aadd42265453e8fe480f2970f180a2aded08e2eee1b0488e4a57c8732e3bfa1e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aadd42265453e8fe480f2970f180a2aded08e2eee1b0488e4a57c8732e3bfa1e.exe
Size

59KB
MD5

38c7ed02066ff7debcd1ff348d24705c
SHA1

6a2c446ea4d85046158645b721c2e563a82dbca8
SHA256

aadd42265453e8fe480f2970f180a2aded08e2eee1b0488e4a57c8732e3bfa1e
SHA512

f6c986e0aaca696d3ac44eabe84c27567bcd4adff23e003cc9210fc8f3f5b9489b4f718631acbe9b297b77180b6be800aa585e6bc7cbbb863cf886413a7c0466
SSDEEP

768:9Y7tTAPpqQK7Cfd4aLo1Pgm+N5DlZ4WMfmLw6w1xOTDRfA0pYgB6A2p/1H52Xdno:1RFK+fdfLoZgJUWM3l1KhA8Yg6A2LmO

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gnpphljo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cbhbbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfokff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djpfbahm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Flgadake.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oplfkeob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Epffbd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdnjfojj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obfhmd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iohlcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Naaghoik.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfbfjk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhehkepj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kpjgaoqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aoioli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pciqnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ijgakgej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fflohaij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iajdgcab.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kidben32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bflham32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phbolflm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fligqhga.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cklhcfle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oifppdpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nfiagd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Idkpmgjo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dhpdkm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihbponja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmhijd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fcbnpnme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nonbqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icbbimih.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfbmgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ggccllai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcicjbal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pjdpelnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jeapcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ekqckmfb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbddobla.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oolnabal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ijdnka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcnfohmi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bmladm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mojopk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dibdeegc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjlmbnof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojomcopk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfncia32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggfobofl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjdknjep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Geklckkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cncnob32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apeknk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hqdkkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlgbon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dioiki32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jekjcaef.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjebiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Baegibae.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lafmjp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkcmjlio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aflpkpjm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aqdbfa32.exe

Executes dropped EXE 64 IoCs

pid	Process
4940	Eblimcdf.exe
4688	Fflohaij.exe
2568	Fligqhga.exe
4888	Fimhjl32.exe
3856	Fbelcblk.exe
3492	Fmkqpkla.exe
1272	Fmmmfj32.exe
4512	Gehbjm32.exe
1324	Gfhndpol.exe
4136	Glgcbf32.exe
4476	Gikdkj32.exe
4392	Gbchdp32.exe
5084	Glkmmefl.exe
1768	Hipmfjee.exe
728	Hfcnpn32.exe
2700	Hplbickp.exe
4472	Hpnoncim.exe
2256	Hifcgion.exe
3392	Hemdlj32.exe
2912	Hpchib32.exe
4944	Iohejo32.exe
2376	Ipgbdbqb.exe
4224	Imkbnf32.exe
3128	Iibccgep.exe
960	Ioolkncg.exe
2868	Jilfifme.exe
2864	Johnamkm.exe
496	Jllokajf.exe
1936	Kpjgaoqm.exe
2080	Knnhjcog.exe
4612	Kckqbj32.exe
3952	Keimof32.exe
4584	Kflide32.exe
4252	Kpanan32.exe
4924	Kjjbjd32.exe
3848	Kcbfcigf.exe
4304	Lpfgmnfp.exe
2248	Llmhaold.exe
3004	Lgbloglj.exe
3472	Lqkqhm32.exe
3008	Ljceqb32.exe
4640	Ljeafb32.exe
2012	Lcnfohmi.exe
1508	Mmfkhmdi.exe
332	Mfqlfb32.exe
3116	Mqimikfj.exe
2972	Mjcngpjh.exe
2100	Nopfpgip.exe
4936	Ncnofeof.exe
3440	Nqbpojnp.exe
660	Nfohgqlg.exe
2520	Nfaemp32.exe
3512	Ojomcopk.exe
4832	Oplfkeob.exe
5100	Onmfimga.exe
3404	Opnbae32.exe
1728	Ojdgnn32.exe
2604	Oclkgccf.exe
4008	Omdppiif.exe
2168	Ofmdio32.exe
3160	Ohlqcagj.exe
4908	Pnfiplog.exe
3140	Pccahbmn.exe
4572	Pjpfjl32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mhckcgpj.exe	Mbibfm32.exe
File created	C:\Windows\SysWOW64\Ibdplaho.exe	Ieqpbm32.exe
File opened for modification	C:\Windows\SysWOW64\Cmmgof32.exe	Cbhbbn32.exe
File created	C:\Windows\SysWOW64\Fbjieo32.dll	Bhhiemoj.exe
File created	C:\Windows\SysWOW64\Giljfddl.exe	Gngeik32.exe
File created	C:\Windows\SysWOW64\Ndnoffic.dll	Kbgfhnhi.exe
File created	C:\Windows\SysWOW64\Ebcdjc32.exe	Epehnhbj.exe
File created	C:\Windows\SysWOW64\Hpacoj32.dll	Pfncia32.exe
File created	C:\Windows\SysWOW64\Eocfgq32.dll	Icklhnop.exe
File opened for modification	C:\Windows\SysWOW64\Iqaiga32.exe	Ijgakgej.exe
File opened for modification	C:\Windows\SysWOW64\Hkjjfkcm.exe	Hkgnalep.exe
File created	C:\Windows\SysWOW64\Gehbjm32.exe	Fmmmfj32.exe
File created	C:\Windows\SysWOW64\Libmeq32.dll	Ganldgib.exe
File opened for modification	C:\Windows\SysWOW64\Dcffnbee.exe	Ccdihbgg.exe
File created	C:\Windows\SysWOW64\Djdpbope.dll	Elfhmc32.exe
File opened for modification	C:\Windows\SysWOW64\Kfbmgo32.exe	Kjlmbnof.exe
File opened for modification	C:\Windows\SysWOW64\Hfcnpn32.exe	Hipmfjee.exe
File created	C:\Windows\SysWOW64\Cklgfgfg.dll	Bkphhgfc.exe
File opened for modification	C:\Windows\SysWOW64\Ipgbdbqb.exe	Iohejo32.exe
File created	C:\Windows\SysWOW64\Elekoe32.dll	Bjfogbjb.exe
File opened for modification	C:\Windows\SysWOW64\Eelpqi32.exe	Ehhpge32.exe
File created	C:\Windows\SysWOW64\Apmhiq32.exe	Aoioli32.exe
File created	C:\Windows\SysWOW64\Cnokmj32.dll	Mhckcgpj.exe
File opened for modification	C:\Windows\SysWOW64\Lchfib32.exe	Ledepn32.exe
File created	C:\Windows\SysWOW64\Hoclajjj.dll	Afeban32.exe
File opened for modification	C:\Windows\SysWOW64\Dhphmj32.exe	Dafppp32.exe
File created	C:\Windows\SysWOW64\Omopjcjp.exe	Ookoaokf.exe
File created	C:\Windows\SysWOW64\Acicqigg.dll	Nkapelka.exe
File created	C:\Windows\SysWOW64\Debnjgcp.exe	Clijablo.exe
File created	C:\Windows\SysWOW64\Mdkabmjf.exe	Ldhdlnli.exe
File opened for modification	C:\Windows\SysWOW64\Ehhpge32.exe	Dalkek32.exe
File created	C:\Windows\SysWOW64\Aochpj32.dll	Kblkap32.exe
File opened for modification	C:\Windows\SysWOW64\Ilhkigcd.exe	Iencmm32.exe
File opened for modification	C:\Windows\SysWOW64\Flfbcndo.exe	Feljgd32.exe
File created	C:\Windows\SysWOW64\Eimelg32.exe	Ejkenpnp.exe
File opened for modification	C:\Windows\SysWOW64\Mlbllc32.exe	Midoph32.exe
File created	C:\Windows\SysWOW64\Enjgeopm.dll	Nqbpojnp.exe
File created	C:\Windows\SysWOW64\Cmmgof32.exe	Cbhbbn32.exe
File created	C:\Windows\SysWOW64\Kdbamc32.dll	Egmjpi32.exe
File opened for modification	C:\Windows\SysWOW64\Imfdaigj.exe	Idkpmgjo.exe
File created	C:\Windows\SysWOW64\Jncemmid.dll	Fplnogmb.exe
File created	C:\Windows\SysWOW64\Ahnljade.dll	Kcgekjgp.exe
File opened for modification	C:\Windows\SysWOW64\Bhbahm32.exe	Ajodef32.exe
File created	C:\Windows\SysWOW64\Nfnamjhk.exe	Nodiqp32.exe
File created	C:\Windows\SysWOW64\Hcljmj32.exe	Hbknebqi.exe
File created	C:\Windows\SysWOW64\Mkofokch.dll	Kjfmminc.exe
File opened for modification	C:\Windows\SysWOW64\Hkmlnimb.exe	Hebcao32.exe
File opened for modification	C:\Windows\SysWOW64\Bedbhi32.exe	Bcbeqaia.exe
File created	C:\Windows\SysWOW64\Ijblcb32.dll	Lagepl32.exe
File opened for modification	C:\Windows\SysWOW64\Onmfimga.exe	Oplfkeob.exe
File opened for modification	C:\Windows\SysWOW64\Nhhldc32.exe	Ndhgie32.exe
File created	C:\Windows\SysWOW64\Llngbabj.exe	Lbebilli.exe
File opened for modification	C:\Windows\SysWOW64\Gohapb32.exe	Fgmllpng.exe
File opened for modification	C:\Windows\SysWOW64\Mdjjgggk.exe	Midfjnge.exe
File opened for modification	C:\Windows\SysWOW64\Gkqhpmkg.exe	Gbecljnl.exe
File created	C:\Windows\SysWOW64\Fnbcgn32.exe	Edionhpn.exe
File created	C:\Windows\SysWOW64\Cadpqeqg.dll	Iencmm32.exe
File opened for modification	C:\Windows\SysWOW64\Dfqdid32.exe	Dhpdkm32.exe
File created	C:\Windows\SysWOW64\Egohdegl.exe	Enfckp32.exe
File created	C:\Windows\SysWOW64\Maeaajpl.exe	Mdaqhf32.exe
File created	C:\Windows\SysWOW64\Mmfkhmdi.exe	Lcnfohmi.exe
File opened for modification	C:\Windows\SysWOW64\Akdilipp.exe	Aonhghjl.exe
File created	C:\Windows\SysWOW64\Dgpamjnb.dll	Gijmad32.exe
File created	C:\Windows\SysWOW64\Lacijjgi.exe	Kblpcndd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
8664	8648	WerFault.exe	707

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ifenan32.dll"	Jllokajf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjamidgd.dll"	Qodeajbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fqeioiam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oamgcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaagdbfm.dll"	Omdppiif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbjieo32.dll"	Bhhiemoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aeffgkkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ohcoob32.dll"	Fhiinbdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhhiemoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjaonjaj.dll"	Enpfan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bdeiqgkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nfiagd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pbddobla.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fpckjlje.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnhjig32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhkfkmmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgimjd32.dll"	Gkcigjel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Balodg32.dll"	Mlemcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mqimikfj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djojepof.dll"	Fgiaemic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdmaoahm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lbebilli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bejobk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpjgaoqm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jaqcnl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hqkjaifk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iimcma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hfamlaff.dll"	Ibdplaho.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ppamjcpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jjakkmpk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pnjiffif.dll"	Iamamcop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hegmlnbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cemeoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mpolbbim.dll"	Nopfpgip.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggcogflc.dll"	Nhkpdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Epehnhbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjpfjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okhbek32.dll"	Cnaaib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghehjh32.dll"	Edionhpn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ppbjhj32.dll"	Epaemojk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eiopdhnf.dll"	Bghddp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgnomg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ganldgib.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjlcjf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nhffijdm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lagepl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbmdml32.dll"	Qpcecb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iencmm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bliajd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Obfhmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dgeenfog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iaejqcdo.dll"	Jidinqpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hpkdfd32.dll"	Ojemig32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Edoencdm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nmlhaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkccgodj.dll"	Fbelcblk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kajefoog.dll"	Pmhbqbae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fgqgfl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fclhpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mlgjhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chdialdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eclhcj32.dll"	Enlcahgh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bihhkm32.dll"	Nonbqd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpdefc32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 4940	3104	aadd42265453e8fe480f2970f180a2aded08e2eee1b0488e4a57c8732e3bfa1e.exe	90
PID 3104 wrote to memory of 4940	3104	aadd42265453e8fe480f2970f180a2aded08e2eee1b0488e4a57c8732e3bfa1e.exe	90
PID 3104 wrote to memory of 4940	3104	aadd42265453e8fe480f2970f180a2aded08e2eee1b0488e4a57c8732e3bfa1e.exe	90
PID 4940 wrote to memory of 4688	4940	Eblimcdf.exe	91
PID 4940 wrote to memory of 4688	4940	Eblimcdf.exe	91
PID 4940 wrote to memory of 4688	4940	Eblimcdf.exe	91
PID 4688 wrote to memory of 2568	4688	Fflohaij.exe	92
PID 4688 wrote to memory of 2568	4688	Fflohaij.exe	92
PID 4688 wrote to memory of 2568	4688	Fflohaij.exe	92
PID 2568 wrote to memory of 4888	2568	Fligqhga.exe	93
PID 2568 wrote to memory of 4888	2568	Fligqhga.exe	93
PID 2568 wrote to memory of 4888	2568	Fligqhga.exe	93
PID 4888 wrote to memory of 3856	4888	Fimhjl32.exe	94
PID 4888 wrote to memory of 3856	4888	Fimhjl32.exe	94
PID 4888 wrote to memory of 3856	4888	Fimhjl32.exe	94
PID 3856 wrote to memory of 3492	3856	Fbelcblk.exe	95
PID 3856 wrote to memory of 3492	3856	Fbelcblk.exe	95
PID 3856 wrote to memory of 3492	3856	Fbelcblk.exe	95
PID 3492 wrote to memory of 1272	3492	Fmkqpkla.exe	96
PID 3492 wrote to memory of 1272	3492	Fmkqpkla.exe	96
PID 3492 wrote to memory of 1272	3492	Fmkqpkla.exe	96
PID 1272 wrote to memory of 4512	1272	Fmmmfj32.exe	97
PID 1272 wrote to memory of 4512	1272	Fmmmfj32.exe	97
PID 1272 wrote to memory of 4512	1272	Fmmmfj32.exe	97
PID 4512 wrote to memory of 1324	4512	Gehbjm32.exe	98
PID 4512 wrote to memory of 1324	4512	Gehbjm32.exe	98
PID 4512 wrote to memory of 1324	4512	Gehbjm32.exe	98
PID 1324 wrote to memory of 4136	1324	Gfhndpol.exe	99
PID 1324 wrote to memory of 4136	1324	Gfhndpol.exe	99
PID 1324 wrote to memory of 4136	1324	Gfhndpol.exe	99
PID 4136 wrote to memory of 4476	4136	Glgcbf32.exe	100
PID 4136 wrote to memory of 4476	4136	Glgcbf32.exe	100
PID 4136 wrote to memory of 4476	4136	Glgcbf32.exe	100
PID 4476 wrote to memory of 4392	4476	Gikdkj32.exe	101
PID 4476 wrote to memory of 4392	4476	Gikdkj32.exe	101
PID 4476 wrote to memory of 4392	4476	Gikdkj32.exe	101
PID 4392 wrote to memory of 5084	4392	Gbchdp32.exe	102
PID 4392 wrote to memory of 5084	4392	Gbchdp32.exe	102
PID 4392 wrote to memory of 5084	4392	Gbchdp32.exe	102
PID 5084 wrote to memory of 1768	5084	Glkmmefl.exe	103
PID 5084 wrote to memory of 1768	5084	Glkmmefl.exe	103
PID 5084 wrote to memory of 1768	5084	Glkmmefl.exe	103
PID 1768 wrote to memory of 728	1768	Hipmfjee.exe	104
PID 1768 wrote to memory of 728	1768	Hipmfjee.exe	104
PID 1768 wrote to memory of 728	1768	Hipmfjee.exe	104
PID 728 wrote to memory of 2700	728	Hfcnpn32.exe	105
PID 728 wrote to memory of 2700	728	Hfcnpn32.exe	105
PID 728 wrote to memory of 2700	728	Hfcnpn32.exe	105
PID 2700 wrote to memory of 4472	2700	Hplbickp.exe	106
PID 2700 wrote to memory of 4472	2700	Hplbickp.exe	106
PID 2700 wrote to memory of 4472	2700	Hplbickp.exe	106
PID 4472 wrote to memory of 2256	4472	Hpnoncim.exe	107
PID 4472 wrote to memory of 2256	4472	Hpnoncim.exe	107
PID 4472 wrote to memory of 2256	4472	Hpnoncim.exe	107
PID 2256 wrote to memory of 3392	2256	Hifcgion.exe	108
PID 2256 wrote to memory of 3392	2256	Hifcgion.exe	108
PID 2256 wrote to memory of 3392	2256	Hifcgion.exe	108
PID 3392 wrote to memory of 2912	3392	Hemdlj32.exe	109
PID 3392 wrote to memory of 2912	3392	Hemdlj32.exe	109
PID 3392 wrote to memory of 2912	3392	Hemdlj32.exe	109
PID 2912 wrote to memory of 4944	2912	Hpchib32.exe	110
PID 2912 wrote to memory of 4944	2912	Hpchib32.exe	110
PID 2912 wrote to memory of 4944	2912	Hpchib32.exe	110
PID 4944 wrote to memory of 2376	4944	Iohejo32.exe	111

C:\Users\Admin\AppData\Local\Temp\aadd42265453e8fe480f2970f180a2aded08e2eee1b0488e4a57c8732e3bfa1e.exe
"C:\Users\Admin\AppData\Local\Temp\aadd42265453e8fe480f2970f180a2aded08e2eee1b0488e4a57c8732e3bfa1e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Windows\SysWOW64\Eblimcdf.exe
  C:\Windows\system32\Eblimcdf.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\SysWOW64\Fflohaij.exe
    C:\Windows\system32\Fflohaij.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4688
  - - C:\Windows\SysWOW64\Fligqhga.exe
      C:\Windows\system32\Fligqhga.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2568
    - - C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4888
      - C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3856
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3492
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1272
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1324
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4136
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4476
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4392
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5084
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1768
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:728
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2700
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4472
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3392
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        23⤵
        Executes dropped EXE
        
        PID:2376
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        24⤵
        Executes dropped EXE
        
        PID:4224
        
        C:\Windows\SysWOW64\Iibccgep.exe
        
        C:\Windows\system32\Iibccgep.exe
        25⤵
        Executes dropped EXE
        
        PID:3128
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        26⤵
        Executes dropped EXE
        
        PID:960
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        27⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        28⤵
        Executes dropped EXE
        
        PID:2868
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        29⤵
        Executes dropped EXE
        
        PID:2864
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:496
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1936
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        32⤵
        Executes dropped EXE
        
        PID:2080
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        33⤵
        Executes dropped EXE
        
        PID:4612
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        34⤵
        Executes dropped EXE
        
        PID:3952
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        35⤵
        Executes dropped EXE
        
        PID:4584
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        36⤵
        Executes dropped EXE
        
        PID:4252
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        37⤵
        Executes dropped EXE
        
        PID:4924
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        38⤵
        Executes dropped EXE
        
        PID:3848
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        39⤵
        Executes dropped EXE
        
        PID:4304
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        40⤵
        Executes dropped EXE
        
        PID:2248
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        41⤵
        Executes dropped EXE
        
        PID:3004
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        42⤵
        Executes dropped EXE
        
        PID:3472
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        43⤵
        Executes dropped EXE
        
        PID:3008
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        44⤵
        Executes dropped EXE
        
        PID:4640
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2012
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        46⤵
        Executes dropped EXE
        
        PID:1508
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        47⤵
        Executes dropped EXE
        
        PID:332
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3116
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        49⤵
        Executes dropped EXE
        
        PID:2972
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        50⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2100
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        51⤵
        Executes dropped EXE
        
        PID:4936
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3440
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        53⤵
        Executes dropped EXE
        
        PID:660
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        54⤵
        Executes dropped EXE
        
        PID:2520
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3512
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4832
        
        C:\Windows\SysWOW64\Onmfimga.exe
        
        C:\Windows\system32\Onmfimga.exe
        57⤵
        Executes dropped EXE
        
        PID:5100
        
        C:\Windows\SysWOW64\Opnbae32.exe
        
        C:\Windows\system32\Opnbae32.exe
        58⤵
        Executes dropped EXE
        
        PID:3404
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        59⤵
        Executes dropped EXE
        
        PID:1728
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        60⤵
        Executes dropped EXE
        
        PID:2604
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4008
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        62⤵
        Executes dropped EXE
        
        PID:2168
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        63⤵
        Executes dropped EXE
        
        PID:3160
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        64⤵
        Executes dropped EXE
        
        PID:4908
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        65⤵
        Executes dropped EXE
        
        PID:3140
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        66⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4572
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3508
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        68⤵
        
        PID:408
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        69⤵
        
        PID:440
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        70⤵
        Modifies registry class
        
        PID:4812
        
        C:\Windows\SysWOW64\Qodeajbg.exe
        
        C:\Windows\system32\Qodeajbg.exe
        71⤵
        Modifies registry class
        
        PID:656
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1576
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        73⤵
        
        PID:4952
        
        C:\Windows\SysWOW64\Aonhghjl.exe
        
        C:\Windows\system32\Aonhghjl.exe
        74⤵
        Drops file in System32 directory
        
        PID:3252
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        75⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        76⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4412
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        77⤵
        Modifies registry class
        
        PID:1136
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        78⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        79⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5244
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        81⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        82⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        83⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        84⤵
        Drops file in System32 directory
        
        PID:5432
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        85⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        86⤵
        Modifies registry class
        
        PID:5548
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        87⤵
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        88⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5712
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        90⤵
        Modifies registry class
        
        PID:5760
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        91⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5852
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        93⤵
        Drops file in System32 directory
        
        PID:5892
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        94⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        95⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        96⤵
        Modifies registry class
        
        PID:6032
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        97⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Dndgfpbo.exe
        
        C:\Windows\system32\Dndgfpbo.exe
        98⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        99⤵
        Drops file in System32 directory
        
        PID:5160
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        100⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        101⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        102⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        103⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        104⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        105⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        106⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        107⤵
        Modifies registry class
        
        PID:5788
        
        C:\Windows\SysWOW64\Edionhpn.exe
        
        C:\Windows\system32\Edionhpn.exe
        108⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5872
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        109⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Fkfcqb32.exe
        
        C:\Windows\system32\Fkfcqb32.exe
        110⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        111⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        112⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        113⤵
        Modifies registry class
        
        PID:5272
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        114⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        115⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        116⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        117⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        118⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6112
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        120⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5252
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        121⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        122⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        123⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        124⤵
        Drops file in System32 directory
        
        PID:5144
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        125⤵
        Drops file in System32 directory
        
        PID:5408
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        126⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        127⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        128⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        129⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        130⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        131⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        132⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        133⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        134⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        135⤵
        Modifies registry class
        
        PID:6256
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        136⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        137⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        138⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6380
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6428
        
        C:\Windows\SysWOW64\Ilphdlqh.exe
        
        C:\Windows\system32\Ilphdlqh.exe
        140⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        141⤵
        Modifies registry class
        
        PID:6520
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        142⤵
        Modifies registry class
        
        PID:6568
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6612
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        144⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6696
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        146⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        147⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        148⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        149⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        150⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6984
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        152⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        153⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        154⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        155⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Kiikpnmj.exe
        
        C:\Windows\system32\Kiikpnmj.exe
        156⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        157⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        158⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Lafmjp32.exe
        
        C:\Windows\system32\Lafmjp32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6376
        
        C:\Windows\SysWOW64\Ledepn32.exe
        
        C:\Windows\system32\Ledepn32.exe
        160⤵
        Drops file in System32 directory
        
        PID:6472
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        161⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        162⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        163⤵
        
        PID:6740
        
        C:\Windows\SysWOW64\Mpapnfhg.exe
        
        C:\Windows\system32\Mpapnfhg.exe
        164⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        165⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        166⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        167⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        168⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        169⤵
        Drops file in System32 directory
        
        PID:6240
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        170⤵
        Drops file in System32 directory
        
        PID:6368
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        171⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Nmaciefp.exe
        
        C:\Windows\system32\Nmaciefp.exe
        172⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        173⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        174⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        175⤵
        Drops file in System32 directory
        
        PID:2924
        
        C:\Windows\SysWOW64\Nfnamjhk.exe
        
        C:\Windows\system32\Nfnamjhk.exe
        176⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6220
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        178⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        179⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Ookoaokf.exe
        
        C:\Windows\system32\Ookoaokf.exe
        180⤵
        Drops file in System32 directory
        
        PID:6832
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        181⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        182⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6560
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        184⤵
        Modifies registry class
        
        PID:3836
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        185⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        186⤵
        Modifies registry class
        
        PID:6316
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        187⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        188⤵
        Modifies registry class
        
        PID:6684
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        189⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        190⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        191⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7264
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        193⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Qapnmopa.exe
        
        C:\Windows\system32\Qapnmopa.exe
        194⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Qcnjijoe.exe
        
        C:\Windows\system32\Qcnjijoe.exe
        195⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Apeknk32.exe
        
        C:\Windows\system32\Apeknk32.exe
        196⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7440
        
        C:\Windows\SysWOW64\Amikgpcc.exe
        
        C:\Windows\system32\Amikgpcc.exe
        197⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Ajmladbl.exe
        
        C:\Windows\system32\Ajmladbl.exe
        198⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Abhqefpg.exe
        
        C:\Windows\system32\Abhqefpg.exe
        199⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Amnebo32.exe
        
        C:\Windows\system32\Amnebo32.exe
        200⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Abjmkf32.exe
        
        C:\Windows\system32\Abjmkf32.exe
        201⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Ampaho32.exe
        
        C:\Windows\system32\Ampaho32.exe
        202⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Bigbmpco.exe
        
        C:\Windows\system32\Bigbmpco.exe
        203⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Bjfogbjb.exe
        
        C:\Windows\system32\Bjfogbjb.exe
        204⤵
        Drops file in System32 directory
        
        PID:7784
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        205⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Biklho32.exe
        
        C:\Windows\system32\Biklho32.exe
        206⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        207⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Bkkhbb32.exe
        
        C:\Windows\system32\Bkkhbb32.exe
        208⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Baepolni.exe
        
        C:\Windows\system32\Baepolni.exe
        209⤵
        
        PID:7980
        
        C:\Windows\SysWOW64\Bdcmkgmm.exe
        
        C:\Windows\system32\Bdcmkgmm.exe
        210⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Bmladm32.exe
        
        C:\Windows\system32\Bmladm32.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8072
        
        C:\Windows\SysWOW64\Bdeiqgkj.exe
        
        C:\Windows\system32\Bdeiqgkj.exe
        212⤵
        Modifies registry class
        
        PID:8116
        
        C:\Windows\SysWOW64\Cibain32.exe
        
        C:\Windows\system32\Cibain32.exe
        213⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Cpljehpo.exe
        
        C:\Windows\system32\Cpljehpo.exe
        214⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        215⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Cienon32.exe
        
        C:\Windows\system32\Cienon32.exe
        216⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Cdmoafdb.exe
        
        C:\Windows\system32\Cdmoafdb.exe
        217⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Ccdihbgg.exe
        
        C:\Windows\system32\Ccdihbgg.exe
        218⤵
        Drops file in System32 directory
        
        PID:7456
        
        C:\Windows\SysWOW64\Dcffnbee.exe
        
        C:\Windows\system32\Dcffnbee.exe
        219⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Dnljkk32.exe
        
        C:\Windows\system32\Dnljkk32.exe
        220⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Dgdncplk.exe
        
        C:\Windows\system32\Dgdncplk.exe
        221⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Dajbaika.exe
        
        C:\Windows\system32\Dajbaika.exe
        222⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Ejjaqk32.exe
        
        C:\Windows\system32\Ejjaqk32.exe
        223⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Edoencdm.exe
        
        C:\Windows\system32\Edoencdm.exe
        224⤵
        Modifies registry class
        
        PID:7856
        
        C:\Windows\SysWOW64\Ejlnfjbd.exe
        
        C:\Windows\system32\Ejlnfjbd.exe
        225⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Epffbd32.exe
        
        C:\Windows\system32\Epffbd32.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8012
        
        C:\Windows\SysWOW64\Eddnic32.exe
        
        C:\Windows\system32\Eddnic32.exe
        227⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Enlcahgh.exe
        
        C:\Windows\system32\Enlcahgh.exe
        228⤵
        Modifies registry class
        
        PID:8144
        
        C:\Windows\SysWOW64\Ekqckmfb.exe
        
        C:\Windows\system32\Ekqckmfb.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6536
        
        C:\Windows\SysWOW64\Eajlhg32.exe
        
        C:\Windows\system32\Eajlhg32.exe
        230⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Fclhpo32.exe
        
        C:\Windows\system32\Fclhpo32.exe
        231⤵
        Modifies registry class
        
        PID:2396
        
        C:\Windows\SysWOW64\Fjeplijj.exe
        
        C:\Windows\system32\Fjeplijj.exe
        232⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Fqphic32.exe
        
        C:\Windows\system32\Fqphic32.exe
        233⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Fgiaemic.exe
        
        C:\Windows\system32\Fgiaemic.exe
        234⤵
        Modifies registry class
        
        PID:7656
        
        C:\Windows\SysWOW64\Fdmaoahm.exe
        
        C:\Windows\system32\Fdmaoahm.exe
        235⤵
        Modifies registry class
        
        PID:7820
        
        C:\Windows\SysWOW64\Fjjjgh32.exe
        
        C:\Windows\system32\Fjjjgh32.exe
        236⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Fcbnpnme.exe
        
        C:\Windows\system32\Fcbnpnme.exe
        237⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8064
        
        C:\Windows\SysWOW64\Fnhbmgmk.exe
        
        C:\Windows\system32\Fnhbmgmk.exe
        238⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Fgqgfl32.exe
        
        C:\Windows\system32\Fgqgfl32.exe
        239⤵
        Modifies registry class
        
        PID:7248
        
        C:\Windows\SysWOW64\Fqikob32.exe
        
        C:\Windows\system32\Fqikob32.exe
        240⤵
        
        PID:264
        
        C:\Windows\SysWOW64\Ggccllai.exe
        
        C:\Windows\system32\Ggccllai.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7708
        
        C:\Windows\SysWOW64\Gbhhieao.exe
        
        C:\Windows\system32\Gbhhieao.exe
        242⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Gcjdam32.exe
        
        C:\Windows\system32\Gcjdam32.exe
        243⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Gjcmngnj.exe
        
        C:\Windows\system32\Gjcmngnj.exe
        244⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Gkcigjel.exe
        
        C:\Windows\system32\Gkcigjel.exe
        245⤵
        Modifies registry class
        
        PID:2964
        
        C:\Windows\SysWOW64\Gcnnllcg.exe
        
        C:\Windows\system32\Gcnnllcg.exe
        246⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Gdnjfojj.exe
        
        C:\Windows\system32\Gdnjfojj.exe
        247⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7976
        
        C:\Windows\SysWOW64\Gnfooe32.exe
        
        C:\Windows\system32\Gnfooe32.exe
        248⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Hqdkkp32.exe
        
        C:\Windows\system32\Hqdkkp32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7776
        
        C:\Windows\SysWOW64\Hnhkdd32.exe
        
        C:\Windows\system32\Hnhkdd32.exe
        250⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Hebcao32.exe
        
        C:\Windows\system32\Hebcao32.exe
        251⤵
        Drops file in System32 directory
        
        PID:7780
        
        C:\Windows\SysWOW64\Hkmlnimb.exe
        
        C:\Windows\system32\Hkmlnimb.exe
        252⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Heepfn32.exe
        
        C:\Windows\system32\Heepfn32.exe
        253⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Hjaioe32.exe
        
        C:\Windows\system32\Hjaioe32.exe
        254⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Hegmlnbp.exe
        
        C:\Windows\system32\Hegmlnbp.exe
        255⤵
        Modifies registry class
        
        PID:8248
        
        C:\Windows\SysWOW64\Hjdedepg.exe
        
        C:\Windows\system32\Hjdedepg.exe
        256⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Hbknebqi.exe
        
        C:\Windows\system32\Hbknebqi.exe
        257⤵
        Drops file in System32 directory
        
        PID:8344
        
        C:\Windows\SysWOW64\Hcljmj32.exe
        
        C:\Windows\system32\Hcljmj32.exe
        258⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Hjfbjdnd.exe
        
        C:\Windows\system32\Hjfbjdnd.exe
        259⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Iapjgo32.exe
        
        C:\Windows\system32\Iapjgo32.exe
        260⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Igjbci32.exe
        
        C:\Windows\system32\Igjbci32.exe
        261⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Indkpcdk.exe
        
        C:\Windows\system32\Indkpcdk.exe
        262⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Iencmm32.exe
        
        C:\Windows\system32\Iencmm32.exe
        263⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8596
        
        C:\Windows\SysWOW64\Ilhkigcd.exe
        
        C:\Windows\system32\Ilhkigcd.exe
        264⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Ieqpbm32.exe
        
        C:\Windows\system32\Ieqpbm32.exe
        265⤵
        Drops file in System32 directory
        
        PID:8684
        
        C:\Windows\SysWOW64\Ibdplaho.exe
        
        C:\Windows\system32\Ibdplaho.exe
        266⤵
        Modifies registry class
        
        PID:8732
        
        C:\Windows\SysWOW64\Iecmhlhb.exe
        
        C:\Windows\system32\Iecmhlhb.exe
        267⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Ihaidhgf.exe
        
        C:\Windows\system32\Ihaidhgf.exe
        268⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Inkaqb32.exe
        
        C:\Windows\system32\Inkaqb32.exe
        269⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Ieeimlep.exe
        
        C:\Windows\system32\Ieeimlep.exe
        270⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Jnnnfalp.exe
        
        C:\Windows\system32\Jnnnfalp.exe
        271⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Jhfbog32.exe
        
        C:\Windows\system32\Jhfbog32.exe
        272⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Jblflp32.exe
        
        C:\Windows\system32\Jblflp32.exe
        273⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Jdmcdhhe.exe
        
        C:\Windows\system32\Jdmcdhhe.exe
        274⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Jjgkab32.exe
        
        C:\Windows\system32\Jjgkab32.exe
        275⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Jaqcnl32.exe
        
        C:\Windows\system32\Jaqcnl32.exe
        276⤵
        Modifies registry class
        
        PID:9160
        
        C:\Windows\SysWOW64\Jhkljfok.exe
        
        C:\Windows\system32\Jhkljfok.exe
        277⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Jeolckne.exe
        
        C:\Windows\system32\Jeolckne.exe
        278⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Jlidpe32.exe
        
        C:\Windows\system32\Jlidpe32.exe
        279⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Kbeibo32.exe
        
        C:\Windows\system32\Kbeibo32.exe
        280⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Kbgfhnhi.exe
        
        C:\Windows\system32\Kbgfhnhi.exe
        281⤵
        Drops file in System32 directory
        
        PID:8456
        
        C:\Windows\SysWOW64\Kdhbpf32.exe
        
        C:\Windows\system32\Kdhbpf32.exe
        282⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Kbjbnnfg.exe
        
        C:\Windows\system32\Kbjbnnfg.exe
        283⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Kdkoef32.exe
        
        C:\Windows\system32\Kdkoef32.exe
        284⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Kblpcndd.exe
        
        C:\Windows\system32\Kblpcndd.exe
        285⤵
        Drops file in System32 directory
        
        PID:8728
        
        C:\Windows\SysWOW64\Lacijjgi.exe
        
        C:\Windows\system32\Lacijjgi.exe
        286⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Lklnconj.exe
        
        C:\Windows\system32\Lklnconj.exe
        287⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Lddble32.exe
        
        C:\Windows\system32\Lddble32.exe
        288⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Lbebilli.exe
        
        C:\Windows\system32\Lbebilli.exe
        289⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9000
        
        C:\Windows\SysWOW64\Llngbabj.exe
        
        C:\Windows\system32\Llngbabj.exe
        290⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Mlbpma32.exe
        
        C:\Windows\system32\Mlbpma32.exe
        291⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Maoifh32.exe
        
        C:\Windows\system32\Maoifh32.exe
        292⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Mlemcq32.exe
        
        C:\Windows\system32\Mlemcq32.exe
        293⤵
        Modifies registry class
        
        PID:8272
        
        C:\Windows\SysWOW64\Mlgjhp32.exe
        
        C:\Windows\system32\Mlgjhp32.exe
        294⤵
        Modifies registry class
        
        PID:8332
        
        C:\Windows\SysWOW64\Mcabej32.exe
        
        C:\Windows\system32\Mcabej32.exe
        295⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Mhnjna32.exe
        
        C:\Windows\system32\Mhnjna32.exe
        296⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Mhpgca32.exe
        
        C:\Windows\system32\Mhpgca32.exe
        297⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Mojopk32.exe
        
        C:\Windows\system32\Mojopk32.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8764
        
        C:\Windows\SysWOW64\Nkapelka.exe
        
        C:\Windows\system32\Nkapelka.exe
        299⤵
        Drops file in System32 directory
        
        PID:8892
        
        C:\Windows\SysWOW64\Ndidna32.exe
        
        C:\Windows\system32\Ndidna32.exe
        300⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Nkcmjlio.exe
        
        C:\Windows\system32\Nkcmjlio.exe
        301⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9064
        
        C:\Windows\SysWOW64\Nfiagd32.exe
        
        C:\Windows\system32\Nfiagd32.exe
        302⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9188
        
        C:\Windows\SysWOW64\Nlcidopb.exe
        
        C:\Windows\system32\Nlcidopb.exe
        303⤵
        
        PID:8304
        
        C:\Windows\SysWOW64\Ndnnianm.exe
        
        C:\Windows\system32\Ndnnianm.exe
        304⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Nbbnbemf.exe
        
        C:\Windows\system32\Nbbnbemf.exe
        305⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Nlgbon32.exe
        
        C:\Windows\system32\Nlgbon32.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8848
        
        C:\Windows\SysWOW64\Okmpqjad.exe
        
        C:\Windows\system32\Okmpqjad.exe
        307⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Obfhmd32.exe
        
        C:\Windows\system32\Obfhmd32.exe
        308⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9168
        
        C:\Windows\SysWOW64\Ollljmhg.exe
        
        C:\Windows\system32\Ollljmhg.exe
        309⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Ochamg32.exe
        
        C:\Windows\system32\Ochamg32.exe
        310⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Odjmdocp.exe
        
        C:\Windows\system32\Odjmdocp.exe
        311⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Oooaah32.exe
        
        C:\Windows\system32\Oooaah32.exe
        312⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Ofijnbkb.exe
        
        C:\Windows\system32\Ofijnbkb.exe
        313⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Omcbkl32.exe
        
        C:\Windows\system32\Omcbkl32.exe
        314⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Oflfdbip.exe
        
        C:\Windows\system32\Oflfdbip.exe
        315⤵
        
        PID:320
        
        C:\Windows\SysWOW64\Pcpgmf32.exe
        
        C:\Windows\system32\Pcpgmf32.exe
        316⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\Pfncia32.exe
        
        C:\Windows\system32\Pfncia32.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9236
        
        C:\Windows\SysWOW64\Pbddobla.exe
        
        C:\Windows\system32\Pbddobla.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9272
        
        C:\Windows\SysWOW64\Pmjhlklg.exe
        
        C:\Windows\system32\Pmjhlklg.exe
        319⤵
        
        PID:9320
        
        C:\Windows\SysWOW64\Peempn32.exe
        
        C:\Windows\system32\Peempn32.exe
        320⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Pkoemhao.exe
        
        C:\Windows\system32\Pkoemhao.exe
        321⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Pfeijqqe.exe
        
        C:\Windows\system32\Pfeijqqe.exe
        322⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Pkabbgol.exe
        
        C:\Windows\system32\Pkabbgol.exe
        323⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Qfgfpp32.exe
        
        C:\Windows\system32\Qfgfpp32.exe
        324⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Qmanljfo.exe
        
        C:\Windows\system32\Qmanljfo.exe
        325⤵
        
        PID:9580
        
        C:\Windows\SysWOW64\Qppkhfec.exe
        
        C:\Windows\system32\Qppkhfec.exe
        326⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Qelcamcj.exe
        
        C:\Windows\system32\Qelcamcj.exe
        327⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Qpbgnecp.exe
        
        C:\Windows\system32\Qpbgnecp.exe
        328⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Aflpkpjm.exe
        
        C:\Windows\system32\Aflpkpjm.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9760
        
        C:\Windows\SysWOW64\Amfhgj32.exe
        
        C:\Windows\system32\Amfhgj32.exe
        330⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Acppddig.exe
        
        C:\Windows\system32\Acppddig.exe
        331⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Abemep32.exe
        
        C:\Windows\system32\Abemep32.exe
        332⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Amkabind.exe
        
        C:\Windows\system32\Amkabind.exe
        333⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Aeffgkkp.exe
        
        C:\Windows\system32\Aeffgkkp.exe
        334⤵
        Modifies registry class
        
        PID:9980
        
        C:\Windows\SysWOW64\Alpnde32.exe
        
        C:\Windows\system32\Alpnde32.exe
        335⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Afeban32.exe
        
        C:\Windows\system32\Afeban32.exe
        336⤵
        Drops file in System32 directory
        
        PID:10060
        
        C:\Windows\SysWOW64\Amoknh32.exe
        
        C:\Windows\system32\Amoknh32.exe
        337⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Bcicjbal.exe
        
        C:\Windows\system32\Bcicjbal.exe
        338⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10136
        
        C:\Windows\SysWOW64\Bejobk32.exe
        
        C:\Windows\system32\Bejobk32.exe
        339⤵
        Modifies registry class
        
        PID:10180
        
        C:\Windows\SysWOW64\Bppcpc32.exe
        
        C:\Windows\system32\Bppcpc32.exe
        340⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Bfjllnnm.exe
        
        C:\Windows\system32\Bfjllnnm.exe
        341⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Blgddd32.exe
        
        C:\Windows\system32\Blgddd32.exe
        342⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Bflham32.exe
        
        C:\Windows\system32\Bflham32.exe
        343⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9372
        
        C:\Windows\SysWOW64\Bliajd32.exe
        
        C:\Windows\system32\Bliajd32.exe
        344⤵
        Modifies registry class
        
        PID:9392
        
        C:\Windows\SysWOW64\Beaecjab.exe
        
        C:\Windows\system32\Beaecjab.exe
        345⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Bcbeqaia.exe
        
        C:\Windows\system32\Bcbeqaia.exe
        346⤵
        Drops file in System32 directory
        
        PID:9568
        
        C:\Windows\SysWOW64\Bedbhi32.exe
        
        C:\Windows\system32\Bedbhi32.exe
        347⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Blnjecfl.exe
        
        C:\Windows\system32\Blnjecfl.exe
        348⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Cbhbbn32.exe
        
        C:\Windows\system32\Cbhbbn32.exe
        349⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9756
        
        C:\Windows\SysWOW64\Cmmgof32.exe
        
        C:\Windows\system32\Cmmgof32.exe
        350⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Cbjogmlf.exe
        
        C:\Windows\system32\Cbjogmlf.exe
        351⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Cpqlfa32.exe
        
        C:\Windows\system32\Cpqlfa32.exe
        352⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Cemeoh32.exe
        
        C:\Windows\system32\Cemeoh32.exe
        353⤵
        Modifies registry class
        
        PID:10048
        
        C:\Windows\SysWOW64\Cmdmpe32.exe
        
        C:\Windows\system32\Cmdmpe32.exe
        354⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Clijablo.exe
        
        C:\Windows\system32\Clijablo.exe
        355⤵
        Drops file in System32 directory
        
        PID:10208
        
        C:\Windows\SysWOW64\Debnjgcp.exe
        
        C:\Windows\system32\Debnjgcp.exe
        356⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Dlncla32.exe
        
        C:\Windows\system32\Dlncla32.exe
        357⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Dibdeegc.exe
        
        C:\Windows\system32\Dibdeegc.exe
        358⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9436
        
        C:\Windows\SysWOW64\Dgfdojfm.exe
        
        C:\Windows\system32\Dgfdojfm.exe
        359⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Epaemojk.exe
        
        C:\Windows\system32\Epaemojk.exe
        360⤵
        Modifies registry class
        
        PID:9684
        
        C:\Windows\SysWOW64\Epcbbohh.exe
        
        C:\Windows\system32\Epcbbohh.exe
        361⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Egmjpi32.exe
        
        C:\Windows\system32\Egmjpi32.exe
        362⤵
        Drops file in System32 directory
        
        PID:9916
        
        C:\Windows\SysWOW64\Eljchpnl.exe
        
        C:\Windows\system32\Eljchpnl.exe
        363⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Edfddl32.exe
        
        C:\Windows\system32\Edfddl32.exe
        364⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Flaiho32.exe
        
        C:\Windows\system32\Flaiho32.exe
        365⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Fckaeioa.exe
        
        C:\Windows\system32\Fckaeioa.exe
        366⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Fnqebaog.exe
        
        C:\Windows\system32\Fnqebaog.exe
        367⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Feljgd32.exe
        
        C:\Windows\system32\Feljgd32.exe
        368⤵
        Drops file in System32 directory
        
        PID:9968
        
        C:\Windows\SysWOW64\Flfbcndo.exe
        
        C:\Windows\system32\Flfbcndo.exe
        369⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Fpckjlje.exe
        
        C:\Windows\system32\Fpckjlje.exe
        370⤵
        Modifies registry class
        
        PID:8868
        
        C:\Windows\SysWOW64\Fgncff32.exe
        
        C:\Windows\system32\Fgncff32.exe
        371⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Fjlpbb32.exe
        
        C:\Windows\system32\Fjlpbb32.exe
        372⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Fcddkggf.exe
        
        C:\Windows\system32\Fcddkggf.exe
        373⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Gcgqag32.exe
        
        C:\Windows\system32\Gcgqag32.exe
        374⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Ggdigekj.exe
        
        C:\Windows\system32\Ggdigekj.exe
        375⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Gjebiq32.exe
        
        C:\Windows\system32\Gjebiq32.exe
        376⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9636
        
        C:\Windows\SysWOW64\Gdkffi32.exe
        
        C:\Windows\system32\Gdkffi32.exe
        377⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Hfnpca32.exe
        
        C:\Windows\system32\Hfnpca32.exe
        378⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\Hcbpme32.exe
        
        C:\Windows\system32\Hcbpme32.exe
        379⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\Hfamia32.exe
        
        C:\Windows\system32\Hfamia32.exe
        380⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Hmkeekag.exe
        
        C:\Windows\system32\Hmkeekag.exe
        381⤵
        
        PID:3308
        
        C:\Windows\SysWOW64\Hcgjhega.exe
        
        C:\Windows\system32\Hcgjhega.exe
        382⤵
        
        PID:2528
        
        C:\Windows\SysWOW64\Hqkjaifk.exe
        
        C:\Windows\system32\Hqkjaifk.exe
        383⤵
        Modifies registry class
        
        PID:1660
        
        C:\Windows\SysWOW64\Hgebnc32.exe
        
        C:\Windows\system32\Hgebnc32.exe
        384⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Hdicggla.exe
        
        C:\Windows\system32\Hdicggla.exe
        385⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\Idkpmgjo.exe
        
        C:\Windows\system32\Idkpmgjo.exe
        386⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4476
        
        C:\Windows\SysWOW64\Imfdaigj.exe
        
        C:\Windows\system32\Imfdaigj.exe
        387⤵
        
        PID:4380
        
        C:\Windows\SysWOW64\Icciccmd.exe
        
        C:\Windows\system32\Icciccmd.exe
        388⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\Ijmapm32.exe
        
        C:\Windows\system32\Ijmapm32.exe
        389⤵
        
        PID:3844
        
        C:\Windows\SysWOW64\Igqbiacj.exe
        
        C:\Windows\system32\Igqbiacj.exe
        390⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\Icgbob32.exe
        
        C:\Windows\system32\Icgbob32.exe
        391⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\Jjakkmpk.exe
        
        C:\Windows\system32\Jjakkmpk.exe
        392⤵
        Modifies registry class
        
        PID:2804
        
        C:\Windows\SysWOW64\Jcjodbgl.exe
        
        C:\Windows\system32\Jcjodbgl.exe
        393⤵
        
        PID:3668
        
        C:\Windows\SysWOW64\Jeneidji.exe
        
        C:\Windows\system32\Jeneidji.exe
        394⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\Jfoaam32.exe
        
        C:\Windows\system32\Jfoaam32.exe
        395⤵
        
        PID:3632
        
        C:\Windows\SysWOW64\Jmijnfgd.exe
        
        C:\Windows\system32\Jmijnfgd.exe
        396⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\Kccbjq32.exe
        
        C:\Windows\system32\Kccbjq32.exe
        397⤵
        
        PID:452
        
        C:\Windows\SysWOW64\Kmlgcf32.exe
        
        C:\Windows\system32\Kmlgcf32.exe
        398⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Kceoppmo.exe
        
        C:\Windows\system32\Kceoppmo.exe
        399⤵
        
        PID:1700
        
        C:\Windows\SysWOW64\Kmncif32.exe
        
        C:\Windows\system32\Kmncif32.exe
        400⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\Kffhakjp.exe
        
        C:\Windows\system32\Kffhakjp.exe
        401⤵
        
        PID:3148
        
        C:\Windows\SysWOW64\Kmppneal.exe
        
        C:\Windows\system32\Kmppneal.exe
        402⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\Keghocao.exe
        
        C:\Windows\system32\Keghocao.exe
        403⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\Kfidgk32.exe
        
        C:\Windows\system32\Kfidgk32.exe
        404⤵
        
        PID:1128
        
        C:\Windows\SysWOW64\Kjfmminc.exe
        
        C:\Windows\system32\Kjfmminc.exe
        405⤵
        Drops file in System32 directory
        
        PID:3128
        
        C:\Windows\SysWOW64\Kaqejcep.exe
        
        C:\Windows\system32\Kaqejcep.exe
        406⤵
        
        PID:1800
        
        C:\Windows\SysWOW64\Ljijci32.exe
        
        C:\Windows\system32\Ljijci32.exe
        407⤵
        
        PID:2484
        
        C:\Windows\SysWOW64\Lhmjlm32.exe
        
        C:\Windows\system32\Lhmjlm32.exe
        408⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\Lmjcdd32.exe
        
        C:\Windows\system32\Lmjcdd32.exe
        409⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\Lkppchfi.exe
        
        C:\Windows\system32\Lkppchfi.exe
        410⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\Ldhdlnli.exe
        
        C:\Windows\system32\Ldhdlnli.exe
        411⤵
        Drops file in System32 directory
        
        PID:4684
        
        C:\Windows\SysWOW64\Mdkabmjf.exe
        
        C:\Windows\system32\Mdkabmjf.exe
        412⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\Mkdiog32.exe
        
        C:\Windows\system32\Mkdiog32.exe
        413⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\Mdmngm32.exe
        
        C:\Windows\system32\Mdmngm32.exe
        414⤵
        
        PID:4924
        
        C:\Windows\SysWOW64\Mdokmm32.exe
        
        C:\Windows\system32\Mdokmm32.exe
        415⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Mkicjgnn.exe
        
        C:\Windows\system32\Mkicjgnn.exe
        416⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\Mackfa32.exe
        
        C:\Windows\system32\Mackfa32.exe
        417⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\Mdagbl32.exe
        
        C:\Windows\system32\Mdagbl32.exe
        418⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\Mgbpdgap.exe
        
        C:\Windows\system32\Mgbpdgap.exe
        419⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\Nmlhaa32.exe
        
        C:\Windows\system32\Nmlhaa32.exe
        420⤵
        Modifies registry class
        
        PID:3168
        
        C:\Windows\SysWOW64\Ndfanlpi.exe
        
        C:\Windows\system32\Ndfanlpi.exe
        421⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\Nnoefagj.exe
        
        C:\Windows\system32\Nnoefagj.exe
        422⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\Nhdicjfp.exe
        
        C:\Windows\system32\Nhdicjfp.exe
        423⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\Nonbqd32.exe
        
        C:\Windows\system32\Nonbqd32.exe
        424⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5096
        
        C:\Windows\SysWOW64\Nhffijdm.exe
        
        C:\Windows\system32\Nhffijdm.exe
        425⤵
        Modifies registry class
        
        PID:1804
        
        C:\Windows\SysWOW64\Nncoaq32.exe
        
        C:\Windows\system32\Nncoaq32.exe
        426⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\Naaghoik.exe
        
        C:\Windows\system32\Naaghoik.exe
        427⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3696
        
        C:\Windows\SysWOW64\Nhkpdi32.exe
        
        C:\Windows\system32\Nhkpdi32.exe
        428⤵
        Modifies registry class
        
        PID:1508
        
        C:\Windows\SysWOW64\Oeopnmoa.exe
        
        C:\Windows\system32\Oeopnmoa.exe
        429⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\Onjebpml.exe
        
        C:\Windows\system32\Onjebpml.exe
        430⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\Oojalb32.exe
        
        C:\Windows\system32\Oojalb32.exe
        431⤵
        
        PID:648
        
        C:\Windows\SysWOW64\Ohbfeh32.exe
        
        C:\Windows\system32\Ohbfeh32.exe
        432⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\Oolnabal.exe
        
        C:\Windows\system32\Oolnabal.exe
        433⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2100
        
        C:\Windows\SysWOW64\Oeffnl32.exe
        
        C:\Windows\system32\Oeffnl32.exe
        434⤵
        
        PID:5008
        
        C:\Windows\SysWOW64\Oamgcm32.exe
        
        C:\Windows\system32\Oamgcm32.exe
        435⤵
        Modifies registry class
        
        PID:2972
        
        C:\Windows\SysWOW64\Pndhhnda.exe
        
        C:\Windows\system32\Pndhhnda.exe
        436⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\Pnfdnnbo.exe
        
        C:\Windows\system32\Pnfdnnbo.exe
        437⤵
        
        PID:660
        
        C:\Windows\SysWOW64\Pohnnqgo.exe
        
        C:\Windows\system32\Pohnnqgo.exe
        438⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\Pfbfjk32.exe
        
        C:\Windows\system32\Pfbfjk32.exe
        439⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:316
        
        C:\Windows\SysWOW64\Pkonbamc.exe
        
        C:\Windows\system32\Pkonbamc.exe
        440⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\Phbolflm.exe
        
        C:\Windows\system32\Phbolflm.exe
        441⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4808
        
        C:\Windows\SysWOW64\Qnpgdmjd.exe
        
        C:\Windows\system32\Qnpgdmjd.exe
        442⤵
        
        PID:756
        
        C:\Windows\SysWOW64\Qdipag32.exe
        
        C:\Windows\system32\Qdipag32.exe
        443⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\Qkchna32.exe
        
        C:\Windows\system32\Qkchna32.exe
        444⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\Qbmpjkqk.exe
        
        C:\Windows\system32\Qbmpjkqk.exe
        445⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\Aoapcood.exe
        
        C:\Windows\system32\Aoapcood.exe
        446⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\Afkipi32.exe
        
        C:\Windows\system32\Afkipi32.exe
        447⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\Adqeaf32.exe
        
        C:\Windows\system32\Adqeaf32.exe
        448⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\Aeglbeea.exe
        
        C:\Windows\system32\Aeglbeea.exe
        449⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Bomppneg.exe
        
        C:\Windows\system32\Bomppneg.exe
        450⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\Bghddp32.exe
        
        C:\Windows\system32\Bghddp32.exe
        451⤵
        Modifies registry class
        
        PID:4916
        
        C:\Windows\SysWOW64\Bgkaip32.exe
        
        C:\Windows\system32\Bgkaip32.exe
        452⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\Bpdfpmoo.exe
        
        C:\Windows\system32\Bpdfpmoo.exe
        453⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Becknc32.exe
        
        C:\Windows\system32\Becknc32.exe
        454⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Cfbhhfbg.exe
        
        C:\Windows\system32\Cfbhhfbg.exe
        455⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Cfedmfqd.exe
        
        C:\Windows\system32\Cfedmfqd.exe
        456⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\Cnpibh32.exe
        
        C:\Windows\system32\Cnpibh32.exe
        457⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\Cnbfgh32.exe
        
        C:\Windows\system32\Cnbfgh32.exe
        458⤵
        
        PID:1576
        
        C:\Windows\SysWOW64\Cpbbak32.exe
        
        C:\Windows\system32\Cpbbak32.exe
        459⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Dbckcf32.exe
        
        C:\Windows\system32\Dbckcf32.exe
        460⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Dhpdkm32.exe
        
        C:\Windows\system32\Dhpdkm32.exe
        461⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:976
        
        C:\Windows\SysWOW64\Dfqdid32.exe
        
        C:\Windows\system32\Dfqdid32.exe
        462⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Dhbqalle.exe
        
        C:\Windows\system32\Dhbqalle.exe
        463⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Dfcqod32.exe
        
        C:\Windows\system32\Dfcqod32.exe
        464⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Donecfao.exe
        
        C:\Windows\system32\Donecfao.exe
        465⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Doqbifpl.exe
        
        C:\Windows\system32\Doqbifpl.exe
        466⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Eldbbjof.exe
        
        C:\Windows\system32\Eldbbjof.exe
        467⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Eoekde32.exe
        
        C:\Windows\system32\Eoekde32.exe
        468⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Epehnhbj.exe
        
        C:\Windows\system32\Epehnhbj.exe
        469⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5756
        
        C:\Windows\SysWOW64\Ebcdjc32.exe
        
        C:\Windows\system32\Ebcdjc32.exe
        470⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Epgdch32.exe
        
        C:\Windows\system32\Epgdch32.exe
        471⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Fplnogmb.exe
        
        C:\Windows\system32\Fplnogmb.exe
        472⤵
        Drops file in System32 directory
        
        PID:3516
        
        C:\Windows\SysWOW64\Flboch32.exe
        
        C:\Windows\system32\Flboch32.exe
        473⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Fcmgpbjc.exe
        
        C:\Windows\system32\Fcmgpbjc.exe
        474⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Fiilblom.exe
        
        C:\Windows\system32\Fiilblom.exe
        475⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Fgmllpng.exe
        
        C:\Windows\system32\Fgmllpng.exe
        476⤵
        Drops file in System32 directory
        
        PID:6008
        
        C:\Windows\SysWOW64\Gohapb32.exe
        
        C:\Windows\system32\Gohapb32.exe
        477⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Ghqeihbb.exe
        
        C:\Windows\system32\Ghqeihbb.exe
        478⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Glnnofhi.exe
        
        C:\Windows\system32\Glnnofhi.exe
        479⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Gegchl32.exe
        
        C:\Windows\system32\Gegchl32.exe
        480⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Gheodg32.exe
        
        C:\Windows\system32\Gheodg32.exe
        481⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Ggfobofl.exe
        
        C:\Windows\system32\Ggfobofl.exe
        482⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4744
        
        C:\Windows\SysWOW64\Gjdknjep.exe
        
        C:\Windows\system32\Gjdknjep.exe
        483⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6032
        
        C:\Windows\SysWOW64\Goadfa32.exe
        
        C:\Windows\system32\Goadfa32.exe
        484⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Geklckkd.exe
        
        C:\Windows\system32\Geklckkd.exe
        485⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3220
        
        C:\Windows\SysWOW64\Hfniikha.exe
        
        C:\Windows\system32\Hfniikha.exe
        486⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Hlhaee32.exe
        
        C:\Windows\system32\Hlhaee32.exe
        487⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Hjlaoioh.exe
        
        C:\Windows\system32\Hjlaoioh.exe
        488⤵
        
        PID:876
        
        C:\Windows\SysWOW64\Hohjgpmo.exe
        
        C:\Windows\system32\Hohjgpmo.exe
        489⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Hhaope32.exe
        
        C:\Windows\system32\Hhaope32.exe
        490⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Hfeoijbi.exe
        
        C:\Windows\system32\Hfeoijbi.exe
        491⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Hqjcgbbo.exe
        
        C:\Windows\system32\Hqjcgbbo.exe
        492⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Hhehkepj.exe
        
        C:\Windows\system32\Hhehkepj.exe
        493⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5484
        
        C:\Windows\SysWOW64\Icklhnop.exe
        
        C:\Windows\system32\Icklhnop.exe
        494⤵
        Drops file in System32 directory
        
        PID:5420
        
        C:\Windows\SysWOW64\Ihheqd32.exe
        
        C:\Windows\system32\Ihheqd32.exe
        495⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Iobmmoed.exe
        
        C:\Windows\system32\Iobmmoed.exe
        496⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Ijgakgej.exe
        
        C:\Windows\system32\Ijgakgej.exe
        497⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5900
        
        C:\Windows\SysWOW64\Iqaiga32.exe
        
        C:\Windows\system32\Iqaiga32.exe
        498⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Igkadlcd.exe
        
        C:\Windows\system32\Igkadlcd.exe
        499⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Imhjlb32.exe
        
        C:\Windows\system32\Imhjlb32.exe
        500⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\Icbbimih.exe
        
        C:\Windows\system32\Icbbimih.exe
        501⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6028
        
        C:\Windows\SysWOW64\Ioicnn32.exe
        
        C:\Windows\system32\Ioicnn32.exe
        502⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Jokpcmmj.exe
        
        C:\Windows\system32\Jokpcmmj.exe
        503⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Jjcqffkm.exe
        
        C:\Windows\system32\Jjcqffkm.exe
        504⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\Jikjmbmb.exe
        
        C:\Windows\system32\Jikjmbmb.exe
        505⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Jfokff32.exe
        
        C:\Windows\system32\Jfokff32.exe
        506⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5784
        
        C:\Windows\SysWOW64\Kmhccpci.exe
        
        C:\Windows\system32\Kmhccpci.exe
        507⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Kiaqnagj.exe
        
        C:\Windows\system32\Kiaqnagj.exe
        508⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Kcgekjgp.exe
        
        C:\Windows\system32\Kcgekjgp.exe
        509⤵
        Drops file in System32 directory
        
        PID:5464
        
        C:\Windows\SysWOW64\Kclnfi32.exe
        
        C:\Windows\system32\Kclnfi32.exe
        510⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Lcnkli32.exe
        
        C:\Windows\system32\Lcnkli32.exe
        511⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Lpelqj32.exe
        
        C:\Windows\system32\Lpelqj32.exe
        512⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Lpghfi32.exe
        
        C:\Windows\system32\Lpghfi32.exe
        513⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Lagepl32.exe
        
        C:\Windows\system32\Lagepl32.exe
        514⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6232
        
        C:\Windows\SysWOW64\Lmneemaq.exe
        
        C:\Windows\system32\Lmneemaq.exe
        515⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Lhcjbfag.exe
        
        C:\Windows\system32\Lhcjbfag.exe
        516⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Midfjnge.exe
        
        C:\Windows\system32\Midfjnge.exe
        517⤵
        Drops file in System32 directory
        
        PID:6000
        
        C:\Windows\SysWOW64\Mdjjgggk.exe
        
        C:\Windows\system32\Mdjjgggk.exe
        518⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Migcpneb.exe
        
        C:\Windows\system32\Migcpneb.exe
        519⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Mdlgmgdh.exe
        
        C:\Windows\system32\Mdlgmgdh.exe
        520⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Miipencp.exe
        
        C:\Windows\system32\Miipencp.exe
        521⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Mapgfk32.exe
        
        C:\Windows\system32\Mapgfk32.exe
        522⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Mabdlk32.exe
        
        C:\Windows\system32\Mabdlk32.exe
        523⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Mdaqhf32.exe
        
        C:\Windows\system32\Mdaqhf32.exe
        524⤵
        Drops file in System32 directory
        
        PID:6652
        
        C:\Windows\SysWOW64\Maeaajpl.exe
        
        C:\Windows\system32\Maeaajpl.exe
        525⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Njmejp32.exe
        
        C:\Windows\system32\Njmejp32.exe
        526⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Npjnbg32.exe
        
        C:\Windows\system32\Npjnbg32.exe
        527⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Ndhgie32.exe
        
        C:\Windows\system32\Ndhgie32.exe
        528⤵
        Drops file in System32 directory
        
        PID:6436
        
        C:\Windows\SysWOW64\Nhhldc32.exe
        
        C:\Windows\system32\Nhhldc32.exe
        529⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Oknnanhj.exe
        
        C:\Windows\system32\Oknnanhj.exe
        530⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Oickbjmb.exe
        
        C:\Windows\system32\Oickbjmb.exe
        531⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Oiehhjjp.exe
        
        C:\Windows\system32\Oiehhjjp.exe
        532⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Pkedbmab.exe
        
        C:\Windows\system32\Pkedbmab.exe
        533⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Ppamjcpj.exe
        
        C:\Windows\system32\Ppamjcpj.exe
        534⤵
        Modifies registry class
        
        PID:6892
        
        C:\Windows\SysWOW64\Pnhjig32.exe
        
        C:\Windows\system32\Pnhjig32.exe
        535⤵
        Modifies registry class
        
        PID:6688
        
        C:\Windows\SysWOW64\Pnjgog32.exe
        
        C:\Windows\system32\Pnjgog32.exe
        536⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Pddokabk.exe
        
        C:\Windows\system32\Pddokabk.exe
        537⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Pknghk32.exe
        
        C:\Windows\system32\Pknghk32.exe
        538⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Qggebl32.exe
        
        C:\Windows\system32\Qggebl32.exe
        539⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Ajhndgjj.exe
        
        C:\Windows\system32\Ajhndgjj.exe
        540⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Aqdbfa32.exe
        
        C:\Windows\system32\Aqdbfa32.exe
        541⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6800
        
        C:\Windows\SysWOW64\Ajodef32.exe
        
        C:\Windows\system32\Ajodef32.exe
        542⤵
        Drops file in System32 directory
        
        PID:3408
        
        C:\Windows\SysWOW64\Bhbahm32.exe
        
        C:\Windows\system32\Bhbahm32.exe
        543⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Bkcjjhgp.exe
        
        C:\Windows\system32\Bkcjjhgp.exe
        544⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Bhgjcmfi.exe
        
        C:\Windows\system32\Bhgjcmfi.exe
        545⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Bqbohocd.exe
        
        C:\Windows\system32\Bqbohocd.exe
        546⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Bnfoac32.exe
        
        C:\Windows\system32\Bnfoac32.exe
        547⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Cqghcn32.exe
        
        C:\Windows\system32\Cqghcn32.exe
        548⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Cgcmeh32.exe
        
        C:\Windows\system32\Cgcmeh32.exe
        549⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Cjdfgc32.exe
        
        C:\Windows\system32\Cjdfgc32.exe
        550⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Ckfofe32.exe
        
        C:\Windows\system32\Ckfofe32.exe
        551⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Dendok32.exe
        
        C:\Windows\system32\Dendok32.exe
        552⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Dgomaf32.exe
        
        C:\Windows\system32\Dgomaf32.exe
        553⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Dioiki32.exe
        
        C:\Windows\system32\Dioiki32.exe
        554⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7344
        
        C:\Windows\SysWOW64\Djpfbahm.exe
        
        C:\Windows\system32\Djpfbahm.exe
        555⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7444
        
        C:\Windows\SysWOW64\Dalkek32.exe
        
        C:\Windows\system32\Dalkek32.exe
        556⤵
        Drops file in System32 directory
        
        PID:6968
        
        C:\Windows\SysWOW64\Ehhpge32.exe
        
        C:\Windows\system32\Ehhpge32.exe
        557⤵
        Drops file in System32 directory
        
        PID:7960
        
        C:\Windows\SysWOW64\Eelpqi32.exe
        
        C:\Windows\system32\Eelpqi32.exe
        558⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Elfhmc32.exe
        
        C:\Windows\system32\Elfhmc32.exe
        559⤵
        Drops file in System32 directory
        
        PID:6944
        
        C:\Windows\SysWOW64\Eacaej32.exe
        
        C:\Windows\system32\Eacaej32.exe
        560⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Ejkenpnp.exe
        
        C:\Windows\system32\Ejkenpnp.exe
        561⤵
        Drops file in System32 directory
        
        PID:7116
        
        C:\Windows\SysWOW64\Eimelg32.exe
        
        C:\Windows\system32\Eimelg32.exe
        562⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Eahjqicj.exe
        
        C:\Windows\system32\Eahjqicj.exe
        563⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Fbggkl32.exe
        
        C:\Windows\system32\Fbggkl32.exe
        564⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Fkbkoo32.exe
        
        C:\Windows\system32\Fkbkoo32.exe
        565⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Fhflhcfa.exe
        
        C:\Windows\system32\Fhflhcfa.exe
        566⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Faopah32.exe
        
        C:\Windows\system32\Faopah32.exe
        567⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Fhiinbdo.exe
        
        C:\Windows\system32\Fhiinbdo.exe
        568⤵
        Modifies registry class
        
        PID:6740
        
        C:\Windows\SysWOW64\Flgadake.exe
        
        C:\Windows\system32\Flgadake.exe
        569⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3636
        
        C:\Windows\SysWOW64\Geabbfoc.exe
        
        C:\Windows\system32\Geabbfoc.exe
        570⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Gbecljnl.exe
        
        C:\Windows\system32\Gbecljnl.exe
        571⤵
        Drops file in System32 directory
        
        PID:7400
        
        C:\Windows\SysWOW64\Gkqhpmkg.exe
        
        C:\Windows\system32\Gkqhpmkg.exe
        572⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Gooqfkan.exe
        
        C:\Windows\system32\Gooqfkan.exe
        573⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Ghgeoq32.exe
        
        C:\Windows\system32\Ghgeoq32.exe
        574⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Hkgnalep.exe
        
        C:\Windows\system32\Hkgnalep.exe
        575⤵
        Drops file in System32 directory
        
        PID:6656
        
        C:\Windows\SysWOW64\Hkjjfkcm.exe
        
        C:\Windows\system32\Hkjjfkcm.exe
        576⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Hadcce32.exe
        
        C:\Windows\system32\Hadcce32.exe
        577⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Hligqnjp.exe
        
        C:\Windows\system32\Hligqnjp.exe
        578⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Hafpiehg.exe
        
        C:\Windows\system32\Hafpiehg.exe
        579⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Hahlnefd.exe
        
        C:\Windows\system32\Hahlnefd.exe
        580⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Hkaqgjme.exe
        
        C:\Windows\system32\Hkaqgjme.exe
        581⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Iefedcmk.exe
        
        C:\Windows\system32\Iefedcmk.exe
        582⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Ijdnka32.exe
        
        C:\Windows\system32\Ijdnka32.exe
        583⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7216
        
        C:\Windows\SysWOW64\Ijigfaol.exe
        
        C:\Windows\system32\Ijigfaol.exe
        584⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Iofpnhmc.exe
        
        C:\Windows\system32\Iofpnhmc.exe
        585⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Iohlcg32.exe
        
        C:\Windows\system32\Iohlcg32.exe
        586⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6840
        
        C:\Windows\SysWOW64\Jjnqap32.exe
        
        C:\Windows\system32\Jjnqap32.exe
        587⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Jkomhhae.exe
        
        C:\Windows\system32\Jkomhhae.exe
        588⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Jhcmbm32.exe
        
        C:\Windows\system32\Jhcmbm32.exe
        589⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Jbnopbdl.exe
        
        C:\Windows\system32\Jbnopbdl.exe
        590⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Jkhpogij.exe
        
        C:\Windows\system32\Jkhpogij.exe
        591⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Kjipmoai.exe
        
        C:\Windows\system32\Kjipmoai.exe
        592⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Kjlmbnof.exe
        
        C:\Windows\system32\Kjlmbnof.exe
        593⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7956
        
        C:\Windows\SysWOW64\Kfbmgo32.exe
        
        C:\Windows\system32\Kfbmgo32.exe
        594⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7272
        
        C:\Windows\SysWOW64\Kcfnqccd.exe
        
        C:\Windows\system32\Kcfnqccd.exe
        595⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Kjqfmn32.exe
        
        C:\Windows\system32\Kjqfmn32.exe
        596⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Kblkap32.exe
        
        C:\Windows\system32\Kblkap32.exe
        597⤵
        Drops file in System32 directory
        
        PID:8448
        
        C:\Windows\SysWOW64\Kmaooihb.exe
        
        C:\Windows\system32\Kmaooihb.exe
        598⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Lckglc32.exe
        
        C:\Windows\system32\Lckglc32.exe
        599⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Lmcldhfp.exe
        
        C:\Windows\system32\Lmcldhfp.exe
        600⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Lcndab32.exe
        
        C:\Windows\system32\Lcndab32.exe
        601⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Lpdefc32.exe
        
        C:\Windows\system32\Lpdefc32.exe
        602⤵
        Modifies registry class
        
        PID:8220
        
        C:\Windows\SysWOW64\Limioiia.exe
        
        C:\Windows\system32\Limioiia.exe
        603⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Lkkekdhe.exe
        
        C:\Windows\system32\Lkkekdhe.exe
        604⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Lbenho32.exe
        
        C:\Windows\system32\Lbenho32.exe
        605⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Lpinac32.exe
        
        C:\Windows\system32\Lpinac32.exe
        606⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Lmmokgne.exe
        
        C:\Windows\system32\Lmmokgne.exe
        607⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Midoph32.exe
        
        C:\Windows\system32\Midoph32.exe
        608⤵
        Drops file in System32 directory
        
        PID:7536
        
        C:\Windows\SysWOW64\Mlbllc32.exe
        
        C:\Windows\system32\Mlbllc32.exe
        609⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Mbldhn32.exe
        
        C:\Windows\system32\Mbldhn32.exe
        610⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8648 -s 400
        611⤵
        Program crash
        
        PID:8664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3936 --field-trial-handle=2304,i,6987730730348465820,3913273227385401271,262144 --variations-seed-version /prefetch:8
1⤵
PID:3288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 8648 -ip 8648
1⤵
PID:8468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aoioli32.exe

Filesize
59KB

MD5
616d2f7376d587bbc4f9cd620228b062

SHA1
ec81bbd138540a5f539cc9e9c875195c44c0951d

SHA256
a8289797c620aeec817eadfedd3ff75ada1e9de8b9dfd8af77646ff11b73a80e

SHA512
25a77f127175c72b936a1590a5fa1e0cf225de6c21ccf0c25eda1365b178885654e2ea4b0eb88e5321d65d7ac4d78f02fd0d4d254ea64e3cc099d0280ec7f266

Download Submit
C:\Windows\SysWOW64\Aonhghjl.exe

Filesize
59KB

MD5
88c1c98d9cd018a9d62dfa0f0e24b42b

SHA1
a176988f494e336eca4a15036c4cd2948dbe6db2

SHA256
d91c3da87b0908f15eca2cf9987db26dc8850235b699dd07ff1d4f1bad5f819b

SHA512
fd78e9ddf8f3c2641dfe130986579b2234b262c06b09258698a36460e5c6bd6e35dcc936b9538a1a718a1ac84da947363febb31e6e270ffe76c603730e1d7d2c

Download Submit
C:\Windows\SysWOW64\Bhkfkmmg.exe

Filesize
59KB

MD5
615201e984321f0c49e229bc72d2a478

SHA1
ed654783c6543333c2004ccbfd56be8776c1e357

SHA256
94afa1df0b4aab0caae97a7ce5b93125f4a89ffc59fc167da79126f05ae77252

SHA512
01382eed322e8870f2612fc7b71e2ace8dc495bdd724c841c1c1784cde7ffd8da3ce14d766ff13a244fb9d2798cabe33bbd66b23b4d504ee521cf81e6a089a69

Download Submit
C:\Windows\SysWOW64\Ccdihbgg.exe

Filesize
59KB

MD5
4251fba19d4df8d6bef1f3cc1b65a42e

SHA1
76b8a7ab14897d96a51c7a3c6b438c06a860d430

SHA256
76213869e479f71a6bb402076330a38a43cb1589fbcf2c978158644ec32b6360

SHA512
85adcb0ba4b54babfd7c7ce45ea939f75348f4f22f8555b7588c49e15f36abba13fd39fdc6e52bd9282290394c757acb7be1964c37e3b6ceb9fb9cc505a50ac9

Download Submit
C:\Windows\SysWOW64\Cmmgof32.exe

Filesize
59KB

MD5
5448cbc43b844f9409f97b448360462f

SHA1
1da73ad956f1c2220ca4753f8dd571003be20d2f

SHA256
a1bda396e8808c048346a79dab60eb5e7b7ccbf32f634ac22a782b06d820ad45

SHA512
ddead17014e68270d2a875da6d7d5d642aff6c3412bc6362789d9efbbe2cea7b71f9ea67fbaf6b0e7a4f4756ecd30652120457baa7f733343eaea5ea850c090f

Download Submit
C:\Windows\SysWOW64\Dgfdojfm.exe

Filesize
59KB

MD5
fe2cc39b94031fce35229232423a05ab

SHA1
162d84cbe7f7e283b4ef23e472c8dfd2b16e0729

SHA256
231a8e736416bdbb0fa2e24906206ed2b60a2d8a8082bc126c9dd49c69ffa970

SHA512
4e48b194b7ed8fb893bffea343da1d8ec1e510ac181746c89f7125f46c5655c8c890793ba474a29f704930963315073e69c3b3666058eafdbebe9b1f2c39c400

Download Submit
C:\Windows\SysWOW64\Eblimcdf.exe

Filesize
59KB

MD5
782e57f52e535b7dc1be989074fe041f

SHA1
c6d620eb3844870f27a6e31086f9c9c6451ec871

SHA256
7f34406e7b019670ec6adbcd607e77832ff257aae83ca319fc6653ecd51c31f2

SHA512
8310e687a92f9f00f05a3422da58b7ee5d33798a81a4803e4bec98f76a6f46a815461baa8a33ed48f85651cbda60cf382068e8176a4dc1575cdcd997c1716ff3

Download Submit
C:\Windows\SysWOW64\Fbelcblk.exe

Filesize
59KB

MD5
63adea0e76b39ff9ae85db0ab8445969

SHA1
f86e9de5f74a707367350b12cd609184e34d00b6

SHA256
c8e0c0941f3d92f720a0d46bacd041a64fdb593c5d6a09d0e959968fd1720037

SHA512
6cc26f6d7a2c08cc680c0a2554a4467c3322bda606658bce78e0b760a7e1e09547b4a708eff30ef7e0154bf3b82c69eb928f153f03e13c37740d96ab9b881703

Download Submit
C:\Windows\SysWOW64\Fflohaij.exe

Filesize
59KB

MD5
48368fea3af848892cec42cf95f4f8db

SHA1
753d1b63f79c16ec26ef645b2c97c8718647b4c6

SHA256
369ba1caaa3bb59568f756f6062d800c1222033347e71007f7ca93aae8706d75

SHA512
4369750727f3d6c9243b88d33db190446a8c450529feffbdb47c241f1d742d0e040675d29be52bde4e30654e878472894c1eb55e36193fdf29e583237d6f0826

Download Submit
C:\Windows\SysWOW64\Fimhjl32.exe

Filesize
59KB

MD5
1e931a56056dbd8b76ed25ddf915c6e0

SHA1
d0f27e8482fb624de9bc0bd43a8d9e94faf1d209

SHA256
f9a4bb81b02d8a7bcae4678a7056cb44fe53613bc1a997d62bc4c389339f2caf

SHA512
40a418a2e620061759ff8eb237964f1a34ea9e53b7a8be07eafda22e5d205ed9619c40005f6c266a18f91c4f7c06045c6fcd2493240afa7ef459f1d1be04c047

Download Submit
C:\Windows\SysWOW64\Fligqhga.exe

Filesize
59KB

MD5
8a8defb3ab9237eb49e34a638d6e8ed2

SHA1
efa83bc451cf21e675053681db03e227341455d6

SHA256
437245f04ed283828eaf18a952d27478b17f506db9f382bbf277671500bdef53

SHA512
c1ff6575b08fdd61a3af98a49e3d2459144c5a63e2ec305425d9691e1a5ac3a2321220da451d033bb859ca99d9f574235b2703beec0df8c9a3fe411a56bb1765

Download Submit
C:\Windows\SysWOW64\Fmkqpkla.exe

Filesize
59KB

MD5
06d91d6a025d3ab261215c0c5bbfb53b

SHA1
77413156721a9254423553f8487603ef9141287c

SHA256
693cb9e3359b05f48c16b47a4cf6351011661347a96c939b772c4f7485af9155

SHA512
2195842d2f6a2e2b3d7af8a2636df42f1f1cdb29a063dd64ab1cb20c4ff6147d668635e01561159d27976b15a464789ade14a316a8fba21803de8c346a3a433d

Download Submit
C:\Windows\SysWOW64\Fmmmfj32.exe

Filesize
59KB

MD5
680c419b2a53db92ed66484d3580143f

SHA1
178610eeaeabdc1b499a6ac339eb539978258d9c

SHA256
dabbdb14730da16c4737efb311343ab8f3e8709fa44ae75f751588366b9c2d08

SHA512
dca44719839895b5a034c010b139f758f8ae7c947d4d7dda5795953208b1cb3c77f2887d304c68b12563e93a7db67cfefd109910f7a1c7e88e704a7da50cb8f1

Download Submit
C:\Windows\SysWOW64\Gbchdp32.exe

Filesize
59KB

MD5
66c8d36ade069daed36346c604871c9f

SHA1
4c6d32bdd779dce9ac7f4d93918422a3cbcc73bd

SHA256
cd81b66fe02deb19780cf3b7d1df0fa7ebc4330d50ff415de830dd33a5c14eb2

SHA512
576a7ca7e7e19a1aebdd5801c190a122f707d32ea3c712b52823269d3d2403d0245753fabe02bae17b72abc1c8eafca390af97d19a654b76b2d04aa10eba13b9

Download Submit
C:\Windows\SysWOW64\Gehbjm32.exe

Filesize
59KB

MD5
d234d23cc1af4ffa8f55ff33490337fb

SHA1
7897fe2ada40b3caac80baf6f0fceb5c28ee569b

SHA256
fdca4cb4d77251b7b5e0bfe00697896c0903035ef4a48fc34645181a47db917a

SHA512
c15e69f9b33e762494df163ca3dfdd6055ad89cea7caefd01a073b5d0333ae6c1f9f2d869b61d5afd7a36fa80beccc674570260e3fc420eea055295cc5cd53d0

Download Submit
C:\Windows\SysWOW64\Gfhndpol.exe

Filesize
59KB

MD5
2d4261b6621deb1c1c62ba6080e6c2a1

SHA1
fc517ee743c8a7b4b90a887083efe7b65bb3e647

SHA256
664a31cc91cfb65af07d514cd3d052096d857d33240f259c8da7551b8c49f1bf

SHA512
f670fe3c9fec8a521f97de46a56a83ca3aa2f17f62d208bfbd09cd963930aafbb17f458a427db5f016da96bd44848f585bbe8d1de91437c898fbea0d7fd12329

Download Submit
C:\Windows\SysWOW64\Gikdkj32.exe

Filesize
59KB

MD5
919bcc3e5d9158a12ef44685661a4032

SHA1
af8aa13a390e12421fe716571e5eb95932462f4a

SHA256
97a26ad981a486b1ecb3f74bf9ebf88ef2fa2a60498f02968f15170ed6c0ff88

SHA512
33f166043d72ddeed508180c01a07faab70916f9150f17265c95a3861471585650d6abaf09d812090be365065f39f723e0f3eac98c78e1e011593947770e3a12

Download Submit
C:\Windows\SysWOW64\Glgcbf32.exe

Filesize
59KB

MD5
2bab96ae94a02d3b0bc9ae92de3f3524

SHA1
2fc292c0c0bcca7be23895862dc78dd381a0a365

SHA256
96b2e5ef350e809c6846ce59d1b34efcdae135850b381802536697b1a6ecfd70

SHA512
30f54567d7447cf1b769abc63a5cb93063df4b187b2dc02742c08fa940006b976334fd1e0d887e30b096309b68d18bff39567b143aa5d6928a5a47ba835af610

Download Submit
C:\Windows\SysWOW64\Glkmmefl.exe

Filesize
59KB

MD5
755c5f9617d2eb8766422049e074da93

SHA1
55beac7a4b8999d44f418760d977229e6c641ac3

SHA256
bb754f14d016d40a69e6b7ae752db8462d001257513b4233e1f46e791d396e01

SHA512
4af146ae91527607dbebf028d000865b68b5fc2af8073ac2302c53e4eceb6de8d492a5a3c49c8d90c0437f87a1541f5f33c6d984b535f838248a511d4e56a634

Download Submit
C:\Windows\SysWOW64\Hemdlj32.exe

Filesize
59KB

MD5
818a200724c9c17461a40678f9722135

SHA1
673af86c1f0c697c5bc2a07cf034ae7cf08ee2c4

SHA256
efe7eca8a80d943c7c9a4a00ab757248871b45954d14776fd997d29d0796ae07

SHA512
d5d554f0f06becbcbf33b456043b2dcb16b68e44472c221e09b98b4681a6cf60e04e870ba7c0bb0f2a04e1dc69e2a031b540ca9b06ca105d02debf70c0f48b0c

Download Submit
C:\Windows\SysWOW64\Hfcnpn32.exe

Filesize
59KB

MD5
bcb055c5f02f1d569f8e442a16c98455

SHA1
2cfacbc055b89b5347a438194123e9ea61b31c4e

SHA256
a55cdeb14e9af5c374f03687bb5f18fdd7d71009a526804a71a207727f7dc721

SHA512
0890c2744fda0b8358d5b2b11bd116e7b1c759117f034f3b020f8668d5367ab566a049fbb1d1cc3135b903f08255a70f629fed48b906faba13bd0382d64fca83

Download Submit
C:\Windows\SysWOW64\Hifcgion.exe

Filesize
59KB

MD5
9e228ef94ab4f0dad4e5fc06e17eef6d

SHA1
a179eb5bc2291c507d3f1e1d8b819ceb50d7518c

SHA256
92d433e94f2cc43150900946c87f3ca0847d0d1bb6f16ebf8403312f86ac7288

SHA512
bff0b53af920005e2bf855905d6614a91d72cd5bf800e3dabe5e9a137ee8872eedd2edd0a8db22013c79b1e34e861baab086844925b2bbf23785fe14a4f17d7b

Download Submit
C:\Windows\SysWOW64\Hipmfjee.exe

Filesize
59KB

MD5
b170c3d49244e11cf505843369288559

SHA1
0591d915e585d92e8b02d15e97f2306101b597d7

SHA256
64d9fd8ec2554cc3438ab00f116fe8bb3b8af82307cf9181551df4df1d5615ff

SHA512
bb44e15f4cfc0a42556f878ecc3a8ae2d8ea960556a6057daf7440a77940a61dc0e6e1c97bb6a81af88123fc50a0997fe3ae70fc18027c668c66d4fa0b2b8d5f

Download Submit
C:\Windows\SysWOW64\Hpchib32.exe

Filesize
59KB

MD5
787bcbee21d95d13050e6c33a7d0e99f

SHA1
9868cc24f52370772fd2a8bb3d2258e53d0c3717

SHA256
a34fe52bf52373c25a5e5c198d868903ee38480bc044dcd12590f0ef08c4ef86

SHA512
d295412328a666482f9e01c166787ed4a5641629462742483fdfff81f5c0c59fb8e9072962ccf2428706c26681faf56aa85569471cc00980f528ea8befc4962f

Download Submit
C:\Windows\SysWOW64\Hplbickp.exe

Filesize
59KB

MD5
762a5af65cf515517fab097170ca4dd5

SHA1
d447ac9146bfd3d31e751d93c2226e0fdf7c485f

SHA256
2e5dd37516bc4613f237a272d6f56234c6bfb6102e9fe6d4cbb36b01669d4a95

SHA512
4c6cdd4e62d163e08d8033eda90a6ad9ce4471971851cde2ad5bd85229d7c7521ffe83d53ed60465d855ab8b85db7433ba5cc8b268b8c87764d72d9bea400ceb

Download Submit
C:\Windows\SysWOW64\Hpnoncim.exe

Filesize
59KB

MD5
43c16baf30b5ed6584aad6fe5c10bdb8

SHA1
80e389cbec8d3f5ebf1c5e3378e9b5381aa19922

SHA256
3ea41bba71ae95171c9288989614b8ed5c53a021cd9848a02d05a6edff9714c3

SHA512
f4a3959f10dd909d6bf83b85e157eb8317e516fa738b150d7adba7d37b136f8c993aef5b9c29c6f38bc64cff19ab7409debc0f7890fb2cb2e322120ffd217e8a

Download Submit
C:\Windows\SysWOW64\Iibccgep.exe

Filesize
59KB

MD5
f9328d1c0f6da5f6e4ca45d996611bef

SHA1
205e500be51752c4bb411981a3844547ad9bff9b

SHA256
41334cb1cfdfe4bb7587be51f296c2582c4ec6d880a5e651de7b86d3988c45c6

SHA512
5a93708f755d1915334d79aed42806236493841b1c32e34fbce2f9932fe19a76d92f1f1de0bceebf1813dbf9d8606e372a7c897f6266aa61b541d9e6945fddbc

Download Submit
C:\Windows\SysWOW64\Imkbnf32.exe

Filesize
59KB

MD5
9e51a20a6c3aa752395869dbb124f500

SHA1
207d11c4ea23b80763172d875fed8d0bda49e0a4

SHA256
ed55faa8833a8e4ccd5552a2fb463b5630807f3b4f257dc88c700b044059a16a

SHA512
902302d08bbe1a03a4294ef305af9bb407ce106b482fed09c20178d2af76815b8fa25726aeb7693a04fa027a9e6efdfe060270fe2b94192c623b4435dce1be1f

Download Submit
C:\Windows\SysWOW64\Iohejo32.exe

Filesize
59KB

MD5
755a27253c0897077a69304278535912

SHA1
44c0ac4941ae963c5b1a8a6f05b1782a0578753b

SHA256
10198c02a00c194cc55e9a90806deb0151d86cf652f41739e1fbfee05f388004

SHA512
90a3b168d63b800564246e5f290386700d793b0685f06ee2cb5a4d5c30bc0e9ab159e7a23315e03dfcd5c2b43b0abed2bda65bcbbea5550752e40eb6a1626de2

Download Submit
C:\Windows\SysWOW64\Ioolkncg.exe

Filesize
59KB

MD5
67af9a9add0d87bcd73bce231ec28c8d

SHA1
01b5746287cca1de1e70625ee83e3b5967d9e73d

SHA256
cba6d73ae3d030f847153571d1b9f2e3fd10069fe112067d14158dced88011fa

SHA512
f90b37d93959bad599bee9d03fff706859e0561badf797c23814acf0a2fdec020dbc0ff39cda952f772f914855781ae5bd133c1e8d3f50988b3352f7f405edbf

Download Submit
C:\Windows\SysWOW64\Ipgbdbqb.exe

Filesize
59KB

MD5
f1bb036d7d648ef286a899f068b40c6c

SHA1
1f54ac69e0a8c9ee60d49829d3f3da89e1c1bd7c

SHA256
2b639b6303b8509a60986a2494a886ccb831d90d5ebba59daecf62fe2cd6f6e4

SHA512
17550ae7bc5da2422cb406c31cac5c22831f750e1b670305ebeb682c445c652cb5403f195c1e624d59842ea82d54604efb37ccff8ec7961beb64dd8c73e28574

Download Submit
C:\Windows\SysWOW64\Jidinqpb.exe

Filesize
59KB

MD5
1f592d1e7b22dc2495a718d03fd7412a

SHA1
bd75bb39ea3ce4e08402ac57553d543b115ec48a

SHA256
244fad095d1ecbb28d6ebb8b3d63533a7a99f04ee85bd71f22a55018235644a4

SHA512
c1bd8dea4513c95409740837a341da3535c0bfee5f796c1b9f4f681527a0ea7e4263c5f1bfad52f6b060642497d78f7c6aaf544bd273c557d7f934be3e4ef781

Download Submit
C:\Windows\SysWOW64\Jilfifme.exe

Filesize
59KB

MD5
bd7d6da8a424ebea245ebf39303e1d23

SHA1
819e1ca57e3938265ef346f58628554b224ef8af

SHA256
3f3b417468250ea22904d85a16ef03f7a8e5620a06270b63c1120f07fbe82eb7

SHA512
ec51bf121194c108540478037714004bea1df27383764cc28b08a1fffcb687f45de307491f6be42a521d21c5641a9b6efd5636d01e61b21d36a6911a584d4819

Download Submit
C:\Windows\SysWOW64\Jllokajf.exe

Filesize
59KB

MD5
1015602c61a6bf87651290f6043a9eab

SHA1
980c2f19756b98e378b13d7435e1b9d9d6996c9c

SHA256
a24ba84d0706a8466e241508d7ce417c68d56a6eef659a33eb5eab250ceb05c7

SHA512
48d19a772becefafc97ddd9021f09059dc0facad3cb1b4b56fb0fd160172007ab3c800a075b7be48cd4ed2e5ef982c05521239a7ca397a4dc1354976421a6ee5

Download Submit
C:\Windows\SysWOW64\Johnamkm.exe

Filesize
59KB

MD5
86915e8f3ceecc9240ab8e021a10fa29

SHA1
8bea363e1385538cdc7bd4bb5df9251f7d426a87

SHA256
9721a7eea6d608ba463321c309a855de023bc339999f4ce9613f9e27c3d59a9d

SHA512
8a2b014ffad7beb4f723bae07fc7fecb7facf94925f617c890b37ba1e554797ba701267d7c81f62b4966718844ab03a2d145787e7d7bbe7d55a031713a215070

Download Submit
C:\Windows\SysWOW64\Kckqbj32.exe

Filesize
59KB

MD5
0f15d7e03f1330692416e2cb37365d9d

SHA1
e218a4dd16fba3b23f772c696107181e14f7d0d2

SHA256
24acb54df0f4c3121ffdf6fc4bdf0db329aa93ab03e795256d5059922b56bd61

SHA512
6f1cf142e1f17e1c4d3cb0878706fa199f6412c7bc7445faabd9a70d90f5a39641f39853410e971389060d0e3d59df2e3fc7af57b95c9ab8a31d1505b768fbfd

Download Submit
C:\Windows\SysWOW64\Keimof32.exe

Filesize
59KB

MD5
9d16f5d3c100519c52c64c28d143aa3e

SHA1
196e7ea7aac03735d6a64b8a3aaee047637c2b9c

SHA256
5c11c9b3c06dfacedf472ad442a733027d6f1e8bb6e7bf0a4dfa2a9c6dddcd25

SHA512
229bb70db908d7f8cfd1cc29cafe7b7136838201f8a00154942cc8c0ef441a7c63db3ea8f5419977bbda434e15cf8c2aba8b58c625bd8bdbe04db6bfcd7f163c

Download Submit
C:\Windows\SysWOW64\Kflide32.exe

Filesize
59KB

MD5
0701d4d3764a97ad42829bb4da8c7278

SHA1
eda65595ec095daea6534ec595841d941ef0f081

SHA256
fd57a78eef09cfcd3efc8d403431179d3d6fece7d030ab1ff868cf0392aea297

SHA512
8a53babc61171db64f0103aa4b25be1ad68690bae037f30ddda173297b45e7fae147cd2c3c26bdd1768968d2e40bc25facfee5399af27ccf7730cdd17b88514e

Download Submit
C:\Windows\SysWOW64\Knnhjcog.exe

Filesize
59KB

MD5
a167b53ea2f77c7f7822f250930d3700

SHA1
6f1356e13a6995abf9962b12e82750d807a2f708

SHA256
e93c8fb5cded4a2fe748c00cf2a328d9a3fcc6cc81cdcf429c95ea5c1a1ff818

SHA512
f64cea77fe24daf7f5c2e8b4c071d43f55d50a8736eacc842a55cb54a7babeb0aa71bacf4b56ecbdcaabfc6b94f8b2c49c9418aca5598c03842e4d15362eaa38

Download Submit
C:\Windows\SysWOW64\Kpjgaoqm.exe

Filesize
59KB

MD5
a721357ffab6baa20421efaddbc1dffe

SHA1
82d2b44d4d70b40b085fc9389b38ddcb625ffb0a

SHA256
5c0e6e730d52a54e6b1df60d4353318a38f40449a7dcfd3e381097b9c9ff63e6

SHA512
2f76dd4354bf6ae38fef216aff9caf28c381357645d94e4924f1e7f60e6210a6bd3a6736fc01142a4cdfdccf8b4b41f0dfa3bfd89fd8efaf3f1e6b3c2426991e

Download Submit
C:\Windows\SysWOW64\Lcmodajm.exe

Filesize
59KB

MD5
fd24d48ec5fa18a10598c6fca7b39a2d

SHA1
de5a924141ff9f8be55f1ae2cd30662eedf0d9f1

SHA256
0bc1c71fb077cf7a42a0cfa8758c7041316f8954824a02982aa933fbbb007c09

SHA512
7340e140c949c113e75318db61b702783bee881cda6bc8f377a50a42a1399e637eddb1671d5ded2a9c75d01f8bc22d69f0b1a05a335f9eac6696c11153760d19

Download Submit
C:\Windows\SysWOW64\Ljceqb32.exe

Filesize
59KB

MD5
bcea8e7e5ce4f52a631b646633161cfc

SHA1
3f4435736b537e95f78e2ba5596652d883c94bca

SHA256
fb2877835375a61d2541123afd690bad8ccc6f692413eefe5638608cbfeffb61

SHA512
b64fda6a4e64bc04f3637a5d57632808bd9c8b52fa83c0b1a5dece67e3e96e8a7be7be0df2dc74b7320c6590da8c9d3316509ec65266eef5707e0660788b770a

Download Submit
C:\Windows\SysWOW64\Llmhaold.exe

Filesize
59KB

MD5
ce09205f06e5175dd139301709efdeac

SHA1
80c1552589497be20d2a2a0a73aa1ec213f79b54

SHA256
4df198ed04283177028a40adfaead2ea7ce87ed8f750e751d509311c7579cf6a

SHA512
6e63c7f09ccb8686f7977ec579121e56c42b9806f08ee9f016220591a4cd22a1e81b3c02e096920abce2ff718e9b220e3c96fae01a1b04b596654ce3b0da2045

Download Submit
C:\Windows\SysWOW64\Mqimikfj.exe

Filesize
59KB

MD5
8c8f3f960968207bc52ea5c807d16908

SHA1
bb622818a7952223ca2c1803f570544fbfad1134

SHA256
2fe3da7f59605e11df090817ec34bfec23df1801bf8cad5cbf46f4a9f1abbc6a

SHA512
c556c13cb884bec88d0defd62335a59ef8d69201b0e07cf98e8b0ef5c1a9e0af05ff62fd7c7b2543a66fef1c44a12b979189979d4850beb692258fd620a4c327

Download Submit
C:\Windows\SysWOW64\Ndnnianm.exe

Filesize
59KB

MD5
ee562c89543bc4e249a19b6332d9587f

SHA1
d56efe412f43756aae8140306132d4db358e1578

SHA256
1f8bef18c9c05e0fc8195b3b9c9dbabddbe7abda6b403362d8d8fe65cc41eba2

SHA512
6f424d3d1b4b2af7e43eb1341d44ff5f66612abbd1e811e7155091fb3cfb0e59760771f09a4d78bf08c1757b20d65a0740acfdc3cb0b1b7f8afef9224f1138bf

Download Submit
C:\Windows\SysWOW64\Nfaemp32.exe

Filesize
59KB

MD5
e59694e6a8afca3d1e517a58319e1926

SHA1
8b288119e3a8e629cd44e15abf9da20dc9657c6a

SHA256
6f184118b73771e2a61cd9763a6229ae6de0d63f674280270de06db641659d81

SHA512
463470365755cee0ac166532ce85a6b9a0f125864b59e044410072078b7747165c012524d49356c9950fcbdf10443f2593f6d15ac7575fb78b0d768e01705294

Download Submit
C:\Windows\SysWOW64\Njedbjej.exe

Filesize
59KB

MD5
6c8bb716ba0ebe6e050b262e3a5e187d

SHA1
ccbc425bdfd7b8ebe66fbf4505a03df2186fbbe2

SHA256
4a8b026a56910362326d6f159b11128fd3e361dee0a97b71ecc5ab8c7e78c5ec

SHA512
6a028d218d02318accbdf51e1ead38513e3408f4af2c38744658253ff5146682787adbeee9156735af6b903dd3c80b935f3e4142fcbea663083634caef37f601

Download Submit
C:\Windows\SysWOW64\Nqbpojnp.exe

Filesize
59KB

MD5
e6c1ab9c68b8b1f20b4b0416996bd07c

SHA1
a6a34245c2c04ac7290cc7f346f5552626cf8473

SHA256
4a38a7752c3c2f0a2deea49bc1d45ff2cd77cc4a10959674d7a86d352ed8fe94

SHA512
4d717722709cd7f5e9d1bda9137f793c17855e6d500721bc7ba1fbd057cca24508d37355053a60a4e64101560daac90fc120ff2fc66db2c501575f1ad6b33187

Download Submit
C:\Windows\SysWOW64\Ochamg32.exe

Filesize
59KB

MD5
e76f2e4db9ad9de6de28f2901feeecca

SHA1
82df53ca488d7b2cdf567a0699b3fae99d99b34b

SHA256
0111afc7ed230a52a8d193cdd012238f260ea50e3e1eef53794c841697bc07cd

SHA512
c436f8019067caff10bed7ddabcc6bc16d439a4a44329b065af7c1e0845ba20962f095a16829921136674825346faa9b3f6cb235da55e8d56a507fe629416273

Download Submit
C:\Windows\SysWOW64\Oclkgccf.exe

Filesize
59KB

MD5
8a7db0b0e5a23af44b9ce3f1f7c15e93

SHA1
225e9049a1ce29637f1ef19cb7171cd558b0d500

SHA256
8950fbd90a4442bde44951a907da44953af400bf42d3a2c2fe9124386dd5b340

SHA512
1f57fa1669e2a6bd75fb9ab89eb5d05178e739471990e6a3ad5237c175aeb72e4d04a9974dbdf99f697aaa0710c0d9b5d0a84d4c0bdaa1ffcd483fab03fcec91

Download Submit
C:\Windows\SysWOW64\Pjpfjl32.exe

Filesize
59KB

MD5
365caf83ddcbda91f29dd0dcb987a262

SHA1
ac1e0cf76de931aa975503494e0b82b54be88994

SHA256
9262f83002b96093824d22938c87947cb10da8a834196bc687b094cc5c4e3826

SHA512
0d677198787c84fd7ae02c4822c996782f26c2373f88fab415c7515815d3e590a29bd9f77b8a4205f79b72a57c9d9032b87a356b8b9d5699505c2e4bb8de11da

Download Submit
C:\Windows\SysWOW64\Pqbala32.exe

Filesize
59KB

MD5
feab95617cfb6434174ef0a34428e264

SHA1
490f8061242427a5fd56418a4d8ac1fd0d77f92e

SHA256
3ba489ad7af057d56d633927ffdd1dbe84e18a3aa9147fcc20d7479240d6bcf1

SHA512
e13bcca6d63713edc22fcb72260b1a8fbffa6c6f916432c5efdf32c7d3cf94dfaa6cfd11aeddb25f98fc4d5d88f271acf91fccc6b979f83f2c066b98a2a21c06

Download Submit
memory/332-337-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/496-226-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/660-373-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/728-121-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/960-201-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1272-56-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1324-72-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1508-331-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1728-409-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1768-113-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1936-233-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2012-325-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2080-242-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2100-355-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2168-427-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2248-295-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2256-146-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2376-178-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2520-379-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2568-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2604-415-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2700-130-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2864-217-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2868-210-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2912-161-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2972-349-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3004-301-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3008-313-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3104-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3104-1-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3104-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3116-343-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3128-193-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3392-153-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3404-407-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3440-367-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3472-307-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3492-48-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3512-385-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3848-283-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3856-41-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3952-262-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4008-421-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4136-82-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4224-186-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4252-271-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4304-289-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4392-98-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4408-202-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4472-138-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4476-90-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4512-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4584-265-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4612-254-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4640-319-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4688-17-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4832-391-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4888-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4924-277-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4936-361-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4940-9-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4944-169-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5084-105-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5100-397-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads