7cc7a94efda72ffc755d64b41c6937c151d17c2e23dac00dce9f4ebc01c0e5fd

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7cc7a94efda72ffc755d64b41c6937c151d17c2e23dac00dce9f4ebc01c0e5fd.exe
Size

386KB
MD5

438f294f6aa54b4a19e9f063a8849e7e
SHA1

1a495b2771cadc73e7c7cfa59f1a54acea114fb6
SHA256

7cc7a94efda72ffc755d64b41c6937c151d17c2e23dac00dce9f4ebc01c0e5fd
SHA512

fa7a46aaacf7e3f2539e7da9e95cbcd91821d91f2743997def1b9207f7fc81fa91adaf1607fd281b9bd03633ddbedca8c7113616aa2d53a3d76ffe6e41a44bb5
SSDEEP

6144:ckO8QI8vNSs7wQIc72nxvG7rbxmPVvRqlfJg9i4s7wQIc72nxvG7rbxmPV:/QFwQZ7287xmPFRkfJg9qwQZ7287xmP

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iikmbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jehokgge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ohqbhdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bjodjb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpdhkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Edionhpn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgcmjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Okkdic32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdbnjdfg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bohbhmfm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mepfiq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcnfohmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iolhkh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jafdcbge.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojjolnaq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jehhaaci.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhiajmod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jhlgfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ncmhko32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fjeplijj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbhbbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olhlhjpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ampkof32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qcbfakec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ibfnqmpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iialhaad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fnjocf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jlbgha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pgefeajb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phodcg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdjgha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jekqmhia.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fqphic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jcgbco32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmiflbel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Opcqnb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddnfmqng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lgjijmin.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oelolmnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gpmomo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Chmndlge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Moaogand.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ogpepl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ccpdoqgd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fcpakn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Afeban32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olcbmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Phelcc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejoomhmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mhckcgpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iinjhh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ekonpckp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oikjkc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qfmfefni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jpkphjeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ocopdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aqmlknnd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjhalefe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbqmiinl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nbqmiinl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhbolp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afqifo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjodjb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boklbi32.exe

Executes dropped EXE 64 IoCs

pid	Process
2080	Jbeidl32.exe
3616	Jmknaell.exe
4668	Jcefno32.exe
3092	Jefbfgig.exe
1164	Jcgbco32.exe
3812	Jehokgge.exe
4904	Jlbgha32.exe
3896	Jifhaenk.exe
4692	Kfoafi32.exe
2468	Leihbeib.exe
3988	Lfhdlh32.exe
3640	Likjcbkc.exe
4292	Lmiciaaj.exe
1136	Mdckfk32.exe
1132	Mgddhf32.exe
4800	Mgfqmfde.exe
684	Migjoaaf.exe
1696	Nilcjp32.exe
4988	Nphhmj32.exe
2388	Ngdmod32.exe
1976	Nlaegk32.exe
2488	Nfjjppmm.exe
3140	Olcbmj32.exe
3348	Oflgep32.exe
2372	Ogkcpbam.exe
5092	Ojjolnaq.exe
1080	Olhlhjpd.exe
1092	Odocigqg.exe
832	Ognpebpj.exe
4536	Onhhamgg.exe
4072	Oqfdnhfk.exe
1672	Ocdqjceo.exe
544	Ojoign32.exe
1372	Olmeci32.exe
2160	Oddmdf32.exe
992	Ogbipa32.exe
2680	Pmoahijl.exe
3728	Pgefeajb.exe
1204	Pnonbk32.exe
3944	Pqmjog32.exe
940	Pggbkagp.exe
3500	Pjeoglgc.exe
1560	Pmdkch32.exe
1788	Pdkcde32.exe
3200	Pncgmkmj.exe
4088	Pmidog32.exe
700	Ampkof32.exe
3804	Afhohlbj.exe
4900	Aeiofcji.exe
4884	Amddjegd.exe
2860	Afmhck32.exe
1128	Anfmjhmd.exe
2256	Bebblb32.exe
784	Bgcknmop.exe
1780	Bmpcfdmg.exe
880	Bjddphlq.exe
3780	Beihma32.exe
1412	Bnbmefbg.exe
1196	Cfmajipb.exe
1160	Chmndlge.exe
2144	Cmiflbel.exe
4208	Cfbkeh32.exe
4480	Cdfkolkf.exe
3892	Cmnpgb32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Dkkcge32.exe	Dodbbdbb.exe
File opened for modification	C:\Windows\SysWOW64\Qepkbpak.exe	Qcaofebg.exe
File opened for modification	C:\Windows\SysWOW64\Imgicgca.exe	Iikmbh32.exe
File opened for modification	C:\Windows\SysWOW64\Ogkcpbam.exe	Oflgep32.exe
File created	C:\Windows\SysWOW64\Aqoiqn32.exe	Afjeceml.exe
File created	C:\Windows\SysWOW64\Iabglnco.exe	Ilfodgeg.exe
File created	C:\Windows\SysWOW64\Memcpg32.dll	Jehokgge.exe
File created	C:\Windows\SysWOW64\Idbodn32.exe	Hhiajmod.exe
File opened for modification	C:\Windows\SysWOW64\Jhnojl32.exe	Jeocna32.exe
File opened for modification	C:\Windows\SysWOW64\Fklcgk32.exe	Fbdnne32.exe
File created	C:\Windows\SysWOW64\Mjbaohka.dll	Dgbanq32.exe
File opened for modification	C:\Windows\SysWOW64\Dkbocbog.exe	Diccgfpd.exe
File created	C:\Windows\SysWOW64\Dlmmaqlm.dll	Hildmn32.exe
File opened for modification	C:\Windows\SysWOW64\Hfjdqmng.exe	Hmbphg32.exe
File opened for modification	C:\Windows\SysWOW64\Oqmhqapg.exe	Oonlfo32.exe
File created	C:\Windows\SysWOW64\Bmpcfdmg.exe	Bgcknmop.exe
File opened for modification	C:\Windows\SysWOW64\Mlklkgei.exe	Lfodbqfa.exe
File created	C:\Windows\SysWOW64\Eqdgdn32.dll	Mfhfhong.exe
File created	C:\Windows\SysWOW64\Ocmconhk.exe	Ooagno32.exe
File opened for modification	C:\Windows\SysWOW64\Ehcfaboo.exe	Eaindh32.exe
File opened for modification	C:\Windows\SysWOW64\Fdffbake.exe	Fipbdikp.exe
File created	C:\Windows\SysWOW64\Dchfiejc.dll	Cmnpgb32.exe
File created	C:\Windows\SysWOW64\Eefaomcg.exe	Dhocqigp.exe
File opened for modification	C:\Windows\SysWOW64\Odhifjkg.exe	Najmjokc.exe
File opened for modification	C:\Windows\SysWOW64\Olcbmj32.exe	Nfjjppmm.exe
File created	C:\Windows\SysWOW64\Kflnfcgg.exe	Klfjijgq.exe
File created	C:\Windows\SysWOW64\Pnbmqiee.dll	Cihclh32.exe
File created	C:\Windows\SysWOW64\Fmpqfq32.exe	Fffhifdk.exe
File opened for modification	C:\Windows\SysWOW64\Dmlkhofd.exe	Cbfgkffn.exe
File opened for modification	C:\Windows\SysWOW64\Cammjakm.exe	Bhpofl32.exe
File created	C:\Windows\SysWOW64\Achgjc32.dll	Kiggbhda.exe
File opened for modification	C:\Windows\SysWOW64\Fdqfll32.exe	Emdajb32.exe
File created	C:\Windows\SysWOW64\Bcghdkpf.dll	Iidphgcn.exe
File opened for modification	C:\Windows\SysWOW64\Lllagh32.exe	Kpqggh32.exe
File opened for modification	C:\Windows\SysWOW64\Olhlhjpd.exe	Ojjolnaq.exe
File created	C:\Windows\SysWOW64\Fgppmg32.dll	Ocmconhk.exe
File created	C:\Windows\SysWOW64\Mepfiq32.exe	Mjkblhfo.exe
File opened for modification	C:\Windows\SysWOW64\Nhmofj32.exe	Nndjndbh.exe
File created	C:\Windows\SysWOW64\Pgefeajb.exe	Pmoahijl.exe
File opened for modification	C:\Windows\SysWOW64\Mfhfhong.exe	Moaogand.exe
File created	C:\Windows\SysWOW64\Lhlndcmq.dll	Hcblpdgg.exe
File opened for modification	C:\Windows\SysWOW64\Ebgpad32.exe	Eoideh32.exe
File created	C:\Windows\SysWOW64\Bhpopokm.dll	Flfkkhid.exe
File opened for modification	C:\Windows\SysWOW64\Njbgmjgl.exe	Nblolm32.exe
File created	C:\Windows\SysWOW64\Pdjgha32.exe	Ofkgcobj.exe
File created	C:\Windows\SysWOW64\Ehpadhll.exe	Eohmkb32.exe
File created	C:\Windows\SysWOW64\Jijjfldq.dll	Bgcknmop.exe
File opened for modification	C:\Windows\SysWOW64\Joffnk32.exe	Jilnqqbj.exe
File created	C:\Windows\SysWOW64\Cihdpk32.dll	Npjnhc32.exe
File created	C:\Windows\SysWOW64\Gdbqla32.dll	Epagkd32.exe
File created	C:\Windows\SysWOW64\Dgcaaddl.dll	Nhpbfpka.exe
File created	C:\Windows\SysWOW64\Mmjmhg32.dll	Cdlqqcnl.exe
File opened for modification	C:\Windows\SysWOW64\Bgeaifia.exe	Bqkill32.exe
File created	C:\Windows\SysWOW64\Fipbdikp.exe	Fineoi32.exe
File created	C:\Windows\SysWOW64\Pjphcf32.dll	Ojnfihmo.exe
File created	C:\Windows\SysWOW64\Enjfli32.exe	Ekljpm32.exe
File created	C:\Windows\SysWOW64\Kkcmfmhk.dll	Ekiohclf.exe
File created	C:\Windows\SysWOW64\Ghpendjj.exe	Ggqida32.exe
File opened for modification	C:\Windows\SysWOW64\Gmeakf32.exe	Gkgeoklj.exe
File created	C:\Windows\SysWOW64\Mieced32.dll	Mehcdfch.exe
File created	C:\Windows\SysWOW64\Jlgkbp32.dll	Poomegpf.exe
File created	C:\Windows\SysWOW64\Ekkkoj32.exe	Dfnbgc32.exe
File created	C:\Windows\SysWOW64\Jnedgq32.exe	Jlfhke32.exe
File opened for modification	C:\Windows\SysWOW64\Jifhaenk.exe	Jlbgha32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6604	10068	WerFault.exe	827

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ikkpgafg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pgefeajb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijdgcpaf.dll"	Ocopdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kijchhbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cimcan32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nlbdlk32.dll"	Ahjgjj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hffken32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mmkdcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jaonbc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfanhp32.dll"	Cffdpghg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hcjdeo32.dll"	Feapkk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Afjeceml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fanmld32.dll"	Nckkfp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Afeban32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oflpld32.dll"	Oblmdhdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ehpadhll.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dgdgijhp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hhihdcbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bqkill32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fkbkdkpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpoqijhk.dll"	Ehfjah32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lcnfohmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dfnbgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbjbac32.dll"	Enjfli32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pkoemhao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aeffgkkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dpgbgpbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mnphmkji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Plpqil32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nnicid32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ipgbdbqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Olcbmj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Aeiofcji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Locbfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mepfiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aieeeflh.dll"	Ogfcjm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Niakfbpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lojkhk32.dll"	Qikgco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cancekeo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Legjmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecbfdd32.dll"	Ljdceo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iciaqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Iahgad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mlemcq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cbhbbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hijjli32.dll"	Kageaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Momkkhch.dll"	Fdglmkeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ficlfj32.dll"	Glkmmefl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pghaae32.dll"	Chglab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Maenpfhk.dll"	Ookoaokf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lhmmjbkf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Dpgnjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lkchelci.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Jpenfp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Odocigqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jnmijq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mgehfkop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hlhccj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Omqmop32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gcghkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ndpjnq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Memcpg32.dll"	Jehokgge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gdppbfff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hhiajmod.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2080	2664	7cc7a94efda72ffc755d64b41c6937c151d17c2e23dac00dce9f4ebc01c0e5fd.exe	81
PID 2664 wrote to memory of 2080	2664	7cc7a94efda72ffc755d64b41c6937c151d17c2e23dac00dce9f4ebc01c0e5fd.exe	81
PID 2664 wrote to memory of 2080	2664	7cc7a94efda72ffc755d64b41c6937c151d17c2e23dac00dce9f4ebc01c0e5fd.exe	81
PID 2080 wrote to memory of 3616	2080	Jbeidl32.exe	82
PID 2080 wrote to memory of 3616	2080	Jbeidl32.exe	82
PID 2080 wrote to memory of 3616	2080	Jbeidl32.exe	82
PID 3616 wrote to memory of 4668	3616	Jmknaell.exe	83
PID 3616 wrote to memory of 4668	3616	Jmknaell.exe	83
PID 3616 wrote to memory of 4668	3616	Jmknaell.exe	83
PID 4668 wrote to memory of 3092	4668	Jcefno32.exe	84
PID 4668 wrote to memory of 3092	4668	Jcefno32.exe	84
PID 4668 wrote to memory of 3092	4668	Jcefno32.exe	84
PID 3092 wrote to memory of 1164	3092	Jefbfgig.exe	85
PID 3092 wrote to memory of 1164	3092	Jefbfgig.exe	85
PID 3092 wrote to memory of 1164	3092	Jefbfgig.exe	85
PID 1164 wrote to memory of 3812	1164	Jcgbco32.exe	86
PID 1164 wrote to memory of 3812	1164	Jcgbco32.exe	86
PID 1164 wrote to memory of 3812	1164	Jcgbco32.exe	86
PID 3812 wrote to memory of 4904	3812	Jehokgge.exe	87
PID 3812 wrote to memory of 4904	3812	Jehokgge.exe	87
PID 3812 wrote to memory of 4904	3812	Jehokgge.exe	87
PID 4904 wrote to memory of 3896	4904	Jlbgha32.exe	88
PID 4904 wrote to memory of 3896	4904	Jlbgha32.exe	88
PID 4904 wrote to memory of 3896	4904	Jlbgha32.exe	88
PID 3896 wrote to memory of 4692	3896	Jifhaenk.exe	90
PID 3896 wrote to memory of 4692	3896	Jifhaenk.exe	90
PID 3896 wrote to memory of 4692	3896	Jifhaenk.exe	90
PID 4692 wrote to memory of 2468	4692	Kfoafi32.exe	91
PID 4692 wrote to memory of 2468	4692	Kfoafi32.exe	91
PID 4692 wrote to memory of 2468	4692	Kfoafi32.exe	91
PID 2468 wrote to memory of 3988	2468	Leihbeib.exe	92
PID 2468 wrote to memory of 3988	2468	Leihbeib.exe	92
PID 2468 wrote to memory of 3988	2468	Leihbeib.exe	92
PID 3988 wrote to memory of 3640	3988	Lfhdlh32.exe	94
PID 3988 wrote to memory of 3640	3988	Lfhdlh32.exe	94
PID 3988 wrote to memory of 3640	3988	Lfhdlh32.exe	94
PID 3640 wrote to memory of 4292	3640	Likjcbkc.exe	95
PID 3640 wrote to memory of 4292	3640	Likjcbkc.exe	95
PID 3640 wrote to memory of 4292	3640	Likjcbkc.exe	95
PID 4292 wrote to memory of 1136	4292	Lmiciaaj.exe	96
PID 4292 wrote to memory of 1136	4292	Lmiciaaj.exe	96
PID 4292 wrote to memory of 1136	4292	Lmiciaaj.exe	96
PID 1136 wrote to memory of 1132	1136	Mdckfk32.exe	97
PID 1136 wrote to memory of 1132	1136	Mdckfk32.exe	97
PID 1136 wrote to memory of 1132	1136	Mdckfk32.exe	97
PID 1132 wrote to memory of 4800	1132	Mgddhf32.exe	98
PID 1132 wrote to memory of 4800	1132	Mgddhf32.exe	98
PID 1132 wrote to memory of 4800	1132	Mgddhf32.exe	98
PID 4800 wrote to memory of 684	4800	Mgfqmfde.exe	99
PID 4800 wrote to memory of 684	4800	Mgfqmfde.exe	99
PID 4800 wrote to memory of 684	4800	Mgfqmfde.exe	99
PID 684 wrote to memory of 1696	684	Migjoaaf.exe	100
PID 684 wrote to memory of 1696	684	Migjoaaf.exe	100
PID 684 wrote to memory of 1696	684	Migjoaaf.exe	100
PID 1696 wrote to memory of 4988	1696	Nilcjp32.exe	101
PID 1696 wrote to memory of 4988	1696	Nilcjp32.exe	101
PID 1696 wrote to memory of 4988	1696	Nilcjp32.exe	101
PID 4988 wrote to memory of 2388	4988	Nphhmj32.exe	102
PID 4988 wrote to memory of 2388	4988	Nphhmj32.exe	102
PID 4988 wrote to memory of 2388	4988	Nphhmj32.exe	102
PID 2388 wrote to memory of 1976	2388	Ngdmod32.exe	103
PID 2388 wrote to memory of 1976	2388	Ngdmod32.exe	103
PID 2388 wrote to memory of 1976	2388	Ngdmod32.exe	103
PID 1976 wrote to memory of 2488	1976	Nlaegk32.exe	104

C:\Users\Admin\AppData\Local\Temp\7cc7a94efda72ffc755d64b41c6937c151d17c2e23dac00dce9f4ebc01c0e5fd.exe
"C:\Users\Admin\AppData\Local\Temp\7cc7a94efda72ffc755d64b41c6937c151d17c2e23dac00dce9f4ebc01c0e5fd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\Jbeidl32.exe
  C:\Windows\system32\Jbeidl32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\SysWOW64\Jmknaell.exe
    C:\Windows\system32\Jmknaell.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3616
  - - C:\Windows\SysWOW64\Jcefno32.exe
      C:\Windows\system32\Jcefno32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4668
    - - C:\Windows\SysWOW64\Jefbfgig.exe
        
        C:\Windows\system32\Jefbfgig.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3092
      - C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1164
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3812
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4904
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3896
        
        C:\Windows\SysWOW64\Kfoafi32.exe
        
        C:\Windows\system32\Kfoafi32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2468
        
        C:\Windows\SysWOW64\Lfhdlh32.exe
        
        C:\Windows\system32\Lfhdlh32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3988
        
        C:\Windows\SysWOW64\Likjcbkc.exe
        
        C:\Windows\system32\Likjcbkc.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3640
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4292
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1136
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Windows\SysWOW64\Mgfqmfde.exe
        
        C:\Windows\system32\Mgfqmfde.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4800
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:684
        
        C:\Windows\SysWOW64\Nilcjp32.exe
        
        C:\Windows\system32\Nilcjp32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1696
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4988
        
        C:\Windows\SysWOW64\Ngdmod32.exe
        
        C:\Windows\system32\Ngdmod32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2388
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1976
        
        C:\Windows\SysWOW64\Nfjjppmm.exe
        
        C:\Windows\system32\Nfjjppmm.exe
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2488
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3140
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3348
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        26⤵
        Executes dropped EXE
        
        PID:2372
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5092
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1080
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1092
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        30⤵
        Executes dropped EXE
        
        PID:832
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        31⤵
        Executes dropped EXE
        
        PID:4536
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        32⤵
        Executes dropped EXE
        
        PID:4072
        
        C:\Windows\SysWOW64\Ocdqjceo.exe
        
        C:\Windows\system32\Ocdqjceo.exe
        33⤵
        Executes dropped EXE
        
        PID:1672
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        34⤵
        Executes dropped EXE
        
        PID:544
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        35⤵
        Executes dropped EXE
        
        PID:1372
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        36⤵
        Executes dropped EXE
        
        PID:2160
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        37⤵
        Executes dropped EXE
        
        PID:992
        
        C:\Windows\SysWOW64\Pmoahijl.exe
        
        C:\Windows\system32\Pmoahijl.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2680
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:3728
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        40⤵
        Executes dropped EXE
        
        PID:1204
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        41⤵
        Executes dropped EXE
        
        PID:3944
        
        C:\Windows\SysWOW64\Pggbkagp.exe
        
        C:\Windows\system32\Pggbkagp.exe
        42⤵
        Executes dropped EXE
        
        PID:940
        
        C:\Windows\SysWOW64\Pjeoglgc.exe
        
        C:\Windows\system32\Pjeoglgc.exe
        43⤵
        Executes dropped EXE
        
        PID:3500
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        44⤵
        Executes dropped EXE
        
        PID:1560
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        45⤵
        Executes dropped EXE
        
        PID:1788
        
        C:\Windows\SysWOW64\Pncgmkmj.exe
        
        C:\Windows\system32\Pncgmkmj.exe
        46⤵
        Executes dropped EXE
        
        PID:3200
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        47⤵
        Executes dropped EXE
        
        PID:4088
        
        C:\Windows\SysWOW64\Ampkof32.exe
        
        C:\Windows\system32\Ampkof32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:700
        
        C:\Windows\SysWOW64\Afhohlbj.exe
        
        C:\Windows\system32\Afhohlbj.exe
        49⤵
        Executes dropped EXE
        
        PID:3804
        
        C:\Windows\SysWOW64\Aeiofcji.exe
        
        C:\Windows\system32\Aeiofcji.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4900
        
        C:\Windows\SysWOW64\Amddjegd.exe
        
        C:\Windows\system32\Amddjegd.exe
        51⤵
        Executes dropped EXE
        
        PID:4884
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        52⤵
        Executes dropped EXE
        
        PID:2860
        
        C:\Windows\SysWOW64\Anfmjhmd.exe
        
        C:\Windows\system32\Anfmjhmd.exe
        53⤵
        Executes dropped EXE
        
        PID:1128
        
        C:\Windows\SysWOW64\Bebblb32.exe
        
        C:\Windows\system32\Bebblb32.exe
        54⤵
        Executes dropped EXE
        
        PID:2256
        
        C:\Windows\SysWOW64\Bgcknmop.exe
        
        C:\Windows\system32\Bgcknmop.exe
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:784
        
        C:\Windows\SysWOW64\Bmpcfdmg.exe
        
        C:\Windows\system32\Bmpcfdmg.exe
        56⤵
        Executes dropped EXE
        
        PID:1780
        
        C:\Windows\SysWOW64\Bjddphlq.exe
        
        C:\Windows\system32\Bjddphlq.exe
        57⤵
        Executes dropped EXE
        
        PID:880
        
        C:\Windows\SysWOW64\Beihma32.exe
        
        C:\Windows\system32\Beihma32.exe
        58⤵
        Executes dropped EXE
        
        PID:3780
        
        C:\Windows\SysWOW64\Bnbmefbg.exe
        
        C:\Windows\system32\Bnbmefbg.exe
        59⤵
        Executes dropped EXE
        
        PID:1412
        
        C:\Windows\SysWOW64\Cfmajipb.exe
        
        C:\Windows\system32\Cfmajipb.exe
        60⤵
        Executes dropped EXE
        
        PID:1196
        
        C:\Windows\SysWOW64\Chmndlge.exe
        
        C:\Windows\system32\Chmndlge.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1160
        
        C:\Windows\SysWOW64\Cmiflbel.exe
        
        C:\Windows\system32\Cmiflbel.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2144
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        63⤵
        Executes dropped EXE
        
        PID:4208
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        64⤵
        Executes dropped EXE
        
        PID:4480
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3892
        
        C:\Windows\SysWOW64\Cffdpghg.exe
        
        C:\Windows\system32\Cffdpghg.exe
        66⤵
        Modifies registry class
        
        PID:800
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        67⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        68⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\Dmefhako.exe
        
        C:\Windows\system32\Dmefhako.exe
        69⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Dodbbdbb.exe
        
        C:\Windows\system32\Dodbbdbb.exe
        70⤵
        Drops file in System32 directory
        
        PID:3776
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        71⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        72⤵
        Drops file in System32 directory
        
        PID:252
        
        C:\Windows\SysWOW64\Eefaomcg.exe
        
        C:\Windows\system32\Eefaomcg.exe
        73⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\Ekbihd32.exe
        
        C:\Windows\system32\Ekbihd32.exe
        74⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\Ehfjah32.exe
        
        C:\Windows\system32\Ehfjah32.exe
        75⤵
        Modifies registry class
        
        PID:1784
        
        C:\Windows\SysWOW64\Eaakpm32.exe
        
        C:\Windows\system32\Eaakpm32.exe
        76⤵
        
        PID:480
        
        C:\Windows\SysWOW64\Ekiohclf.exe
        
        C:\Windows\system32\Ekiohclf.exe
        77⤵
        Drops file in System32 directory
        
        PID:1260
        
        C:\Windows\SysWOW64\Fdbdah32.exe
        
        C:\Windows\system32\Fdbdah32.exe
        78⤵
        
        PID:2948
        
        C:\Windows\SysWOW64\Foghnabl.exe
        
        C:\Windows\system32\Foghnabl.exe
        79⤵
        
        PID:1496
        
        C:\Windows\SysWOW64\Feapkk32.exe
        
        C:\Windows\system32\Feapkk32.exe
        80⤵
        Modifies registry class
        
        PID:788
        
        C:\Windows\SysWOW64\Fgbmccpg.exe
        
        C:\Windows\system32\Fgbmccpg.exe
        81⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Fggfnc32.exe
        
        C:\Windows\system32\Fggfnc32.exe
        82⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\Famjkl32.exe
        
        C:\Windows\system32\Famjkl32.exe
        83⤵
        
        PID:1648
        
        C:\Windows\SysWOW64\Fgjccb32.exe
        
        C:\Windows\system32\Fgjccb32.exe
        84⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\Foqkdp32.exe
        
        C:\Windows\system32\Foqkdp32.exe
        85⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Ghipne32.exe
        
        C:\Windows\system32\Ghipne32.exe
        86⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Gochjpho.exe
        
        C:\Windows\system32\Gochjpho.exe
        87⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Gdppbfff.exe
        
        C:\Windows\system32\Gdppbfff.exe
        88⤵
        Modifies registry class
        
        PID:2280
        
        C:\Windows\SysWOW64\Ggqida32.exe
        
        C:\Windows\system32\Ggqida32.exe
        89⤵
        Drops file in System32 directory
        
        PID:2316
        
        C:\Windows\SysWOW64\Ghpendjj.exe
        
        C:\Windows\system32\Ghpendjj.exe
        90⤵
        
        PID:1324
        
        C:\Windows\SysWOW64\Gnmnfkia.exe
        
        C:\Windows\system32\Gnmnfkia.exe
        91⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\Hakgmjoh.exe
        
        C:\Windows\system32\Hakgmjoh.exe
        92⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Hgjljpkm.exe
        
        C:\Windows\system32\Hgjljpkm.exe
        93⤵
        
        PID:1336
        
        C:\Windows\SysWOW64\Hhihdcbp.exe
        
        C:\Windows\system32\Hhihdcbp.exe
        94⤵
        Modifies registry class
        
        PID:4444
        
        C:\Windows\SysWOW64\Hnfamjqg.exe
        
        C:\Windows\system32\Hnfamjqg.exe
        95⤵
        
        PID:2720
        
        C:\Windows\SysWOW64\Hofmfmhj.exe
        
        C:\Windows\system32\Hofmfmhj.exe
        96⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\Ifbbig32.exe
        
        C:\Windows\system32\Ifbbig32.exe
        97⤵
        
        PID:284
        
        C:\Windows\SysWOW64\Ikokan32.exe
        
        C:\Windows\system32\Ikokan32.exe
        98⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\Ibicnh32.exe
        
        C:\Windows\system32\Ibicnh32.exe
        99⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\Iomcgl32.exe
        
        C:\Windows\system32\Iomcgl32.exe
        100⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\Idjlpc32.exe
        
        C:\Windows\system32\Idjlpc32.exe
        101⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\Ikcdlmgf.exe
        
        C:\Windows\system32\Ikcdlmgf.exe
        102⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\Ifleoe32.exe
        
        C:\Windows\system32\Ifleoe32.exe
        103⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\Jodjhkkj.exe
        
        C:\Windows\system32\Jodjhkkj.exe
        104⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\Jilnqqbj.exe
        
        C:\Windows\system32\Jilnqqbj.exe
        105⤵
        Drops file in System32 directory
        
        PID:2332
        
        C:\Windows\SysWOW64\Joffnk32.exe
        
        C:\Windows\system32\Joffnk32.exe
        106⤵
        
        PID:2564
        
        C:\Windows\SysWOW64\Jbdbjf32.exe
        
        C:\Windows\system32\Jbdbjf32.exe
        107⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\Jkmgblok.exe
        
        C:\Windows\system32\Jkmgblok.exe
        108⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\Jbgoof32.exe
        
        C:\Windows\system32\Jbgoof32.exe
        109⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\Jgdhgmep.exe
        
        C:\Windows\system32\Jgdhgmep.exe
        110⤵
        
        PID:1880
        
        C:\Windows\SysWOW64\Jpkphjeb.exe
        
        C:\Windows\system32\Jpkphjeb.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1596
        
        C:\Windows\SysWOW64\Jbileede.exe
        
        C:\Windows\system32\Jbileede.exe
        112⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Jehhaaci.exe
        
        C:\Windows\system32\Jehhaaci.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5124
        
        C:\Windows\SysWOW64\Jkaqnk32.exe
        
        C:\Windows\system32\Jkaqnk32.exe
        114⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Jejefqaf.exe
        
        C:\Windows\system32\Jejefqaf.exe
        115⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Jghabl32.exe
        
        C:\Windows\system32\Jghabl32.exe
        116⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Kbnepe32.exe
        
        C:\Windows\system32\Kbnepe32.exe
        117⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Klfjijgq.exe
        
        C:\Windows\system32\Klfjijgq.exe
        118⤵
        Drops file in System32 directory
        
        PID:5336
        
        C:\Windows\SysWOW64\Kflnfcgg.exe
        
        C:\Windows\system32\Kflnfcgg.exe
        119⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Khmknk32.exe
        
        C:\Windows\system32\Khmknk32.exe
        120⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Kpdboimg.exe
        
        C:\Windows\system32\Kpdboimg.exe
        121⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Khpgckkb.exe
        
        C:\Windows\system32\Khpgckkb.exe
        122⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Kpgodhkd.exe
        
        C:\Windows\system32\Kpgodhkd.exe
        123⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Kiodmn32.exe
        
        C:\Windows\system32\Kiodmn32.exe
        124⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Kbghfc32.exe
        
        C:\Windows\system32\Kbghfc32.exe
        125⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Llpmoiof.exe
        
        C:\Windows\system32\Llpmoiof.exe
        126⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Lbjelc32.exe
        
        C:\Windows\system32\Lbjelc32.exe
        127⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Lehaho32.exe
        
        C:\Windows\system32\Lehaho32.exe
        128⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Lpneegel.exe
        
        C:\Windows\system32\Lpneegel.exe
        129⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Lifjnm32.exe
        
        C:\Windows\system32\Lifjnm32.exe
        130⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Lldfjh32.exe
        
        C:\Windows\system32\Lldfjh32.exe
        131⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Locbfd32.exe
        
        C:\Windows\system32\Locbfd32.exe
        132⤵
        Modifies registry class
        
        PID:5940
        
        C:\Windows\SysWOW64\Lemkcnaa.exe
        
        C:\Windows\system32\Lemkcnaa.exe
        133⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Llgcph32.exe
        
        C:\Windows\system32\Llgcph32.exe
        134⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Loeolc32.exe
        
        C:\Windows\system32\Loeolc32.exe
        135⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Lflgmqhd.exe
        
        C:\Windows\system32\Lflgmqhd.exe
        136⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Likcilhh.exe
        
        C:\Windows\system32\Likcilhh.exe
        137⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\Llipehgk.exe
        
        C:\Windows\system32\Llipehgk.exe
        138⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Loglacfo.exe
        
        C:\Windows\system32\Loglacfo.exe
        139⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Lfodbqfa.exe
        
        C:\Windows\system32\Lfodbqfa.exe
        140⤵
        Drops file in System32 directory
        
        PID:5320
        
        C:\Windows\SysWOW64\Mlklkgei.exe
        
        C:\Windows\system32\Mlklkgei.exe
        141⤵
        
        PID:4584
        
        C:\Windows\SysWOW64\Mojhgbdl.exe
        
        C:\Windows\system32\Mojhgbdl.exe
        142⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Medqcmki.exe
        
        C:\Windows\system32\Medqcmki.exe
        143⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Mpieqeko.exe
        
        C:\Windows\system32\Mpieqeko.exe
        144⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Mbhamajc.exe
        
        C:\Windows\system32\Mbhamajc.exe
        145⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Mibijk32.exe
        
        C:\Windows\system32\Mibijk32.exe
        146⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Mbjnbqhp.exe
        
        C:\Windows\system32\Mbjnbqhp.exe
        147⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Midfokpm.exe
        
        C:\Windows\system32\Midfokpm.exe
        148⤵
        
        PID:5068
        
        C:\Windows\SysWOW64\Mlbbkfoq.exe
        
        C:\Windows\system32\Mlbbkfoq.exe
        149⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Moaogand.exe
        
        C:\Windows\system32\Moaogand.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5928
        
        C:\Windows\SysWOW64\Mfhfhong.exe
        
        C:\Windows\system32\Mfhfhong.exe
        151⤵
        Drops file in System32 directory
        
        PID:5996
        
        C:\Windows\SysWOW64\Npedmdab.exe
        
        C:\Windows\system32\Npedmdab.exe
        152⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Ngomin32.exe
        
        C:\Windows\system32\Ngomin32.exe
        153⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Nlleaeff.exe
        
        C:\Windows\system32\Nlleaeff.exe
        154⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Ncfmno32.exe
        
        C:\Windows\system32\Ncfmno32.exe
        155⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Nipekiep.exe
        
        C:\Windows\system32\Nipekiep.exe
        156⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Npjnhc32.exe
        
        C:\Windows\system32\Npjnhc32.exe
        157⤵
        Drops file in System32 directory
        
        PID:5512
        
        C:\Windows\SysWOW64\Neffpj32.exe
        
        C:\Windows\system32\Neffpj32.exe
        158⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Nheble32.exe
        
        C:\Windows\system32\Nheble32.exe
        159⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Nookip32.exe
        
        C:\Windows\system32\Nookip32.exe
        160⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\Ogfcjm32.exe
        
        C:\Windows\system32\Ogfcjm32.exe
        161⤵
        Modifies registry class
        
        PID:5892
        
        C:\Windows\SysWOW64\Oidofh32.exe
        
        C:\Windows\system32\Oidofh32.exe
        162⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Olckbd32.exe
        
        C:\Windows\system32\Olckbd32.exe
        163⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Ooagno32.exe
        
        C:\Windows\system32\Ooagno32.exe
        164⤵
        Drops file in System32 directory
        
        PID:5208
        
        C:\Windows\SysWOW64\Ocmconhk.exe
        
        C:\Windows\system32\Ocmconhk.exe
        165⤵
        Drops file in System32 directory
        
        PID:5412
        
        C:\Windows\SysWOW64\Oekpkigo.exe
        
        C:\Windows\system32\Oekpkigo.exe
        166⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        167⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Opadhb32.exe
        
        C:\Windows\system32\Opadhb32.exe
        168⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Ocopdn32.exe
        
        C:\Windows\system32\Ocopdn32.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6012
        
        C:\Windows\SysWOW64\Oenlqi32.exe
        
        C:\Windows\system32\Oenlqi32.exe
        170⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Opcqnb32.exe
        
        C:\Windows\system32\Opcqnb32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5488
        
        C:\Windows\SysWOW64\Ogmijllo.exe
        
        C:\Windows\system32\Ogmijllo.exe
        172⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Oileggkb.exe
        
        C:\Windows\system32\Oileggkb.exe
        173⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Opemca32.exe
        
        C:\Windows\system32\Opemca32.exe
        174⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Ocdjpmac.exe
        
        C:\Windows\system32\Ocdjpmac.exe
        175⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Ogpepl32.exe
        
        C:\Windows\system32\Ogpepl32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6048
        
        C:\Windows\SysWOW64\Ohqbhdpj.exe
        
        C:\Windows\system32\Ohqbhdpj.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5632
        
        C:\Windows\SysWOW64\Ocffempp.exe
        
        C:\Windows\system32\Ocffempp.exe
        178⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Phcomcng.exe
        
        C:\Windows\system32\Phcomcng.exe
        179⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Pomgjn32.exe
        
        C:\Windows\system32\Pomgjn32.exe
        180⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Phelcc32.exe
        
        C:\Windows\system32\Phelcc32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6224
        
        C:\Windows\SysWOW64\Poodpmca.exe
        
        C:\Windows\system32\Poodpmca.exe
        182⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Ppopjp32.exe
        
        C:\Windows\system32\Ppopjp32.exe
        183⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Pcmlfl32.exe
        
        C:\Windows\system32\Pcmlfl32.exe
        184⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Pflibgil.exe
        
        C:\Windows\system32\Pflibgil.exe
        185⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Phjenbhp.exe
        
        C:\Windows\system32\Phjenbhp.exe
        186⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Podmkm32.exe
        
        C:\Windows\system32\Podmkm32.exe
        187⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Pgkelj32.exe
        
        C:\Windows\system32\Pgkelj32.exe
        188⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Plhnda32.exe
        
        C:\Windows\system32\Plhnda32.exe
        189⤵
        
        PID:6556
        
        C:\Windows\SysWOW64\Qcbfakec.exe
        
        C:\Windows\system32\Qcbfakec.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6592
        
        C:\Windows\SysWOW64\Qljjjqlc.exe
        
        C:\Windows\system32\Qljjjqlc.exe
        191⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Aokcklid.exe
        
        C:\Windows\system32\Aokcklid.exe
        192⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Afelhf32.exe
        
        C:\Windows\system32\Afelhf32.exe
        193⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Afghneoo.exe
        
        C:\Windows\system32\Afghneoo.exe
        194⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Ahfdjanb.exe
        
        C:\Windows\system32\Ahfdjanb.exe
        195⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Aqmlknnd.exe
        
        C:\Windows\system32\Aqmlknnd.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6848
        
        C:\Windows\SysWOW64\Ackigjmh.exe
        
        C:\Windows\system32\Ackigjmh.exe
        197⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Afjeceml.exe
        
        C:\Windows\system32\Afjeceml.exe
        198⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6928
        
        C:\Windows\SysWOW64\Aqoiqn32.exe
        
        C:\Windows\system32\Aqoiqn32.exe
        199⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Agiamhdo.exe
        
        C:\Windows\system32\Agiamhdo.exe
        200⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Aijnep32.exe
        
        C:\Windows\system32\Aijnep32.exe
        201⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Amhfkopc.exe
        
        C:\Windows\system32\Amhfkopc.exe
        202⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Bgpgng32.exe
        
        C:\Windows\system32\Bgpgng32.exe
        203⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Bjodjb32.exe
        
        C:\Windows\system32\Bjodjb32.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5840
        
        C:\Windows\SysWOW64\Bmmpfn32.exe
        
        C:\Windows\system32\Bmmpfn32.exe
        205⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Boklbi32.exe
        
        C:\Windows\system32\Boklbi32.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6212
        
        C:\Windows\SysWOW64\Bfedoc32.exe
        
        C:\Windows\system32\Bfedoc32.exe
        207⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Bqkill32.exe
        
        C:\Windows\system32\Bqkill32.exe
        208⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6332
        
        C:\Windows\SysWOW64\Bgeaifia.exe
        
        C:\Windows\system32\Bgeaifia.exe
        209⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Bmbiamhi.exe
        
        C:\Windows\system32\Bmbiamhi.exe
        210⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Bggnof32.exe
        
        C:\Windows\system32\Bggnof32.exe
        211⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Cmdfgm32.exe
        
        C:\Windows\system32\Cmdfgm32.exe
        212⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Cikglnkj.exe
        
        C:\Windows\system32\Cikglnkj.exe
        213⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Ccqkigkp.exe
        
        C:\Windows\system32\Ccqkigkp.exe
        214⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        215⤵
        Modifies registry class
        
        PID:6816
        
        C:\Windows\SysWOW64\Cpglnhad.exe
        
        C:\Windows\system32\Cpglnhad.exe
        216⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Cfadkb32.exe
        
        C:\Windows\system32\Cfadkb32.exe
        217⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Cmklglpn.exe
        
        C:\Windows\system32\Cmklglpn.exe
        218⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Cjomap32.exe
        
        C:\Windows\system32\Cjomap32.exe
        219⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Cgcmjd32.exe
        
        C:\Windows\system32\Cgcmjd32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7100
        
        C:\Windows\SysWOW64\Dmpfbk32.exe
        
        C:\Windows\system32\Dmpfbk32.exe
        221⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        222⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Dhjckcgi.exe
        
        C:\Windows\system32\Dhjckcgi.exe
        223⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Dhlpqc32.exe
        
        C:\Windows\system32\Dhlpqc32.exe
        224⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Eipinkib.exe
        
        C:\Windows\system32\Eipinkib.exe
        225⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Edemkd32.exe
        
        C:\Windows\system32\Edemkd32.exe
        226⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Ehailbaa.exe
        
        C:\Windows\system32\Ehailbaa.exe
        227⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Ejpfhnpe.exe
        
        C:\Windows\system32\Ejpfhnpe.exe
        228⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Eaindh32.exe
        
        C:\Windows\system32\Eaindh32.exe
        229⤵
        Drops file in System32 directory
        
        PID:6992
        
        C:\Windows\SysWOW64\Ehcfaboo.exe
        
        C:\Windows\system32\Ehcfaboo.exe
        230⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        231⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Epagkd32.exe
        
        C:\Windows\system32\Epagkd32.exe
        232⤵
        Drops file in System32 directory
        
        PID:6344
        
        C:\Windows\SysWOW64\Epcdqd32.exe
        
        C:\Windows\system32\Epcdqd32.exe
        233⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Fkihnmhj.exe
        
        C:\Windows\system32\Fkihnmhj.exe
        234⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Facqkg32.exe
        
        C:\Windows\system32\Facqkg32.exe
        235⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Fhmigagd.exe
        
        C:\Windows\system32\Fhmigagd.exe
        236⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Fineoi32.exe
        
        C:\Windows\system32\Fineoi32.exe
        237⤵
        Drops file in System32 directory
        
        PID:7152
        
        C:\Windows\SysWOW64\Fipbdikp.exe
        
        C:\Windows\system32\Fipbdikp.exe
        238⤵
        Drops file in System32 directory
        
        PID:6468
        
        C:\Windows\SysWOW64\Fdffbake.exe
        
        C:\Windows\system32\Fdffbake.exe
        239⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Fkpool32.exe
        
        C:\Windows\system32\Fkpool32.exe
        240⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Fajgkfio.exe
        
        C:\Windows\system32\Fajgkfio.exe
        241⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Fkbkdkpp.exe
        
        C:\Windows\system32\Fkbkdkpp.exe
        242⤵
        Modifies registry class
        
        PID:6588
        
        C:\Windows\SysWOW64\Gkdhjknm.exe
        
        C:\Windows\system32\Gkdhjknm.exe
        243⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Gpaqbbld.exe
        
        C:\Windows\system32\Gpaqbbld.exe
        244⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Ghhhcomg.exe
        
        C:\Windows\system32\Ghhhcomg.exe
        245⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Gkgeoklj.exe
        
        C:\Windows\system32\Gkgeoklj.exe
        246⤵
        Drops file in System32 directory
        
        PID:7208
        
        C:\Windows\SysWOW64\Gmeakf32.exe
        
        C:\Windows\system32\Gmeakf32.exe
        247⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        248⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Gdoihpbk.exe
        
        C:\Windows\system32\Gdoihpbk.exe
        249⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Ggnedlao.exe
        
        C:\Windows\system32\Ggnedlao.exe
        250⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Gacjadad.exe
        
        C:\Windows\system32\Gacjadad.exe
        251⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Gpkchqdj.exe
        
        C:\Windows\system32\Gpkchqdj.exe
        252⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Hkpheidp.exe
        
        C:\Windows\system32\Hkpheidp.exe
        253⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Hnodaecc.exe
        
        C:\Windows\system32\Hnodaecc.exe
        254⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Hpmpnp32.exe
        
        C:\Windows\system32\Hpmpnp32.exe
        255⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Hammhcij.exe
        
        C:\Windows\system32\Hammhcij.exe
        256⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Hhfedm32.exe
        
        C:\Windows\system32\Hhfedm32.exe
        257⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Hjhalefe.exe
        
        C:\Windows\system32\Hjhalefe.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7728
        
        C:\Windows\SysWOW64\Hhiajmod.exe
        
        C:\Windows\system32\Hhiajmod.exe
        259⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7768
        
        C:\Windows\SysWOW64\Idbodn32.exe
        
        C:\Windows\system32\Idbodn32.exe
        260⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        261⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Igedlh32.exe
        
        C:\Windows\system32\Igedlh32.exe
        262⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        263⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Ikcmbfcj.exe
        
        C:\Windows\system32\Ikcmbfcj.exe
        264⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Iqbbpm32.exe
        
        C:\Windows\system32\Iqbbpm32.exe
        265⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Jglklggl.exe
        
        C:\Windows\system32\Jglklggl.exe
        266⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        267⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8124
        
        C:\Windows\SysWOW64\Jjmcnbdm.exe
        
        C:\Windows\system32\Jjmcnbdm.exe
        269⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Jbdlop32.exe
        
        C:\Windows\system32\Jbdlop32.exe
        270⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Jdbhkk32.exe
        
        C:\Windows\system32\Jdbhkk32.exe
        271⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        272⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Jklphekp.exe
        
        C:\Windows\system32\Jklphekp.exe
        273⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Jnkldqkc.exe
        
        C:\Windows\system32\Jnkldqkc.exe
        274⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Jqiipljg.exe
        
        C:\Windows\system32\Jqiipljg.exe
        275⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        276⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Jnmijq32.exe
        
        C:\Windows\system32\Jnmijq32.exe
        277⤵
        Modifies registry class
        
        PID:7676
        
        C:\Windows\SysWOW64\Kjffdalb.exe
        
        C:\Windows\system32\Kjffdalb.exe
        278⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Kqpoakco.exe
        
        C:\Windows\system32\Kqpoakco.exe
        279⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Kiggbhda.exe
        
        C:\Windows\system32\Kiggbhda.exe
        280⤵
        Drops file in System32 directory
        
        PID:7856
        
        C:\Windows\SysWOW64\Kbpkkn32.exe
        
        C:\Windows\system32\Kbpkkn32.exe
        281⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        282⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        283⤵
        Modifies registry class
        
        PID:8064
        
        C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        284⤵
        Modifies registry class
        
        PID:8104
        
        C:\Windows\SysWOW64\Kgamnded.exe
        
        C:\Windows\system32\Kgamnded.exe
        285⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Lajagj32.exe
        
        C:\Windows\system32\Lajagj32.exe
        286⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Lnnbqnjn.exe
        
        C:\Windows\system32\Lnnbqnjn.exe
        287⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Lalnmiia.exe
        
        C:\Windows\system32\Lalnmiia.exe
        288⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        289⤵
        Modifies registry class
        
        PID:4384
        
        C:\Windows\SysWOW64\Lgffic32.exe
        
        C:\Windows\system32\Lgffic32.exe
        290⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Ljdceo32.exe
        
        C:\Windows\system32\Ljdceo32.exe
        291⤵
        Modifies registry class
        
        PID:7792
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        292⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        293⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        294⤵
        Modifies registry class
        
        PID:8068
        
        C:\Windows\SysWOW64\Mngegmbc.exe
        
        C:\Windows\system32\Mngegmbc.exe
        295⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Meefofek.exe
        
        C:\Windows\system32\Meefofek.exe
        296⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        297⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Mehcdfch.exe
        
        C:\Windows\system32\Mehcdfch.exe
        298⤵
        Drops file in System32 directory
        
        PID:7776
        
        C:\Windows\SysWOW64\Mhfppabl.exe
        
        C:\Windows\system32\Mhfppabl.exe
        299⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\Mnphmkji.exe
        
        C:\Windows\system32\Mnphmkji.exe
        300⤵
        Modifies registry class
        
        PID:8100
        
        C:\Windows\SysWOW64\Maodigil.exe
        
        C:\Windows\system32\Maodigil.exe
        301⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Mifljdjo.exe
        
        C:\Windows\system32\Mifljdjo.exe
        302⤵
        
        PID:7452
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        303⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7864
        
        C:\Windows\SysWOW64\Nhpbfpka.exe
        
        C:\Windows\system32\Nhpbfpka.exe
        304⤵
        Drops file in System32 directory
        
        PID:8112
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        305⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Nahgoe32.exe
        
        C:\Windows\system32\Nahgoe32.exe
        306⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Nhbolp32.exe
        
        C:\Windows\system32\Nhbolp32.exe
        307⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7836
        
        C:\Windows\SysWOW64\Nolgijpk.exe
        
        C:\Windows\system32\Nolgijpk.exe
        308⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        309⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        310⤵
        Modifies registry class
        
        PID:8268
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        311⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        312⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Olbdhn32.exe
        
        C:\Windows\system32\Olbdhn32.exe
        313⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        314⤵
        Modifies registry class
        
        PID:8444
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        315⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        316⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Oaajed32.exe
        
        C:\Windows\system32\Oaajed32.exe
        317⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Oihagaji.exe
        
        C:\Windows\system32\Oihagaji.exe
        318⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Olgncmim.exe
        
        C:\Windows\system32\Olgncmim.exe
        319⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Ooejohhq.exe
        
        C:\Windows\system32\Ooejohhq.exe
        320⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        321⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Oiknlagg.exe
        
        C:\Windows\system32\Oiknlagg.exe
        322⤵
        
        PID:8784
        
        C:\Windows\SysWOW64\Pahpfc32.exe
        
        C:\Windows\system32\Pahpfc32.exe
        323⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        324⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        325⤵
        Modifies registry class
        
        PID:8904
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        326⤵
        Drops file in System32 directory
        
        PID:8944
        
        C:\Windows\SysWOW64\Peieba32.exe
        
        C:\Windows\system32\Peieba32.exe
        327⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        328⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Pkenjh32.exe
        
        C:\Windows\system32\Pkenjh32.exe
        329⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Pcmeke32.exe
        
        C:\Windows\system32\Pcmeke32.exe
        330⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        331⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Pcobaedj.exe
        
        C:\Windows\system32\Pcobaedj.exe
        332⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Piijno32.exe
        
        C:\Windows\system32\Piijno32.exe
        333⤵
        
        PID:656
        
        C:\Windows\SysWOW64\Qkjgegae.exe
        
        C:\Windows\system32\Qkjgegae.exe
        334⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Qcaofebg.exe
        
        C:\Windows\system32\Qcaofebg.exe
        335⤵
        Drops file in System32 directory
        
        PID:8328
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        336⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Qikgco32.exe
        
        C:\Windows\system32\Qikgco32.exe
        337⤵
        Modifies registry class
        
        PID:8436
        
        C:\Windows\SysWOW64\Ahqddk32.exe
        
        C:\Windows\system32\Ahqddk32.exe
        338⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Ajpqnneo.exe
        
        C:\Windows\system32\Ajpqnneo.exe
        339⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Afgacokc.exe
        
        C:\Windows\system32\Afgacokc.exe
        340⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        341⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Ahjgjj32.exe
        
        C:\Windows\system32\Ahjgjj32.exe
        342⤵
        Modifies registry class
        
        PID:8780
        
        C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        343⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        344⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Bohibc32.exe
        
        C:\Windows\system32\Bohibc32.exe
        345⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Bfbaonae.exe
        
        C:\Windows\system32\Bfbaonae.exe
        346⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        347⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Bblnindg.exe
        
        C:\Windows\system32\Bblnindg.exe
        348⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Bheffh32.exe
        
        C:\Windows\system32\Bheffh32.exe
        349⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        350⤵
        Drops file in System32 directory
        
        PID:8252
        
        C:\Windows\SysWOW64\Cfldelik.exe
        
        C:\Windows\system32\Cfldelik.exe
        351⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        352⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Ccpdoqgd.exe
        
        C:\Windows\system32\Ccpdoqgd.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8556
        
        C:\Windows\SysWOW64\Cmhigf32.exe
        
        C:\Windows\system32\Cmhigf32.exe
        354⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        355⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Ccdnjp32.exe
        
        C:\Windows\system32\Ccdnjp32.exe
        356⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        357⤵
        Drops file in System32 directory
        
        PID:8992
        
        C:\Windows\SysWOW64\Dkbocbog.exe
        
        C:\Windows\system32\Dkbocbog.exe
        358⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        359⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        360⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        361⤵
        Modifies registry class
        
        PID:8476
        
        C:\Windows\SysWOW64\Ebejfk32.exe
        
        C:\Windows\system32\Ebejfk32.exe
        362⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        363⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        364⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9064
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        365⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        366⤵
        Drops file in System32 directory
        
        PID:8432
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        367⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Ffobhg32.exe
        
        C:\Windows\system32\Ffobhg32.exe
        368⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        369⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        370⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        371⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        372⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Fibhpbea.exe
        
        C:\Windows\system32\Fibhpbea.exe
        373⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        374⤵
        Modifies registry class
        
        PID:9288
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        375⤵
        Drops file in System32 directory
        
        PID:9324
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        376⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        377⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Gfheof32.exe
        
        C:\Windows\system32\Gfheof32.exe
        378⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        379⤵
        
        PID:9480
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        380⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        381⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        382⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Gdobnj32.exe
        
        C:\Windows\system32\Gdobnj32.exe
        383⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        384⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        385⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        386⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        387⤵
        
        PID:9824
        
        C:\Windows\SysWOW64\Hgdejd32.exe
        
        C:\Windows\system32\Hgdejd32.exe
        388⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        389⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        390⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        391⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        392⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        393⤵
        Modifies registry class
        
        PID:10064
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        394⤵
        Drops file in System32 directory
        
        PID:10108
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        395⤵
        Drops file in System32 directory
        
        PID:10152
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        396⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        397⤵
        Modifies registry class
        
        PID:10232
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        398⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        399⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        400⤵
        Modifies registry class
        
        PID:9384
        
        C:\Windows\SysWOW64\Idkkpf32.exe
        
        C:\Windows\system32\Idkkpf32.exe
        401⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        402⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        403⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        404⤵
        
        PID:9648
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        405⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        406⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:792
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        407⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        408⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        409⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        410⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        411⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        412⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        413⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        414⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Kdigadjo.exe
        
        C:\Windows\system32\Kdigadjo.exe
        415⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        416⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        417⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        418⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        419⤵
        
        PID:4680
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        420⤵
        
        PID:10180
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        421⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        422⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        423⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        424⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        425⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        426⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        427⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Lqkgbcff.exe
        
        C:\Windows\system32\Lqkgbcff.exe
        428⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        429⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        430⤵
        Modifies registry class
        
        PID:9464
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        431⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        432⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        433⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3092
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        434⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Mcqjon32.exe
        
        C:\Windows\system32\Mcqjon32.exe
        435⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        436⤵
        Drops file in System32 directory
        
        PID:2304
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        437⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9976
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        438⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        439⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        440⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        441⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        442⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\Malpia32.exe
        
        C:\Windows\system32\Malpia32.exe
        443⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        444⤵
        Modifies registry class
        
        PID:9560
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        445⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        446⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        447⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        448⤵
        
        PID:9624
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        449⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        450⤵
        Drops file in System32 directory
        
        PID:876
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        451⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        452⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        453⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        454⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Nnicid32.exe
        
        C:\Windows\system32\Nnicid32.exe
        455⤵
        Modifies registry class
        
        PID:10364
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        456⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        457⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        458⤵
        
        PID:10488
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        459⤵
        Drops file in System32 directory
        
        PID:10536
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        460⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        461⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        462⤵
        Modifies registry class
        
        PID:10668
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        463⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        464⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        465⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10836
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        466⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        467⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        468⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10980
        
        C:\Windows\SysWOW64\Phodcg32.exe
        
        C:\Windows\system32\Phodcg32.exe
        469⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11032
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        470⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        471⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        472⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        473⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        474⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        475⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        476⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4220
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        478⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10688
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        479⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        480⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        481⤵
        
        PID:10828
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        482⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        483⤵
        
        PID:10940
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        484⤵
        Drops file in System32 directory
        
        PID:3140
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        485⤵
        Modifies registry class
        
        PID:5000
        
        C:\Windows\SysWOW64\Clchbqoo.exe
        
        C:\Windows\system32\Clchbqoo.exe
        486⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        487⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\Cocacl32.exe
        
        C:\Windows\system32\Cocacl32.exe
        488⤵
        
        PID:4872
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        489⤵
        
        PID:2420
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        490⤵
        Drops file in System32 directory
        
        PID:11164
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        491⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        492⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        493⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        494⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10312
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        495⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        496⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:2928
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        497⤵
        
        PID:684
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        498⤵
        
        PID:1116
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        499⤵
        Drops file in System32 directory
        
        PID:10644
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        500⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        501⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        502⤵
        
        PID:3372
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        503⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        504⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        505⤵
        Drops file in System32 directory
        
        PID:10924
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        506⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Fpgpgfmh.exe
        
        C:\Windows\system32\Fpgpgfmh.exe
        507⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        508⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        509⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        510⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\Gblbca32.exe
        
        C:\Windows\system32\Gblbca32.exe
        511⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        512⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        513⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        514⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        515⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        516⤵
        Modifies registry class
        
        PID:540
        
        C:\Windows\SysWOW64\Hfaajnfb.exe
        
        C:\Windows\system32\Hfaajnfb.exe
        517⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        518⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        519⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        520⤵
        Modifies registry class
        
        PID:10660
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        521⤵
        
        PID:4116
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        522⤵
        Drops file in System32 directory
        
        PID:236
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        523⤵
        
        PID:4416
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        524⤵
        
        PID:2640
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        525⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        526⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3264
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        527⤵
        
        PID:1252
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        528⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        529⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4040
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        530⤵
        Modifies registry class
        
        PID:3348
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        531⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2320
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        532⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        533⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        534⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        535⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        536⤵
        Drops file in System32 directory
        
        PID:3044
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        537⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        538⤵
        
        PID:2888
        
        C:\Windows\SysWOW64\Jekqmhia.exe
        
        C:\Windows\system32\Jekqmhia.exe
        539⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10316
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        540⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        541⤵
        
        PID:4052
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        542⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        543⤵
        Modifies registry class
        
        PID:10656
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        544⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        545⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        546⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        547⤵
        
        PID:1904
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        548⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        549⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        550⤵
        
        PID:784
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        551⤵
        
        PID:544
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        552⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        553⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11244
        
        C:\Windows\SysWOW64\Mqdcnl32.exe
        
        C:\Windows\system32\Mqdcnl32.exe
        554⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        555⤵
        Modifies registry class
        
        PID:10280
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        556⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        557⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        558⤵
        Drops file in System32 directory
        
        PID:4532
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        559⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3304
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        560⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        561⤵
        Drops file in System32 directory
        
        PID:1472
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        562⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        563⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        564⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Dkcndeen.exe
        
        C:\Windows\system32\Dkcndeen.exe
        565⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        566⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        567⤵
        
        PID:112
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        568⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        569⤵
        Drops file in System32 directory
        
        PID:6032
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        570⤵
        Modifies registry class
        
        PID:5852
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        571⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5248
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        572⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        573⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        574⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5240
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        575⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        576⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        577⤵
        
        PID:988
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        578⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        579⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        580⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5956
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        581⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        582⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Hahokfag.exe
        
        C:\Windows\system32\Hahokfag.exe
        583⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        584⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        585⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        586⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        587⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        588⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        589⤵
        Modifies registry class
        
        PID:2104
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        590⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Ilnlom32.exe
        
        C:\Windows\system32\Ilnlom32.exe
        591⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\Iolhkh32.exe
        
        C:\Windows\system32\Iolhkh32.exe
        592⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6272
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        593⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5720
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        594⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        595⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        596⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Jhgiim32.exe
        
        C:\Windows\system32\Jhgiim32.exe
        597⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        598⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        599⤵
        Modifies registry class
        
        PID:6512
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        600⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        601⤵
        Drops file in System32 directory
        
        PID:11156
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        602⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        603⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1260
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        604⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        605⤵
        
        PID:3388
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        606⤵
        Drops file in System32 directory
        
        PID:6760
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        607⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        608⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\Loofnccf.exe
        
        C:\Windows\system32\Loofnccf.exe
        609⤵
        
        PID:11260
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        610⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        611⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Mcfbkpab.exe
        
        C:\Windows\system32\Mcfbkpab.exe
        612⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        613⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6092
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        614⤵
        
        PID:2856
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        615⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        616⤵
        Drops file in System32 directory
        
        PID:3496
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        617⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        618⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        619⤵
        Modifies registry class
        
        PID:500
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        620⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5192
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        621⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        622⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        623⤵
        Drops file in System32 directory
        
        PID:6460
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        624⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        625⤵
        Modifies registry class
        
        PID:1696
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        626⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        627⤵
        Drops file in System32 directory
        
        PID:4884
        
        C:\Windows\SysWOW64\Oqmhqapg.exe
        
        C:\Windows\system32\Oqmhqapg.exe
        628⤵
        
        PID:4868
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        629⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7576
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        630⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Qclmck32.exe
        
        C:\Windows\system32\Qclmck32.exe
        631⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Qjffpe32.exe
        
        C:\Windows\system32\Qjffpe32.exe
        632⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        633⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7444
        
        C:\Windows\SysWOW64\Aimogakj.exe
        
        C:\Windows\system32\Aimogakj.exe
        634⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Amkhmoap.exe
        
        C:\Windows\system32\Amkhmoap.exe
        635⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Abmjqe32.exe
        
        C:\Windows\system32\Abmjqe32.exe
        636⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Biklho32.exe
        
        C:\Windows\system32\Biklho32.exe
        637⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Bbdpad32.exe
        
        C:\Windows\system32\Bbdpad32.exe
        638⤵
        
        PID:240
        
        C:\Windows\SysWOW64\Binhnomg.exe
        
        C:\Windows\system32\Binhnomg.exe
        639⤵
        
        PID:3976
        
        C:\Windows\SysWOW64\Bphqji32.exe
        
        C:\Windows\system32\Bphqji32.exe
        640⤵
        
        PID:4704
        
        C:\Windows\SysWOW64\Bipecnkd.exe
        
        C:\Windows\system32\Bipecnkd.exe
        641⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Bmladm32.exe
        
        C:\Windows\system32\Bmladm32.exe
        642⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\Bpjmph32.exe
        
        C:\Windows\system32\Bpjmph32.exe
        643⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Cpljehpo.exe
        
        C:\Windows\system32\Cpljehpo.exe
        644⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Ckdkhq32.exe
        
        C:\Windows\system32\Ckdkhq32.exe
        645⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Cancekeo.exe
        
        C:\Windows\system32\Cancekeo.exe
        646⤵
        Modifies registry class
        
        PID:6692
        
        C:\Windows\SysWOW64\Cgklmacf.exe
        
        C:\Windows\system32\Cgklmacf.exe
        647⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Cgmhcaac.exe
        
        C:\Windows\system32\Cgmhcaac.exe
        648⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Cildom32.exe
        
        C:\Windows\system32\Cildom32.exe
        649⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Ccdihbgg.exe
        
        C:\Windows\system32\Ccdihbgg.exe
        650⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        651⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Dgbanq32.exe
        
        C:\Windows\system32\Dgbanq32.exe
        652⤵
        Drops file in System32 directory
        
        PID:5376
        
        C:\Windows\SysWOW64\Dnljkk32.exe
        
        C:\Windows\system32\Dnljkk32.exe
        653⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Dajbaika.exe
        
        C:\Windows\system32\Dajbaika.exe
        654⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\Dggkipii.exe
        
        C:\Windows\system32\Dggkipii.exe
        655⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Dnqcfjae.exe
        
        C:\Windows\system32\Dnqcfjae.exe
        656⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Dcnlnaom.exe
        
        C:\Windows\system32\Dcnlnaom.exe
        657⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Eaaiahei.exe
        
        C:\Windows\system32\Eaaiahei.exe
        658⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Egnajocq.exe
        
        C:\Windows\system32\Egnajocq.exe
        659⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\Ejlnfjbd.exe
        
        C:\Windows\system32\Ejlnfjbd.exe
        660⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Edaaccbj.exe
        
        C:\Windows\system32\Edaaccbj.exe
        661⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Ekljpm32.exe
        
        C:\Windows\system32\Ekljpm32.exe
        662⤵
        Drops file in System32 directory
        
        PID:7340
        
        C:\Windows\SysWOW64\Enjfli32.exe
        
        C:\Windows\system32\Enjfli32.exe
        663⤵
        Modifies registry class
        
        PID:7632
        
        C:\Windows\SysWOW64\Eddnic32.exe
        
        C:\Windows\system32\Eddnic32.exe
        664⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Egbken32.exe
        
        C:\Windows\system32\Egbken32.exe
        665⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Ejagaj32.exe
        
        C:\Windows\system32\Ejagaj32.exe
        666⤵
        
        PID:4384
        
        C:\Windows\SysWOW64\Egegjn32.exe
        
        C:\Windows\system32\Egegjn32.exe
        667⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Edihdb32.exe
        
        C:\Windows\system32\Edihdb32.exe
        668⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Fjeplijj.exe
        
        C:\Windows\system32\Fjeplijj.exe
        669⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:216
        
        C:\Windows\SysWOW64\Fnalmh32.exe
        
        C:\Windows\system32\Fnalmh32.exe
        670⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Fqphic32.exe
        
        C:\Windows\system32\Fqphic32.exe
        671⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4488
        
        C:\Windows\SysWOW64\Fcneeo32.exe
        
        C:\Windows\system32\Fcneeo32.exe
        672⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Fqbeoc32.exe
        
        C:\Windows\system32\Fqbeoc32.exe
        673⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Fcpakn32.exe
        
        C:\Windows\system32\Fcpakn32.exe
        674⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8248
        
        C:\Windows\SysWOW64\Fkgillpj.exe
        
        C:\Windows\system32\Fkgillpj.exe
        675⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Fjjjgh32.exe
        
        C:\Windows\system32\Fjjjgh32.exe
        676⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\Fbaahf32.exe
        
        C:\Windows\system32\Fbaahf32.exe
        677⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Fqdbdbna.exe
        
        C:\Windows\system32\Fqdbdbna.exe
        678⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Fgnjqm32.exe
        
        C:\Windows\system32\Fgnjqm32.exe
        679⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Fbdnne32.exe
        
        C:\Windows\system32\Fbdnne32.exe
        680⤵
        Drops file in System32 directory
        
        PID:8504
        
        C:\Windows\SysWOW64\Fklcgk32.exe
        
        C:\Windows\system32\Fklcgk32.exe
        681⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Fnjocf32.exe
        
        C:\Windows\system32\Fnjocf32.exe
        682⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7388
        
        C:\Windows\SysWOW64\Gcghkm32.exe
        
        C:\Windows\system32\Gcghkm32.exe
        683⤵
        Modifies registry class
        
        PID:1088
        
        C:\Windows\SysWOW64\Gjhfif32.exe
        
        C:\Windows\system32\Gjhfif32.exe
        684⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Hkcbnh32.exe
        
        C:\Windows\system32\Hkcbnh32.exe
        685⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\Ilfodgeg.exe
        
        C:\Windows\system32\Ilfodgeg.exe
        686⤵
        Drops file in System32 directory
        
        PID:7640
        
        C:\Windows\SysWOW64\Iabglnco.exe
        
        C:\Windows\system32\Iabglnco.exe
        687⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Igmoih32.exe
        
        C:\Windows\system32\Igmoih32.exe
        688⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Inidkb32.exe
        
        C:\Windows\system32\Inidkb32.exe
        689⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Ijbbfc32.exe
        
        C:\Windows\system32\Ijbbfc32.exe
        690⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Jhkljfok.exe
        
        C:\Windows\system32\Jhkljfok.exe
        691⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Jlfhke32.exe
        
        C:\Windows\system32\Jlfhke32.exe
        692⤵
        Drops file in System32 directory
        
        PID:7520
        
        C:\Windows\SysWOW64\Jnedgq32.exe
        
        C:\Windows\system32\Jnedgq32.exe
        693⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Jhmhpfmi.exe
        
        C:\Windows\system32\Jhmhpfmi.exe
        694⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Jogqlpde.exe
        
        C:\Windows\system32\Jogqlpde.exe
        695⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Jeaiij32.exe
        
        C:\Windows\system32\Jeaiij32.exe
        696⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Kbeibo32.exe
        
        C:\Windows\system32\Kbeibo32.exe
        697⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Kbgfhnhi.exe
        
        C:\Windows\system32\Kbgfhnhi.exe
        698⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Kdpiqehp.exe
        
        C:\Windows\system32\Kdpiqehp.exe
        699⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\Leoejh32.exe
        
        C:\Windows\system32\Leoejh32.exe
        700⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\Lojfin32.exe
        
        C:\Windows\system32\Lojfin32.exe
        701⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Lajokiaa.exe
        
        C:\Windows\system32\Lajokiaa.exe
        702⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Mlemcq32.exe
        
        C:\Windows\system32\Mlemcq32.exe
        703⤵
        Modifies registry class
        
        PID:7808
        
        C:\Windows\SysWOW64\Mlgjhp32.exe
        
        C:\Windows\system32\Mlgjhp32.exe
        704⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Nhbciqln.exe
        
        C:\Windows\system32\Nhbciqln.exe
        705⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Nhgmcp32.exe
        
        C:\Windows\system32\Nhgmcp32.exe
        706⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Ndpjnq32.exe
        
        C:\Windows\system32\Ndpjnq32.exe
        707⤵
        Modifies registry class
        
        PID:11196
        
        C:\Windows\SysWOW64\Oomelheh.exe
        
        C:\Windows\system32\Oomelheh.exe
        708⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Pbgqdb32.exe
        
        C:\Windows\system32\Pbgqdb32.exe
        709⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\Pkoemhao.exe
        
        C:\Windows\system32\Pkoemhao.exe
        710⤵
        Modifies registry class
        
        PID:8940
        
        C:\Windows\SysWOW64\Pmoagk32.exe
        
        C:\Windows\system32\Pmoagk32.exe
        711⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Qbngeadf.exe
        
        C:\Windows\system32\Qbngeadf.exe
        712⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Qihoak32.exe
        
        C:\Windows\system32\Qihoak32.exe
        713⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Qcncodki.exe
        
        C:\Windows\system32\Qcncodki.exe
        714⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Aflpkpjm.exe
        
        C:\Windows\system32\Aflpkpjm.exe
        715⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Aeopfl32.exe
        
        C:\Windows\system32\Aeopfl32.exe
        716⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Akihcfid.exe
        
        C:\Windows\system32\Akihcfid.exe
        717⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Afnlpohj.exe
        
        C:\Windows\system32\Afnlpohj.exe
        718⤵
        
        PID:212
        
        C:\Windows\SysWOW64\Alkeifga.exe
        
        C:\Windows\system32\Alkeifga.exe
        719⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Acbmjcgd.exe
        
        C:\Windows\system32\Acbmjcgd.exe
        720⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Afqifo32.exe
        
        C:\Windows\system32\Afqifo32.exe
        721⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7084
        
        C:\Windows\SysWOW64\Aioebj32.exe
        
        C:\Windows\system32\Aioebj32.exe
        722⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Abgjkpll.exe
        
        C:\Windows\system32\Abgjkpll.exe
        723⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\Aeffgkkp.exe
        
        C:\Windows\system32\Aeffgkkp.exe
        724⤵
        Modifies registry class
        
        PID:3356
        
        C:\Windows\SysWOW64\Apkjddke.exe
        
        C:\Windows\system32\Apkjddke.exe
        725⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Abjfqpji.exe
        
        C:\Windows\system32\Abjfqpji.exe
        726⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Afeban32.exe
        
        C:\Windows\system32\Afeban32.exe
        727⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5572
        
        C:\Windows\SysWOW64\Albkieqj.exe
        
        C:\Windows\system32\Albkieqj.exe
        728⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Bfhofnpp.exe
        
        C:\Windows\system32\Bfhofnpp.exe
        729⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Bmagch32.exe
        
        C:\Windows\system32\Bmagch32.exe
        730⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Bppcpc32.exe
        
        C:\Windows\system32\Bppcpc32.exe
        731⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Bfjllnnm.exe
        
        C:\Windows\system32\Bfjllnnm.exe
        732⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Bihhhi32.exe
        
        C:\Windows\system32\Bihhhi32.exe
        733⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Bmddihfj.exe
        
        C:\Windows\system32\Bmddihfj.exe
        734⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Bpemkcck.exe
        
        C:\Windows\system32\Bpemkcck.exe
        735⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Bmkjig32.exe
        
        C:\Windows\system32\Bmkjig32.exe
        736⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Cbhbbn32.exe
        
        C:\Windows\system32\Cbhbbn32.exe
        737⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9404
        
        C:\Windows\SysWOW64\Cmmgof32.exe
        
        C:\Windows\system32\Cmmgof32.exe
        738⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Cehlcikj.exe
        
        C:\Windows\system32\Cehlcikj.exe
        739⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Cbmlmmjd.exe
        
        C:\Windows\system32\Cbmlmmjd.exe
        740⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Cpqlfa32.exe
        
        C:\Windows\system32\Cpqlfa32.exe
        741⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Cdnelpod.exe
        
        C:\Windows\system32\Cdnelpod.exe
        742⤵
        
        PID:10788
        
        C:\Windows\SysWOW64\Dpgbgpbe.exe
        
        C:\Windows\system32\Dpgbgpbe.exe
        743⤵
        Modifies registry class
        
        PID:8352
        
        C:\Windows\SysWOW64\Dedkogqm.exe
        
        C:\Windows\system32\Dedkogqm.exe
        744⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Dgdgijhp.exe
        
        C:\Windows\system32\Dgdgijhp.exe
        745⤵
        Modifies registry class
        
        PID:7212
        
        C:\Windows\SysWOW64\Dbkhnk32.exe
        
        C:\Windows\system32\Dbkhnk32.exe
        746⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10068 -s 420
        747⤵
        Program crash
        
        PID:6604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 10068 -ip 10068
1⤵
PID:9972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ahqddk32.exe

Filesize
386KB

MD5
661cb25ca2838f2f11505f6fab97301b

SHA1
ad4b3a5367613d609130ebda10aed5f700007f68

SHA256
ffbf06b3236a68a68053745ea6b9a6da9ae13cf1de9d2e2e4d3c2a078538f2d3

SHA512
1afed3a2083ba945514e752d3dbe44d6a798ddd3b7c8d2c7b04817a59595090150beae26b920afaa7a4cf22fa6a5f95d835568c3170cd5ca75b72d40bd63cfdd

Download Submit
C:\Windows\SysWOW64\Anfmjhmd.exe

Filesize
386KB

MD5
386481da25c3b2df8540553bc599f4a4

SHA1
026cb5710606a99577144b5a8a66a8f8b273d9d8

SHA256
c158e6a94af5fe7658b2f27dc6908eaca02d539731a639138c4aa65f2662b80b

SHA512
622960e84f012562fa384a04a674efc8e6b3a63d4d4df7787551561965fa641958a3c9bf539b8c47f941a009c6e9d0d33fcd58f3c818987941bd9742f8e24cb6

Download Submit
C:\Windows\SysWOW64\Bcfahbpo.exe

Filesize
386KB

MD5
602784409a8b1b108ee740934fc86923

SHA1
8bf20b558c9f6105fb994c3c0a73f718ac024841

SHA256
84658b514e36ac9d31e53dde8208326d284c7cd0afcd1c920af402541956f99e

SHA512
2bc696e727ff37af1575ac44561887c65ba57de2322a25e7a8aacdf6b834ccb54776997d7e690af9e5c2e57e3cc070d0d0ed48b8dad7f4cb6e3f8baee95570ad

Download Submit
C:\Windows\SysWOW64\Bfngdn32.exe

Filesize
320KB

MD5
db2b9da8587718000135f1130e4da35c

SHA1
28590008028e430be8fb6102a0888fba36ac895d

SHA256
d2771b0f69685b9ab88ebad6c198a38c61194838629c4434f99b05636d5ca687

SHA512
635db9fbf4643b4a6024b7040bed7beb9b01427d2a93759b2c52966b087dd5dcc1724fa29795f444c5a6498013208cfef9003a8560d9e8f52f29ebae5418ae70

Download Submit
C:\Windows\SysWOW64\Cihclh32.exe

Filesize
386KB

MD5
1aa2d4402af532ea1b9f0790e670e84e

SHA1
f0ab435d61079f729ef738a1271eb2347d0ee7aa

SHA256
7d9f304b9f6ab1251f56e9410549f0b8b3c0cfb3c3e525026d233d534a4b9b3a

SHA512
f9f2989bd821617245c9fa353daf38e1192bd51d98f78fd2eb1fa66a02db1e0d4c3ef6faf02b0572d36040e554bab3be6d339bdc8ba8629cc3a6d0911ec48e86

Download Submit
C:\Windows\SysWOW64\Dhjckcgi.exe

Filesize
386KB

MD5
0cc372213792f58bc77f3c6c74efd961

SHA1
b0560849ec781f1b6e049b78e65bb7d5d103cdf1

SHA256
296f286649e53b1b5233af2b14876b3fbf8b1a49aad158da6d259f61302e2510

SHA512
60ed83773e33601eb1922f941ab84854d158a3643490e54dbb2cf2c5a0d764ad2bd6528173d2a4e6747a1f5cf4aff5f4504b6b27d126b9727fe7dab85b232679

Download Submit
C:\Windows\SysWOW64\Dhocqigp.exe

Filesize
386KB

MD5
43da587d67be008e76a348f980bcc468

SHA1
d391360a6aa41dd575a045594745c0a47215ac5d

SHA256
e4a1804311c51b995b19dc3da6f5d6c85767e565f6f9a737730b3be9efc74696

SHA512
237f6ee06c282c074b1238c4a596d757af0a0dd18b5d22b318ded5f9511863f4a24e86762095c382871a79306f2382dbce2f17785980c13f22ef223b6265c8fe

Download Submit
C:\Windows\SysWOW64\Eaakpm32.exe

Filesize
386KB

MD5
4ea685562191f51d0b5c43de99717add

SHA1
878413c70d8c50be53e949e186eb236a5b0dabe0

SHA256
74bdcedfd3c0c0388038a8c6f7f6742964dac942c1e82fdf1f89bf794b1bb5ce

SHA512
dfa7043ca4db8f4d6458e9e168f1b698934b31694d847343e82c00aaad50fa5ccd498eee26e5db544e21a6e03b614a6b668a1e09f5587b91adab6693da170958

Download Submit
C:\Windows\SysWOW64\Emdajb32.exe

Filesize
386KB

MD5
f5bf070e3c7e6d4ba4f6fcc75d048ca7

SHA1
a09567b14e7a8f023303cd38565a718eea17fd48

SHA256
2d7cdcb247177f9963635e5d11d11caa0a96e7adbe074add8e19e93abce9e1a2

SHA512
841f27383b948112a39247c02e0d610c69582c70b952a69b40e42602cbc96119b3ef0aa230889562ed449afbb7b725e204f2ddb6381f8cc670888ff9b6770ca3

Download Submit
C:\Windows\SysWOW64\Fgbmccpg.exe

Filesize
386KB

MD5
98313aa8936e7e8a45d3d94bf5b05534

SHA1
10fa00dff2605669700436b01a99ffc2b0dd69a7

SHA256
7147342141991f44409b14505362209a2dcad433be96ec14d40db363147a5c20

SHA512
29f5e12169af2604eddec62510cb7874b67226206a0d92a4068711b9cacc8c844edb62a6085102414156a0edbe8a850b683eb37bd4d4b32d5457e67b8631d44c

Download Submit
C:\Windows\SysWOW64\Fineoi32.exe

Filesize
386KB

MD5
61ec327a2e8af431a4851e1f98522d3b

SHA1
66c7c219f9b85583e634d19a563987b222e90f40

SHA256
2af6861286dd9d275e21b397d991f3c0f4ec69a8c272dbe2bcaa1daa4724d1f7

SHA512
60441dd3e00ea19336c61bddc3a3a9618cbe524eac10983524234637770674a8cab6b6c6602fb3c797b130cc31f3998e16e3ea8dd20534be00bacb42b1a54a60

Download Submit
C:\Windows\SysWOW64\Hfnhlp32.dll

Filesize
7KB

MD5
0527a2ec92a538123708cbbd8e263a7e

SHA1
208109b74390485263d5084a6cc1070c500cd387

SHA256
356647554b7f145580d86331971a9530892e45a5722de8846535a32e246c725b

SHA512
d8ebf61939e3ffa010419ecceecae8cf1555e941494961af66d5dbf049eec037c9396f7d2235e227bce9f3870674a4dda77485034d3ebc145de34d5ac8b36111

Download Submit
C:\Windows\SysWOW64\Hgjljpkm.exe

Filesize
386KB

MD5
e275f67980a2d88e676a7fbecfcca2ce

SHA1
149f53d08eb6ba695c01ece9da49fa7bb8a93ea9

SHA256
b2dfd252c2ef49eca2714eab5cf972f12fceb7e2c8ac14d4b32e3286c1dfad16

SHA512
6e241aeaff610230b2160480076145768d3cc235071e30efd4a6568be3c9a403117432407476f058ded6b0bca7b111083dda4ceeb15bf738f25d4504fd2c6e98

Download Submit
C:\Windows\SysWOW64\Hnfamjqg.exe

Filesize
386KB

MD5
0a20b0aa76e5ab476abfd9e8968d6e9e

SHA1
daa9b31306a706b5037020189cc70937a5b2d8bc

SHA256
c07b7508474e8c2fd178d3ef190551d14fd5eb168a4ca3b2a160b31a527fe7de

SHA512
eca5c7516510e7d2f4e10bf139514c378a5efbe9b4599083f58a5bd20bae69142a8d5c40604a4194ae0ad04f18c03794840286462c28f1077884dccb77b84b45

Download Submit
C:\Windows\SysWOW64\Jbeidl32.exe

Filesize
386KB

MD5
b66d53dbe1a3b15287bdec0c31225508

SHA1
739f9f849d20b3b09352bc6b041dd0ccc6df6d07

SHA256
2188ccb5918fb7d58d00284f8db46b0b1e12022b11524d5deb026d3be0aa546d

SHA512
cc24512903c63bd80765d887eb0ba83448ad5e215555ef100c00310c4e65bfc53a05b8bcea51cd141cc33ed7b514f1b717abb6461f5344f9f38c85ebb973e8fc

Download Submit
C:\Windows\SysWOW64\Jcefno32.exe

Filesize
386KB

MD5
ba341153bd2ad2006707292df5763c88

SHA1
d79a7ce5c32c11921a962587b390b873a431374a

SHA256
6455a5b23bcf664b24f6fa45a116ee4acfe9bb2f5e55f73231ba3b8d96834383

SHA512
46431f128abe075a8021c5e3d7a4526b93188a19461e287748384772233da74c509ee6476a1e0d81c9e6024eac8f89f5b9d71ed82a3047ddbd686a4dbc7cc2a2

Download Submit
C:\Windows\SysWOW64\Jcgbco32.exe

Filesize
386KB

MD5
205b9ab218906eceea9620b9c3abb26b

SHA1
afce914f3a0cb30dee4f9487c22f9fca3a748738

SHA256
127812b18c2fef17b6427542f580fb9c94ac719ed839002ae5575c2ad6916d17

SHA512
106b83b65378f6b28bfe5aef8ff876251929a9178f40ddbdd145841ea76b3a0fffc7138e756d9d7b8706c6d7306b668d321c25b68b4f3cfcd032f833996f4bc2

Download Submit
C:\Windows\SysWOW64\Jcikgacl.exe

Filesize
386KB

MD5
e97d3c324ea6cf0fe1cceb8b371cbb77

SHA1
7cbb00a6e300a9a5d6667530288b6b1c5ac9fd8a

SHA256
b124965b80f6afc5df9962865cc05ffd8642af1cb3f5a343b903af758475e969

SHA512
028150943d121904b02f15de912fa4f5950dfef0d0ee0e6f72ac9168c0cd8d04528f02aa38f05934415c70b899a500a12ec5848cbf07eb5b9669f0ce86c92de3

Download Submit
C:\Windows\SysWOW64\Jefbfgig.exe

Filesize
386KB

MD5
958b3520fbd915d7a4d76d58e390b6f8

SHA1
e98f389685b32c15eb0a67067a01d19ea75eee35

SHA256
5109c024b6e1476f60b3b0efeb0e9dc4a31bf9fad0f6611b02e171b47e7bbcd8

SHA512
687bc8fbc6f9c63030200615501ddf363026b6eb1c3f296522a843f294f1a144db45ca9e4731a64be22781927d370d83c03c3e65ec061298f6f193159f3bbb9c

Download Submit
C:\Windows\SysWOW64\Jehokgge.exe

Filesize
386KB

MD5
97943490fd9c6a8b5b7753e732a70f32

SHA1
ac892b13a6fef49e0bcb0329c0ebdc12f555cce3

SHA256
750cbca3e9eaed3d3617a062b2dbcec9c1e4292dfeade3e7b937736fabbce965

SHA512
462c9c7899187669ecd68d34d1051e485b7e96803c03a4e562cdd64edd9662044f220d5ad7f083e2e6ac06a0f383fe2bba9707726b6a97fff6942634a1ed7714

Download Submit
C:\Windows\SysWOW64\Jifhaenk.exe

Filesize
386KB

MD5
1a89d5fb650ea9a07f4a9cf79124c929

SHA1
1fa5411af0b1d049785fd271ffa9753115436e8f

SHA256
fcef05a8515f03493ef7c75d1098c855c24289dbf2c9dd19dd958a5a66af9bbd

SHA512
6427214c9a0421acba9f60cb1fc8be5ba7719a23004b2ed0dc4d7e11faf5f4d3d22fb345ffa78463116d2796f117ecd9628116e8a45a26514b79a91b74dada7f

Download Submit
C:\Windows\SysWOW64\Jlbgha32.exe

Filesize
386KB

MD5
b3720530aa4403d6f3860cba64020444

SHA1
beae5277023b9c6a34c014bbbc42dad9848b3448

SHA256
9ad942664ec4f498ccc175ed453a36d9879a5b223fa4b19de9586f0b957bdc52

SHA512
77aff800fe596112f13af7f80a08b185c43c0b4c3946c13bc540092201095d06b355c3cd6b6d98d721e9fb46755434a1b14b8d624992f0afd48851f486f35c00

Download Submit
C:\Windows\SysWOW64\Jmknaell.exe

Filesize
386KB

MD5
a373616312889d2ae46f968065fb841f

SHA1
c23382f33a74fdd6648e1efec828f4a27d409daf

SHA256
a07852aefea80e29e31a617b4ba9b0133562ae71030c47de1f33845b5c18deec

SHA512
dd268fd97acd1b1385863d3e5a1fce9fb732e43d53f08e2b9de063c5e0ae0f98153844693671bbb3b0b920adfa5d9871040162eaf5f31d2b3405b0a80a3357ab

Download Submit
C:\Windows\SysWOW64\Jnmijq32.exe

Filesize
386KB

MD5
5a2412abc50c9010975d829c73aa16b8

SHA1
57c6b4bcf8a796974ec03ec2759a2e0dbdd4a536

SHA256
59a16fa3ebed7209929ee17893e7df8c19a6b10ad283a025c7ccd1a83d9a00ff

SHA512
41cc0d4a0cb8c4df66a9f11b773aa615720ee306cb6dc1a73fb9b6890afac5d260962addbc2fb8cc0f8742aea0a1b78863beabdc0a730cf27bec589778b8d7c0

Download Submit
C:\Windows\SysWOW64\Kfoafi32.exe

Filesize
386KB

MD5
c2dfb505967caf70a9d302bad0937f38

SHA1
c5898e98898bc0ebec0dfabed654d5dd7ac801fc

SHA256
f2877667934f3848ed57547c75861c1a0942b07f1529ebfe2ee375b907ace0cb

SHA512
018f65d725040564d197a319e23270595e34ce7c270e32af1eb9c3980fc3d2004b4f563dcef59faf101fecff60e8920cfc800c9492b2d83d7af66eedb066b2c6

Download Submit
C:\Windows\SysWOW64\Lcjcnoej.exe

Filesize
386KB

MD5
e88e4bac79e6f77bac21202745764e89

SHA1
e28f2826a4ed01c10324d64fd1492d51815a6aee

SHA256
ca4cf1e3cd5f2fd93ed3f81d9ed862d769e7e4b94c60fd82dc3257d27befdd9a

SHA512
ae15bf73fc23589d2d98e975e7209ccdce7de4a8e696c89141acb7a6ef006664e7d81a5756043e70bcd6c6711984cade3411949a04521f49e3cbe8bdd0e0485b

Download Submit
C:\Windows\SysWOW64\Leihbeib.exe

Filesize
386KB

MD5
2523a73cea381a73f8b3918b2339cf61

SHA1
76d1cd9cf2dcf0d32d4ecc17d9a5ebd21cfee2ff

SHA256
fc2fb162368ba57e30407ed1764ef958b600436819463f00d090814f4d82b807

SHA512
106ea9d2050d00f64937171e9b553c0f2ed8bf8ebd102fdb792931355f49f7fec5453ac76b4a72959c4b4d900c1fc4fcff1da95178f7b25eb3b846bd9c758725

Download Submit
C:\Windows\SysWOW64\Lfhdlh32.exe

Filesize
386KB

MD5
baf762c8176da03f4f5850569ff0aa35

SHA1
19ffae15ff800dbe460b8473cba35292b831a9b3

SHA256
9a657f887865b91c581c765cc60751b20fc222c1209c9641b06fdb361e574ac9

SHA512
c1b47efcd8fcbca725e8f98db873b901fb1bca72921b433b55ad9e48cb3bf24d57b84870faa98d1f2947a3c7010216b044d598f7a67dc5043b2dd5c914edc1be

Download Submit
C:\Windows\SysWOW64\Likjcbkc.exe

Filesize
386KB

MD5
95c27cdd0799d4a7345196a6c695866e

SHA1
33461b0d0a7313419593c46820ddd373051bf83a

SHA256
f4084ef3a1201903849cea8d38d18bde672e5b7efbfb2d6febfbf1678e376f03

SHA512
f021b8844f93e0df267f634d2172ef63ac179478553d1734afa13f05292441a82f9f5570f5733ac49927b7d846158b2ea210d213d9c3d5b5b28a5041eeeb8c34

Download Submit
C:\Windows\SysWOW64\Lmiciaaj.exe

Filesize
386KB

MD5
c92a7bae105657dacf6fa219f995d4ef

SHA1
e9d4f2d6ab9da46ddf05b46d4b36a81963a4ff4f

SHA256
a392d95542e22b31ff6429d44ce883e1a8bfed3220bc2e07251d6510f3438b49

SHA512
6afa8191ab09ee72242ed68887d76423b3802e735f60092687677fad7afc35aaf1ac5836f5efb47790af48f595abb42f6846965230931b82444176eaef5dc042

Download Submit
C:\Windows\SysWOW64\Mdckfk32.exe

Filesize
386KB

MD5
0d5e2c3fb5d4d5902c45cab75d799fc8

SHA1
92c6129e97f475dafa30b91ffba934d95be2988b

SHA256
a692436394117c02624a118233c931e3cb0e8ec16901126745d6222867442e5f

SHA512
58dc757269fe025f8186012c7de90dfbe1573c3bc295f0a9b1a5c0582c5b83467a352cae84184a030eed9df046c301c881c34b200afaffd87b2748f637f80922

Download Submit
C:\Windows\SysWOW64\Mgddhf32.exe

Filesize
386KB

MD5
d14bc131311f1b528fca28be2bae926c

SHA1
4a5792ce729df784ec27e579ea3c7015847537db

SHA256
3d27bd4ac666ab626900a9e7126ac19d20127f5f39d7af22f0f038846f79d60e

SHA512
729d439b423d1f74c20e1efd4b6cf19df343b59eb26edeea86fb13c217222cc29ec132194238aa376b28cc7ddf1e689a22c8b0db9f69a041211b9ba93a377591

Download Submit
C:\Windows\SysWOW64\Mgfqmfde.exe

Filesize
386KB

MD5
51e43c1ad64484c31caa962e19426dc1

SHA1
1c4e95c3559a3fb9ac66cefefdb42009d5105e86

SHA256
5019bbfe6910a6a387484995f0b138f418d2527ced105df6e292dd0d1532c0e9

SHA512
53e6de871263187f36c033fb91134bfd06917be300b8c89737f834d6db2b0a41adc895a0cbac3cb58010b96eeff0eb6a355d4197b2e6f28de329d0620eda1dc3

Download Submit
C:\Windows\SysWOW64\Migjoaaf.exe

Filesize
386KB

MD5
4cd2d301edbc27037ee087bdbf40fd18

SHA1
bc505216c08900cb472a37ce221524c3a1e34ca8

SHA256
066d5ae0f90d3780405bc6f24d4f37b44d83227824ab08e84f48a4d28323cde5

SHA512
2d90cbe1e50be3bcf4d879b8de5c14fb4a509c7973f9cec0c5fa215d3991baa79634054141302b35f9b8202916a67d0701a0480df613f8e3b2e06244a8bed2c0

Download Submit
C:\Windows\SysWOW64\Mngegmbc.exe

Filesize
386KB

MD5
4c50657e646c85e6641c06550577de26

SHA1
ccaaa4467a3306e68df6dbe0e04466549aa0541f

SHA256
92f86a780b97167d6c56916f02318a541478e39547658db3eb586608d853b31e

SHA512
e6cdc172e8a0ec50922c2f9f3e8fd9f045c2f133cb8294c01cb266272bd73bb595765b42060d1fb684391de52e7c153bc5b57b604842515b2338b17e758c62db

Download Submit
C:\Windows\SysWOW64\Nfjjppmm.exe

Filesize
386KB

MD5
8f03c03c470e55b9b7bb7cbd8948aa34

SHA1
9d807446c0e36f8f0f449f60fd6a957f35a73620

SHA256
2945e1ec1104a6365d8bc456d4086d6730dd46f2919afcb46f3eb6aec0c043de

SHA512
2a99bca3caa7c4d364da87dfd19364c51015fb27458e2611eefaaa7109bd8ce2f45ac05602bd1ceb57ae0ba4ac48e1c51b8eb348cd353ebd9ab20b6133c484cc

Download Submit
C:\Windows\SysWOW64\Ngdmod32.exe

Filesize
386KB

MD5
04f2d1f9ee45420907dac8f73e7b722d

SHA1
ca315c3e3b412cf92b1eae6e727b9c169ddc78e9

SHA256
399cda3602aa5c976fb21c2a2ccb73e96bb643001631a72bc9e5bb71de832741

SHA512
0000098c78c821acec08b6474078b00b0b09f2994897b5731748712ac2ee7c00bc7a169453ab2e90c0f7b77a44b7dd55c573a120ea2937610e284622d6268ab1

Download Submit
C:\Windows\SysWOW64\Nilcjp32.exe

Filesize
386KB

MD5
ae94518ad53cf1cdfab6ff5f2c8ec6fa

SHA1
e2b2ca5c0990d9b6ed5225a1dc51a45d587399d8

SHA256
0202206b647161ec6940991f9b8c3730dc96a1576950b79045ad342744488ad5

SHA512
9104853e9c99a276c80a0c26dc0250760485e22c265b041119117ec61ebdce3af78c3c17e392d5c15b089e26496eb89f1d471fe2ee83ba23833117ff621089be

Download Submit
C:\Windows\SysWOW64\Nlaegk32.exe

Filesize
386KB

MD5
a2ec82f344a54eada67988a699e4f7a7

SHA1
6362047e3adb7aa419d1eed9140a2f8bbef97515

SHA256
6bc594b71e2c5e7cffa01789223c2cabbad02b71e1f3ac5d53c712c081efe2fb

SHA512
9989f2af1f383d9fec1a16d9f8530a4cf4b057d697bee2ad135db2b71622b3378299515690eef405bf75dfec7fd6b4e1778da754b2a1d00c61ce5bda8fbcd487

Download Submit
C:\Windows\SysWOW64\Nphhmj32.exe

Filesize
386KB

MD5
2a53b93e9aa2da88d6e34f5dfaa6fbb9

SHA1
7b326198eba0f1c981e26353e70f8819d002697e

SHA256
f875ddf327cfda9d8cd25dd4533914f4ad447633e91bfacd8db5260436b91df2

SHA512
cba04f6cf436928ba4c90c358fcced1065e930d0b1b56d30620ea9aac2e56164e690a7417904d04312b45de96c3ecc38a09933597ce7108372cb0ff1192a1943

Download Submit
C:\Windows\SysWOW64\Ocdqjceo.exe

Filesize
386KB

MD5
a8dee3c046b27f0bce4db0ae9bdee0d2

SHA1
d9d5dd8c700d1b2f0f9f0d280095aa9a43af2ef3

SHA256
9de8eb76fad35f269a421fe3786d3b4b68c288688ff06a62c47c03b1c3cffe5a

SHA512
37c15e91998457d2ef4ada30fa165728eb603dea750eb541535ea3e8bdd4426c8e3072497610e9543c334a6a40f267a54139886e41c73b38bdca892357d7ef8a

Download Submit
C:\Windows\SysWOW64\Odocigqg.exe

Filesize
386KB

MD5
ed47c526ad6f9a82cda52063771eda76

SHA1
7452de75fcd495fa37e0d7bacf47a7eb192916f2

SHA256
b40d2a774fce5385d1f17288676d4cbbb4da4f40849bf060714cc4c896385338

SHA512
1b9dcb91a6c3a188cdaa251c8194e7818585f12e393f72ee7a5ff6b2c0f95aa981d9f63b8a759ffb28f58b60f255914594f223ae81ed3b7dcab101ca1b02e60f

Download Submit
C:\Windows\SysWOW64\Oflgep32.exe

Filesize
386KB

MD5
26c1db723c7cb1d2d6ffce4eb066fd81

SHA1
4c5439a6ebd7ace90a1c0c18dc3cbaf33a8b3c08

SHA256
c02217fd3851650d5ab73f1c63f834b9c88941fa191d49363dafe4060c951355

SHA512
3858d3723372865d7bfa5d54fe36c056b181e2bd899c590048272493be67f52d5979a7d394635a78c3796323888cbbf7f82c97e2830d8d2aa22c8871a6e842e6

Download Submit
C:\Windows\SysWOW64\Ogkcpbam.exe

Filesize
386KB

MD5
e0d602c54ef20369966f669874b8af99

SHA1
7286ba346504876e47a675be6095805772599009

SHA256
2678652d1cafada7f9721fcb74d75c4ecc7a69643d155ea4e3a6ebc63464cf42

SHA512
33e985c1f5b44ba468c92cee5c5ef55f34e3aefb950c637b94df9cdd0e23d1e1bea856c3f948f37fe3cab4ba391aca6fc766a720c8fb591c20a1649b18b4aa7b

Download Submit
C:\Windows\SysWOW64\Ognpebpj.exe

Filesize
386KB

MD5
ecde3ce887fca8e14a42f1f5caff6a49

SHA1
16cf30fef1e28b4192d623d16dfbf8bb8a87e31a

SHA256
6fcd951847a9023b7f1b51d7b54656806fb90b1781ae137cffd2b5af14df4049

SHA512
f5aeb7033de932aab841b631e3523c9c343b497e5c969c19c601bd5bfa6f80f238b595c1e1b7ec47f94c895015629313eb1bd5678e0994b8ee26acab4fb1eebb

Download Submit
C:\Windows\SysWOW64\Ojjolnaq.exe

Filesize
386KB

MD5
6bfad54669d37d280652fa2d511f452e

SHA1
e45b8f57e0acdb19eb6bb7bdb7da050211499a9e

SHA256
bba940d4807b65af7086cce9e89c6a5f3cb683b7425c700b3e4c5a7c491cb262

SHA512
2546737ae0c6b3be73bbfa2d2426066fb86bf7a04e102159695ba8222634690572ebd47a5d9431de52f0a1902975abcbf265d64ae09166c76186a84c112549b8

Download Submit
C:\Windows\SysWOW64\Olcbmj32.exe

Filesize
386KB

MD5
931552dece3080de78b5fd7d4faf8dd5

SHA1
4c81ef33aa0c62f24970c882b670281e4ac47c1b

SHA256
1ec6cd0b0e495a761f19e9cbb36b89c1ce6681a7470d3650feccc7c4d69da34f

SHA512
b2cb2d59828476ef8e3f25d59994d76b0d66cc6cab194fa7b8f9dc21daa85c0ff00acd205479f474fec834689a73f9a7517815da4ab14e0d37552bfbfcad8e8b

Download Submit
C:\Windows\SysWOW64\Olhlhjpd.exe

Filesize
386KB

MD5
d525d697c2941543b48a0436e54f7789

SHA1
e4b229de5381a2301028cd7afbf12004abbba16c

SHA256
3c0d6f648604ec28f00e75c97de804260daad217f78ca867e4a892b8158aefe9

SHA512
66bd1151e7508c322ee268d45ba186eebfdf5693feb1dcd60154754d9d9faf5f9edb6c111e0740caab37510c4f17d611c5cc0506651f1f1f093d5de0f4db8f1a

Download Submit
C:\Windows\SysWOW64\Onhhamgg.exe

Filesize
386KB

MD5
c2e25f0cf3deedf7a8d4d3fb59d563ef

SHA1
39f4fe3b401caee5eb0a38a42f14dc741582673e

SHA256
cf67dfb961af41a7dd73e3d6a6a1d2bf8b8fe6d3c3a325312cb720b175e431c9

SHA512
99b6cf0848a5f96804e02ec08469dbafe1fc774cba7af7577de5e3f047432ce53fff7a2e9668486951f359e4c941eb959145a949d66bc78f8ba51626fbe985fd

Download Submit
C:\Windows\SysWOW64\Oqfdnhfk.exe

Filesize
386KB

MD5
6d7598d07b2f910a6c8b121eb56e6d53

SHA1
4e848f2f6dd638ac1d9cc3cef186a9a83e2ac460

SHA256
0d28745f55ef7233a4efdd0d3c7ef6205a455a1c4a5307e66e79e6c5c5749934

SHA512
bb56f9a5e49bca2afe3a2e3d88020dfcff073c3ad8ba4ab41a2e107bca20dbe2cc8fccd10e50d3aa0610be4581d69f12e438d72f4b94037a6f6885efa876dcef

Download Submit
C:\Windows\SysWOW64\Poodpmca.exe

Filesize
64KB

MD5
5c38056157aa2866774bf116fce2f86c

SHA1
0788e0c49ada52cdd5881b2058c2f77677a4af1d

SHA256
911126dbfcfecfd895f9de907f15c108b19bf72d047b295518cf0535d5825a43

SHA512
232bdf2eb8ae2242f4320b84981b5fb2542456e6cf4bd5e6d7d6aebc693fc30a393e440a3d7672ac02a57ed41af0dd8261e651f65bf2163f4e42825ffc59b668

Download Submit
memory/252-479-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/684-135-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/700-335-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/784-377-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/800-443-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/832-317-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/880-389-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1080-310-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1092-315-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1128-365-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1132-119-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1136-112-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1160-413-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1164-59-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1188-473-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1196-407-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1372-320-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1412-401-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1560-327-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1672-319-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1696-143-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1780-383-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1784-497-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1788-328-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/1976-168-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2080-8-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2144-419-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2160-321-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2256-371-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2372-309-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2388-159-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2468-80-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2488-176-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2496-485-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2664-0-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2860-359-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/2996-449-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/3092-57-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/3140-184-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/3164-455-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/3348-192-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/3616-16-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/3640-96-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/3776-470-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/3780-395-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/3804-341-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/3812-60-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/3892-437-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/3896-64-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/3988-87-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/4072-318-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/4088-329-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/4208-425-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/4272-491-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/4292-104-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/4480-431-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/4532-461-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/4668-28-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/4692-71-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/4800-128-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/4884-353-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/4900-347-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/4904-63-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download
memory/4988-151-0x0000000000400000-0x0000000000487000-memory.dmp

Filesize
540KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads