99eeb168819c609ae7cd53c0bd4ac5f49c8d8a2ffcf3412f7d983d3fc1e4456e

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-03-2024 23:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

99eeb168819c609ae7cd53c0bd4ac5f49c8d8a2ffcf3412f7d983d3fc1e4456e.exe
Size

64KB
MD5

2101affddbc4614c27f4748237952621
SHA1

11e4f4ed647f9fe9c87d294d2c2454e58e26de36
SHA256

99eeb168819c609ae7cd53c0bd4ac5f49c8d8a2ffcf3412f7d983d3fc1e4456e
SHA512

04fc32c3342443ad8c031ce9f650043c7571cbd29cdb30e0a6ee715608f8ac46fd8a5a20bdd48799e4f5eadae283b42a1dafa2fb2d2e346a3538991ecf107033
SSDEEP

768:Loo2rEd5bvXolfbcT7MfBhkRcul62zaR4Z4DhFCi9ye9nUNu/1H50XdnhgOPuM1T:kzEd5bvXkucRRF7ye9nUu0ZuYDPf

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdpkflfe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Neccpd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igfclkdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndokbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qcdbfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Klfaapbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdagpnbk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdglmkeg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olanmgig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnadagbm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpfcdojl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjohde32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ajcdnd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dakacjdb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nabfjpak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhahaiec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfmajipb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhdjehhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nccokk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omqmop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mqdcnl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbhfjljd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pgllfp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iedjmioj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odkjng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jilnqqbj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ageolo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnkgeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Imiehfao.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jmmjgejj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lpebpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hjedffig.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aanbhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmafajfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iedjmioj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfkaag32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdbhkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkabjbih.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbqklb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lnnbqnjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahenokjf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnjgfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adcjop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibqpimpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bganhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikkpgafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aeaanjkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fligqhga.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdagpnbk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jilnqqbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pflibgil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Filiii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kqpoakco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omqmop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kcidmkpq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mdjagjco.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpablkhc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kndojobi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qaalblgi.exe

Executes dropped EXE 64 IoCs

pid	Process
2264	Hbeqmoji.exe
3908	Hmjdjgjo.exe
4072	Hcdmga32.exe
3352	Ikpaldog.exe
2188	Ibjjhn32.exe
3268	Imoneg32.exe
2780	Iblfnn32.exe
2412	Ippggbck.exe
880	Imdgqfbd.exe
4004	Ibqpimpl.exe
1008	Iikhfg32.exe
4832	Jfoiokfb.exe
996	Jpgmha32.exe
5008	Jfaedkdp.exe
4288	Jlnnmb32.exe
3376	Jbhfjljd.exe
3076	Jmmjgejj.exe
2160	Jbjcolha.exe
5044	Jidklf32.exe
536	Jpnchp32.exe
2760	Jeklag32.exe
3984	Jpppnp32.exe
1472	Kfjhkjle.exe
3004	Kbaipkbi.exe
5080	Kikame32.exe
4616	Kdqejn32.exe
2532	Kmijbcpl.exe
4416	Kbfbkj32.exe
2380	Kmkfhc32.exe
3876	Kdeoemeg.exe
4536	Kefkme32.exe
2632	Kdgljmcd.exe
2312	Leihbeib.exe
3156	Lpnlpnih.exe
4880	Lfhdlh32.exe
1560	Lmbmibhb.exe
3464	Lfkaag32.exe
3672	Lmdina32.exe
1636	Ldoaklml.exe
3808	Lepncd32.exe
4000	Lpebpm32.exe
4896	Mdehlk32.exe
3676	Megdccmb.exe
3024	Mdhdajea.exe
1564	Mmpijp32.exe
4532	Mdjagjco.exe
2336	Mgimcebb.exe
4176	Mpablkhc.exe
2960	Menjdbgj.exe
4084	Mlhbal32.exe
4204	Ndokbi32.exe
3732	Npfkgjdn.exe
3348	Ngpccdlj.exe
4392	Nlmllkja.exe
2788	Nnlhfn32.exe
5056	Ndhmhh32.exe
4824	Nggjdc32.exe
4164	Nnqbanmo.exe
4948	Odkjng32.exe
2244	Ojgbfocc.exe
212	Olfobjbg.exe
1136	Ocpgod32.exe
3152	Ojjolnaq.exe
1116	Oneklm32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Qgqeappe.exe	Qmkadgpo.exe
File created	C:\Windows\SysWOW64\Neccpd32.exe	Nahgoe32.exe
File created	C:\Windows\SysWOW64\Edhjghdk.dll	Cnahdi32.exe
File created	C:\Windows\SysWOW64\Efeihb32.exe	Emmdom32.exe
File opened for modification	C:\Windows\SysWOW64\Eifaim32.exe	Eblimcdf.exe
File created	C:\Windows\SysWOW64\Keojhkpc.dll	Fdkggg32.exe
File opened for modification	C:\Windows\SysWOW64\Acgolj32.exe	Aokcklid.exe
File opened for modification	C:\Windows\SysWOW64\Cpbbch32.exe	Cqpbglno.exe
File created	C:\Windows\SysWOW64\Locfbi32.dll	Jcfggkac.exe
File created	C:\Windows\SysWOW64\Nknbglob.dll	Fhmpagkp.exe
File created	C:\Windows\SysWOW64\Jdljmf32.dll	Jngjch32.exe
File created	C:\Windows\SysWOW64\Jfgdkd32.exe	Jnpmjf32.exe
File opened for modification	C:\Windows\SysWOW64\Hehkajig.exe	Hlpfhe32.exe
File created	C:\Windows\SysWOW64\Iefeek32.dll	Ibhkfm32.exe
File created	C:\Windows\SysWOW64\Kfcfimfi.dll	Pjpfjl32.exe
File created	C:\Windows\SysWOW64\Hbhhgenc.dll	Eonehbjg.exe
File created	C:\Windows\SysWOW64\Llpmoiof.exe	Kfcdfbqo.exe
File created	C:\Windows\SysWOW64\Egijmegb.exe	Edknqiho.exe
File created	C:\Windows\SysWOW64\Ibffdoal.dll	Ookjdn32.exe
File created	C:\Windows\SysWOW64\Cibmlmeb.exe	Cceddf32.exe
File created	C:\Windows\SysWOW64\Gapjhc32.dll	Icdheded.exe
File created	C:\Windows\SysWOW64\Dcnfjkma.dll	Ilccoh32.exe
File created	C:\Windows\SysWOW64\Kngkqbgl.exe	Knenkbio.exe
File created	C:\Windows\SysWOW64\Kdgljmcd.exe	Kefkme32.exe
File opened for modification	C:\Windows\SysWOW64\Cfmajipb.exe	Bcoenmao.exe
File created	C:\Windows\SysWOW64\Ipligd32.dll	Hdbfodfa.exe
File created	C:\Windows\SysWOW64\Lknojl32.exe	Lgccinoe.exe
File created	C:\Windows\SysWOW64\Eehmok32.dll	Ppahmb32.exe
File created	C:\Windows\SysWOW64\Dahhio32.exe	Daekdooc.exe
File opened for modification	C:\Windows\SysWOW64\Ifleoe32.exe	Indmnh32.exe
File opened for modification	C:\Windows\SysWOW64\Jnpmjf32.exe	Jgfdmlcm.exe
File created	C:\Windows\SysWOW64\Gbomgcch.dll	Plhnda32.exe
File opened for modification	C:\Windows\SysWOW64\Dfdpad32.exe	Dnmhpg32.exe
File opened for modification	C:\Windows\SysWOW64\Dooaoj32.exe	Dkceokii.exe
File created	C:\Windows\SysWOW64\Iblfnn32.exe	Imoneg32.exe
File created	C:\Windows\SysWOW64\Kjpgii32.dll	Ocgmpccl.exe
File opened for modification	C:\Windows\SysWOW64\Qjnkcekm.exe	Qcdbfk32.exe
File created	C:\Windows\SysWOW64\Bjfjka32.exe	Bggnof32.exe
File created	C:\Windows\SysWOW64\Fhffdban.dll	Djjebh32.exe
File created	C:\Windows\SysWOW64\Adcjop32.exe	Aphnnafb.exe
File opened for modification	C:\Windows\SysWOW64\Bpdnjple.exe	Bmeandma.exe
File created	C:\Windows\SysWOW64\Mokknfec.dll	Hnfamjqg.exe
File created	C:\Windows\SysWOW64\Bfpfngma.dll	Glengm32.exe
File created	C:\Windows\SysWOW64\Eidbij32.exe	Edhjqc32.exe
File created	C:\Windows\SysWOW64\Jdokpl32.dll	Miaboe32.exe
File created	C:\Windows\SysWOW64\Jimehgni.dll	Afgacokc.exe
File created	C:\Windows\SysWOW64\Eghghj32.dll	Lklbdm32.exe
File created	C:\Windows\SysWOW64\Hehkajig.exe	Hlpfhe32.exe
File created	C:\Windows\SysWOW64\Jilnqqbj.exe	Jngjch32.exe
File created	C:\Windows\SysWOW64\Mojhgbdl.exe	Mhppji32.exe
File opened for modification	C:\Windows\SysWOW64\Oelolmnd.exe	Oejbfmpg.exe
File created	C:\Windows\SysWOW64\Ncnaabfm.dll	Jmmjgejj.exe
File opened for modification	C:\Windows\SysWOW64\Pdfjifjo.exe	Pnlaml32.exe
File created	C:\Windows\SysWOW64\Bdkohe32.dll	Lndagg32.exe
File created	C:\Windows\SysWOW64\Lpefcn32.dll	Jcmdaljn.exe
File created	C:\Windows\SysWOW64\Jljbeali.exe	Jilfifme.exe
File created	C:\Windows\SysWOW64\Ckjooo32.dll	Hoaojp32.exe
File created	C:\Windows\SysWOW64\Eaakpm32.exe	Edmjfifl.exe
File opened for modification	C:\Windows\SysWOW64\Hdlpneli.exe	Hoogfnnb.exe
File opened for modification	C:\Windows\SysWOW64\Jkmgblok.exe	Jiokfpph.exe
File created	C:\Windows\SysWOW64\Pmekjp32.dll	Keakgpko.exe
File created	C:\Windows\SysWOW64\Bcbohigp.exe	Ajjjocap.exe
File created	C:\Windows\SysWOW64\Aeheme32.dll	Phincl32.exe
File opened for modification	C:\Windows\SysWOW64\Gbnoiqdq.exe	Gncchb32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3680	7660	WerFault.exe	819

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gmojkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bkibgh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qcdbfk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dafipibl.dll"	Jdaaaeqg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgaokl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Coohhlpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbnnhndk.dll"	Phdnngdn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgllfp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jgfdmlcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnbebofc.dll"	Kelalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Phincl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlfpph32.dll"	Bpdnjple.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghdief32.dll"	Lcnmin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpaekf32.dll"	Ojllan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kghjhemo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qlimed32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aamknj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iohjlmeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cgcmjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cammjakm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qhmqdemc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggpenegb.dll"	Ppjbmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Menjdbgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpcmfk32.dll"	Pnfdcjkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfpecg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Injcmc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fmlneg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckeimm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmamoe32.dll"	Jbhfjljd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Agjhgngj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlglfe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjcmebie.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dnpdegjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjdlfi32.dll"	Fbgihaji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Adfonlkp.dll"	Jpcapp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lfgipd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ojllan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afmfkjol.dll"	Qebhhp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jdaaaeqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aogiap32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kdgljmcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmlneg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abklmb32.dll"	Cdbfab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cocjiehd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nemmoe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Embddb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhkngh32.dll"	Kefkme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glgmkm32.dll"	Nnqbanmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fiebmc32.dll"	Mjpbam32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qhlkilba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dakacjdb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ilcldb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgnffj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Igigla32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jlobkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhgcme32.dll"	Bkjiao32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gnqfcbnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Einbcgha.dll"	Kpiljh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dakacjdb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Neccpd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pkfhoiaf.dll"	Ojgbfocc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjmqinmi.dll"	Mniallpq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lqhdbm32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 2264	1828	99eeb168819c609ae7cd53c0bd4ac5f49c8d8a2ffcf3412f7d983d3fc1e4456e.exe	87
PID 1828 wrote to memory of 2264	1828	99eeb168819c609ae7cd53c0bd4ac5f49c8d8a2ffcf3412f7d983d3fc1e4456e.exe	87
PID 1828 wrote to memory of 2264	1828	99eeb168819c609ae7cd53c0bd4ac5f49c8d8a2ffcf3412f7d983d3fc1e4456e.exe	87
PID 2264 wrote to memory of 3908	2264	Hbeqmoji.exe	88
PID 2264 wrote to memory of 3908	2264	Hbeqmoji.exe	88
PID 2264 wrote to memory of 3908	2264	Hbeqmoji.exe	88
PID 3908 wrote to memory of 4072	3908	Hmjdjgjo.exe	89
PID 3908 wrote to memory of 4072	3908	Hmjdjgjo.exe	89
PID 3908 wrote to memory of 4072	3908	Hmjdjgjo.exe	89
PID 4072 wrote to memory of 3352	4072	Hcdmga32.exe	90
PID 4072 wrote to memory of 3352	4072	Hcdmga32.exe	90
PID 4072 wrote to memory of 3352	4072	Hcdmga32.exe	90
PID 3352 wrote to memory of 2188	3352	Ikpaldog.exe	91
PID 3352 wrote to memory of 2188	3352	Ikpaldog.exe	91
PID 3352 wrote to memory of 2188	3352	Ikpaldog.exe	91
PID 2188 wrote to memory of 3268	2188	Ibjjhn32.exe	92
PID 2188 wrote to memory of 3268	2188	Ibjjhn32.exe	92
PID 2188 wrote to memory of 3268	2188	Ibjjhn32.exe	92
PID 3268 wrote to memory of 2780	3268	Imoneg32.exe	93
PID 3268 wrote to memory of 2780	3268	Imoneg32.exe	93
PID 3268 wrote to memory of 2780	3268	Imoneg32.exe	93
PID 2780 wrote to memory of 2412	2780	Iblfnn32.exe	94
PID 2780 wrote to memory of 2412	2780	Iblfnn32.exe	94
PID 2780 wrote to memory of 2412	2780	Iblfnn32.exe	94
PID 2412 wrote to memory of 880	2412	Ippggbck.exe	95
PID 2412 wrote to memory of 880	2412	Ippggbck.exe	95
PID 2412 wrote to memory of 880	2412	Ippggbck.exe	95
PID 880 wrote to memory of 4004	880	Imdgqfbd.exe	97
PID 880 wrote to memory of 4004	880	Imdgqfbd.exe	97
PID 880 wrote to memory of 4004	880	Imdgqfbd.exe	97
PID 4004 wrote to memory of 1008	4004	Ibqpimpl.exe	98
PID 4004 wrote to memory of 1008	4004	Ibqpimpl.exe	98
PID 4004 wrote to memory of 1008	4004	Ibqpimpl.exe	98
PID 1008 wrote to memory of 4832	1008	Iikhfg32.exe	99
PID 1008 wrote to memory of 4832	1008	Iikhfg32.exe	99
PID 1008 wrote to memory of 4832	1008	Iikhfg32.exe	99
PID 4832 wrote to memory of 996	4832	Jfoiokfb.exe	100
PID 4832 wrote to memory of 996	4832	Jfoiokfb.exe	100
PID 4832 wrote to memory of 996	4832	Jfoiokfb.exe	100
PID 996 wrote to memory of 5008	996	Jpgmha32.exe	101
PID 996 wrote to memory of 5008	996	Jpgmha32.exe	101
PID 996 wrote to memory of 5008	996	Jpgmha32.exe	101
PID 5008 wrote to memory of 4288	5008	Jfaedkdp.exe	102
PID 5008 wrote to memory of 4288	5008	Jfaedkdp.exe	102
PID 5008 wrote to memory of 4288	5008	Jfaedkdp.exe	102
PID 4288 wrote to memory of 3376	4288	Jlnnmb32.exe	103
PID 4288 wrote to memory of 3376	4288	Jlnnmb32.exe	103
PID 4288 wrote to memory of 3376	4288	Jlnnmb32.exe	103
PID 3376 wrote to memory of 3076	3376	Jbhfjljd.exe	104
PID 3376 wrote to memory of 3076	3376	Jbhfjljd.exe	104
PID 3376 wrote to memory of 3076	3376	Jbhfjljd.exe	104
PID 3076 wrote to memory of 2160	3076	Jmmjgejj.exe	105
PID 3076 wrote to memory of 2160	3076	Jmmjgejj.exe	105
PID 3076 wrote to memory of 2160	3076	Jmmjgejj.exe	105
PID 2160 wrote to memory of 5044	2160	Jbjcolha.exe	106
PID 2160 wrote to memory of 5044	2160	Jbjcolha.exe	106
PID 2160 wrote to memory of 5044	2160	Jbjcolha.exe	106
PID 5044 wrote to memory of 536	5044	Jidklf32.exe	107
PID 5044 wrote to memory of 536	5044	Jidklf32.exe	107
PID 5044 wrote to memory of 536	5044	Jidklf32.exe	107
PID 536 wrote to memory of 2760	536	Jpnchp32.exe	108
PID 536 wrote to memory of 2760	536	Jpnchp32.exe	108
PID 536 wrote to memory of 2760	536	Jpnchp32.exe	108
PID 2760 wrote to memory of 3984	2760	Jeklag32.exe	109

C:\Users\Admin\AppData\Local\Temp\99eeb168819c609ae7cd53c0bd4ac5f49c8d8a2ffcf3412f7d983d3fc1e4456e.exe
"C:\Users\Admin\AppData\Local\Temp\99eeb168819c609ae7cd53c0bd4ac5f49c8d8a2ffcf3412f7d983d3fc1e4456e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Windows\SysWOW64\Hbeqmoji.exe
  C:\Windows\system32\Hbeqmoji.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Windows\SysWOW64\Hmjdjgjo.exe
    C:\Windows\system32\Hmjdjgjo.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\Windows\SysWOW64\Hcdmga32.exe
      C:\Windows\system32\Hcdmga32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4072
    - - C:\Windows\SysWOW64\Ikpaldog.exe
        
        C:\Windows\system32\Ikpaldog.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3352
      - C:\Windows\SysWOW64\Ibjjhn32.exe
        
        C:\Windows\system32\Ibjjhn32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2188
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3268
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2780
        
        C:\Windows\SysWOW64\Ippggbck.exe
        
        C:\Windows\system32\Ippggbck.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Windows\SysWOW64\Imdgqfbd.exe
        
        C:\Windows\system32\Imdgqfbd.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:880
        
        C:\Windows\SysWOW64\Ibqpimpl.exe
        
        C:\Windows\system32\Ibqpimpl.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1008
        
        C:\Windows\SysWOW64\Jfoiokfb.exe
        
        C:\Windows\system32\Jfoiokfb.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4832
        
        C:\Windows\SysWOW64\Jpgmha32.exe
        
        C:\Windows\system32\Jpgmha32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:996
        
        C:\Windows\SysWOW64\Jfaedkdp.exe
        
        C:\Windows\system32\Jfaedkdp.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4288
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3376
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3076
        
        C:\Windows\SysWOW64\Jbjcolha.exe
        
        C:\Windows\system32\Jbjcolha.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2160
        
        C:\Windows\SysWOW64\Jidklf32.exe
        
        C:\Windows\system32\Jidklf32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5044
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\SysWOW64\Jeklag32.exe
        
        C:\Windows\system32\Jeklag32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2760
        
        C:\Windows\SysWOW64\Jpppnp32.exe
        
        C:\Windows\system32\Jpppnp32.exe
        23⤵
        Executes dropped EXE
        
        PID:3984
        
        C:\Windows\SysWOW64\Kfjhkjle.exe
        
        C:\Windows\system32\Kfjhkjle.exe
        24⤵
        Executes dropped EXE
        
        PID:1472
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        25⤵
        Executes dropped EXE
        
        PID:3004
        
        C:\Windows\SysWOW64\Kikame32.exe
        
        C:\Windows\system32\Kikame32.exe
        26⤵
        Executes dropped EXE
        
        PID:5080
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        27⤵
        Executes dropped EXE
        
        PID:4616
        
        C:\Windows\SysWOW64\Kmijbcpl.exe
        
        C:\Windows\system32\Kmijbcpl.exe
        28⤵
        Executes dropped EXE
        
        PID:2532
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        29⤵
        Executes dropped EXE
        
        PID:4416
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        30⤵
        Executes dropped EXE
        
        PID:2380
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        31⤵
        Executes dropped EXE
        
        PID:3876
        
        C:\Windows\SysWOW64\Kefkme32.exe
        
        C:\Windows\system32\Kefkme32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:4536
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        33⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2632
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        34⤵
        Executes dropped EXE
        
        PID:2312
        
        C:\Windows\SysWOW64\Lpnlpnih.exe
        
        C:\Windows\system32\Lpnlpnih.exe
        35⤵
        Executes dropped EXE
        
        PID:3156
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        36⤵
        Executes dropped EXE
        
        PID:4880
        
        C:\Windows\SysWOW64\Lmbmibhb.exe
        
        C:\Windows\system32\Lmbmibhb.exe
        37⤵
        Executes dropped EXE
        
        PID:1560
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3464
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        39⤵
        Executes dropped EXE
        
        PID:3672
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        40⤵
        Executes dropped EXE
        
        PID:1636
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        41⤵
        Executes dropped EXE
        
        PID:3808
        
        C:\Windows\SysWOW64\Lpebpm32.exe
        
        C:\Windows\system32\Lpebpm32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4000
        
        C:\Windows\SysWOW64\Mdehlk32.exe
        
        C:\Windows\system32\Mdehlk32.exe
        43⤵
        Executes dropped EXE
        
        PID:4896
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        44⤵
        Executes dropped EXE
        
        PID:3676
        
        C:\Windows\SysWOW64\Mdhdajea.exe
        
        C:\Windows\system32\Mdhdajea.exe
        45⤵
        Executes dropped EXE
        
        PID:3024
        
        C:\Windows\SysWOW64\Mmpijp32.exe
        
        C:\Windows\system32\Mmpijp32.exe
        46⤵
        Executes dropped EXE
        
        PID:1564
        
        C:\Windows\SysWOW64\Mdjagjco.exe
        
        C:\Windows\system32\Mdjagjco.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4532
        
        C:\Windows\SysWOW64\Mgimcebb.exe
        
        C:\Windows\system32\Mgimcebb.exe
        48⤵
        Executes dropped EXE
        
        PID:2336
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4176
        
        C:\Windows\SysWOW64\Menjdbgj.exe
        
        C:\Windows\system32\Menjdbgj.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2960
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        51⤵
        Executes dropped EXE
        
        PID:4084
        
        C:\Windows\SysWOW64\Ndokbi32.exe
        
        C:\Windows\system32\Ndokbi32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4204
        
        C:\Windows\SysWOW64\Npfkgjdn.exe
        
        C:\Windows\system32\Npfkgjdn.exe
        53⤵
        Executes dropped EXE
        
        PID:3732
        
        C:\Windows\SysWOW64\Ngpccdlj.exe
        
        C:\Windows\system32\Ngpccdlj.exe
        54⤵
        Executes dropped EXE
        
        PID:3348
        
        C:\Windows\SysWOW64\Nlmllkja.exe
        
        C:\Windows\system32\Nlmllkja.exe
        55⤵
        Executes dropped EXE
        
        PID:4392
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        56⤵
        Executes dropped EXE
        
        PID:2788
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        57⤵
        Executes dropped EXE
        
        PID:5056
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        58⤵
        Executes dropped EXE
        
        PID:4824
        
        C:\Windows\SysWOW64\Nnqbanmo.exe
        
        C:\Windows\system32\Nnqbanmo.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4164
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4948
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2244
        
        C:\Windows\SysWOW64\Olfobjbg.exe
        
        C:\Windows\system32\Olfobjbg.exe
        62⤵
        Executes dropped EXE
        
        PID:212
        
        C:\Windows\SysWOW64\Ocpgod32.exe
        
        C:\Windows\system32\Ocpgod32.exe
        63⤵
        Executes dropped EXE
        
        PID:1136
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        64⤵
        Executes dropped EXE
        
        PID:3152
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        65⤵
        Executes dropped EXE
        
        PID:1116
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        66⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\Ofqpqo32.exe
        
        C:\Windows\system32\Ofqpqo32.exe
        67⤵
        
        PID:3852
        
        C:\Windows\SysWOW64\Ojllan32.exe
        
        C:\Windows\system32\Ojllan32.exe
        68⤵
        Modifies registry class
        
        PID:316
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        69⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        70⤵
        Drops file in System32 directory
        
        PID:3088
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        71⤵
        Drops file in System32 directory
        
        PID:3896
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        72⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        73⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        74⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\Pnakhkol.exe
        
        C:\Windows\system32\Pnakhkol.exe
        75⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        76⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\Pflplnlg.exe
        
        C:\Windows\system32\Pflplnlg.exe
        77⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        78⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3628
        
        C:\Windows\SysWOW64\Pnfdcjkg.exe
        
        C:\Windows\system32\Pnfdcjkg.exe
        80⤵
        Modifies registry class
        
        PID:4768
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        81⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        82⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Qmkadgpo.exe
        
        C:\Windows\system32\Qmkadgpo.exe
        83⤵
        Drops file in System32 directory
        
        PID:5224
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        84⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        85⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        86⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Qddfkd32.exe
        
        C:\Windows\system32\Qddfkd32.exe
        87⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Qffbbldm.exe
        
        C:\Windows\system32\Qffbbldm.exe
        88⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        89⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        90⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5644
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        92⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        93⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        94⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Agglboim.exe
        
        C:\Windows\system32\Agglboim.exe
        95⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Anadoi32.exe
        
        C:\Windows\system32\Anadoi32.exe
        96⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        97⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5964
        
        C:\Windows\SysWOW64\Aeniabfd.exe
        
        C:\Windows\system32\Aeniabfd.exe
        99⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        100⤵
        Modifies registry class
        
        PID:6064
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        101⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        102⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\Bganhm32.exe
        
        C:\Windows\system32\Bganhm32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5204
        
        C:\Windows\SysWOW64\Bnkgeg32.exe
        
        C:\Windows\system32\Bnkgeg32.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5308
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        105⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        106⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Beglgani.exe
        
        C:\Windows\system32\Beglgani.exe
        107⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        108⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5724
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        110⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        111⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Bmemac32.exe
        
        C:\Windows\system32\Bmemac32.exe
        112⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        113⤵
        Drops file in System32 directory
        
        PID:6008
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6076
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        115⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        116⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        117⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Cdhhdlid.exe
        
        C:\Windows\system32\Cdhhdlid.exe
        118⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        119⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        120⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\Dfiafg32.exe
        
        C:\Windows\system32\Dfiafg32.exe
        121⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3328
        
        C:\Windows\SysWOW64\Daqbip32.exe
        
        C:\Windows\system32\Daqbip32.exe
        123⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        124⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        125⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        126⤵
        Drops file in System32 directory
        
        PID:5892
        
        C:\Windows\SysWOW64\Dahhio32.exe
        
        C:\Windows\system32\Dahhio32.exe
        127⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Egdqae32.exe
        
        C:\Windows\system32\Egdqae32.exe
        128⤵
        
        PID:4836
        
        C:\Windows\SysWOW64\Ehdmlhcj.exe
        
        C:\Windows\system32\Ehdmlhcj.exe
        129⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Eonehbjg.exe
        
        C:\Windows\system32\Eonehbjg.exe
        130⤵
        Drops file in System32 directory
        
        PID:5264
        
        C:\Windows\SysWOW64\Edknqiho.exe
        
        C:\Windows\system32\Edknqiho.exe
        131⤵
        Drops file in System32 directory
        
        PID:5860
        
        C:\Windows\SysWOW64\Egijmegb.exe
        
        C:\Windows\system32\Egijmegb.exe
        132⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\Emcbio32.exe
        
        C:\Windows\system32\Emcbio32.exe
        133⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Edmjfifl.exe
        
        C:\Windows\system32\Edmjfifl.exe
        134⤵
        Drops file in System32 directory
        
        PID:6136
        
        C:\Windows\SysWOW64\Eaakpm32.exe
        
        C:\Windows\system32\Eaakpm32.exe
        135⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Egnchd32.exe
        
        C:\Windows\system32\Egnchd32.exe
        136⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\Emhldnkj.exe
        
        C:\Windows\system32\Emhldnkj.exe
        137⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Fhmpagkp.exe
        
        C:\Windows\system32\Fhmpagkp.exe
        138⤵
        Drops file in System32 directory
        
        PID:5380
        
        C:\Windows\SysWOW64\Foghnabl.exe
        
        C:\Windows\system32\Foghnabl.exe
        139⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\Fajnfl32.exe
        
        C:\Windows\system32\Fajnfl32.exe
        140⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Fdkggg32.exe
        
        C:\Windows\system32\Fdkggg32.exe
        141⤵
        Drops file in System32 directory
        
        PID:6184
        
        C:\Windows\SysWOW64\Gdncmghi.exe
        
        C:\Windows\system32\Gdncmghi.exe
        142⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Ghipne32.exe
        
        C:\Windows\system32\Ghipne32.exe
        143⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Gochjpho.exe
        
        C:\Windows\system32\Gochjpho.exe
        144⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Gnfhfl32.exe
        
        C:\Windows\system32\Gnfhfl32.exe
        145⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Gnhdkl32.exe
        
        C:\Windows\system32\Gnhdkl32.exe
        146⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Goljqnpd.exe
        
        C:\Windows\system32\Goljqnpd.exe
        147⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Hoogfnnb.exe
        
        C:\Windows\system32\Hoogfnnb.exe
        148⤵
        Drops file in System32 directory
        
        PID:6488
        
        C:\Windows\SysWOW64\Hdlpneli.exe
        
        C:\Windows\system32\Hdlpneli.exe
        149⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Hbpphi32.exe
        
        C:\Windows\system32\Hbpphi32.exe
        150⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Hnfamjqg.exe
        
        C:\Windows\system32\Hnfamjqg.exe
        151⤵
        Drops file in System32 directory
        
        PID:6624
        
        C:\Windows\SysWOW64\Hdpiid32.exe
        
        C:\Windows\system32\Hdpiid32.exe
        152⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Hgoeep32.exe
        
        C:\Windows\system32\Hgoeep32.exe
        153⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Hfpecg32.exe
        
        C:\Windows\system32\Hfpecg32.exe
        154⤵
        Modifies registry class
        
        PID:6752
        
        C:\Windows\SysWOW64\Hdbfodfa.exe
        
        C:\Windows\system32\Hdbfodfa.exe
        155⤵
        Drops file in System32 directory
        
        PID:6800
        
        C:\Windows\SysWOW64\Hgabkoee.exe
        
        C:\Windows\system32\Hgabkoee.exe
        156⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Iohjlmeg.exe
        
        C:\Windows\system32\Iohjlmeg.exe
        157⤵
        Modifies registry class
        
        PID:6896
        
        C:\Windows\SysWOW64\Ihqoeb32.exe
        
        C:\Windows\system32\Ihqoeb32.exe
        158⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Ikokan32.exe
        
        C:\Windows\system32\Ikokan32.exe
        159⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Inmgmijo.exe
        
        C:\Windows\system32\Inmgmijo.exe
        160⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Idgojc32.exe
        
        C:\Windows\system32\Idgojc32.exe
        161⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Ikaggmii.exe
        
        C:\Windows\system32\Ikaggmii.exe
        162⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Ibkpcg32.exe
        
        C:\Windows\system32\Ibkpcg32.exe
        163⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Ighhln32.exe
        
        C:\Windows\system32\Ighhln32.exe
        164⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Inbqhhfj.exe
        
        C:\Windows\system32\Inbqhhfj.exe
        165⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Igjeanmj.exe
        
        C:\Windows\system32\Igjeanmj.exe
        166⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Indmnh32.exe
        
        C:\Windows\system32\Indmnh32.exe
        167⤵
        Drops file in System32 directory
        
        PID:6388
        
        C:\Windows\SysWOW64\Ifleoe32.exe
        
        C:\Windows\system32\Ifleoe32.exe
        168⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Igmagnkg.exe
        
        C:\Windows\system32\Igmagnkg.exe
        169⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Jngjch32.exe
        
        C:\Windows\system32\Jngjch32.exe
        170⤵
        Drops file in System32 directory
        
        PID:6556
        
        C:\Windows\SysWOW64\Jilnqqbj.exe
        
        C:\Windows\system32\Jilnqqbj.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6636
        
        C:\Windows\SysWOW64\Jiokfpph.exe
        
        C:\Windows\system32\Jiokfpph.exe
        172⤵
        Drops file in System32 directory
        
        PID:6720
        
        C:\Windows\SysWOW64\Jkmgblok.exe
        
        C:\Windows\system32\Jkmgblok.exe
        173⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Jnkcogno.exe
        
        C:\Windows\system32\Jnkcogno.exe
        174⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Jfbkpd32.exe
        
        C:\Windows\system32\Jfbkpd32.exe
        175⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Jgdhgmep.exe
        
        C:\Windows\system32\Jgdhgmep.exe
        176⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Jbileede.exe
        
        C:\Windows\system32\Jbileede.exe
        177⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Jgfdmlcm.exe
        
        C:\Windows\system32\Jgfdmlcm.exe
        178⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6276
        
        C:\Windows\SysWOW64\Jnpmjf32.exe
        
        C:\Windows\system32\Jnpmjf32.exe
        179⤵
        Drops file in System32 directory
        
        PID:6392
        
        C:\Windows\SysWOW64\Jfgdkd32.exe
        
        C:\Windows\system32\Jfgdkd32.exe
        180⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Kldmckic.exe
        
        C:\Windows\system32\Kldmckic.exe
        181⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Kfjapcii.exe
        
        C:\Windows\system32\Kfjapcii.exe
        182⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Kelalp32.exe
        
        C:\Windows\system32\Kelalp32.exe
        183⤵
        Modifies registry class
        
        PID:6784
        
        C:\Windows\SysWOW64\Kgknhl32.exe
        
        C:\Windows\system32\Kgknhl32.exe
        184⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Klfjijgq.exe
        
        C:\Windows\system32\Klfjijgq.exe
        185⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Knefeffd.exe
        
        C:\Windows\system32\Knefeffd.exe
        186⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Khmknk32.exe
        
        C:\Windows\system32\Khmknk32.exe
        187⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Kngcje32.exe
        
        C:\Windows\system32\Kngcje32.exe
        188⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Keakgpko.exe
        
        C:\Windows\system32\Keakgpko.exe
        189⤵
        Drops file in System32 directory
        
        PID:6768
        
        C:\Windows\SysWOW64\Khpgckkb.exe
        
        C:\Windows\system32\Khpgckkb.exe
        190⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Knippe32.exe
        
        C:\Windows\system32\Knippe32.exe
        191⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Kechmoil.exe
        
        C:\Windows\system32\Kechmoil.exe
        192⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Kpiljh32.exe
        
        C:\Windows\system32\Kpiljh32.exe
        193⤵
        Modifies registry class
        
        PID:6948
        
        C:\Windows\SysWOW64\Kfcdfbqo.exe
        
        C:\Windows\system32\Kfcdfbqo.exe
        194⤵
        Drops file in System32 directory
        
        PID:6168
        
        C:\Windows\SysWOW64\Llpmoiof.exe
        
        C:\Windows\system32\Llpmoiof.exe
        195⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Lfealaol.exe
        
        C:\Windows\system32\Lfealaol.exe
        196⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Lhfmdj32.exe
        
        C:\Windows\system32\Lhfmdj32.exe
        197⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\Lifjnm32.exe
        
        C:\Windows\system32\Lifjnm32.exe
        198⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Lbqklb32.exe
        
        C:\Windows\system32\Lbqklb32.exe
        199⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4888
        
        C:\Windows\SysWOW64\Mhppji32.exe
        
        C:\Windows\system32\Mhppji32.exe
        200⤵
        Drops file in System32 directory
        
        PID:7036
        
        C:\Windows\SysWOW64\Mojhgbdl.exe
        
        C:\Windows\system32\Mojhgbdl.exe
        201⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Mbedga32.exe
        
        C:\Windows\system32\Mbedga32.exe
        202⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Mlnipg32.exe
        
        C:\Windows\system32\Mlnipg32.exe
        203⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Mbhamajc.exe
        
        C:\Windows\system32\Mbhamajc.exe
        204⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Mhdjehhj.exe
        
        C:\Windows\system32\Mhdjehhj.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7316
        
        C:\Windows\SysWOW64\Mpnnle32.exe
        
        C:\Windows\system32\Mpnnle32.exe
        206⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Mleoafmn.exe
        
        C:\Windows\system32\Mleoafmn.exe
        207⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Nlglfe32.exe
        
        C:\Windows\system32\Nlglfe32.exe
        208⤵
        Modifies registry class
        
        PID:7448
        
        C:\Windows\SysWOW64\Nhnlkfpp.exe
        
        C:\Windows\system32\Nhnlkfpp.exe
        209⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Ngomin32.exe
        
        C:\Windows\system32\Ngomin32.exe
        210⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Nedjjj32.exe
        
        C:\Windows\system32\Nedjjj32.exe
        211⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Neffpj32.exe
        
        C:\Windows\system32\Neffpj32.exe
        212⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Oghppm32.exe
        
        C:\Windows\system32\Oghppm32.exe
        213⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        214⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Oocddono.exe
        
        C:\Windows\system32\Oocddono.exe
        215⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Ogklelna.exe
        
        C:\Windows\system32\Ogklelna.exe
        216⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Oenlqi32.exe
        
        C:\Windows\system32\Oenlqi32.exe
        217⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Olgemcli.exe
        
        C:\Windows\system32\Olgemcli.exe
        218⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Oofaiokl.exe
        
        C:\Windows\system32\Oofaiokl.exe
        219⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Oileggkb.exe
        
        C:\Windows\system32\Oileggkb.exe
        220⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Ogpepl32.exe
        
        C:\Windows\system32\Ogpepl32.exe
        221⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Ojnblg32.exe
        
        C:\Windows\system32\Ojnblg32.exe
        222⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Ollnhb32.exe
        
        C:\Windows\system32\Ollnhb32.exe
        223⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Ookjdn32.exe
        
        C:\Windows\system32\Ookjdn32.exe
        224⤵
        Drops file in System32 directory
        
        PID:8140
        
        C:\Windows\SysWOW64\Pgbbek32.exe
        
        C:\Windows\system32\Pgbbek32.exe
        225⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Phcomcng.exe
        
        C:\Windows\system32\Phcomcng.exe
        226⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Ploknb32.exe
        
        C:\Windows\system32\Ploknb32.exe
        227⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Pcicklnn.exe
        
        C:\Windows\system32\Pcicklnn.exe
        228⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Pfgogh32.exe
        
        C:\Windows\system32\Pfgogh32.exe
        229⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Pjbkgfej.exe
        
        C:\Windows\system32\Pjbkgfej.exe
        230⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Plagcbdn.exe
        
        C:\Windows\system32\Plagcbdn.exe
        231⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Pckppl32.exe
        
        C:\Windows\system32\Pckppl32.exe
        232⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Pjehmfch.exe
        
        C:\Windows\system32\Pjehmfch.exe
        233⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Phhhhc32.exe
        
        C:\Windows\system32\Phhhhc32.exe
        234⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Pflibgil.exe
        
        C:\Windows\system32\Pflibgil.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7824
        
        C:\Windows\SysWOW64\Pfnegggi.exe
        
        C:\Windows\system32\Pfnegggi.exe
        236⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Plhnda32.exe
        
        C:\Windows\system32\Plhnda32.exe
        237⤵
        Drops file in System32 directory
        
        PID:7964
        
        C:\Windows\SysWOW64\Qcbfakec.exe
        
        C:\Windows\system32\Qcbfakec.exe
        238⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Qgnbaj32.exe
        
        C:\Windows\system32\Qgnbaj32.exe
        239⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Qjlnnemp.exe
        
        C:\Windows\system32\Qjlnnemp.exe
        240⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Qhonib32.exe
        
        C:\Windows\system32\Qhonib32.exe
        241⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Qqffjo32.exe
        
        C:\Windows\system32\Qqffjo32.exe
        242⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Qcdbfk32.exe
        
        C:\Windows\system32\Qcdbfk32.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7416
        
        C:\Windows\SysWOW64\Qjnkcekm.exe
        
        C:\Windows\system32\Qjnkcekm.exe
        244⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Qlmgopjq.exe
        
        C:\Windows\system32\Qlmgopjq.exe
        245⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Aokcklid.exe
        
        C:\Windows\system32\Aokcklid.exe
        246⤵
        Drops file in System32 directory
        
        PID:7660
        
        C:\Windows\SysWOW64\Acgolj32.exe
        
        C:\Windows\system32\Acgolj32.exe
        247⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\Ahchda32.exe
        
        C:\Windows\system32\Ahchda32.exe
        248⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Ajcdnd32.exe
        
        C:\Windows\system32\Ajcdnd32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7800
        
        C:\Windows\SysWOW64\Aihaoqlp.exe
        
        C:\Windows\system32\Aihaoqlp.exe
        250⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Aobilkcl.exe
        
        C:\Windows\system32\Aobilkcl.exe
        251⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Aflaie32.exe
        
        C:\Windows\system32\Aflaie32.exe
        252⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Aijnep32.exe
        
        C:\Windows\system32\Aijnep32.exe
        253⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Aqaffn32.exe
        
        C:\Windows\system32\Aqaffn32.exe
        254⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Aglnbhal.exe
        
        C:\Windows\system32\Aglnbhal.exe
        255⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Ajjjocap.exe
        
        C:\Windows\system32\Ajjjocap.exe
        256⤵
        Drops file in System32 directory
        
        PID:1276
        
        C:\Windows\SysWOW64\Bcbohigp.exe
        
        C:\Windows\system32\Bcbohigp.exe
        257⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Bmkcqn32.exe
        
        C:\Windows\system32\Bmkcqn32.exe
        258⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Bfchidda.exe
        
        C:\Windows\system32\Bfchidda.exe
        259⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Bjaqpbkh.exe
        
        C:\Windows\system32\Bjaqpbkh.exe
        260⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Bjcmebie.exe
        
        C:\Windows\system32\Bjcmebie.exe
        261⤵
        Modifies registry class
        
        PID:7676
        
        C:\Windows\SysWOW64\Bggnof32.exe
        
        C:\Windows\system32\Bggnof32.exe
        262⤵
        Drops file in System32 directory
        
        PID:4216
        
        C:\Windows\SysWOW64\Bjfjka32.exe
        
        C:\Windows\system32\Bjfjka32.exe
        263⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Bihjfnmm.exe
        
        C:\Windows\system32\Bihjfnmm.exe
        264⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Cqpbglno.exe
        
        C:\Windows\system32\Cqpbglno.exe
        265⤵
        Drops file in System32 directory
        
        PID:7396
        
        C:\Windows\SysWOW64\Cpbbch32.exe
        
        C:\Windows\system32\Cpbbch32.exe
        266⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\Cpeohh32.exe
        
        C:\Windows\system32\Cpeohh32.exe
        267⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        268⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Cpglnhad.exe
        
        C:\Windows\system32\Cpglnhad.exe
        269⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\Cjmpkqqj.exe
        
        C:\Windows\system32\Cjmpkqqj.exe
        270⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\Cceddf32.exe
        
        C:\Windows\system32\Cceddf32.exe
        271⤵
        Drops file in System32 directory
        
        PID:8200
        
        C:\Windows\SysWOW64\Cibmlmeb.exe
        
        C:\Windows\system32\Cibmlmeb.exe
        272⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Cpleig32.exe
        
        C:\Windows\system32\Cpleig32.exe
        273⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Cgcmjd32.exe
        
        C:\Windows\system32\Cgcmjd32.exe
        274⤵
        Modifies registry class
        
        PID:8336
        
        C:\Windows\SysWOW64\Dakacjdb.exe
        
        C:\Windows\system32\Dakacjdb.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8376
        
        C:\Windows\SysWOW64\Djdflp32.exe
        
        C:\Windows\system32\Djdflp32.exe
        276⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Dannij32.exe
        
        C:\Windows\system32\Dannij32.exe
        277⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Dfmcfp32.exe
        
        C:\Windows\system32\Dfmcfp32.exe
        278⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Dpehof32.exe
        
        C:\Windows\system32\Dpehof32.exe
        279⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Edemkd32.exe
        
        C:\Windows\system32\Edemkd32.exe
        280⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Edhjqc32.exe
        
        C:\Windows\system32\Edhjqc32.exe
        281⤵
        Drops file in System32 directory
        
        PID:8644
        
        C:\Windows\SysWOW64\Eidbij32.exe
        
        C:\Windows\system32\Eidbij32.exe
        282⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Epokedmj.exe
        
        C:\Windows\system32\Epokedmj.exe
        283⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Efhcbodf.exe
        
        C:\Windows\system32\Efhcbodf.exe
        284⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Filiii32.exe
        
        C:\Windows\system32\Filiii32.exe
        285⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8820
        
        C:\Windows\SysWOW64\Faenpf32.exe
        
        C:\Windows\system32\Faenpf32.exe
        286⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Fgbfhmll.exe
        
        C:\Windows\system32\Fgbfhmll.exe
        287⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        288⤵
        Modifies registry class
        
        PID:8952
        
        C:\Windows\SysWOW64\Fhabbp32.exe
        
        C:\Windows\system32\Fhabbp32.exe
        289⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Fkpool32.exe
        
        C:\Windows\system32\Fkpool32.exe
        290⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Fibojhim.exe
        
        C:\Windows\system32\Fibojhim.exe
        291⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Fpmggb32.exe
        
        C:\Windows\system32\Fpmggb32.exe
        292⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Fhdohp32.exe
        
        C:\Windows\system32\Fhdohp32.exe
        293⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Falcae32.exe
        
        C:\Windows\system32\Falcae32.exe
        294⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Gkdhjknm.exe
        
        C:\Windows\system32\Gkdhjknm.exe
        295⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        296⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Ghhhcomg.exe
        
        C:\Windows\system32\Ghhhcomg.exe
        297⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Hhbkinel.exe
        
        C:\Windows\system32\Hhbkinel.exe
        298⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Hhdhon32.exe
        
        C:\Windows\system32\Hhdhon32.exe
        299⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Hjedffig.exe
        
        C:\Windows\system32\Hjedffig.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5336
        
        C:\Windows\SysWOW64\Hdkidohn.exe
        
        C:\Windows\system32\Hdkidohn.exe
        301⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Hgiepjga.exe
        
        C:\Windows\system32\Hgiepjga.exe
        302⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Hnhghcki.exe
        
        C:\Windows\system32\Hnhghcki.exe
        303⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Hpfcdojl.exe
        
        C:\Windows\system32\Hpfcdojl.exe
        304⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8852
        
        C:\Windows\SysWOW64\Igqkqiai.exe
        
        C:\Windows\system32\Igqkqiai.exe
        305⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Ijogmdqm.exe
        
        C:\Windows\system32\Ijogmdqm.exe
        306⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Injcmc32.exe
        
        C:\Windows\system32\Injcmc32.exe
        307⤵
        Modifies registry class
        
        PID:9048
        
        C:\Windows\SysWOW64\Iqipio32.exe
        
        C:\Windows\system32\Iqipio32.exe
        308⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Ihphkl32.exe
        
        C:\Windows\system32\Ihphkl32.exe
        309⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Inmpcc32.exe
        
        C:\Windows\system32\Inmpcc32.exe
        310⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Iqklon32.exe
        
        C:\Windows\system32\Iqklon32.exe
        311⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Inomhbeq.exe
        
        C:\Windows\system32\Inomhbeq.exe
        312⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        313⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        314⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Jbaojpgb.exe
        
        C:\Windows\system32\Jbaojpgb.exe
        315⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Jdpkflfe.exe
        
        C:\Windows\system32\Jdpkflfe.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8900
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        317⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Jbdlop32.exe
        
        C:\Windows\system32\Jbdlop32.exe
        318⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Jdbhkk32.exe
        
        C:\Windows\system32\Jdbhkk32.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8244
        
        C:\Windows\SysWOW64\Jklphekp.exe
        
        C:\Windows\system32\Jklphekp.exe
        320⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\Jnkldqkc.exe
        
        C:\Windows\system32\Jnkldqkc.exe
        321⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Jhpqaiji.exe
        
        C:\Windows\system32\Jhpqaiji.exe
        322⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Jnmijq32.exe
        
        C:\Windows\system32\Jnmijq32.exe
        323⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Jdgafjpn.exe
        
        C:\Windows\system32\Jdgafjpn.exe
        324⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Jjdjoane.exe
        
        C:\Windows\system32\Jjdjoane.exe
        325⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        326⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\Kghjhemo.exe
        
        C:\Windows\system32\Kghjhemo.exe
        327⤵
        Modifies registry class
        
        PID:8504
        
        C:\Windows\SysWOW64\Kqpoakco.exe
        
        C:\Windows\system32\Kqpoakco.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8836
        
        C:\Windows\SysWOW64\Kkfcndce.exe
        
        C:\Windows\system32\Kkfcndce.exe
        329⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Kndojobi.exe
        
        C:\Windows\system32\Kndojobi.exe
        330⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8500
        
        C:\Windows\SysWOW64\Kkhpdcab.exe
        
        C:\Windows\system32\Kkhpdcab.exe
        331⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Kbbhqn32.exe
        
        C:\Windows\system32\Kbbhqn32.exe
        332⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Lajagj32.exe
        
        C:\Windows\system32\Lajagj32.exe
        333⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Leenhhdn.exe
        
        C:\Windows\system32\Leenhhdn.exe
        334⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Lgcjdd32.exe
        
        C:\Windows\system32\Lgcjdd32.exe
        335⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Lnnbqnjn.exe
        
        C:\Windows\system32\Lnnbqnjn.exe
        336⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9256
        
        C:\Windows\SysWOW64\Licfngjd.exe
        
        C:\Windows\system32\Licfngjd.exe
        337⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Lkabjbih.exe
        
        C:\Windows\system32\Lkabjbih.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9348
        
        C:\Windows\SysWOW64\Ljdceo32.exe
        
        C:\Windows\system32\Ljdceo32.exe
        339⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        340⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Lieccf32.exe
        
        C:\Windows\system32\Lieccf32.exe
        341⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Lelchgne.exe
        
        C:\Windows\system32\Lelchgne.exe
        342⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        343⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        344⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Llhikacp.exe
        
        C:\Windows\system32\Llhikacp.exe
        345⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Mhoipb32.exe
        
        C:\Windows\system32\Mhoipb32.exe
        346⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        347⤵
        Modifies registry class
        
        PID:9736
        
        C:\Windows\SysWOW64\Mjpbam32.exe
        
        C:\Windows\system32\Mjpbam32.exe
        348⤵
        Modifies registry class
        
        PID:9780
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        349⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Miaboe32.exe
        
        C:\Windows\system32\Miaboe32.exe
        350⤵
        Drops file in System32 directory
        
        PID:9868
        
        C:\Windows\SysWOW64\Mldhfpib.exe
        
        C:\Windows\system32\Mldhfpib.exe
        351⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        352⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Nemmoe32.exe
        
        C:\Windows\system32\Nemmoe32.exe
        353⤵
        Modifies registry class
        
        PID:9992
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        354⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        355⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Nhmeapmd.exe
        
        C:\Windows\system32\Nhmeapmd.exe
        356⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Nbcjnilj.exe
        
        C:\Windows\system32\Nbcjnilj.exe
        357⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        358⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        359⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Nahgoe32.exe
        
        C:\Windows\system32\Nahgoe32.exe
        360⤵
        Drops file in System32 directory
        
        PID:9272
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9328
        
        C:\Windows\SysWOW64\Nhbolp32.exe
        
        C:\Windows\system32\Nhbolp32.exe
        362⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        363⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        364⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        365⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Olgncmim.exe
        
        C:\Windows\system32\Olgncmim.exe
        366⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        367⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Plndcl32.exe
        
        C:\Windows\system32\Plndcl32.exe
        368⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Pchlpfjb.exe
        
        C:\Windows\system32\Pchlpfjb.exe
        369⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        370⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Pcjiff32.exe
        
        C:\Windows\system32\Pcjiff32.exe
        371⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        372⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        373⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Pcmeke32.exe
        
        C:\Windows\system32\Pcmeke32.exe
        374⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        375⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9296
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        376⤵
        Modifies registry class
        
        PID:9416
        
        C:\Windows\SysWOW64\Qhngolpo.exe
        
        C:\Windows\system32\Qhngolpo.exe
        377⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Qebhhp32.exe
        
        C:\Windows\system32\Qebhhp32.exe
        378⤵
        Modifies registry class
        
        PID:9632
        
        C:\Windows\SysWOW64\Afgacokc.exe
        
        C:\Windows\system32\Afgacokc.exe
        379⤵
        Drops file in System32 directory
        
        PID:9716
        
        C:\Windows\SysWOW64\Ahenokjf.exe
        
        C:\Windows\system32\Ahenokjf.exe
        380⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9812
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        381⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9960
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        382⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Bjlpjm32.exe
        
        C:\Windows\system32\Bjlpjm32.exe
        383⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        384⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Bmofagfp.exe
        
        C:\Windows\system32\Bmofagfp.exe
        385⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Bkdcbd32.exe
        
        C:\Windows\system32\Bkdcbd32.exe
        386⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Bbnkonbd.exe
        
        C:\Windows\system32\Bbnkonbd.exe
        387⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Cfigpm32.exe
        
        C:\Windows\system32\Cfigpm32.exe
        388⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        389⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        390⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        391⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Cfldelik.exe
        
        C:\Windows\system32\Cfldelik.exe
        392⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        393⤵
        
        PID:10124
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        394⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        395⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        396⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        397⤵
        Drops file in System32 directory
        
        PID:9948
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        398⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Efhlhh32.exe
        
        C:\Windows\system32\Efhlhh32.exe
        399⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        400⤵
        Modifies registry class
        
        PID:10288
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        401⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Fbhpch32.exe
        
        C:\Windows\system32\Fbhpch32.exe
        402⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Fjohde32.exe
        
        C:\Windows\system32\Fjohde32.exe
        403⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10440
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10500
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        405⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        406⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        407⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Gfheof32.exe
        
        C:\Windows\system32\Gfheof32.exe
        408⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        409⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        410⤵
        Drops file in System32 directory
        
        PID:10772
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        411⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        412⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        413⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        414⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        415⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        416⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        417⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        418⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        419⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        420⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        421⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        422⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        423⤵
        
        PID:3964
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        424⤵
        Drops file in System32 directory
        
        PID:10428
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        425⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10496
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        426⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\Idcepgmg.exe
        
        C:\Windows\system32\Idcepgmg.exe
        427⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        428⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        429⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        430⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        431⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        432⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        433⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        434⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\Ilccoh32.exe
        
        C:\Windows\system32\Ilccoh32.exe
        435⤵
        Drops file in System32 directory
        
        PID:11224
        
        C:\Windows\SysWOW64\Idkkpf32.exe
        
        C:\Windows\system32\Idkkpf32.exe
        436⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Igigla32.exe
        
        C:\Windows\system32\Igigla32.exe
        437⤵
        Modifies registry class
        
        PID:10372
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        438⤵
        
        PID:876
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        439⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        440⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        441⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Jdodkebj.exe
        
        C:\Windows\system32\Jdodkebj.exe
        442⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        443⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        444⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        445⤵
        Modifies registry class
        
        PID:11116
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        446⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        447⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        448⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Jlobkg32.exe
        
        C:\Windows\system32\Jlobkg32.exe
        449⤵
        Modifies registry class
        
        PID:1632
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        450⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        451⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        452⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        453⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        454⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Kcndbp32.exe
        
        C:\Windows\system32\Kcndbp32.exe
        455⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        456⤵
        
        PID:11128
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        457⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        458⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        459⤵
        
        PID:3268
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        460⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        461⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        462⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        463⤵
        Drops file in System32 directory
        
        PID:10904
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        464⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        465⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        466⤵
        Drops file in System32 directory
        
        PID:2160
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        467⤵
        
        PID:1792
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        468⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        469⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        470⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        471⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        472⤵
        
        PID:968
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        473⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4116
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        474⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        475⤵
        Modifies registry class
        
        PID:1772
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        476⤵
        Drops file in System32 directory
        
        PID:1688
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        477⤵
        
        PID:676
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        478⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        479⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        480⤵
        Modifies registry class
        
        PID:4776
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        481⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        482⤵
        
        PID:1080
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        483⤵
        
        PID:440
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        484⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        485⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        486⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        487⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        488⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        489⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        490⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3004
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        491⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        492⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        493⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3464
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        494⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        495⤵
        
        PID:868
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        496⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        497⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        498⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:224
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        499⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        500⤵
        
        PID:3736
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        501⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        502⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10356
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        503⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        504⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3144
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        505⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        506⤵
        Drops file in System32 directory
        
        PID:2496
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        507⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        508⤵
        
        PID:2312
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        509⤵
        
        PID:208
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        510⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        511⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        512⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        513⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        514⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        515⤵
        Modifies registry class
        
        PID:840
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        516⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\Ponfka32.exe
        
        C:\Windows\system32\Ponfka32.exe
        517⤵
        
        PID:384
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        518⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        519⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        520⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        521⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        522⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        523⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4880
        
        C:\Windows\SysWOW64\Qachgk32.exe
        
        C:\Windows\system32\Qachgk32.exe
        524⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        525⤵
        Modifies registry class
        
        PID:2244
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        526⤵
        Modifies registry class
        
        PID:1136
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        527⤵
        Modifies registry class
        
        PID:5196
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        528⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4604
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        529⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        530⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        531⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        532⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        533⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        534⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        535⤵
        Modifies registry class
        
        PID:3032
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        536⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        537⤵
        
        PID:4064
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        538⤵
        Modifies registry class
        
        PID:2076
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        539⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        540⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        541⤵
        
        PID:512
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        542⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        543⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        544⤵
        
        PID:1752
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        545⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        546⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        547⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        548⤵
        Modifies registry class
        
        PID:3132
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        549⤵
        Drops file in System32 directory
        
        PID:5872
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        550⤵
        Modifies registry class
        
        PID:6000
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        551⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        552⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        553⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        554⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        555⤵
        Modifies registry class
        
        PID:6040
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        556⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        557⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        558⤵
        
        PID:1088
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        559⤵
        Drops file in System32 directory
        
        PID:5728
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        560⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        561⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        562⤵
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Dfglfdkb.exe
        
        C:\Windows\system32\Dfglfdkb.exe
        563⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        564⤵
        
        PID:2824
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        565⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Dkceokii.exe
        
        C:\Windows\system32\Dkceokii.exe
        566⤵
        Drops file in System32 directory
        
        PID:4992
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        567⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        568⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        569⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        570⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        571⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        572⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        573⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        574⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        575⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        576⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        577⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        578⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        579⤵
        Drops file in System32 directory
        
        PID:5400
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        580⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        581⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        582⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        583⤵
        Drops file in System32 directory
        
        PID:5804
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        584⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        585⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Efjbcakl.exe
        
        C:\Windows\system32\Efjbcakl.exe
        586⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        587⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        588⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        589⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        590⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5852
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        591⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        592⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        593⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        594⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        595⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        596⤵
        Modifies registry class
        
        PID:5712
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        597⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        598⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        599⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        600⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        601⤵
        Modifies registry class
        
        PID:6244
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        602⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        603⤵
        Modifies registry class
        
        PID:6196
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        604⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        605⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        606⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5896
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        607⤵
        Drops file in System32 directory
        
        PID:11312
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        608⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        609⤵
        
        PID:11408
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        610⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        611⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        612⤵
        
        PID:11544
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        613⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        614⤵
        
        PID:11652
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        615⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        616⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        617⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        618⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        619⤵
        
        PID:11884
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        620⤵
        Drops file in System32 directory
        
        PID:11924
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        621⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        622⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\Hmpcbhji.exe
        
        C:\Windows\system32\Hmpcbhji.exe
        623⤵
        
        PID:12076
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        624⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        625⤵
        Drops file in System32 directory
        
        PID:12164
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        626⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        627⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        628⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        629⤵
        
        PID:11332
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        630⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        631⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        632⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        633⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        634⤵
        
        PID:11580
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        635⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        636⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11720
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        637⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11816
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        638⤵
        
        PID:11872
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        639⤵
        Drops file in System32 directory
        
        PID:11936
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        640⤵
        
        PID:11976
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        641⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        642⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12112
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        643⤵
        Modifies registry class
        
        PID:12180
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        644⤵
        Drops file in System32 directory
        
        PID:12244
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        645⤵
        
        PID:12284
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        646⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        647⤵
        Modifies registry class
        
        PID:11372
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        648⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        649⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        650⤵
        Drops file in System32 directory
        
        PID:6088
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        651⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        652⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        653⤵
        
        PID:11772
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        654⤵
        Drops file in System32 directory
        
        PID:11840
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        655⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        656⤵
        
        PID:11896
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        657⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        658⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6576
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        659⤵
        
        PID:12152
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        660⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        661⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        662⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11268
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        663⤵
        Drops file in System32 directory
        
        PID:6904
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        664⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        665⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        666⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7044
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        667⤵
        Modifies registry class
        
        PID:11588
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        668⤵
        Modifies registry class
        
        PID:6308
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        669⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        670⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        671⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        672⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        673⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        674⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        675⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        676⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        677⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12196
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        678⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        679⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        680⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        681⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        682⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        683⤵
        
        PID:11420
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        684⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        685⤵
        Modifies registry class
        
        PID:908
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        686⤵
        Drops file in System32 directory
        
        PID:12148
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        687⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        688⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        689⤵
        Drops file in System32 directory
        
        PID:6392
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        690⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        691⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        692⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        693⤵
        Drops file in System32 directory
        
        PID:4888
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        694⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6788
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        695⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        696⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        697⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        698⤵
        
        PID:11736
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        699⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        700⤵
        Drops file in System32 directory
        
        PID:6620
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        701⤵
        Modifies registry class
        
        PID:8116
        
        C:\Windows\SysWOW64\Bgnffj32.exe
        
        C:\Windows\system32\Bgnffj32.exe
        702⤵
        Modifies registry class
        
        PID:6432
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        703⤵
        Modifies registry class
        
        PID:2168
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        704⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        705⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7656
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        706⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        707⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        708⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        709⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        710⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        711⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        712⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        713⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        714⤵
        Modifies registry class
        
        PID:7460
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        715⤵
        
        PID:11340
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        716⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        717⤵
        Modifies registry class
        
        PID:6480
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        718⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        719⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7724
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        720⤵
        
        PID:11608
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        721⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        722⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        723⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        724⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\Dkqaoe32.exe
        
        C:\Windows\system32\Dkqaoe32.exe
        725⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7660 -s 400
        726⤵
        Program crash
        
        PID:3680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 7660 -ip 7660
1⤵
PID:6932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bgehcmmm.exe

Filesize
64KB

MD5
5ece953c0461de2384e990ad90d12478

SHA1
2834683002093057e08392d63689dbba91aeccc6

SHA256
fe9a11123bdf0c899855d7f8e1ffa733a78039f1f771e42beda8a4ce8f8c3a3f

SHA512
b567a63ef122199155146e0b83da42230d7d85e1eadc9dc6b485a556dd08f7bda2a193f852b5514d08fb718149b9218776fd52d341700c28a73b57d5455d6a97

Download Submit
C:\Windows\SysWOW64\Bnkgeg32.exe

Filesize
64KB

MD5
689b822f8cc9c3c2c21176764037e980

SHA1
3f9214e905d1d8ad6e6cdb399cfaaeff35b88d9d

SHA256
fd807e2866a7b5f4ec264b48f3fde143735a82f174189c5b548a362a669d382d

SHA512
04d81be89ff77ba1dc11004527bba9cab11d9d378a624270586d0936cbc7ccf6fb47aaaab39972b9bbfccc3a4e3774f4ca82b4f4a800c1f09eb112aae8fc80b9

Download Submit
C:\Windows\SysWOW64\Daekdooc.exe

Filesize
64KB

MD5
9c734cdd9b05b706b57c4ee980e803f4

SHA1
e9cafe459660bbcb43ce2aac7b0d1f057ee9a7ab

SHA256
1cd19dea9d5e72e7fa17426b5db94f6bce543f12405ad80b05b5944f1c41dd75

SHA512
2cd53dc5e3b85ba7b236e5830c1b22886c272c14874bb0dd8a43d6fb2a0af8887d2a30c44b8ad536e9b57395b7007de52424229bf14e02a444af5b1f1d9a83ea

Download Submit
C:\Windows\SysWOW64\Dpnkdq32.exe

Filesize
64KB

MD5
b3d26bd96c4e9bac649d861a389f3ca7

SHA1
24dea2854833ef143baae84f7aee97d40b0e5b36

SHA256
6ed6da9efa83c30dcc8552a8933b30422fe243408ae9e3c86f9c8df2f452f7a6

SHA512
7278e79c578dd8dc71aafdfd7fc1f752af571e7e3dc65640055698cc78ef1cacaf6c2433adb1b0616285ed040065d1edfef0ec47fa03f13117325938411b667e

Download Submit
C:\Windows\SysWOW64\Ebjcajjd.exe

Filesize
64KB

MD5
3dfc4e525e67ca53c4ffb0d0a988c4f1

SHA1
4cc50c5249051c5c11784f4a2cabecbacf04cece

SHA256
127c56e76bf5fc46af082da8dbc27d02926b6924197e135fa1f4231953bf2b01

SHA512
c78908382c32db2f7004355f9010d2a2e89a1d487415c79c8b50c596b14f0b26a28b66941e9ea06d17c641e7690f86a454a818e4de285294f2ab787bf6dc6f6d

Download Submit
C:\Windows\SysWOW64\Egnchd32.exe

Filesize
64KB

MD5
d153c190cc9cef820a5ec85b06ba91cf

SHA1
41742647cdcd3cf06bcede4f98891dd4b7b9958f

SHA256
4f2cb804d6565d609c36ebf19fbfeea94eef2a9b6b7f02cc502ef128d7a0ed1d

SHA512
15ee00e16264cf30a55637af7c4b63239a908bb8e615d4564d5a69bd595b9632405adc08d388d03652d8cfb75767f6c797e7a3125306807752bbc1e2bc4e0be1

Download Submit
C:\Windows\SysWOW64\Fajnfl32.exe

Filesize
64KB

MD5
f2ea738d70ee2fc6550bf0f63fa6fc25

SHA1
eaa2b414faa1b5fa6ff1de025f69ada97477cbf3

SHA256
96f38e6f3fea72cbf8ebce18b7105f6e01cf5d46c602834ea7cf2f40e1cc30e2

SHA512
46789f221e89b8d3fe1d9b68addd5afcc07e707f4fb1118479c6d2676a6f0c2a3cb233fe51ef796ee2570066bdca9262cc00e6ebcd64ffa783e9010fa3c1fa3f

Download Submit
C:\Windows\SysWOW64\Ffaong32.exe

Filesize
64KB

MD5
fbea2c7d5df35047bd0c0e628d8b8f81

SHA1
bded64a14da1f36551a716d66d47e3661c868ade

SHA256
23f5b9f430aa7e28ba7d03c4a3d4b82e02a5f6aed86cdc0b78c20ad7674d691b

SHA512
acdc29b24e2f890f6f466d4319ea28333d369cc16654bbdc5e81362cf4b69620f4199f702de946d9f7028f1c99cdf71936669d6e11c3beb2bb14c9c16ea6a108

Download Submit
C:\Windows\SysWOW64\Gkmdecbg.exe

Filesize
64KB

MD5
120d7a28174f31134842d956021beb4f

SHA1
ff3f17ed4cf930c27ef6d7b31821e068cee78cc0

SHA256
143f4a411675c8b4f6abded4bdb465da0f9d505f73c931c6fa8c11f547880f1d

SHA512
073cce9662d07e27e0e3b7467cb1e4ec65f5a76f36802050b1d7a0cfd496167e7b7f287a8f28a3e99e803a14f927f91d933109554284c98558d220cacc4373b2

Download Submit
C:\Windows\SysWOW64\Hbeqmoji.exe

Filesize
64KB

MD5
5e8bf29779930a4e8e821e2285dd2b19

SHA1
03943da540bd156afe51f0aedb44a0a2fa61d59f

SHA256
4b36fd2b1c4cfeae779ecfd0e00c57eeb760ec6644f4b9d6c21de7392e559815

SHA512
ca1a4d7924fcec53714cd3474728edba5cfa292aa3b8cc318db6d4073c7ea4ea39c6faef4e760619ef9b05e7f4057089fcaf58a3ef9cdf57162d0574a9889f8b

Download Submit
C:\Windows\SysWOW64\Hcdmga32.exe

Filesize
64KB

MD5
4e8c64a5a897faf10db010f38dcd94f4

SHA1
fc7272ee722a09ac83fe365efafe59d54dbc4219

SHA256
70b85f1afa33068901658ad4e66dda3907188dd2831295e6e752b79615013d51

SHA512
1555073c9a2ffa9b62ab6fa4003db0e7b9b22791df0fbaf3f6ab1e40d46d11d9f4b8a8685c37d808a1a5c96b9ec67480fdc10480b10afcd1fb388ecf23ddec1c

Download Submit
C:\Windows\SysWOW64\Hhbkinel.exe

Filesize
64KB

MD5
dcb59d7a74ec23d07c555b9429b55874

SHA1
930695c8452b66586d6a3f8b9ec951b7774aa5c7

SHA256
ebc63b51fe959c9276dad06d22270e583e253793829433e6fab15b91d8bb6703

SHA512
5cb99aedfa62b145f6feb030de9acb3ac93634550eca410c08c71d7b0f0c9ccc2c9052acf67c4ee28000d0ec3b70a2a1713585ce2443a82938af5d5927a4ddd6

Download Submit
C:\Windows\SysWOW64\Hmjdjgjo.exe

Filesize
64KB

MD5
76941cfa937a6abf02cc93d6f9ccbd64

SHA1
30d578521dd9fee4feb20ad592b3214458fcba2f

SHA256
3606aed9d40c1b5cc86ec41aaf2d62316cde620364d5a77f8f9112d355dd2c0c

SHA512
67330d0cec6570f2daedebb02a084191a72a62042c5bd3462b0742ae7252fd4407284f24679145c256f089edc7291c37b8182cecbebaf2327649f51ad3e29266

Download Submit
C:\Windows\SysWOW64\Hplicjok.exe

Filesize
64KB

MD5
bfe13dea3f1a300adc345d5c2455e450

SHA1
e6a4bcd7dfcd0435f99364ec3c4f46567153542f

SHA256
30feb9a7b6d8c9ffbcd13ca8ce7a82e440f40199a0acf2550da87ca4c3aeabd2

SHA512
6b0ac0756d775af1aff414c1391aa5ad773aeeb6a17ab93bc54bbd9fe5dc8948ae4be344b13cd122daab107bbe2664ff20b138993e2d5d6541cadd20787a6756

Download Submit
C:\Windows\SysWOW64\Ibjjhn32.exe

Filesize
64KB

MD5
9a6590c31f38ef665e3e3afb07400703

SHA1
c4d596b89b7c9e5aec5adca13823d82889c777c4

SHA256
bff7d2f00d478d9e7d0cafc8ce4319783723379c713c7da7d38388146a93d476

SHA512
ac1f48ce2d0a6626d472193009c30868eb530bfb89e5e1da8828edefb1aea9050185d2cf69c07de257cc08765ae71f4fde06cf45885b58fdb51aed082724dd80

Download Submit
C:\Windows\SysWOW64\Iblfnn32.exe

Filesize
64KB

MD5
33561ee7e13981c1722597ef2beac642

SHA1
14792c45ce8083bf2949b40b3ac4f72c7dd0c4f1

SHA256
6fda4eb08742671d66d1837df2f242166e0c825b68bbaa8d110fa1441c3a5304

SHA512
ee9943aede03dd7d1d4e3760cd88639dcc21e60b9e875e9c0c823b43d29fdbabc585b5ade0332d4b03c66bf692b0ab8ba4458d4f77d7842b933a4521c6052c1a

Download Submit
C:\Windows\SysWOW64\Ibqpimpl.exe

Filesize
64KB

MD5
50dce66f692ea25f07a8fef75ef3083b

SHA1
b65ca77afeb0ff0dce040bab75ababb1d4f72824

SHA256
6ab93f4d31c2a0146b6ff18bcb5dac8638c9bae2cea642c8599d1c65433e2252

SHA512
8ac083298df00f257cbc9aa8bd65bff1fdf17caa1ff3ba5efafd771e7cceeeb2fe163ce31f1490cb5e72675845dd122adceec3d663cd277efeec270dd8383267

Download Submit
C:\Windows\SysWOW64\Iikhfg32.exe

Filesize
64KB

MD5
ea84089cd22a759d44a6710f43af0e9c

SHA1
56236387348962f68f703b4717b1216c941ea355

SHA256
482e0b77e9bb9262d03ff6276f03e83389b1b6a9c56857f558dd1296d81b3a21

SHA512
a37bef49217a43256e7f7563b1f9180e40fc4c7d5bd3bfd73f45143c55c9bc52995b37309a9bd9a4c74cae9655a6efb9bd9241102024deaa65fc5edfcaa70684

Download Submit
C:\Windows\SysWOW64\Ikpaldog.exe

Filesize
64KB

MD5
a98db6dd38f2d15bc13bc4b27981506b

SHA1
27d0552a19802f50ddbe6a21b4bc01aed3e5037c

SHA256
6fc316bbbe1249600b228e2a707183c1699c84187a56b2b185936ca3454812d1

SHA512
2c1cd390562ebb485dcf85c51382edadb06241a5c53d2aad0d0641ecb66c0f221370d5971c30728742cb216ca52c6fd845b7a5df2c77b801837a4734f65ec793

Download Submit
C:\Windows\SysWOW64\Imdgqfbd.exe

Filesize
64KB

MD5
cfd8c12639e1db6584cf57fefc724bb3

SHA1
4637dd01b169995c248b392c8270a55a43fed8a4

SHA256
2a0698ea6d40a755558f76aa806ee82de06c977de959d59a46b74a6b7058f297

SHA512
eb19b10b38d0f1a0378eea83476025c6a345b294a49db721ce1af10b8e5c0edda80bf43ee352d1fa711a455a37c6494226940897380e3d483f3fa2c6f1359b7a

Download Submit
C:\Windows\SysWOW64\Imoneg32.exe

Filesize
64KB

MD5
3007223ab230351a5f3e1c9c43f06d17

SHA1
ddd5dcdcadd1b7649f54aca1e5170eead26d8067

SHA256
9ed74b7a0277e297345cf4aab8048d7b9fa8092c30c5e4b77a86b715d3a84539

SHA512
f854df4b8a0236e219d4cbd2778bddf2046d06a5629a7f8d5637da2d7ab6b4d9d4696ea0d9a65119abe539457e7f0cbd43285ed3bfc773b6145ead54afb99669

Download Submit
C:\Windows\SysWOW64\Inbqhhfj.exe

Filesize
64KB

MD5
a7dcb6a9022914d35e6fad5ab83ce014

SHA1
d593f775d28ec4b40cfa2b9a92f6cdcaea4fd776

SHA256
b910abaf3f7c35d415894100717788023901fd73e8a0031bd8c49c429e244c27

SHA512
11a2d0e1b059234c6074ca6431cc181f03eb805fc9cd9337386a0481ba6b1798950c4587683bd46c00722c13e64284f9de1c6fb2ac05ad9a044fa4730d409605

Download Submit
C:\Windows\SysWOW64\Ippggbck.exe

Filesize
64KB

MD5
5ee980ae1316cb4bf75b41e3049869c2

SHA1
c52616b0cc66225c152c6232df33fe5c926cf2b5

SHA256
41469c7a30a720eb979ba2603ed5ee1974002d8da7b437bd8b2f9d5b36cd4fc8

SHA512
919d42409955cbb4054bdc703e0bf716409fbe6b80fa83eebf19e0cc04d1f79dd811a0b786a29487937fd2ea99be92b7d713c63535c47721a58082fe9c42f2a8

Download Submit
C:\Windows\SysWOW64\Jbhfjljd.exe

Filesize
64KB

MD5
77cd7e987637cc909d3e8e0fadc00835

SHA1
df9fa2854ee1f377856f490c6be13a8099cb7938

SHA256
63f94541dc47e0e8ff74bbc2362532382cefe55c21c1eecb21f392a6f2b225a1

SHA512
9d5d5644f801475ce65327961f7a69aa73ed3867d66dbde1a0c7b887168d0476ecd451f2ffae5b7b87bc69f5ec7abf2a958a5e1e685047e3b38e63b313bbf900

Download Submit
C:\Windows\SysWOW64\Jbjcolha.exe

Filesize
64KB

MD5
04716531c11395986d7bce5e19ea4d12

SHA1
c08c4ad4630da52f4001460b3e415e83c7988076

SHA256
6c1165d52e7925096793b65a6166870a0a919d9a6d99c96a93172fd98024c688

SHA512
5d0c158526359bc5ec8bb99795819c5d3d57cf984290217af8ee9bc50ec939777ea10c043f3436d12c6c82792c94cd7ed0d2068a3e9485946961047a33135aae

Download Submit
C:\Windows\SysWOW64\Jeklag32.exe

Filesize
64KB

MD5
04c534dfe20ccbac8a7f06e36aa9b4a2

SHA1
efbbe6abf1fe86f5b27fda6baa63e3ae643c774f

SHA256
092823cb32059a5f9b079bd36b4c88532f9f2defc9a10b38246c5cba6d802422

SHA512
7abdddfd57586f30459d639a1523c680983ca7fd5736f9c4e2a08af1faf0a570ff28bf11f665c093caf66a9f6630e1529ed378cacef9560f63c3ae8043662f38

Download Submit
C:\Windows\SysWOW64\Jfaedkdp.exe

Filesize
64KB

MD5
e71b0e2b977175c9e20b738d0cabb2db

SHA1
eb67e7924d4418c51d1acaa4e115905cf8482fcc

SHA256
a443ee344c3ecc7056a2732c63ddf6cd0f4fea7f81cd7b2ad98ebdeb6c2b544a

SHA512
67c9418c01d474a3f6c8c9e10e8f99d3130ef100f8703051afdcc410b1f5444cad57baf525a9a859d167c4f33d72702b1c90a59a8c52d9f24bf79965a7018453

Download Submit
C:\Windows\SysWOW64\Jfoiokfb.exe

Filesize
64KB

MD5
21c15ca667bcf4e91378320e51bccf51

SHA1
ce4e09dc23f044b4387d82137968b3d16190d8cc

SHA256
bea3c012484928112916cd38e63d1bc889e3cf33782b8bad79064f9d526f20f2

SHA512
441ed6cfb024c054c5f75cad6e94de791a9973e87bbf78ce5a92e7b68191fc1759eb246c0eaa101a6208ee1761d0f3b05f16e0e3ec5ce6b5e3f278a30b7c74d0

Download Submit
C:\Windows\SysWOW64\Jidklf32.exe

Filesize
64KB

MD5
a53272a3230a94bf93ff55ec1b0929fb

SHA1
80b2754d4ac64431641df93165e15c7ca7e9b624

SHA256
e0e18ad61d430a60d1d316027fb7cee2601c2738354428d306c445a3c4553b04

SHA512
1b710e5ee88f2b45adcf8ca90f0f91323462ea40b6eae40d94381144dfa857db574b0ba7f08dcedf2a903bd5b8b7ed2ef4ca4ebf1b04092bb57e58ee44eb4094

Download Submit
C:\Windows\SysWOW64\Jlnnmb32.exe

Filesize
64KB

MD5
98f9adb17e944a41e8aedcf8d4af886c

SHA1
ba4cefd0bbc389fb035ff3868753b80dabc7c02e

SHA256
723b85c74f786c649a60e2770d06dc3c3d443855913261fe5b8fb19341f5ef7a

SHA512
62797dd6e03c5bdd91f02f0801bdca08c31e29daa9003c09058e5c8f65db72ffdef2c1efd2d8a1ee65995badb7df58c88bd5dee5f3a5185238430f97d3a4ef93

Download Submit
C:\Windows\SysWOW64\Jmmjgejj.exe

Filesize
64KB

MD5
116ef1bf4d3d1a28228027f987c03f2b

SHA1
949ca0364b09862f556defe0ff88f85874a5c4d1

SHA256
02757233d2629bfd5dfdab5490c460c684bc287963ddfb65f26141c022f923b5

SHA512
ee96d20659102b02e8a76799ffd17357e7912751dce8690ac757c6a6eafdd2e6e41193601d4d6a8f2fc131577fdd4b079d1dbe8bfc1f7b2520ffbf23d9221d2e

Download Submit
C:\Windows\SysWOW64\Jpgmha32.exe

Filesize
64KB

MD5
630668acb46d40499e7fda16144b37b8

SHA1
6b454947c882e5481a908fd0adf1ce48fdb6da05

SHA256
4cb9eed7e13949a01bf4db592a2e76b83b9379680aa4dea9c51d43ecbaa5249e

SHA512
f83087424e315d13e129de2267e0077c392b2c110bc39260c6d790b96be3daac9b5a90baa30dd42f28c57af1849505f6b83782d39c4e9dfce577bf06158620c6

Download Submit
C:\Windows\SysWOW64\Jpnchp32.exe

Filesize
64KB

MD5
e20874629d1b468918bc7420cbd7fd26

SHA1
1c5da10542e88d486d7b7e863c36d5bc189badfc

SHA256
5aaa9d70d680331511794c4c4c5ca3cf68bd6da945e289a1734db1d9c553c20c

SHA512
ad47f0dbc7eb88f3d420a8d1f4da6103dc206558ee8209b0fc4db38d93ba74dc34bb2d216d54a6cc9ad6e2fdc88f31ad428bc711467163ba7f451133413f4b12

Download Submit
C:\Windows\SysWOW64\Jpppnp32.exe

Filesize
64KB

MD5
37ec698c59c4e561e5ba9e7778a200dd

SHA1
03a70af4585b3d235fb8ea02c0c55ec6ef19f1ca

SHA256
59b21d677e113b6bd33710dba669eb5c67473e84156bddf0a73c55f05884dd76

SHA512
494bdaab10dfd11eee6778cd948413fb401f316df2e69261ed8f653ac54b879cbff2bfbdd81f8f92cd80ae27b32afafb13fd670daeea105f2136edbefa02aa82

Download Submit
C:\Windows\SysWOW64\Kbaipkbi.exe

Filesize
64KB

MD5
92562453e8d3f8bffea0b439a7df107f

SHA1
db52a4069912213757129678cf95e7b8205d58d9

SHA256
7fa2e58a1ad035b4a278bac450db3d3bd5294ee7d0d52d43f44148d5d71f3ea7

SHA512
e62537f2c87c9e36a48c99e98587ccd20ae4fd24969547a9f8d10a4b21a7627a9a71c9ecd68ceb205924cada628690cf2594d6d328ed4909ec56964284038ebc

Download Submit
C:\Windows\SysWOW64\Kbfbkj32.exe

Filesize
64KB

MD5
4e759ce47f631817205ea8ba49da06cf

SHA1
fa92f68aa5fe656fa44721815b92bdd601c1a075

SHA256
67928fda3ee241e7a7863bb4e1e41013625705b692ff2b42195a1603e3185307

SHA512
2280263537cc1fd0214d05573c652fa51e9dcc4e0f7c8bb4f164924abfdb601a4ce1409244552ca7b0a8045dc5c5738249cd42c29be1f3802ff8f5c194259155

Download Submit
C:\Windows\SysWOW64\Kdeoemeg.exe

Filesize
64KB

MD5
bec1f7f800ad017809a98733b31b3c46

SHA1
d45fd402d1775dd1136c63ef5fd82209a739aba1

SHA256
4a2392aff4d2b54efaa6e17b988657bd97a06540902eba44cffb009c4c59d180

SHA512
edb7db00b28be40100c6446d7dcda73834c600895726970b2ac76e8ed88872f9678f6e6bcfd4f2f6be6f3bf87d552570d1d2ce8d0804987277ed9d0444603737

Download Submit
C:\Windows\SysWOW64\Kdgljmcd.exe

Filesize
64KB

MD5
3bc82dd05a098346512909251658a135

SHA1
0c1eb1fbedfa4c0fb41096b01598cc9d37503f43

SHA256
ceb0e244b75fa385802c1437a0799f0f66f64efb752e58d3b55a702526681443

SHA512
91be0ad8c64a7e362922ab930319c7123c7a55d9e00b38f1b543998cc1094f132ba5985c8076833c257955c5b599823274fa4f489bf49aa7d185603c4c538565

Download Submit
C:\Windows\SysWOW64\Kdqejn32.exe

Filesize
64KB

MD5
3eb2d06fa3989c0ccd7157466285889a

SHA1
f506017715bd488da9ed167d4b59456922ba0ed2

SHA256
307b7426b5fe8590d11837cc5ccf9a9fc6bfd84f39bc5dfddf11e726527cdbb0

SHA512
68e6cdbd3769bc0414af59c43b116bdeb48f1339147a99ef59f80bb6f33661c9afca4a600247312c4eee9658ed533d8458870dd281e18aff0382f2dbb0e20016

Download Submit
C:\Windows\SysWOW64\Kefkme32.exe

Filesize
64KB

MD5
6328ab7b22b6f02f8ee4cddbcc364a4f

SHA1
e054f3ef5386812f80ae0d0a4e4cf7c9973b2016

SHA256
cc8313951e62447c82c556414f8ae2b89ccb5ecdad9d1f035dcea624d62749ce

SHA512
eb257bad36c68be743a4db03afab5f6483c9c5ce24ef37d64a3aacf695c5a8c0af719214903b307ef25afef567b076833749846dedb78ad908dbd4d553b90531

Download Submit
C:\Windows\SysWOW64\Kfjhkjle.exe

Filesize
64KB

MD5
a743f3e9ee86ed85884bed7eb06ab426

SHA1
5c3658989afe9f04ab6392fb8a11696943d934ef

SHA256
6739482d5939bf22ddacea764e4bed30b1d3dbfbdc7560545c33febef15a915e

SHA512
65818ae595c04c226e3fbb9e818dfc2f545c1aaf4830ecdbc48f259902e0bcbae921ce24f7c399dac5519481fe6a3270e100966ee4f515c9083ff78882ac7b30

Download Submit
C:\Windows\SysWOW64\Kikame32.exe

Filesize
64KB

MD5
88c80eb89dc4bb34199478dd537e9fe8

SHA1
a66de9293f1643652b96e8bb8e8332a956d89beb

SHA256
cd881798be3886f9215f7bf9058b3c3fb89db968de162754d3e7bde9f6d4ca91

SHA512
db7547a204d4f0a3cfbc55dc02cc3333d23cd8bedadd998a8ff4fc311f930d09abe910922b5188c6791cd72c5f8afa5815b8ca5177ec6da13bdb38343d3e5671

Download Submit
C:\Windows\SysWOW64\Kmijbcpl.exe

Filesize
64KB

MD5
a5f55bf67d1db81a60117a655cfbdb31

SHA1
f81e9b714b227cdcb2bc295cffa56142c578382e

SHA256
983f8edb95deae02b635916971744a1ea593d65ce0998f57a0f7992d8313c935

SHA512
dff85f19803196b404be18c52624fbd2cc2033d6068f1dadee1eeab489802a919f37b17f6e493e6de6c8c62eb8b1d085d4eabbe68fbfeaa557e1ce0823172595

Download Submit
C:\Windows\SysWOW64\Kmkfhc32.exe

Filesize
64KB

MD5
db7f2c3add7af277efe974138f746495

SHA1
188b9de34dbf8ae9184bb249f4e451c0632ab2c6

SHA256
9ca670ca1e4e55c342deae226b09ca63699010c3451ad07b69ac5ba68b331bba

SHA512
27905872040b1f7fda0e72ece4b7aaa2e9daede4082f3337e975e9812f7658898b1bf0c4dc92930d712b1699b8e380c5e8354b481a30308ad217c0ca66e304b8

Download Submit
C:\Windows\SysWOW64\Lbqklb32.exe

Filesize
64KB

MD5
388b645bae000812c8f01b800c68f061

SHA1
338b086e47a4a8534ed609662fa3cbee363c7f62

SHA256
c6ea2178c1e113fa800621ff84ef703cef6b91b62cc21efcdc3238dc988b6daf

SHA512
5559b86a5907126c82ef24c23e2a8920424acf64387ca12a88133c3e3ceaa2c9c72ef719161587427e2eb9db812aeac37c0386e1e87e75b1d623e3d55f3e2743

Download Submit
C:\Windows\SysWOW64\Lpnlpnih.exe

Filesize
64KB

MD5
f161a23bb04d5a447a082f177d22acb3

SHA1
ce1a485cf9dc013466d4cc602555ce74def11a05

SHA256
317ec272035a89879d970e5bc4333297c13471a7bc7f78fd1320015661ab8419

SHA512
fe55fdc10f5f0bf429ed329b09c655b20861273aa89215be08c0462fb40ffae33b0de4c97e93420d6376caaeb0f28febf0b97b907675e29207cd9a7387fa2dc2

Download Submit
C:\Windows\SysWOW64\Neffpj32.exe

Filesize
64KB

MD5
6726e9e4a8524f3d00760a68dac40e8f

SHA1
08e51f0cca49f0fa9377e2ab3912e8cf7f5356d9

SHA256
16e036f597c060f947eee23fd1cd9bc9304b1b0e962c1d627a6ee0cec5e2d45c

SHA512
cd3f2e3136c9e274c66f76243cd678e2862c8c0dc4962380addc48a71903f639c484894046f9d8e8a60c1d366c4e42412290006faab50d6e36e773bc82ced468

Download Submit
C:\Windows\SysWOW64\Ngomin32.exe

Filesize
64KB

MD5
99a31f5e1479e8243f970e8dffb1e244

SHA1
153bfe77222412f4279ef45afe31755b4a371ea7

SHA256
5ccbfea85cece62fec665147724e2db0745ea680880937a1786e727708b1d900

SHA512
b39cb475b3b29103fd6029d6f9460283d9ebcb2846e62d413837a6d9d4ab959c4ad09ae56632c329669ae6c700c84b6167619ec75d331f4ba7cc101f70d36e72

Download Submit
C:\Windows\SysWOW64\Pflibgil.exe

Filesize
64KB

MD5
625309f1f9fdd02fd0065aaf80c018da

SHA1
e9728f82312e4f0998f2aeddbe82fa19d7b6b4f2

SHA256
a1a6a8fd8721fae163e57b15f41b68266bc694fa4cde477dd965747af598efa8

SHA512
410058c25cc57a1bf8e63e6b5cf3b87c30afafb9045b539448a9ccff058ddf3d06896ad9439b73103e980960a0a65d756d3b3582cc0b4569da79f7059d7d97d1

Download Submit
C:\Windows\SysWOW64\Phincl32.exe

Filesize
64KB

MD5
87259f88e106c6038e2bb614d7902c42

SHA1
1e3a91c325833b67de9bd8ed3ce844605a616431

SHA256
cb379a1805ccc727fda219f634393b5396dc0429d6f590bc85e397260b4f7eda

SHA512
63bee7284d9601a772f5e8d008a6b8a644d22771a1b05ae1ec2d2580e86f4381a4aebb0d887d1c1b1d5846790388b7d95294ddbaa5ff8bfa506bfb8717ff9681

Download Submit
C:\Windows\SysWOW64\Qgqeappe.exe

Filesize
64KB

MD5
633a52aa64174cec071cf68dec6a51aa

SHA1
7481341e9e0cb3eab1f4c904842e29a52c7fe336

SHA256
e0cbd62c6d03e53a0de4ac316a51a44f90bb2c886a68af8e501a38275fd0fe46

SHA512
9693b31b06c673120089c2406561981fe1d11a9167d481356f8ab76a71f56226c85f15556b5c335884e9b32c712bbf30fd964802b174cfbfd0e38e2c3b523e50

Download Submit
memory/212-432-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/536-161-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/880-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/996-106-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1008-90-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1472-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1560-282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1564-336-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1636-300-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1828-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1828-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1828-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2160-150-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2188-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2244-430-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2264-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2312-264-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2336-352-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2380-234-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2412-65-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2532-218-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2632-258-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2760-170-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2780-57-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2788-396-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2960-360-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3004-196-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3024-330-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3076-142-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3156-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3268-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3348-384-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3352-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3376-130-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3464-288-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3672-294-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3676-324-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3732-378-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3808-306-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3876-246-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3908-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3984-178-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4000-312-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4004-87-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4072-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4084-370-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4164-418-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4176-354-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4204-372-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4288-122-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4392-394-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4416-226-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4532-346-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4536-250-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4616-214-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4824-412-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4832-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4880-276-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4896-318-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4948-420-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5008-113-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5044-154-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5056-402-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5080-201-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads