153374c0e6cb22a7ae3b49ccacd54399b78ef3a79519d403317ecafd9cd7fa8d

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16-04-2024 19:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

153374c0e6cb22a7ae3b49ccacd54399b78ef3a79519d403317ecafd9cd7fa8d.exe
Size

80KB
MD5

af119bb7dbb1fd12a550e3de3c49b8cc
SHA1

4eec4e9b5409af726381f060d1d37bca5a24fd2a
SHA256

153374c0e6cb22a7ae3b49ccacd54399b78ef3a79519d403317ecafd9cd7fa8d
SHA512

5e92f658b8306e0d0ddbc47b63884768d634c6a76ca4f838f7255d67b5fed6eecc1a8cbc2aa58a9bae4fa143346a1f470ee3f6cdab61495494e4028cd468c5a4
SSDEEP

1536:xeNJFmIMjspusSC+HOQq/YF/2LHwaIZTJ+7LhkiB0:x8F6THj8YFEQaMU7ui

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfnegggi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecgcfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eohmkb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oiccje32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdgljmcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cijpahho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dinael32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oflgep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dldpkoil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnebeogl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fpjcgm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbofcghl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bajqda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjlkge32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ojdgnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihmfco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Khlklj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppgomnai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abhqefpg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jbeidl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmpjmn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgpmmp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Akqfkp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qacameaj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acmflf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lacdmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lenicahg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kncaec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jdaaaeqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcpcdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Biklho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdcmkgmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qdphngfl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jimekgff.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Chcddk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kjhcjq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcepkfld.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdjibj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mepfiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pkbjjbda.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qlgpod32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Abcgjg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onapdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oocddono.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aijnep32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dhclmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgnbdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oclkgccf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppgegd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kiidgeki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bciehh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Afkknogn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ckkiccep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnpofnhk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmalne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ingpmmgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kcoccc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Balfaiil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkalchij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iblfnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmgfda32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnfcia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhldpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Caqpkjcl.exe

Executes dropped EXE 64 IoCs

pid	Process
4236	Qbimoo32.exe
4924	Ajdbcano.exe
2824	Acmflf32.exe
1140	Anbkio32.exe
1412	Acocaf32.exe
4644	Andgoobc.exe
1560	Ahmlgd32.exe
3092	Abbpem32.exe
2676	Ahoimd32.exe
2412	Bdfibe32.exe
3600	Bjpaooda.exe
3008	Beeflhdh.exe
3760	Balfaiil.exe
212	Bjdkjo32.exe
4772	Bhikcb32.exe
2620	Bobcpmfc.exe
4184	Bhkhibmc.exe
5008	Boepel32.exe
4512	Cacmah32.exe
2152	Cliaoq32.exe
4784	Cddecc32.exe
3532	Cknnpm32.exe
3856	Clnjjpod.exe
2960	Cajcbgml.exe
3348	Conclk32.exe
4372	Cehkhecb.exe
712	Clbceo32.exe
2908	Dekhneap.exe
1072	Dldpkoil.exe
1968	Daaicfgd.exe
3116	Doeiljfn.exe
4432	Dlijfneg.exe
3660	Dddojq32.exe
4128	Dllfkn32.exe
3248	Dahode32.exe
2772	Ehedfo32.exe
4020	Eepjpb32.exe
1640	Fohoigfh.exe
2548	Fhqcam32.exe
4700	Fdgdgnbm.exe
3272	Fkalchij.exe
1724	Fhemmlhc.exe
2944	Fbnafb32.exe
4688	Fkffog32.exe
3308	Ffkjlp32.exe
2756	Fhjfhl32.exe
1020	Gkhbdg32.exe
1456	Gbbkaako.exe
5028	Gmjlcj32.exe
4460	Gcddpdpo.exe
3528	Ghaliknf.exe
4940	Gicinj32.exe
4536	Gcimkc32.exe
4724	Hiefcj32.exe
5104	Hckjacjg.exe
1220	Helfik32.exe
3040	Hkfoeega.exe
2216	Hcmgfbhd.exe
3676	Heocnk32.exe
1600	Hfnphn32.exe
3748	Himldi32.exe
4716	Hbeqmoji.exe
2912	Hcdmga32.exe
3964	Hfcicmqp.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Mnbcedcn.dll	Icnpmp32.exe
File created	C:\Windows\SysWOW64\Ndlapjeg.dll	Jdbhkk32.exe
File created	C:\Windows\SysWOW64\Qgfcle32.dll	Bhamkipi.exe
File created	C:\Windows\SysWOW64\Jcdjbk32.exe	Jepjhg32.exe
File created	C:\Windows\SysWOW64\Bgelgi32.exe	Bdfpkm32.exe
File created	C:\Windows\SysWOW64\Bdlfjh32.exe	Afhfaddk.exe
File opened for modification	C:\Windows\SysWOW64\Ciihjmcj.exe	Cdmoafdb.exe
File created	C:\Windows\SysWOW64\Fhpmgg32.exe	Fkllnbjc.exe
File created	C:\Windows\SysWOW64\Pidcecbj.dll	Pfnegggi.exe
File created	C:\Windows\SysWOW64\Oanfen32.exe	Odjeljhd.exe
File opened for modification	C:\Windows\SysWOW64\Ohkkhhmh.exe	Oelolmnd.exe
File created	C:\Windows\SysWOW64\Jfniqp32.dll	Omgcpokp.exe
File created	C:\Windows\SysWOW64\Gkjcgjio.dll	Jenmcggo.exe
File opened for modification	C:\Windows\SysWOW64\Mpablkhc.exe	Migjoaaf.exe
File created	C:\Windows\SysWOW64\Qceiaa32.exe	Pfaigm32.exe
File created	C:\Windows\SysWOW64\Fbggjh32.dll	Ehapfiem.exe
File opened for modification	C:\Windows\SysWOW64\Bjlgdc32.exe	Bqdblmhl.exe
File created	C:\Windows\SysWOW64\Ajfmkfhq.dll	Jknfcofa.exe
File opened for modification	C:\Windows\SysWOW64\Ebdcld32.exe	Ekkkoj32.exe
File opened for modification	C:\Windows\SysWOW64\Fbelcblk.exe	Fngcmcfe.exe
File created	C:\Windows\SysWOW64\Baepolni.exe	Bkkhbb32.exe
File created	C:\Windows\SysWOW64\Cehkhecb.exe	Conclk32.exe
File opened for modification	C:\Windows\SysWOW64\Dekhneap.exe	Clbceo32.exe
File opened for modification	C:\Windows\SysWOW64\Daaicfgd.exe	Dldpkoil.exe
File created	C:\Windows\SysWOW64\Hjlkge32.exe	Hnfjbdmk.exe
File created	C:\Windows\SysWOW64\Qfgllk32.dll	Hoeieolb.exe
File created	C:\Windows\SysWOW64\Hnphoj32.exe	Hlblcn32.exe
File created	C:\Windows\SysWOW64\Iondqhpl.exe	Ipkdek32.exe
File opened for modification	C:\Windows\SysWOW64\Belebq32.exe	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Ennamn32.dll	Cklhcfle.exe
File opened for modification	C:\Windows\SysWOW64\Dpkmal32.exe	Dnmaea32.exe
File opened for modification	C:\Windows\SysWOW64\Gmjlcj32.exe	Gbbkaako.exe
File opened for modification	C:\Windows\SysWOW64\Jdbhkk32.exe	Jnhpoamf.exe
File created	C:\Windows\SysWOW64\Nldfjqkf.dll	Mlkepaam.exe
File created	C:\Windows\SysWOW64\Dkhnjk32.exe	Dijbno32.exe
File opened for modification	C:\Windows\SysWOW64\Qhhpop32.exe	Phfcipoo.exe
File created	C:\Windows\SysWOW64\Kkbljp32.dll	Pnonbk32.exe
File created	C:\Windows\SysWOW64\Klifnj32.exe	Khmknk32.exe
File opened for modification	C:\Windows\SysWOW64\Fdkpma32.exe	Fmqgpgoc.exe
File opened for modification	C:\Windows\SysWOW64\Dkhnjk32.exe	Dijbno32.exe
File created	C:\Windows\SysWOW64\Ilcldb32.exe	Impliekg.exe
File opened for modification	C:\Windows\SysWOW64\Fohoigfh.exe	Eepjpb32.exe
File created	C:\Windows\SysWOW64\Imhkcaln.dll	Hckjacjg.exe
File opened for modification	C:\Windows\SysWOW64\Ifjodl32.exe	Ickchq32.exe
File created	C:\Windows\SysWOW64\Bhaomhld.dll	Klgqcqkl.exe
File created	C:\Windows\SysWOW64\Apnpee32.dll	Jnfcia32.exe
File created	C:\Windows\SysWOW64\Nlphbnoe.exe	Niakfbpa.exe
File created	C:\Windows\SysWOW64\Gmigpf32.dll	Qlgpod32.exe
File opened for modification	C:\Windows\SysWOW64\Daeifj32.exe	Dinael32.exe
File created	C:\Windows\SysWOW64\Bqhimici.dll	Eepjpb32.exe
File opened for modification	C:\Windows\SysWOW64\Imoneg32.exe	Ifefimom.exe
File created	C:\Windows\SysWOW64\Pbbigf32.dll	Nlfelogp.exe
File created	C:\Windows\SysWOW64\Jcbiffko.dll	Kkeldnpi.exe
File opened for modification	C:\Windows\SysWOW64\Jcdjbk32.exe	Jepjhg32.exe
File created	C:\Windows\SysWOW64\Ofkgcobj.exe	Oclkgccf.exe
File created	C:\Windows\SysWOW64\Apeknk32.exe	Amfobp32.exe
File opened for modification	C:\Windows\SysWOW64\Fdbdah32.exe	Ehkclgmb.exe
File created	C:\Windows\SysWOW64\Aaopkj32.dll	Abbkcpma.exe
File created	C:\Windows\SysWOW64\Iogkekkb.dll	Cfnjpfcl.exe
File opened for modification	C:\Windows\SysWOW64\Gegkpf32.exe	Gbiockdj.exe
File created	C:\Windows\SysWOW64\Hemmac32.exe	Hbnaeh32.exe
File created	C:\Windows\SysWOW64\Jaonbc32.exe	Iehmmb32.exe
File created	C:\Windows\SysWOW64\Bcomgibl.dll	Qclmck32.exe
File created	C:\Windows\SysWOW64\Khacqh32.dll	Diccgfpd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12780	12716	WerFault.exe	1073

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghaeocdd.dll"	Ojnfihmo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpijnqkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Diphbb32.dll"	Dhocqigp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Peieba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkhkgplb.dll"	Mepfiq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qmhlgmmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ipgbdbqb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofcmfodb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dcnfjkma.dll"	Ipoopgnf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kmdlffhj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kkeldnpi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omegjomb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anhejhfp.dll"	Jmeede32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ipihpkkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jhnojl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Omocan32.dll"	Cenahpha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbofcghl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfebfnqn.dll"	Gpgind32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipbehfom.dll"	Lgpoihnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dpkmal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Geanfelc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Megdccmb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Emanjldl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmpmkplp.dll"	Jpijnqkp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnnndm32.dll"	Hghoeqmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dlkbjqgm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hlegnjbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enjgeopm.dll"	Nqbpojnp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Doagjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Egjoqncg.dll"	Aeddnp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcleff32.dll"	Ngjkfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipnjafgo.dll"	Hiefcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iledokkp.dll"	Imakkfdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdifoehl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lldopb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oidhlb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpildobq.dll"	Oboijgbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbpkkeen.dll"	Bdapehop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gmfplibd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jphkkpbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfnphn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbeqmoji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jfeopj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nnaefb32.dll"	Doilmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mhghfqcd.dll"	Jgonlm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hdhedh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldklgegb.dll"	Fbelcblk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjoiip32.dll"	Mokfja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mgjpndjd.dll"	Qbimoo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ffkjlp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laapnj32.dll"	Ickchq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddooacnk.dll"	Ikkpgafg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Knhakh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Akqfkp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bfaigclq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qahlom32.dll"	Dknnoofg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Opeiadfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leboon32.dll"	Kpnjah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Likage32.dll"	Omdieb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mqnbqh32.dll"	Bphgeo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ddgibkpc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npbgmepl.dll"	Bciehh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjhgac32.dll"	Plejdkmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhocin32.dll"	Qebhhp32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 216 wrote to memory of 4236	216	153374c0e6cb22a7ae3b49ccacd54399b78ef3a79519d403317ecafd9cd7fa8d.exe	83
PID 216 wrote to memory of 4236	216	153374c0e6cb22a7ae3b49ccacd54399b78ef3a79519d403317ecafd9cd7fa8d.exe	83
PID 216 wrote to memory of 4236	216	153374c0e6cb22a7ae3b49ccacd54399b78ef3a79519d403317ecafd9cd7fa8d.exe	83
PID 4236 wrote to memory of 4924	4236	Qbimoo32.exe	85
PID 4236 wrote to memory of 4924	4236	Qbimoo32.exe	85
PID 4236 wrote to memory of 4924	4236	Qbimoo32.exe	85
PID 4924 wrote to memory of 2824	4924	Ajdbcano.exe	86
PID 4924 wrote to memory of 2824	4924	Ajdbcano.exe	86
PID 4924 wrote to memory of 2824	4924	Ajdbcano.exe	86
PID 2824 wrote to memory of 1140	2824	Acmflf32.exe	87
PID 2824 wrote to memory of 1140	2824	Acmflf32.exe	87
PID 2824 wrote to memory of 1140	2824	Acmflf32.exe	87
PID 1140 wrote to memory of 1412	1140	Anbkio32.exe	88
PID 1140 wrote to memory of 1412	1140	Anbkio32.exe	88
PID 1140 wrote to memory of 1412	1140	Anbkio32.exe	88
PID 1412 wrote to memory of 4644	1412	Acocaf32.exe	89
PID 1412 wrote to memory of 4644	1412	Acocaf32.exe	89
PID 1412 wrote to memory of 4644	1412	Acocaf32.exe	89
PID 4644 wrote to memory of 1560	4644	Andgoobc.exe	90
PID 4644 wrote to memory of 1560	4644	Andgoobc.exe	90
PID 4644 wrote to memory of 1560	4644	Andgoobc.exe	90
PID 1560 wrote to memory of 3092	1560	Ahmlgd32.exe	92
PID 1560 wrote to memory of 3092	1560	Ahmlgd32.exe	92
PID 1560 wrote to memory of 3092	1560	Ahmlgd32.exe	92
PID 3092 wrote to memory of 2676	3092	Abbpem32.exe	93
PID 3092 wrote to memory of 2676	3092	Abbpem32.exe	93
PID 3092 wrote to memory of 2676	3092	Abbpem32.exe	93
PID 2676 wrote to memory of 2412	2676	Ahoimd32.exe	94
PID 2676 wrote to memory of 2412	2676	Ahoimd32.exe	94
PID 2676 wrote to memory of 2412	2676	Ahoimd32.exe	94
PID 2412 wrote to memory of 3600	2412	Bdfibe32.exe	95
PID 2412 wrote to memory of 3600	2412	Bdfibe32.exe	95
PID 2412 wrote to memory of 3600	2412	Bdfibe32.exe	95
PID 3600 wrote to memory of 3008	3600	Bjpaooda.exe	97
PID 3600 wrote to memory of 3008	3600	Bjpaooda.exe	97
PID 3600 wrote to memory of 3008	3600	Bjpaooda.exe	97
PID 3008 wrote to memory of 3760	3008	Beeflhdh.exe	98
PID 3008 wrote to memory of 3760	3008	Beeflhdh.exe	98
PID 3008 wrote to memory of 3760	3008	Beeflhdh.exe	98
PID 3760 wrote to memory of 212	3760	Balfaiil.exe	99
PID 3760 wrote to memory of 212	3760	Balfaiil.exe	99
PID 3760 wrote to memory of 212	3760	Balfaiil.exe	99
PID 212 wrote to memory of 4772	212	Bjdkjo32.exe	100
PID 212 wrote to memory of 4772	212	Bjdkjo32.exe	100
PID 212 wrote to memory of 4772	212	Bjdkjo32.exe	100
PID 4772 wrote to memory of 2620	4772	Bhikcb32.exe	101
PID 4772 wrote to memory of 2620	4772	Bhikcb32.exe	101
PID 4772 wrote to memory of 2620	4772	Bhikcb32.exe	101
PID 2620 wrote to memory of 4184	2620	Bobcpmfc.exe	102
PID 2620 wrote to memory of 4184	2620	Bobcpmfc.exe	102
PID 2620 wrote to memory of 4184	2620	Bobcpmfc.exe	102
PID 4184 wrote to memory of 5008	4184	Bhkhibmc.exe	103
PID 4184 wrote to memory of 5008	4184	Bhkhibmc.exe	103
PID 4184 wrote to memory of 5008	4184	Bhkhibmc.exe	103
PID 5008 wrote to memory of 4512	5008	Boepel32.exe	104
PID 5008 wrote to memory of 4512	5008	Boepel32.exe	104
PID 5008 wrote to memory of 4512	5008	Boepel32.exe	104
PID 4512 wrote to memory of 2152	4512	Cacmah32.exe	105
PID 4512 wrote to memory of 2152	4512	Cacmah32.exe	105
PID 4512 wrote to memory of 2152	4512	Cacmah32.exe	105
PID 2152 wrote to memory of 4784	2152	Cliaoq32.exe	106
PID 2152 wrote to memory of 4784	2152	Cliaoq32.exe	106
PID 2152 wrote to memory of 4784	2152	Cliaoq32.exe	106
PID 4784 wrote to memory of 3532	4784	Cddecc32.exe	107

C:\Users\Admin\AppData\Local\Temp\153374c0e6cb22a7ae3b49ccacd54399b78ef3a79519d403317ecafd9cd7fa8d.exe
"C:\Users\Admin\AppData\Local\Temp\153374c0e6cb22a7ae3b49ccacd54399b78ef3a79519d403317ecafd9cd7fa8d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:216
- C:\Windows\SysWOW64\Qbimoo32.exe
  C:\Windows\system32\Qbimoo32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\SysWOW64\Ajdbcano.exe
    C:\Windows\system32\Ajdbcano.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Windows\SysWOW64\Acmflf32.exe
      C:\Windows\system32\Acmflf32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2824
    - - C:\Windows\SysWOW64\Anbkio32.exe
        
        C:\Windows\system32\Anbkio32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1140
      - C:\Windows\SysWOW64\Acocaf32.exe
        
        C:\Windows\system32\Acocaf32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1412
        
        C:\Windows\SysWOW64\Andgoobc.exe
        
        C:\Windows\system32\Andgoobc.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4644
        
        C:\Windows\SysWOW64\Ahmlgd32.exe
        
        C:\Windows\system32\Ahmlgd32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1560
        
        C:\Windows\SysWOW64\Abbpem32.exe
        
        C:\Windows\system32\Abbpem32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3092
        
        C:\Windows\SysWOW64\Ahoimd32.exe
        
        C:\Windows\system32\Ahoimd32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2676
        
        C:\Windows\SysWOW64\Bdfibe32.exe
        
        C:\Windows\system32\Bdfibe32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2412
        
        C:\Windows\SysWOW64\Bjpaooda.exe
        
        C:\Windows\system32\Bjpaooda.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3600
        
        C:\Windows\SysWOW64\Beeflhdh.exe
        
        C:\Windows\system32\Beeflhdh.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3008
        
        C:\Windows\SysWOW64\Balfaiil.exe
        
        C:\Windows\system32\Balfaiil.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3760
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:212
        
        C:\Windows\SysWOW64\Bhikcb32.exe
        
        C:\Windows\system32\Bhikcb32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Windows\SysWOW64\Bobcpmfc.exe
        
        C:\Windows\system32\Bobcpmfc.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2620
        
        C:\Windows\SysWOW64\Bhkhibmc.exe
        
        C:\Windows\system32\Bhkhibmc.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Windows\SysWOW64\Boepel32.exe
        
        C:\Windows\system32\Boepel32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\SysWOW64\Cacmah32.exe
        
        C:\Windows\system32\Cacmah32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\SysWOW64\Cliaoq32.exe
        
        C:\Windows\system32\Cliaoq32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2152
        
        C:\Windows\SysWOW64\Cddecc32.exe
        
        C:\Windows\system32\Cddecc32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4784
        
        C:\Windows\SysWOW64\Cknnpm32.exe
        
        C:\Windows\system32\Cknnpm32.exe
        23⤵
        Executes dropped EXE
        
        PID:3532
        
        C:\Windows\SysWOW64\Clnjjpod.exe
        
        C:\Windows\system32\Clnjjpod.exe
        24⤵
        Executes dropped EXE
        
        PID:3856
        
        C:\Windows\SysWOW64\Cajcbgml.exe
        
        C:\Windows\system32\Cajcbgml.exe
        25⤵
        Executes dropped EXE
        
        PID:2960
        
        C:\Windows\SysWOW64\Conclk32.exe
        
        C:\Windows\system32\Conclk32.exe
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3348
        
        C:\Windows\SysWOW64\Cehkhecb.exe
        
        C:\Windows\system32\Cehkhecb.exe
        27⤵
        Executes dropped EXE
        
        PID:4372
        
        C:\Windows\SysWOW64\Clbceo32.exe
        
        C:\Windows\system32\Clbceo32.exe
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:712
        
        C:\Windows\SysWOW64\Dekhneap.exe
        
        C:\Windows\system32\Dekhneap.exe
        29⤵
        Executes dropped EXE
        
        PID:2908
        
        C:\Windows\SysWOW64\Dldpkoil.exe
        
        C:\Windows\system32\Dldpkoil.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1072
        
        C:\Windows\SysWOW64\Daaicfgd.exe
        
        C:\Windows\system32\Daaicfgd.exe
        31⤵
        Executes dropped EXE
        
        PID:1968
        
        C:\Windows\SysWOW64\Doeiljfn.exe
        
        C:\Windows\system32\Doeiljfn.exe
        32⤵
        Executes dropped EXE
        
        PID:3116
        
        C:\Windows\SysWOW64\Dlijfneg.exe
        
        C:\Windows\system32\Dlijfneg.exe
        33⤵
        Executes dropped EXE
        
        PID:4432
        
        C:\Windows\SysWOW64\Dddojq32.exe
        
        C:\Windows\system32\Dddojq32.exe
        34⤵
        Executes dropped EXE
        
        PID:3660
        
        C:\Windows\SysWOW64\Dllfkn32.exe
        
        C:\Windows\system32\Dllfkn32.exe
        35⤵
        Executes dropped EXE
        
        PID:4128
        
        C:\Windows\SysWOW64\Dahode32.exe
        
        C:\Windows\system32\Dahode32.exe
        36⤵
        Executes dropped EXE
        
        PID:3248
        
        C:\Windows\SysWOW64\Ehedfo32.exe
        
        C:\Windows\system32\Ehedfo32.exe
        37⤵
        Executes dropped EXE
        
        PID:2772
        
        C:\Windows\SysWOW64\Eepjpb32.exe
        
        C:\Windows\system32\Eepjpb32.exe
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4020
        
        C:\Windows\SysWOW64\Fohoigfh.exe
        
        C:\Windows\system32\Fohoigfh.exe
        39⤵
        Executes dropped EXE
        
        PID:1640
        
        C:\Windows\SysWOW64\Fhqcam32.exe
        
        C:\Windows\system32\Fhqcam32.exe
        40⤵
        Executes dropped EXE
        
        PID:2548
        
        C:\Windows\SysWOW64\Fdgdgnbm.exe
        
        C:\Windows\system32\Fdgdgnbm.exe
        41⤵
        Executes dropped EXE
        
        PID:4700
        
        C:\Windows\SysWOW64\Fkalchij.exe
        
        C:\Windows\system32\Fkalchij.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3272
        
        C:\Windows\SysWOW64\Fhemmlhc.exe
        
        C:\Windows\system32\Fhemmlhc.exe
        43⤵
        Executes dropped EXE
        
        PID:1724
        
        C:\Windows\SysWOW64\Fbnafb32.exe
        
        C:\Windows\system32\Fbnafb32.exe
        44⤵
        Executes dropped EXE
        
        PID:2944
        
        C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        45⤵
        Executes dropped EXE
        
        PID:4688
        
        C:\Windows\SysWOW64\Ffkjlp32.exe
        
        C:\Windows\system32\Ffkjlp32.exe
        46⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3308
        
        C:\Windows\SysWOW64\Fhjfhl32.exe
        
        C:\Windows\system32\Fhjfhl32.exe
        47⤵
        Executes dropped EXE
        
        PID:2756
        
        C:\Windows\SysWOW64\Gkhbdg32.exe
        
        C:\Windows\system32\Gkhbdg32.exe
        48⤵
        Executes dropped EXE
        
        PID:1020
        
        C:\Windows\SysWOW64\Gbbkaako.exe
        
        C:\Windows\system32\Gbbkaako.exe
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1456
        
        C:\Windows\SysWOW64\Gmjlcj32.exe
        
        C:\Windows\system32\Gmjlcj32.exe
        50⤵
        Executes dropped EXE
        
        PID:5028
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        51⤵
        Executes dropped EXE
        
        PID:4460
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        52⤵
        Executes dropped EXE
        
        PID:3528
        
        C:\Windows\SysWOW64\Gicinj32.exe
        
        C:\Windows\system32\Gicinj32.exe
        53⤵
        Executes dropped EXE
        
        PID:4940
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        54⤵
        Executes dropped EXE
        
        PID:4536
        
        C:\Windows\SysWOW64\Hiefcj32.exe
        
        C:\Windows\system32\Hiefcj32.exe
        55⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4724
        
        C:\Windows\SysWOW64\Hckjacjg.exe
        
        C:\Windows\system32\Hckjacjg.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5104
        
        C:\Windows\SysWOW64\Helfik32.exe
        
        C:\Windows\system32\Helfik32.exe
        57⤵
        Executes dropped EXE
        
        PID:1220
        
        C:\Windows\SysWOW64\Hkfoeega.exe
        
        C:\Windows\system32\Hkfoeega.exe
        58⤵
        Executes dropped EXE
        
        PID:3040
        
        C:\Windows\SysWOW64\Hcmgfbhd.exe
        
        C:\Windows\system32\Hcmgfbhd.exe
        59⤵
        Executes dropped EXE
        
        PID:2216
        
        C:\Windows\SysWOW64\Heocnk32.exe
        
        C:\Windows\system32\Heocnk32.exe
        60⤵
        Executes dropped EXE
        
        PID:3676
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1600
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        62⤵
        Executes dropped EXE
        
        PID:3748
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4716
        
        C:\Windows\SysWOW64\Hcdmga32.exe
        
        C:\Windows\system32\Hcdmga32.exe
        64⤵
        Executes dropped EXE
        
        PID:2912
        
        C:\Windows\SysWOW64\Hfcicmqp.exe
        
        C:\Windows\system32\Hfcicmqp.exe
        65⤵
        Executes dropped EXE
        
        PID:3964
        
        C:\Windows\SysWOW64\Immapg32.exe
        
        C:\Windows\system32\Immapg32.exe
        66⤵
        
        PID:724
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        67⤵
        
        PID:748
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        68⤵
        Drops file in System32 directory
        
        PID:1588
        
        C:\Windows\SysWOW64\Imoneg32.exe
        
        C:\Windows\system32\Imoneg32.exe
        69⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        70⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Iblfnn32.exe
        
        C:\Windows\system32\Iblfnn32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3612
        
        C:\Windows\SysWOW64\Iejcji32.exe
        
        C:\Windows\system32\Iejcji32.exe
        72⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\Imakkfdg.exe
        
        C:\Windows\system32\Imakkfdg.exe
        73⤵
        Modifies registry class
        
        PID:3056
        
        C:\Windows\SysWOW64\Ickchq32.exe
        
        C:\Windows\system32\Ickchq32.exe
        74⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4748
        
        C:\Windows\SysWOW64\Ifjodl32.exe
        
        C:\Windows\system32\Ifjodl32.exe
        75⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        76⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        77⤵
        Drops file in System32 directory
        
        PID:1704
        
        C:\Windows\SysWOW64\Ifllil32.exe
        
        C:\Windows\system32\Ifllil32.exe
        78⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\Imfdff32.exe
        
        C:\Windows\system32\Imfdff32.exe
        79⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\Ilidbbgl.exe
        
        C:\Windows\system32\Ilidbbgl.exe
        80⤵
        
        PID:664
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        81⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\Jimekgff.exe
        
        C:\Windows\system32\Jimekgff.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1520
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        83⤵
        
        PID:2816
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3996
        
        C:\Windows\SysWOW64\Jmknaell.exe
        
        C:\Windows\system32\Jmknaell.exe
        85⤵
        
        PID:2508
        
        C:\Windows\SysWOW64\Jpijnqkp.exe
        
        C:\Windows\system32\Jpijnqkp.exe
        86⤵
        Modifies registry class
        
        PID:2716
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        87⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        88⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Jplfcpin.exe
        
        C:\Windows\system32\Jplfcpin.exe
        89⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Jfeopj32.exe
        
        C:\Windows\system32\Jfeopj32.exe
        90⤵
        Modifies registry class
        
        PID:5220
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        91⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        92⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Jifhaenk.exe
        
        C:\Windows\system32\Jifhaenk.exe
        93⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Jcllonma.exe
        
        C:\Windows\system32\Jcllonma.exe
        94⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Kiidgeki.exe
        
        C:\Windows\system32\Kiidgeki.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5440
        
        C:\Windows\SysWOW64\Klgqcqkl.exe
        
        C:\Windows\system32\Klgqcqkl.exe
        96⤵
        Drops file in System32 directory
        
        PID:5480
        
        C:\Windows\SysWOW64\Kbaipkbi.exe
        
        C:\Windows\system32\Kbaipkbi.exe
        97⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Kdqejn32.exe
        
        C:\Windows\system32\Kdqejn32.exe
        98⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Kebbafoj.exe
        
        C:\Windows\system32\Kebbafoj.exe
        99⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        100⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Kbfbkj32.exe
        
        C:\Windows\system32\Kbfbkj32.exe
        101⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Klngdpdd.exe
        
        C:\Windows\system32\Klngdpdd.exe
        102⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Kdeoemeg.exe
        
        C:\Windows\system32\Kdeoemeg.exe
        103⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        104⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Kdgljmcd.exe
        
        C:\Windows\system32\Kdgljmcd.exe
        105⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5860
        
        C:\Windows\SysWOW64\Leihbeib.exe
        
        C:\Windows\system32\Leihbeib.exe
        106⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        107⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Lekehdgp.exe
        
        C:\Windows\system32\Lekehdgp.exe
        108⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Lboeaifi.exe
        
        C:\Windows\system32\Lboeaifi.exe
        109⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Lmdina32.exe
        
        C:\Windows\system32\Lmdina32.exe
        110⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Ldoaklml.exe
        
        C:\Windows\system32\Ldoaklml.exe
        111⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Lmgfda32.exe
        
        C:\Windows\system32\Lmgfda32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:844
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        113⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Lgokmgjm.exe
        
        C:\Windows\system32\Lgokmgjm.exe
        114⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Lmiciaaj.exe
        
        C:\Windows\system32\Lmiciaaj.exe
        115⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        116⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Mipcob32.exe
        
        C:\Windows\system32\Mipcob32.exe
        117⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Mlopkm32.exe
        
        C:\Windows\system32\Mlopkm32.exe
        118⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Mchhggno.exe
        
        C:\Windows\system32\Mchhggno.exe
        119⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Megdccmb.exe
        
        C:\Windows\system32\Megdccmb.exe
        120⤵
        Modifies registry class
        
        PID:5728
        
        C:\Windows\SysWOW64\Mlampmdo.exe
        
        C:\Windows\system32\Mlampmdo.exe
        121⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Mckemg32.exe
        
        C:\Windows\system32\Mckemg32.exe
        122⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        123⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Migjoaaf.exe
        
        C:\Windows\system32\Migjoaaf.exe
        124⤵
        Drops file in System32 directory
        
        PID:6000
        
        C:\Windows\SysWOW64\Mpablkhc.exe
        
        C:\Windows\system32\Mpablkhc.exe
        125⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Mgkjhe32.exe
        
        C:\Windows\system32\Mgkjhe32.exe
        126⤵
        
        PID:476
        
        C:\Windows\SysWOW64\Mnebeogl.exe
        
        C:\Windows\system32\Mnebeogl.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5208
        
        C:\Windows\SysWOW64\Ncbknfed.exe
        
        C:\Windows\system32\Ncbknfed.exe
        128⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        129⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        130⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        131⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Oponmilc.exe
        
        C:\Windows\system32\Oponmilc.exe
        132⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Oflgep32.exe
        
        C:\Windows\system32\Oflgep32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5936
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        134⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        135⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        136⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        137⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        138⤵
        Modifies registry class
        
        PID:5760
        
        C:\Windows\SysWOW64\Oqhacgdh.exe
        
        C:\Windows\system32\Oqhacgdh.exe
        139⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Pdfjifjo.exe
        
        C:\Windows\system32\Pdfjifjo.exe
        140⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\Pnonbk32.exe
        
        C:\Windows\system32\Pnonbk32.exe
        141⤵
        Drops file in System32 directory
        
        PID:5000
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        142⤵
        Modifies registry class
        
        PID:3500
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        143⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        144⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        145⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        146⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Pdmpje32.exe
        
        C:\Windows\system32\Pdmpje32.exe
        147⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\Pdpmpdbd.exe
        
        C:\Windows\system32\Pdpmpdbd.exe
        148⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\Pfaigm32.exe
        
        C:\Windows\system32\Pfaigm32.exe
        149⤵
        Drops file in System32 directory
        
        PID:5672
        
        C:\Windows\SysWOW64\Qceiaa32.exe
        
        C:\Windows\system32\Qceiaa32.exe
        150⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        151⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        152⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Adgbpc32.exe
        
        C:\Windows\system32\Adgbpc32.exe
        153⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\Aqncedbp.exe
        
        C:\Windows\system32\Aqncedbp.exe
        154⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        155⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        156⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Afmhck32.exe
        
        C:\Windows\system32\Afmhck32.exe
        157⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Acqimo32.exe
        
        C:\Windows\system32\Acqimo32.exe
        158⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Bmkjkd32.exe
        
        C:\Windows\system32\Bmkjkd32.exe
        159⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        160⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        161⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        162⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        163⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        164⤵
        Drops file in System32 directory
        
        PID:6508
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        165⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Cjinkg32.exe
        
        C:\Windows\system32\Cjinkg32.exe
        166⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        167⤵
        Modifies registry class
        
        PID:6640
        
        C:\Windows\SysWOW64\Cjkjpgfi.exe
        
        C:\Windows\system32\Cjkjpgfi.exe
        168⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Caebma32.exe
        
        C:\Windows\system32\Caebma32.exe
        169⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        170⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        171⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Cjpckf32.exe
        
        C:\Windows\system32\Cjpckf32.exe
        172⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Cajlhqjp.exe
        
        C:\Windows\system32\Cajlhqjp.exe
        173⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6944
        
        C:\Windows\SysWOW64\Cjbpaf32.exe
        
        C:\Windows\system32\Cjbpaf32.exe
        175⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        176⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Dopigd32.exe
        
        C:\Windows\system32\Dopigd32.exe
        177⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        178⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        179⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        180⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Deokon32.exe
        
        C:\Windows\system32\Deokon32.exe
        181⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Dmjocp32.exe
        
        C:\Windows\system32\Dmjocp32.exe
        182⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Dhocqigp.exe
        
        C:\Windows\system32\Dhocqigp.exe
        183⤵
        Modifies registry class
        
        PID:6408
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        184⤵
        Modifies registry class
        
        PID:6476
        
        C:\Windows\SysWOW64\Ehapfiem.exe
        
        C:\Windows\system32\Ehapfiem.exe
        185⤵
        Drops file in System32 directory
        
        PID:6536
        
        C:\Windows\SysWOW64\Emoinpcd.exe
        
        C:\Windows\system32\Emoinpcd.exe
        186⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Ehdmlhcj.exe
        
        C:\Windows\system32\Ehdmlhcj.exe
        187⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Emaedo32.exe
        
        C:\Windows\system32\Emaedo32.exe
        188⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Egijmegb.exe
        
        C:\Windows\system32\Egijmegb.exe
        189⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Eaonjngh.exe
        
        C:\Windows\system32\Eaonjngh.exe
        190⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Ehkclgmb.exe
        
        C:\Windows\system32\Ehkclgmb.exe
        191⤵
        Drops file in System32 directory
        
        PID:6960
        
        C:\Windows\SysWOW64\Fdbdah32.exe
        
        C:\Windows\system32\Fdbdah32.exe
        192⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Fkllnbjc.exe
        
        C:\Windows\system32\Fkllnbjc.exe
        193⤵
        Drops file in System32 directory
        
        PID:7116
        
        C:\Windows\SysWOW64\Fhpmgg32.exe
        
        C:\Windows\system32\Fhpmgg32.exe
        194⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Fnmepn32.exe
        
        C:\Windows\system32\Fnmepn32.exe
        195⤵
        
        PID:6256
        
        C:\Windows\SysWOW64\Fdfmlhna.exe
        
        C:\Windows\system32\Fdfmlhna.exe
        196⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Fnobem32.exe
        
        C:\Windows\system32\Fnobem32.exe
        197⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Fdijbg32.exe
        
        C:\Windows\system32\Fdijbg32.exe
        198⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Fkcboack.exe
        
        C:\Windows\system32\Fkcboack.exe
        199⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Fgjccb32.exe
        
        C:\Windows\system32\Fgjccb32.exe
        200⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Gglpibgm.exe
        
        C:\Windows\system32\Gglpibgm.exe
        201⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Gochjpho.exe
        
        C:\Windows\system32\Gochjpho.exe
        202⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\Ggnlobej.exe
        
        C:\Windows\system32\Ggnlobej.exe
        203⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Goedpofl.exe
        
        C:\Windows\system32\Goedpofl.exe
        204⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Ghniielm.exe
        
        C:\Windows\system32\Ghniielm.exe
        205⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Ghpendjj.exe
        
        C:\Windows\system32\Ghpendjj.exe
        206⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Gojnko32.exe
        
        C:\Windows\system32\Gojnko32.exe
        207⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Gfdfgiid.exe
        
        C:\Windows\system32\Gfdfgiid.exe
        208⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Ggeboaob.exe
        
        C:\Windows\system32\Ggeboaob.exe
        209⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Hffcmh32.exe
        
        C:\Windows\system32\Hffcmh32.exe
        210⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Hghoeqmp.exe
        
        C:\Windows\system32\Hghoeqmp.exe
        211⤵
        Modifies registry class
        
        PID:6452
        
        C:\Windows\SysWOW64\Hnagak32.exe
        
        C:\Windows\system32\Hnagak32.exe
        212⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Hocqam32.exe
        
        C:\Windows\system32\Hocqam32.exe
        213⤵
        
        PID:4876
        
        C:\Windows\SysWOW64\Ifbbig32.exe
        
        C:\Windows\system32\Ifbbig32.exe
        214⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Igcoqocb.exe
        
        C:\Windows\system32\Igcoqocb.exe
        215⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Ifgldfio.exe
        
        C:\Windows\system32\Ifgldfio.exe
        216⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Ifleoe32.exe
        
        C:\Windows\system32\Ifleoe32.exe
        217⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Jfnbdecg.exe
        
        C:\Windows\system32\Jfnbdecg.exe
        218⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Jgonlm32.exe
        
        C:\Windows\system32\Jgonlm32.exe
        219⤵
        Modifies registry class
        
        PID:6584
        
        C:\Windows\SysWOW64\Jkmgblok.exe
        
        C:\Windows\system32\Jkmgblok.exe
        220⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Jnpmjf32.exe
        
        C:\Windows\system32\Jnpmjf32.exe
        221⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Jfgdkd32.exe
        
        C:\Windows\system32\Jfgdkd32.exe
        222⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Kbnepe32.exe
        
        C:\Windows\system32\Kbnepe32.exe
        223⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Kgknhl32.exe
        
        C:\Windows\system32\Kgknhl32.exe
        224⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Keonap32.exe
        
        C:\Windows\system32\Keonap32.exe
        225⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Khmknk32.exe
        
        C:\Windows\system32\Khmknk32.exe
        226⤵
        Drops file in System32 directory
        
        PID:7352
        
        C:\Windows\SysWOW64\Klifnj32.exe
        
        C:\Windows\system32\Klifnj32.exe
        227⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Kfnkkb32.exe
        
        C:\Windows\system32\Kfnkkb32.exe
        228⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Knippe32.exe
        
        C:\Windows\system32\Knippe32.exe
        229⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Kfqgab32.exe
        
        C:\Windows\system32\Kfqgab32.exe
        230⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Klmpiiai.exe
        
        C:\Windows\system32\Klmpiiai.exe
        231⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Kpiljh32.exe
        
        C:\Windows\system32\Kpiljh32.exe
        232⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Kiaqcnpb.exe
        
        C:\Windows\system32\Kiaqcnpb.exe
        233⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Lpbopfag.exe
        
        C:\Windows\system32\Lpbopfag.exe
        234⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Llipehgk.exe
        
        C:\Windows\system32\Llipehgk.exe
        235⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Mhbmphjm.exe
        
        C:\Windows\system32\Mhbmphjm.exe
        236⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Mhdjehhj.exe
        
        C:\Windows\system32\Mhdjehhj.exe
        237⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Mehjol32.exe
        
        C:\Windows\system32\Mehjol32.exe
        238⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Mifcejnj.exe
        
        C:\Windows\system32\Mifcejnj.exe
        239⤵
        
        PID:7924
        
        C:\Windows\SysWOW64\Niniei32.exe
        
        C:\Windows\system32\Niniei32.exe
        240⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Nomncpcg.exe
        
        C:\Windows\system32\Nomncpcg.exe
        241⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Ngdfdmdi.exe
        
        C:\Windows\system32\Ngdfdmdi.exe
        242⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Nlqomd32.exe
        
        C:\Windows\system32\Nlqomd32.exe
        243⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Ncjginjn.exe
        
        C:\Windows\system32\Ncjginjn.exe
        244⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Oidofh32.exe
        
        C:\Windows\system32\Oidofh32.exe
        245⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Ocmconhk.exe
        
        C:\Windows\system32\Ocmconhk.exe
        246⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        247⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Oocddono.exe
        
        C:\Windows\system32\Oocddono.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7360
        
        C:\Windows\SysWOW64\Ogklelna.exe
        
        C:\Windows\system32\Ogklelna.exe
        249⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Ohlimd32.exe
        
        C:\Windows\system32\Ohlimd32.exe
        250⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Oohnonij.exe
        
        C:\Windows\system32\Oohnonij.exe
        251⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Ohqbhdpj.exe
        
        C:\Windows\system32\Ohqbhdpj.exe
        252⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Ookjdn32.exe
        
        C:\Windows\system32\Ookjdn32.exe
        253⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Poodpmca.exe
        
        C:\Windows\system32\Poodpmca.exe
        254⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Pgihfj32.exe
        
        C:\Windows\system32\Pgihfj32.exe
        255⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Ppamophb.exe
        
        C:\Windows\system32\Ppamophb.exe
        256⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Pfnegggi.exe
        
        C:\Windows\system32\Pfnegggi.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7920
        
        C:\Windows\SysWOW64\Plhnda32.exe
        
        C:\Windows\system32\Plhnda32.exe
        258⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Qcbfakec.exe
        
        C:\Windows\system32\Qcbfakec.exe
        259⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Qhonib32.exe
        
        C:\Windows\system32\Qhonib32.exe
        260⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Qcdbfk32.exe
        
        C:\Windows\system32\Qcdbfk32.exe
        261⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Qjnkcekm.exe
        
        C:\Windows\system32\Qjnkcekm.exe
        262⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Agbkmijg.exe
        
        C:\Windows\system32\Agbkmijg.exe
        263⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Aqkpeopg.exe
        
        C:\Windows\system32\Aqkpeopg.exe
        264⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Afghneoo.exe
        
        C:\Windows\system32\Afghneoo.exe
        265⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Ackigjmh.exe
        
        C:\Windows\system32\Ackigjmh.exe
        266⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Aflaie32.exe
        
        C:\Windows\system32\Aflaie32.exe
        267⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Aijnep32.exe
        
        C:\Windows\system32\Aijnep32.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7896
        
        C:\Windows\SysWOW64\Acpbbi32.exe
        
        C:\Windows\system32\Acpbbi32.exe
        269⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Bqdblmhl.exe
        
        C:\Windows\system32\Bqdblmhl.exe
        270⤵
        Drops file in System32 directory
        
        PID:8124
        
        C:\Windows\SysWOW64\Bjlgdc32.exe
        
        C:\Windows\system32\Bjlgdc32.exe
        271⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\Bcelmhen.exe
        
        C:\Windows\system32\Bcelmhen.exe
        272⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Bgbdcgld.exe
        
        C:\Windows\system32\Bgbdcgld.exe
        273⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\Bidqko32.exe
        
        C:\Windows\system32\Bidqko32.exe
        274⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Bmomlnjk.exe
        
        C:\Windows\system32\Bmomlnjk.exe
        275⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Bciehh32.exe
        
        C:\Windows\system32\Bciehh32.exe
        276⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7972
        
        C:\Windows\SysWOW64\Bqmeal32.exe
        
        C:\Windows\system32\Bqmeal32.exe
        277⤵
        
        PID:2808
        
        C:\Windows\SysWOW64\Cqpbglno.exe
        
        C:\Windows\system32\Cqpbglno.exe
        278⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Cmfclm32.exe
        
        C:\Windows\system32\Cmfclm32.exe
        279⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Cabomkll.exe
        
        C:\Windows\system32\Cabomkll.exe
        280⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Cglgjeci.exe
        
        C:\Windows\system32\Cglgjeci.exe
        281⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        282⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Ccchof32.exe
        
        C:\Windows\system32\Ccchof32.exe
        283⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Cceddf32.exe
        
        C:\Windows\system32\Cceddf32.exe
        284⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Cmniml32.exe
        
        C:\Windows\system32\Cmniml32.exe
        285⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Cgcmjd32.exe
        
        C:\Windows\system32\Cgcmjd32.exe
        286⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Cidjbmcp.exe
        
        C:\Windows\system32\Cidjbmcp.exe
        287⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Dmpfbk32.exe
        
        C:\Windows\system32\Dmpfbk32.exe
        288⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Dpnbog32.exe
        
        C:\Windows\system32\Dpnbog32.exe
        289⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        290⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Dfjgaq32.exe
        
        C:\Windows\system32\Dfjgaq32.exe
        291⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Dmdonkgc.exe
        
        C:\Windows\system32\Dmdonkgc.exe
        292⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Dpckjfgg.exe
        
        C:\Windows\system32\Dpckjfgg.exe
        293⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Dfmcfp32.exe
        
        C:\Windows\system32\Dfmcfp32.exe
        294⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Dpehof32.exe
        
        C:\Windows\system32\Dpehof32.exe
        295⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Dmihij32.exe
        
        C:\Windows\system32\Dmihij32.exe
        296⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Emlenj32.exe
        
        C:\Windows\system32\Emlenj32.exe
        297⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Ejbbmnnb.exe
        
        C:\Windows\system32\Ejbbmnnb.exe
        298⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Eangpgcl.exe
        
        C:\Windows\system32\Eangpgcl.exe
        299⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Ehjlaaig.exe
        
        C:\Windows\system32\Ehjlaaig.exe
        300⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Fgbfhmll.exe
        
        C:\Windows\system32\Fgbfhmll.exe
        301⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Fagjfflb.exe
        
        C:\Windows\system32\Fagjfflb.exe
        302⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Fibojhim.exe
        
        C:\Windows\system32\Fibojhim.exe
        303⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Fdhcgaic.exe
        
        C:\Windows\system32\Fdhcgaic.exe
        304⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Fkbkdkpp.exe
        
        C:\Windows\system32\Fkbkdkpp.exe
        305⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Fmqgpgoc.exe
        
        C:\Windows\system32\Fmqgpgoc.exe
        306⤵
        Drops file in System32 directory
        
        PID:9004
        
        C:\Windows\SysWOW64\Fdkpma32.exe
        
        C:\Windows\system32\Fdkpma32.exe
        307⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Gpaqbbld.exe
        
        C:\Windows\system32\Gpaqbbld.exe
        308⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Ggkiol32.exe
        
        C:\Windows\system32\Ggkiol32.exe
        309⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Gaamlecg.exe
        
        C:\Windows\system32\Gaamlecg.exe
        310⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Ggnedlao.exe
        
        C:\Windows\system32\Ggnedlao.exe
        311⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Gacjadad.exe
        
        C:\Windows\system32\Gacjadad.exe
        312⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Ggpbjkpl.exe
        
        C:\Windows\system32\Ggpbjkpl.exe
        313⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Gnjjfegi.exe
        
        C:\Windows\system32\Gnjjfegi.exe
        314⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Gddbcp32.exe
        
        C:\Windows\system32\Gddbcp32.exe
        315⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        316⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Hkpheidp.exe
        
        C:\Windows\system32\Hkpheidp.exe
        317⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Hnodaecc.exe
        
        C:\Windows\system32\Hnodaecc.exe
        318⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Hdilnojp.exe
        
        C:\Windows\system32\Hdilnojp.exe
        319⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        320⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Hhiajmod.exe
        
        C:\Windows\system32\Hhiajmod.exe
        321⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        322⤵
        Drops file in System32 directory
        
        PID:8940
        
        C:\Windows\SysWOW64\Hjlkge32.exe
        
        C:\Windows\system32\Hjlkge32.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9012
        
        C:\Windows\SysWOW64\Ihnkel32.exe
        
        C:\Windows\system32\Ihnkel32.exe
        324⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        325⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Ijadbdoj.exe
        
        C:\Windows\system32\Ijadbdoj.exe
        326⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        327⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Ihbdplfi.exe
        
        C:\Windows\system32\Ihbdplfi.exe
        328⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        329⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Ikcmbfcj.exe
        
        C:\Windows\system32\Ikcmbfcj.exe
        330⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        331⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Iqbbpm32.exe
        
        C:\Windows\system32\Iqbbpm32.exe
        332⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Jhijqj32.exe
        
        C:\Windows\system32\Jhijqj32.exe
        333⤵
        
        PID:8948
        
        C:\Windows\SysWOW64\Jnfcia32.exe
        
        C:\Windows\system32\Jnfcia32.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9060
        
        C:\Windows\SysWOW64\Jgogbgei.exe
        
        C:\Windows\system32\Jgogbgei.exe
        335⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        336⤵
        Drops file in System32 directory
        
        PID:8248
        
        C:\Windows\SysWOW64\Jdbhkk32.exe
        
        C:\Windows\system32\Jdbhkk32.exe
        337⤵
        Drops file in System32 directory
        
        PID:8500
        
        C:\Windows\SysWOW64\Jnkldqkc.exe
        
        C:\Windows\system32\Jnkldqkc.exe
        338⤵
        
        PID:8552
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        339⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Jibmgi32.exe
        
        C:\Windows\system32\Jibmgi32.exe
        340⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Jkaicd32.exe
        
        C:\Windows\system32\Jkaicd32.exe
        341⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Kdinljnk.exe
        
        C:\Windows\system32\Kdinljnk.exe
        342⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        343⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Kjhcjq32.exe
        
        C:\Windows\system32\Kjhcjq32.exe
        344⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8848
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        345⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Kjkpoq32.exe
        
        C:\Windows\system32\Kjkpoq32.exe
        346⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Kilpmh32.exe
        
        C:\Windows\system32\Kilpmh32.exe
        347⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Kniieo32.exe
        
        C:\Windows\system32\Kniieo32.exe
        348⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Kecabifp.exe
        
        C:\Windows\system32\Kecabifp.exe
        349⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Knkekn32.exe
        
        C:\Windows\system32\Knkekn32.exe
        350⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Ljbfpo32.exe
        
        C:\Windows\system32\Ljbfpo32.exe
        351⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Lgffic32.exe
        
        C:\Windows\system32\Lgffic32.exe
        352⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9288
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        354⤵
        Modifies registry class
        
        PID:9332
        
        C:\Windows\SysWOW64\Laqhhi32.exe
        
        C:\Windows\system32\Laqhhi32.exe
        355⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Lbpdblmo.exe
        
        C:\Windows\system32\Lbpdblmo.exe
        356⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9460
        
        C:\Windows\SysWOW64\Llhikacp.exe
        
        C:\Windows\system32\Llhikacp.exe
        358⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        359⤵
        
        PID:9552
        
        C:\Windows\SysWOW64\Mlkepaam.exe
        
        C:\Windows\system32\Mlkepaam.exe
        360⤵
        Drops file in System32 directory
        
        PID:9596
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        361⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Miofjepg.exe
        
        C:\Windows\system32\Miofjepg.exe
        362⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Miaboe32.exe
        
        C:\Windows\system32\Miaboe32.exe
        363⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Mnnkgl32.exe
        
        C:\Windows\system32\Mnnkgl32.exe
        364⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        365⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Mejpje32.exe
        
        C:\Windows\system32\Mejpje32.exe
        366⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Mldhfpib.exe
        
        C:\Windows\system32\Mldhfpib.exe
        367⤵
        
        PID:9908
        
        C:\Windows\SysWOW64\Nbnpcj32.exe
        
        C:\Windows\system32\Nbnpcj32.exe
        368⤵
        
        PID:9952
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        369⤵
        Drops file in System32 directory
        
        PID:9996
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        370⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Nbcjnilj.exe
        
        C:\Windows\system32\Nbcjnilj.exe
        371⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        372⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Nahgoe32.exe
        
        C:\Windows\system32\Nahgoe32.exe
        373⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        374⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Niakfbpa.exe
        
        C:\Windows\system32\Niakfbpa.exe
        375⤵
        Drops file in System32 directory
        
        PID:9240
        
        C:\Windows\SysWOW64\Nlphbnoe.exe
        
        C:\Windows\system32\Nlphbnoe.exe
        376⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Objpoh32.exe
        
        C:\Windows\system32\Objpoh32.exe
        377⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        378⤵
        Modifies registry class
        
        PID:9440
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        379⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Oboijgbl.exe
        
        C:\Windows\system32\Oboijgbl.exe
        380⤵
        Modifies registry class
        
        PID:9620
        
        C:\Windows\SysWOW64\Olgncmim.exe
        
        C:\Windows\system32\Olgncmim.exe
        381⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Obafpg32.exe
        
        C:\Windows\system32\Obafpg32.exe
        382⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        383⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Oklkdi32.exe
        
        C:\Windows\system32\Oklkdi32.exe
        384⤵
        
        PID:9944
        
        C:\Windows\SysWOW64\Oafcqcea.exe
        
        C:\Windows\system32\Oafcqcea.exe
        385⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        386⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        387⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10224
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        388⤵
        
        PID:9344
        
        C:\Windows\SysWOW64\Pkadoiip.exe
        
        C:\Windows\system32\Pkadoiip.exe
        389⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        390⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Pibdmp32.exe
        
        C:\Windows\system32\Pibdmp32.exe
        391⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        392⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Peieba32.exe
        
        C:\Windows\system32\Peieba32.exe
        393⤵
        Modifies registry class
        
        PID:9932
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        394⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        395⤵
        Modifies registry class
        
        PID:10200
        
        C:\Windows\SysWOW64\Pocfpf32.exe
        
        C:\Windows\system32\Pocfpf32.exe
        396⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Qcaofebg.exe
        
        C:\Windows\system32\Qcaofebg.exe
        397⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Qhngolpo.exe
        
        C:\Windows\system32\Qhngolpo.exe
        398⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Qkmdkgob.exe
        
        C:\Windows\system32\Qkmdkgob.exe
        399⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Qcclld32.exe
        
        C:\Windows\system32\Qcclld32.exe
        400⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Qebhhp32.exe
        
        C:\Windows\system32\Qebhhp32.exe
        401⤵
        Modifies registry class
        
        PID:9400
        
        C:\Windows\SysWOW64\Allpejfe.exe
        
        C:\Windows\system32\Allpejfe.exe
        402⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Aeddnp32.exe
        
        C:\Windows\system32\Aeddnp32.exe
        403⤵
        Modifies registry class
        
        PID:10152
        
        C:\Windows\SysWOW64\Akcjkfij.exe
        
        C:\Windows\system32\Akcjkfij.exe
        404⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        405⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Afinioip.exe
        
        C:\Windows\system32\Afinioip.exe
        406⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\Abponp32.exe
        
        C:\Windows\system32\Abponp32.exe
        407⤵
        
        PID:1792
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        408⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4416
        
        C:\Windows\SysWOW64\Aleckinj.exe
        
        C:\Windows\system32\Aleckinj.exe
        409⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Akhcfe32.exe
        
        C:\Windows\system32\Akhcfe32.exe
        410⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        411⤵
        Drops file in System32 directory
        
        PID:2192
        
        C:\Windows\SysWOW64\Bhldpj32.exe
        
        C:\Windows\system32\Bhldpj32.exe
        412⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9284
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        413⤵
        
        PID:2624
        
        C:\Windows\SysWOW64\Bcddcbab.exe
        
        C:\Windows\system32\Bcddcbab.exe
        414⤵
        
        PID:1140
        
        C:\Windows\SysWOW64\Bjnmpl32.exe
        
        C:\Windows\system32\Bjnmpl32.exe
        415⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Bhamkipi.exe
        
        C:\Windows\system32\Bhamkipi.exe
        416⤵
        Drops file in System32 directory
        
        PID:652
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        417⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Bbiado32.exe
        
        C:\Windows\system32\Bbiado32.exe
        418⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Bmofagfp.exe
        
        C:\Windows\system32\Bmofagfp.exe
        419⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Bjbfklei.exe
        
        C:\Windows\system32\Bjbfklei.exe
        420⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Ckfphc32.exe
        
        C:\Windows\system32\Ckfphc32.exe
        421⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        422⤵
        
        PID:10464
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        423⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10504
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        424⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Cfnqklgh.exe
        
        C:\Windows\system32\Cfnqklgh.exe
        425⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Cimmggfl.exe
        
        C:\Windows\system32\Cimmggfl.exe
        426⤵
        
        PID:10644
        
        C:\Windows\SysWOW64\Ckkiccep.exe
        
        C:\Windows\system32\Ckkiccep.exe
        427⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10684
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        428⤵
        
        PID:10720
        
        C:\Windows\SysWOW64\Cjliajmo.exe
        
        C:\Windows\system32\Cjliajmo.exe
        429⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\Coiaiakf.exe
        
        C:\Windows\system32\Coiaiakf.exe
        430⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Cbgnemjj.exe
        
        C:\Windows\system32\Cbgnemjj.exe
        431⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Ciafbg32.exe
        
        C:\Windows\system32\Ciafbg32.exe
        432⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        433⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        434⤵
        Drops file in System32 directory
        
        PID:10976
        
        C:\Windows\SysWOW64\Dkbocbog.exe
        
        C:\Windows\system32\Dkbocbog.exe
        435⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        436⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        437⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Dmalne32.exe
        
        C:\Windows\system32\Dmalne32.exe
        438⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11148
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        439⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        440⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Djelgied.exe
        
        C:\Windows\system32\Djelgied.exe
        441⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Dpbdopck.exe
        
        C:\Windows\system32\Dpbdopck.exe
        442⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Dikihe32.exe
        
        C:\Windows\system32\Dikihe32.exe
        443⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        444⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\Dmhand32.exe
        
        C:\Windows\system32\Dmhand32.exe
        445⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        446⤵
        Modifies registry class
        
        PID:3772
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        447⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        448⤵
        
        PID:10540
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        449⤵
        
        PID:212
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        450⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        451⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        452⤵
        
        PID:2620
        
        C:\Windows\SysWOW64\Eiaoid32.exe
        
        C:\Windows\system32\Eiaoid32.exe
        453⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        454⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2916
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        455⤵
        
        PID:5100
        
        C:\Windows\SysWOW64\Elbhjp32.exe
        
        C:\Windows\system32\Elbhjp32.exe
        456⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Eblpgjha.exe
        
        C:\Windows\system32\Eblpgjha.exe
        457⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\Ejchhgid.exe
        
        C:\Windows\system32\Ejchhgid.exe
        458⤵
        
        PID:10988
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        459⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        460⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        461⤵
        
        PID:11160
        
        C:\Windows\SysWOW64\Fpjcgm32.exe
        
        C:\Windows\system32\Fpjcgm32.exe
        462⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11204
        
        C:\Windows\SysWOW64\Fibhpbea.exe
        
        C:\Windows\system32\Fibhpbea.exe
        463⤵
        
        PID:11256
        
        C:\Windows\SysWOW64\Fbjmhh32.exe
        
        C:\Windows\system32\Fbjmhh32.exe
        464⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        465⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        466⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        467⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        468⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10492
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        469⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Gpqjglii.exe
        
        C:\Windows\system32\Gpqjglii.exe
        470⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        471⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        472⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10756
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        473⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Gljgbllj.exe
        
        C:\Windows\system32\Gljgbllj.exe
        474⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        475⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        476⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        477⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        478⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\Hgdejd32.exe
        
        C:\Windows\system32\Hgdejd32.exe
        479⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        480⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        481⤵
        Modifies registry class
        
        PID:4016
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        482⤵
        
        PID:3332
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        483⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10268
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        484⤵
        
        PID:712
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        485⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        486⤵
        Modifies registry class
        
        PID:10536
        
        C:\Windows\SysWOW64\Hpcodihc.exe
        
        C:\Windows\system32\Hpcodihc.exe
        487⤵
        
        PID:10580
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        488⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\Ingpmmgm.exe
        
        C:\Windows\system32\Ingpmmgm.exe
        489⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2600
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        490⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\Idahjg32.exe
        
        C:\Windows\system32\Idahjg32.exe
        491⤵
        
        PID:788
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        492⤵
        Modifies registry class
        
        PID:10880
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        493⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        494⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        495⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        496⤵
        
        PID:3264
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        497⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        498⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        499⤵
        
        PID:3656
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        500⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        501⤵
        Modifies registry class
        
        PID:584
        
        C:\Windows\SysWOW64\Idkkpf32.exe
        
        C:\Windows\system32\Idkkpf32.exe
        502⤵
        
        PID:1408
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        503⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        504⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Jdmgfedl.exe
        
        C:\Windows\system32\Jdmgfedl.exe
        505⤵
        
        PID:2372
        
        C:\Windows\SysWOW64\Jcphab32.exe
        
        C:\Windows\system32\Jcphab32.exe
        506⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\Jjjpnlbd.exe
        
        C:\Windows\system32\Jjjpnlbd.exe
        507⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        508⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        509⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1724
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        510⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4788
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        511⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        512⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        513⤵
        Drops file in System32 directory
        
        PID:11004
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        514⤵
        
        PID:3244
        
        C:\Windows\SysWOW64\Jlobkg32.exe
        
        C:\Windows\system32\Jlobkg32.exe
        515⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        516⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        517⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Knooej32.exe
        
        C:\Windows\system32\Knooej32.exe
        518⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        519⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        520⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        521⤵
        
        PID:460
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        522⤵
        Modifies registry class
        
        PID:3612
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        523⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        524⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10592
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        525⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        526⤵
        
        PID:10772
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        527⤵
        
        PID:11044
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        528⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        529⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        530⤵
        Modifies registry class
        
        PID:4716
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        531⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        532⤵
        
        PID:2504
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        533⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        534⤵
        
        PID:3528
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        535⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        536⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        537⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Lgjijmin.exe
        
        C:\Windows\system32\Lgjijmin.exe
        538⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        539⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        540⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1644
        
        C:\Windows\SysWOW64\Mepfiq32.exe
        
        C:\Windows\system32\Mepfiq32.exe
        541⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5300
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        542⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        543⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        544⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        545⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        546⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        547⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        548⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        549⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        550⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        551⤵
        
        PID:2548
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        552⤵
        
        PID:10440
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        553⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        554⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        555⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        556⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Nmenca32.exe
        
        C:\Windows\system32\Nmenca32.exe
        557⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        558⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        559⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        560⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        561⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        562⤵
        
        PID:5892
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        563⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        564⤵
        Drops file in System32 directory
        
        PID:6020
        
        C:\Windows\SysWOW64\Oanfen32.exe
        
        C:\Windows\system32\Oanfen32.exe
        565⤵
        
        PID:11176
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        566⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        567⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        568⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        569⤵
        Modifies registry class
        
        PID:5500
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        570⤵
        Drops file in System32 directory
        
        PID:5740
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        571⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        572⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        573⤵
        Drops file in System32 directory
        
        PID:5808
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        574⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        575⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        576⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Pmlmkn32.exe
        
        C:\Windows\system32\Pmlmkn32.exe
        577⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        578⤵
        
        PID:3004
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        579⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        580⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5988
        
        C:\Windows\SysWOW64\Phfjcf32.exe
        
        C:\Windows\system32\Phfjcf32.exe
        581⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        582⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        583⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        584⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        585⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        586⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        587⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5732
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        588⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5912
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        589⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        590⤵
        Modifies registry class
        
        PID:6080
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        591⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        592⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        593⤵
        
        PID:568
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        594⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        595⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        596⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        597⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5944
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        598⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        599⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        600⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        601⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        602⤵
        
        PID:2760
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        603⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        604⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        605⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        606⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        607⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        608⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        609⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        610⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        611⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        612⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Bdickcpo.exe
        
        C:\Windows\system32\Bdickcpo.exe
        613⤵
        
        PID:2368
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        614⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        615⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        616⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        617⤵
        Drops file in System32 directory
        
        PID:6128
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        618⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        619⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        620⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        621⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        622⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        623⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        624⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        625⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6792
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        626⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        627⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        628⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        629⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        630⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        631⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        632⤵
        Drops file in System32 directory
        
        PID:6296
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        633⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        634⤵
        
        PID:4636
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        635⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Ekkkoj32.exe
        
        C:\Windows\system32\Ekkkoj32.exe
        636⤵
        Drops file in System32 directory
        
        PID:6816
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        637⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        638⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        639⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        640⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        641⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        642⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        643⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        644⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        645⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        646⤵
        Modifies registry class
        
        PID:5904
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        647⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        648⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        649⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        650⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        651⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        652⤵
        Drops file in System32 directory
        
        PID:7080
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        653⤵
        Modifies registry class
        
        PID:6852
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        654⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        655⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        656⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        657⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        658⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        659⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        660⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        661⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\Gpbpbecj.exe
        
        C:\Windows\system32\Gpbpbecj.exe
        662⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        663⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        664⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        665⤵
        Modifies registry class
        
        PID:6160
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        666⤵
        
        PID:6320
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        667⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        668⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        669⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        670⤵
        Modifies registry class
        
        PID:10020
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        671⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Hipmfjee.exe
        
        C:\Windows\system32\Hipmfjee.exe
        672⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        673⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        674⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Hefnkkkj.exe
        
        C:\Windows\system32\Hefnkkkj.exe
        675⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        676⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        677⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        678⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        679⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        680⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        681⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        682⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        683⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        684⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        685⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        686⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        687⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        688⤵
        Drops file in System32 directory
        
        PID:6532
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        689⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        690⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        691⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        692⤵
        
        PID:11408
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        693⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        694⤵
        Modifies registry class
        
        PID:11492
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        695⤵
        
        PID:11540
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        696⤵
        
        PID:11584
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        697⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        698⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        699⤵
        
        PID:11712
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        700⤵
        Drops file in System32 directory
        
        PID:11752
        
        C:\Windows\SysWOW64\Ilcldb32.exe
        
        C:\Windows\system32\Ilcldb32.exe
        701⤵
        
        PID:11792
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        702⤵
        
        PID:11836
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        703⤵
        
        PID:11876
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        704⤵
        
        PID:11920
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        705⤵
        
        PID:11964
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        706⤵
        Drops file in System32 directory
        
        PID:12000
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        707⤵
        Modifies registry class
        
        PID:12052
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        708⤵
        
        PID:12096
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        709⤵
        Drops file in System32 directory
        
        PID:12140
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        710⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        711⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        712⤵
        Modifies registry class
        
        PID:12268
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        713⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        714⤵
        
        PID:11332
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        715⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        716⤵
        
        PID:11476
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        717⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        718⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11608
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        719⤵
        
        PID:11644
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        720⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        721⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        722⤵
        
        PID:11844
        
        C:\Windows\SysWOW64\Kgnbdh32.exe
        
        C:\Windows\system32\Kgnbdh32.exe
        723⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11900
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        724⤵
        
        PID:11552
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        725⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        726⤵
        Modifies registry class
        
        PID:12012
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        727⤵
        
        PID:12072
        
        C:\Windows\SysWOW64\Lfeljd32.exe
        
        C:\Windows\system32\Lfeljd32.exe
        728⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        729⤵
        
        PID:12220
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        730⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Lmaamn32.exe
        
        C:\Windows\system32\Lmaamn32.exe
        731⤵
        
        PID:12280
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        732⤵
        
        PID:11292
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        733⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        734⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        735⤵
        
        PID:11536
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        736⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7504
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        737⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        738⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        739⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        740⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        741⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        742⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        743⤵
        
        PID:11984
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        744⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        745⤵
        
        PID:12148
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        746⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        747⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        748⤵
        Modifies registry class
        
        PID:7084
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        749⤵
        
        PID:11424
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        750⤵
        Modifies registry class
        
        PID:9984
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        751⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        752⤵
        
        PID:11656
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        753⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        754⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        755⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        756⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:888
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        757⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        758⤵
        
        PID:12064
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        759⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12212
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        760⤵
        
        PID:12248
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        761⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11312
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        762⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        763⤵
        Modifies registry class
        
        PID:8016
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        764⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        765⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        766⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4852
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        767⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        768⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Pfdjinjo.exe
        
        C:\Windows\system32\Pfdjinjo.exe
        769⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        770⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Pdhkcb32.exe
        
        C:\Windows\system32\Pdhkcb32.exe
        771⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        772⤵
        
        PID:12176
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        773⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        774⤵
        Drops file in System32 directory
        
        PID:6708
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        775⤵
        
        PID:11456
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        776⤵
        
        PID:11528
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        777⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7888
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        778⤵
        
        PID:11704
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        779⤵
        
        PID:1952
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        780⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        781⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        782⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        783⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        784⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        785⤵
        
        PID:11356
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        786⤵
        
        PID:3636
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        787⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        788⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        789⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        790⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        791⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Boenhgdd.exe
        
        C:\Windows\system32\Boenhgdd.exe
        792⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        793⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        794⤵
        
        PID:12136
        
        C:\Windows\SysWOW64\Bmjkic32.exe
        
        C:\Windows\system32\Bmjkic32.exe
        795⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        796⤵
        Modifies registry class
        
        PID:8092
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        797⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        798⤵
        Drops file in System32 directory
        
        PID:7512
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        799⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        800⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        801⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11828
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        802⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        803⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Coqncejg.exe
        
        C:\Windows\system32\Coqncejg.exe
        804⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        805⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        806⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        807⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        808⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        809⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Cklhcfle.exe
        
        C:\Windows\system32\Cklhcfle.exe
        810⤵
        Drops file in System32 directory
        
        PID:4448
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        811⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        812⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        813⤵
        Drops file in System32 directory
        
        PID:7288
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        814⤵
        Modifies registry class
        
        PID:7396
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        815⤵
        Modifies registry class
        
        PID:7392
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        816⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        817⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        818⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        819⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        820⤵
        Modifies registry class
        
        PID:8032
        
        C:\Windows\SysWOW64\Dqbcbkab.exe
        
        C:\Windows\system32\Dqbcbkab.exe
        821⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Ddnobj32.exe
        
        C:\Windows\system32\Ddnobj32.exe
        822⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        823⤵
        
        PID:7704
        
        C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        824⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        825⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Eqgmmk32.exe
        
        C:\Windows\system32\Eqgmmk32.exe
        826⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        827⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Eohmkb32.exe
        
        C:\Windows\system32\Eohmkb32.exe
        828⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7584
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        829⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        830⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        831⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        832⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Fkfcqb32.exe
        
        C:\Windows\system32\Fkfcqb32.exe
        833⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Fganqbgg.exe
        
        C:\Windows\system32\Fganqbgg.exe
        834⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        835⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Gbiockdj.exe
        
        C:\Windows\system32\Gbiockdj.exe
        836⤵
        Drops file in System32 directory
        
        PID:8128
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        837⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        838⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Gnpphljo.exe
        
        C:\Windows\system32\Gnpphljo.exe
        839⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        840⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        841⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        842⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        843⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        844⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        845⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        846⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        847⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        848⤵
        Modifies registry class
        
        PID:8404
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        849⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Hbihjifh.exe
        
        C:\Windows\system32\Hbihjifh.exe
        850⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Hicpgc32.exe
        
        C:\Windows\system32\Hicpgc32.exe
        851⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        852⤵
        Drops file in System32 directory
        
        PID:9100
        
        C:\Windows\SysWOW64\Hnphoj32.exe
        
        C:\Windows\system32\Hnphoj32.exe
        853⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        854⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        855⤵
        
        PID:60
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        856⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Hbnaeh32.exe
        
        C:\Windows\system32\Hbnaeh32.exe
        857⤵
        Drops file in System32 directory
        
        PID:9120
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        858⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        859⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        860⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        861⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        862⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7580
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        863⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Ilkoim32.exe
        
        C:\Windows\system32\Ilkoim32.exe
        864⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        865⤵
        
        PID:8220
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        866⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        867⤵
        Modifies registry class
        
        PID:8812
        
        C:\Windows\SysWOW64\Ipkdek32.exe
        
        C:\Windows\system32\Ipkdek32.exe
        868⤵
        Drops file in System32 directory
        
        PID:8056
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        869⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        870⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        871⤵
        Drops file in System32 directory
        
        PID:8900
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        872⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        873⤵
        
        PID:9036
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        874⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        875⤵
        
        PID:9204
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        876⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Jadgnb32.exe
        
        C:\Windows\system32\Jadgnb32.exe
        877⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        878⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Jhnojl32.exe
        
        C:\Windows\system32\Jhnojl32.exe
        879⤵
        Modifies registry class
        
        PID:8940
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        880⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        881⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        882⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        883⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        884⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        885⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        886⤵
        Modifies registry class
        
        PID:8936
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        887⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        888⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8700
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        889⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        890⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8908
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        891⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        892⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        893⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        894⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\Ledepn32.exe
        
        C:\Windows\system32\Ledepn32.exe
        895⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        896⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        897⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        898⤵
        
        PID:256
        
        C:\Windows\SysWOW64\Lhenai32.exe
        
        C:\Windows\system32\Lhenai32.exe
        899⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        900⤵
        
        PID:8736
        
        C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        901⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        902⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Mhoahh32.exe
        
        C:\Windows\system32\Mhoahh32.exe
        903⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        904⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        905⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Mcdeeq32.exe
        
        C:\Windows\system32\Mcdeeq32.exe
        906⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        907⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        908⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        909⤵
        Modifies registry class
        
        PID:9856
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        910⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        911⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        912⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        913⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Nodiqp32.exe
        
        C:\Windows\system32\Nodiqp32.exe
        914⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        915⤵
        
        PID:10148
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        916⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        917⤵
        Modifies registry class
        
        PID:9972
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        918⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        919⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        920⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:572
        
        C:\Windows\SysWOW64\Oqklkbbi.exe
        
        C:\Windows\system32\Oqklkbbi.exe
        921⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        922⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        923⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Ockdmmoj.exe
        
        C:\Windows\system32\Ockdmmoj.exe
        924⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        925⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        926⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        927⤵
        Modifies registry class
        
        PID:9820
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        928⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        929⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Pimfpc32.exe
        
        C:\Windows\system32\Pimfpc32.exe
        930⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        931⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9500
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        932⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        933⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Qclmck32.exe
        
        C:\Windows\system32\Qclmck32.exe
        934⤵
        Drops file in System32 directory
        
        PID:9632
        
        C:\Windows\SysWOW64\Qjffpe32.exe
        
        C:\Windows\system32\Qjffpe32.exe
        935⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Qiiflaoo.exe
        
        C:\Windows\system32\Qiiflaoo.exe
        936⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Qcnjijoe.exe
        
        C:\Windows\system32\Qcnjijoe.exe
        937⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Qbajeg32.exe
        
        C:\Windows\system32\Qbajeg32.exe
        938⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        939⤵
        Drops file in System32 directory
        
        PID:9368
        
        C:\Windows\SysWOW64\Apeknk32.exe
        
        C:\Windows\system32\Apeknk32.exe
        940⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\Acqgojmb.exe
        
        C:\Windows\system32\Acqgojmb.exe
        941⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Abcgjg32.exe
        
        C:\Windows\system32\Abcgjg32.exe
        942⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10224
        
        C:\Windows\SysWOW64\Ajjokd32.exe
        
        C:\Windows\system32\Ajjokd32.exe
        943⤵
        
        PID:9504
        
        C:\Windows\SysWOW64\Abhqefpg.exe
        
        C:\Windows\system32\Abhqefpg.exe
        944⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9736
        
        C:\Windows\SysWOW64\Amnebo32.exe
        
        C:\Windows\system32\Amnebo32.exe
        945⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Aaiqcnhg.exe
        
        C:\Windows\system32\Aaiqcnhg.exe
        946⤵
        
        PID:9232
        
        C:\Windows\SysWOW64\Aplaoj32.exe
        
        C:\Windows\system32\Aplaoj32.exe
        947⤵
        
        PID:10112
        
        C:\Windows\SysWOW64\Ajaelc32.exe
        
        C:\Windows\system32\Ajaelc32.exe
        948⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Adjjeieh.exe
        
        C:\Windows\system32\Adjjeieh.exe
        949⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Afhfaddk.exe
        
        C:\Windows\system32\Afhfaddk.exe
        950⤵
        Drops file in System32 directory
        
        PID:10156
        
        C:\Windows\SysWOW64\Bdlfjh32.exe
        
        C:\Windows\system32\Bdlfjh32.exe
        951⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        952⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Bdocph32.exe
        
        C:\Windows\system32\Bdocph32.exe
        953⤵
        
        PID:404
        
        C:\Windows\SysWOW64\Bbaclegm.exe
        
        C:\Windows\system32\Bbaclegm.exe
        954⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Bfmolc32.exe
        
        C:\Windows\system32\Bfmolc32.exe
        955⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Biklho32.exe
        
        C:\Windows\system32\Biklho32.exe
        956⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:452
        
        C:\Windows\SysWOW64\Babcil32.exe
        
        C:\Windows\system32\Babcil32.exe
        957⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\Bdapehop.exe
        
        C:\Windows\system32\Bdapehop.exe
        958⤵
        Modifies registry class
        
        PID:10232
        
        C:\Windows\SysWOW64\Bfolacnc.exe
        
        C:\Windows\system32\Bfolacnc.exe
        959⤵
        
        PID:428
        
        C:\Windows\SysWOW64\Bkkhbb32.exe
        
        C:\Windows\system32\Bkkhbb32.exe
        960⤵
        Drops file in System32 directory
        
        PID:1932
        
        C:\Windows\SysWOW64\Baepolni.exe
        
        C:\Windows\system32\Baepolni.exe
        961⤵
        
        PID:488
        
        C:\Windows\SysWOW64\Bdcmkgmm.exe
        
        C:\Windows\system32\Bdcmkgmm.exe
        962⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9528
        
        C:\Windows\SysWOW64\Bfaigclq.exe
        
        C:\Windows\system32\Bfaigclq.exe
        963⤵
        Modifies registry class
        
        PID:10264
        
        C:\Windows\SysWOW64\Bkmeha32.exe
        
        C:\Windows\system32\Bkmeha32.exe
        964⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\Bmladm32.exe
        
        C:\Windows\system32\Bmladm32.exe
        965⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Bdeiqgkj.exe
        
        C:\Windows\system32\Bdeiqgkj.exe
        966⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Cmnnimak.exe
        
        C:\Windows\system32\Cmnnimak.exe
        967⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Cienon32.exe
        
        C:\Windows\system32\Cienon32.exe
        968⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Cmpjoloh.exe
        
        C:\Windows\system32\Cmpjoloh.exe
        969⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\Cpogkhnl.exe
        
        C:\Windows\system32\Cpogkhnl.exe
        970⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\Ccmcgcmp.exe
        
        C:\Windows\system32\Ccmcgcmp.exe
        971⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Cdmoafdb.exe
        
        C:\Windows\system32\Cdmoafdb.exe
        972⤵
        Drops file in System32 directory
        
        PID:1140
        
        C:\Windows\SysWOW64\Ciihjmcj.exe
        
        C:\Windows\system32\Ciihjmcj.exe
        973⤵
        
        PID:652
        
        C:\Windows\SysWOW64\Cmedjl32.exe
        
        C:\Windows\system32\Cmedjl32.exe
        974⤵
        
        PID:12300
        
        C:\Windows\SysWOW64\Caqpkjcl.exe
        
        C:\Windows\system32\Caqpkjcl.exe
        975⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12344
        
        C:\Windows\SysWOW64\Cdolgfbp.exe
        
        C:\Windows\system32\Cdolgfbp.exe
        976⤵
        
        PID:12392
        
        C:\Windows\SysWOW64\Cgmhcaac.exe
        
        C:\Windows\system32\Cgmhcaac.exe
        977⤵
        
        PID:12436
        
        C:\Windows\SysWOW64\Dkkaiphj.exe
        
        C:\Windows\system32\Dkkaiphj.exe
        978⤵
        
        PID:12476
        
        C:\Windows\SysWOW64\Dinael32.exe
        
        C:\Windows\system32\Dinael32.exe
        979⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12516
        
        C:\Windows\SysWOW64\Daeifj32.exe
        
        C:\Windows\system32\Daeifj32.exe
        980⤵
        
        PID:12560
        
        C:\Windows\SysWOW64\Dphiaffa.exe
        
        C:\Windows\system32\Dphiaffa.exe
        981⤵
        
        PID:12596
        
        C:\Windows\SysWOW64\Dcffnbee.exe
        
        C:\Windows\system32\Dcffnbee.exe
        982⤵
        
        PID:12636
        
        C:\Windows\SysWOW64\Dknnoofg.exe
        
        C:\Windows\system32\Dknnoofg.exe
        983⤵
        Modifies registry class
        
        PID:12676
        
        C:\Windows\SysWOW64\Diqnjl32.exe
        
        C:\Windows\system32\Diqnjl32.exe
        984⤵
        
        PID:12716
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12716 -s 408
        985⤵
        Program crash
        
        PID:12780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 12716 -ip 12716
1⤵
PID:12752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abbpem32.exe

Filesize
80KB

MD5
627faa66949397eefb8ea1c6e983b211

SHA1
66ed4204c240b4a042288b40f43cd1e3a518540f

SHA256
e297dc09e566f296fe39a63d8bb66f026cd95eaf529733d03d2fd753e099632b

SHA512
7a91793b47093b130499727aa23a9ac1c4420a6610dbcb4e21b93f3f5135745ffd4a732af2c91379fe41554ae31e3194081bf182404fc57f589e89fa0878b3de

Download Submit
C:\Windows\SysWOW64\Acmflf32.exe

Filesize
80KB

MD5
70085642eb22e295197065b074fcdfb1

SHA1
b1473d508458d2b6fdd82fa9ae3fb546561e91e4

SHA256
2e3525c596fe6c47bac7bfc4589a043e98912cf09662d4254bba05e2daae4812

SHA512
b645c0df2a75b542561b69f50d16ecc27cb9d38a2a9ea705f9b26b6e540a21c7a1c94745ddf1ee99a7afd92e6588e4bdc46a9ca4775b9431be17d7e48c5727e9

Download Submit
C:\Windows\SysWOW64\Acocaf32.exe

Filesize
80KB

MD5
8b9eedda7918917d74f9dae6504d4703

SHA1
cd14061355842e3c40679a8453ebf5c1e31d608c

SHA256
add17ca354d5e89ccec5e17e3be4002950f0f1c151ffee1e1fbe86152654bb46

SHA512
a0a9fa408092fdad81b9506f04ac092ce05b84904ebe913c07342fb36db50e263f2a2ca0b89270da6b1f9f0ab539694b74470baaa91f2a8c531f316d0cce5424

Download Submit
C:\Windows\SysWOW64\Aednci32.exe

Filesize
80KB

MD5
a708048f07d384996e2f9bb4bedd8918

SHA1
b548e7d12e3633b15bccd670747e47b41ee6c6fc

SHA256
36a36944ef32bd01630028ff3db96b71ccf656401b23e64e1d6ced54eaf510ba

SHA512
8846701fba1c07f08076bd97e08cb96b7b973ce5b8486c3fcd752e3be6aa411caf5e76e5afbbdcdad1819dd1c0b3d7959ea464ff1c6325344c4840edc282cf0e

Download Submit
C:\Windows\SysWOW64\Ahmlgd32.exe

Filesize
80KB

MD5
fbfd9c05e86fe9153578103c6b970d86

SHA1
117e020ba8252aba578e7ea952b78d5c2d7c2625

SHA256
00985c75830e7e85a3c2804390f9e71dbd023a63158285ff663b4484c40b7f62

SHA512
a22821ea22c268d49b518fea2cba114ec1e1563b75631bb510cf02706566a046b2b91b4ddb93c9f3c08276fe315f950d4c768a169169122137b7dc966234426a

Download Submit
C:\Windows\SysWOW64\Ahoimd32.exe

Filesize
80KB

MD5
fd616ace43abe7d2ba93cbd802225535

SHA1
56697272eca7684b5b05cc1bab6acf740c814d09

SHA256
8a2173e489968950454b73d98a52b1b87df16202db9f6e416690b23796e21fed

SHA512
5fa1ba8f80b34ce7c05d77bd4b6c8c64303b2f7db1495d3ef92fc146e07f2480adcdc5fa2f66c3dd0eeccc51436e3231416ce069047375cbebafa1ac2cc49237

Download Submit
C:\Windows\SysWOW64\Ajdbcano.exe

Filesize
80KB

MD5
9c848979444997fd0a599befb9d443d8

SHA1
3bb924b0210a72f42f0d7ae0303bb0ef17cf3d2b

SHA256
82f2d5020f4e63daec970cbfb3642ea5738e8583e55e65e77dad29187cee5749

SHA512
b0d9f86faaa1dcdd39904dad8ef76906fdca83e8551c1d14e5daa7fa63d649b35d69d38a65e4f5660619d2c5e979c9bc689fe36e79e3310d176d989723d5d39e

Download Submit
C:\Windows\SysWOW64\Ajjokd32.exe

Filesize
80KB

MD5
514faf01dfe68e455fd21175a1375bb4

SHA1
b61e226566a19ef879c663e4e8c19cb8c834f234

SHA256
476083efbd64a6dd78c4aa55d8fbba7f56ced22297a6cfd4f088b4ee6981ec01

SHA512
b5a8cc78fce86edaee11b975cec5f881e5d14ee42970b9ea7bc0ee309e7894d1ff4c7b5fdf517c18548c565422e630e16992adfe9e0f31d4c5b64ef5b8ea81b7

Download Submit
C:\Windows\SysWOW64\Anbkio32.exe

Filesize
80KB

MD5
e1ca4d617162986c0c602c04eb548382

SHA1
294a5f863ed283d1fd9c2bd9d6f8865ca246462c

SHA256
0df7fe24b3d27136748252fb53105fda438bc80d36ad713abf66ad2f8fa579b1

SHA512
d8ff7e17f999e6635ef76b2aac3919de299f465f7377e5a4760c39448b34f7c6e66fd4c13223e6b0e1912a4ac9769f95e0b859f3a4d7649ced0923e3851ea811

Download Submit
C:\Windows\SysWOW64\Andgoobc.exe

Filesize
80KB

MD5
4beb1e01eed93331e09b142ab449f2ee

SHA1
cdbd28fb5a322e5a9001393aa5a468d7961785ef

SHA256
6f62aab243ccf928a40b9cbad27ab0531638f8467e9ebcfa15c1a6705bf32341

SHA512
64b06f15b433e0ce386b8603fa35e6ef33b550a40484433eb1eb18f032db1d76ec5071b0b1240c4c0b16c1a70abc9a44153e898fbd526759d003b67b9b9cf04a

Download Submit
C:\Windows\SysWOW64\Balfaiil.exe

Filesize
80KB

MD5
5843aec19be6095b607d2842e9e2d817

SHA1
fc75663e9887c850863d59c2d8e0a1dfb8494c10

SHA256
378354a135413c68371cc6e3d29a9d9e55b705b62bbcf101f5e790b8c53125a4

SHA512
b38eb4236b38b910b73e60707d7d1f1af2366a41c200cf9f895bd251374835ef522b5dca58e5dc223f5f1d79bb5013e4017e7cb723ccdd698cc17106935c1405

Download Submit
C:\Windows\SysWOW64\Bdfibe32.exe

Filesize
80KB

MD5
9133accf2eadd5da425e509ac979d8c0

SHA1
b87a4c78945051f2f16cfa9787eb294023c1191b

SHA256
6cdaff418b66d8a367c40c5f740538a30e7aaaaaf8e567784fa87ab25de1d59d

SHA512
099845f511771abde2e208248ed19d412bfafa7b5200a3b8e0613adb5818fbfeb4a102152e48bdd15586e490877b09eafa6a01ccaee6ae2848cd98ecc28b701e

Download Submit
C:\Windows\SysWOW64\Beeflhdh.exe

Filesize
80KB

MD5
844f8fd7780c1f0aa329009e7d4b18c3

SHA1
8d7e9535f713c1a5858377a30c9f9450165637c8

SHA256
c3c67e0f94d19d2aaadcabcfcdd3e98b478e55ffbeeb4b3485b14130fb8b2dc6

SHA512
a2b5f07fdcb30aef7b1d6ffe7ee2cdbfb576a13a3f4632b8d3a8d4542ef0e7725321dd6f2d747a3154cae10989b106e7a2b27ed1fd666bcedb5772a178092321

Download Submit
C:\Windows\SysWOW64\Bhikcb32.exe

Filesize
80KB

MD5
9b94bd0db330340e554b11fac3300095

SHA1
11c4fb89af389dc67372f84aa9201099d283472b

SHA256
d4aeafb94a8edd7da36dbe2ce4fb91ddf90455c0429326b610dd0c5e7758b90e

SHA512
c4ca451335e424cb3f253b9c2f8858cd98f2aad0b06e3cb0dbf8efb4059b7c8e3717d4c35a0bd58c2f14ffd865d5202ba299df56bd336f5ef3bfe9f0f5be9fb9

Download Submit
C:\Windows\SysWOW64\Bhkhibmc.exe

Filesize
80KB

MD5
024e94678bdfa671d8a8f3b2da93ad00

SHA1
8e933b92bcc97817781bba50e1bc5bcea50a4526

SHA256
88a00bad170af99cd0358bbba598b3c3b7bab9eea18431ee46ea070b6963203e

SHA512
1b6f294a4ba2d37a81cc8a4b089639b8e9086f399fefaf923afe73bc29835274e486023a1a6e77e2db37a74edeffc54c74bfc38f38f4a932fedbdb9b24c0c05b

Download Submit
C:\Windows\SysWOW64\Bhpfqcln.exe

Filesize
80KB

MD5
820e987836cd9d7e69eed089eba0045b

SHA1
c4dec9646d69f754be1d1d6f621328ff7a97646e

SHA256
e06feba0922a9b5d85d8e4f40c23453619cffe3ed2dc1050cc0ecf2e3d3efaab

SHA512
7a8c35b9eede766c5c69fed17049e20560c42e1b58b115edf86c58c1176725674502b515f3432d188e21bf6b21169c65e59d43756aa7a98492f1164cade34875

Download Submit
C:\Windows\SysWOW64\Bjdkjo32.exe

Filesize
80KB

MD5
414739552b2b9c915ba0a811cf8cc2bc

SHA1
7d8ea1ca252262cdb8d9cb78cb363c7672920555

SHA256
9dc164bfc743016829082df0197a1762f266b490c6cf55da98fb419c37780c6e

SHA512
873b0fb8bf3a48409eb59d3077e3df5ec85ac4a7658c21e6f9d738fae63b436a738160cf2fb9a18b58df23379fd4c4d6c59243d1c25dca97f7b10782793e643c

Download Submit
C:\Windows\SysWOW64\Bjpaooda.exe

Filesize
80KB

MD5
983db8d34a078d9e7fea26ef382e1e9e

SHA1
e5cd6592034e034071c5d0c2ee81e8722be341fd

SHA256
2a84c29abc32ed689d6f38198254bb94770037c54da0fce17687163ed3442a05

SHA512
b2ba884893f030243dee639d59932534ef1466914321a41ed8b78127dc205db6d183aef2b87b8c44020217d9ac6420db9db4ced0bfaac8d40e6220b89bdc0a21

Download Submit
C:\Windows\SysWOW64\Bobcpmfc.exe

Filesize
80KB

MD5
55e1efc7d3424201be60fc11d9a62b53

SHA1
41465b6303dffe23d4c22592884f80e7974f1d28

SHA256
cef44f8820aa92b7fe7b2aedc30adcafbe4198c7e25fd5af900e363ab5e43f35

SHA512
e3d0fddbef90ddffdbe8a3f51be4b20d0a25b9caa3c3537f5bf4e3d9a5203d9b49b751c2aba097752c39cdbe66255e8ebbf79614be312121902c02e22aa2e886

Download Submit
C:\Windows\SysWOW64\Boepel32.exe

Filesize
80KB

MD5
79d101d07a11cb2e70fce7e319e229a1

SHA1
3b730355e672c6b7d387c2ce41463e95959eaa81

SHA256
43060e6659ccf12caa77b049dc6c030166f7eb3fb675df033db59ca819c70847

SHA512
0da34f2d10a7873b3084056c359cbb8727f08e1f76ef8062401e10a3b19b7aa2c4b66cf62c82e9b08257f962b06a1e43a32b4329d6e29fda9f756fe5461e2a27

Download Submit
C:\Windows\SysWOW64\Bqmeal32.exe

Filesize
80KB

MD5
62e6a32b2d44f793c31e5af4ef91d8a1

SHA1
02a94a9b15bed3424f56a7aec02cdae508e35448

SHA256
a9aeb43b395a1cda70b2a662bb7bfc1e321081299043530ea8a68e2a1f3bcb26

SHA512
c917d9b47a82b1b8b8b1965e48fe0cefc3bcf2b30e94888a459ccfdd8bc289c18c24e9eb0c65250aba5c6cc2ac1d6d2e2a8ba6d09891f67bcb3805df721db68d

Download Submit
C:\Windows\SysWOW64\Cacmah32.exe

Filesize
80KB

MD5
3ec5eacd856ec4e9845c2eec42e06d5b

SHA1
c99ee8c35420982a66ac9054a41c1faf1327052a

SHA256
aacd803aabe9750563d6f67fb45716a3826c7607b76d18761773393ee74f6f20

SHA512
8c3ae161bc58553e05f4fa1c26785b4175b42af2bb343412d4955ec110987ea526bbc4640be3ffdaee36cdb264236ee2351efb61c8f5ab250b13b7a2c2d59796

Download Submit
C:\Windows\SysWOW64\Cajcbgml.exe

Filesize
80KB

MD5
cc6ecd82e664168966d75cd62bb99098

SHA1
f256d5b12326ecb6dadeab617ea058685e289f3b

SHA256
a14d476cf7be3317e88a2c14b8f6862134085a6cf69b852fd083a2193252456f

SHA512
19d57c87962916cce53d83868795b52b711af742dbe544a5cc5db240433d8a68ef5d22cd6ee5c7cafa42401d0bb546a6eda0a3a7235bab0a46c99bd734506189

Download Submit
C:\Windows\SysWOW64\Cceddf32.exe

Filesize
80KB

MD5
0dd824ffbf0c1981c672c49797064277

SHA1
a0106f6a22dc64dcf3d8011561401c628177c8bf

SHA256
c512fd89c8ad9d20351f9f7035a313ed84ca4bf3ee247c93408fac262d8bbed6

SHA512
e32f32f0fba4553289625080fc3452ef7809c75d6ddb4b31c73f63e9416b1d779a09bf83f7422de9d2761a82dec77ec0b20d1708694f1af97adb11eae4809461

Download Submit
C:\Windows\SysWOW64\Cddecc32.exe

Filesize
80KB

MD5
bb99bc7f23490a681c5d89ac170e582b

SHA1
178001eea0be399605fe3205a07a7ffe201ef3bc

SHA256
e7c24559604345c4152d2a74fc39cc7780761d6aa01a9370031e367282d430f8

SHA512
c3ace54275ccefc76aa10a023a2ca8da51303d2ba1545bfaaa5e1440318eb434651821d9011b4b19f6e7981541eb618b346d65926415db4b0b0598d6800b301b

Download Submit
C:\Windows\SysWOW64\Cdmoafdb.exe

Filesize
80KB

MD5
a8ce2ecc4c9e015050e3339ea7e529f7

SHA1
88fdd3acdab4fa9f48ab8956ca2b2228bf105c63

SHA256
110cb898e7aa594038e6185d945de37c870c662a08e934479b168ffe47387486

SHA512
ac69211a11cb705b3a45f5c64c6f777b40aed214d5dcb9bdcd969b2c56d38b929ec3f796656efc10b85d0613ddd117cbbc22123ff6f6a3e43e53117ad4aa2659

Download Submit
C:\Windows\SysWOW64\Cehkhecb.exe

Filesize
80KB

MD5
526ca6f9d8e19a42bf6d332d3a6c8040

SHA1
0689347b81982741df8c9b15799d5e2ea72a895a

SHA256
09992e4214bac09b7a81d8efbd8bd205bea449da6a892aa3c54c412d2a3da1a7

SHA512
e68455164b1897a12d46ea579ea9d98a4dfed592cd1b70839cdfa1f40d50aa2edb02981c6d75eb104eec96d5002241844c8092595569caef5d9c97b2547b73c8

Download Submit
C:\Windows\SysWOW64\Cknnpm32.exe

Filesize
80KB

MD5
a28279151f125bb4ae35527173ef9d34

SHA1
8d360fe437be0de4dc5996f3f122b641e44998a8

SHA256
1a408e8956222b6329d717a41081415f4524df2b51c7d6e70c99507c42d7bc32

SHA512
4c9ae4317530fef41fbcd96f622c25c809580ed47e1d481c0413fd8ead9223010600a717b12b0ce7d5997ad5f10894bed1a977e048125ccebc05b9a73bffc16a

Download Submit
C:\Windows\SysWOW64\Clbceo32.exe

Filesize
80KB

MD5
fb632159c92fbd9f92a615f78b6720d4

SHA1
4af3f61f33c60ff3bed986f52b244b819e957fe3

SHA256
0c360c318d4e26bb7d3f4a63551f9424efafb6aa124d59fd4fda3a0ed50c5c7a

SHA512
bcbf595938f5967f48d0518506bbbcbac80202d5d13e54ecd477141706aca2a3752f585863661f56fdc925443f6dfec01d7975f29eb6c54c30953f6e69c50507

Download Submit
C:\Windows\SysWOW64\Cliaoq32.exe

Filesize
80KB

MD5
9f090068ee249d47944a1eb0a976f580

SHA1
e6c8e7ace89dffa5754a751e2d5dddee816731f5

SHA256
f12af82fad604303d36fbbf8a3b5d6756988c56b5c3754ac5b68bbe25189ec23

SHA512
f36e8626265cc146232937a9b44e012c3a95d86eb60690756a61e7a5e9babb645c7616857fd15141e00ce42cc901bdfc9528449576a06cd45cb19b6fc9ef1347

Download Submit
C:\Windows\SysWOW64\Clnjjpod.exe

Filesize
80KB

MD5
981d78f08933a6213c7b1b393025c3ff

SHA1
b7d647c81f03b575b9f8908e47da271279a90f63

SHA256
28d34d469f4f7e2ab3b3de59b59317381cf054f9d3a335ad77723949441f393e

SHA512
9202a81ed688fb0739b809de6a37391955dea75d2c6d1ebf36b6164b534b163e637c31659c64703eb3a3b098d800147111c34ccf92c108cda35147693a73a14c

Download Submit
C:\Windows\SysWOW64\Conclk32.exe

Filesize
80KB

MD5
7d026b4ad121890cdcc51c71bc62db8e

SHA1
2002cd428b57458d432881b44897f858c2ab019a

SHA256
0759f34afed844aec10420e2dbfd1054e794687200dde777fe4ce19ac2b80237

SHA512
9a1acb96ef5a28c6cfb9239bed18aa78d7028bcf3c89731d517f53ea27f6d3c3ecc8f83f7f25fd70946131b054b70774571f621b530f4f42f157dca72baa41b9

Download Submit
C:\Windows\SysWOW64\Daaicfgd.exe

Filesize
80KB

MD5
f5beadcb592e9e7113660b1b0db1c45b

SHA1
31ff7fde187b870fb25bbd5e3b40836a7d7a3779

SHA256
55f1502cbb220547480f6f8934da2f516696bed536769702ee54ea92b7e20271

SHA512
1e41a7ac0d981bf4292e03c28b06fda7e50073f3de5627eadf2cf8770f021fa9a02c9d3f76f6ebcac453149553ba8a90b437ec284cbe073f8c2d6013ce242607

Download Submit
C:\Windows\SysWOW64\Dekhneap.exe

Filesize
80KB

MD5
b1e35a3075d8183e96e7443e4ca31f94

SHA1
5c8e658432bc953c6ebedc160844187bb4e83fc9

SHA256
ffe9035381e93e87b013186efb58cf8302d72e9246526034d9e44dceac8e3a17

SHA512
94077c7efee69cea75e1bd151e4666bcf8d91014224a187782ecde90801d68a7bebe5ea2dd361697d63bb9f84f25ee0db343284ac884d4fcd428bb44af0090c7

Download Submit
C:\Windows\SysWOW64\Dldpkoil.exe

Filesize
80KB

MD5
acaeb80dfe8a253c6b9c270e76b552e7

SHA1
16a7568df5b6b2c86f76f5de63ce5cbc51d9017d

SHA256
7a13f9f61afe1e9bfd3ee884ff1fcb34a8166c3414ed738540eec7618d434c67

SHA512
f53d0008e7a2cfb3577d5b7108597fabf7bfcbd7152928cf80fcd66a58f798daf1236c8b8fd9740f3e84643004e2d5bb7b45c80ac06332355ad771c622d2d987

Download Submit
C:\Windows\SysWOW64\Dlijfneg.exe

Filesize
80KB

MD5
9281d8bb101285a898add073045acc4c

SHA1
9bb989b806e69f1b121221d9486faa1d707f9be1

SHA256
cdcd67bc0b419f2f53ae3b318d654e172bcc5f428dffefaeed902fb8c75ddb42

SHA512
8206e0630067f94d1bcd04b96ad5360ee4134e21fbfbfab43d4c39f2e6aa2013229f8ea4247f1cc4686da0e607f34e1be9dc9008e0374a68d257af5301b7c290

Download Submit
C:\Windows\SysWOW64\Doeiljfn.exe

Filesize
80KB

MD5
bef89f0b2fe7e35a3eaced64cd4206ac

SHA1
41a7c93ccad9900335e73976785562ebdbc6eff2

SHA256
795d192facb25e7d3e0f70d9330067e2189bab7347cc0810b57f8dd73360dd6a

SHA512
299f023c273ac9c4be5a63d3a05cf120c0fea7da82f3e528b9a007cce00b7741b253e3f8457ac29301d91eb1cf6156c90e6754a972824c374001f49e65bd0c3c

Download Submit
C:\Windows\SysWOW64\Dpehof32.exe

Filesize
80KB

MD5
3c35b45e8128559774e50e1cb484f23a

SHA1
0a7f4778f5bbc4e15aceb20fc4039de5a4b15328

SHA256
94dc863342d36cd36f1b5ccc9c320edb4e9db17a5bd82adf4805c3265545db50

SHA512
6f1011541508e08e60b804d82a0e02071882ea835bcd684a651a740d56310c6a8e0a3bc7165f0de711f5e119f6f2b9fb20a1f523806d0dcc45999ddd086a32fb

Download Submit
C:\Windows\SysWOW64\Dpnbog32.exe

Filesize
80KB

MD5
0576b731ae8872a6eb5453a280f3ab6b

SHA1
0ad5372bfb7ede62c294e9dfcd33faa41668bd83

SHA256
bfcd0afaca5b783b19aed234370731b599c4eaf5567b033402c6fc4ae4cb6b54

SHA512
0a7f25f0de4bebd8da88ad53450d4034a42f7b057cffe5d130e222b848c18f818b9ef440848213bd5ec0fa75cf2cc8c2b69874ba2392349ea7d9fd73c417f946

Download Submit
C:\Windows\SysWOW64\Ehedfo32.exe

Filesize
80KB

MD5
ae57851723562c96e1a81b3bf0bb2012

SHA1
992a27f9f0319dafdfb1648622a8afac0e93422f

SHA256
11b0071084f7f83d2f8e97e548be769cd3d3e54926a8762268cca17728b9b370

SHA512
ca495d8d31cda18815ee8f5718ccc08d9d0a23f0684edf0ec390369d120dacd17d2dde40039f6823e9475aed6db10dc7c607bbfce84a47ef4bb58db309d88543

Download Submit
C:\Windows\SysWOW64\Ehkclgmb.exe

Filesize
80KB

MD5
478ff04bf1cc2c5c5cbc5cddb9b1dc9e

SHA1
8ac8ff496018b3878481551fb47356aecce95513

SHA256
429e0e6a0e23281ffb24828f7a56b1dfd5aeb8ce3aa36fe3ff43080b43bd58ed

SHA512
40f426b93dbdbd62aacd26910059383d873c9f4f0cbcb2e88e6ff6f9e2202a8e90c756384caa5c1b25caa45b0df7a780fe769783b594464fe5148e768088c480

Download Submit
C:\Windows\SysWOW64\Ejchhgid.exe

Filesize
80KB

MD5
c425eed7f5fa30ec11f3970cce41d586

SHA1
1bc10575212280801714cb26f455defffd9a647e

SHA256
37bb4c74a7839f4a25a620719367f7003c3598ea587454f0f4bc2ae7fe263211

SHA512
750bdc4fdefa4b6b59c4dfad34ebb99d66f67edee8689ecbdcd08276cdbef91c4c5177fb9e2be8b35e96c8d3f13508203f7f6be1a3b6f78d58a8fe9bab9198bd

Download Submit
C:\Windows\SysWOW64\Enbjad32.exe

Filesize
80KB

MD5
04b82cf3e0b429e5cd7b2fabc2e19745

SHA1
839ef6d8242696f161634c059082a2667c12b942

SHA256
3e632c43d8c061361be448ca4cc20898c15e4118837162428b67d70936c85402

SHA512
e516d2793c578fda11dcdb66c45373dcf8fdc593893e01b68049987eeb07c6c4258f8388f209ba466487228934d476a990edca0325bf0bb22ee4e01b9091e1e2

Download Submit
C:\Windows\SysWOW64\Fbelcblk.exe

Filesize
80KB

MD5
15a0c082f1932bc40474d3fd3a3b5d73

SHA1
7e75b9da350080bffa94e738a60c20c7b909ae2c

SHA256
136888a71b256855545fd9644271f25cfcdd96dc40390cf1ce26bf2efdcca17f

SHA512
b846269d29b6ea3088b0fa4b932b4ef5483ae2e79169afafc62c6b5e83d977a926f803480a4e9605b4d6f8a682ff2c92415e7c718e9a71dd6b029974d612b1a9

Download Submit
C:\Windows\SysWOW64\Fbfcmhpg.exe

Filesize
80KB

MD5
19ad433f80eb399127758e41e932d931

SHA1
258d1b31a01fbebe26a65a15d9a9e4a18134c459

SHA256
6026c0416463b71aaca029820695857ef1f234b57ab73b6310a58b160e5a4046

SHA512
884febe612937c8155bef7b8fcaf50316af1f5d6fbb91d279093de529a80c4dcb204ee7e881e480858f730705d64d5f5635a9638367517ed66fc02244bf8ac1d

Download Submit
C:\Windows\SysWOW64\Fgbfhmll.exe

Filesize
80KB

MD5
8f424f040d9c36a24a3ca5ae7a8111e1

SHA1
6ae581b7cd5dde3aa7f20a179af3bd3cc2dbcf2d

SHA256
58863d2a44a8435ec01cba661c1bef987de2e225bd6507122b4b5023360ad825

SHA512
5a30a30970842ef8652d72f04654e0785da2d5f49c4f7a03708034d4450ce278612eaa2bbf33c630e63edb131b28cef8b841d2f9dd4dcde05a72202904a2a2f2

Download Submit
C:\Windows\SysWOW64\Flpmagqi.exe

Filesize
80KB

MD5
aeeb046ab33b2804708c22b3adfe1d03

SHA1
a3f6316eaa6a50ed705222bed505638a48c885e9

SHA256
3581545358b7f9e0d058bd289b3938f6d397a0e1cef768f133edaa682a303e82

SHA512
014b0abaefb2140bad4e17176ece4d489cfe86c39b4a1944a6da2af6a05ef1309c80a0abbbcfe23c0f9cfecb04dea8c1d9565316ce3eafd50a988ba797123fd0

Download Submit
C:\Windows\SysWOW64\Fnobem32.exe

Filesize
80KB

MD5
272906a2b70ed08b1c743a584fe5e1b3

SHA1
6703b183219f47c182fd461aee004935dbae048b

SHA256
800b65c7dd341b39d74e3b638888e25c8deb2eac81c50271d3aa012577614e89

SHA512
ca99ab236e821e1673ecb2709795254dbb1f5638a71468dec0c03f4cbbb9865b6a99e1063d51b7fd58e2224f8138eb52a938592530228f44d3292bcafb497d4d

Download Submit
C:\Windows\SysWOW64\Gcddpdpo.exe

Filesize
80KB

MD5
2c104c282f72f3d7f2608bd3c9ccf349

SHA1
c9e793ca36ce83a8618e291e00ccb853ed156841

SHA256
16c2b6e1481f28b0d56cc50f0d8e99977ac7dc6c545f3f3dd251992224373dd5

SHA512
1f766cb5d71379d17a70955de24eedba031990fab112bbf73bc15bba2b297aa819406d1aff5eead3c0f902304dce77d62ad947990b765255a1d99c9aee41cca3

Download Submit
C:\Windows\SysWOW64\Ghniielm.exe

Filesize
80KB

MD5
ec881ede712278636e5b9e2d944afafd

SHA1
c164a633f351b3d6f8d4a497635890b95123d3f9

SHA256
b69c269e8a607f720744e90adc4e66c05e8c7bbbc3a7e34fb39f44f62f7d933e

SHA512
7a0ee95636d6af92b9289672023f1951e0b9b26919c84e483351939bfc1a6bb5558795a65228ba2965b902edeba89af63ff35ad6b3be26f3b1adfb6a4fe9ae51

Download Submit
C:\Windows\SysWOW64\Hcdmga32.exe

Filesize
80KB

MD5
568711f98ceea8ff4483be868348599f

SHA1
9307f724789da877a5c6f073bb7e243df355f6ec

SHA256
291b5d5be11175a2b81eb2b87eebf0200c1c085936d3a77f9612098ccecee781

SHA512
84ad3fcd4a9535ef7458c201e158cdc781686c17d9628c046e63eda38cddcdd62c36bd55aceef822c21a30d03411090b78709459ae8e0c89c3e3c4870d113309

Download Submit
C:\Windows\SysWOW64\Ifefimom.exe

Filesize
80KB

MD5
0bf8fe3b573a69a0da9ebffa590c9e0b

SHA1
56ef80d07c47ace244674f6532830abedb2abc68

SHA256
50e7f9a038b064767ae35148f07123efb411a0d55c168b24addc2cdfca722e46

SHA512
a1eb2c9f892eeb25d114f6666ab9e74a072f99cf36777948b840f2640836296b31c6385478c2849dea4be6b371df31fa9777b06a62bff5b98563ab51dc8d278b

Download Submit
C:\Windows\SysWOW64\Igjngh32.exe

Filesize
80KB

MD5
c217d44d7796bee2ba416f48c6fa5cb6

SHA1
e228cb14d30a848cc2221ad3fbea18450a7c5c3b

SHA256
cd3c96cc5266937eca62edc54085943d92fe89aaf7ef5edf6afd279e6fa7b967

SHA512
ff9298538268b32657115dfdffa809d7c51f4d57d726ce60c42db96249dcd7059fe19c4cf128ffcf9ce7cc6dca307940905072b46a54f68592a7360522cd3603

Download Submit
C:\Windows\SysWOW64\Ijadbdoj.exe

Filesize
80KB

MD5
2abb405a8d9e939e36025e1f71b71b85

SHA1
dde86b7f1e04131a2a82a3911070484b971a6b21

SHA256
ea14155631c062538edddd820c2dc3672c718cfd5636d5ba457faf92a1dac9f5

SHA512
43b07bd043ac35670d7d4f92a2afbddc1d1a4a6d065eb8623bc3e130c9cbc86eb01e18fb87bc6d9dd21253e5389a75ab3b91e065149fbd589dcb7e9a82a5e76b

Download Submit
C:\Windows\SysWOW64\Jaonbc32.exe

Filesize
80KB

MD5
4cfd3102dc9f6ac09c68a821a7af0697

SHA1
6bb41813b4830f55c2287b16817472017215b3bf

SHA256
61bb5e6604c1e8959d801695b593f933c9a2df70a1b7629e4f314a86138d49d6

SHA512
4b0a4d36d974e0d3ff06555b7d2954d539cddbbf5b682b78b6f5f63561873579a32d7660712a024649cb3fe105c8dad650b654b7a5284038ce9a9cbfb07d6f8f

Download Submit
C:\Windows\SysWOW64\Jfeopj32.exe

Filesize
80KB

MD5
278af30759d3a6a301702079badd60d0

SHA1
2f7f466503fee995c21aeb8edcf8ddbcb3435cb6

SHA256
5375c84e0bcf436852758057d21e39ae1417898cec1b549abea9fedeb75ad1b0

SHA512
f388d631a967eb166fab960ce369faf9356fd2aeb4f7904dea7efc1e8e5fc226db42d8ad7fa52af26f7044862d6a8713ea83dd559f670039a16da7a70c8e1917

Download Submit
C:\Windows\SysWOW64\Jnpmjf32.exe

Filesize
80KB

MD5
3e8b9a55f18a34aca30f69c8569258f7

SHA1
6ac7f9cd49e11f4c0286dc615fe2c000cb64d4d1

SHA256
915302d9f8338c6170e500eb9dbdfa20f6b881cb5c89d460e05c2fe35d6445d2

SHA512
b76ea51ce29b236de147348e69b162301a4ba83e0887c586ff569167641ea27742db8cbc29c8157c8b16562622173f52652f94a0a79f6acc5939a3867fc88802

Download Submit
C:\Windows\SysWOW64\Kgknhl32.exe

Filesize
80KB

MD5
dbe96b2fdf5ba81e02ce70bb86f07f42

SHA1
03920d91cdf72c2b338e446b6e54450538c2c4cd

SHA256
3a64c3a322a28ffed9960e16ed77aeb60ef7827828882d5c2b5b7af3df82c1af

SHA512
381c8a45619762ac7ac3f4bc1a4063fb35916ffb057e5322a9c8a286f171de8a67b4a09f05536b6f8e556579139834a6b63b14b5467aed2b9997b6338e3785e8

Download Submit
C:\Windows\SysWOW64\Kjeiodek.exe

Filesize
80KB

MD5
3afa8ffe167535b23d20cb9264a509da

SHA1
d2b012c9e0a7fcbe11106da73174056fa3f47e65

SHA256
859134365399a19cc8333335510c9fc9f107e08784115724e4d8eb8b5c54dbe6

SHA512
8ae37c29001b7f3963aab9aa023a035948d68d2fe9ee4581f6e092bf91cb2decc600ae0fd5613d12ff2d0d712fe659fee66f9357970af8ae58c42ddd529dfbee

Download Submit
C:\Windows\SysWOW64\Lbpdblmo.exe

Filesize
80KB

MD5
0d1c54a56cc3330f12fcfb57c766b006

SHA1
1d03188678d876bfe45bf9ee797c89cdf57c680f

SHA256
dca8bcacac13069fe6cc495549718cbe5538f3089226d87d23850769d8f926d9

SHA512
703a9a8bdc3af149f8fe66245cdbee7d42e40b74283ee064fe7c81b13c8fedb4c54b01d76737e24e056c45cfd927151a453371d68b42e4f789522f3b5aeb923e

Download Submit
C:\Windows\SysWOW64\Llipehgk.exe

Filesize
80KB

MD5
8d7187d0145c8f862ef7fa5b0b0d3ed5

SHA1
c5066f10b6975b1c842529bd19e7af749b778a66

SHA256
64be9e8dc556001e315eacb212ec29593801c64ff6e907df11dad22e2ec26b0b

SHA512
5c3b701892e766139852fe77adfb9cae93804b605d5dccc5fde28cea86245a4b354e6918a639c3a07d52ef6ce34f59d85cd827b473ca7360652952dd1ac1c02a

Download Submit
C:\Windows\SysWOW64\Mifcejnj.exe

Filesize
80KB

MD5
98e41d316fc543195feb4edbeed94867

SHA1
dbcfc26a9ff921c3c2410f41910c39b2b098ff97

SHA256
ae785c3eedb6a4a9a2946e10597282d005f58b10419ed6c91649c5b79f38f573

SHA512
192ed044751395dcc6fb6e8fa9007f43cdbde738d56dea79acebc5f0b3a9591e8fefda27607af059ce6150282e3b5d79e0938ef021267bd4f684c6029e722a22

Download Submit
C:\Windows\SysWOW64\Miofjepg.exe

Filesize
80KB

MD5
34834db756ad81a2827ab6c8b41bd49d

SHA1
223495700fc94711615d04d5b2c5ace7d35831f8

SHA256
5422ce550c7604eca8a42b9d3b1a4db6af5d42923b302adf166dbb3af4216387

SHA512
755f07d4a68283a4980425d6a68590044bbbf4b1af9667ff01af047a4073edd333eec91f9be913953a6e1e724ede3b140701de9a4f1084afb6b893f586bc8939

Download Submit
C:\Windows\SysWOW64\Mjaabq32.exe

Filesize
80KB

MD5
d4f13444b0c88091e6287dfe94817757

SHA1
5f1efc2a9e8f096973acaad05716c5a8d27bac55

SHA256
879f8407629df1515173e1afd9057d39cf1fbda7d8d4161772c94346be63fdd6

SHA512
d927fa6805c6f42abca7482cf991de88ca4c0ac654ec887b877ae6b4487ba1fc6a77f2fea17f12c7391746c0f1cb3212f4a6670070b51c6b9a3b866f8ab5200c

Download Submit
C:\Windows\SysWOW64\Mjellmbp.exe

Filesize
80KB

MD5
e1a6d138a41350c6b484b480866d2a75

SHA1
47aadbc501bd4a491fca1365344b6e3b621b1a0a

SHA256
0e2de460460e3879154dd2ee4086118d82064d57fa5ccac6af348297e8a92ae4

SHA512
3061dacb19b4d84aecdc6432291ecf0796d2c7074de1c7506cb9a4f24764d0781af5af7956458838aaadbdcf01542ace25b1ba570ccc898517467fe40a198275

Download Submit
C:\Windows\SysWOW64\Mjokgg32.exe

Filesize
80KB

MD5
90fd0f96babed674de65baba8aafe79a

SHA1
c279f5456ebf48ebdc7332e4285f20ddc524e6df

SHA256
10e76ea88c663548b472d09086cb9e7c53ae3c2a010423bb5fbe6d320752b27c

SHA512
8974875505671a1f65c728f5da9204d7cb7de0737463dd1fef8f438aed4a6e684b21d92085eec8e45b268067e587480e1e6f251d98b711a01f1efcbac325c425

Download Submit
C:\Windows\SysWOW64\Mnebeogl.exe

Filesize
80KB

MD5
70664bb8cb4b6a5dafd00056219bf27c

SHA1
cd2fcd7729a48bf2c6cc3b3d61b35e7334b62349

SHA256
a2e45b9d602669777aa30ec37605033bb56dbf606059c1bcbd9870c1f4777c31

SHA512
64d6b0f549fb60fc7049a137e9993f798444f79fe40a5099ca27b8f3a1c809363fe1e418049eb7bbbb4ffcee6e6bf448d0cf81f7360cba8d6496d5de1d9309d3

Download Submit
C:\Windows\SysWOW64\Nacmdf32.exe

Filesize
80KB

MD5
a7e940e0132c1697511a01c9bfdd388d

SHA1
0f68a2ee97ff5462a04a30364f04914942672645

SHA256
f6e1aa8da8bc13fc061ef7e8193b0b9dc1d80284928391d3f5e9f3694bdaea00

SHA512
1bfa2fcd432ced016f3bbd88cdb31662ffcffccfde6a00940366680a38f0c192fef9a88d489a8022d069c09420f419cc630b17c805cbda7becb007a3081fca8e

Download Submit
C:\Windows\SysWOW64\Nbgcih32.exe

Filesize
80KB

MD5
ba8c7e54402661e266f37393e74fa6d4

SHA1
b249f24c4d316478e8765525d3780ec1bdb7a17a

SHA256
1cbab625ba325747c7fabe674206196d92abe8eab660e83e245aee0bf2d82b4d

SHA512
d33bd8cae8e156f75ec7e447bb303b07a5e4ccad5fc280180bab900286f9b5ace91d3ec7c3b31b724d12b6150fb7043926c1f3c6873a88222c1ab03dd5f01a8e

Download Submit
C:\Windows\SysWOW64\Nfaemp32.exe

Filesize
80KB

MD5
6028b1fa9bc08f6671568962737a56d3

SHA1
6194552d26197b727117c388117d3d3abd155362

SHA256
b57819c874cb5da98e0f6202291a6e49c79a80fb99055464dd0e8a5d3aef782b

SHA512
208dcd7fd7f72c506471a2ceea7a9dc031695222b0b8dce8e9d2e9c840d49e344283af5b0a42a0a59b4332aa491b9b1313e9b6c7bb048843c6d08b6a8c8e0d1e

Download Submit
C:\Windows\SysWOW64\Odjeljhd.exe

Filesize
80KB

MD5
070b1e4bc51be8f0c20168777ab83a6e

SHA1
4a7f6ea4b39b957b9c790fabdce7495e79e6eb53

SHA256
c504af2f14826f76754fcc3ecb2e6712916a9ea9274dbdcd66b095cc5a7ea53d

SHA512
5e4799bfedec0c4b91b23b9c754f7b14b7813554403a9ff36d8279958261ed6d6538d11e87306de0b28088553cd3e4707dbf0b6f0fc10640cd112d7efad851c8

Download Submit
C:\Windows\SysWOW64\Ohnohn32.exe

Filesize
80KB

MD5
13de87f34e6a4749484ebdb4c878cd97

SHA1
26bd495201f4608141065224cc8476314d9b9f80

SHA256
2a15b6204f78c26946d9ce8c63503c0fdddff1c7984fe03567aa189a57d0f25f

SHA512
914115c010d5a552b2becc8f17962f0e9eb70478bb2995bdfa625ed8d3ca6a29678076bdb5b7b9a35465b054e8ef20bbe7ddbfc2f1ef330acc6ab237d63f49eb

Download Submit
C:\Windows\SysWOW64\Oplfkeob.exe

Filesize
80KB

MD5
0b6ad72a1a96a0cead5be8199ae97f46

SHA1
3bd89403677d18fe8ab7b33f234f942ca2709d8d

SHA256
d87d72e4a8757c459fb05ae89d075120bf6cbcf8d9a866a32069a71c4fece9d5

SHA512
99cab47d19447aa00e87e99aab0e29ac5bbbfd6f31739ea500fabe629c6dba9c2c04a4d1f0bb4517bb5a678cab588726df2f25545f15202f51fa1d16ae748108

Download Submit
C:\Windows\SysWOW64\Oqhacgdh.exe

Filesize
80KB

MD5
bd3f46339454e37b94facc5def8c3690

SHA1
77e526c9789d13a9b9dffbdd1b701198f9dd3a9d

SHA256
d37b143a284dfddc9877f35a19e6ea5b7f621621cbd5425236594fec48280aaa

SHA512
6d2b296df32dff027f386fc7a674357e7a43fc7953a4b62926aeff526e11cfd2b23b5d6748fe1908b283666063baca65366c2321fe845df0f99bff1c2f1d7283

Download Submit
C:\Windows\SysWOW64\Peieba32.exe

Filesize
80KB

MD5
341dd2d77623852bc6221508b4078e2c

SHA1
12d622c4fa1df5d64e618300928912d11d6d9beb

SHA256
fea539655f04b598dfb447ae54911040b68a8cc039d9e20c8915ab1b01e75033

SHA512
ddbeda245d5f393e49821c761f27f365ee0e4d0fe97c44faf955c79acbe4ed843cc034e460b2dfee3a89e31e0c62bb7483704a8bdd2ec257e3b258ec384ab63c

Download Submit
C:\Windows\SysWOW64\Phfcipoo.exe

Filesize
80KB

MD5
d7ba2ada711c1a459adcfd5b870b7f86

SHA1
b6124def85f3a05cede41a94767da90cc08642a1

SHA256
45ff900cb7c7abf7b6d77f72b960508e81d4b80ef8fe56c7de4b4fb041b92e77

SHA512
0aa6be8dd4c9c07f670493fcad6014cae2cc683799f47079003f56914cdb1768ad99f4763f9e6ac2f171ee1cd5782961a13fb28f517d064240485bd3ecd71e90

Download Submit
C:\Windows\SysWOW64\Piocecgj.exe

Filesize
80KB

MD5
3ec1647f30af1900bf0f13db4d0ed0e6

SHA1
2e7fed91b9189dab3ba606de5ab76e8d4f8730e7

SHA256
41b940150d36b092b3f80e55af982cbb918756ac24e93889b0df6aafdbdce217

SHA512
cbdd4cae7c8b1345b6332c636afed5a72b1636c6abced46cb784a7e06dc9612338aa6c1db82ad425899635a8c2a30df8d5d24f9158f8973d1809ad5612d0128e

Download Submit
C:\Windows\SysWOW64\Pnifekmd.exe

Filesize
80KB

MD5
5143d876825b02dc57a02af251449c8e

SHA1
d12db799e6a527dd1a1e440cef4c89d102a9a3a2

SHA256
ea9fedcdbff0d5b0ef56f4e12906a1b39fe59b1bd74214f9f4da74ffdde6c6b1

SHA512
38f0e411b0a8b08d5cc8cb194ad660b5f61108c850c6d1289ac425cba5d79315d4b7aafd45cfc74390eaa23b88b5fda6960a90b4ff0e7cfdfe6a6cbb6ea45cd3

Download Submit
C:\Windows\SysWOW64\Qbimoo32.exe

Filesize
80KB

MD5
3b22917fb7a7b4b0e4abb84e005aa4f7

SHA1
a583ad66c940999b4947e37a41478f901f646587

SHA256
8c01b634177a0bf0b3fb136b7eb27303074f9f23de3ab168578658c333e4fcd8

SHA512
df8b48315f1d1ea971435eecfce1b08b61dd340ba099710213725f08b3bc8e83ff037574770f15ef66de38616a81c8ff5709f1223f20418867fbc69fea176b27

Download Submit
memory/212-118-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/212-221-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/216-5-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/216-72-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/216-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/712-235-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1072-319-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1072-248-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1140-117-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1140-33-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1412-130-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1412-40-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1560-164-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1560-57-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1640-317-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1968-326-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/1968-256-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2152-173-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2152-247-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2412-82-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2412-187-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2548-320-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2620-135-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2620-230-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2676-183-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2676-74-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2772-300-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2824-25-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2824-108-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2908-312-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2908-239-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2960-285-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2960-205-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3008-104-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3092-177-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3092-65-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3116-264-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3248-293-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3348-292-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3348-213-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3532-192-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3600-195-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3600-92-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3660-284-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3760-113-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3856-278-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3856-197-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4020-306-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4128-286-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4184-153-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4236-90-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4236-9-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4372-299-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4372-222-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4432-271-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4512-168-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4644-48-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4644-150-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4700-327-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4772-134-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4784-182-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4924-17-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4924-99-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/5008-159-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads