
        
        C:\Windows\system32\Qfjjpf32.exe
        755⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Qjffpe32.exe
        
        C:\Windows\system32\Qjffpe32.exe
        756⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7896
        
        C:\Windows\SysWOW64\Qapnmopa.exe
        
        C:\Windows\system32\Qapnmopa.exe
        757⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Qpbnhl32.exe
        
        C:\Windows\system32\Qpbnhl32.exe
        758⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        759⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Qikbaaml.exe
        
        C:\Windows\system32\Qikbaaml.exe
        760⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Ajjokd32.exe
        
        C:\Windows\system32\Ajjokd32.exe
        761⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Amikgpcc.exe
        
        C:\Windows\system32\Amikgpcc.exe
        762⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\Aadghn32.exe
        
        C:\Windows\system32\Aadghn32.exe
        763⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Acccdj32.exe
        
        C:\Windows\system32\Acccdj32.exe
        764⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Abfdpfaj.exe
        
        C:\Windows\system32\Abfdpfaj.exe
        765⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Afappe32.exe
        
        C:\Windows\system32\Afappe32.exe
        766⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Ajmladbl.exe
        
        C:\Windows\system32\Ajmladbl.exe
        767⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Aagdnn32.exe
        
        C:\Windows\system32\Aagdnn32.exe
        768⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Ajohfcpj.exe
        
        C:\Windows\system32\Ajohfcpj.exe
        769⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Aplaoj32.exe
        
        C:\Windows\system32\Aplaoj32.exe
        770⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\Adgmoigj.exe
        
        C:\Windows\system32\Adgmoigj.exe
        771⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Affikdfn.exe
        
        C:\Windows\system32\Affikdfn.exe
        772⤵
        Modifies registry class
        
        PID:9620
        
        C:\Windows\SysWOW64\Ampaho32.exe
        
        C:\Windows\system32\Ampaho32.exe
        773⤵
        Modifies registry class
        
        PID:7436
        
        C:\Windows\SysWOW64\Apnndj32.exe
        
        C:\Windows\system32\Apnndj32.exe
        774⤵
        Drops file in System32 directory
        
        PID:9064
        
        C:\Windows\SysWOW64\Abmjqe32.exe
        
        C:\Windows\system32\Abmjqe32.exe
        775⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8948
        
        C:\Windows\SysWOW64\Bigbmpco.exe
        
        C:\Windows\system32\Bigbmpco.exe
        776⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Bdlfjh32.exe
        
        C:\Windows\system32\Bdlfjh32.exe
        777⤵
        Drops file in System32 directory
        
        PID:6964
        
        C:\Windows\SysWOW64\Bjfogbjb.exe
        
        C:\Windows\system32\Bjfogbjb.exe
        778⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Bmdkcnie.exe
        
        C:\Windows\system32\Bmdkcnie.exe
        779⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Bbaclegm.exe
        
        C:\Windows\system32\Bbaclegm.exe
        780⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Biklho32.exe
        
        C:\Windows\system32\Biklho32.exe
        781⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Bmggingc.exe
        
        C:\Windows\system32\Bmggingc.exe
        782⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Bkkhbb32.exe
        
        C:\Windows\system32\Bkkhbb32.exe
        783⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Bipecnkd.exe
        
        C:\Windows\system32\Bipecnkd.exe
        784⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Bmladm32.exe
        
        C:\Windows\system32\Bmladm32.exe
        785⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Bpjmph32.exe
        
        C:\Windows\system32\Bpjmph32.exe
        786⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Bdeiqgkj.exe
        
        C:\Windows\system32\Bdeiqgkj.exe
        787⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Bgdemb32.exe
        
        C:\Windows\system32\Bgdemb32.exe
        788⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Cajjjk32.exe
        
        C:\Windows\system32\Cajjjk32.exe
        789⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Ccmcgcmp.exe
        
        C:\Windows\system32\Ccmcgcmp.exe
        790⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Ckdkhq32.exe
        
        C:\Windows\system32\Ckdkhq32.exe
        791⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Cmbgdl32.exe
        
        C:\Windows\system32\Cmbgdl32.exe
        792⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Cgklmacf.exe
        
        C:\Windows\system32\Cgklmacf.exe
        793⤵
        Drops file in System32 directory
        
        PID:2128
        
        C:\Windows\SysWOW64\Ckggnp32.exe
        
        C:\Windows\system32\Ckggnp32.exe
        794⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Ckidcpjl.exe
        
        C:\Windows\system32\Ckidcpjl.exe
        795⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Cdaile32.exe
        
        C:\Windows\system32\Cdaile32.exe
        796⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Daeifj32.exe
        
        C:\Windows\system32\Daeifj32.exe
        797⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7856
        
        C:\Windows\SysWOW64\Dnljkk32.exe
        
        C:\Windows\system32\Dnljkk32.exe
        798⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8516
        
        C:\Windows\SysWOW64\Dcibca32.exe
        
        C:\Windows\system32\Dcibca32.exe
        799⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Dnngpj32.exe
        
        C:\Windows\system32\Dnngpj32.exe
        800⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Ddhomdje.exe
        
        C:\Windows\system32\Ddhomdje.exe
        801⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\Dkbgjo32.exe
        
        C:\Windows\system32\Dkbgjo32.exe
        802⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Dnqcfjae.exe
        
        C:\Windows\system32\Dnqcfjae.exe
        803⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Dalofi32.exe
        
        C:\Windows\system32\Dalofi32.exe
        804⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Djgdkk32.exe
        
        C:\Windows\system32\Djgdkk32.exe
        805⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Dpalgenf.exe
        
        C:\Windows\system32\Dpalgenf.exe
        806⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Enemaimp.exe
        
        C:\Windows\system32\Enemaimp.exe
        807⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Egpnooan.exe
        
        C:\Windows\system32\Egpnooan.exe
        808⤵
        Drops file in System32 directory
        
        PID:9920
        
        C:\Windows\SysWOW64\Ephbhd32.exe
        
        C:\Windows\system32\Ephbhd32.exe
        809⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Ecgodpgb.exe
        
        C:\Windows\system32\Ecgodpgb.exe
        810⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Enlcahgh.exe
        
        C:\Windows\system32\Enlcahgh.exe
        811⤵
        Drops file in System32 directory
        
        PID:9432
        
        C:\Windows\SysWOW64\Eqkondfl.exe
        
        C:\Windows\system32\Eqkondfl.exe
        812⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Fkcpql32.exe
        
        C:\Windows\system32\Fkcpql32.exe
        813⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Fcneeo32.exe
        
        C:\Windows\system32\Fcneeo32.exe
        814⤵
        Drops file in System32 directory
        
        PID:8300
        
        C:\Windows\SysWOW64\Fncibg32.exe
        
        C:\Windows\system32\Fncibg32.exe
        815⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Fboecfii.exe
        
        C:\Windows\system32\Fboecfii.exe
        816⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Fdmaoahm.exe
        
        C:\Windows\system32\Fdmaoahm.exe
        817⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Fnffhgon.exe
        
        C:\Windows\system32\Fnffhgon.exe
        818⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Fdpnda32.exe
        
        C:\Windows\system32\Fdpnda32.exe
        819⤵
        Drops file in System32 directory
        
        PID:9436
        
        C:\Windows\SysWOW64\Fcbnpnme.exe
        
        C:\Windows\system32\Fcbnpnme.exe
        820⤵
        Drops file in System32 directory
        
        PID:9668
        
        C:\Windows\SysWOW64\Fbdnne32.exe
        
        C:\Windows\system32\Fbdnne32.exe
        821⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Fcekfnkb.exe
        
        C:\Windows\system32\Fcekfnkb.exe
        822⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Fnjocf32.exe
        
        C:\Windows\system32\Fnjocf32.exe
        823⤵
        Drops file in System32 directory
        
        PID:9816
        
        C:\Windows\SysWOW64\Fbfkceca.exe
        
        C:\Windows\system32\Fbfkceca.exe
        824⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Ggccllai.exe
        
        C:\Windows\system32\Ggccllai.exe
        825⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Gqkhda32.exe
        
        C:\Windows\system32\Gqkhda32.exe
        826⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Gdgdeppb.exe
        
        C:\Windows\system32\Gdgdeppb.exe
        827⤵
        Modifies registry class
        
        PID:9344
        
        C:\Windows\SysWOW64\Ggepalof.exe
        
        C:\Windows\system32\Ggepalof.exe
        828⤵
        Drops file in System32 directory
        
        PID:8504
        
        C:\Windows\SysWOW64\Gnohnffc.exe
        
        C:\Windows\system32\Gnohnffc.exe
        829⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Gclafmej.exe
        
        C:\Windows\system32\Gclafmej.exe
        830⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\Gcnnllcg.exe
        
        C:\Windows\system32\Gcnnllcg.exe
        831⤵
        Modifies registry class
        
        PID:10184
        
        C:\Windows\SysWOW64\Gkefmjcj.exe
        
        C:\Windows\system32\Gkefmjcj.exe
        832⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Gndbie32.exe
        
        C:\Windows\system32\Gndbie32.exe
        833⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Gqbneq32.exe
        
        C:\Windows\system32\Gqbneq32.exe
        834⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Gkhbbi32.exe
        
        C:\Windows\system32\Gkhbbi32.exe
        835⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Gnfooe32.exe
        
        C:\Windows\system32\Gnfooe32.exe
        836⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Gbbkocid.exe
        
        C:\Windows\system32\Gbbkocid.exe
        837⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Hepgkohh.exe
        
        C:\Windows\system32\Hepgkohh.exe
        838⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Hccggl32.exe
        
        C:\Windows\system32\Hccggl32.exe
        839⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Hkjohi32.exe
        
        C:\Windows\system32\Hkjohi32.exe
        840⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\Hbdgec32.exe
        
        C:\Windows\system32\Hbdgec32.exe
        841⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Hebcao32.exe
        
        C:\Windows\system32\Hebcao32.exe
        842⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Hnkhjdle.exe
        
        C:\Windows\system32\Hnkhjdle.exe
        843⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Haidfpki.exe
        
        C:\Windows\system32\Haidfpki.exe
        844⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Halaloif.exe
        
        C:\Windows\system32\Halaloif.exe
        845⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Hkaeih32.exe
        
        C:\Windows\system32\Hkaeih32.exe
        846⤵
        Drops file in System32 directory
        
        PID:9224
        
        C:\Windows\SysWOW64\Hcljmj32.exe
        
        C:\Windows\system32\Hcljmj32.exe
        847⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\Hnbnjc32.exe
        
        C:\Windows\system32\Hnbnjc32.exe
        848⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\Ielfgmnj.exe
        
        C:\Windows\system32\Ielfgmnj.exe
        849⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10600
        
        C:\Windows\SysWOW64\Ijiopd32.exe
        
        C:\Windows\system32\Ijiopd32.exe
        850⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Iabglnco.exe
        
        C:\Windows\system32\Iabglnco.exe
        851⤵
        Drops file in System32 directory
        
        PID:10588
        
        C:\Windows\SysWOW64\Igmoih32.exe
        
        C:\Windows\system32\Igmoih32.exe
        852⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Ibbcfa32.exe
        
        C:\Windows\system32\Ibbcfa32.exe
        853⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Iaedanal.exe
        
        C:\Windows\system32\Iaedanal.exe
        854⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Ieqpbm32.exe
        
        C:\Windows\system32\Ieqpbm32.exe
        855⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Iholohii.exe
        
        C:\Windows\system32\Iholohii.exe
        856⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Ijmhkchl.exe
        
        C:\Windows\system32\Ijmhkchl.exe
        857⤵
        Modifies registry class
        
        PID:8660
        
        C:\Windows\SysWOW64\Inidkb32.exe
        
        C:\Windows\system32\Inidkb32.exe
        858⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Iecmhlhb.exe
        
        C:\Windows\system32\Iecmhlhb.exe
        859⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Ihaidhgf.exe
        
        C:\Windows\system32\Ihaidhgf.exe
        860⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Ijpepcfj.exe
        
        C:\Windows\system32\Ijpepcfj.exe
        861⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Iajmmm32.exe
        
        C:\Windows\system32\Iajmmm32.exe
        862⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Jaljbmkd.exe
        
        C:\Windows\system32\Jaljbmkd.exe
        863⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Jjdokb32.exe
        
        C:\Windows\system32\Jjdokb32.exe
        864⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Jejbhk32.exe
        
        C:\Windows\system32\Jejbhk32.exe
        865⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Jnbgaa32.exe
        
        C:\Windows\system32\Jnbgaa32.exe
        866⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Jjkdlall.exe
        
        C:\Windows\system32\Jjkdlall.exe
        867⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Kahinkaf.exe
        
        C:\Windows\system32\Kahinkaf.exe
        868⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11096
        
        C:\Windows\SysWOW64\Klmnkdal.exe
        
        C:\Windows\system32\Klmnkdal.exe
        869⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Kkpnga32.exe
        
        C:\Windows\system32\Kkpnga32.exe
        870⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Kbgfhnhi.exe
        
        C:\Windows\system32\Kbgfhnhi.exe
        871⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Kajfdk32.exe
        
        C:\Windows\system32\Kajfdk32.exe
        872⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Khdoqefq.exe
        
        C:\Windows\system32\Khdoqefq.exe
        873⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Kongmo32.exe
        
        C:\Windows\system32\Kongmo32.exe
        874⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Klbgfc32.exe
        
        C:\Windows\system32\Klbgfc32.exe
        875⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Kkgdhp32.exe
        
        C:\Windows\system32\Kkgdhp32.exe
        876⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Lkiamp32.exe
        
        C:\Windows\system32\Lkiamp32.exe
        877⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Ldbefe32.exe
        
        C:\Windows\system32\Ldbefe32.exe
        878⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Leabphmp.exe
        
        C:\Windows\system32\Leabphmp.exe
        879⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Lbebilli.exe
        
        C:\Windows\system32\Lbebilli.exe
        880⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5976
        
        C:\Windows\SysWOW64\Ledoegkm.exe
        
        C:\Windows\system32\Ledoegkm.exe
        881⤵
        Modifies registry class
        
        PID:10360
        
        C:\Windows\SysWOW64\Lkqgno32.exe
        
        C:\Windows\system32\Lkqgno32.exe
        882⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Lajokiaa.exe
        
        C:\Windows\system32\Lajokiaa.exe
        883⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Ldikgdpe.exe
        
        C:\Windows\system32\Ldikgdpe.exe
        884⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9848 -s 420
        885⤵
        Program crash
        
        PID:10948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=3408,i,16599691418790971742,134777455365707676,262144 --variations-seed-version /prefetch:8
1⤵
PID:8144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 9848 -ip 9848
1⤵
PID:10320

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aadifclh.exe

Filesize
72KB

MD5
bbe0cf16baa7578616b561e384c2e5db

SHA1
29933a44ac8ab2cb72044614f75afdbcaafb905d

SHA256
1682c05fceb83f68b00019001633f95f002aa8cea3c0741f46121c96ef9eef64

SHA512
a3859df228253834e88728d6704a1ec0bbd43679b73f607ecc178685326bd6a0c3cd9707c2fc2fb76a50dc55e9b8decbaec5ac24e856d7c498a3fc9ed4e80097

Download Submit
C:\Windows\SysWOW64\Aajohjon.exe

Filesize
64KB

MD5
8b6f704b7a94e174e3e441395ac2ce25

SHA1
4fab937fc07823970db8dd8e3fcda53f9e6dd643

SHA256
5e955dfe24ece4cd68c1654f43fc6983cb1e70d0f980392ddd6742e828507f42

SHA512
fd0ef514cdde1c319d489fbc57559e874016d6090c5a6b72711a79ae9bda8b3d8637a4bc546c9c32e7d9b016ee9b5a6e76749faa3d4070908b28a19a2e067437

Download Submit
C:\Windows\SysWOW64\Ackigjmh.exe

Filesize
72KB

MD5
85034125d8dd4875c0734efbc8bd22b2

SHA1
1c026dcdb932becb2a27c16d9804ba46832f2758

SHA256
b1bd87d51daa16134a6e0d2d0577bc28d9aa30d8579b06d1d3a5fd7188785a1b

SHA512
c233caa7b4144d2efefdcbccfbc2b9a03ea0b3f4621fee960bf7ce5b72138a328a74a8fc6086334372b5f42d4c4bba140414693ae23219916fba5c34e6d8fbf7

Download Submit
C:\Windows\SysWOW64\Acokhc32.exe

Filesize
72KB

MD5
33aedd406ed054fff3f273fe6610647c

SHA1
527d1b5d02882f41e8de72b575f67259cb6c7326

SHA256
fc95d6ac26deda78556711e607d257489ccb24b5eedeb692d54861a9216636d6

SHA512
68cde3e83d39e403ee4066f469c7b925bc8604abfc652aa05836254ea3a854431b6db31a476a791956cd7030470ff21ae3ff6d3e095728ca1570863296a29ee3

Download Submit
C:\Windows\SysWOW64\Aeniabfd.exe

Filesize
72KB

MD5
66398b87e8c9a6c3a754d81f046e25f5

SHA1
a3ff58e537d3b8880ead65f87bdf07c9fc5d9e27

SHA256
99b5863debdb3b1b7a6cb8b24ea6b3d2c301dc34af66600dc42e51f1a9f75405

SHA512
8d0433ad26fdfa7be80b6e2979bf68f712af060aa2f2f59a158f1213b23c6e1dad12ba60ea3c9616d834c6d747379d653da713039d6587b859a62a97d6ead0f1

Download Submit
C:\Windows\SysWOW64\Afjlnk32.exe

Filesize
72KB

MD5
63eea18bf9fc8fea147e8fc8d69f3ab2

SHA1
ea224e89be1cc3442f2ef9136bc1bd877f161731

SHA256
b1a9d5de8eb8974e6f5d73d703f1def333960b4068d5f0a0cdfac4976467d7ea

SHA512
6fe2c318633ab3af38bb8f9402dbe806fb8170e8284e67b28b727b10964b3941a95ea860d2356c16dc2cb45e0e15d99ca3a1e02e075e1d0fd2f39c63c4085aea

Download Submit
C:\Windows\SysWOW64\Afoeiklb.exe

Filesize
72KB

MD5
651e1b4e0d1acfd5a66664c292b2b51b

SHA1
0af27c6019bd4e4b3bca244ba8528ff52f7f9713

SHA256
2c41dbd95118b59e260bca1f43bc23a44a51104429f27184e4d290603c194f1c

SHA512
15cb540737022e57fdfda80bd69a9f55f3e9f2270236c392b9013ec92e3e828602d29c7f6b8bc1b377c292d189b90ebaab2411b33a3afbb95fcbf86e81c205ad

Download Submit
C:\Windows\SysWOW64\Agjhgngj.exe

Filesize
72KB

MD5
0b90201fcde43fcfd05efc9bb3a6edb8

SHA1
78ccfc15d23e35d5c38076563babc9a1117210e7

SHA256
2c747ca18f4e9cef22609891a776b03aee0d753b58154a47059ebb4fc84d5f45

SHA512
a4d62bad847f9cf049bf65959b509c4c83cdfacde645829b457a0a97c0a4271830188e147a1c8abb71fcb95cd507570e6dbfdf5a2716241b2e44ec941be194b3

Download Submit
C:\Windows\SysWOW64\Andqdh32.exe

Filesize
72KB

MD5
04e9c64f8f1417c032cabe04157d4381

SHA1
2e6d11ae4fff8766ad0e2d3bd08cd2c0ca20c415

SHA256
ce9e753b7a5107dd04a4a8b6b6acac90436a8a0636a0aebc524a4957f415be9a

SHA512
e637ea9f0d66549a0e910fa8369fac363cfe0c14b793631806eeefbfafa6abb1ed494c5f037312446649cf39eed1d814e6495b6487f9659205651c137468aace

Download Submit
C:\Windows\SysWOW64\Bcoenmao.exe

Filesize
72KB

MD5
1ac66b8b33764e08cb0ff1cad74c2ace

SHA1
3fb2bef344119bc97fad644dc7125e10f1257656

SHA256
54fb496742e0e3633620cf5dcf8a8250cd313bc0e438e9b127b329199715ca4c

SHA512
f3cca56f934ca924c60d45f04329421edd31e14b1170132371563f75960a656cf7e0d77da7b18459931749fdfd7fba00395b82418ab02b3536fcf6c663d320b8

Download Submit
C:\Windows\SysWOW64\Bebblb32.exe

Filesize
72KB

MD5
cf2ed11d3426d1f2c1b802c95154c902

SHA1
9699b53f93b8f9ee54f83a5232b90cc38d0dfb9f

SHA256
9633b8cf12f016a8bad37f8cedaa9a7205d8901709d3bd415cc90637fd045bfd

SHA512
7a68db945d87de872863ef3c92618e66fdf0b2bd853d73f45ad69d14c88738331e7491d02fad54f88c41a2cf4eb244859a1f9a7d7fb3e39a28dee506f6b0e3a8

Download Submit
C:\Windows\SysWOW64\Beihma32.exe

Filesize
72KB

MD5
c76dd37d11240b5661012ef678e2f19c

SHA1
484f93775b60fbf0fbf73e26a8185c5134674af4

SHA256
e394b49cb788c8f080c04a724759891449b1f864f0b5bd2067dac1cc4afb0970

SHA512
53093e8a0b68b1e224cd5cde485e162bdec0f3e4fc2bae885de71b3bcce1fbe2de38fc110c428ac2a5e6e26605706aaaba2931dbd1702ed7bf21c2b5b995dcc6

Download Submit
C:\Windows\SysWOW64\Bfedoc32.exe

Filesize
72KB

MD5
87cf530cd1e2bbec3fdb684a717e7451

SHA1
d2238b0399983f7043b52e6b8ee84aa4ef0d0732

SHA256
15f1d298fa8b0ff26b19371e9553049e5a3a20b6e43a0adbd9a5cdc9fdf4e107

SHA512
8cf3202d2b0f4a9b785d42e4a34df6ae2fce970808f781f24dfac7f3d981714f11d588f08a1d394834a90f2dc5f4a5c661f1e0dc0d2a9939637544c340ddd75f

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
72KB

MD5
642e5e5158d84efa31bd62f22f0072c7

SHA1
914af7c8f6f7bb4876507be691e789ed8201a5d5

SHA256
27af86ed9bbabd51978354e928e803d7ebb600e6dcd11c696ae0a26767a706bf

SHA512
5a45255565c5a75c2a0ba35dd8899dd148dc8166d3e84a10aa8334d25e2bbada26fd13846d600557fab4ae2a338fff60fa97e335a6dcefaa4268eb17f915faff

Download Submit
C:\Windows\SysWOW64\Bjokdipf.exe

Filesize
72KB

MD5
deddc6bc916c9b9680ea720b47963fc2

SHA1
3d787cc72a80749e59b589c77924713b01fa29e4

SHA256
beb85ce99b255392a9e5c0162ceb6420316eff1bb154ff1ba8aff0e4b1d6da61

SHA512
7cacbc7d293194b9fe8ed143f2538e248584a01ba061a842af13929664de5a061a4c5490fee96bf38daccac12c70dc8c2908a48b5a7dd7f69831b95f1c52a94b

Download Submit
C:\Windows\SysWOW64\Bkjpmk32.dll

Filesize
7KB

MD5
b65f02033c1745b0c2bf3f2e291f14db

SHA1
3270f9fd7b343c04c56359173159742a45e8cff0

SHA256
f9a9eaae39b5d701882b1fed63640a571e25987ac39eae308de55755c73b7de3

SHA512
0157d6c862d544a587a84591411a8477a2890d1c856f97f9e8987030d49f439b5d2c9404ef7177622c4081e92c03de2ac2b6927ef0f6f55c90f19f4c37113aaa

Download Submit
C:\Windows\SysWOW64\Bnbmefbg.exe

Filesize
72KB

MD5
7820bf03583247a0aae5aa7d7f430cfb

SHA1
10b4ba16d6ac2330c1ef52871a31390e87c9dbc2

SHA256
121dbcb968153e8fa818149e2fa4ed14fecafd40813e63d47878d115d7c3f148

SHA512
e7208e72208176c42da1cc408ef1a8274097bb05b9d2370fc5fc8646455c1e61c944c3e0dacd288d197bcbbc3f72fae3a88a83bb894f88ae03f0f8ff5bd5257d

Download Submit
C:\Windows\SysWOW64\Bnhjohkb.exe

Filesize
72KB

MD5
fa998d25141064d3c9a8bd7c60d460c4

SHA1
f4a472fb125c7e052c9cedbf8e3475274e999695

SHA256
be84f20f15a09371b4fb216a0791a347a524fd32fba7f80ad7c792ed16357f5e

SHA512
00bf83eff45c5d9372e7a498305ff40408d48ba2728feebd67c9faa1e58d412d90f61562d68760f4d485472a51d217fa19d63402290f4c95ca307b5efc176540

Download Submit
C:\Windows\SysWOW64\Bnmcjg32.exe

Filesize
72KB

MD5
29b462120fe2eadcc2da99606df7a825

SHA1
1acb2ef90479cf4bd0ec66aee60ed80e33bb2d69

SHA256
fc6088395983554e39ccf5a81f69d49c0838c43589a1bb154a0f5727f2fb76f7

SHA512
4d775e7a6adb9fc51ab584fd06d65f7550102823ae51ee21eb0f49153d871ec28ddffa68cd7e068bb20d1d2a5a0a64f558ed6f5d35897e997a5f5ad353c43dfd

Download Submit
C:\Windows\SysWOW64\Cagobalc.exe

Filesize
72KB

MD5
2d924123b8e900f85a788f875e85085d

SHA1
0b96d9e2f9a12446c52da7e65254dd1448e8222d

SHA256
e391f97807c2500559ba6b9922a11fb48a161ac277a8b002ab53a9efd153e630

SHA512
6c22b781268173a93d96fa614220a094903f1f428ae91b064dd529e1d209e0c0d9deae98f02587e4b50dd1d4ada4d85cfdf29f5fe6bb66a49db6e58706d60a04

Download Submit
C:\Windows\SysWOW64\Cajlhqjp.exe

Filesize
72KB

MD5
818a2d59f5bcf81eb4fda1570a4e7a55

SHA1
8d7189eaf5fa8a09e09d16d50d4eaaa4b8f1c698

SHA256
f9b5f20100494488da93f2358f62e2a23c004abf4280a5af47e962b03fc8fab5

SHA512
76b26a13c5ce87beea8fce26d05d8e4e86a4a0d5c19c8d54e1673c8e82a864e827e487bcbc99c8ba0c13eccbc0861cac8ba6eb5fa0b6afcd3846948f5b2e41b4

Download Submit
C:\Windows\SysWOW64\Cdabcm32.exe

Filesize
72KB

MD5
d04165b6fd6c4a4e5c198b96dac905d7

SHA1
c739ac574e9e6dd81869807f2b1c88a7486674f6

SHA256
e59d0006037f4d2c43e469ddbbcd2c873263d9e3ebf8b0eb67c7fdc98120a759

SHA512
da9cf8be3d8d096ad4f2eb283249067d61994fc8b72a25dcbb249baaa1aca65efaa556fb667c29ba599f4d518868592d64a840b104c3d22a9a0537515b91c978

Download Submit
C:\Windows\SysWOW64\Cfdhkhjj.exe

Filesize
72KB

MD5
cc1a12caffa30ac8e391e566ac4dca90

SHA1
a3a81d774172babef6429982734d914077336a05

SHA256
19f285eece507b24ee15bed07bc694ca91592770c90f442aa827b01a51a76af7

SHA512
c485502262eed57195ff7f817c8362eff624c4e4578a99252a215a73946e809f9583ffa1337d54eb60905257ccba638a38ebc6d1d78c8b3bc00b7d0164b6d45e

Download Submit
C:\Windows\SysWOW64\Cffdpghg.exe

Filesize
72KB

MD5
ab32aac68842af6fd6a8a2dd089939a5

SHA1
e595232dd7a3186b52b07e1bc4e38e0ca8a61e91

SHA256
1511dc9556427c111703132772d8d5d17bab1490af9e88cff8f26fe0ae5d3239

SHA512
5b33633da7c806405b281cd081f112c8b5ac27112a33cac1ac51c206e27bda20ee9ec315d11f3785312c0d5a63db959a32b203090eaf1304c1338f4188f61216

Download Submit
C:\Windows\SysWOW64\Cmiflbel.exe

Filesize
72KB

MD5
b08f7289466efd6e351075896367ab1a

SHA1
a7002f98cfab34aa0c72d59d5391604b95ace0f1

SHA256
93a5ef696e65ae379181cc1346e765cf56d247b8278f1aff4ed36d09affc86c2

SHA512
ab8657487879514473e82fb795b40a1c1a896ef36466b224631e12eaec76f44521f92057c3b24480a9a594e9c3ad2fffdae5a459e4d176d4440ba6cb71dced16

Download Submit
C:\Windows\SysWOW64\Cndikf32.exe

Filesize
72KB

MD5
01a428171eb712e701fd64cb1b3b3f47

SHA1
475e63eb5d7b44d3092a1928ee4332c13989dbe9

SHA256
0c8f2daf82a38ee2d70af654c3f5fd8d92471eaacc072f6a51caa6908a3993c3

SHA512
0641f50610e01c82d583d76560d07d9fa51ef86c6a2be3e3dee1a8ee2a75c4e6db5433865649d471d5c3922fc9de7d47094261e594606a446692e041398cd072

Download Submit
C:\Windows\SysWOW64\Cnicfe32.exe

Filesize
72KB

MD5
75a083e079acafc02fad65b719ba0d9f

SHA1
d23ff462c9c05b664af930580a065429e0fe68ac

SHA256
3ff558209f99b78a0846c72d7ce5b721e866b4a10872b7a7055a78142fc369a4

SHA512
37cd61f3231209275482450f7505789ed0be6fe8dd58b301d45e25e339654fdb7068c325ee327a364a0088a5c4457d8cdc167fbafd63ad91bb5e6cf4540e0515

Download Submit
C:\Windows\SysWOW64\Dddhpjof.exe

Filesize
72KB

MD5
149dbbc0c2375d3f93a38ddbd170dd8c

SHA1
4e640900aeee374a2b075e6e070dbda72c3f45c4

SHA256
655eafc92c17f670f0dfdfd6001975e52bba68c9172c4ef4369f38ea82396bf7

SHA512
13bdbcb89e35034d7b7a0b5174520cf9c4d4848e4521ba3995246340244417620efdb6cfb54ca370a7f0bc2e69464356b6b2febb85aea51389eae1eaacad3c2d

Download Submit
C:\Windows\SysWOW64\Ddmaok32.exe

Filesize
72KB

MD5
dbef72e28b67deaf5a775a24a69e630f

SHA1
0f55272272214f4457a3ca719b32659d128de481

SHA256
dfbe88e94b67513c5326b6a6492a8e9398ca61cb8a00aa5482ddf13d434e9d4f

SHA512
df5bb19eaa6d2c21911fd829a16cd8aafad22531a332d462b4342214ce7ff78474cffab38b554734855b5f8cf6aa0cca4465955d92b91c3e10eac5d8c2fa1a5f

Download Submit
C:\Windows\SysWOW64\Dhfajjoj.exe

Filesize
72KB

MD5
c22f8ab7a9a47fc610b828ea0bfd57ac

SHA1
b05ab981877861398e0d279cc480750173dcc20e

SHA256
ab3cfa137ace8f8392105d1d4070e6910dc5dcc3deedacc33053e0678d442e93

SHA512
2cbeeef5e3a36338622fc709acdb0694a0db9ab14c63f14ac24d52a385a49ca3fe17c369a0fbb0cb013647595b6c1187c93dcde7c4a94f534e9f95cfecc17036

Download Submit
C:\Windows\SysWOW64\Dhmgki32.exe

Filesize
72KB

MD5
b99c28dc78090ba107a0444ac076bfb2

SHA1
44d9f6524588f32fb7bf9c25ca696f168127e9ae

SHA256
725b1fbbaf910cf537dc81c60b0cb800453fd08f67fca51f3a36688a1c620b8f

SHA512
8e4616e396cef4d78f807db181cdb4e41aa998add5557c624aa85a8bb1400b4f29683d2d51880210dd2ed5ca1dcbe0e946ce71bc5e012b95f7b8b0f62a2a371d

Download Submit
C:\Windows\SysWOW64\Dkifae32.exe

Filesize
72KB

MD5
b1d2da08334f8a1098c8219324f20234

SHA1
ae30bb31112ec83b21ff11c0fd642bfe5b9111a2

SHA256
421839e27e4fb542f4926aa650ad86c804dbe0057bbbd3aad7fc23c252d40973

SHA512
56c2ac05e8177c6698332bee5cdbf97f1bdb7e65a2ead6f667389c08f3c9e734d29b97b1185d9f2f7e7111deacd0754e5c71121322bfb8053a670cb888dbde6e

Download Submit
C:\Windows\SysWOW64\Dknpmdfc.exe

Filesize
72KB

MD5
e943755581a631f35771488a3dba9b9a

SHA1
c2a98803e9c8c48a558d7c48ce1fa8fa39307b0e

SHA256
a3042cebd33e15dc60ef4e801134cfa4ab98286c71b79fb8879dcb83af2a8e93

SHA512
4b89325de564bbe5058235b85ea6cf616845b99796e60da7a179f94231b01c561119b872e8cba64151d7b89774139b098586da8d4256209f7e5eaa44bf2baf81

Download Submit
C:\Windows\SysWOW64\Dmefhako.exe

Filesize
72KB

MD5
04252ac2ab2182aa4562d15d1b888342

SHA1
2cafe9a583a6872d20710204a1d577b2e0906e8a

SHA256
f120ddeceadd7caea6f1a1552d8af3f3cc711f64295c6c436baea0f6a8de5cbf

SHA512
1013e6572cf01b58ac7632ca490ff817126ed4bbaf8f19e577b30d6e44cfa86a0d8be083725407c14a5f3c7fcbdb5d254a9c5b1eeeee87ee192901259a5d19f9

Download Submit
C:\Windows\SysWOW64\Dmgbnq32.exe

Filesize
72KB

MD5
608039e7c8f2d9ee3bd057667b0555b3

SHA1
02bc273b0ccfbee2112879bb3027b670962d48a0

SHA256
51cada2fdec30503bd877bc64e020ce6da93afbe1ac83b5344cfa5686d64fa3c

SHA512
020af9fa9f13a19b2fdb314fbf7ce1bd2b8d637a56761deea37cdb04d685f5e293ac9905df4ca48d8b71ed70da96bbc3d9862dd3dabb8570e04a61d08db39406

Download Submit
C:\Windows\SysWOW64\Dmjocp32.exe

Filesize
72KB

MD5
a068a1b7d6ce9d50ffcdba747e9824b8

SHA1
76f5590d286c4c07c8788179cf928774dbff77f4

SHA256
2a79767606ff8c8535e2de13ae3fa6db2122786e8d524d4be4c0f7437537f291

SHA512
6b5f3330fa8dac45e2c9f1ab2f1f916585b0b8bf9ecc3da1fd22529623f2f873e684e6ff62be0e4e498f38d2b9727bdfe52f8cfe6d839133c0a62ecf63ffa402

Download Submit
C:\Windows\SysWOW64\Dopigd32.exe

Filesize
72KB

MD5
14890b2043aa47fb657bc8fe506bad43

SHA1
6c8b36fc30216a7398c08a71d7762eb2490e9a00

SHA256
901916f47d22f6824cf9050021d094d41b2e008bac80b06efa0913746ec1c688

SHA512
28fbd52600006bc7ddae3a616f9158d7453cfe401beca187a464e77fe209ab4c0220625d589f36a6311353ebd8e063acbd581cf5bd035e3a7231eb4c1faecce7

Download Submit
C:\Windows\SysWOW64\Ecbjkngo.exe

Filesize
72KB

MD5
c40b77205450d9b4eeb97c3805e79259

SHA1
fedc096bb5a4e393425ad6a1d63d2f55cce7bda7

SHA256
48a46f31d5164ab2165e2ab3583d4740f9c14e321114a46eabed7f6d5d10a222

SHA512
3eb42db08116bba51dc99126bb0188ee33caeb331cf10884f8e5c09f0556cabb03068d9ecba2a06a3ca8a4a03554a84b3ca2e3e3d71424d32f55e1a10c2df63d

Download Submit
C:\Windows\SysWOW64\Ecefqnel.exe

Filesize
72KB

MD5
79418cb43da337e59180162e4020a119

SHA1
da8ff25f53d07a5c5fc68da7187ee2e67bc6c78e

SHA256
f9f43df47819f22214a29c7fb2b26eecfa50abbc74c445d168192ecd6ebb9a21

SHA512
e98380f5716a7a5f42727e0f65f60b3339c3eccd02930314d0843d0ee0ce23d90429f1edc46b166c0cd78f0e4b473fdc8e54e8a06d0576210bfbb0ea224e9868

Download Submit
C:\Windows\SysWOW64\Eecdjmfi.exe

Filesize
72KB

MD5
10dfacbba2a369597f038e1e749999f8

SHA1
7359622a8e342e713c0725d1ab15de1aed540366

SHA256
05aa238fca4b7fe1c437642b00dd71f4350eaf374b2e994610128d3de41c9ec3

SHA512
0bdf3b1e35e22b8ffb6f0cfdec92db74ec5e4df74f672292903917e8fd34a5fb808fce13fb89b2744aa3ed35afeea70e1a55500b614c8c00b60aa5a46ef272d2

Download Submit
C:\Windows\SysWOW64\Fibhpbea.exe

Filesize
72KB

MD5
7d5603ee9ae1125f01ab4d5e4cdbadd3

SHA1
cee3c66d8e3dedfa248e4cc1775c4c8eabc0c564

SHA256
cb3e3e68394d3a17326c4b3d00236133d72aadb12bb1a5dcac30be995e2b25dc

SHA512
72b2a760f3bf6a15762b1601f114399fb2ec6741f32a86acba9902183510f509731cde0fa2e2b348d8ee482a956979c46a02231489ba2a08c4a11782ad5bf0cf

Download Submit
C:\Windows\SysWOW64\Gilapgqb.exe

Filesize
72KB

MD5
386114cee566758916b9e80016b1e10c

SHA1
5914076e5ecbe41e84276a9bd5c5eae39507a0ed

SHA256
67cce796e282cc693707a114a89362e9a087dc63500633549c3c5db71c2ee346

SHA512
913ed55545d4a41f687bbfe8f2586b676691fdfafb63fd384279113aaee28e9ffc67c29bcdb9e3303c7cba5e056ff72323e2b27a6646b737a0c6dd8d1212a198

Download Submit
C:\Windows\SysWOW64\Gmdjapgb.exe

Filesize
72KB

MD5
b7fd16fd85da6de4e537a8982391b5ef

SHA1
5bdfc85bf572d01b71571b2b01a2e3a0131ef1fa

SHA256
62e3914780f2e34004df588cc00b3bfc9069e042b9f25e6d6dc57d3c231a7e57

SHA512
4a3f6b6cc0b2de458945d699177c61d4dda419f6ab80943add0e08d73087d37337a81234eea06c678155391e18ff11d24a8ab5775014ccb7630b14f8c6ba313a

Download Submit
C:\Windows\SysWOW64\Hgkkkcbc.exe

Filesize
72KB

MD5
4328d411617abba28685fe0e6c6e21e2

SHA1
baf11000dd72bae0b717e16fc9bd6b05e465a182

SHA256
cfba2b74b04164f5fe52bca254f50607a62d37474b07e978674271213f5f9883

SHA512
9462f34b2ac8daf29c0af0de97818aa68fc89eb23f0d6d91c4ec2e243ce50c94dd4fe4d6eb5d4a5200a10e0e7700f5382cebc5a22aab41b90cbee4fe8594d1e5

Download Submit
C:\Windows\SysWOW64\Iakiia32.exe

Filesize
72KB

MD5
ce3a587ef5a8aa39ce906053010d8754

SHA1
7d4ef31c58cf9d02a92f75d8c41d9d9e167cec41

SHA256
ea1b06b90eaf4bd1d7f76d28680469fbe3e1ddcbce01d5256894d6b41bd8d443

SHA512
e5777c99ac262aba87c4ee1de2aa8d59129fd642bf0bc8c369158dec01d07f2bd159af19a8ea7c63c9788befb89c7e7fe8604fabbac6ba9569108ebaec192d2b

Download Submit
C:\Windows\SysWOW64\Idfaefkd.exe

Filesize
72KB

MD5
20f1a69d63f796d3d01955cd06e6958d

SHA1
47904be2d2fbe591ce4a6755ef0c6f1bfc696a81

SHA256
0e61fa6973653aefb837382e66d9daca11f7581dbd952a54283d3f59e56f963f

SHA512
4694390618c592a9e3040c127bcde030ca2122a8851cf991b37ee4076f45411d9dbebf81b3c55b98e516e0f954efafcdffe0f5cf0243a516ed35917adbe96f4c

Download Submit
C:\Windows\SysWOW64\Indfca32.exe

Filesize
72KB

MD5
f9d56a9c608bc878f457911a097b02ff

SHA1
fcf3eabcdf262b23f2d2ee4907a13a625628815e

SHA256
05c3e9691722e6f6ec86d6c45ad7ea7084cc0a6297b9f85fc669fdd446aca319

SHA512
60cfca668e1392334e4fb2ef23a9b0795e3361421cc95e7774fc66a1607765b5083b6d4a05266c334de733458e132a6342b15e8733b51cbf996141fd6739e9eb

Download Submit
C:\Windows\SysWOW64\Jdaaaeqg.exe

Filesize
72KB

MD5
7bfd878ca9e5bb20dbc028a7edc40852

SHA1
1b8055f3397260eebf51c9aa312a2a85ac627c2d

SHA256
c77daa27057d6835bf007fe107b550a16ca9bdc599f8faea7bb4533a43125533

SHA512
60cecd6ca13a4274c3845feb0fa787425851826fa2043d9f566f43beab4913ea758b1a4ac08007ae2ecbd9873f9900273f3f4f55a1bc87eb0a043841b64c9ab3

Download Submit
C:\Windows\SysWOW64\Kdigadjo.exe

Filesize
72KB

MD5
cb4825bf30424f3644aac7e689ba9004

SHA1
19a096b6178891151f6d3d997b6dab17e04caf38

SHA256
392628b97bce21518a68be0524257291f700f05004acc4b5d67e8415894307cf

SHA512
3fcba96b2eb570eb4ec8a5c2111a6ea3f4ba2d051b179eae2c060e7bb010f205b41e41e400ecfd094d2888c22c1844c233fac6d09305cf08833b71036e6c512e

Download Submit
C:\Windows\SysWOW64\Kgninn32.exe

Filesize
72KB

MD5
487958b2046f2c74830b665f3f84791e

SHA1
3b9f802073886212cad49b956ad9635a7b435edd

SHA256
3558e6988f04954817344f2431b5ce3798cf76c3f08cb8c9bea181bbb5b9f462

SHA512
39d6232776f238101814ae9aac1ab447934b11a28ad60292a8f5b7fb477cc8fec16d69e07e32e221c15f9524195824afe3c9b9a5f654c8c6e5eee0ece58fb270

Download Submit
C:\Windows\SysWOW64\Kkcfid32.exe

Filesize
72KB

MD5
b894a07dbc5c8c49db858b949a93ed2f

SHA1
5283bffc343350cd90d073e6534a4d63bdc21b2d

SHA256
f26c711a6391c8cdd5d1655e2e91195ce93762358b0039b2fd4998517d02b9f0

SHA512
047f954caf04d66dd85b4618951e1593454cf51eb802e336c4a9875a3155ad377ad674321a6559ac17e7212baeb25c1bc7dfa24986901e025860c7592a32d154

Download Submit
C:\Windows\SysWOW64\Mgehfkop.exe

Filesize
72KB

MD5
486202f7d3831884bc5ad7767445e35f

SHA1
457d572d781129ca628cb647289f9d29874e2599

SHA256
068123a63e4a955cb506f136439bcaad88009367b47530e1d6efde5f8f923961

SHA512
ff727a3efc0e972ba9cee1068bfdfb3a479856acffa92f1216624485f65e628cbfb10d0736a96dadb05c491d8e3e91a5c46f90637cc34caa27645d78e81fa978

Download Submit
C:\Windows\SysWOW64\Nhdlao32.exe

Filesize
72KB

MD5
584e5760db17b32f4b3ff667209c81c8

SHA1
c309a412854fbf558bfe1435743f3feed2bac3a8

SHA256
fccb67c70074374eb2a5af686612894ee4d8bd2ed76621cc6274019a1308db01

SHA512
381c40abc576d8234dd0b5d4643f35daf2d4fea8e258cd32a1cc35f1e29a55ba26824c9f6ca5fc1dfde410feb7dd3edec69f0beaeb8f7c7bdc4bb0c895aab29a

Download Submit
C:\Windows\SysWOW64\Nlfnaicd.exe

Filesize
72KB

MD5
f36c5b4cb541219a277ddd2a8531b774

SHA1
437975245425d8372110216888cffd6cdab63d05

SHA256
74541085870c2f643bac53e0e0a9c14c2579c08b40672324e865571bd2000542

SHA512
292e8cd9974250c323ae6a06345caf67e840abf1575745510d3c327ef3d0d8c91f885bc20cf6c971f14d2f6779c388366a2b8e93a47f887496f9319e5b982041

Download Submit
C:\Windows\SysWOW64\Obcceg32.exe

Filesize
72KB

MD5
dfbc974c3aef6c202143340ffee0ac66

SHA1
c635821f6b77447763e0f22b2dfc2baa693982e5

SHA256
b8aff52d34d1d2e1987782751a2a26010208d063880aee5e92394e9b1bd2ba5e

SHA512
bb05c135d4200849dcae78092caca441ace9095e3218c22cbae675732473c6faa2bdfa18f2c219ae67be4ce640d00545fda3d08f6562b4247ea917b82ae18325

Download Submit
C:\Windows\SysWOW64\Odalmibl.exe

Filesize
72KB

MD5
2c6864f0e3e118662e2910050da66e04

SHA1
33bed499911e700b15830e8ffbbf96b58a3b53ab

SHA256
011f3f9c4c583ba7b00a31650df6974c9f4b7382c4a23041b1c349662064b049

SHA512
ca0235c6900c7b39044b0a28e09da2feae73626098a69d2bb6f85e9fde368c86cfac68fcece849037389c880cc73296601df6f0d9eab399896f65657aae44c79

Download Submit
C:\Windows\SysWOW64\Ohfami32.exe

Filesize
72KB

MD5
53329aa06b4f21d0ed728fb61f061b88

SHA1
c18896aba8bc80a7aedaf8a383ddb8a735611969

SHA256
5df5f9e1fa12dcda41745e7e71248d9780c110dcfeaef7fd3e9c1679b8844a7a

SHA512
f66942c3cd8ee4b60273f98bfdd1b60f807007948b63391a54f51b678a9f0130553714596fc5bdd5f2f524b3a687cd673aa8fc0da4684bfebe6da8c844adbea7

Download Submit
C:\Windows\SysWOW64\Plbmokop.exe

Filesize
72KB

MD5
6fd9eceed194b4b2c53ddd4d1f520088

SHA1
328f31ec6c54a6ce52e1635db01e95919c9f5143

SHA256
fe33496e3a3ee91f3b3c45ce30b5174751912ed581d16827987bbf22c1f5d614

SHA512
67c0fa1342da8100986a55567c5073ade443c38be1ddb3d1b240555ea932666205ce46625a05c1b1c95cca3d2b4ec96ed49589a06b71bcb97ae4b69a62ce27d2

Download Submit
memory/116-175-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/400-120-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/452-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/568-207-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/732-87-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/796-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/928-256-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1064-103-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1340-293-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1356-305-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1436-220-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1548-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1796-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1808-79-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1940-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2236-176-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2276-192-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2368-100-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2548-127-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2632-137-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2708-236-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3248-144-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3328-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3356-167-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3468-160-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3496-228-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3752-275-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3808-311-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3900-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3964-199-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4000-184-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4104-244-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4132-317-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4136-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4192-281-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4276-114-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4332-299-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4432-269-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4512-152-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4968-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5000-287-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5036-248-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5080-263-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5092-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5160-323-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5204-329-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5248-335-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5288-341-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5328-347-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5368-354-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5412-360-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5452-366-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5492-372-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5532-378-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5572-384-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5612-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5652-396-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5692-406-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5736-408-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5784-414-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5824-420-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5868-430-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5924-432-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5964-438-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads