cf14bac3bc3eb0981dce9efe95d9d47d4ddc13cdaf20f6ddf8d8ffbdd19f620d

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2024, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cf14bac3bc3eb0981dce9efe95d9d47d4ddc13cdaf20f6ddf8d8ffbdd19f620d.exe
Size

178KB
MD5

3623ebc8d8781c6576ec4582b5be3c0a
SHA1

30302fb3cc1e04a4fc0d1f5b377d20924870ef9a
SHA256

cf14bac3bc3eb0981dce9efe95d9d47d4ddc13cdaf20f6ddf8d8ffbdd19f620d
SHA512

7edf20eea489deef86421ecc7358c7c6f4dec341fbeca7ad94ece3b2733835815b5e248b9278f427e03dd767500e1dd9ea78c7fd102db8228b1c1f357d7ba425
SSDEEP

3072:5Dc3l1imRI2EGISTtGM75ue6+oqU4ifdgUCj707Fj5fypEu6+ow:8i9STAv+nifdgUCcfOEf+/

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gacepg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngaionfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcogje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alnfpcag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cnindhpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dbicpfdk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Agdcpkll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ebfign32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Haaaaeim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aadifclh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eaindh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlfpdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dolmodpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Epokedmj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdaociml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjmjdm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjbcplpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hehdfdek.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jeocna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ceckcp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jeekkafl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Medqcmki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Peahgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bgbpaipl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oonlfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qnjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kihnmohm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jgogbgei.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pidabppl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlmfeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hoobdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kfnfjehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pmdkch32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlbbkfoq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iefgbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kpjgaoqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ccchof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hgiepjga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pabblb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flqdlnde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jjgchm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmmolepp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nggjdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chagok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jekqmhia.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hiacacpg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcnmin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpkibf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eicedn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bclang32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afkknogn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ogmijllo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pleaoa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pqcjepfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emehdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fneggdhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ogjdmbil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ngbpidjh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpieqeko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddkbmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pecellgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cdpcal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oikjkc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jpmlnjco.exe

Executes dropped EXE 64 IoCs

pid	Process
4396	Mlefklpj.exe
2824	Mcpnhfhf.exe
4240	Npcoakfp.exe
2412	Nepgjaeg.exe
3764	Ndaggimg.exe
1964	Nebdoa32.exe
1824	Nnjlpo32.exe
1872	Ngbpidjh.exe
3932	Nnlhfn32.exe
528	Njciko32.exe
1208	Nggjdc32.exe
1700	Oponmilc.exe
112	Ogkcpbam.exe
3676	Ocbddc32.exe
2272	Oqfdnhfk.exe
2076	Ojoign32.exe
4252	Oqhacgdh.exe
1424	Ojaelm32.exe
1132	Pclgkb32.exe
2736	Pmdkch32.exe
492	Pcncpbmd.exe
4644	Pncgmkmj.exe
1316	Pcppfaka.exe
1060	Pgnilpah.exe
780	Qdbiedpa.exe
1200	Qnjnnj32.exe
2840	Anmjcieo.exe
4760	Aqkgpedc.exe
1032	Ajckij32.exe
4236	Aqncedbp.exe
3432	Aeklkchg.exe
4616	Andqdh32.exe
1464	Afoeiklb.exe
5044	Aadifclh.exe
2196	Bjmnoi32.exe
980	Bcebhoii.exe
2704	Bmngqdpj.exe
1392	Bgcknmop.exe
2636	Bmpcfdmg.exe
3824	Bjddphlq.exe
652	Bclhhnca.exe
828	Bapiabak.exe
3008	Cmgjgcgo.exe
116	Ceqnmpfo.exe
3136	Cfbkeh32.exe
3388	Ceckcp32.exe
2556	Chagok32.exe
5152	Cmnpgb32.exe
5196	Ceehho32.exe
5248	Cnnlaehj.exe
5300	Calhnpgn.exe
5360	Djdmffnn.exe
5404	Danecp32.exe
5464	Gohaeo32.exe
5512	Gafmaj32.exe
5556	Ggcfja32.exe
5612	Gahjgj32.exe
5668	Gdgfce32.exe
5708	Hffcmh32.exe
5772	Hghoeqmp.exe
5824	Hnagak32.exe
5868	Hnddgjbj.exe
5912	Hglipp32.exe
5952	Hocqam32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Cfbkeh32.exe	Ceqnmpfo.exe
File created	C:\Windows\SysWOW64\Ncjginjn.exe	Nibbqicm.exe
File created	C:\Windows\SysWOW64\Aojlaeei.exe	Qebhhp32.exe
File opened for modification	C:\Windows\SysWOW64\Fpgpgfmh.exe	Fmhdkknd.exe
File created	C:\Windows\SysWOW64\Jjpdeo32.dll	Gkaclqkk.exe
File created	C:\Windows\SysWOW64\Ehfcfb32.exe	Epokedmj.exe
File created	C:\Windows\SysWOW64\Nmnpml32.dll	Eplgeokq.exe
File created	C:\Windows\SysWOW64\Gmophg32.dll	Imgicgca.exe
File created	C:\Windows\SysWOW64\Ogakfe32.dll	Pjbcplpe.exe
File opened for modification	C:\Windows\SysWOW64\Dpiplm32.exe	Cnjdpaki.exe
File created	C:\Windows\SysWOW64\Kbbokdlk.exe	Klifnj32.exe
File created	C:\Windows\SysWOW64\Neoieenp.exe	Nacmdf32.exe
File created	C:\Windows\SysWOW64\Chalkm32.dll	Ohnohn32.exe
File created	C:\Windows\SysWOW64\Hiacacpg.exe	Hpioin32.exe
File created	C:\Windows\SysWOW64\Jfnbdecg.exe	Jkhngl32.exe
File created	C:\Windows\SysWOW64\Ohlimd32.exe	Ocopdn32.exe
File opened for modification	C:\Windows\SysWOW64\Oaompd32.exe	Okedcjcm.exe
File opened for modification	C:\Windows\SysWOW64\Nmenca32.exe	Njfagf32.exe
File created	C:\Windows\SysWOW64\Ghcfpl32.dll	Mjpjgj32.exe
File created	C:\Windows\SysWOW64\Miiflecc.dll	Jeqbpb32.exe
File created	C:\Windows\SysWOW64\Bgnpek32.dll	Lafmjp32.exe
File created	C:\Windows\SysWOW64\Nfenigce.dll	Mfnhfm32.exe
File opened for modification	C:\Windows\SysWOW64\Ihdldn32.exe	Ipihpkkd.exe
File opened for modification	C:\Windows\SysWOW64\Bjddphlq.exe	Bmpcfdmg.exe
File created	C:\Windows\SysWOW64\Obfohnkk.dll	Oileggkb.exe
File opened for modification	C:\Windows\SysWOW64\Hjlkge32.exe	Haafcb32.exe
File opened for modification	C:\Windows\SysWOW64\Phonha32.exe	Pccahbmn.exe
File created	C:\Windows\SysWOW64\Lelgfl32.dll	Cammjakm.exe
File created	C:\Windows\SysWOW64\Ldfgeigq.dll	Aadifclh.exe
File created	C:\Windows\SysWOW64\Eaqdegaj.exe	Emehdh32.exe
File opened for modification	C:\Windows\SysWOW64\Cbbdjm32.exe	Cmflbf32.exe
File created	C:\Windows\SysWOW64\Chnlgjlb.exe	Coegoe32.exe
File created	C:\Windows\SysWOW64\Nqcejcha.exe	Nimmifgo.exe
File created	C:\Windows\SysWOW64\Obcceg32.exe	Oohgdhfn.exe
File opened for modification	C:\Windows\SysWOW64\Bddcenpi.exe	Baegibae.exe
File created	C:\Windows\SysWOW64\Cnnbme32.dll	Gemkelcd.exe
File created	C:\Windows\SysWOW64\Onogcg32.dll	Klbnajqc.exe
File opened for modification	C:\Windows\SysWOW64\Ogmijllo.exe	Oofaiokl.exe
File created	C:\Windows\SysWOW64\Clfabmda.dll	Eaqdegaj.exe
File created	C:\Windows\SysWOW64\Ackekpfe.dll	Ahdged32.exe
File created	C:\Windows\SysWOW64\Kfnfjehl.exe	Kncaec32.exe
File opened for modification	C:\Windows\SysWOW64\Mgloefco.exe	Modgdicm.exe
File created	C:\Windows\SysWOW64\Gadiippo.dll	Oabhfg32.exe
File created	C:\Windows\SysWOW64\Imffkelf.dll	Enhpao32.exe
File created	C:\Windows\SysWOW64\Gpaihooo.exe	Glfmgp32.exe
File created	C:\Windows\SysWOW64\Nibbqicm.exe	Nchjdo32.exe
File opened for modification	C:\Windows\SysWOW64\Pjehmfch.exe	Pgflqkdd.exe
File opened for modification	C:\Windows\SysWOW64\Hgiepjga.exe	Hdkidohn.exe
File opened for modification	C:\Windows\SysWOW64\Dpgnjo32.exe	Dlkbjqgm.exe
File opened for modification	C:\Windows\SysWOW64\Oakbehfe.exe	Omnjojpo.exe
File opened for modification	C:\Windows\SysWOW64\Ahchda32.exe	Aokcklid.exe
File created	C:\Windows\SysWOW64\Ingfla32.dll	Ceehho32.exe
File opened for modification	C:\Windows\SysWOW64\Pldcjeia.exe	Paoollik.exe
File created	C:\Windows\SysWOW64\Fneggdhg.exe	Fpbflg32.exe
File created	C:\Windows\SysWOW64\Mpagaf32.dll	Ppikbm32.exe
File opened for modification	C:\Windows\SysWOW64\Iijaka32.exe	Ifleoe32.exe
File opened for modification	C:\Windows\SysWOW64\Afkknogn.exe	Ahgjejhd.exe
File created	C:\Windows\SysWOW64\Fllkqn32.exe	Fimodc32.exe
File created	C:\Windows\SysWOW64\Kggcnoic.exe	Kqmkae32.exe
File opened for modification	C:\Windows\SysWOW64\Ghojbq32.exe	Gaebef32.exe
File opened for modification	C:\Windows\SysWOW64\Bpnihiio.exe	Bqkill32.exe
File created	C:\Windows\SysWOW64\Qebhhp32.exe	Qohpkf32.exe
File created	C:\Windows\SysWOW64\Hjfcen32.dll	Aaiimadl.exe
File opened for modification	C:\Windows\SysWOW64\Flngfn32.exe	Fmkgkapm.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8384	3752	WerFault.exe	846

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ioopml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Poajkgnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ncofplba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmncdk32.dll"	Bddcenpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cdkifmjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mcpnhfhf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ingfla32.dll"	Ceehho32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jekqmhia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpefcn32.dll"	Jekqmhia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npmknd32.dll"	Jhifomdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qnjnnj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Njfagf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qfpbmfdf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kcllei32.dll"	Cpeohh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ggbook32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iloidijb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jemfhacc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fegbnohh.dll"	Loacdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Idjlpc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jkhngl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bcelmhen.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nenbjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Oogpjbbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jieagojp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iokifhcf.dll"	Jldbpl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fbfcmhpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omjbpn32.dll"	Dpiplm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cffmfadl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oghdfilo.dll"	Dpgnjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mmkkmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gpnfge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ceehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lfhnaa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eigonjcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fmkgkapm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hiipmhmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ckjknfnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bkgppbgc.dll"	Lepleocn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lohqnd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ndaggimg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bghakj32.dll"	Pgflqkdd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nimmifgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Paihlpfi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gahjgj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ngaionfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjmhfb32.dll"	Oadfkdgd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Paiogf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nenbjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgdbei32.dll"	Jfnbdecg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Acigfpbp.dll"	Aojlaeei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njiekege.dll"	Aleckinj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilgonc32.dll"	Pdenmbkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldamee32.dll"	Oqhacgdh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aaccdk32.dll"	Jkmgblok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jqdoem32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ppikbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cnnlaehj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Okedcjcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fckjejfe.dll"	Gnpphljo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gbkkik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkmjlphl.dll"	Adcjop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlkbkddd.dll"	Paihlpfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fpebke32.dll"	Jfehed32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 4396	2552	cf14bac3bc3eb0981dce9efe95d9d47d4ddc13cdaf20f6ddf8d8ffbdd19f620d.exe	94
PID 2552 wrote to memory of 4396	2552	cf14bac3bc3eb0981dce9efe95d9d47d4ddc13cdaf20f6ddf8d8ffbdd19f620d.exe	94
PID 2552 wrote to memory of 4396	2552	cf14bac3bc3eb0981dce9efe95d9d47d4ddc13cdaf20f6ddf8d8ffbdd19f620d.exe	94
PID 4396 wrote to memory of 2824	4396	Mlefklpj.exe	95
PID 4396 wrote to memory of 2824	4396	Mlefklpj.exe	95
PID 4396 wrote to memory of 2824	4396	Mlefklpj.exe	95
PID 2824 wrote to memory of 4240	2824	Mcpnhfhf.exe	96
PID 2824 wrote to memory of 4240	2824	Mcpnhfhf.exe	96
PID 2824 wrote to memory of 4240	2824	Mcpnhfhf.exe	96
PID 4240 wrote to memory of 2412	4240	Npcoakfp.exe	97
PID 4240 wrote to memory of 2412	4240	Npcoakfp.exe	97
PID 4240 wrote to memory of 2412	4240	Npcoakfp.exe	97
PID 2412 wrote to memory of 3764	2412	Nepgjaeg.exe	98
PID 2412 wrote to memory of 3764	2412	Nepgjaeg.exe	98
PID 2412 wrote to memory of 3764	2412	Nepgjaeg.exe	98
PID 3764 wrote to memory of 1964	3764	Ndaggimg.exe	99
PID 3764 wrote to memory of 1964	3764	Ndaggimg.exe	99
PID 3764 wrote to memory of 1964	3764	Ndaggimg.exe	99
PID 1964 wrote to memory of 1824	1964	Nebdoa32.exe	100
PID 1964 wrote to memory of 1824	1964	Nebdoa32.exe	100
PID 1964 wrote to memory of 1824	1964	Nebdoa32.exe	100
PID 1824 wrote to memory of 1872	1824	Nnjlpo32.exe	101
PID 1824 wrote to memory of 1872	1824	Nnjlpo32.exe	101
PID 1824 wrote to memory of 1872	1824	Nnjlpo32.exe	101
PID 1872 wrote to memory of 3932	1872	Ngbpidjh.exe	102
PID 1872 wrote to memory of 3932	1872	Ngbpidjh.exe	102
PID 1872 wrote to memory of 3932	1872	Ngbpidjh.exe	102
PID 3932 wrote to memory of 528	3932	Nnlhfn32.exe	103
PID 3932 wrote to memory of 528	3932	Nnlhfn32.exe	103
PID 3932 wrote to memory of 528	3932	Nnlhfn32.exe	103
PID 528 wrote to memory of 1208	528	Njciko32.exe	105
PID 528 wrote to memory of 1208	528	Njciko32.exe	105
PID 528 wrote to memory of 1208	528	Njciko32.exe	105
PID 1208 wrote to memory of 1700	1208	Nggjdc32.exe	106
PID 1208 wrote to memory of 1700	1208	Nggjdc32.exe	106
PID 1208 wrote to memory of 1700	1208	Nggjdc32.exe	106
PID 1700 wrote to memory of 112	1700	Oponmilc.exe	108
PID 1700 wrote to memory of 112	1700	Oponmilc.exe	108
PID 1700 wrote to memory of 112	1700	Oponmilc.exe	108
PID 112 wrote to memory of 3676	112	Ogkcpbam.exe	109
PID 112 wrote to memory of 3676	112	Ogkcpbam.exe	109
PID 112 wrote to memory of 3676	112	Ogkcpbam.exe	109
PID 3676 wrote to memory of 2272	3676	Ocbddc32.exe	110
PID 3676 wrote to memory of 2272	3676	Ocbddc32.exe	110
PID 3676 wrote to memory of 2272	3676	Ocbddc32.exe	110
PID 2272 wrote to memory of 2076	2272	Oqfdnhfk.exe	111
PID 2272 wrote to memory of 2076	2272	Oqfdnhfk.exe	111
PID 2272 wrote to memory of 2076	2272	Oqfdnhfk.exe	111
PID 2076 wrote to memory of 4252	2076	Ojoign32.exe	112
PID 2076 wrote to memory of 4252	2076	Ojoign32.exe	112
PID 2076 wrote to memory of 4252	2076	Ojoign32.exe	112
PID 4252 wrote to memory of 1424	4252	Oqhacgdh.exe	113
PID 4252 wrote to memory of 1424	4252	Oqhacgdh.exe	113
PID 4252 wrote to memory of 1424	4252	Oqhacgdh.exe	113
PID 1424 wrote to memory of 1132	1424	Ojaelm32.exe	114
PID 1424 wrote to memory of 1132	1424	Ojaelm32.exe	114
PID 1424 wrote to memory of 1132	1424	Ojaelm32.exe	114
PID 1132 wrote to memory of 2736	1132	Pclgkb32.exe	116
PID 1132 wrote to memory of 2736	1132	Pclgkb32.exe	116
PID 1132 wrote to memory of 2736	1132	Pclgkb32.exe	116
PID 2736 wrote to memory of 492	2736	Pmdkch32.exe	117
PID 2736 wrote to memory of 492	2736	Pmdkch32.exe	117
PID 2736 wrote to memory of 492	2736	Pmdkch32.exe	117
PID 492 wrote to memory of 4644	492	Pcncpbmd.exe	118

C:\Users\Admin\AppData\Local\Temp\cf14bac3bc3eb0981dce9efe95d9d47d4ddc13cdaf20f6ddf8d8ffbdd19f620d.exe
"C:\Users\Admin\AppData\Local\Temp\cf14bac3bc3eb0981dce9efe95d9d47d4ddc13cdaf20f6ddf8d8ffbdd19f620d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Windows\SysWOW64\Mlefklpj.exe
  C:\Windows\system32\Mlefklpj.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\SysWOW64\Mcpnhfhf.exe
    C:\Windows\system32\Mcpnhfhf.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Windows\SysWOW64\Npcoakfp.exe
      C:\Windows\system32\Npcoakfp.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4240
    - - C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2412
      - C:\Windows\SysWOW64\Ndaggimg.exe
        
        C:\Windows\system32\Ndaggimg.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3764
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Windows\SysWOW64\Nnjlpo32.exe
        
        C:\Windows\system32\Nnjlpo32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1824
        
        C:\Windows\SysWOW64\Ngbpidjh.exe
        
        C:\Windows\system32\Ngbpidjh.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1872
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3932
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:528
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1208
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1700
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:112
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3676
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2272
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2076
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        18⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1424
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2736
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:492
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        23⤵
        Executes dropped EXE
        
        PID:4644
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        24⤵
        Executes dropped EXE
        
        PID:1316
        
        C:\Windows\SysWOW64\Pgnilpah.exe
        
        C:\Windows\system32\Pgnilpah.exe
        25⤵
        Executes dropped EXE
        
        PID:1060
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        26⤵
        Executes dropped EXE
        
        PID:780
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1200
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        28⤵
        Executes dropped EXE
        
        PID:2840
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        29⤵
        Executes dropped EXE
        
        PID:4760
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        30⤵
        Executes dropped EXE
        
        PID:1032
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        31⤵
        Executes dropped EXE
        
        PID:4236
        
        C:\Windows\SysWOW64\Aeklkchg.exe
        
        C:\Windows\system32\Aeklkchg.exe
        32⤵
        Executes dropped EXE
        
        PID:3432
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        33⤵
        Executes dropped EXE
        
        PID:4616
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        34⤵
        Executes dropped EXE
        
        PID:1464
        
        C:\Windows\SysWOW64\Aadifclh.exe
        
        C:\Windows\system32\Aadifclh.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5044
        
        C:\Windows\SysWOW64\Bjmnoi32.exe
        
        C:\Windows\system32\Bjmnoi32.exe
        36⤵
        Executes dropped EXE
        
        PID:2196
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        37⤵
        Executes dropped EXE
        
        PID:980
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        38⤵
        Executes dropped EXE
        
        PID:2704
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        39⤵
        Executes dropped EXE
        
        PID:1392
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2636
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        41⤵
        Executes dropped EXE
        
        PID:3824
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        42⤵
        Executes dropped EXE
        
        PID:652
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        43⤵
        Executes dropped EXE
        
        PID:828
        
        C:\Windows\SysWOW64\Cmgjgcgo.exe
        
        C:\Windows\system32\Cmgjgcgo.exe
        44⤵
        Executes dropped EXE
        
        PID:3008
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        45⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:116
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        46⤵
        Executes dropped EXE
        
        PID:3136
        
        C:\Windows\SysWOW64\Ceckcp32.exe
        
        C:\Windows\system32\Ceckcp32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3388
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2556
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        49⤵
        Executes dropped EXE
        
        PID:5152
        
        C:\Windows\SysWOW64\Ceehho32.exe
        
        C:\Windows\system32\Ceehho32.exe
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:5196
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5248
        
        C:\Windows\SysWOW64\Calhnpgn.exe
        
        C:\Windows\system32\Calhnpgn.exe
        52⤵
        Executes dropped EXE
        
        PID:5300
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        53⤵
        Executes dropped EXE
        
        PID:5360
        
        C:\Windows\SysWOW64\Danecp32.exe
        
        C:\Windows\system32\Danecp32.exe
        54⤵
        Executes dropped EXE
        
        PID:5404
        
        C:\Windows\SysWOW64\Gohaeo32.exe
        
        C:\Windows\system32\Gohaeo32.exe
        55⤵
        Executes dropped EXE
        
        PID:5464
        
        C:\Windows\SysWOW64\Gafmaj32.exe
        
        C:\Windows\system32\Gafmaj32.exe
        56⤵
        Executes dropped EXE
        
        PID:5512
        
        C:\Windows\SysWOW64\Ggcfja32.exe
        
        C:\Windows\system32\Ggcfja32.exe
        57⤵
        Executes dropped EXE
        
        PID:5556
        
        C:\Windows\SysWOW64\Gahjgj32.exe
        
        C:\Windows\system32\Gahjgj32.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5612
        
        C:\Windows\SysWOW64\Gdgfce32.exe
        
        C:\Windows\system32\Gdgfce32.exe
        59⤵
        Executes dropped EXE
        
        PID:5668
        
        C:\Windows\SysWOW64\Hffcmh32.exe
        
        C:\Windows\system32\Hffcmh32.exe
        60⤵
        Executes dropped EXE
        
        PID:5708
        
        C:\Windows\SysWOW64\Hghoeqmp.exe
        
        C:\Windows\system32\Hghoeqmp.exe
        61⤵
        Executes dropped EXE
        
        PID:5772
        
        C:\Windows\SysWOW64\Hnagak32.exe
        
        C:\Windows\system32\Hnagak32.exe
        62⤵
        Executes dropped EXE
        
        PID:5824
        
        C:\Windows\SysWOW64\Hnddgjbj.exe
        
        C:\Windows\system32\Hnddgjbj.exe
        63⤵
        Executes dropped EXE
        
        PID:5868
        
        C:\Windows\SysWOW64\Hglipp32.exe
        
        C:\Windows\system32\Hglipp32.exe
        64⤵
        Executes dropped EXE
        
        PID:5912
        
        C:\Windows\SysWOW64\Hocqam32.exe
        
        C:\Windows\system32\Hocqam32.exe
        65⤵
        Executes dropped EXE
        
        PID:5952
        
        C:\Windows\SysWOW64\Hdpiid32.exe
        
        C:\Windows\system32\Hdpiid32.exe
        66⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Hofmfmhj.exe
        
        C:\Windows\system32\Hofmfmhj.exe
        67⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Hfpecg32.exe
        
        C:\Windows\system32\Hfpecg32.exe
        68⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Hkmnln32.exe
        
        C:\Windows\system32\Hkmnln32.exe
        69⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Idebdcdo.exe
        
        C:\Windows\system32\Idebdcdo.exe
        70⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Iokgal32.exe
        
        C:\Windows\system32\Iokgal32.exe
        71⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Idgojc32.exe
        
        C:\Windows\system32\Idgojc32.exe
        72⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Ikaggmii.exe
        
        C:\Windows\system32\Ikaggmii.exe
        73⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Idjlpc32.exe
        
        C:\Windows\system32\Idjlpc32.exe
        74⤵
        Modifies registry class
        
        PID:4712
        
        C:\Windows\SysWOW64\Ioopml32.exe
        
        C:\Windows\system32\Ioopml32.exe
        75⤵
        Modifies registry class
        
        PID:5448
        
        C:\Windows\SysWOW64\Ifihif32.exe
        
        C:\Windows\system32\Ifihif32.exe
        76⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Ioambknl.exe
        
        C:\Windows\system32\Ioambknl.exe
        77⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Ifleoe32.exe
        
        C:\Windows\system32\Ifleoe32.exe
        78⤵
        Drops file in System32 directory
        
        PID:5764
        
        C:\Windows\SysWOW64\Iijaka32.exe
        
        C:\Windows\system32\Iijaka32.exe
        79⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Jkhngl32.exe
        
        C:\Windows\system32\Jkhngl32.exe
        80⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5932
        
        C:\Windows\SysWOW64\Jfnbdecg.exe
        
        C:\Windows\system32\Jfnbdecg.exe
        81⤵
        Modifies registry class
        
        PID:5988
        
        C:\Windows\SysWOW64\Jeqbpb32.exe
        
        C:\Windows\system32\Jeqbpb32.exe
        82⤵
        Drops file in System32 directory
        
        PID:1284
        
        C:\Windows\SysWOW64\Jkkjmlan.exe
        
        C:\Windows\system32\Jkkjmlan.exe
        83⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Jnifigpa.exe
        
        C:\Windows\system32\Jnifigpa.exe
        84⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\Jfpojead.exe
        
        C:\Windows\system32\Jfpojead.exe
        85⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Jiokfpph.exe
        
        C:\Windows\system32\Jiokfpph.exe
        86⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Jkmgblok.exe
        
        C:\Windows\system32\Jkmgblok.exe
        87⤵
        Modifies registry class
        
        PID:5936
        
        C:\Windows\SysWOW64\Jbgoof32.exe
        
        C:\Windows\system32\Jbgoof32.exe
        88⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Jeekkafl.exe
        
        C:\Windows\system32\Jeekkafl.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5224
        
        C:\Windows\SysWOW64\Jnnpdg32.exe
        
        C:\Windows\system32\Jnnpdg32.exe
        90⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Jfehed32.exe
        
        C:\Windows\system32\Jfehed32.exe
        91⤵
        Modifies registry class
        
        PID:5832
        
        C:\Windows\SysWOW64\Jgfdmlcm.exe
        
        C:\Windows\system32\Jgfdmlcm.exe
        92⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Jpmlnjco.exe
        
        C:\Windows\system32\Jpmlnjco.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3484
        
        C:\Windows\SysWOW64\Jieagojp.exe
        
        C:\Windows\system32\Jieagojp.exe
        94⤵
        Modifies registry class
        
        PID:4120
        
        C:\Windows\SysWOW64\Knbiofhg.exe
        
        C:\Windows\system32\Knbiofhg.exe
        95⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Kihnmohm.exe
        
        C:\Windows\system32\Kihnmohm.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6008
        
        C:\Windows\SysWOW64\Kbpbed32.exe
        
        C:\Windows\system32\Kbpbed32.exe
        97⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Klifnj32.exe
        
        C:\Windows\system32\Klifnj32.exe
        98⤵
        Drops file in System32 directory
        
        PID:6200
        
        C:\Windows\SysWOW64\Kbbokdlk.exe
        
        C:\Windows\system32\Kbbokdlk.exe
        99⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Kimghn32.exe
        
        C:\Windows\system32\Kimghn32.exe
        100⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Kpgodhkd.exe
        
        C:\Windows\system32\Kpgodhkd.exe
        101⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Kechmoil.exe
        
        C:\Windows\system32\Kechmoil.exe
        102⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Klmpiiai.exe
        
        C:\Windows\system32\Klmpiiai.exe
        103⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Kiaqcnpb.exe
        
        C:\Windows\system32\Kiaqcnpb.exe
        104⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Lpkiph32.exe
        
        C:\Windows\system32\Lpkiph32.exe
        105⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Lfealaol.exe
        
        C:\Windows\system32\Lfealaol.exe
        106⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Llbidimc.exe
        
        C:\Windows\system32\Llbidimc.exe
        107⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Lfhnaa32.exe
        
        C:\Windows\system32\Lfhnaa32.exe
        108⤵
        Modifies registry class
        
        PID:6644
        
        C:\Windows\SysWOW64\Lldfjh32.exe
        
        C:\Windows\system32\Lldfjh32.exe
        109⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Lfjjga32.exe
        
        C:\Windows\system32\Lfjjga32.exe
        110⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Lihfcm32.exe
        
        C:\Windows\system32\Lihfcm32.exe
        111⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Lpbopfag.exe
        
        C:\Windows\system32\Lpbopfag.exe
        112⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Lhncdi32.exe
        
        C:\Windows\system32\Lhncdi32.exe
        113⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Mimpolee.exe
        
        C:\Windows\system32\Mimpolee.exe
        114⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Mpghkf32.exe
        
        C:\Windows\system32\Mpghkf32.exe
        115⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Mojhgbdl.exe
        
        C:\Windows\system32\Mojhgbdl.exe
        116⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Medqcmki.exe
        
        C:\Windows\system32\Medqcmki.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7040
        
        C:\Windows\SysWOW64\Mpieqeko.exe
        
        C:\Windows\system32\Mpieqeko.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7084
        
        C:\Windows\SysWOW64\Mhdjehhj.exe
        
        C:\Windows\system32\Mhdjehhj.exe
        119⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Mlbbkfoq.exe
        
        C:\Windows\system32\Mlbbkfoq.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4664
        
        C:\Windows\SysWOW64\Mekgdl32.exe
        
        C:\Windows\system32\Mekgdl32.exe
        121⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Mpqkad32.exe
        
        C:\Windows\system32\Mpqkad32.exe
        122⤵
        
        PID:384
        
        C:\Windows\SysWOW64\Nemcjk32.exe
        
        C:\Windows\system32\Nemcjk32.exe
        123⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Npchgdcd.exe
        
        C:\Windows\system32\Npchgdcd.exe
        124⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Ngmpcn32.exe
        
        C:\Windows\system32\Ngmpcn32.exe
        125⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Neppokal.exe
        
        C:\Windows\system32\Neppokal.exe
        126⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Nohehq32.exe
        
        C:\Windows\system32\Nohehq32.exe
        127⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Nebmekoi.exe
        
        C:\Windows\system32\Nebmekoi.exe
        128⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Nhpiafnm.exe
        
        C:\Windows\system32\Nhpiafnm.exe
        129⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Ngaionfl.exe
        
        C:\Windows\system32\Ngaionfl.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6740
        
        C:\Windows\SysWOW64\Nipekiep.exe
        
        C:\Windows\system32\Nipekiep.exe
        131⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Nchjdo32.exe
        
        C:\Windows\system32\Nchjdo32.exe
        132⤵
        Drops file in System32 directory
        
        PID:6940
        
        C:\Windows\SysWOW64\Nibbqicm.exe
        
        C:\Windows\system32\Nibbqicm.exe
        133⤵
        Drops file in System32 directory
        
        PID:6988
        
        C:\Windows\SysWOW64\Ncjginjn.exe
        
        C:\Windows\system32\Ncjginjn.exe
        134⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Olckbd32.exe
        
        C:\Windows\system32\Olckbd32.exe
        135⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Ocmconhk.exe
        
        C:\Windows\system32\Ocmconhk.exe
        136⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Ocopdn32.exe
        
        C:\Windows\system32\Ocopdn32.exe
        137⤵
        Drops file in System32 directory
        
        PID:3372
        
        C:\Windows\SysWOW64\Ohlimd32.exe
        
        C:\Windows\system32\Ohlimd32.exe
        138⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Oofaiokl.exe
        
        C:\Windows\system32\Oofaiokl.exe
        139⤵
        Drops file in System32 directory
        
        PID:6456
        
        C:\Windows\SysWOW64\Ogmijllo.exe
        
        C:\Windows\system32\Ogmijllo.exe
        140⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5240
        
        C:\Windows\SysWOW64\Oileggkb.exe
        
        C:\Windows\system32\Oileggkb.exe
        141⤵
        Drops file in System32 directory
        
        PID:6632
        
        C:\Windows\SysWOW64\Ojnblg32.exe
        
        C:\Windows\system32\Ojnblg32.exe
        142⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Ocffempp.exe
        
        C:\Windows\system32\Ocffempp.exe
        143⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Plagcbdn.exe
        
        C:\Windows\system32\Plagcbdn.exe
        144⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Pckppl32.exe
        
        C:\Windows\system32\Pckppl32.exe
        145⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Pgflqkdd.exe
        
        C:\Windows\system32\Pgflqkdd.exe
        146⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6168
        
        C:\Windows\SysWOW64\Pjehmfch.exe
        
        C:\Windows\system32\Pjehmfch.exe
        147⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Poaqemao.exe
        
        C:\Windows\system32\Poaqemao.exe
        148⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Pflibgil.exe
        
        C:\Windows\system32\Pflibgil.exe
        149⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Pleaoa32.exe
        
        C:\Windows\system32\Pleaoa32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6772
        
        C:\Windows\SysWOW64\Podmkm32.exe
        
        C:\Windows\system32\Podmkm32.exe
        151⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Pjjahe32.exe
        
        C:\Windows\system32\Pjjahe32.exe
        152⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Pqcjepfo.exe
        
        C:\Windows\system32\Pqcjepfo.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4788
        
        C:\Windows\SysWOW64\Qcbfakec.exe
        
        C:\Windows\system32\Qcbfakec.exe
        154⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Qfpbmfdf.exe
        
        C:\Windows\system32\Qfpbmfdf.exe
        155⤵
        Modifies registry class
        
        PID:6668
        
        C:\Windows\SysWOW64\Qqffjo32.exe
        
        C:\Windows\system32\Qqffjo32.exe
        156⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Qfbobf32.exe
        
        C:\Windows\system32\Qfbobf32.exe
        157⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Qhakoa32.exe
        
        C:\Windows\system32\Qhakoa32.exe
        158⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Aokcklid.exe
        
        C:\Windows\system32\Aokcklid.exe
        159⤵
        Drops file in System32 directory
        
        PID:6972
        
        C:\Windows\SysWOW64\Ahchda32.exe
        
        C:\Windows\system32\Ahchda32.exe
        160⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Amodep32.exe
        
        C:\Windows\system32\Amodep32.exe
        161⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Afghneoo.exe
        
        C:\Windows\system32\Afghneoo.exe
        162⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Amaqjp32.exe
        
        C:\Windows\system32\Amaqjp32.exe
        163⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Acnemi32.exe
        
        C:\Windows\system32\Acnemi32.exe
        164⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Bqdblmhl.exe
        
        C:\Windows\system32\Bqdblmhl.exe
        165⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Bcelmhen.exe
        
        C:\Windows\system32\Bcelmhen.exe
        166⤵
        Modifies registry class
        
        PID:6892
        
        C:\Windows\SysWOW64\Bjodjb32.exe
        
        C:\Windows\system32\Bjodjb32.exe
        167⤵
        
        PID:432
        
        C:\Windows\SysWOW64\Bqkill32.exe
        
        C:\Windows\system32\Bqkill32.exe
        168⤵
        Drops file in System32 directory
        
        PID:5296
        
        C:\Windows\SysWOW64\Bpnihiio.exe
        
        C:\Windows\system32\Bpnihiio.exe
        169⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Bmbiamhi.exe
        
        C:\Windows\system32\Bmbiamhi.exe
        170⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Bclang32.exe
        
        C:\Windows\system32\Bclang32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7260
        
        C:\Windows\SysWOW64\Cmfclm32.exe
        
        C:\Windows\system32\Cmfclm32.exe
        172⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Cpeohh32.exe
        
        C:\Windows\system32\Cpeohh32.exe
        173⤵
        Modifies registry class
        
        PID:7360
        
        C:\Windows\SysWOW64\Cfogeb32.exe
        
        C:\Windows\system32\Cfogeb32.exe
        174⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Cmipblaq.exe
        
        C:\Windows\system32\Cmipblaq.exe
        175⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Ccchof32.exe
        
        C:\Windows\system32\Ccchof32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7516
        
        C:\Windows\SysWOW64\Cippgm32.exe
        
        C:\Windows\system32\Cippgm32.exe
        177⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Cpihcgoa.exe
        
        C:\Windows\system32\Cpihcgoa.exe
        178⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Cffmfadl.exe
        
        C:\Windows\system32\Cffmfadl.exe
        179⤵
        Modifies registry class
        
        PID:7656
        
        C:\Windows\SysWOW64\Dannij32.exe
        
        C:\Windows\system32\Dannij32.exe
        180⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Dclkee32.exe
        
        C:\Windows\system32\Dclkee32.exe
        181⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Dcogje32.exe
        
        C:\Windows\system32\Dcogje32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7784
        
        C:\Windows\SysWOW64\Ddcqedkk.exe
        
        C:\Windows\system32\Ddcqedkk.exe
        183⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Eagaoh32.exe
        
        C:\Windows\system32\Eagaoh32.exe
        184⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Eaindh32.exe
        
        C:\Windows\system32\Eaindh32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7912
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        186⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Epokedmj.exe
        
        C:\Windows\system32\Epokedmj.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8000
        
        C:\Windows\SysWOW64\Ehfcfb32.exe
        
        C:\Windows\system32\Ehfcfb32.exe
        188⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Eigonjcj.exe
        
        C:\Windows\system32\Eigonjcj.exe
        189⤵
        Modifies registry class
        
        PID:8092
        
        C:\Windows\SysWOW64\Epagkd32.exe
        
        C:\Windows\system32\Epagkd32.exe
        190⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Emehdh32.exe
        
        C:\Windows\system32\Emehdh32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8176
        
        C:\Windows\SysWOW64\Eaqdegaj.exe
        
        C:\Windows\system32\Eaqdegaj.exe
        192⤵
        Drops file in System32 directory
        
        PID:7184
        
        C:\Windows\SysWOW64\Efmmmn32.exe
        
        C:\Windows\system32\Efmmmn32.exe
        193⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Filiii32.exe
        
        C:\Windows\system32\Filiii32.exe
        194⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Faenpf32.exe
        
        C:\Windows\system32\Faenpf32.exe
        195⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        196⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Fhdohp32.exe
        
        C:\Windows\system32\Fhdohp32.exe
        197⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        198⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Gpaqbbld.exe
        
        C:\Windows\system32\Gpaqbbld.exe
        199⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Gkgeoklj.exe
        
        C:\Windows\system32\Gkgeoklj.exe
        200⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        201⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Ginnfgop.exe
        
        C:\Windows\system32\Ginnfgop.exe
        202⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        203⤵
        Modifies registry class
        
        PID:7996
        
        C:\Windows\SysWOW64\Hhbkinel.exe
        
        C:\Windows\system32\Hhbkinel.exe
        204⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Hdilnojp.exe
        
        C:\Windows\system32\Hdilnojp.exe
        205⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Hdkidohn.exe
        
        C:\Windows\system32\Hdkidohn.exe
        206⤵
        Drops file in System32 directory
        
        PID:8160
        
        C:\Windows\SysWOW64\Hgiepjga.exe
        
        C:\Windows\system32\Hgiepjga.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7248
        
        C:\Windows\SysWOW64\Hncmmd32.exe
        
        C:\Windows\system32\Hncmmd32.exe
        208⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Hpbiip32.exe
        
        C:\Windows\system32\Hpbiip32.exe
        209⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Hhiajmod.exe
        
        C:\Windows\system32\Hhiajmod.exe
        210⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Hglaej32.exe
        
        C:\Windows\system32\Hglaej32.exe
        211⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        212⤵
        Drops file in System32 directory
        
        PID:7924
        
        C:\Windows\SysWOW64\Hjlkge32.exe
        
        C:\Windows\system32\Hjlkge32.exe
        213⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Hacbhb32.exe
        
        C:\Windows\system32\Hacbhb32.exe
        214⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Ihnkel32.exe
        
        C:\Windows\system32\Ihnkel32.exe
        215⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Injcmc32.exe
        
        C:\Windows\system32\Injcmc32.exe
        216⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Iqipio32.exe
        
        C:\Windows\system32\Iqipio32.exe
        217⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Indfca32.exe
        
        C:\Windows\system32\Indfca32.exe
        218⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Jkhgmf32.exe
        
        C:\Windows\system32\Jkhgmf32.exe
        219⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        220⤵
        Modifies registry class
        
        PID:7680
        
        C:\Windows\SysWOW64\Jgogbgei.exe
        
        C:\Windows\system32\Jgogbgei.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8028
        
        C:\Windows\SysWOW64\Jjmcnbdm.exe
        
        C:\Windows\system32\Jjmcnbdm.exe
        222⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Jhpqaiji.exe
        
        C:\Windows\system32\Jhpqaiji.exe
        223⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Jnmijq32.exe
        
        C:\Windows\system32\Jnmijq32.exe
        224⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Jgenbfoa.exe
        
        C:\Windows\system32\Jgenbfoa.exe
        225⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Jjdjoane.exe
        
        C:\Windows\system32\Jjdjoane.exe
        226⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        227⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        228⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Knbbep32.exe
        
        C:\Windows\system32\Knbbep32.exe
        229⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        230⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Knflpoqf.exe
        
        C:\Windows\system32\Knflpoqf.exe
        231⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Kilpmh32.exe
        
        C:\Windows\system32\Kilpmh32.exe
        232⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        233⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Kinmcg32.exe
        
        C:\Windows\system32\Kinmcg32.exe
        234⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        235⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        236⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Lnbklm32.exe
        
        C:\Windows\system32\Lnbklm32.exe
        237⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Laqhhi32.exe
        
        C:\Windows\system32\Laqhhi32.exe
        238⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Lijlof32.exe
        
        C:\Windows\system32\Lijlof32.exe
        239⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Mjneln32.exe
        
        C:\Windows\system32\Mjneln32.exe
        240⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Mecjif32.exe
        
        C:\Windows\system32\Mecjif32.exe
        241⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Mjpbam32.exe
        
        C:\Windows\system32\Mjpbam32.exe
        242⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Mlpokp32.exe
        
        C:\Windows\system32\Mlpokp32.exe
        243⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Mifljdjo.exe
        
        C:\Windows\system32\Mifljdjo.exe
        244⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        245⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        246⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        247⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        248⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Noeahkfc.exe
        
        C:\Windows\system32\Noeahkfc.exe
        249⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        250⤵
        Drops file in System32 directory
        
        PID:5576
        
        C:\Windows\SysWOW64\Neoieenp.exe
        
        C:\Windows\system32\Neoieenp.exe
        251⤵
        
        PID:3752
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        252⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Nahgoe32.exe
        
        C:\Windows\system32\Nahgoe32.exe
        253⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Nhbolp32.exe
        
        C:\Windows\system32\Nhbolp32.exe
        254⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        255⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Nefped32.exe
        
        C:\Windows\system32\Nefped32.exe
        256⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        257⤵
        
        PID:8660
        
        C:\Windows\SysWOW64\Objpoh32.exe
        
        C:\Windows\system32\Objpoh32.exe
        258⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        259⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8800
        
        C:\Windows\SysWOW64\Oaompd32.exe
        
        C:\Windows\system32\Oaompd32.exe
        260⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Oekiqccc.exe
        
        C:\Windows\system32\Oekiqccc.exe
        261⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Ohiemobf.exe
        
        C:\Windows\system32\Ohiemobf.exe
        262⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        263⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Ooejohhq.exe
        
        C:\Windows\system32\Ooejohhq.exe
        264⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Oadfkdgd.exe
        
        C:\Windows\system32\Oadfkdgd.exe
        265⤵
        Modifies registry class
        
        PID:8104
        
        C:\Windows\SysWOW64\Oeoblb32.exe
        
        C:\Windows\system32\Oeoblb32.exe
        266⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        267⤵
        Drops file in System32 directory
        
        PID:8272
        
        C:\Windows\SysWOW64\Oohgdhfn.exe
        
        C:\Windows\system32\Oohgdhfn.exe
        268⤵
        Drops file in System32 directory
        
        PID:8392
        
        C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        269⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Oeaoab32.exe
        
        C:\Windows\system32\Oeaoab32.exe
        270⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        271⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        272⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Piphgq32.exe
        
        C:\Windows\system32\Piphgq32.exe
        273⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Pkadoiip.exe
        
        C:\Windows\system32\Pkadoiip.exe
        274⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        275⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        276⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Pidabppl.exe
        
        C:\Windows\system32\Pidabppl.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8348
        
        C:\Windows\SysWOW64\Poajkgnc.exe
        
        C:\Windows\system32\Poajkgnc.exe
        278⤵
        Modifies registry class
        
        PID:8512
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        279⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Pocfpf32.exe
        
        C:\Windows\system32\Pocfpf32.exe
        280⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9032
        
        C:\Windows\SysWOW64\Pemomqcn.exe
        
        C:\Windows\system32\Pemomqcn.exe
        282⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        283⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Qcaofebg.exe
        
        C:\Windows\system32\Qcaofebg.exe
        284⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Qikgco32.exe
        
        C:\Windows\system32\Qikgco32.exe
        285⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Qohpkf32.exe
        
        C:\Windows\system32\Qohpkf32.exe
        286⤵
        Drops file in System32 directory
        
        PID:9160
        
        C:\Windows\SysWOW64\Qebhhp32.exe
        
        C:\Windows\system32\Qebhhp32.exe
        287⤵
        Drops file in System32 directory
        
        PID:5476
        
        C:\Windows\SysWOW64\Aojlaeei.exe
        
        C:\Windows\system32\Aojlaeei.exe
        288⤵
        Modifies registry class
        
        PID:8732
        
        C:\Windows\SysWOW64\Aaiimadl.exe
        
        C:\Windows\system32\Aaiimadl.exe
        289⤵
        Drops file in System32 directory
        
        PID:9172
        
        C:\Windows\SysWOW64\Ahcajk32.exe
        
        C:\Windows\system32\Ahcajk32.exe
        290⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Ajbmdn32.exe
        
        C:\Windows\system32\Ajbmdn32.exe
        291⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        292⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        293⤵
        Drops file in System32 directory
        
        PID:9232
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9276
        
        C:\Windows\SysWOW64\Aleckinj.exe
        
        C:\Windows\system32\Aleckinj.exe
        295⤵
        Modifies registry class
        
        PID:9328
        
        C:\Windows\SysWOW64\Blhpqhlh.exe
        
        C:\Windows\system32\Blhpqhlh.exe
        296⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Bcahmb32.exe
        
        C:\Windows\system32\Bcahmb32.exe
        297⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        298⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Bcinna32.exe
        
        C:\Windows\system32\Bcinna32.exe
        299⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Cmcolgbj.exe
        
        C:\Windows\system32\Cmcolgbj.exe
        300⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        301⤵
        Drops file in System32 directory
        
        PID:9572
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        302⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        303⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        304⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Ciafbg32.exe
        
        C:\Windows\system32\Ciafbg32.exe
        305⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        306⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        307⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Djelgied.exe
        
        C:\Windows\system32\Djelgied.exe
        308⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Dpdaepai.exe
        
        C:\Windows\system32\Dpdaepai.exe
        309⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        310⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        311⤵
        Drops file in System32 directory
        
        PID:10000
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        312⤵
        Modifies registry class
        
        PID:10044
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        313⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        314⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        315⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Eplgeokq.exe
        
        C:\Windows\system32\Eplgeokq.exe
        316⤵
        Drops file in System32 directory
        
        PID:10216
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        317⤵
        
        PID:9240
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        318⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Emphocjj.exe
        
        C:\Windows\system32\Emphocjj.exe
        319⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        320⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        321⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        322⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        323⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Fikbocki.exe
        
        C:\Windows\system32\Fikbocki.exe
        324⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        325⤵
        Drops file in System32 directory
        
        PID:9792
        
        C:\Windows\SysWOW64\Fllkqn32.exe
        
        C:\Windows\system32\Fllkqn32.exe
        326⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        327⤵
        Modifies registry class
        
        PID:9904
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        328⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9984
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        329⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        330⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10176
        
        C:\Windows\SysWOW64\Fjadje32.exe
        
        C:\Windows\system32\Fjadje32.exe
        332⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        333⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9312
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        334⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        335⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        336⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        337⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        338⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        339⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        340⤵
        Modifies registry class
        
        PID:10080
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        341⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Ikbfgppo.exe
        
        C:\Windows\system32\Ikbfgppo.exe
        342⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Idkkpf32.exe
        
        C:\Windows\system32\Idkkpf32.exe
        343⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9604
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9820
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        346⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        347⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10156
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        348⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        349⤵
        Drops file in System32 directory
        
        PID:9640
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        350⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        351⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        352⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        353⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        354⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        355⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9888
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        356⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        357⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        358⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        359⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        360⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10444
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        361⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        362⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        363⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        364⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        365⤵
        Modifies registry class
        
        PID:10656
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        366⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        367⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        368⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        369⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10836
        
        C:\Windows\SysWOW64\Nmenca32.exe
        
        C:\Windows\system32\Nmenca32.exe
        370⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        371⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        372⤵
        Modifies registry class
        
        PID:10960
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        373⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        374⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        375⤵
        Modifies registry class
        
        PID:11108
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        376⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        377⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        378⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        379⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        380⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        381⤵
        
        PID:10484
        
        C:\Windows\SysWOW64\Omcjep32.exe
        
        C:\Windows\system32\Omcjep32.exe
        382⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        383⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        384⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        385⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        386⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        387⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        388⤵
        Modifies registry class
        
        PID:10992
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        389⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        390⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11124
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        391⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        392⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11220
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        393⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        394⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        395⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        396⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Paoollik.exe
        
        C:\Windows\system32\Paoollik.exe
        397⤵
        Drops file in System32 directory
        
        PID:10560
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        398⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        399⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        400⤵
        
        PID:3416
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        401⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        402⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        403⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        404⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        405⤵
        
        PID:1104
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        406⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        407⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2000
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        408⤵
        
        PID:2284
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        409⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        410⤵
        Drops file in System32 directory
        
        PID:2316
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        411⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        412⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        413⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        414⤵
        
        PID:2428
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        415⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        416⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        417⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        418⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        419⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        420⤵
        
        PID:10276
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        421⤵
        
        PID:10368
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        422⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        423⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        424⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        425⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Cndeii32.exe
        
        C:\Windows\system32\Cndeii32.exe
        426⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        427⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        428⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        429⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11116
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        430⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        431⤵
        
        PID:4752
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        432⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        433⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        434⤵
        
        PID:3176
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        435⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        436⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:312
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        437⤵
        
        PID:412
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        438⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        439⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        440⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        441⤵
        
        PID:652
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        442⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        443⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        444⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        445⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        446⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        447⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        448⤵
        
        PID:3496
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        449⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        450⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        451⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        452⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2824
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        453⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        454⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        455⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        456⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        457⤵
        Drops file in System32 directory
        
        PID:2556
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        458⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4320
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        459⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        460⤵
        
        PID:768
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        461⤵
        
        PID:10784
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        462⤵
        
        PID:4276
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        463⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        464⤵
        
        PID:4128
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        465⤵
        Drops file in System32 directory
        
        PID:868
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        466⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        467⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        468⤵
        
        PID:4504
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        469⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        470⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        471⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        472⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        473⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11288
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        474⤵
        
        PID:11332
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        475⤵
        
        PID:11376
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        476⤵
        
        PID:11416
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        477⤵
        
        PID:11460
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        478⤵
        Modifies registry class
        
        PID:11504
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        479⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        480⤵
        Drops file in System32 directory
        
        PID:11600
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        481⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        482⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        483⤵
        
        PID:11736
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        484⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        485⤵
        
        PID:11820
        
        C:\Windows\SysWOW64\Gimqajgh.exe
        
        C:\Windows\system32\Gimqajgh.exe
        486⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        487⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        488⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        489⤵
        
        PID:12004
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        490⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        491⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12096
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        492⤵
        
        PID:12168
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        493⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        494⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        495⤵
        Modifies registry class
        
        PID:11284
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        496⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        497⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        498⤵
        Drops file in System32 directory
        
        PID:4448
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        499⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        500⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        501⤵
        
        PID:11720
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        502⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        503⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5700
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        504⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        505⤵
        
        PID:11940
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        506⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12032
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        507⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        508⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        509⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        510⤵
        
        PID:12196
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        511⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        512⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11276
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        513⤵
        
        PID:11328
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        514⤵
        
        PID:11400
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        515⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        516⤵
        Drops file in System32 directory
        
        PID:5400
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        517⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11684
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        518⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Loighj32.exe
        
        C:\Windows\system32\Loighj32.exe
        519⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        520⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        521⤵
        
        PID:11900
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        522⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        523⤵
        
        PID:11968
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        524⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        525⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        526⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        527⤵
        
        PID:12136
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        528⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        529⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        530⤵
        Drops file in System32 directory
        
        PID:12268
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        531⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        532⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        533⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        534⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        535⤵
        
        PID:11456
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        536⤵
        
        PID:11612
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        537⤵
        
        PID:11584
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        538⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        539⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        540⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        541⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        542⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        543⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        544⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        545⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        546⤵
        Drops file in System32 directory
        
        PID:5744
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        547⤵
        
        PID:12084
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        548⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        549⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        550⤵
        
        PID:12152
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        551⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        552⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4032
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        553⤵
        Drops file in System32 directory
        
        PID:5276
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        554⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        555⤵
        
        PID:11404
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        556⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Pmiikh32.exe
        
        C:\Windows\system32\Pmiikh32.exe
        557⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        558⤵
        Drops file in System32 directory
        
        PID:6864
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        559⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        560⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7040
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        561⤵
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        562⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        563⤵
        Modifies registry class
        
        PID:5592
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        564⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        565⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5728
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        566⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        567⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Qmeigg32.exe
        
        C:\Windows\system32\Qmeigg32.exe
        568⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        569⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        570⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        571⤵
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        572⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6744
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        573⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        574⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        575⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        576⤵
        
        PID:11324
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        577⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        578⤵
        
        PID:4040
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        579⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        580⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        581⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        582⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        583⤵
        Drops file in System32 directory
        
        PID:6488
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        584⤵
        Modifies registry class
        
        PID:5260
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        585⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        586⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11800
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        587⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        588⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        589⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        590⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        591⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        592⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        593⤵
        Drops file in System32 directory
        
        PID:6564
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        594⤵
        Modifies registry class
        
        PID:6772
        
        C:\Windows\SysWOW64\Chfegk32.exe
        
        C:\Windows\system32\Chfegk32.exe
        595⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        596⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        597⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        598⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        599⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        600⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        601⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5368
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        602⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        603⤵
        Modifies registry class
        
        PID:6216
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        604⤵
        Drops file in System32 directory
        
        PID:6264
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        605⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        606⤵
        Drops file in System32 directory
        
        PID:1404
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        607⤵
        Modifies registry class
        
        PID:6384
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        608⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        609⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5644
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        610⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        611⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11944
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        612⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\Dglkoeio.exe
        
        C:\Windows\system32\Dglkoeio.exe
        613⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        614⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        615⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        616⤵
        Drops file in System32 directory
        
        PID:6544
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        617⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Ebfign32.exe
        
        C:\Windows\system32\Ebfign32.exe
        618⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4788
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        619⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        620⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        621⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        622⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        623⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        624⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        625⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        626⤵
        
        PID:11540
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        627⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        628⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        629⤵
        
        PID:11768
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        630⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        631⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Fganqbgg.exe
        
        C:\Windows\system32\Fganqbgg.exe
        632⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        633⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        634⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        635⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        636⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        637⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        638⤵
        Drops file in System32 directory
        
        PID:456
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        639⤵
        Modifies registry class
        
        PID:6468
        
        C:\Windows\SysWOW64\Gbkkik32.exe
        
        C:\Windows\system32\Gbkkik32.exe
        640⤵
        Modifies registry class
        
        PID:7740
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        641⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        642⤵
        
        PID:11436
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        643⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        644⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        645⤵
        Drops file in System32 directory
        
        PID:7080
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        646⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        647⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        648⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7576
        
        C:\Windows\SysWOW64\Ggmmlamj.exe
        
        C:\Windows\system32\Ggmmlamj.exe
        649⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        650⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        651⤵
        Drops file in System32 directory
        
        PID:6300
        
        C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        652⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        653⤵
        
        PID:3408
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        654⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        655⤵
        Drops file in System32 directory
        
        PID:8020
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        656⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7000
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        657⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        658⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6700
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        659⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        660⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        661⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Hejqldci.exe
        
        C:\Windows\system32\Hejqldci.exe
        662⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        663⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        664⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1840
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        665⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        666⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\Ieojgc32.exe
        
        C:\Windows\system32\Ieojgc32.exe
        667⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        668⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        669⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        670⤵
        Drops file in System32 directory
        
        PID:2720
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        671⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        672⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        673⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        674⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        675⤵
        Modifies registry class
        
        PID:6240
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        676⤵
        Modifies registry class
        
        PID:8176
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        677⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        678⤵
        Modifies registry class
        
        PID:7268
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        679⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        680⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        681⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        682⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6812
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        683⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        684⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        685⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        686⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        687⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        688⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Klbnajqc.exe
        
        C:\Windows\system32\Klbnajqc.exe
        689⤵
        Drops file in System32 directory
        
        PID:7248
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        690⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Kabcopmg.exe
        
        C:\Windows\system32\Kabcopmg.exe
        691⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        692⤵
        
        PID:12248
        
        C:\Windows\SysWOW64\Lepleocn.exe
        
        C:\Windows\system32\Lepleocn.exe
        693⤵
        Modifies registry class
        
        PID:7228
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        694⤵
        Modifies registry class
        
        PID:8120
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        695⤵
        Drops file in System32 directory
        
        PID:7680
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        696⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        697⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Ledepn32.exe
        
        C:\Windows\system32\Ledepn32.exe
        698⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        699⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        700⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        701⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        702⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        703⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        704⤵
        Modifies registry class
        
        PID:7812
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        705⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        706⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        707⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        708⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        709⤵
        Drops file in System32 directory
        
        PID:8236
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        710⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        711⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        712⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Mjpjgj32.exe
        
        C:\Windows\system32\Mjpjgj32.exe
        713⤵
        Drops file in System32 directory
        
        PID:7540
        
        C:\Windows\SysWOW64\Nhegig32.exe
        
        C:\Windows\system32\Nhegig32.exe
        714⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        715⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Nfihbk32.exe
        
        C:\Windows\system32\Nfihbk32.exe
        716⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        717⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        718⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        719⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        720⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        721⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8572
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        722⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        723⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        724⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        725⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        726⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        727⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10980
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        728⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        729⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        730⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        731⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7684
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        732⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        733⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        734⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        735⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        736⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7560
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        737⤵
        Modifies registry class
        
        PID:8660
        
        C:\Windows\SysWOW64\Ppnenlka.exe
        
        C:\Windows\system32\Ppnenlka.exe
        738⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        739⤵
        
        PID:3752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 412
        740⤵
        Program crash
        
        PID:8384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3864 --field-trial-handle=2264,i,1475924722205134884,16549311107360026087,262144 --variations-seed-version /prefetch:8
1⤵
PID:1528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3752 -ip 3752
1⤵
PID:8932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acnemi32.exe

Filesize
178KB

MD5
05f9ea33d47bcd085cae9ac8b751f4a2

SHA1
d86747ab541c31e60db0448683dac7ed2cd81563

SHA256
9e0ba0ff89fabe6af67df1fa0814a31d33f6e6677517fa3838c864fb07360353

SHA512
dee8c0b318e5188614a0d07d8dc0c153abbbee15593bb53839f96c08b4c7e7046b4b98a5d08ffc283b0011ae59a97ed79010da17e048f2cb0249f35168a324db

Download Submit
C:\Windows\SysWOW64\Aeklkchg.exe

Filesize
178KB

MD5
5dd4baa9151d37e09fdb46558705376d

SHA1
c7c1496e6c3ff7b42f8c9fd8b1250b2de47d2620

SHA256
d09263d59e07a216c2fd6b3e3609420af2c3cc5a806ce951301bbdc406e4ef11

SHA512
5763a40db974302e7fd873cc1f126cf4400117c95c193b8a0a278962611d57430d9d3b3ad4ed6c08c8a4e98acef178de603cae4cf9350b3460a1f3fb097a64ff

Download Submit
C:\Windows\SysWOW64\Ajckij32.exe

Filesize
178KB

MD5
76620ebb2c676c04eeb1961366884008

SHA1
141bbd7bcd153f34ac5e49046de11bab3fba89a0

SHA256
d1d62ce43b1c89dfc2de631034d013111484c07bbd2923acfb363aa7d05ce6ce

SHA512
eead2af7882aaef9968212fdeb65f723b951af35f28471b38d7fe9860cc75a22fcb5e57a9b2ef4905ca3402b5c773b12c7b2fd5a303b81c25f5149fee4043318

Download Submit
C:\Windows\SysWOW64\Andqdh32.exe

Filesize
178KB

MD5
ac5e52cd5fab81a5eb546a22598f9f20

SHA1
07f668dab7fd890b1f172cd1f4762a164836e031

SHA256
2d90c99ed8677a3a3ae7564b7aaf7029efff98c7cef1b48ad59b83f7dfa334a8

SHA512
53cd6fbeb3758f695cb76abb05385b609b9b0d2d506cf860582d2230a02ff940d3d42a40511808749552eb4ebfcda94b419f4529f97022f0e6b7aeaeb088ca25

Download Submit
C:\Windows\SysWOW64\Anmjcieo.exe

Filesize
178KB

MD5
7083a17e0382793429957b44d9353c20

SHA1
dfb8c1bee5014208acc53fcd917354fb84795b09

SHA256
9ecd109a4145a10e48a257b0c1b8d0b409206b240e3b698f57d0f543f0395459

SHA512
eff4a6d834d2ac7cf2ddbfc505b9b00efa1afee6ded0d183aefa42ae1bc7c14aff4ceaed0dce311cb59b3635d21e12390c310340084380e5f665516e131f54bf

Download Submit
C:\Windows\SysWOW64\Aqkgpedc.exe

Filesize
178KB

MD5
beb46f99b0f7b7175d499287169b1f9d

SHA1
b59ec3dc9e9c7277c103621ec7c52f70d4b98674

SHA256
418b4e400746669c72560008f98b780e346ccc1f7c8fd2fdfa85e63494564179

SHA512
a55617380a95b79623a73c76f15dcc37b48781e021dbebf3606edde1a5e742c4f510d5b3dfe0a471dd59c42044f527ff9fc45f8c8012f7c61e1bf1f212720922

Download Submit
C:\Windows\SysWOW64\Aqncedbp.exe

Filesize
178KB

MD5
eba1a0d343a3ebc8c1cacb462fdbc482

SHA1
9d6406a6159d883c9e783df21b42dea77cc0bce7

SHA256
05ed1853e70869f9656baf52273d79d091985c2484cf93492de78b9f4c7ec477

SHA512
73cfe7ae8c22007aeac2c5f6defafd6bb7306e62362c0d7d71e2128cf923cedce2038d6259cc8c2fecee2d6b85d1a2bd01b3f98c4bb6f6405bc7827bb0326b6e

Download Submit
C:\Windows\SysWOW64\Bcebhoii.exe

Filesize
178KB

MD5
3ca4166a150d1788ff3bee9c1fda001f

SHA1
41becd42217037fff6e872895b63a8cb3bcb977f

SHA256
cac11dfc6f0e1be2928fa9f3d83f675a481e64d77ec002a7207a87f965deb5c4

SHA512
341c2994e1f5b08017a01f67bdc63f8c279f20cc1afee9a65f1ba28323c134f7e5cc26bb9230b007e14bd363ee9bbbc387ba94462a5be0526523870f0cf90e87

Download Submit
C:\Windows\SysWOW64\Bjddphlq.exe

Filesize
178KB

MD5
ba72ae61efb0214b15a5bc3b824c86b4

SHA1
352b03d4550f53f8ddee632f4e8620ba8f840d16

SHA256
cf184426ec0802c139d25388f7eb09a19d8d40250a137187f8c9e3027bcc048b

SHA512
c661d2bc61fd84085ce15157a44cc8a78af2bc0b49aae1269d1b9d9d9414346b20e131f86002e3dd35245fa19b350abbf3fad79ff5b3580ff2be61fab7d03fc7

Download Submit
C:\Windows\SysWOW64\Cpihcgoa.exe

Filesize
178KB

MD5
050906e6d3db816f22a10e37947ed3a8

SHA1
fe28c91a34994ea46f6928637fb9319bbec47268

SHA256
d88dba6ce575beec969405050eb030b2dc24adb673356502000e8f5247c24523

SHA512
96ec5d7db0ef56c0f6c5b4d9b27680b7e7e6f74f0bb078237a45a956ab596bbda0ef9cbd7aa1b99d3eaa393a741af302328010d8bc6014b7fc59c0e82e188bb3

Download Submit
C:\Windows\SysWOW64\Dcogje32.exe

Filesize
178KB

MD5
88ebfbb630a4ef4883e34fc5ffb0dccc

SHA1
68aa8170d79a0ebc6f267ad23e4f96722e222411

SHA256
0b965c75d73ff184d37a01fd81923b83943d2c1844bba4a070f5d34863e631f9

SHA512
18c3f118fe3a787b9967a9b3c87c18652f46bf086f6b3025879cdd2a8a1bd25c9e3639682f00394387c449401ec59bd231487e950ecd2081d02ed3334c31b91c

Download Submit
C:\Windows\SysWOW64\Emphocjj.exe

Filesize
178KB

MD5
039fc33ddb7f260101c8f6a93874b637

SHA1
3a49a77be85387e5d5f700013770c182f7fda794

SHA256
623138fc34c5e5c094b972b37cfb7031ecdae7f06ee50a02bcdec384dd395a4d

SHA512
34e649af72f011cdd5c71e03327e571527a7e4e540bab9988a13244886e79da76c95b2d0e1b457a3515424d71b7cdbecf8456b0efb32b29f93b14d3b33bcd8a7

Download Submit
C:\Windows\SysWOW64\Hdilnojp.exe

Filesize
178KB

MD5
ed63c022dd39782c49639bf9b2f9faf1

SHA1
9821cf93f4b686a49771b16f83269d7947e8f54a

SHA256
47789d35a6e68b044f2cd7cd8aadc375a8e5cd0e15980882dee0232565fab81e

SHA512
b8cf16a71efe8c3e63e44381336957c1b5fe6e2ba120e024d7b7a4acfdc09b95925fd53a3d3df1188df900414800d6c8487edacfe364ffe233605372b5017dcc

Download Submit
C:\Windows\SysWOW64\Idebdcdo.exe

Filesize
178KB

MD5
667ea06e57b4e74bb4d46940f0826b29

SHA1
6905faf935c3d48db1e9059930f81076d6fd1450

SHA256
e3c77ccb96f0d933d2e051469a3f96877649a94b2577f940cee45d77f5e76d70

SHA512
693ad6213f0c42bea88cd6a5323c91986a8f91e9f9777347b2de9b9062c6484f8e6c515a389cc06d3d8c87056be436ed858885d9c05890195bc043917f781aa2

Download Submit
C:\Windows\SysWOW64\Kelkaj32.exe

Filesize
178KB

MD5
1364024f211c480c946d4f3bb9388514

SHA1
b3d2d272473baf30b17c8aeb51e50d514a8712d1

SHA256
1afafffa71eccd406c17d55e0947f804c42864a25eca64969f50f6f89f09e2cf

SHA512
8448a6be29a43d3e9df9633dd67086eba75afb578a3a2e22e28f983ae3485fd8ff3998e8ec8f9b66563bc36759354f3b42385731e2a23b098b0354a469b00d21

Download Submit
C:\Windows\SysWOW64\Mcpnhfhf.exe

Filesize
178KB

MD5
8f2219c2369ae5786f565e31cfa0fc7d

SHA1
f136e40b61e65b6080c4ae611425d30ba2ae8a15

SHA256
8ad60c51829130ba6f32bf4a170e43ed7e24c73bcb6e6c5b57899cb347965d25

SHA512
fe79661ef74cbaef6314b325146349958ea87647fa69fc2d4fff2cf003cb42f6ec076058186a101bd083f2c2da13a8448b5aa7bd745e7c548df59f2566a3c6a3

Download Submit
C:\Windows\SysWOW64\Mgclpkac.exe

Filesize
178KB

MD5
d15f0ff986472bd5b9642998cb5d03a5

SHA1
919a4b94e856a4914aa5a6b0e52174fc27efcc9c

SHA256
8cfff5118fb06bfa6d3af4bffda759a99ba56dd622ddbab807e64f9357ddc716

SHA512
cff1cf2181113416adcd8160585ca4fdce098704013271501be511ba7820c1843b28b9554ee537124fa7e7006d69ce595077df85d1e605640212462b8ee9b59d

Download Submit
C:\Windows\SysWOW64\Mlefklpj.exe

Filesize
178KB

MD5
433ab46ce31165af1dd9016cb7978a10

SHA1
b00433a4d1c28fbe7d1e823488c35da61af0dcd7

SHA256
3914dd99ca1c7f082b9d134e084caea3f0a12251679e8f0dc2cec6e9ad511808

SHA512
384a23de27d7588a63c78f21e29a29f3c3b9073f7f075e3c83c481a4aabbad76b9c69d08798792b6c68082195bc3bde262b4288be047d636eafbd720e4fecda3

Download Submit
C:\Windows\SysWOW64\Ndaggimg.exe

Filesize
178KB

MD5
0389c011ffed2cac4bdd368d435488df

SHA1
d93f81f521fbc23fd697e8731544e5e13f9c05f7

SHA256
4d40bb1649d7b0747a084cc65b36decb3f3a66d87ce22b5c11b337fa00773a23

SHA512
6f0ad61d79fe01758fbd466f88f45d1195ba7610672c6a82d4a282ecc2c27df7c1b26f58297311736c96db1d39fe68d20863b3a553c7fa50406299035c0fffa3

Download Submit
C:\Windows\SysWOW64\Nebdoa32.exe

Filesize
178KB

MD5
ebf6688d56016b71c14ca212312ece05

SHA1
c54b5195cbdd056fae7bc18bbdf20665ffa66bb3

SHA256
06a06ca804b95642e17db6c96bb1fc4afc55ed290cbac1d44ae7af880b4cfdc5

SHA512
12604e10ce1c53fc70126331402adf7845452780fe34631a51f6e97a24a4bd1409309984a9277890c8db5866c8bcc9e3f28600c4d9c9246196b28d174c3d6229

Download Submit
C:\Windows\SysWOW64\Nenqea32.dll

Filesize
7KB

MD5
c53f514d39d20896eff481556b5f0e79

SHA1
dc2e6ee28f2b34d29a477dd537625ee4b3b7fb03

SHA256
bdc949dad255990cc4513b4a3fe90cca4189698695ef03d370379573a60ba5f6

SHA512
04060447dfe7ac1f672b27f31f4eb846a3b0d9f7cc926bfe4fc69a2bfc839f935172a968956328ea40dbdf373b0439e65d8792fc6926f8cdb76d38497e78c725

Download Submit
C:\Windows\SysWOW64\Nepgjaeg.exe

Filesize
178KB

MD5
9ba166134cbd5e9dad9a94e55164361f

SHA1
119c85610f0c9c7dfac683ecfc8e3e117821bf02

SHA256
14b4712efa490717099b5d7fec7e22083a16f215d57a5e98d667cad3ea27a973

SHA512
60be07f9706b65355d6a3ab252ccc47ab95bfc600cf6130b097a2e51a5d95c0bc8846e9c8218aa57bc0df46922f69cdf17a99f26aeaa2629a76349076289f099

Download Submit
C:\Windows\SysWOW64\Ngbpidjh.exe

Filesize
178KB

MD5
2d458ca51884d399b76a8037a7c7f301

SHA1
bebfee06d7a325a0ec9e78f72079c496bf036b23

SHA256
7e2e00b7a5df3c2dd0d26a3b7b0b63742f0bbde3ae3f82145edefa1adcc4a195

SHA512
5a7ad4c8c7707595e26e6acaf8a9670bd90bddeae6c4ab93908f7b759ae4e44827cf97cb536c65fafe897faedd249b5c8e97f0eb2ab2b9f3af3ac28243386040

Download Submit
C:\Windows\SysWOW64\Nggjdc32.exe

Filesize
178KB

MD5
b344d8c433f86764563c74191c4d7109

SHA1
f700f57463650314d5b9d8055bb5d263600f3af4

SHA256
05a4ac790d503e406511f8b2e1c43197be294c43965c7847dc1be88d656c0fa1

SHA512
69ecba1bbdad38a047b5d61307e3e09aad8e7c650b451a7dea57c27789ec3c9f881a1a5a6dea1d5bbd82d198e6d3ac1844c98ed2c58cc50b28aa56e3e28f599e

Download Submit
C:\Windows\SysWOW64\Njciko32.exe

Filesize
178KB

MD5
f6625b2bd409976d8cc2abd8fff84a51

SHA1
a9b7f30c0f48e0265819cb73024aac4ea34dfa2f

SHA256
cc5d1cc0462cbb7cf23bd7a7eb71ae7b0be16258125f2835fafd8370b486e4aa

SHA512
944184881429cc1ab0f17749bfc4b7f8a93a297ea70aaabef9904aabe313ae69f3dfc8c207ad6ee355d85c39b04015075b25c8061a9463740c8cac942dd73c67

Download Submit
C:\Windows\SysWOW64\Nnjlpo32.exe

Filesize
178KB

MD5
a38009e655fe922cc16d9f0ea03e76ff

SHA1
d5b09dbbad82d782c0c54b2daff096e732798f61

SHA256
b4bced7dc8720f0edc4246edc8f9a1d30fafcd2c012a5d2f32e23984d7f57f1d

SHA512
df81438241be217d3b7abaa16e225d3592d287174072593e3c0a349cbc4d1c28e6022a198b52ebc8542f5357a0dbf353dbfa9a63c6a1acb1ae37346a98a9b757

Download Submit
C:\Windows\SysWOW64\Nnlhfn32.exe

Filesize
178KB

MD5
730a5215a02a23716ad2560dd341dcd8

SHA1
3bd84bc1de14ae95ffe03d1d7d83f795eefb7e12

SHA256
c1e2534b3cb76c99268a95fcd1dc6b987598deabf680abc14c917a98404b55c8

SHA512
f0c69e5635e73bcefbf563a902612508a56625a005925365b56078958df7c7f7efd18c35677c824427cc9ad557c0e48743dc3ad1ff1438e9fff8a89010665d75

Download Submit
C:\Windows\SysWOW64\Npcoakfp.exe

Filesize
178KB

MD5
47fe37a6043ffffd9555e29a7c24b80d

SHA1
becfac2d8724da2ecac0a52c3cdcec00e7a99e26

SHA256
8e27802a208ecec2b4133795e3b0bc1734a963fcb73ef79ceb22e4597e287b66

SHA512
672380ccebbe5103b58566c5f62cbab48483a548b351e8d32c481f23b7c4812e1fb6087ab09ca18f3794e473818e6d5cba5417c19ebafdd06d502659aa1c7bd7

Download Submit
C:\Windows\SysWOW64\Ocbddc32.exe

Filesize
178KB

MD5
7579644152bf1d075223c162f866fbf4

SHA1
172570332dc5e517c1e84b07f1eae31411dc8fc0

SHA256
5bd31a7f1588f798001f5012b50e4297d1a5a8e883f0daeb2a8ee9dcca09d867

SHA512
193b9f921f9409b8a4e5d9c8e49f21f1651ba4e493e4c1ac4b7265598139b87366e8cd5a6d43e47c7e7f7b4afbe5a5a28d77a4419e0ee987813bb841bb68b845

Download Submit
C:\Windows\SysWOW64\Ogkcpbam.exe

Filesize
178KB

MD5
97c1d8e90bf3c3343038b6f0f716e075

SHA1
cd304a0550abb94560f52966dcc9ddcece015b5f

SHA256
1d9e5f23bbea82c463573501edc81029aaba516f086e02e78bd9c123988a0c31

SHA512
21c8a5cdb0b1a39a19fba4540028405dd4e15461ec5ae531d988343dc4c2980030e24239d2d3e913a0c93985c1d7144b6fe98d19742bc545a48516a773859f77

Download Submit
C:\Windows\SysWOW64\Ojaelm32.exe

Filesize
178KB

MD5
2bda78876e775e3be82a3ade02608f6d

SHA1
1a19d39f70205fd11c47fae0e2465250dce95285

SHA256
03bd1281cb075e80ee59add122500744766caeb71de0112d078c63bfe6d02ffb

SHA512
163074d757999d763744244f2df4d6034d63abba381f83eec8c8a957516ec0ca04de6acfe809a6fc3583c2bd5bdb0181d431d4ff436e09583653e27bcd51ef45

Download Submit
C:\Windows\SysWOW64\Ojoign32.exe

Filesize
178KB

MD5
21a4b2dd969d79588a12a95bfd374daa

SHA1
ff375d8fe7e09042c53e7454076404d4f257523c

SHA256
436386f4df80eb39d4ab8784bd38d05ce68f853e9681f45ce7320cb0366d5411

SHA512
79bd9e9bf631076fdcb37932b12d0f6a75c4ea730c545bbf6471cdd25ee961eccc549b721aa6dd1f5209f14f34cb9ad188a6de9932ced2e2430cf86d30e162c6

Download Submit
C:\Windows\SysWOW64\Oponmilc.exe

Filesize
178KB

MD5
de301ee360f5647b45e1a6435ec1d6f5

SHA1
75ffbdafcfe5e199af6108c9d61f956b45894be8

SHA256
c257be8399188196e103c2a2db865d38f895be84e114485791192c3f84cb652a

SHA512
977bedf1d962519ae95cdbe4f34c6c9c596409eebfdd4ea0b156d833c31d5a9cdb7277f1db804754b627ddb5f199941774448c1ec9ad05d8cf6e73bfa6d7bc30

Download Submit
C:\Windows\SysWOW64\Oqfdnhfk.exe

Filesize
178KB

MD5
521b489965f26d90121f3d63f3c6e047

SHA1
8a6acaff9417742eaea4a56b63f59f947e8e8c53

SHA256
1d5d87237d23e5854c6fd46504fb06f73bc46e392fcb2cc42d299a41b56f79c6

SHA512
61ab6be31056ce9a8ccf949c98e51a00c0eac710cd242f3a39684661700d61ec5182dd0cf8be23a68ddf627db4531ae4b877bd7dbc0c6ae8816edecda0fed859

Download Submit
C:\Windows\SysWOW64\Oqhacgdh.exe

Filesize
178KB

MD5
516238db41e601ed4c063dc588066b0b

SHA1
86b2bb575c6e0ac0dac4566fda7d1e04e3560f19

SHA256
9fea382184b71b2c1e38df9ec17956f2edb59bead2a8f3290c7f4ba8efe4d11c

SHA512
7a1edd4e20e97477dd17427d6599555403a33d9f82daf354239e65585dd7b2796c78eb3e5e82c99d16f6482b44131254b388b22d9b04da09c93467194d63355e

Download Submit
C:\Windows\SysWOW64\Pclgkb32.exe

Filesize
178KB

MD5
16ac8006313d72005aa6ecdaf92ac783

SHA1
b11c72edb3e6222c0af18f1286e38ee081519330

SHA256
cc7903977a33f2ec3b5e9851614b3971f170edda29774ef080756bea19b772d6

SHA512
207aaee589cc4828cdb6d3a5eecbbce69efdcdfb0259eb94ec7d342d21cdd4d904eae3ea06874e095902139465d6d8b8138afff62016936b4662329b84214b55

Download Submit
C:\Windows\SysWOW64\Pcncpbmd.exe

Filesize
178KB

MD5
738031860aeda9434fe98f0217c40dfb

SHA1
389b002734c23d5ddb0daa370f002c65b885d528

SHA256
23fe25f73f6755f9e6e6b1b38cdaea8d16bce2bea2885e78cd3d1be984be336e

SHA512
901c781b85a030cba21e3019340581e21c239e3d12445cdae7560e8f8785da27416df78277beb6a1905b46455b94264ea6ef23dd4d1a9fb59a2f8bdca198f330

Download Submit
C:\Windows\SysWOW64\Pcppfaka.exe

Filesize
178KB

MD5
d03d8340ac67995126f2cb7acec6b1b3

SHA1
f4c021bb7ca21b0d3be12ba6b314c7a5edbf7ed8

SHA256
bd55e23d0a422eccaea7d520a05f03a944e526d58d924a84d0771a9249a50e8b

SHA512
bda2a4f476a36920ae34160ba2ffd0501f2e8146ee9d2a5aa662166fac2dfe197f999755eb4e111b363a6b01a3611a2d3eca3c89c77f6c0ad61ef8aacbfecd37

Download Submit
C:\Windows\SysWOW64\Pgnilpah.exe

Filesize
178KB

MD5
dc14266f774007139317a7d3d5c41d6b

SHA1
cc7f91de9627b720fceebf426b7de198efdad8c3

SHA256
28825ad3bd97bf9e4f77f0ed796e833e7b36c33128219bb7f96fae667b3b3f81

SHA512
1258f56575b8cba60fc5d3fced642e3f01dbd61648536f037d800cc5573c881e869af1768f7365450debe6cb15edba62ab4615e6b946452baa3d58132acdd391

Download Submit
C:\Windows\SysWOW64\Pmdkch32.exe

Filesize
178KB

MD5
e830cfe31cd6d0755ee8d3a34df03b26

SHA1
ff5e5928401a2686dbc2b9d8f148a637795a6496

SHA256
a0e404a6a497e96d874be04cd84fc374ea3a55e924042c96e801760c969d0517

SHA512
cd86716650e0a2f778f40367d956d8c1980d93406401ed54e41108e91197a47dcebcdd611f75641b12473a4392eebf7529efb9f1f27dd6146b5abb780b56175c

Download Submit
C:\Windows\SysWOW64\Pncgmkmj.exe

Filesize
178KB

MD5
06d69dac56320e0dd092c441b3619420

SHA1
3c99fdaad28d35a327a4aff82dea54c8a6ed9a65

SHA256
e3ebbdb4722c084e1cb449f8c629c5a91e5163b399717c498b94514f4a756427

SHA512
0147af5d08c03ac77aefd3e7eef1eec133cc953c9d0c2282aef3967acc9f8d30139a03dd210ee16cd28cb3abd69c476347574bf49e119cc065746dc353b0b09b

Download Submit
C:\Windows\SysWOW64\Qdbiedpa.exe

Filesize
178KB

MD5
8b772e31c09909d0162428cacd72e248

SHA1
dea34af879c36dbb69a99cff2b41ecf71d7984c6

SHA256
d1f8fdb791084a4972e7c868236d124fbf5ac69193ddc0c5d51163c1ae2f07fb

SHA512
19201f5c9eecdef3387c5686e6390e80b4b384ef1cb164922e7b90456c9515563d4e7543c9b842b122087dfc88aeb1a5de22e98a4dd3597850be726c600bd55b

Download Submit
C:\Windows\SysWOW64\Qnjnnj32.exe

Filesize
178KB

MD5
1eb403be49e722fe04942146ba12c879

SHA1
dbdf1acef4cf8dbde8c955d410155d541e829f8e

SHA256
0ac65d6ab44dd08b6c34fecb2c1ffdfb5049a4bb9a46c7671ca78928d215848a

SHA512
cf3c1e5bae6ea648c1b649e52f653a39491961e4254c1f1cd6fb6033a3abe9dd688fa9e259707262638a2e7fa0aef604a4caeb4dcbe31545b82f97a681cf7827

Download Submit
memory/112-104-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/116-332-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/492-172-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/528-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/652-310-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/780-200-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/828-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/980-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1032-232-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1060-191-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1132-151-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1200-207-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1208-88-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1316-183-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1392-296-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1424-143-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1464-262-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1700-95-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1824-59-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1872-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1964-52-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2076-128-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2196-274-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2272-119-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2412-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2552-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2556-346-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2636-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2704-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2736-160-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2824-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2840-220-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3008-322-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3136-334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3388-344-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3432-248-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3676-112-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3764-44-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3824-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3932-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4236-239-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4240-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4252-136-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4396-12-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4616-255-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4644-180-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4760-224-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5044-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5152-352-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5196-358-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5248-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5300-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5360-380-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5404-382-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5464-392-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5512-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5556-404-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5612-406-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5668-416-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5708-422-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5772-424-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5824-430-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5868-436-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5912-446-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads