3af65d8febb677f4c530ab44a38dc9e880552ec4fd74348ff4044530b10b9b1e

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 23:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab87fac46a27ead63f347dfa08afd8e2.exe
Size

443KB
MD5

ab87fac46a27ead63f347dfa08afd8e2
SHA1

6281a84d022d614fc082597c0c7ec0b9c8e7fc03
SHA256

3af65d8febb677f4c530ab44a38dc9e880552ec4fd74348ff4044530b10b9b1e
SHA512

d4119ac29db425849e352a354807ca28b8ea37c92b75b4256ca50f3457d04b5c7137a1cae69eace0645193f8750e733920bb20a4b1e495c3d0793e1c329368a1
SSDEEP

6144:efQ2VPsZv7zeXmRL13n4GAI13n4GAvs0PEpNF0pNO021fv13n4GA3uKjwszeXmOs:efQ2h81J1HJ1Uj+HiPj

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkamdi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djipbbne.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lhncdi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aioebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmlpjdgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebokodfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nknobkje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnkbcj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkbfpeec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phneqf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Beoimjce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kaqejcep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnabladg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fochecog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mifljdjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbcjnilj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Achegd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ackbmcjl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ioppho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ackbmcjl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bokehc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkeldnpi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inhmqlmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Miemjaci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oponmilc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlnkmnah.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oeaoab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jqbbno32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kciaqi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgoigcip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hllkqdli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hokgmpkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jjqdafmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bflagg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhbqalle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hhleefhe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkjnfkma.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Blnoga32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfddci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnppkj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acgfec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aocmio32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmnnlk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eangjkkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlihle32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlnkmnah.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fealin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hibjli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fpimlfke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npjnbg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmfkjl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fcaqka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kakednfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ogkcpbam.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahgjejhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eennefib.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gnoacp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmqiec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oekiqccc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obafpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmiclo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mminhceb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fidbgm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijedehgm.exe

Executes dropped EXE 64 IoCs

pid	Process
5108	Likjcbkc.exe
212	Lebkhc32.exe
2500	Mgagbf32.exe
436	Mibpda32.exe
1072	Miemjaci.exe
3904	Mpoefk32.exe
4968	Migjoaaf.exe
3744	Mdmnlj32.exe
2200	Ncbknfed.exe
2600	Nebdoa32.exe
4668	Njqmepik.exe
1416	Npjebj32.exe
1456	Nlaegk32.exe
4056	Oponmilc.exe
4652	Oncofm32.exe
5112	Ogkcpbam.exe
4044	Opdghh32.exe
1660	Onhhamgg.exe
4920	Odapnf32.exe
4724	Ofcmfodb.exe
5036	Oddmdf32.exe
3536	Ofeilobp.exe
1208	Pnlaml32.exe
4940	Pqknig32.exe
2504	Pgefeajb.exe
3880	Pjcbbmif.exe
1508	Pqmjog32.exe
4484	Kppici32.exe
5048	Kelalp32.exe
2468	Kijjbofj.exe
2040	Keakgpko.exe
2384	Kiodmn32.exe
4836	Kfcdfbqo.exe
2244	Lhdqnj32.exe
4532	Lnnikdnj.exe
4860	Lfealaol.exe
4100	Llbidimc.exe
1100	Lejnmncd.exe
324	Locbfd32.exe
3968	Lemkcnaa.exe
4624	Llgcph32.exe
836	Leoghn32.exe
2988	Lhncdi32.exe
4388	Loglacfo.exe
4708	Mimpolee.exe
1764	Mojhgbdl.exe
4992	Mpieqeko.exe
1560	Mefmimif.exe
4256	Mlpeff32.exe
4864	Mehjol32.exe
112	Mpnnle32.exe
60	Mblkhq32.exe
3400	Mekgdl32.exe
3148	Mbognp32.exe
2520	Neppokal.exe
4576	Nlihle32.exe
4288	Ejflhm32.exe
2588	Eaqdegaj.exe
1840	Ehjlaaig.exe
1236	Fpeafcfa.exe
1516	Fineoi32.exe
956	Fmqgpgoc.exe
5060	Fdkpma32.exe
184	Gmcdffmq.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Chglab32.exe	Cfipef32.exe
File opened for modification	C:\Windows\SysWOW64\Dajnol32.exe	Djpfbahm.exe
File created	C:\Windows\SysWOW64\Linhah32.dll	Nhdicjfp.exe
File created	C:\Windows\SysWOW64\Pbdmdlie.exe	Poeahaib.exe
File opened for modification	C:\Windows\SysWOW64\Adnilfnl.exe	Abpmpkoh.exe
File created	C:\Windows\SysWOW64\Pjmlhkgb.dll	Aqpika32.exe
File opened for modification	C:\Windows\SysWOW64\Calbnnkj.exe	Cjaiac32.exe
File opened for modification	C:\Windows\SysWOW64\Ccdnjp32.exe	Cmjemflb.exe
File opened for modification	C:\Windows\SysWOW64\Pejkmk32.exe	Pehngkcg.exe
File created	C:\Windows\SysWOW64\Llqmbp32.dll	Fncbha32.exe
File opened for modification	C:\Windows\SysWOW64\Pbfjjlgc.exe	Pohnnqgo.exe
File created	C:\Windows\SysWOW64\Opjgidfa.exe	Oiqomj32.exe
File created	C:\Windows\SysWOW64\Onbiicqa.dll	Ohdlpa32.exe
File opened for modification	C:\Windows\SysWOW64\Fealin32.exe	Fpdcag32.exe
File created	C:\Windows\SysWOW64\Dggkcakg.dll	Abcppq32.exe
File created	C:\Windows\SysWOW64\Jjknakhq.exe	Jglaepim.exe
File created	C:\Windows\SysWOW64\Goahpc32.dll	Bjkcqdje.exe
File created	C:\Windows\SysWOW64\Mifljdjo.exe	Mblcnj32.exe
File created	C:\Windows\SysWOW64\Maiccajf.exe	Mmkkmc32.exe
File created	C:\Windows\SysWOW64\Fealin32.exe	Fpdcag32.exe
File created	C:\Windows\SysWOW64\Dkakdg32.dll	Fpmeimpn.exe
File created	C:\Windows\SysWOW64\Aajohjon.exe	Akqfkp32.exe
File created	C:\Windows\SysWOW64\Idkpmgjo.exe	Inagpm32.exe
File created	C:\Windows\SysWOW64\Opedqiad.dll	Jepbodhg.exe
File opened for modification	C:\Windows\SysWOW64\Lnnikdnj.exe	Lhdqnj32.exe
File created	C:\Windows\SysWOW64\Aafemk32.exe	Qhmqdemc.exe
File created	C:\Windows\SysWOW64\Jgefkimp.dll	Migjoaaf.exe
File created	C:\Windows\SysWOW64\Mminhceb.exe	Mjkblhfo.exe
File opened for modification	C:\Windows\SysWOW64\Glipgf32.exe	Geohklaa.exe
File created	C:\Windows\SysWOW64\Apckeggh.dll	Edoncm32.exe
File opened for modification	C:\Windows\SysWOW64\Hmbkfjko.exe	Hqfqfj32.exe
File opened for modification	C:\Windows\SysWOW64\Mibpda32.exe	Mgagbf32.exe
File created	C:\Windows\SysWOW64\Fqehjpfj.dll	Ddnfmqng.exe
File created	C:\Windows\SysWOW64\Hkchqpgd.dll	Aoapcood.exe
File created	C:\Windows\SysWOW64\Anmfaf32.dll	Jcpojk32.exe
File created	C:\Windows\SysWOW64\Cokmqnam.dll	Eippgckc.exe
File created	C:\Windows\SysWOW64\Nigbmkil.dll	Hmbkfjko.exe
File created	C:\Windows\SysWOW64\Fcneeo32.exe	Klggli32.exe
File opened for modification	C:\Windows\SysWOW64\Lqbncb32.exe	Lekmnajj.exe
File opened for modification	C:\Windows\SysWOW64\Alkijdci.exe	Addaif32.exe
File created	C:\Windows\SysWOW64\Higpgk32.dll	Kjdqhjpf.exe
File created	C:\Windows\SysWOW64\Nnfkgp32.exe	Nkgoke32.exe
File created	C:\Windows\SysWOW64\Fbhnec32.exe	Elnehifk.exe
File created	C:\Windows\SysWOW64\Oanicm32.dll	Cnboma32.exe
File opened for modification	C:\Windows\SysWOW64\Pqknig32.exe	Pnlaml32.exe
File created	C:\Windows\SysWOW64\Kkeldnpi.exe	Jjafok32.exe
File created	C:\Windows\SysWOW64\Adndoe32.exe	Albpkc32.exe
File created	C:\Windows\SysWOW64\Idnabjdn.dll	Bpdfpmoo.exe
File created	C:\Windows\SysWOW64\Hjfbiobf.dll	Fcaqka32.exe
File opened for modification	C:\Windows\SysWOW64\Dcnqpo32.exe	Dmdhcddh.exe
File created	C:\Windows\SysWOW64\Alkijdci.exe	Addaif32.exe
File opened for modification	C:\Windows\SysWOW64\Mkjnfkma.exe	Mepfiq32.exe
File opened for modification	C:\Windows\SysWOW64\Ciaddaaj.exe	Cfbhhfbg.exe
File created	C:\Windows\SysWOW64\Dqiieebk.dll	Kfcdfbqo.exe
File created	C:\Windows\SysWOW64\Ddfbhfmf.dll	Achegd32.exe
File opened for modification	C:\Windows\SysWOW64\Goadfa32.exe	Ghgljg32.exe
File created	C:\Windows\SysWOW64\Mgieqpje.dll	Iiaggc32.exe
File opened for modification	C:\Windows\SysWOW64\Oaejhh32.exe	Ogpfko32.exe
File created	C:\Windows\SysWOW64\Ojbacd32.exe	Odhifjkg.exe
File created	C:\Windows\SysWOW64\Pemqkk32.dll	Akjnnpcf.exe
File created	C:\Windows\SysWOW64\Dqhckhgq.dll	Jjjggede.exe
File created	C:\Windows\SysWOW64\Famnbgil.dll	Abgjkpll.exe
File created	C:\Windows\SysWOW64\Kaonnmka.dll	Fpandm32.exe
File created	C:\Windows\SysWOW64\Pkjdhm32.dll	Acbmjcgd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10492	10400	WerFault.exe	831

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ciqmjkno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iknmla32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kaqejcep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdddhlbl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nkjlqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ckfphc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjdejk32.dll"	Hginecde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mknlef32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lhammfci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkkgqn32.dll"	Oaejhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nnabladg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgeogb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcalgbgh.dll"	Abbiej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jldpnbmh.dll"	Pgoigcip.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlpeff32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hpjmnjqn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cocacl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohkpigmd.dll"	Ababkdij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hcpojd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fpandm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fcaqka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qpbgnecp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hokgmpkl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Polnbakm.dll"	Adpogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpnnle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mohokaph.dll"	Qcaofebg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pkoemhao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dmalne32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Alkijdci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bihancje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebeapc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fenpmnno.dll"	Jmbhoeid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jmbhoeid.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cibkohef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jejechjg.dll"	Fmfnpa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Glgcbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cpqeln32.dll"	Goadfa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmlpjdgo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Moglpedd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dddmqp32.dll"	Mknlef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ebokodfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hqkefo32.dll"	Hjbhph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpcelk32.dll"	Gbdoof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Knojng32.dll"	Piolkm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Apimodmh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gldglf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdhail32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Foeeml32.dll"	Gcimfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjjlan32.dll"	Ljmmcbdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lhncdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebjkfjbc.dll"	Ojbacd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akqfkp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fncbha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gdkffi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jnolbm32.dll"	Bejhhd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpipkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jepidp32.dll"	Ndjcne32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dcnqpo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ecgcfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiaafn32.dll"	Gemkelcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gphphj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ekodjiol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhfcae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fngbbg32.dll"	Lnbklm32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 5108	752	ab87fac46a27ead63f347dfa08afd8e2.exe	87
PID 752 wrote to memory of 5108	752	ab87fac46a27ead63f347dfa08afd8e2.exe	87
PID 752 wrote to memory of 5108	752	ab87fac46a27ead63f347dfa08afd8e2.exe	87
PID 5108 wrote to memory of 212	5108	Likjcbkc.exe	88
PID 5108 wrote to memory of 212	5108	Likjcbkc.exe	88
PID 5108 wrote to memory of 212	5108	Likjcbkc.exe	88
PID 212 wrote to memory of 2500	212	Lebkhc32.exe	89
PID 212 wrote to memory of 2500	212	Lebkhc32.exe	89
PID 212 wrote to memory of 2500	212	Lebkhc32.exe	89
PID 2500 wrote to memory of 436	2500	Mgagbf32.exe	90
PID 2500 wrote to memory of 436	2500	Mgagbf32.exe	90
PID 2500 wrote to memory of 436	2500	Mgagbf32.exe	90
PID 436 wrote to memory of 1072	436	Mibpda32.exe	92
PID 436 wrote to memory of 1072	436	Mibpda32.exe	92
PID 436 wrote to memory of 1072	436	Mibpda32.exe	92
PID 1072 wrote to memory of 3904	1072	Miemjaci.exe	93
PID 1072 wrote to memory of 3904	1072	Miemjaci.exe	93
PID 1072 wrote to memory of 3904	1072	Miemjaci.exe	93
PID 3904 wrote to memory of 4968	3904	Mpoefk32.exe	94
PID 3904 wrote to memory of 4968	3904	Mpoefk32.exe	94
PID 3904 wrote to memory of 4968	3904	Mpoefk32.exe	94
PID 4968 wrote to memory of 3744	4968	Migjoaaf.exe	95
PID 4968 wrote to memory of 3744	4968	Migjoaaf.exe	95
PID 4968 wrote to memory of 3744	4968	Migjoaaf.exe	95
PID 3744 wrote to memory of 2200	3744	Mdmnlj32.exe	96
PID 3744 wrote to memory of 2200	3744	Mdmnlj32.exe	96
PID 3744 wrote to memory of 2200	3744	Mdmnlj32.exe	96
PID 2200 wrote to memory of 2600	2200	Ncbknfed.exe	97
PID 2200 wrote to memory of 2600	2200	Ncbknfed.exe	97
PID 2200 wrote to memory of 2600	2200	Ncbknfed.exe	97
PID 2600 wrote to memory of 4668	2600	Nebdoa32.exe	98
PID 2600 wrote to memory of 4668	2600	Nebdoa32.exe	98
PID 2600 wrote to memory of 4668	2600	Nebdoa32.exe	98
PID 4668 wrote to memory of 1416	4668	Njqmepik.exe	99
PID 4668 wrote to memory of 1416	4668	Njqmepik.exe	99
PID 4668 wrote to memory of 1416	4668	Njqmepik.exe	99
PID 1416 wrote to memory of 1456	1416	Npjebj32.exe	100
PID 1416 wrote to memory of 1456	1416	Npjebj32.exe	100
PID 1416 wrote to memory of 1456	1416	Npjebj32.exe	100
PID 1456 wrote to memory of 4056	1456	Nlaegk32.exe	101
PID 1456 wrote to memory of 4056	1456	Nlaegk32.exe	101
PID 1456 wrote to memory of 4056	1456	Nlaegk32.exe	101
PID 4056 wrote to memory of 4652	4056	Oponmilc.exe	102
PID 4056 wrote to memory of 4652	4056	Oponmilc.exe	102
PID 4056 wrote to memory of 4652	4056	Oponmilc.exe	102
PID 4652 wrote to memory of 5112	4652	Oncofm32.exe	103
PID 4652 wrote to memory of 5112	4652	Oncofm32.exe	103
PID 4652 wrote to memory of 5112	4652	Oncofm32.exe	103
PID 5112 wrote to memory of 4044	5112	Ogkcpbam.exe	104
PID 5112 wrote to memory of 4044	5112	Ogkcpbam.exe	104
PID 5112 wrote to memory of 4044	5112	Ogkcpbam.exe	104
PID 4044 wrote to memory of 1660	4044	Opdghh32.exe	105
PID 4044 wrote to memory of 1660	4044	Opdghh32.exe	105
PID 4044 wrote to memory of 1660	4044	Opdghh32.exe	105
PID 1660 wrote to memory of 4920	1660	Onhhamgg.exe	106
PID 1660 wrote to memory of 4920	1660	Onhhamgg.exe	106
PID 1660 wrote to memory of 4920	1660	Onhhamgg.exe	106
PID 4920 wrote to memory of 4724	4920	Odapnf32.exe	107
PID 4920 wrote to memory of 4724	4920	Odapnf32.exe	107
PID 4920 wrote to memory of 4724	4920	Odapnf32.exe	107
PID 4724 wrote to memory of 5036	4724	Ofcmfodb.exe	108
PID 4724 wrote to memory of 5036	4724	Ofcmfodb.exe	108
PID 4724 wrote to memory of 5036	4724	Ofcmfodb.exe	108
PID 5036 wrote to memory of 3536	5036	Oddmdf32.exe	109

C:\Users\Admin\AppData\Local\Temp\ab87fac46a27ead63f347dfa08afd8e2.exe
"C:\Users\Admin\AppData\Local\Temp\ab87fac46a27ead63f347dfa08afd8e2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:752
- C:\Windows\SysWOW64\Likjcbkc.exe
  C:\Windows\system32\Likjcbkc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5108
- - C:\Windows\SysWOW64\Lebkhc32.exe
    C:\Windows\system32\Lebkhc32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:212
  - - C:\Windows\SysWOW64\Mgagbf32.exe
      C:\Windows\system32\Mgagbf32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2500
    - - C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:436
      - C:\Windows\SysWOW64\Miemjaci.exe
        
        C:\Windows\system32\Miemjaci.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1072
        
        C:\Windows\SysWOW64\Mpoefk32.exe
        
        C:\Windows\system32\Mpoefk32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3904
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4968
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3744
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2200
        
        C:\Windows\SysWOW64\Nebdoa32.exe
        
        C:\Windows\system32\Nebdoa32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2600
        
        C:\Windows\SysWOW64\Njqmepik.exe
        
        C:\Windows\system32\Njqmepik.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4668
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1416
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4056
        
        C:\Windows\SysWOW64\Oncofm32.exe
        
        C:\Windows\system32\Oncofm32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4652
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4044
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1660
        
        C:\Windows\SysWOW64\Odapnf32.exe
        
        C:\Windows\system32\Odapnf32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4920
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4724
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\SysWOW64\Ofeilobp.exe
        
        C:\Windows\system32\Ofeilobp.exe
        23⤵
        Executes dropped EXE
        
        PID:3536
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1208
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        25⤵
        Executes dropped EXE
        
        PID:4940
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        26⤵
        Executes dropped EXE
        
        PID:2504
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        27⤵
        Executes dropped EXE
        
        PID:3880
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        28⤵
        Executes dropped EXE
        
        PID:1508
        
        C:\Windows\SysWOW64\Kppici32.exe
        
        C:\Windows\system32\Kppici32.exe
        29⤵
        Executes dropped EXE
        
        PID:4484
        
        C:\Windows\SysWOW64\Kelalp32.exe
        
        C:\Windows\system32\Kelalp32.exe
        30⤵
        Executes dropped EXE
        
        PID:5048
        
        C:\Windows\SysWOW64\Kijjbofj.exe
        
        C:\Windows\system32\Kijjbofj.exe
        31⤵
        Executes dropped EXE
        
        PID:2468
        
        C:\Windows\SysWOW64\Keakgpko.exe
        
        C:\Windows\system32\Keakgpko.exe
        32⤵
        Executes dropped EXE
        
        PID:2040
        
        C:\Windows\SysWOW64\Kiodmn32.exe
        
        C:\Windows\system32\Kiodmn32.exe
        33⤵
        Executes dropped EXE
        
        PID:2384
        
        C:\Windows\SysWOW64\Kfcdfbqo.exe
        
        C:\Windows\system32\Kfcdfbqo.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4836
        
        C:\Windows\SysWOW64\Lhdqnj32.exe
        
        C:\Windows\system32\Lhdqnj32.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2244
        
        C:\Windows\SysWOW64\Lnnikdnj.exe
        
        C:\Windows\system32\Lnnikdnj.exe
        36⤵
        Executes dropped EXE
        
        PID:4532
        
        C:\Windows\SysWOW64\Lfealaol.exe
        
        C:\Windows\system32\Lfealaol.exe
        37⤵
        Executes dropped EXE
        
        PID:4860
        
        C:\Windows\SysWOW64\Llbidimc.exe
        
        C:\Windows\system32\Llbidimc.exe
        38⤵
        Executes dropped EXE
        
        PID:4100
        
        C:\Windows\SysWOW64\Lejnmncd.exe
        
        C:\Windows\system32\Lejnmncd.exe
        39⤵
        Executes dropped EXE
        
        PID:1100
        
        C:\Windows\SysWOW64\Locbfd32.exe
        
        C:\Windows\system32\Locbfd32.exe
        40⤵
        Executes dropped EXE
        
        PID:324
        
        C:\Windows\SysWOW64\Lemkcnaa.exe
        
        C:\Windows\system32\Lemkcnaa.exe
        41⤵
        Executes dropped EXE
        
        PID:3968
        
        C:\Windows\SysWOW64\Llgcph32.exe
        
        C:\Windows\system32\Llgcph32.exe
        42⤵
        Executes dropped EXE
        
        PID:4624
        
        C:\Windows\SysWOW64\Leoghn32.exe
        
        C:\Windows\system32\Leoghn32.exe
        43⤵
        Executes dropped EXE
        
        PID:836
        
        C:\Windows\SysWOW64\Lhncdi32.exe
        
        C:\Windows\system32\Lhncdi32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2988
        
        C:\Windows\SysWOW64\Loglacfo.exe
        
        C:\Windows\system32\Loglacfo.exe
        45⤵
        Executes dropped EXE
        
        PID:4388
        
        C:\Windows\SysWOW64\Mimpolee.exe
        
        C:\Windows\system32\Mimpolee.exe
        46⤵
        Executes dropped EXE
        
        PID:4708
        
        C:\Windows\SysWOW64\Mojhgbdl.exe
        
        C:\Windows\system32\Mojhgbdl.exe
        47⤵
        Executes dropped EXE
        
        PID:1764
        
        C:\Windows\SysWOW64\Mpieqeko.exe
        
        C:\Windows\system32\Mpieqeko.exe
        48⤵
        Executes dropped EXE
        
        PID:4992
        
        C:\Windows\SysWOW64\Mefmimif.exe
        
        C:\Windows\system32\Mefmimif.exe
        49⤵
        Executes dropped EXE
        
        PID:1560
        
        C:\Windows\SysWOW64\Mlpeff32.exe
        
        C:\Windows\system32\Mlpeff32.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4256
        
        C:\Windows\SysWOW64\Mehjol32.exe
        
        C:\Windows\system32\Mehjol32.exe
        51⤵
        Executes dropped EXE
        
        PID:4864
        
        C:\Windows\SysWOW64\Mpnnle32.exe
        
        C:\Windows\system32\Mpnnle32.exe
        52⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:112
        
        C:\Windows\SysWOW64\Mblkhq32.exe
        
        C:\Windows\system32\Mblkhq32.exe
        53⤵
        Executes dropped EXE
        
        PID:60
        
        C:\Windows\SysWOW64\Mekgdl32.exe
        
        C:\Windows\system32\Mekgdl32.exe
        54⤵
        Executes dropped EXE
        
        PID:3400
        
        C:\Windows\SysWOW64\Mbognp32.exe
        
        C:\Windows\system32\Mbognp32.exe
        55⤵
        Executes dropped EXE
        
        PID:3148
        
        C:\Windows\SysWOW64\Neppokal.exe
        
        C:\Windows\system32\Neppokal.exe
        56⤵
        Executes dropped EXE
        
        PID:2520
        
        C:\Windows\SysWOW64\Nlihle32.exe
        
        C:\Windows\system32\Nlihle32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4576
        
        C:\Windows\SysWOW64\Ejflhm32.exe
        
        C:\Windows\system32\Ejflhm32.exe
        58⤵
        Executes dropped EXE
        
        PID:4288
        
        C:\Windows\SysWOW64\Eaqdegaj.exe
        
        C:\Windows\system32\Eaqdegaj.exe
        59⤵
        Executes dropped EXE
        
        PID:2588
        
        C:\Windows\SysWOW64\Ehjlaaig.exe
        
        C:\Windows\system32\Ehjlaaig.exe
        60⤵
        Executes dropped EXE
        
        PID:1840
        
        C:\Windows\SysWOW64\Fpeafcfa.exe
        
        C:\Windows\system32\Fpeafcfa.exe
        61⤵
        Executes dropped EXE
        
        PID:1236
        
        C:\Windows\SysWOW64\Fineoi32.exe
        
        C:\Windows\system32\Fineoi32.exe
        62⤵
        Executes dropped EXE
        
        PID:1516
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        63⤵
        Executes dropped EXE
        
        PID:956
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        64⤵
        Executes dropped EXE
        
        PID:5060
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        65⤵
        Executes dropped EXE
        
        PID:184
        
        C:\Windows\SysWOW64\Licfngjd.exe
        
        C:\Windows\system32\Licfngjd.exe
        66⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\Lnbklm32.exe
        
        C:\Windows\system32\Lnbklm32.exe
        67⤵
        Modifies registry class
        
        PID:2240
        
        C:\Windows\SysWOW64\Lndham32.exe
        
        C:\Windows\system32\Lndham32.exe
        68⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\Mhoipb32.exe
        
        C:\Windows\system32\Mhoipb32.exe
        69⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\Mnlnbl32.exe
        
        C:\Windows\system32\Mnlnbl32.exe
        70⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\Mlpokp32.exe
        
        C:\Windows\system32\Mlpokp32.exe
        71⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\Mehcdfch.exe
        
        C:\Windows\system32\Mehcdfch.exe
        72⤵
        
        PID:348
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        73⤵
        
        PID:724
        
        C:\Windows\SysWOW64\Mblcnj32.exe
        
        C:\Windows\system32\Mblcnj32.exe
        74⤵
        Drops file in System32 directory
        
        PID:4560
        
        C:\Windows\SysWOW64\Mifljdjo.exe
        
        C:\Windows\system32\Mifljdjo.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4128
        
        C:\Windows\SysWOW64\Nbnpcj32.exe
        
        C:\Windows\system32\Nbnpcj32.exe
        76⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        77⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\Njiegl32.exe
        
        C:\Windows\system32\Njiegl32.exe
        78⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        79⤵
        
        PID:512
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        80⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        81⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\Nbcjnilj.exe
        
        C:\Windows\system32\Nbcjnilj.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3228
        
        C:\Windows\SysWOW64\Nafjjf32.exe
        
        C:\Windows\system32\Nafjjf32.exe
        83⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\Nhpbfpka.exe
        
        C:\Windows\system32\Nhpbfpka.exe
        84⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2992
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        86⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        87⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        88⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4424
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        89⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\Oekiqccc.exe
        
        C:\Windows\system32\Oekiqccc.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2748
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        91⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\Oboijgbl.exe
        
        C:\Windows\system32\Oboijgbl.exe
        92⤵
        
        PID:3192
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        93⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Olgncmim.exe
        
        C:\Windows\system32\Olgncmim.exe
        94⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5248
        
        C:\Windows\SysWOW64\Oiknlagg.exe
        
        C:\Windows\system32\Oiknlagg.exe
        96⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Oohgdhfn.exe
        
        C:\Windows\system32\Oohgdhfn.exe
        97⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Oeaoab32.exe
        
        C:\Windows\system32\Oeaoab32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5380
        
        C:\Windows\SysWOW64\Ohpkmn32.exe
        
        C:\Windows\system32\Ohpkmn32.exe
        99⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Pkogiikb.exe
        
        C:\Windows\system32\Pkogiikb.exe
        100⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        101⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Plndcl32.exe
        
        C:\Windows\system32\Plndcl32.exe
        102⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Pefhlaie.exe
        
        C:\Windows\system32\Pefhlaie.exe
        103⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Pkcadhgm.exe
        
        C:\Windows\system32\Pkcadhgm.exe
        104⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Pcjiff32.exe
        
        C:\Windows\system32\Pcjiff32.exe
        105⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        106⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Poajkgnc.exe
        
        C:\Windows\system32\Poajkgnc.exe
        107⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        108⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        109⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        110⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        111⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Qcaofebg.exe
        
        C:\Windows\system32\Qcaofebg.exe
        112⤵
        Modifies registry class
        
        PID:5996
        
        C:\Windows\SysWOW64\Qhngolpo.exe
        
        C:\Windows\system32\Qhngolpo.exe
        113⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Qcclld32.exe
        
        C:\Windows\system32\Qcclld32.exe
        114⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Ahqddk32.exe
        
        C:\Windows\system32\Ahqddk32.exe
        115⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Aojlaeei.exe
        
        C:\Windows\system32\Aojlaeei.exe
        116⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Aeddnp32.exe
        
        C:\Windows\system32\Aeddnp32.exe
        117⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Akamff32.exe
        
        C:\Windows\system32\Akamff32.exe
        118⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Achegd32.exe
        
        C:\Windows\system32\Achegd32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5304
        
        C:\Windows\SysWOW64\Ackbmcjl.exe
        
        C:\Windows\system32\Ackbmcjl.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5396
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5448
        
        C:\Windows\SysWOW64\Acmobchj.exe
        
        C:\Windows\system32\Acmobchj.exe
        122⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        123⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Akhcfe32.exe
        
        C:\Windows\system32\Akhcfe32.exe
        124⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        125⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        126⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Bbdhiojo.exe
        
        C:\Windows\system32\Bbdhiojo.exe
        127⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Bhoqeibl.exe
        
        C:\Windows\system32\Bhoqeibl.exe
        128⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        129⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        130⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Bokehc32.exe
        
        C:\Windows\system32\Bokehc32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5152
        
        C:\Windows\SysWOW64\Bcinna32.exe
        
        C:\Windows\system32\Bcinna32.exe
        132⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Cjecpkcg.exe
        
        C:\Windows\system32\Cjecpkcg.exe
        133⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Ckfphc32.exe
        
        C:\Windows\system32\Ckfphc32.exe
        134⤵
        Modifies registry class
        
        PID:5456
        
        C:\Windows\SysWOW64\Cmflbf32.exe
        
        C:\Windows\system32\Cmflbf32.exe
        135⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Cbbdjm32.exe
        
        C:\Windows\system32\Cbbdjm32.exe
        136⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Ckkiccep.exe
        
        C:\Windows\system32\Ckkiccep.exe
        137⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        138⤵
        Drops file in System32 directory
        
        PID:5924
        
        C:\Windows\SysWOW64\Ccdnjp32.exe
        
        C:\Windows\system32\Ccdnjp32.exe
        139⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Ciafbg32.exe
        
        C:\Windows\system32\Ciafbg32.exe
        140⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\Coknoaic.exe
        
        C:\Windows\system32\Coknoaic.exe
        141⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        142⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Dpnkdq32.exe
        
        C:\Windows\system32\Dpnkdq32.exe
        143⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Dfgcakon.exe
        
        C:\Windows\system32\Dfgcakon.exe
        144⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Dmalne32.exe
        
        C:\Windows\system32\Dmalne32.exe
        145⤵
        Modifies registry class
        
        PID:5944
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        146⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        147⤵
        Drops file in System32 directory
        
        PID:5388
        
        C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        148⤵
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Djhimica.exe
        
        C:\Windows\system32\Djhimica.exe
        149⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        150⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Dbcmakpl.exe
        
        C:\Windows\system32\Dbcmakpl.exe
        151⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        152⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        153⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        154⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        155⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        156⤵
        Modifies registry class
        
        PID:6212
        
        C:\Windows\SysWOW64\Ejalcgkg.exe
        
        C:\Windows\system32\Ejalcgkg.exe
        157⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        158⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        159⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        160⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        161⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        162⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        163⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Fcniglmb.exe
        
        C:\Windows\system32\Fcniglmb.exe
        164⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Ffmfchle.exe
        
        C:\Windows\system32\Ffmfchle.exe
        165⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Fmfnpa32.exe
        
        C:\Windows\system32\Fmfnpa32.exe
        166⤵
        Modifies registry class
        
        PID:6636
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        167⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Fllkqn32.exe
        
        C:\Windows\system32\Fllkqn32.exe
        168⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        169⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        170⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Fbhpch32.exe
        
        C:\Windows\system32\Fbhpch32.exe
        171⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Fibhpbea.exe
        
        C:\Windows\system32\Fibhpbea.exe
        172⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        173⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        174⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        175⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        176⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        177⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        178⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        179⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        180⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        181⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        182⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        183⤵
        Modifies registry class
        
        PID:6540
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        184⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        185⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6684
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        186⤵
        Modifies registry class
        
        PID:6732
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        187⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        188⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        189⤵
        Modifies registry class
        
        PID:6964
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        190⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        191⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        192⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        193⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        194⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        195⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        196⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        197⤵
        Modifies registry class
        
        PID:6916
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        198⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        199⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        200⤵
        Modifies registry class
        
        PID:6624
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        201⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        202⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Hdokdg32.exe
        
        C:\Windows\system32\Hdokdg32.exe
        203⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        204⤵
        Modifies registry class
        
        PID:4052
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        205⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        206⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        207⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        208⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        209⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        210⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        211⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        212⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        213⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        214⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        215⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        216⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        217⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        218⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        219⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        220⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        221⤵
        Drops file in System32 directory
        
        PID:7696
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7752
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        223⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        224⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        225⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Ljclki32.exe
        
        C:\Windows\system32\Ljclki32.exe
        226⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        227⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Lclpdncg.exe
        
        C:\Windows\system32\Lclpdncg.exe
        228⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        229⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        230⤵
        Drops file in System32 directory
        
        PID:8084
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        231⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        232⤵
        Drops file in System32 directory
        
        PID:8164
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        233⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4544
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        234⤵
        Drops file in System32 directory
        
        PID:7240
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7324
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        236⤵
        Drops file in System32 directory
        
        PID:7400
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        237⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        238⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        239⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        240⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        241⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        242⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Nlkgmh32.exe
        
        C:\Windows\system32\Nlkgmh32.exe
        243⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        244⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        245⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        246⤵
        Drops file in System32 directory
        
        PID:7228
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        247⤵
        Modifies registry class
        
        PID:7388
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        248⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        249⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        250⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        251⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        252⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        253⤵
        Drops file in System32 directory
        
        PID:2756
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        254⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        255⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        256⤵
        Drops file in System32 directory
        
        PID:7172
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        257⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        258⤵
        Drops file in System32 directory
        
        PID:7260
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        259⤵
        Modifies registry class
        
        PID:7416
        
        C:\Windows\SysWOW64\Aojefobm.exe
        
        C:\Windows\system32\Aojefobm.exe
        260⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        261⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        262⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4668
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        263⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        264⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\Akccap32.exe
        
        C:\Windows\system32\Akccap32.exe
        265⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        266⤵
        Drops file in System32 directory
        
        PID:1064
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        267⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        268⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        269⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        270⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        271⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        272⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2984
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        274⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        275⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7672
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        277⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        278⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        279⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        280⤵
        Drops file in System32 directory
        
        PID:1456
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        281⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        282⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        283⤵
        Modifies registry class
        
        PID:7232
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        284⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        285⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Dkfadkgf.exe
        
        C:\Windows\system32\Dkfadkgf.exe
        286⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        287⤵
        Drops file in System32 directory
        
        PID:1992
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        288⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        289⤵
        Modifies registry class
        
        PID:7872
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        290⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        291⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        292⤵
        Drops file in System32 directory
        
        PID:7176
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        293⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3032
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7544
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        295⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        296⤵
        Modifies registry class
        
        PID:4040
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        297⤵
        Modifies registry class
        
        PID:764
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        298⤵
        Modifies registry class
        
        PID:3676
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        299⤵
        Drops file in System32 directory
        
        PID:7340
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        300⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        301⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        302⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        303⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        304⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        305⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2444
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        306⤵
        Modifies registry class
        
        PID:8248
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        307⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        308⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        309⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        310⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        311⤵
        Drops file in System32 directory
        
        PID:4628
        
        C:\Windows\SysWOW64\Fcneeo32.exe
        
        C:\Windows\system32\Fcneeo32.exe
        312⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\Ggccllai.exe
        
        C:\Windows\system32\Ggccllai.exe
        313⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Kbeibo32.exe
        
        C:\Windows\system32\Kbeibo32.exe
        314⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Kemhei32.exe
        
        C:\Windows\system32\Kemhei32.exe
        315⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\Llngbabj.exe
        
        C:\Windows\system32\Llngbabj.exe
        316⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\Mkgmoncl.exe
        
        C:\Windows\system32\Mkgmoncl.exe
        317⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Mccokj32.exe
        
        C:\Windows\system32\Mccokj32.exe
        318⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\Ndlacapp.exe
        
        C:\Windows\system32\Ndlacapp.exe
        319⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Nkhfek32.exe
        
        C:\Windows\system32\Nkhfek32.exe
        320⤵
        
        PID:1360
        
        C:\Windows\SysWOW64\Nbdkhe32.exe
        
        C:\Windows\system32\Nbdkhe32.exe
        321⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Obkahddl.exe
        
        C:\Windows\system32\Obkahddl.exe
        322⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Omcbkl32.exe
        
        C:\Windows\system32\Omcbkl32.exe
        323⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Pdqcenmg.exe
        
        C:\Windows\system32\Pdqcenmg.exe
        324⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Piolkm32.exe
        
        C:\Windows\system32\Piolkm32.exe
        325⤵
        Modifies registry class
        
        PID:3196
        
        C:\Windows\SysWOW64\Piaiqlak.exe
        
        C:\Windows\system32\Piaiqlak.exe
        326⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Pkoemhao.exe
        
        C:\Windows\system32\Pkoemhao.exe
        327⤵
        Modifies registry class
        
        PID:5524
        
        C:\Windows\SysWOW64\Pokanf32.exe
        
        C:\Windows\system32\Pokanf32.exe
        328⤵
        
        PID:812
        
        C:\Windows\SysWOW64\Pbimjb32.exe
        
        C:\Windows\system32\Pbimjb32.exe
        329⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Pkabbgol.exe
        
        C:\Windows\system32\Pkabbgol.exe
        330⤵
        
        PID:416
        
        C:\Windows\SysWOW64\Pcijce32.exe
        
        C:\Windows\system32\Pcijce32.exe
        331⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Qfgfpp32.exe
        
        C:\Windows\system32\Qfgfpp32.exe
        332⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Qifbll32.exe
        
        C:\Windows\system32\Qifbll32.exe
        333⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Qckfid32.exe
        
        C:\Windows\system32\Qckfid32.exe
        334⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Qbngeadf.exe
        
        C:\Windows\system32\Qbngeadf.exe
        335⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Qelcamcj.exe
        
        C:\Windows\system32\Qelcamcj.exe
        336⤵
        
        PID:1460
        
        C:\Windows\SysWOW64\Qmckbjdl.exe
        
        C:\Windows\system32\Qmckbjdl.exe
        337⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\Qpbgnecp.exe
        
        C:\Windows\system32\Qpbgnecp.exe
        338⤵
        Modifies registry class
        
        PID:6272
        
        C:\Windows\SysWOW64\Abpcja32.exe
        
        C:\Windows\system32\Abpcja32.exe
        339⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Aeopfl32.exe
        
        C:\Windows\system32\Aeopfl32.exe
        340⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\Amfhgj32.exe
        
        C:\Windows\system32\Amfhgj32.exe
        341⤵
        
        PID:5420
        
        C:\Windows\SysWOW64\Apddce32.exe
        
        C:\Windows\system32\Apddce32.exe
        342⤵
        
        PID:1300
        
        C:\Windows\SysWOW64\Abcppq32.exe
        
        C:\Windows\system32\Abcppq32.exe
        343⤵
        Drops file in System32 directory
        
        PID:5612
        
        C:\Windows\SysWOW64\Acbmjcgd.exe
        
        C:\Windows\system32\Acbmjcgd.exe
        344⤵
        Drops file in System32 directory
        
        PID:5740
        
        C:\Windows\SysWOW64\Aioebj32.exe
        
        C:\Windows\system32\Aioebj32.exe
        345⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1376
        
        C:\Windows\SysWOW64\Amkabind.exe
        
        C:\Windows\system32\Amkabind.exe
        346⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Apimodmh.exe
        
        C:\Windows\system32\Apimodmh.exe
        347⤵
        Modifies registry class
        
        PID:5600
        
        C:\Windows\SysWOW64\Abgjkpll.exe
        
        C:\Windows\system32\Abgjkpll.exe
        348⤵
        Drops file in System32 directory
        
        PID:3468
        
        C:\Windows\SysWOW64\Aeffgkkp.exe
        
        C:\Windows\system32\Aeffgkkp.exe
        349⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Ammnhilb.exe
        
        C:\Windows\system32\Ammnhilb.exe
        350⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Acgfec32.exe
        
        C:\Windows\system32\Acgfec32.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6436
        
        C:\Windows\SysWOW64\Bfjllnnm.exe
        
        C:\Windows\system32\Bfjllnnm.exe
        352⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Beoimjce.exe
        
        C:\Windows\system32\Beoimjce.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3124
        
        C:\Windows\SysWOW64\Bbcignbo.exe
        
        C:\Windows\system32\Bbcignbo.exe
        354⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\Bmimdg32.exe
        
        C:\Windows\system32\Bmimdg32.exe
        355⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Cibkohef.exe
        
        C:\Windows\system32\Cibkohef.exe
        356⤵
        Modifies registry class
        
        PID:5276
        
        C:\Windows\SysWOW64\Cbjogmlf.exe
        
        C:\Windows\system32\Cbjogmlf.exe
        357⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Cfhhml32.exe
        
        C:\Windows\system32\Cfhhml32.exe
        358⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Clgmkbna.exe
        
        C:\Windows\system32\Clgmkbna.exe
        359⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Cfmahknh.exe
        
        C:\Windows\system32\Cfmahknh.exe
        360⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Dfonnk32.exe
        
        C:\Windows\system32\Dfonnk32.exe
        361⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Didqkeeq.exe
        
        C:\Windows\system32\Didqkeeq.exe
        362⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\Dpoiho32.exe
        
        C:\Windows\system32\Dpoiho32.exe
        363⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Dekapfke.exe
        
        C:\Windows\system32\Dekapfke.exe
        364⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\Dmbiackg.exe
        
        C:\Windows\system32\Dmbiackg.exe
        365⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Epaemojk.exe
        
        C:\Windows\system32\Epaemojk.exe
        366⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Ecoaijio.exe
        
        C:\Windows\system32\Ecoaijio.exe
        367⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Eennefib.exe
        
        C:\Windows\system32\Eennefib.exe
        368⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6476
        
        C:\Windows\SysWOW64\Elhfbp32.exe
        
        C:\Windows\system32\Elhfbp32.exe
        369⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Edoncm32.exe
        
        C:\Windows\system32\Edoncm32.exe
        370⤵
        Drops file in System32 directory
        
        PID:6348
        
        C:\Windows\SysWOW64\Egpgehnb.exe
        
        C:\Windows\system32\Egpgehnb.exe
        371⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Eincadmf.exe
        
        C:\Windows\system32\Eincadmf.exe
        372⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Ecfhji32.exe
        
        C:\Windows\system32\Ecfhji32.exe
        373⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\Eippgckc.exe
        
        C:\Windows\system32\Eippgckc.exe
        374⤵
        Drops file in System32 directory
        
        PID:7088
        
        C:\Windows\SysWOW64\Edfddl32.exe
        
        C:\Windows\system32\Edfddl32.exe
        375⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Egdqph32.exe
        
        C:\Windows\system32\Egdqph32.exe
        376⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Fnnimbaj.exe
        
        C:\Windows\system32\Fnnimbaj.exe
        377⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Fpmeimpn.exe
        
        C:\Windows\system32\Fpmeimpn.exe
        378⤵
        Drops file in System32 directory
        
        PID:8528
        
        C:\Windows\SysWOW64\Fdhail32.exe
        
        C:\Windows\system32\Fdhail32.exe
        379⤵
        Modifies registry class
        
        PID:7412
        
        C:\Windows\SysWOW64\Fgfmeg32.exe
        
        C:\Windows\system32\Fgfmeg32.exe
        380⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Fpoaom32.exe
        
        C:\Windows\system32\Fpoaom32.exe
        381⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Fgijkgeh.exe
        
        C:\Windows\system32\Fgijkgeh.exe
        382⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Feljgd32.exe
        
        C:\Windows\system32\Feljgd32.exe
        383⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Fncbha32.exe
        
        C:\Windows\system32\Fncbha32.exe
        384⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6584
        
        C:\Windows\SysWOW64\Fpandm32.exe
        
        C:\Windows\system32\Fpandm32.exe
        385⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6280
        
        C:\Windows\SysWOW64\Fcpkph32.exe
        
        C:\Windows\system32\Fcpkph32.exe
        386⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\Ffnglc32.exe
        
        C:\Windows\system32\Ffnglc32.exe
        387⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Flhoinbl.exe
        
        C:\Windows\system32\Flhoinbl.exe
        388⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Fdogjk32.exe
        
        C:\Windows\system32\Fdogjk32.exe
        389⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Fjlpbb32.exe
        
        C:\Windows\system32\Fjlpbb32.exe
        390⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Fpfholhc.exe
        
        C:\Windows\system32\Fpfholhc.exe
        391⤵
        
        PID:672
        
        C:\Windows\SysWOW64\Fdadpk32.exe
        
        C:\Windows\system32\Fdadpk32.exe
        392⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\Fgpplf32.exe
        
        C:\Windows\system32\Fgpplf32.exe
        393⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\Glmhdm32.exe
        
        C:\Windows\system32\Glmhdm32.exe
        394⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Gnlenp32.exe
        
        C:\Windows\system32\Gnlenp32.exe
        395⤵
        
        PID:3652
        
        C:\Windows\SysWOW64\Gqkajk32.exe
        
        C:\Windows\system32\Gqkajk32.exe
        396⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\Gcimfg32.exe
        
        C:\Windows\system32\Gcimfg32.exe
        397⤵
        Modifies registry class
        
        PID:8128
        
        C:\Windows\SysWOW64\Gnoacp32.exe
        
        C:\Windows\system32\Gnoacp32.exe
        398⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7888
        
        C:\Windows\SysWOW64\Gdhjpjjd.exe
        
        C:\Windows\system32\Gdhjpjjd.exe
        399⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Gnanioad.exe
        
        C:\Windows\system32\Gnanioad.exe
        400⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Gdkffi32.exe
        
        C:\Windows\system32\Gdkffi32.exe
        401⤵
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Ggicbe32.exe
        
        C:\Windows\system32\Ggicbe32.exe
        402⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Gjhonp32.exe
        
        C:\Windows\system32\Gjhonp32.exe
        403⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Gmfkjl32.exe
        
        C:\Windows\system32\Gmfkjl32.exe
        404⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5436
        
        C:\Windows\SysWOW64\Gglpgd32.exe
        
        C:\Windows\system32\Gglpgd32.exe
        405⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Hqfqfj32.exe
        
        C:\Windows\system32\Hqfqfj32.exe
        406⤵
        Drops file in System32 directory
        
        PID:5708
        
        C:\Windows\SysWOW64\Hmbkfjko.exe
        
        C:\Windows\system32\Hmbkfjko.exe
        407⤵
        Drops file in System32 directory
        
        PID:7968
        
        C:\Windows\SysWOW64\Iggocbke.exe
        
        C:\Windows\system32\Iggocbke.exe
        408⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Inagpm32.exe
        
        C:\Windows\system32\Inagpm32.exe
        409⤵
        Drops file in System32 directory
        
        PID:8132
        
        C:\Windows\SysWOW64\Idkpmgjo.exe
        
        C:\Windows\system32\Idkpmgjo.exe
        410⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\Ijhhenhf.exe
        
        C:\Windows\system32\Ijhhenhf.exe
        411⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Iqbpahpc.exe
        
        C:\Windows\system32\Iqbpahpc.exe
        412⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Iglhob32.exe
        
        C:\Windows\system32\Iglhob32.exe
        413⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\Infqklol.exe
        
        C:\Windows\system32\Infqklol.exe
        414⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Icciccmd.exe
        
        C:\Windows\system32\Icciccmd.exe
        415⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Inhmqlmj.exe
        
        C:\Windows\system32\Inhmqlmj.exe
        416⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5124
        
        C:\Windows\SysWOW64\Inkjfk32.exe
        
        C:\Windows\system32\Inkjfk32.exe
        417⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Jjakkmpk.exe
        
        C:\Windows\system32\Jjakkmpk.exe
        418⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Jmbdmg32.exe
        
        C:\Windows\system32\Jmbdmg32.exe
        419⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\Japmcfcc.exe
        
        C:\Windows\system32\Japmcfcc.exe
        420⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Jfmekm32.exe
        
        C:\Windows\system32\Jfmekm32.exe
        421⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Jeneidji.exe
        
        C:\Windows\system32\Jeneidji.exe
        422⤵
        
        PID:3080
        
        C:\Windows\SysWOW64\Jglaepim.exe
        
        C:\Windows\system32\Jglaepim.exe
        423⤵
        Drops file in System32 directory
        
        PID:5832
        
        C:\Windows\SysWOW64\Jjknakhq.exe
        
        C:\Windows\system32\Jjknakhq.exe
        424⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Jepbodhg.exe
        
        C:\Windows\system32\Jepbodhg.exe
        425⤵
        Drops file in System32 directory
        
        PID:1280
        
        C:\Windows\SysWOW64\Khonkogj.exe
        
        C:\Windows\system32\Khonkogj.exe
        426⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Kjmjgk32.exe
        
        C:\Windows\system32\Kjmjgk32.exe
        427⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\Kmlgcf32.exe
        
        C:\Windows\system32\Kmlgcf32.exe
        428⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\Kceoppmo.exe
        
        C:\Windows\system32\Kceoppmo.exe
        429⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Knkcmild.exe
        
        C:\Windows\system32\Knkcmild.exe
        430⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\Keekjc32.exe
        
        C:\Windows\system32\Keekjc32.exe
        431⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Kffhakjp.exe
        
        C:\Windows\system32\Kffhakjp.exe
        432⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Knmpbi32.exe
        
        C:\Windows\system32\Knmpbi32.exe
        433⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\Kdjhkp32.exe
        
        C:\Windows\system32\Kdjhkp32.exe
        434⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\Kjdqhjpf.exe
        
        C:\Windows\system32\Kjdqhjpf.exe
        435⤵
        Drops file in System32 directory
        
        PID:5504
        
        C:\Windows\SysWOW64\Kanidd32.exe
        
        C:\Windows\system32\Kanidd32.exe
        436⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\Knbinhfl.exe
        
        C:\Windows\system32\Knbinhfl.exe
        437⤵
        
        PID:436
        
        C:\Windows\SysWOW64\Kaqejcep.exe
        
        C:\Windows\system32\Kaqejcep.exe
        438⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6104
        
        C:\Windows\SysWOW64\Lhjnfn32.exe
        
        C:\Windows\system32\Lhjnfn32.exe
        439⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Lndfchdj.exe
        
        C:\Windows\system32\Lndfchdj.exe
        440⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Lmjcdd32.exe
        
        C:\Windows\system32\Lmjcdd32.exe
        441⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Lmlpjdgo.exe
        
        C:\Windows\system32\Lmlpjdgo.exe
        442⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7172
        
        C:\Windows\SysWOW64\Ldfhgn32.exe
        
        C:\Windows\system32\Ldfhgn32.exe
        443⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Lfddci32.exe
        
        C:\Windows\system32\Lfddci32.exe
        444⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8428
        
        C:\Windows\SysWOW64\Lokldg32.exe
        
        C:\Windows\system32\Lokldg32.exe
        445⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\Lmqiec32.exe
        
        C:\Windows\system32\Lmqiec32.exe
        446⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3460
        
        C:\Windows\SysWOW64\Mkdiog32.exe
        
        C:\Windows\system32\Mkdiog32.exe
        447⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\Maoakaip.exe
        
        C:\Windows\system32\Maoakaip.exe
        448⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Mkgfdgpq.exe
        
        C:\Windows\system32\Mkgfdgpq.exe
        449⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Maaoaa32.exe
        
        C:\Windows\system32\Maaoaa32.exe
        450⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Mdokmm32.exe
        
        C:\Windows\system32\Mdokmm32.exe
        451⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\Moeoje32.exe
        
        C:\Windows\system32\Moeoje32.exe
        452⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\Mhmcck32.exe
        
        C:\Windows\system32\Mhmcck32.exe
        453⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Mklpof32.exe
        
        C:\Windows\system32\Mklpof32.exe
        454⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Moglpedd.exe
        
        C:\Windows\system32\Moglpedd.exe
        455⤵
        Modifies registry class
        
        PID:5780
        
        C:\Windows\SysWOW64\Maehlqch.exe
        
        C:\Windows\system32\Maehlqch.exe
        456⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\Mdddhlbl.exe
        
        C:\Windows\system32\Mdddhlbl.exe
        457⤵
        Modifies registry class
        
        PID:8340
        
        C:\Windows\SysWOW64\Mknlef32.exe
        
        C:\Windows\system32\Mknlef32.exe
        458⤵
        Modifies registry class
        
        PID:5184
        
        C:\Windows\SysWOW64\Necqbo32.exe
        
        C:\Windows\system32\Necqbo32.exe
        459⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Nhbmnj32.exe
        
        C:\Windows\system32\Nhbmnj32.exe
        460⤵
        
        PID:1984
        
        C:\Windows\SysWOW64\Najagp32.exe
        
        C:\Windows\system32\Najagp32.exe
        461⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Nhdicjfp.exe
        
        C:\Windows\system32\Nhdicjfp.exe
        462⤵
        Drops file in System32 directory
        
        PID:5648
        
        C:\Windows\SysWOW64\Nkbfpeec.exe
        
        C:\Windows\system32\Nkbfpeec.exe
        463⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8368
        
        C:\Windows\SysWOW64\Nnabladg.exe
        
        C:\Windows\system32\Nnabladg.exe
        464⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6696
        
        C:\Windows\SysWOW64\Nehjmnei.exe
        
        C:\Windows\system32\Nehjmnei.exe
        465⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Nhffijdm.exe
        
        C:\Windows\system32\Nhffijdm.exe
        466⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Nkebee32.exe
        
        C:\Windows\system32\Nkebee32.exe
        467⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Nncoaq32.exe
        
        C:\Windows\system32\Nncoaq32.exe
        468⤵
        
        PID:4144
        
        C:\Windows\SysWOW64\Nejgbn32.exe
        
        C:\Windows\system32\Nejgbn32.exe
        469⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Nkgoke32.exe
        
        C:\Windows\system32\Nkgoke32.exe
        470⤵
        Drops file in System32 directory
        
        PID:8616
        
        C:\Windows\SysWOW64\Nnfkgp32.exe
        
        C:\Windows\system32\Nnfkgp32.exe
        471⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\Nemchn32.exe
        
        C:\Windows\system32\Nemchn32.exe
        472⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Nhkpdi32.exe
        
        C:\Windows\system32\Nhkpdi32.exe
        473⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Nkjlqd32.exe
        
        C:\Windows\system32\Nkjlqd32.exe
        474⤵
        Modifies registry class
        
        PID:8592
        
        C:\Windows\SysWOW64\Onhhmpoo.exe
        
        C:\Windows\system32\Onhhmpoo.exe
        475⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Oeopnmoa.exe
        
        C:\Windows\system32\Oeopnmoa.exe
        476⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Ogcike32.exe
        
        C:\Windows\system32\Ogcike32.exe
        477⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\Oolnabal.exe
        
        C:\Windows\system32\Oolnabal.exe
        478⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Odifjipd.exe
        
        C:\Windows\system32\Odifjipd.exe
        479⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Ohdbkh32.exe
        
        C:\Windows\system32\Ohdbkh32.exe
        480⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Okcogc32.exe
        
        C:\Windows\system32\Okcogc32.exe
        481⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\Oamgcm32.exe
        
        C:\Windows\system32\Oamgcm32.exe
        482⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Ohgopgfj.exe
        
        C:\Windows\system32\Ohgopgfj.exe
        483⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Pfkpiled.exe
        
        C:\Windows\system32\Pfkpiled.exe
        484⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\Pgllad32.exe
        
        C:\Windows\system32\Pgllad32.exe
        485⤵
        
        PID:888
        
        C:\Windows\SysWOW64\Pocdba32.exe
        
        C:\Windows\system32\Pocdba32.exe
        486⤵
        
        PID:4052
        
        C:\Windows\SysWOW64\Pbapom32.exe
        
        C:\Windows\system32\Pbapom32.exe
        487⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\Pgoigcip.exe
        
        C:\Windows\system32\Pgoigcip.exe
        488⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7892
        
        C:\Windows\SysWOW64\Poeahaib.exe
        
        C:\Windows\system32\Poeahaib.exe
        489⤵
        Drops file in System32 directory
        
        PID:4896
        
        C:\Windows\SysWOW64\Pbdmdlie.exe
        
        C:\Windows\system32\Pbdmdlie.exe
        490⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Phneqf32.exe
        
        C:\Windows\system32\Phneqf32.exe
        491⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9040
        
        C:\Windows\SysWOW64\Pohnnqgo.exe
        
        C:\Windows\system32\Pohnnqgo.exe
        492⤵
        Drops file in System32 directory
        
        PID:9068
        
        C:\Windows\SysWOW64\Pbfjjlgc.exe
        
        C:\Windows\system32\Pbfjjlgc.exe
        493⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\Pdeffgff.exe
        
        C:\Windows\system32\Pdeffgff.exe
        494⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\Pgcbbc32.exe
        
        C:\Windows\system32\Pgcbbc32.exe
        495⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Pojjcp32.exe
        
        C:\Windows\system32\Pojjcp32.exe
        496⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Pbifol32.exe
        
        C:\Windows\system32\Pbifol32.exe
        497⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Pdgckg32.exe
        
        C:\Windows\system32\Pdgckg32.exe
        498⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Pgeogb32.exe
        
        C:\Windows\system32\Pgeogb32.exe
        499⤵
        Modifies registry class
        
        PID:2552
        
        C:\Windows\SysWOW64\Qomghp32.exe
        
        C:\Windows\system32\Qomghp32.exe
        500⤵
        
        PID:452
        
        C:\Windows\SysWOW64\Qbkcek32.exe
        
        C:\Windows\system32\Qbkcek32.exe
        501⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Qhghge32.exe
        
        C:\Windows\system32\Qhghge32.exe
        502⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Aoapcood.exe
        
        C:\Windows\system32\Aoapcood.exe
        503⤵
        Drops file in System32 directory
        
        PID:5620
        
        C:\Windows\SysWOW64\Abpmpkoh.exe
        
        C:\Windows\system32\Abpmpkoh.exe
        504⤵
        Drops file in System32 directory
        
        PID:8104
        
        C:\Windows\SysWOW64\Adnilfnl.exe
        
        C:\Windows\system32\Adnilfnl.exe
        505⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Akhaipei.exe
        
        C:\Windows\system32\Akhaipei.exe
        506⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\Aocmio32.exe
        
        C:\Windows\system32\Aocmio32.exe
        507⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7248
        
        C:\Windows\SysWOW64\Abbiej32.exe
        
        C:\Windows\system32\Abbiej32.exe
        508⤵
        Modifies registry class
        
        PID:4408
        
        C:\Windows\SysWOW64\Adqeaf32.exe
        
        C:\Windows\system32\Adqeaf32.exe
        509⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Ailabddb.exe
        
        C:\Windows\system32\Ailabddb.exe
        510⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Akjnnpcf.exe
        
        C:\Windows\system32\Akjnnpcf.exe
        511⤵
        Drops file in System32 directory
        
        PID:5252
        
        C:\Windows\SysWOW64\Anijjkbj.exe
        
        C:\Windows\system32\Anijjkbj.exe
        512⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Afpbkicl.exe
        
        C:\Windows\system32\Afpbkicl.exe
        513⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Akmjdpac.exe
        
        C:\Windows\system32\Akmjdpac.exe
        514⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\Ankgpk32.exe
        
        C:\Windows\system32\Ankgpk32.exe
        515⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Afboah32.exe
        
        C:\Windows\system32\Afboah32.exe
        516⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Agckiqgg.exe
        
        C:\Windows\system32\Agckiqgg.exe
        517⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\Anncek32.exe
        
        C:\Windows\system32\Anncek32.exe
        518⤵
        
        PID:3048
        
        C:\Windows\SysWOW64\Afdkfh32.exe
        
        C:\Windows\system32\Afdkfh32.exe
        519⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Bichcc32.exe
        
        C:\Windows\system32\Bichcc32.exe
        520⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\Bgfhnpde.exe
        
        C:\Windows\system32\Bgfhnpde.exe
        521⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Bnppkj32.exe
        
        C:\Windows\system32\Bnppkj32.exe
        522⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4300
        
        C:\Windows\SysWOW64\Bejhhd32.exe
        
        C:\Windows\system32\Bejhhd32.exe
        523⤵
        Modifies registry class
        
        PID:7724
        
        C:\Windows\SysWOW64\Bghddp32.exe
        
        C:\Windows\system32\Bghddp32.exe
        524⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Bkdqdokk.exe
        
        C:\Windows\system32\Bkdqdokk.exe
        525⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\Bbniai32.exe
        
        C:\Windows\system32\Bbniai32.exe
        526⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\Belemd32.exe
        
        C:\Windows\system32\Belemd32.exe
        527⤵
        
        PID:1452
        
        C:\Windows\SysWOW64\Bihancje.exe
        
        C:\Windows\system32\Bihancje.exe
        528⤵
        Modifies registry class
        
        PID:5228
        
        C:\Windows\SysWOW64\Bkfmjnii.exe
        
        C:\Windows\system32\Bkfmjnii.exe
        529⤵
        
        PID:324
        
        C:\Windows\SysWOW64\Bflagg32.exe
        
        C:\Windows\system32\Bflagg32.exe
        530⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6864
        
        C:\Windows\SysWOW64\Bijncb32.exe
        
        C:\Windows\system32\Bijncb32.exe
        531⤵
        
        PID:632
        
        C:\Windows\SysWOW64\Bpdfpmoo.exe
        
        C:\Windows\system32\Bpdfpmoo.exe
        532⤵
        Drops file in System32 directory
        
        PID:5164
        
        C:\Windows\SysWOW64\Beaohcmf.exe
        
        C:\Windows\system32\Beaohcmf.exe
        533⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Bnicai32.exe
        
        C:\Windows\system32\Bnicai32.exe
        534⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Ciogobcm.exe
        
        C:\Windows\system32\Ciogobcm.exe
        535⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Cpipkl32.exe
        
        C:\Windows\system32\Cpipkl32.exe
        536⤵
        Modifies registry class
        
        PID:2504
        
        C:\Windows\SysWOW64\Cfbhhfbg.exe
        
        C:\Windows\system32\Cfbhhfbg.exe
        537⤵
        Drops file in System32 directory
        
        PID:8600
        
        C:\Windows\SysWOW64\Ciaddaaj.exe
        
        C:\Windows\system32\Ciaddaaj.exe
        538⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Clpppmqn.exe
        
        C:\Windows\system32\Clpppmqn.exe
        539⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\Cnnllhpa.exe
        
        C:\Windows\system32\Cnnllhpa.exe
        540⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Cehdib32.exe
        
        C:\Windows\system32\Cehdib32.exe
        541⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Cpmifkgd.exe
        
        C:\Windows\system32\Cpmifkgd.exe
        542⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Chinkndp.exe
        
        C:\Windows\system32\Chinkndp.exe
        543⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Cppelkeb.exe
        
        C:\Windows\system32\Cppelkeb.exe
        544⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Cfjnhe32.exe
        
        C:\Windows\system32\Cfjnhe32.exe
        545⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Chkjpm32.exe
        
        C:\Windows\system32\Chkjpm32.exe
        546⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Cnebmgjj.exe
        
        C:\Windows\system32\Cnebmgjj.exe
        547⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Cfljnejl.exe
        
        C:\Windows\system32\Cfljnejl.exe
        548⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Dhmgfm32.exe
        
        C:\Windows\system32\Dhmgfm32.exe
        549⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\Dpdogj32.exe
        
        C:\Windows\system32\Dpdogj32.exe
        550⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Dbckcf32.exe
        
        C:\Windows\system32\Dbckcf32.exe
        551⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Deagoa32.exe
        
        C:\Windows\system32\Deagoa32.exe
        552⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Dhpdkm32.exe
        
        C:\Windows\system32\Dhpdkm32.exe
        553⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\Dbehienn.exe
        
        C:\Windows\system32\Dbehienn.exe
        554⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\Dhbqalle.exe
        
        C:\Windows\system32\Dhbqalle.exe
        555⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8040
        
        C:\Windows\SysWOW64\Dbgdnelk.exe
        
        C:\Windows\system32\Dbgdnelk.exe
        556⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Defajqko.exe
        
        C:\Windows\system32\Defajqko.exe
        557⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Dlpigk32.exe
        
        C:\Windows\system32\Dlpigk32.exe
        558⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Donecfao.exe
        
        C:\Windows\system32\Donecfao.exe
        559⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Dfemdcba.exe
        
        C:\Windows\system32\Dfemdcba.exe
        560⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Didjqoae.exe
        
        C:\Windows\system32\Didjqoae.exe
        561⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Dlbfmjqi.exe
        
        C:\Windows\system32\Dlbfmjqi.exe
        562⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Dblnid32.exe
        
        C:\Windows\system32\Dblnid32.exe
        563⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Eekjep32.exe
        
        C:\Windows\system32\Eekjep32.exe
        564⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\Ehifak32.exe
        
        C:\Windows\system32\Ehifak32.exe
        565⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Eppobi32.exe
        
        C:\Windows\system32\Eppobi32.exe
        566⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\Ebokodfc.exe
        
        C:\Windows\system32\Ebokodfc.exe
        567⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5216
        
        C:\Windows\SysWOW64\Eihcln32.exe
        
        C:\Windows\system32\Eihcln32.exe
        568⤵
        
        PID:1264
        
        C:\Windows\SysWOW64\Ehnpmkbg.exe
        
        C:\Windows\system32\Ehnpmkbg.exe
        569⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\Epehnhbj.exe
        
        C:\Windows\system32\Epehnhbj.exe
        570⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Efopjbjg.exe
        
        C:\Windows\system32\Efopjbjg.exe
        571⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Ebeapc32.exe
        
        C:\Windows\system32\Ebeapc32.exe
        572⤵
        Modifies registry class
        
        PID:5140
        
        C:\Windows\SysWOW64\Eipilmgh.exe
        
        C:\Windows\system32\Eipilmgh.exe
        573⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Elnehifk.exe
        
        C:\Windows\system32\Elnehifk.exe
        574⤵
        Drops file in System32 directory
        
        PID:8116
        
        C:\Windows\SysWOW64\Fbhnec32.exe
        
        C:\Windows\system32\Fbhnec32.exe
        575⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Fgcjea32.exe
        
        C:\Windows\system32\Fgcjea32.exe
        576⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\Fibfbm32.exe
        
        C:\Windows\system32\Fibfbm32.exe
        577⤵
        
        PID:4620
        
        C:\Windows\SysWOW64\Flpbnh32.exe
        
        C:\Windows\system32\Flpbnh32.exe
        578⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Foonjd32.exe
        
        C:\Windows\system32\Foonjd32.exe
        579⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\Fgffka32.exe
        
        C:\Windows\system32\Fgffka32.exe
        580⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Fidbgm32.exe
        
        C:\Windows\system32\Fidbgm32.exe
        581⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3964
        
        C:\Windows\SysWOW64\Flboch32.exe
        
        C:\Windows\system32\Flboch32.exe
        582⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Fifomlap.exe
        
        C:\Windows\system32\Fifomlap.exe
        583⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Fochecog.exe
        
        C:\Windows\system32\Fochecog.exe
        584⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6744
        
        C:\Windows\SysWOW64\Fiilblom.exe
        
        C:\Windows\system32\Fiilblom.exe
        585⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\Flghognq.exe
        
        C:\Windows\system32\Flghognq.exe
        586⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Fcaqka32.exe
        
        C:\Windows\system32\Fcaqka32.exe
        587⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:6756
        
        C:\Windows\SysWOW64\Fikihlmj.exe
        
        C:\Windows\system32\Fikihlmj.exe
        588⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Fpeaeedg.exe
        
        C:\Windows\system32\Fpeaeedg.exe
        589⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\Ggoiap32.exe
        
        C:\Windows\system32\Ggoiap32.exe
        590⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Ginenk32.exe
        
        C:\Windows\system32\Ginenk32.exe
        591⤵
        
        PID:392
        
        C:\Windows\SysWOW64\Gllajf32.exe
        
        C:\Windows\system32\Gllajf32.exe
        592⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Gojnfb32.exe
        
        C:\Windows\system32\Gojnfb32.exe
        593⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\Ggafgo32.exe
        
        C:\Windows\system32\Ggafgo32.exe
        594⤵
        
        PID:564
        
        C:\Windows\SysWOW64\Gipbck32.exe
        
        C:\Windows\system32\Gipbck32.exe
        595⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Gpjjpe32.exe
        
        C:\Windows\system32\Gpjjpe32.exe
        596⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\Gegchl32.exe
        
        C:\Windows\system32\Gegchl32.exe
        597⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\Glqkefff.exe
        
        C:\Windows\system32\Glqkefff.exe
        598⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Gplged32.exe
        
        C:\Windows\system32\Gplged32.exe
        599⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Ggfobofl.exe
        
        C:\Windows\system32\Ggfobofl.exe
        600⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Ghgljg32.exe
        
        C:\Windows\system32\Ghgljg32.exe
        601⤵
        Drops file in System32 directory
        
        PID:5684
        
        C:\Windows\SysWOW64\Goadfa32.exe
        
        C:\Windows\system32\Goadfa32.exe
        602⤵
        Modifies registry class
        
        PID:7436
        
        C:\Windows\SysWOW64\Gcmpgpkp.exe
        
        C:\Windows\system32\Gcmpgpkp.exe
        603⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Geklckkd.exe
        
        C:\Windows\system32\Geklckkd.exe
        604⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\Ghjhofjg.exe
        
        C:\Windows\system32\Ghjhofjg.exe
        605⤵
        
        PID:3232
        
        C:\Windows\SysWOW64\Hcommoin.exe
        
        C:\Windows\system32\Hcommoin.exe
        606⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\Hhleefhe.exe
        
        C:\Windows\system32\Hhleefhe.exe
        607⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5332
        
        C:\Windows\SysWOW64\Hjlaoioh.exe
        
        C:\Windows\system32\Hjlaoioh.exe
        608⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Hohjgpmo.exe
        
        C:\Windows\system32\Hohjgpmo.exe
        609⤵
        
        PID:4148
        
        C:\Windows\SysWOW64\Hllkqdli.exe
        
        C:\Windows\system32\Hllkqdli.exe
        610⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7472
        
        C:\Windows\SysWOW64\Hokgmpkl.exe
        
        C:\Windows\system32\Hokgmpkl.exe
        611⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6020
        
        C:\Windows\SysWOW64\Hjpkjh32.exe
        
        C:\Windows\system32\Hjpkjh32.exe
        612⤵
        
        PID:8396
        
        C:\Windows\SysWOW64\Hlogfd32.exe
        
        C:\Windows\system32\Hlogfd32.exe
        613⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Hqjcgbbo.exe
        
        C:\Windows\system32\Hqjcgbbo.exe
        614⤵
        
        PID:368
        
        C:\Windows\SysWOW64\Hgdlcm32.exe
        
        C:\Windows\system32\Hgdlcm32.exe
        615⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Hjbhph32.exe
        
        C:\Windows\system32\Hjbhph32.exe
        616⤵
        Modifies registry class
        
        PID:7628
        
        C:\Windows\SysWOW64\Hladlc32.exe
        
        C:\Windows\system32\Hladlc32.exe
        617⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Ioppho32.exe
        
        C:\Windows\system32\Ioppho32.exe
        618⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3412
        
        C:\Windows\SysWOW64\Igghilhi.exe
        
        C:\Windows\system32\Igghilhi.exe
        619⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\Ijedehgm.exe
        
        C:\Windows\system32\Ijedehgm.exe
        620⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6916
        
        C:\Windows\SysWOW64\Imcqacfq.exe
        
        C:\Windows\system32\Imcqacfq.exe
        621⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Icminm32.exe
        
        C:\Windows\system32\Icminm32.exe
        622⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Ifleji32.exe
        
        C:\Windows\system32\Ifleji32.exe
        623⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Iodjcnca.exe
        
        C:\Windows\system32\Iodjcnca.exe
        624⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Ijjnpg32.exe
        
        C:\Windows\system32\Ijjnpg32.exe
        625⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\Ioffhn32.exe
        
        C:\Windows\system32\Ioffhn32.exe
        626⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Iiaggc32.exe
        
        C:\Windows\system32\Iiaggc32.exe
        627⤵
        Drops file in System32 directory
        
        PID:8204
        
        C:\Windows\SysWOW64\Jjqdafmp.exe
        
        C:\Windows\system32\Jjqdafmp.exe
        628⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4084
        
        C:\Windows\SysWOW64\Jgedjjki.exe
        
        C:\Windows\system32\Jgedjjki.exe
        629⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\Jmamba32.exe
        
        C:\Windows\system32\Jmamba32.exe
        630⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Jggapj32.exe
        
        C:\Windows\system32\Jggapj32.exe
        631⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Jihngboe.exe
        
        C:\Windows\system32\Jihngboe.exe
        632⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Jobfdl32.exe
        
        C:\Windows\system32\Jobfdl32.exe
        633⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Jikjmbmb.exe
        
        C:\Windows\system32\Jikjmbmb.exe
        634⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Jqbbno32.exe
        
        C:\Windows\system32\Jqbbno32.exe
        635⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3632
        
        C:\Windows\SysWOW64\Jcpojk32.exe
        
        C:\Windows\system32\Jcpojk32.exe
        636⤵
        Drops file in System32 directory
        
        PID:8684
        
        C:\Windows\SysWOW64\Jjjggede.exe
        
        C:\Windows\system32\Jjjggede.exe
        637⤵
        Drops file in System32 directory
        
        PID:8804
        
        C:\Windows\SysWOW64\Kcbkpj32.exe
        
        C:\Windows\system32\Kcbkpj32.exe
        638⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\Kmkpipaf.exe
        
        C:\Windows\system32\Kmkpipaf.exe
        639⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Kiaqnagj.exe
        
        C:\Windows\system32\Kiaqnagj.exe
        640⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Kgcqlh32.exe
        
        C:\Windows\system32\Kgcqlh32.exe
        641⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Kakednfj.exe
        
        C:\Windows\system32\Kakednfj.exe
        642⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5480
        
        C:\Windows\SysWOW64\Kciaqi32.exe
        
        C:\Windows\system32\Kciaqi32.exe
        643⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3712
        
        C:\Windows\SysWOW64\Kfhnme32.exe
        
        C:\Windows\system32\Kfhnme32.exe
        644⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Kifjip32.exe
        
        C:\Windows\system32\Kifjip32.exe
        645⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\Kclnfi32.exe
        
        C:\Windows\system32\Kclnfi32.exe
        646⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Lapopm32.exe
        
        C:\Windows\system32\Lapopm32.exe
        647⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\Lfmghdpl.exe
        
        C:\Windows\system32\Lfmghdpl.exe
        648⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Labkempb.exe
        
        C:\Windows\system32\Labkempb.exe
        649⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Lglcag32.exe
        
        C:\Windows\system32\Lglcag32.exe
        650⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Ladhkmno.exe
        
        C:\Windows\system32\Ladhkmno.exe
        651⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Ljmmcbdp.exe
        
        C:\Windows\system32\Ljmmcbdp.exe
        652⤵
        Modifies registry class
        
        PID:8808
        
        C:\Windows\SysWOW64\Lagepl32.exe
        
        C:\Windows\system32\Lagepl32.exe
        653⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Lhammfci.exe
        
        C:\Windows\system32\Lhammfci.exe
        654⤵
        Modifies registry class
        
        PID:2152
        
        C:\Windows\SysWOW64\Lmneemaq.exe
        
        C:\Windows\system32\Lmneemaq.exe
        655⤵
        
        PID:1608
        
        C:\Windows\SysWOW64\Mpnngh32.exe
        
        C:\Windows\system32\Mpnngh32.exe
        656⤵
        
        PID:8688
        
        C:\Windows\SysWOW64\Mfhgcbfo.exe
        
        C:\Windows\system32\Mfhgcbfo.exe
        657⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\Migcpneb.exe
        
        C:\Windows\system32\Migcpneb.exe
        658⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\Mankaked.exe
        
        C:\Windows\system32\Mankaked.exe
        659⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\Mfkcibdl.exe
        
        C:\Windows\system32\Mfkcibdl.exe
        660⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\Mmdlflki.exe
        
        C:\Windows\system32\Mmdlflki.exe
        661⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Mdodbf32.exe
        
        C:\Windows\system32\Mdodbf32.exe
        662⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Mfmpob32.exe
        
        C:\Windows\system32\Mfmpob32.exe
        663⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Miklkm32.exe
        
        C:\Windows\system32\Miklkm32.exe
        664⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Mdaqhf32.exe
        
        C:\Windows\system32\Mdaqhf32.exe
        665⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Mfomda32.exe
        
        C:\Windows\system32\Mfomda32.exe
        666⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Mdcmnfop.exe
        
        C:\Windows\system32\Mdcmnfop.exe
        667⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Npjnbg32.exe
        
        C:\Windows\system32\Npjnbg32.exe
        668⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:184
        
        C:\Windows\SysWOW64\Nmnnlk32.exe
        
        C:\Windows\system32\Nmnnlk32.exe
        669⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9232
        
        C:\Windows\SysWOW64\Ndhgie32.exe
        
        C:\Windows\system32\Ndhgie32.exe
        670⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Nkboeobh.exe
        
        C:\Windows\system32\Nkboeobh.exe
        671⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Ndjcne32.exe
        
        C:\Windows\system32\Ndjcne32.exe
        672⤵
        Modifies registry class
        
        PID:9356
        
        C:\Windows\SysWOW64\Nmbhgjoi.exe
        
        C:\Windows\system32\Nmbhgjoi.exe
        673⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Naqqmieo.exe
        
        C:\Windows\system32\Naqqmieo.exe
        674⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Ogmiepcf.exe
        
        C:\Windows\system32\Ogmiepcf.exe
        675⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Oacmchcl.exe
        
        C:\Windows\system32\Oacmchcl.exe
        676⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Ogpfko32.exe
        
        C:\Windows\system32\Ogpfko32.exe
        677⤵
        Drops file in System32 directory
        
        PID:9556
        
        C:\Windows\SysWOW64\Oaejhh32.exe
        
        C:\Windows\system32\Oaejhh32.exe
        678⤵
        Modifies registry class
        
        PID:9596
        
        C:\Windows\SysWOW64\Oiqomj32.exe
        
        C:\Windows\system32\Oiqomj32.exe
        679⤵
        Drops file in System32 directory
        
        PID:9636
        
        C:\Windows\SysWOW64\Opjgidfa.exe
        
        C:\Windows\system32\Opjgidfa.exe
        680⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Oickbjmb.exe
        
        C:\Windows\system32\Oickbjmb.exe
        681⤵
        
        PID:9712
        
        C:\Windows\SysWOW64\Opmcod32.exe
        
        C:\Windows\system32\Opmcod32.exe
        682⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Ohdlpa32.exe
        
        C:\Windows\system32\Ohdlpa32.exe
        683⤵
        Drops file in System32 directory
        
        PID:9796
        
        C:\Windows\SysWOW64\Onqdhh32.exe
        
        C:\Windows\system32\Onqdhh32.exe
        684⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Pjgemi32.exe
        
        C:\Windows\system32\Pjgemi32.exe
        685⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Pdmikb32.exe
        
        C:\Windows\system32\Pdmikb32.exe
        686⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Pgkegn32.exe
        
        C:\Windows\system32\Pgkegn32.exe
        687⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Pjjaci32.exe
        
        C:\Windows\system32\Pjjaci32.exe
        688⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Paaidf32.exe
        
        C:\Windows\system32\Paaidf32.exe
        689⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Pdofpb32.exe
        
        C:\Windows\system32\Pdofpb32.exe
        690⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Pacfjfej.exe
        
        C:\Windows\system32\Pacfjfej.exe
        691⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Aqpika32.exe
        
        C:\Windows\system32\Aqpika32.exe
        692⤵
        Drops file in System32 directory
        
        PID:10172
        
        C:\Windows\SysWOW64\Akenij32.exe
        
        C:\Windows\system32\Akenij32.exe
        693⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Adnbapjp.exe
        
        C:\Windows\system32\Adnbapjp.exe
        694⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Aglnnkid.exe
        
        C:\Windows\system32\Aglnnkid.exe
        695⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Ababkdij.exe
        
        C:\Windows\system32\Ababkdij.exe
        696⤵
        Modifies registry class
        
        PID:9348
        
        C:\Windows\SysWOW64\Adpogp32.exe
        
        C:\Windows\system32\Adpogp32.exe
        697⤵
        Modifies registry class
        
        PID:9380
        
        C:\Windows\SysWOW64\Ajmgof32.exe
        
        C:\Windows\system32\Ajmgof32.exe
        698⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Agqhik32.exe
        
        C:\Windows\system32\Agqhik32.exe
        699⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Ajaqjfbp.exe
        
        C:\Windows\system32\Ajaqjfbp.exe
        700⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Bqkigp32.exe
        
        C:\Windows\system32\Bqkigp32.exe
        701⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Bkamdi32.exe
        
        C:\Windows\system32\Bkamdi32.exe
        702⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9704
        
        C:\Windows\SysWOW64\Bdiamnpc.exe
        
        C:\Windows\system32\Bdiamnpc.exe
        703⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Bkcjjhgp.exe
        
        C:\Windows\system32\Bkcjjhgp.exe
        704⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Bbmbgb32.exe
        
        C:\Windows\system32\Bbmbgb32.exe
        705⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Bhgjcmfi.exe
        
        C:\Windows\system32\Bhgjcmfi.exe
        706⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Bkefphem.exe
        
        C:\Windows\system32\Bkefphem.exe
        707⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Bbpolb32.exe
        
        C:\Windows\system32\Bbpolb32.exe
        708⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Biigildg.exe
        
        C:\Windows\system32\Biigildg.exe
        709⤵
        
        PID:10196
        
        C:\Windows\SysWOW64\Bjkcqdje.exe
        
        C:\Windows\system32\Bjkcqdje.exe
        710⤵
        Drops file in System32 directory
        
        PID:9256
        
        C:\Windows\SysWOW64\Bqdlmo32.exe
        
        C:\Windows\system32\Bqdlmo32.exe
        711⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Bkjpkg32.exe
        
        C:\Windows\system32\Bkjpkg32.exe
        712⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Cqghcn32.exe
        
        C:\Windows\system32\Cqghcn32.exe
        713⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Cgaqphgl.exe
        
        C:\Windows\system32\Cgaqphgl.exe
        714⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Cbfema32.exe
        
        C:\Windows\system32\Cbfema32.exe
        715⤵
        
        PID:9832
        
        C:\Windows\SysWOW64\Ciqmjkno.exe
        
        C:\Windows\system32\Ciqmjkno.exe
        716⤵
        Modifies registry class
        
        PID:9912
        
        C:\Windows\SysWOW64\Cjaiac32.exe
        
        C:\Windows\system32\Cjaiac32.exe
        717⤵
        Drops file in System32 directory
        
        PID:10036
        
        C:\Windows\SysWOW64\Calbnnkj.exe
        
        C:\Windows\system32\Calbnnkj.exe
        718⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Cicjokll.exe
        
        C:\Windows\system32\Cicjokll.exe
        719⤵
        
        PID:2628
        
        C:\Windows\SysWOW64\Ckafkfkp.exe
        
        C:\Windows\system32\Ckafkfkp.exe
        720⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Cbknhqbl.exe
        
        C:\Windows\system32\Cbknhqbl.exe
        721⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Ciefek32.exe
        
        C:\Windows\system32\Ciefek32.exe
        722⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Cnboma32.exe
        
        C:\Windows\system32\Cnboma32.exe
        723⤵
        Drops file in System32 directory
        
        PID:9872
        
        C:\Windows\SysWOW64\Celgjlpn.exe
        
        C:\Windows\system32\Celgjlpn.exe
        724⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Djipbbne.exe
        
        C:\Windows\system32\Djipbbne.exe
        725⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2692
        
        C:\Windows\SysWOW64\Dabhomea.exe
        
        C:\Windows\system32\Dabhomea.exe
        726⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Dgmpkg32.exe
        
        C:\Windows\system32\Dgmpkg32.exe
        727⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Daeddlco.exe
        
        C:\Windows\system32\Daeddlco.exe
        728⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Dgomaf32.exe
        
        C:\Windows\system32\Dgomaf32.exe
        729⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Dagajlal.exe
        
        C:\Windows\system32\Dagajlal.exe
        730⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Djpfbahm.exe
        
        C:\Windows\system32\Djpfbahm.exe
        731⤵
        Drops file in System32 directory
        
        PID:9304
        
        C:\Windows\SysWOW64\Dajnol32.exe
        
        C:\Windows\system32\Dajnol32.exe
        732⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Dbijinfl.exe
        
        C:\Windows\system32\Dbijinfl.exe
        733⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Dhfcae32.exe
        
        C:\Windows\system32\Dhfcae32.exe
        734⤵
        Modifies registry class
        
        PID:10276
        
        C:\Windows\SysWOW64\Enpknplq.exe
        
        C:\Windows\system32\Enpknplq.exe
        735⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Eangjkkd.exe
        
        C:\Windows\system32\Eangjkkd.exe
        736⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10360
        
        C:\Windows\SysWOW64\Eldlhckj.exe
        
        C:\Windows\system32\Eldlhckj.exe
        737⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10400 -s 400
        738⤵
        Program crash
        
        PID:10492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 10400 -ip 10400
1⤵
PID:10468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Blnoga32.exe

Filesize
443KB

MD5
f96064f0e42167957a4d0f3519d4ef20

SHA1
a09cca874ea77f8d3a1e42b136a57483bbb1bb8c

SHA256
96dc358d841db02476a78d7f23d44123f19b5128056e477643ce670b80048e33

SHA512
313d80c7f2d32a6e379c5b54a29fe1ac7354b2eb492fc2f712835f4fe83cea56ed75b439668a009b82a7391f8a61ea4c24cc80823a6d882c2f2e88d240fb721c

Download Submit
C:\Windows\SysWOW64\Cmflbf32.exe

Filesize
443KB

MD5
5f74ebed1a354c839fe32b59537d45dd

SHA1
0607db70d3f088c07cae7812226e4d0be758c12f

SHA256
653e70c185976e75c43ba8ffff8152987213a5e0fe8f92f528f50d853499948f

SHA512
22c887e434a89ef56caf6fa7af2795d807e61494474e365708ac4aaf046686121244f07acbe9da8f315bd62953948aa9318d94c34fd4e359a7e9a92b6c850b8c

Download Submit
C:\Windows\SysWOW64\Cpmifkgd.exe

Filesize
443KB

MD5
6956a7c6c2d7d5221ac0f2250dbe52ad

SHA1
464c7b9ce0f8e2fcb0defe5e15429e9b29995a5a

SHA256
eba5b0fdd190d9c70d3a69e2ed4281e039479af1639dd8bbd266494b25f4df92

SHA512
8736c08f1e4d3d1b92e1116d3797372c024a6af9726e79bf26fbdc0f395394ba4d8cb04d155fdeaac8d8f2d0f6d8864085ec2514c59410fd4d7e129f7441f47d

Download Submit
C:\Windows\SysWOW64\Dajnol32.exe

Filesize
443KB

MD5
01ac20b6d7a211d32229e08f1b7a8e38

SHA1
f431957ab2d66cf31f1043714270bd947e95b0d2

SHA256
f1bd3393d6f5233839b65599432e981a888cdd431bd16711ab5f29e6b29f3133

SHA512
55a021268110110633995aa14980e266d9322e833028bf1234350756e05e8527ca6cfaa9f82120af47057214db9efdef3f6f5715e59f5f03ce324f377ee7c6ed

Download Submit
C:\Windows\SysWOW64\Dfefkkqp.exe

Filesize
443KB

MD5
cb1948b439862a469a1f36e997e8db89

SHA1
ef5a39a374538a94d6798407b6172e080b5b826a

SHA256
8e6d216ae58ea4964fbf3bc7956d317ee323b826da9e0818cc338acb89d5e06f

SHA512
6f6bc24d66c32ec07aa5c908aa592e6fb8fcefc4b283c58c487a25ddef350b2f639de3883f378b664aac8bb36a4d2480ffe13f138036b6a3f24d8b35e90a3cad

Download Submit
C:\Windows\SysWOW64\Dkhgod32.exe

Filesize
443KB

MD5
b2282e932b7bc02f924470b9485d8028

SHA1
e13e230257167ed2a96ad16548f539de5b3cd37d

SHA256
695d0cfc9335e0a0e00f1664a71d496c48a511607c4e64b4943faa31b9780b49

SHA512
4b67e374fc60200e9e202eee4a186c294f09d38c458dce54641fc016107ffa148d431305e5a0d23a1354cd5359acdafbebc313a5dd833ba1ec323292edd97aa5

Download Submit
C:\Windows\SysWOW64\Fealin32.exe

Filesize
443KB

MD5
cc53c4c93b01ebc17286b37c5ba0c8e4

SHA1
8c2463899ecf1a4b520ee6f15d43051cf2b3419d

SHA256
a3d4485fa7cb591ceeb9ff2caf277f8898520dbacc2f0cb24518d226337ac52c

SHA512
429df2200514329b57613fc9ff0c5f964ea2519019f7faccc75cfb0b5b3b3b4b6a7a3b4a35405fec4e60c44468775ce35fd0656d2ce5e7a0932b0ef59ddb57a4

Download Submit
C:\Windows\SysWOW64\Fllkqn32.exe

Filesize
443KB

MD5
b8fffc43da3a66fb6c758f3758cc48e6

SHA1
9e678bcae120c1dbf72d3eaa21f30e40eb3f68d3

SHA256
4d29f41ced8cf983e74071be0a4c948c24dafed2522edc6a97d43ac556c468e3

SHA512
ea7824f164a4dbb823e7e7caa1d31a4eb1996277db8b7c16354741852a9421140770b8a5db6a7e92aefee5c730544ac68e3632d8826820539a563470913d4da4

Download Submit
C:\Windows\SysWOW64\Fpeafcfa.exe

Filesize
64KB

MD5
fd6ed600de6b895854e4228c48f2e6f6

SHA1
b652ac5ec194f0ad7a84062926a73de4176aae7d

SHA256
bb525431a5ea54d122f08b87172eef199555c7977b2e52dbfbb6bab1013a7310

SHA512
cf8a54b614b8833ab246db6edd5f4eb5f2a824c174f6006c2a46db3d293345d73598e2bcb879510c10b9220065fd0413f7f3eac86f45e3a5281d9cee66adc9f0

Download Submit
C:\Windows\SysWOW64\Fplpll32.exe

Filesize
128KB

MD5
0acb3fcf5b25cda9125f88748c148c74

SHA1
066ad8be37c72ceef60deb57fa10d31aa7f86e94

SHA256
b19a9c8b76cdf1743086b2aadd2e0925ef605f41e8f508f08a5459c6b8191fb5

SHA512
dfdb5cd6d01532e1edb001029f10bef167457fce7d22d420a7f4f1b51bec51643113b1508e4f857ba23e4100c45297d2f3805356213d56364a9309f7ff9016a0

Download Submit
C:\Windows\SysWOW64\Hedafk32.exe

Filesize
443KB

MD5
86f55e2f6c9cc0df292a9f13edf37c39

SHA1
a25038a98cb86094dfb49216435215149806f90a

SHA256
12101f0f0c269a9b75ebac70d83b68bb937fd6f12febc4b65f97c81349128b11

SHA512
4432afdb3ff2f85962372a23f2c75a361dea176a6b5b94a72c38d5d3f1b1370d9a416ec8873a14275b5e977fa232f23333a86e14792207c610e612fbbd1e276b

Download Submit
C:\Windows\SysWOW64\Ijegcm32.exe

Filesize
443KB

MD5
8673afd2875b72415d64784087cd76fa

SHA1
eacfe9732c4ddb19b29772f6b1d08c417a0f366e

SHA256
969ae16bd576bfb0a39b6aad0e60deae9643f9d74e649ea943daae8d4f6be635

SHA512
1bb08ab0a2d24c9fd068392c12e70f12b845f486cb92e35fd25728333f02889d304c52fd49d380c420dea3e5a79a2ec3283a6e0b1a5292feea1610b00636f272

Download Submit
C:\Windows\SysWOW64\Inlihl32.exe

Filesize
192KB

MD5
5f57ff8ad84e4bb53849f4541cb9c923

SHA1
6653fd50e6f8724669f4a13db0e40bd248676fbe

SHA256
34afb75f8c9ea48414da7f867f83c6bd92a20782bc47a9810cde322c9bb019a0

SHA512
af3d930e2f363e41ad0574c7c18dfa61cb107f6c7b2ae47ed7f0c0a03babacd78185f9dffa7612605b61a960aa6f6968dac753e611d20be35ab0e2936fb8f1e3

Download Submit
C:\Windows\SysWOW64\Ioffhn32.exe

Filesize
443KB

MD5
8849f04d2816bebaa0fd51c9bad20e68

SHA1
b8fcf0cde1e8c5c8ffd23d5741f04202c7c5f6bc

SHA256
e4d01a0f610ebeb065d04c4020a473416957e2ad2a12094319795f32043ecf12

SHA512
55339765b07e3e67325d2fae1e3371737919a9eb8bf728792215009cd9eb0ed582e6fa88339a9d23fd05dd19de219ae396c988a066b748fbaca274816e81d3c1

Download Submit
C:\Windows\SysWOW64\Jfmekm32.exe

Filesize
64KB

MD5
217d0e028b0e454181d665249865c833

SHA1
4f91a8b8e8654611fd30bf5a865d6311091cdf53

SHA256
6f7867e9a82e6f1cffeef8d2362420c58edd07384b22cb04f338a1ca905772b9

SHA512
f5edf2631efcedf22533f4e6d436eb3a0ab2c63493e4c3a3076a9e1d16904124441268299e9db5cedd7a2b7e73cf00ce037572dff4a8c1cb1e9369a43b60783d

Download Submit
C:\Windows\SysWOW64\Jmbdmg32.exe

Filesize
384KB

MD5
0dacde0c34153a8274c54becefd63731

SHA1
bb706b1b80a6bac2f8cea09a07227b2663c7f540

SHA256
9685a2a612434e0e8e02a6a2249dc1abfef64126a855e8bd06311c9f693eccc1

SHA512
e463f83be63fa0df747d2d08d58ac33808989c1cee839974194a2c689941ca3d8323e3fc00b4d12fc4341b906ab9bbafd9ec2dace761b97aeb23f105213fcefb

Download Submit
C:\Windows\SysWOW64\Kcbkpj32.exe

Filesize
64KB

MD5
db7f77968346057192de59d0d4a4fa06

SHA1
31723135d162df5686b58ca478d68144617ca39f

SHA256
3b48f224e92abb4a864a4a5d0f1f2c67bdf37f1ed322017cc7836b009b5b0504

SHA512
a0390720a93aa435d64b10fb3b1da0a3a15fced1a8d1187d5fa9ce445fb35bbba1be4aaa12596f884a436a64c7ddb19d50a743f1a152958654d5b18119cafc25

Download Submit
C:\Windows\SysWOW64\Keakgpko.exe

Filesize
443KB

MD5
51ae80eb6f6da5a9c506d36373204a97

SHA1
9897d69f83e5baa9138b6a2f6c07aa8429b45535

SHA256
4b1a98d58192900a24414eb953a858028ee4f4a29f8bb88d34f514197ab279ee

SHA512
8b0d1e387c9d11f5ec6461c41f4b8a3b37cc48e3197e9452f964da17fc027405c005fe3b46e2dc9746d268b9ea85bfe7950ebf5fe0c7f604d8dbe06bdff6195c

Download Submit
C:\Windows\SysWOW64\Kelalp32.exe

Filesize
443KB

MD5
a804604b43114b19ea192792b106f350

SHA1
5479d631768c8782a7b86289d74fc035368d1ff9

SHA256
3f71193306baea236d2831d08560f720022d602a68b963a798fd11113bf6a094

SHA512
23b5190ba55b22315456e8b8ca235c8d54082a7978a082274a881a239a0ce89986ea7d4c6bcea7b8c73f9c2f66e0c9f10cae4ebd33c9cf5e68ef2b3618a0e3e5

Download Submit
C:\Windows\SysWOW64\Kijjbofj.exe

Filesize
443KB

MD5
db273f1a5481becfc338d6293996a2ac

SHA1
21dcb6a4fa4c7504b92436b33f4509a62feb4e19

SHA256
2511073283590622775dd32d6dc0aaa0fa29313e1a60353c53c6685188d08df1

SHA512
849343605f897e7de5fb11c2543266b4f27bf27786f73e888531921c9732827d5ad3e231acb1df2230a36666897028bcc153b8b777110d18c50d91ae13277332

Download Submit
C:\Windows\SysWOW64\Kiodmn32.exe

Filesize
443KB

MD5
689f53fd035fe5cd618daa93cdecb9bd

SHA1
a629cdc4cce217c9dc73bc7e8948de4d3142ca51

SHA256
74d455d1b68b685c2d425cd0ed56ab3ea4d83ad91c007a6f00653843b96604c1

SHA512
1079e5c076348082af6e473b6ae596c319029534f28d64997ff997ed8730de4fa200b8469226a2fe00e02a95d40223f53b8afb44d490aac9c5f4d5cff8b534a2

Download Submit
C:\Windows\SysWOW64\Kppici32.exe

Filesize
443KB

MD5
a65310f209662d2352c92fd824d811b0

SHA1
8f5d60fbbb52ffcef9ea98dcf14bdd31fc3f4823

SHA256
7cdefe5cac785012aaed40a49e4f38f41b171f0cfc67cf94135d627da850efb6

SHA512
63fefded9d8eeef0a9d580ec9d85caec77a4d08aaeedf5f0dd5f41aa7f3d216e5a33cc24267aaa56fda8bcbef54b427dac1f9afb032e3ebb790b99b66c5b8c94

Download Submit
C:\Windows\SysWOW64\Ladhkmno.exe

Filesize
443KB

MD5
de1508c5bf6158748e618ef796e9e884

SHA1
67ffed7d25e22668de4a46c72cb35b4081231a4a

SHA256
402dbb592f8d3c9008ca5c4efe9edae1e49861537f73699e8dc901ed7f752e2a

SHA512
19e1029e032f13ef220cfe96f927b09ae45289b21afb77ae66f747ecfa42f97e281e71353b4971934c259bed0f9984d9f9e3e3ccd8b851b4473044277a848f3f

Download Submit
C:\Windows\SysWOW64\Lebkhc32.exe

Filesize
443KB

MD5
c5f10a2d03576aa4b8060a71c8ff9df1

SHA1
5151766d9c03cd866f0ae69f29a6e028c7f498c8

SHA256
17f224323d38f8dc94ba5d88bf77c5d24aa88a2ced95149da831848f858180fb

SHA512
9654ebab99ed7d4422fa192e696d487c75bbdfb9d21d551bd42567ebf28c5476f4c3c3535f31b1cc60a29ddbb1cd572fc589a81d575c511b70c655eba6345fe3

Download Submit
C:\Windows\SysWOW64\Likjcbkc.exe

Filesize
443KB

MD5
dd298ed35c15120f6bee90de35bf21dc

SHA1
a7a3fba64bd5adad494d5372e516c907cf1d1649

SHA256
602749ad12e3d77551576d63564466c9f08a4282d9f4794d105eebb2a27aed88

SHA512
f0959eff2a12c3486d6f74996b2aa9929d0feea139ed3926de6b5d80b5130f2741cb658f7edaa36068442e0a638b8eef374d9469fc919ad6b7569df679877915

Download Submit
C:\Windows\SysWOW64\Lmneemaq.exe

Filesize
443KB

MD5
381135639b09b0add87f8c3dcc7e92d8

SHA1
b2021f2a4893d7bd6f7560a81e26645eed738835

SHA256
fbd78c2194b4f2ecfa87bb8ddb551de45cc292ae6f306af8abf612c4016739a6

SHA512
79fea3c71ba8b2a6aec5f66a44abc586936fd4df84692f1a20737093b0a4aee45719a8bbfa81ad44ec75a10d7ca0adbfb19b59b03eff372ae0a694f9e3fc441c

Download Submit
C:\Windows\SysWOW64\Lnbklm32.exe

Filesize
443KB

MD5
764094ecf51f2302c536104c3f443655

SHA1
89e851e7c47c417eb617c209f0bbe3791c38817d

SHA256
a23d6ce5948ac83de4d7f1ed619a90a667a23aba4a4b14242c4177d652eabff1

SHA512
e275f0636398d6b164586c2a21e154b6b27656c68f48f8d6a923ece0de76db653f253e62124ef0033c3da8286e7d7c60c890bb989c16b8b36ed45a3f1aad960b

Download Submit
C:\Windows\SysWOW64\Mdmnlj32.exe

Filesize
443KB

MD5
fccf7ea9abf5a8b7bf6c037be6955acf

SHA1
7518f0326bbdbbe55f0d225dc8652c54721a944b

SHA256
03238e0c84153bc7688feb650738e4fc9fdf4cc1e787f7567503d269d15163ee

SHA512
61e85011699b4b5a6a32769e0784593b5882aaa28160cef62bae30610292b55f773cc6c8521b6e77a672eacf7749e08ea5d7b6e2e0da5e0b28ff5c316c696c8c

Download Submit
C:\Windows\SysWOW64\Mgagbf32.exe

Filesize
443KB

MD5
774a73124fef523782d271dc0b8f7620

SHA1
785e2173ce15364f8670fc7c81896fc7ef1c4a7a

SHA256
1a1c60bb87a32204331a68cd57293ccb1c6e47d40612e16f942ba164cab9c643

SHA512
90ce47f41f153190d63ce0b6aab7134b46c90940c55bd6975438d2f81c5612a0727bbbc27d803528620927e6cfa10539a29bc912073e6eb497cb1803a5e483fb

Download Submit
C:\Windows\SysWOW64\Mibpda32.exe

Filesize
443KB

MD5
5d86bdba13d207c098c934d2f90ba686

SHA1
274227aad888719e7a110894ca3d9d7743c001da

SHA256
699708921a86ebe15160858ed8420489bef92a823b328f78237882b44eadfdb4

SHA512
669f2daca7ffe7295dc260bae65ab050d3dd86ab33785112e546bb2426aed78776a7864efd649d76fe5ebdcc867ab18c3a69e21ac5b96766f0e7a2bff9270567

Download Submit
C:\Windows\SysWOW64\Miemjaci.exe

Filesize
443KB

MD5
aeceece053a3795022a01d9cafe97ac2

SHA1
d608ecd929d811e7f6ff661287d96be1ccbbaeef

SHA256
c1887b5a99458f65824aa44c8dd9068d96f3364c14d8b03e872d671ee84429a3

SHA512
5a44ece7183c17ce48eeb1510619bb510d97266c4e5c4e0a1af507aa0ca1b196396e20fc7a2c5a4bfc42d03fb9251373e0a149ae509799f717e02218d9ca87f6

Download Submit
C:\Windows\SysWOW64\Migjoaaf.exe

Filesize
443KB

MD5
34770a70f14cf3ffa3f66023c28df263

SHA1
04905d5b2a4d86bcae128df8f58f4c7876e3fa49

SHA256
509cde202e70a781a39566bafd341da67bf3026cd149aa509609be00c5a93623

SHA512
560b965c4a229ae03f1a0a129b834f51c40744300995b95d6780464216acc1086014005a3fe84bf1070732e3fe18db3839b03bc155f6b65598d2c4f7564365f1

Download Submit
C:\Windows\SysWOW64\Mmkkmc32.exe

Filesize
443KB

MD5
f90e1fa2ee77a84af27e87eb89175f34

SHA1
8b62b10df5f3fb5912eb87cf408ba0555d3c1d59

SHA256
51d93dab87d1919abf794b31660a844e4a1ca845a56ebc4116c13dc0e9735e27

SHA512
9fe6d129d0ac3b858b629508e2f4a800317bda912faf04980423afa1acbb78ce686d070c751344aae98de3344112c0f6680dca9f293be3a877478c0486b7d837

Download Submit
C:\Windows\SysWOW64\Mpoefk32.exe

Filesize
443KB

MD5
feed76f42bfd0ec4df433b4dc0d1474a

SHA1
30de3ea289570c722885d0df58143a28fc539d1d

SHA256
b972f91b08c9beb36cf97be313cf373d0da64afdae49ff07572abd67d0cd558a

SHA512
a051d6d36d8ebfc1e45c6060f3442a2c9f710118b1bbc0626f15ea9848c8a5d2b9a5c23c700b2b7137f9cd9a0cd4d187d7738fddc5668fc4a51c2e31294599d0

Download Submit
C:\Windows\SysWOW64\Ncbknfed.exe

Filesize
443KB

MD5
e33de1df465aa1abe8a6da32033b3fc1

SHA1
6989b0002d10b363f3ed2f89fe65481714a7f59f

SHA256
c6a4820900ac1b93ec4bf981f6cfb60d07c884363ce320b23c463532bee756a9

SHA512
d5e0a047190803645e4718b58b7b2277711fc02423e31a181aa0cc61c6ba8b5ca9d45a98dbeab7921e43ee236c7ca7fad411b65611a6d1e3c0b7f317f6a04ade

Download Submit
C:\Windows\SysWOW64\Nebdoa32.exe

Filesize
443KB

MD5
cbb2a808b578a57fa639075f94a86caf

SHA1
18b0fb5c5931f5e6a17b2030724f99db137855e4

SHA256
a80592c5a987c386af16675bb02728f84dbae6aca6154e220c53f70040fb836c

SHA512
a7e82601f0d447ead619dc8244214a8be22b12e853a19d25ca1b281d8f10536e61a2a694c14f77bdfc29bc7df4757088c856ab3a731ad4141be3afbaa689b003

Download Submit
C:\Windows\SysWOW64\Neppokal.exe

Filesize
443KB

MD5
d173c762ff1797ddbf1e4101bf737554

SHA1
2d5eb0267998f5f7b9a9c660d89ddcfefcc16d46

SHA256
31f416a60d63fc1ca90e06a3e122bc28e5f87aa4495a12f638328c15eb84a98d

SHA512
a6eb7924539c9434949b94c711ffdf575332c5c4c7d422efc44db2848518d1fa71bf6b42f6565371c6bdc2e8b9e4da06a9c297f693492744aa2f4e8e8b8034b3

Download Submit
C:\Windows\SysWOW64\Njqmepik.exe

Filesize
443KB

MD5
b2127ffe7b1dbcee3960f166e8b79b70

SHA1
4c91916c72ef2922a2a4d0a08ba1624d754cf257

SHA256
71ba9a1568351072ae520a638d88fca4a7509ec453096ac8a9294bc07a1f56b3

SHA512
4bf900f673b48e3111cfe9ca393d9a6b14e66b45131bba6ff1f4297f89c2f9df9ea07583b56adbacc741831d5fc617b5192dcaf60f211aab02b57a9bcd0e6a4c

Download Submit
C:\Windows\SysWOW64\Nlaegk32.exe

Filesize
443KB

MD5
b13f4f32106eed7c80be6a33430d3cc5

SHA1
8aff1902c96069e5ef4b4918e15fb200d159a593

SHA256
033158a1b02bfce3ef78af14f29a15f9e3c68b346b70125b72877bb9495ef3f0

SHA512
faf536b06b8c3fb0f338034b3c53891925e30a3d375e3d372d9e76f4ff22b901972943667d8af030713f7a6f74af42922b3890dbcd3c94af0fd5a26a8cccb310

Download Submit
C:\Windows\SysWOW64\Nmbhgjoi.exe

Filesize
443KB

MD5
52c64bfc3001b795e78567a198526095

SHA1
733763783fa34b3d74e912fe479353d1de5494f3

SHA256
5024996f6be70b7d880971e0ae5660233b1b5d77afccd331e818e59133169a3b

SHA512
b6cffd317535099620780146989ac13a32158f9bf8f92e0d0b5e0d8fc70c67ae2bb815686bcc3174fa8c7482175feed05cff0a66f7bf0f038aa1e688d1226e3d

Download Submit
C:\Windows\SysWOW64\Npjebj32.exe

Filesize
443KB

MD5
132406e54d7070197ef40cdfaab9cac9

SHA1
e141197dc4433c2f369d894aaaed03f2ea1481b3

SHA256
0bab47a5376ce121d99278b70fe39826edf22f99cb2275b1e20957fca1c593d8

SHA512
4b5cb963c2223ff2410ee40702430ae6e8f02f867e92c974d889fbcfea97409a1919948a0db91a8ef632ba47b000afdc8f56e118c5f1d298148e0ad4fe663859

Download Submit
C:\Windows\SysWOW64\Odapnf32.exe

Filesize
443KB

MD5
ece9f47e036eb19157f7a2f73b1f5749

SHA1
96f095c75aacc6d5e747550fca4ebd4695ef5d27

SHA256
30d408b80ec3b571b56da5f7f7febb593262a25fcb072a43987a4da5d21d014b

SHA512
de119b1ceeca0742e8c8e2e7eff9fa6576272ebd8c75969aa12f6d7c62a05caef714e240dd3848aed038e8b2f6e24162f45e55247bb8f19ed079f5982f8c6d6f

Download Submit
C:\Windows\SysWOW64\Oddmdf32.exe

Filesize
443KB

MD5
0da3aa5b80d88237bad1906993d24753

SHA1
d6e468a3d43021585578d9a140e95913563528ac

SHA256
d718e1fc48de15fc556f9d790bcb8f47ea94be40183d09ea0fdcbd765f01f06c

SHA512
616ecf09205ff86282c6e7e4bd80f115eb99846969f839bf64c2bf46294431d3d1ebc6e16199ba18771a76ce84ea6d139e6706467037073441a9254712fbfaf3

Download Submit
C:\Windows\SysWOW64\Ofcmfodb.exe

Filesize
443KB

MD5
42d5589378578720280969845c8472d9

SHA1
cefd36a8e101d36a2b3e2bfbdc012abc690a57e6

SHA256
f456c788455736b9cbaa584e5d2c5f72c49425109ec6cb610a05992965ae3242

SHA512
1f0d80dd4469b88415fead9c2caa48fb4e63d79e88fb3cd90a25fa0aa208cfd7bb8ad76bfa49469336cb1d0039c9e6ed576c343b70014f2ae03f588f71621524

Download Submit
C:\Windows\SysWOW64\Ofeilobp.exe

Filesize
443KB

MD5
ca9ae91a475cb946e688c2e47595a703

SHA1
2aeae531e994a9601fef48fab34c7b886888960b

SHA256
ff4a82d946e1dcd058677815b16459bfb5cf5f94c7fabf3c29a3ac45f24b7218

SHA512
3250f1477cebbd13beacbb016f5244441449d8dff7ba63142a5a6871efc62ef0bf6d2a02cdd54e996076d6fadeb09f4d35e6cf6a2a212d87d251c7443ea49e82

Download Submit
C:\Windows\SysWOW64\Ogcike32.exe

Filesize
443KB

MD5
1d66b24bbc3f7da0f8cc03a4736ec1cc

SHA1
162f1136245928c73402c59b998191eef57b1de7

SHA256
260aa4eb6d2f76c8d6e25de608fa367beab52a38437e59ce030b4feaa83102b5

SHA512
5a4424502c93cd51a7e2a6204335784773b77f9b9414bdb56e632a03f5ea88e74809a07890da62a6e69531cfb25c7f23150730783092906afacd8d0c59da1ee2

Download Submit
C:\Windows\SysWOW64\Ogkcpbam.exe

Filesize
443KB

MD5
0a4b59eed52b9c9179fecedea4537c2b

SHA1
62406fb20d9a4480c6d25c6e2f596b93322eb0cb

SHA256
5ee351ea0bbfe562b3d0865f77f1789d6e01092f575797384d78f0723c53434a

SHA512
55737c5c510ee974eb8a1d6995d21fe969341bb9cec7bd25d24b5b41f13fba407544ca8611aafdac893d3ad054b3bfbd3b4b581dca4cba90dfde5256d001193c

Download Submit
C:\Windows\SysWOW64\Oncofm32.exe

Filesize
443KB

MD5
69f461ff31f7e324776991fbec2b9201

SHA1
914c79b3f52e85643f2c34b2403a56af5677e55b

SHA256
ca9ec1d0195156a95330833e22f3d84c8b2a825410691a5e41eabdee18a7f228

SHA512
b546c829d436229ed86bba1d14d4846e6f274efbd0fa72c6cc04cf8cc66c50b13a9b4fd9d2356f957b68b9de6bec92b78cdd387f6c88c4c3a3a2f30c53fb13e7

Download Submit
C:\Windows\SysWOW64\Onhhamgg.exe

Filesize
443KB

MD5
0035c43e86b69c847b36b3d0514f27d5

SHA1
396da27fa8d5fa461f45607b6afcf280e83b6f1b

SHA256
60e3ef69cbb029cace5626456d41c66d3c2a0c6b7bb42d93f03b0a806a47ce7f

SHA512
b99826eaa000e131b68abe9e52998d1ace04c264367cd4045fe96eeccb923ddb8011e4b90d7a838f888ee4f9bbe337ecdb4083c11588573c1634794fa85852eb

Download Submit
C:\Windows\SysWOW64\Onqdhh32.exe

Filesize
384KB

MD5
0f995a0cc255cb24c702cc059e5399cf

SHA1
1a0baf1a85c7458b776cab430c156c2e64fa29d1

SHA256
1c344a89798ecbf1bc7ef5b2d882b684db1e02c543f5ef74a8a67acb3170c069

SHA512
2e616e8549db73c871963a194b7c576c4d7a99e9428d760d265c64025be2b02d76970ac7635c0a4c516df56563899f04f137fc474e8a201e7dc7e79179320ca8

Download Submit
C:\Windows\SysWOW64\Opdghh32.exe

Filesize
443KB

MD5
b32e068407d7037f65a845f61ab04946

SHA1
0b52377a892e60d2012ecd57df9121e324718900

SHA256
6c3299674c6d44b3291f0c7da24180e2041deac52c6f653b608a5082ea7c017f

SHA512
5601aa6345877fdbe7b9f31dc251bc841ad26c2672514a6969951a2147d623f4fb78c7c355f82f1c95e11de4857b2a21b495ffcf90fc1221107482abe4a93997

Download Submit
C:\Windows\SysWOW64\Oponmilc.exe

Filesize
443KB

MD5
e9e67ec03d503a220a1c49652251e3fe

SHA1
a83a6ef003d44421a19d373f0e7e4d3ec6bf1fa1

SHA256
d1f0e81bd092e266e6f60540a7790eb52c86cf8e3a8e28b88bff0a751840ff2d

SHA512
b41f28f495c8ad729e4f0fd71056e1b7d3e9c95cfc7ffaaa52232faf4f5e3eb9c4b58a644a54af259c246213e35c4f386a5980997a3fdc31c510eeddfe0cb99f

Download Submit
C:\Windows\SysWOW64\Pacfjfej.exe

Filesize
443KB

MD5
a43187f321689a9da74cf3834145cfae

SHA1
1f36bac20195f0517b41df82ade2db53970ee2a6

SHA256
2f01a8e3442302c3b08775a273ed3ba7988e42a1f1aad07f564acbd961068562

SHA512
4558b803884bc0829d67e8e7c7c251fa5dbc860dbc7961742e67c4ad4f2e634847027ddb0cfef582dbac1e9a99cfcc929daf0f5a7e8729917fa1763225ed6907

Download Submit
C:\Windows\SysWOW64\Pgefeajb.exe

Filesize
443KB

MD5
6b7df276fbf5fc4c026b32f97c2bd7c8

SHA1
a6ff688c7c634359203cd1ee844caedd2b374514

SHA256
d0a9348ae869e5b0c78bf28e35462210a56c70c2f4339c230c9f27fe9489ccc3

SHA512
aea5d2328a109c04c5fde5b46ea70ecb3227db967ec1e32ebcc65f3553d43eed0bb3cac16958bea87bfc4a44b0942bd9ff516ca943b539238ed2617fadc2c348

Download Submit
C:\Windows\SysWOW64\Pjcbbmif.exe

Filesize
443KB

MD5
4e729d92d7d48a2cfc4036ae748d466f

SHA1
66dd36f2dbdca677a67759a27bb293466bca62e2

SHA256
9c5ed7969ba7ce35fa782118ba52cecc3705a4e02d1a5295d4b8ae6a2e17aee2

SHA512
9ec09f43d575c383fb2a5fd366ab09b821084e6b3ad5de62f1dd82db3985295ae353ee958ec884eab8d95f37062b1252593b55813186f809f7573faa90a011ce

Download Submit
C:\Windows\SysWOW64\Pnlaml32.exe

Filesize
443KB

MD5
ade669b8f49e14b416d8594c54340ea5

SHA1
f649bdb070864ff6c13e12f773b24694b62f6ea9

SHA256
51df317f758c37676948700c5072abefd9b24d6d10711877ace7e9f3e9993e7f

SHA512
040e2cb4595a97b847399a333ad83ae7a4eae8e04861162ff2d4bcb75ec17c17276cf89369bf3a7feecf34f6997fb3fa027504842c62a82dccb31a9e92491e6b

Download Submit
C:\Windows\SysWOW64\Pqknig32.exe

Filesize
443KB

MD5
295dbe1165caa4948194347678bd38ab

SHA1
ce6ef45f4a4a732977c8f9dbdfc0616252f55fa7

SHA256
204da48d282190c59a96068ff979c77417294e38d6d937aafa3235af9ab4f164

SHA512
099783bff882d81abdcc972b904f5176e4b888714398d7b53a5605da9c2907c63e8352aa227021a18dd5da971328f07452421525a701fab34a45c91796ce23e9

Download Submit
C:\Windows\SysWOW64\Pqmjog32.exe

Filesize
443KB

MD5
fe2aa3d9d16fdc265b882b31abfdd859

SHA1
8d7d6397f5835ea7f765fddf675e141e9c786012

SHA256
1e53aa53866548178b8549151a8db74d9cd5742fae4fcfe6c0ed1476a63562d5

SHA512
c321442288c3ba948a2e7724275a34172d4c164ae5eccd02e401a6af3944f35826b1f520ef8ff20064f3ed108bb3c5620b4625d7b26022c662c6a1e14894bf24

Download Submit
memory/60-386-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/112-381-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/184-483-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/212-17-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/324-298-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/436-37-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/752-79-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/752-0-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/752-5-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/836-316-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/956-465-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1072-40-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1100-292-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1208-205-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1236-449-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1416-96-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1456-107-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1508-216-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1516-455-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1560-354-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1660-145-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1764-346-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/1840-443-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2200-71-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2244-279-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2384-255-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2468-245-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2500-25-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2504-207-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2520-405-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2588-437-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2600-81-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/2988-322-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3148-395-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3400-389-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3880-208-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/3904-48-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4044-137-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4056-113-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4100-286-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4256-366-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4288-435-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4388-329-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4484-225-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4532-275-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4568-485-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4576-425-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4624-314-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4652-121-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4668-89-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4708-335-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4724-203-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4836-261-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4860-280-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4864-373-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4920-153-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4940-206-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4968-57-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/4992-348-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/5036-204-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/5048-232-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/5060-467-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/5108-9-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/5112-133-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads