b1a11b63d514f648c7a0f71e20ad78d6bf528126635a6dececffda0085310a36

Analysis

max time kernel
124s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 22:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1a11b63d514f648c7a0f71e20ad78d6bf528126635a6dececffda0085310a36.exe
Size

51KB
MD5

01493b07e3eacab03b04307a4418d5d0
SHA1

01a2d93c16ab92e1616861f2eb99163635863169
SHA256

b1a11b63d514f648c7a0f71e20ad78d6bf528126635a6dececffda0085310a36
SHA512

b0191fd60b8a3ecdc6f411e6b9ac0d2b6ce1ad9e1bcbee6b462ec3fe5bde0b6c5bf123f4561c7ccd404317cf9028f2cc4276c97102e80331fac025b25fcc71df
SSDEEP

1536:VxGZbbYtwXYPrULjr9+cdCbE8fEpJYGlzB:KlbYhULjr8ck3EpJbX

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aaohcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onkidm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Giljfddl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njacpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jioaqfcc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agbkmijg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olanmgig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pcbkml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hejjanpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ffaong32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hidgai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmfcok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apnndj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bapiabak.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khmknk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbcncibp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfjeckpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Enmjlojd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ammnhilb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Piockppb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Khmknk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efjimhnh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oeheqm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Abqjjd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doqpak32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Emehdh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmnkkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcobaedj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Modgdicm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpepbgbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ooangh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ammnhilb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkoigdom.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahippdbe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnfkdb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Khabke32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bihhhi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdlhgpag.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jgmjmjnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bgkiaj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eqiibjlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apimodmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dodjjimm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpgdai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpljkdig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oocmii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hkfglb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlhccj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dckdjomg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Feenjgfq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fboecfii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obdkma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ffgqqaip.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Banllbdn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ljgpkonp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adfnofpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jenmcggo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pqbala32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfmfefni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmklglpn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnkpnclp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Offnhpfo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dqpfmlce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmnnimak.exe

Executes dropped EXE 64 IoCs

pid	Process
1716	Gpjfdbom.exe
4936	Gjdcmj32.exe
4952	Hhjqlngd.exe
372	Hfpnmj32.exe
4296	Hdfklnic.exe
4460	Hdhgangq.exe
2396	Idjdgm32.exe
3376	Imeeeb32.exe
2072	Jpoaml32.exe
1064	Khpleh32.exe
2016	Lnhdinkd.exe
228	Ldbleh32.exe
4404	Lafmol32.exe
2416	Mhbaaf32.exe
3132	Mkcjca32.exe
3648	Mndcdlqf.exe
4428	Mgodcaed.exe
3592	Nnkiek32.exe
3996	Ndebbe32.exe
4564	Nnmfkkhl.exe
2084	Nghgipmj.exe
1704	Oijqibbj.exe
5108	Olocem32.exe
3616	Opmllk32.exe
2908	Pelaib32.exe
4212	Pbekne32.exe
864	Piockppb.exe
4624	Qpikgj32.exe
3000	Qajhobmm.exe
3920	Abqjjd32.exe
1116	Aiolam32.exe
1292	Bifbbllg.exe
4560	Bbofkbbh.exe
1252	Clldogdc.exe
3216	Ccfmla32.exe
4524	Cipehkcl.exe
4616	Cpljkdig.exe
4260	Doccaall.exe
3780	Dpemacql.exe
4516	Dhcnke32.exe
3972	Ejbkehcg.exe
5080	Ebbidj32.exe
3452	Ecbenm32.exe
1120	Efpajh32.exe
2092	Ficgacna.exe
3432	Fqmlhpla.exe
3360	Fbqefhpm.exe
4868	Gimjhafg.exe
2424	Gpklpkio.exe
1964	Hmfbjnbp.exe
3680	Icljbg32.exe
3196	Iabgaklg.exe
3048	Jkdnpo32.exe
2448	Kdffocib.exe
2180	Liggbi32.exe
4884	Mjcgohig.exe
5092	Njacpf32.exe
4844	Occkojkm.exe
2100	Okjbpglo.exe
2268	Obdkma32.exe
2608	Pgemphmn.exe
4056	Anpncp32.exe
4996	Angddopp.exe
3736	Bjdkjo32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Ennioe32.dll	Hpabni32.exe
File created	C:\Windows\SysWOW64\Amcehdod.exe	Akdilipp.exe
File opened for modification	C:\Windows\SysWOW64\Bbfmgd32.exe	Bdapehop.exe
File opened for modification	C:\Windows\SysWOW64\Nghgipmj.exe	Nnmfkkhl.exe
File created	C:\Windows\SysWOW64\Jbeidl32.exe	Icgjmapi.exe
File opened for modification	C:\Windows\SysWOW64\Maodigil.exe	Mahnhhod.exe
File created	C:\Windows\SysWOW64\Bjlpjm32.exe	Bbdhiojo.exe
File opened for modification	C:\Windows\SysWOW64\Bbalaoda.exe	Bpbpecen.exe
File opened for modification	C:\Windows\SysWOW64\Occkojkm.exe	Njacpf32.exe
File created	C:\Windows\SysWOW64\Bldgoeog.exe	Bejobk32.exe
File created	C:\Windows\SysWOW64\Fkpjfn32.dll	Aiolam32.exe
File opened for modification	C:\Windows\SysWOW64\Hcpojd32.exe	Hpabni32.exe
File opened for modification	C:\Windows\SysWOW64\Blielbfi.exe	Ahippdbe.exe
File created	C:\Windows\SysWOW64\Chempj32.dll	Qgqeappe.exe
File opened for modification	C:\Windows\SysWOW64\Abcgjg32.exe	Aabkbono.exe
File created	C:\Windows\SysWOW64\Lfhilofo.dll	Ejbkehcg.exe
File created	C:\Windows\SysWOW64\Lghekack.dll	Fqmlhpla.exe
File created	C:\Windows\SysWOW64\Qgqeappe.exe	Pgllfp32.exe
File created	C:\Windows\SysWOW64\Ekbngp32.dll	Egdqae32.exe
File created	C:\Windows\SysWOW64\Pnaopd32.dll	Feocelll.exe
File opened for modification	C:\Windows\SysWOW64\Eiloco32.exe	Dbbffdlq.exe
File created	C:\Windows\SysWOW64\Cekhihig.exe	Cbmlmmjd.exe
File created	C:\Windows\SysWOW64\Jghabl32.exe	Igjeanmj.exe
File created	C:\Windows\SysWOW64\Mjpnkbfj.dll	Lcclncbh.exe
File created	C:\Windows\SysWOW64\Mdnebc32.exe	Mclhjkfa.exe
File created	C:\Windows\SysWOW64\Dheibpje.exe	Cohkokgj.exe
File opened for modification	C:\Windows\SysWOW64\Lhdggb32.exe	Lajokiaa.exe
File created	C:\Windows\SysWOW64\Ejflhm32.exe	Edhjqc32.exe
File created	C:\Windows\SysWOW64\Cbmlmmjd.exe	Bcbeqaia.exe
File created	C:\Windows\SysWOW64\Dpllbp32.exe	Dibdeegc.exe
File created	C:\Windows\SysWOW64\Jhbffb32.dll	Bjfaeh32.exe
File created	C:\Windows\SysWOW64\Ojidbohn.dll	Egcaod32.exe
File opened for modification	C:\Windows\SysWOW64\Cpcpfg32.exe	Cmedjl32.exe
File created	C:\Windows\SysWOW64\Jdeflhhf.dll	Ncdgcf32.exe
File opened for modification	C:\Windows\SysWOW64\Nhmofj32.exe	Nenbjo32.exe
File opened for modification	C:\Windows\SysWOW64\Adkqoohc.exe	Aaldccip.exe
File opened for modification	C:\Windows\SysWOW64\Nagpeo32.exe	Njmhhefi.exe
File opened for modification	C:\Windows\SysWOW64\Digehphc.exe	Dfiildio.exe
File created	C:\Windows\SysWOW64\Jmeede32.exe	Jenmcggo.exe
File created	C:\Windows\SysWOW64\Mjhmqf32.dll	Himldi32.exe
File created	C:\Windows\SysWOW64\Hcjdeo32.dll	Fgppmd32.exe
File created	C:\Windows\SysWOW64\Bnffda32.dll	Cjgpfk32.exe
File created	C:\Windows\SysWOW64\Jphopllo.dll	Lfkaag32.exe
File opened for modification	C:\Windows\SysWOW64\Cmedjl32.exe	Cgklmacf.exe
File opened for modification	C:\Windows\SysWOW64\Iencmm32.exe	Hkcbnh32.exe
File created	C:\Windows\SysWOW64\Mfnfol32.dll	Bifbbllg.exe
File created	C:\Windows\SysWOW64\Ofimgb32.dll	Plbmokop.exe
File opened for modification	C:\Windows\SysWOW64\Pplobcpp.exe	Pnkbkk32.exe
File created	C:\Windows\SysWOW64\Najlgpeb.dll	Lhpnlclc.exe
File created	C:\Windows\SysWOW64\Mmhjbhod.dll	Pgemphmn.exe
File created	C:\Windows\SysWOW64\Icgjmapi.exe	Hbeqmoji.exe
File opened for modification	C:\Windows\SysWOW64\Icgjmapi.exe	Hbeqmoji.exe
File created	C:\Windows\SysWOW64\Boplohfa.dll	Bfmolc32.exe
File created	C:\Windows\SysWOW64\Ainpbi32.dll	Ffgqqaip.exe
File created	C:\Windows\SysWOW64\Lcnhho32.dll	Opakbi32.exe
File created	C:\Windows\SysWOW64\Ncndec32.dll	Poajkgnc.exe
File created	C:\Windows\SysWOW64\Ilgonc32.dll	Offnhpfo.exe
File opened for modification	C:\Windows\SysWOW64\Hhjqlngd.exe	Gjdcmj32.exe
File opened for modification	C:\Windows\SysWOW64\Cceddf32.exe	Cmklglpn.exe
File opened for modification	C:\Windows\SysWOW64\Cofnik32.exe	Bebjdgmj.exe
File created	C:\Windows\SysWOW64\Kfnkkb32.exe	Kngcje32.exe
File created	C:\Windows\SysWOW64\Gdmmbq32.exe	Fmnkkg32.exe
File opened for modification	C:\Windows\SysWOW64\Kfjapcii.exe	Kppici32.exe
File opened for modification	C:\Windows\SysWOW64\Amikgpcc.exe	Abcgjg32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6200	4576	WerFault.exe	680

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kfnkkb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Occgpjdk.dll"	Hcpojd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iialhaad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Apnndj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kobamdoe.dll"	Khpleh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddipic32.dll"	Glgcbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bamagp32.dll"	Cpljkdig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfmpaf32.dll"	Nofefp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cacmpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nfnjbdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjagjhnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pgkelj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mfeeabda.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ckbncapd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Khabke32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cekhihig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eelcja32.dll"	Ddpeoafg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cofnik32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cgklmacf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qdphngfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Klndfknp.dll"	Nbbeml32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edjgidik.dll"	Bmimdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lciibdmj.dll"	Hlglidlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Laiimcij.dll"	Lpochfji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Glbqbe32.dll"	Gqbneq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Alkeifga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Occkojkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfhilofo.dll"	Ejbkehcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfddbh32.dll"	Ajhddjfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hfpecg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjhjimfo.dll"	Cpdgqmnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Djbehfpe.dll"	Cbmlmmjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mhbaaf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjjfdfbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ccblbb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iagqgn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odoogi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljfhqh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Enkdaepb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jcdihk32.dll"	Fijdjfdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmdjdl32.dll"	Dmcibama.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdpfkn32.dll"	Dfpgffpm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Illfdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edgbbfnk.dll"	Kpjcdn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jilkmnni.dll"	Ojoign32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Olanmgig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Blielbfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oinmjoam.dll"	Lnhdinkd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Boipmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Akcoajfm.dll"	Hlpfhe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njhgbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Anhaoj32.dll"	Fqbliicp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hioflcbj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mcoepkdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfjeckpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fgbmccpg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ncofplba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Obdkma32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbociolq.dll"	Bkkple32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eiobceef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aokkahlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfjeckpj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpcapp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmdjce32.dll"	Kppici32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1716	1448	b1a11b63d514f648c7a0f71e20ad78d6bf528126635a6dececffda0085310a36.exe	81
PID 1448 wrote to memory of 1716	1448	b1a11b63d514f648c7a0f71e20ad78d6bf528126635a6dececffda0085310a36.exe	81
PID 1448 wrote to memory of 1716	1448	b1a11b63d514f648c7a0f71e20ad78d6bf528126635a6dececffda0085310a36.exe	81
PID 1716 wrote to memory of 4936	1716	Gpjfdbom.exe	82
PID 1716 wrote to memory of 4936	1716	Gpjfdbom.exe	82
PID 1716 wrote to memory of 4936	1716	Gpjfdbom.exe	82
PID 4936 wrote to memory of 4952	4936	Gjdcmj32.exe	83
PID 4936 wrote to memory of 4952	4936	Gjdcmj32.exe	83
PID 4936 wrote to memory of 4952	4936	Gjdcmj32.exe	83
PID 4952 wrote to memory of 372	4952	Hhjqlngd.exe	84
PID 4952 wrote to memory of 372	4952	Hhjqlngd.exe	84
PID 4952 wrote to memory of 372	4952	Hhjqlngd.exe	84
PID 372 wrote to memory of 4296	372	Hfpnmj32.exe	85
PID 372 wrote to memory of 4296	372	Hfpnmj32.exe	85
PID 372 wrote to memory of 4296	372	Hfpnmj32.exe	85
PID 4296 wrote to memory of 4460	4296	Hdfklnic.exe	86
PID 4296 wrote to memory of 4460	4296	Hdfklnic.exe	86
PID 4296 wrote to memory of 4460	4296	Hdfklnic.exe	86
PID 4460 wrote to memory of 2396	4460	Hdhgangq.exe	87
PID 4460 wrote to memory of 2396	4460	Hdhgangq.exe	87
PID 4460 wrote to memory of 2396	4460	Hdhgangq.exe	87
PID 2396 wrote to memory of 3376	2396	Idjdgm32.exe	88
PID 2396 wrote to memory of 3376	2396	Idjdgm32.exe	88
PID 2396 wrote to memory of 3376	2396	Idjdgm32.exe	88
PID 3376 wrote to memory of 2072	3376	Imeeeb32.exe	89
PID 3376 wrote to memory of 2072	3376	Imeeeb32.exe	89
PID 3376 wrote to memory of 2072	3376	Imeeeb32.exe	89
PID 2072 wrote to memory of 1064	2072	Jpoaml32.exe	90
PID 2072 wrote to memory of 1064	2072	Jpoaml32.exe	90
PID 2072 wrote to memory of 1064	2072	Jpoaml32.exe	90
PID 1064 wrote to memory of 2016	1064	Khpleh32.exe	91
PID 1064 wrote to memory of 2016	1064	Khpleh32.exe	91
PID 1064 wrote to memory of 2016	1064	Khpleh32.exe	91
PID 2016 wrote to memory of 228	2016	Lnhdinkd.exe	92
PID 2016 wrote to memory of 228	2016	Lnhdinkd.exe	92
PID 2016 wrote to memory of 228	2016	Lnhdinkd.exe	92
PID 228 wrote to memory of 4404	228	Ldbleh32.exe	93
PID 228 wrote to memory of 4404	228	Ldbleh32.exe	93
PID 228 wrote to memory of 4404	228	Ldbleh32.exe	93
PID 4404 wrote to memory of 2416	4404	Lafmol32.exe	94
PID 4404 wrote to memory of 2416	4404	Lafmol32.exe	94
PID 4404 wrote to memory of 2416	4404	Lafmol32.exe	94
PID 2416 wrote to memory of 3132	2416	Mhbaaf32.exe	95
PID 2416 wrote to memory of 3132	2416	Mhbaaf32.exe	95
PID 2416 wrote to memory of 3132	2416	Mhbaaf32.exe	95
PID 3132 wrote to memory of 3648	3132	Mkcjca32.exe	96
PID 3132 wrote to memory of 3648	3132	Mkcjca32.exe	96
PID 3132 wrote to memory of 3648	3132	Mkcjca32.exe	96
PID 3648 wrote to memory of 4428	3648	Mndcdlqf.exe	97
PID 3648 wrote to memory of 4428	3648	Mndcdlqf.exe	97
PID 3648 wrote to memory of 4428	3648	Mndcdlqf.exe	97
PID 4428 wrote to memory of 3592	4428	Mgodcaed.exe	98
PID 4428 wrote to memory of 3592	4428	Mgodcaed.exe	98
PID 4428 wrote to memory of 3592	4428	Mgodcaed.exe	98
PID 3592 wrote to memory of 3996	3592	Nnkiek32.exe	99
PID 3592 wrote to memory of 3996	3592	Nnkiek32.exe	99
PID 3592 wrote to memory of 3996	3592	Nnkiek32.exe	99
PID 3996 wrote to memory of 4564	3996	Ndebbe32.exe	100
PID 3996 wrote to memory of 4564	3996	Ndebbe32.exe	100
PID 3996 wrote to memory of 4564	3996	Ndebbe32.exe	100
PID 4564 wrote to memory of 2084	4564	Nnmfkkhl.exe	101
PID 4564 wrote to memory of 2084	4564	Nnmfkkhl.exe	101
PID 4564 wrote to memory of 2084	4564	Nnmfkkhl.exe	101
PID 2084 wrote to memory of 1704	2084	Nghgipmj.exe	102

C:\Users\Admin\AppData\Local\Temp\b1a11b63d514f648c7a0f71e20ad78d6bf528126635a6dececffda0085310a36.exe
"C:\Users\Admin\AppData\Local\Temp\b1a11b63d514f648c7a0f71e20ad78d6bf528126635a6dececffda0085310a36.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\Gpjfdbom.exe
  C:\Windows\system32\Gpjfdbom.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\SysWOW64\Gjdcmj32.exe
    C:\Windows\system32\Gjdcmj32.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\Windows\SysWOW64\Hhjqlngd.exe
      C:\Windows\system32\Hhjqlngd.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4952
    - - C:\Windows\SysWOW64\Hfpnmj32.exe
        
        C:\Windows\system32\Hfpnmj32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:372
      - C:\Windows\SysWOW64\Hdfklnic.exe
        
        C:\Windows\system32\Hdfklnic.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4296
        
        C:\Windows\SysWOW64\Hdhgangq.exe
        
        C:\Windows\system32\Hdhgangq.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Windows\SysWOW64\Idjdgm32.exe
        
        C:\Windows\system32\Idjdgm32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2396
        
        C:\Windows\SysWOW64\Imeeeb32.exe
        
        C:\Windows\system32\Imeeeb32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3376
        
        C:\Windows\SysWOW64\Jpoaml32.exe
        
        C:\Windows\system32\Jpoaml32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2072
        
        C:\Windows\SysWOW64\Khpleh32.exe
        
        C:\Windows\system32\Khpleh32.exe
        11⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1064
        
        C:\Windows\SysWOW64\Lnhdinkd.exe
        
        C:\Windows\system32\Lnhdinkd.exe
        12⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2016
        
        C:\Windows\SysWOW64\Ldbleh32.exe
        
        C:\Windows\system32\Ldbleh32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:228
        
        C:\Windows\SysWOW64\Lafmol32.exe
        
        C:\Windows\system32\Lafmol32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4404
        
        C:\Windows\SysWOW64\Mhbaaf32.exe
        
        C:\Windows\system32\Mhbaaf32.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2416
        
        C:\Windows\SysWOW64\Mkcjca32.exe
        
        C:\Windows\system32\Mkcjca32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Windows\SysWOW64\Mndcdlqf.exe
        
        C:\Windows\system32\Mndcdlqf.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3648
        
        C:\Windows\SysWOW64\Mgodcaed.exe
        
        C:\Windows\system32\Mgodcaed.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Windows\SysWOW64\Nnkiek32.exe
        
        C:\Windows\system32\Nnkiek32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3592
        
        C:\Windows\SysWOW64\Ndebbe32.exe
        
        C:\Windows\system32\Ndebbe32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3996
        
        C:\Windows\SysWOW64\Nnmfkkhl.exe
        
        C:\Windows\system32\Nnmfkkhl.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4564
        
        C:\Windows\SysWOW64\Nghgipmj.exe
        
        C:\Windows\system32\Nghgipmj.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2084
        
        C:\Windows\SysWOW64\Oijqibbj.exe
        
        C:\Windows\system32\Oijqibbj.exe
        23⤵
        Executes dropped EXE
        
        PID:1704
        
        C:\Windows\SysWOW64\Olocem32.exe
        
        C:\Windows\system32\Olocem32.exe
        24⤵
        Executes dropped EXE
        
        PID:5108
        
        C:\Windows\SysWOW64\Opmllk32.exe
        
        C:\Windows\system32\Opmllk32.exe
        25⤵
        Executes dropped EXE
        
        PID:3616
        
        C:\Windows\SysWOW64\Pelaib32.exe
        
        C:\Windows\system32\Pelaib32.exe
        26⤵
        Executes dropped EXE
        
        PID:2908
        
        C:\Windows\SysWOW64\Pbekne32.exe
        
        C:\Windows\system32\Pbekne32.exe
        27⤵
        Executes dropped EXE
        
        PID:4212
        
        C:\Windows\SysWOW64\Piockppb.exe
        
        C:\Windows\system32\Piockppb.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:864
        
        C:\Windows\SysWOW64\Qpikgj32.exe
        
        C:\Windows\system32\Qpikgj32.exe
        29⤵
        Executes dropped EXE
        
        PID:4624
        
        C:\Windows\SysWOW64\Qajhobmm.exe
        
        C:\Windows\system32\Qajhobmm.exe
        30⤵
        Executes dropped EXE
        
        PID:3000
        
        C:\Windows\SysWOW64\Abqjjd32.exe
        
        C:\Windows\system32\Abqjjd32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3920
        
        C:\Windows\SysWOW64\Aiolam32.exe
        
        C:\Windows\system32\Aiolam32.exe
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1116
        
        C:\Windows\SysWOW64\Bifbbllg.exe
        
        C:\Windows\system32\Bifbbllg.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1292
        
        C:\Windows\SysWOW64\Bbofkbbh.exe
        
        C:\Windows\system32\Bbofkbbh.exe
        34⤵
        Executes dropped EXE
        
        PID:4560
        
        C:\Windows\SysWOW64\Clldogdc.exe
        
        C:\Windows\system32\Clldogdc.exe
        35⤵
        Executes dropped EXE
        
        PID:1252
        
        C:\Windows\SysWOW64\Ccfmla32.exe
        
        C:\Windows\system32\Ccfmla32.exe
        36⤵
        Executes dropped EXE
        
        PID:3216
        
        C:\Windows\SysWOW64\Cipehkcl.exe
        
        C:\Windows\system32\Cipehkcl.exe
        37⤵
        Executes dropped EXE
        
        PID:4524
        
        C:\Windows\SysWOW64\Cpljkdig.exe
        
        C:\Windows\system32\Cpljkdig.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:4616
        
        C:\Windows\SysWOW64\Doccaall.exe
        
        C:\Windows\system32\Doccaall.exe
        39⤵
        Executes dropped EXE
        
        PID:4260
        
        C:\Windows\SysWOW64\Dpemacql.exe
        
        C:\Windows\system32\Dpemacql.exe
        40⤵
        Executes dropped EXE
        
        PID:3780
        
        C:\Windows\SysWOW64\Dhcnke32.exe
        
        C:\Windows\system32\Dhcnke32.exe
        41⤵
        Executes dropped EXE
        
        PID:4516
        
        C:\Windows\SysWOW64\Ejbkehcg.exe
        
        C:\Windows\system32\Ejbkehcg.exe
        42⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3972
        
        C:\Windows\SysWOW64\Ebbidj32.exe
        
        C:\Windows\system32\Ebbidj32.exe
        43⤵
        Executes dropped EXE
        
        PID:5080
        
        C:\Windows\SysWOW64\Ecbenm32.exe
        
        C:\Windows\system32\Ecbenm32.exe
        44⤵
        Executes dropped EXE
        
        PID:3452
        
        C:\Windows\SysWOW64\Efpajh32.exe
        
        C:\Windows\system32\Efpajh32.exe
        45⤵
        Executes dropped EXE
        
        PID:1120
        
        C:\Windows\SysWOW64\Ficgacna.exe
        
        C:\Windows\system32\Ficgacna.exe
        46⤵
        Executes dropped EXE
        
        PID:2092
        
        C:\Windows\SysWOW64\Fqmlhpla.exe
        
        C:\Windows\system32\Fqmlhpla.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3432
        
        C:\Windows\SysWOW64\Fbqefhpm.exe
        
        C:\Windows\system32\Fbqefhpm.exe
        48⤵
        Executes dropped EXE
        
        PID:3360
        
        C:\Windows\SysWOW64\Gimjhafg.exe
        
        C:\Windows\system32\Gimjhafg.exe
        49⤵
        Executes dropped EXE
        
        PID:4868
        
        C:\Windows\SysWOW64\Gpklpkio.exe
        
        C:\Windows\system32\Gpklpkio.exe
        50⤵
        Executes dropped EXE
        
        PID:2424
        
        C:\Windows\SysWOW64\Hmfbjnbp.exe
        
        C:\Windows\system32\Hmfbjnbp.exe
        51⤵
        Executes dropped EXE
        
        PID:1964
        
        C:\Windows\SysWOW64\Icljbg32.exe
        
        C:\Windows\system32\Icljbg32.exe
        52⤵
        Executes dropped EXE
        
        PID:3680
        
        C:\Windows\SysWOW64\Iabgaklg.exe
        
        C:\Windows\system32\Iabgaklg.exe
        53⤵
        Executes dropped EXE
        
        PID:3196
        
        C:\Windows\SysWOW64\Jkdnpo32.exe
        
        C:\Windows\system32\Jkdnpo32.exe
        54⤵
        Executes dropped EXE
        
        PID:3048
        
        C:\Windows\SysWOW64\Kdffocib.exe
        
        C:\Windows\system32\Kdffocib.exe
        55⤵
        Executes dropped EXE
        
        PID:2448
        
        C:\Windows\SysWOW64\Liggbi32.exe
        
        C:\Windows\system32\Liggbi32.exe
        56⤵
        Executes dropped EXE
        
        PID:2180
        
        C:\Windows\SysWOW64\Mjcgohig.exe
        
        C:\Windows\system32\Mjcgohig.exe
        57⤵
        Executes dropped EXE
        
        PID:4884
        
        C:\Windows\SysWOW64\Njacpf32.exe
        
        C:\Windows\system32\Njacpf32.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5092
        
        C:\Windows\SysWOW64\Occkojkm.exe
        
        C:\Windows\system32\Occkojkm.exe
        59⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4844
        
        C:\Windows\SysWOW64\Okjbpglo.exe
        
        C:\Windows\system32\Okjbpglo.exe
        60⤵
        Executes dropped EXE
        
        PID:2100
        
        C:\Windows\SysWOW64\Obdkma32.exe
        
        C:\Windows\system32\Obdkma32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2268
        
        C:\Windows\SysWOW64\Pgemphmn.exe
        
        C:\Windows\system32\Pgemphmn.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2608
        
        C:\Windows\SysWOW64\Anpncp32.exe
        
        C:\Windows\system32\Anpncp32.exe
        63⤵
        Executes dropped EXE
        
        PID:4056
        
        C:\Windows\SysWOW64\Angddopp.exe
        
        C:\Windows\system32\Angddopp.exe
        64⤵
        Executes dropped EXE
        
        PID:4996
        
        C:\Windows\SysWOW64\Bjdkjo32.exe
        
        C:\Windows\system32\Bjdkjo32.exe
        65⤵
        Executes dropped EXE
        
        PID:3736
        
        C:\Windows\SysWOW64\Cklaknjd.exe
        
        C:\Windows\system32\Cklaknjd.exe
        66⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\Cecbmf32.exe
        
        C:\Windows\system32\Cecbmf32.exe
        67⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\Doqpak32.exe
        
        C:\Windows\system32\Doqpak32.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1916
        
        C:\Windows\SysWOW64\Ddpeoafg.exe
        
        C:\Windows\system32\Ddpeoafg.exe
        69⤵
        Modifies registry class
        
        PID:2508
        
        C:\Windows\SysWOW64\Elbmlmml.exe
        
        C:\Windows\system32\Elbmlmml.exe
        70⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Ekhjmiad.exe
        
        C:\Windows\system32\Ekhjmiad.exe
        71⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\Edbklofb.exe
        
        C:\Windows\system32\Edbklofb.exe
        72⤵
        
        PID:3900
        
        C:\Windows\SysWOW64\Fkmchi32.exe
        
        C:\Windows\system32\Fkmchi32.exe
        73⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\Fcckif32.exe
        
        C:\Windows\system32\Fcckif32.exe
        74⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\Ffgqqaip.exe
        
        C:\Windows\system32\Ffgqqaip.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3172
        
        C:\Windows\SysWOW64\Gomakdcp.exe
        
        C:\Windows\system32\Gomakdcp.exe
        76⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        77⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\Himldi32.exe
        
        C:\Windows\system32\Himldi32.exe
        78⤵
        Drops file in System32 directory
        
        PID:2980
        
        C:\Windows\SysWOW64\Hkkhqd32.exe
        
        C:\Windows\system32\Hkkhqd32.exe
        79⤵
        
        PID:2800
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        80⤵
        Drops file in System32 directory
        
        PID:1900
        
        C:\Windows\SysWOW64\Icgjmapi.exe
        
        C:\Windows\system32\Icgjmapi.exe
        81⤵
        Drops file in System32 directory
        
        PID:4192
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        82⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2256
        
        C:\Windows\SysWOW64\Jianff32.exe
        
        C:\Windows\system32\Jianff32.exe
        84⤵
        
        PID:4368
        
        C:\Windows\SysWOW64\Jmpgldhg.exe
        
        C:\Windows\system32\Jmpgldhg.exe
        85⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\Jpnchp32.exe
        
        C:\Windows\system32\Jpnchp32.exe
        86⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        87⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\Kipkhdeq.exe
        
        C:\Windows\system32\Kipkhdeq.exe
        88⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\Kpjcdn32.exe
        
        C:\Windows\system32\Kpjcdn32.exe
        89⤵
        Modifies registry class
        
        PID:2008
        
        C:\Windows\SysWOW64\Kfckahdj.exe
        
        C:\Windows\system32\Kfckahdj.exe
        90⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        91⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        92⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        93⤵
        Drops file in System32 directory
        
        PID:4720
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        94⤵
        
        PID:2392
        
        C:\Windows\SysWOW64\Lepncd32.exe
        
        C:\Windows\system32\Lepncd32.exe
        95⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\Mpjlklok.exe
        
        C:\Windows\system32\Mpjlklok.exe
        96⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        97⤵
        
        PID:4496
        
        C:\Windows\SysWOW64\Mibpda32.exe
        
        C:\Windows\system32\Mibpda32.exe
        98⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        99⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        100⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        101⤵
        Drops file in System32 directory
        
        PID:4328
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        102⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\Olcbmj32.exe
        
        C:\Windows\system32\Olcbmj32.exe
        103⤵
        
        PID:896
        
        C:\Windows\SysWOW64\Opakbi32.exe
        
        C:\Windows\system32\Opakbi32.exe
        104⤵
        Drops file in System32 directory
        
        PID:2488
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        105⤵
        
        PID:2968
        
        C:\Windows\SysWOW64\Ojjolnaq.exe
        
        C:\Windows\system32\Ojjolnaq.exe
        106⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Opdghh32.exe
        
        C:\Windows\system32\Opdghh32.exe
        107⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Ognpebpj.exe
        
        C:\Windows\system32\Ognpebpj.exe
        108⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        109⤵
        Modifies registry class
        
        PID:5180
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        110⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Oddmdf32.exe
        
        C:\Windows\system32\Oddmdf32.exe
        111⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Pdkcde32.exe
        
        C:\Windows\system32\Pdkcde32.exe
        112⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        113⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Pgllfp32.exe
        
        C:\Windows\system32\Pgllfp32.exe
        114⤵
        Drops file in System32 directory
        
        PID:5308
        
        C:\Windows\SysWOW64\Qgqeappe.exe
        
        C:\Windows\system32\Qgqeappe.exe
        115⤵
        Drops file in System32 directory
        
        PID:5324
        
        C:\Windows\SysWOW64\Qjoankoi.exe
        
        C:\Windows\system32\Qjoankoi.exe
        116⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        117⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Qcgffqei.exe
        
        C:\Windows\system32\Qcgffqei.exe
        118⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Acnlgp32.exe
        
        C:\Windows\system32\Acnlgp32.exe
        119⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Ajhddjfn.exe
        
        C:\Windows\system32\Ajhddjfn.exe
        120⤵
        Modifies registry class
        
        PID:5432
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        121⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Bchomn32.exe
        
        C:\Windows\system32\Bchomn32.exe
        122⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Bjagjhnc.exe
        
        C:\Windows\system32\Bjagjhnc.exe
        123⤵
        Modifies registry class
        
        PID:5508
        
        C:\Windows\SysWOW64\Banllbdn.exe
        
        C:\Windows\system32\Banllbdn.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5524
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        125⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Bjfaeh32.exe
        
        C:\Windows\system32\Bjfaeh32.exe
        126⤵
        Drops file in System32 directory
        
        PID:5556
        
        C:\Windows\SysWOW64\Bapiabak.exe
        
        C:\Windows\system32\Bapiabak.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5572
        
        C:\Windows\SysWOW64\Bcoenmao.exe
        
        C:\Windows\system32\Bcoenmao.exe
        128⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        129⤵
        
        PID:5604
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        130⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Dmcibama.exe
        
        C:\Windows\system32\Dmcibama.exe
        131⤵
        Modifies registry class
        
        PID:5680
        
        C:\Windows\SysWOW64\Dfpgffpm.exe
        
        C:\Windows\system32\Dfpgffpm.exe
        132⤵
        Modifies registry class
        
        PID:5696
        
        C:\Windows\SysWOW64\Egdqae32.exe
        
        C:\Windows\system32\Egdqae32.exe
        133⤵
        Drops file in System32 directory
        
        PID:5728
        
        C:\Windows\SysWOW64\Ehfjah32.exe
        
        C:\Windows\system32\Ehfjah32.exe
        134⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Feocelll.exe
        
        C:\Windows\system32\Feocelll.exe
        135⤵
        Drops file in System32 directory
        
        PID:5760
        
        C:\Windows\SysWOW64\Fgppmd32.exe
        
        C:\Windows\system32\Fgppmd32.exe
        136⤵
        Drops file in System32 directory
        
        PID:5776
        
        C:\Windows\SysWOW64\Fgbmccpg.exe
        
        C:\Windows\system32\Fgbmccpg.exe
        137⤵
        Modifies registry class
        
        PID:5792
        
        C:\Windows\SysWOW64\Fgeihcme.exe
        
        C:\Windows\system32\Fgeihcme.exe
        138⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Fkcboack.exe
        
        C:\Windows\system32\Fkcboack.exe
        139⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Ghpendjj.exe
        
        C:\Windows\system32\Ghpendjj.exe
        140⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Gojnko32.exe
        
        C:\Windows\system32\Gojnko32.exe
        141⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Gdgfce32.exe
        
        C:\Windows\system32\Gdgfce32.exe
        142⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Hfipbh32.exe
        
        C:\Windows\system32\Hfipbh32.exe
        143⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Hglipp32.exe
        
        C:\Windows\system32\Hglipp32.exe
        144⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Hfpecg32.exe
        
        C:\Windows\system32\Hfpecg32.exe
        145⤵
        Modifies registry class
        
        PID:6004
        
        C:\Windows\SysWOW64\Inpccihl.exe
        
        C:\Windows\system32\Inpccihl.exe
        146⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Ighhln32.exe
        
        C:\Windows\system32\Ighhln32.exe
        147⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Igjeanmj.exe
        
        C:\Windows\system32\Igjeanmj.exe
        148⤵
        Drops file in System32 directory
        
        PID:6096
        
        C:\Windows\SysWOW64\Jghabl32.exe
        
        C:\Windows\system32\Jghabl32.exe
        149⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Kppici32.exe
        
        C:\Windows\system32\Kppici32.exe
        150⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6136
        
        C:\Windows\SysWOW64\Kfjapcii.exe
        
        C:\Windows\system32\Kfjapcii.exe
        151⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Khmknk32.exe
        
        C:\Windows\system32\Khmknk32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5244
        
        C:\Windows\SysWOW64\Kngcje32.exe
        
        C:\Windows\system32\Kngcje32.exe
        153⤵
        Drops file in System32 directory
        
        PID:5416
        
        C:\Windows\SysWOW64\Kfnkkb32.exe
        
        C:\Windows\system32\Kfnkkb32.exe
        154⤵
        Modifies registry class
        
        PID:4028
        
        C:\Windows\SysWOW64\Klkcdj32.exe
        
        C:\Windows\system32\Klkcdj32.exe
        155⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\Kiaqcnpb.exe
        
        C:\Windows\system32\Kiaqcnpb.exe
        156⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Loeolc32.exe
        
        C:\Windows\system32\Loeolc32.exe
        157⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Mlbbkfoq.exe
        
        C:\Windows\system32\Mlbbkfoq.exe
        158⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\Mleoafmn.exe
        
        C:\Windows\system32\Mleoafmn.exe
        159⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\Nchjdo32.exe
        
        C:\Windows\system32\Nchjdo32.exe
        160⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        161⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\Oohnonij.exe
        
        C:\Windows\system32\Oohnonij.exe
        162⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\Ogpepl32.exe
        
        C:\Windows\system32\Ogpepl32.exe
        163⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Pjbkgfej.exe
        
        C:\Windows\system32\Pjbkgfej.exe
        164⤵
        
        PID:4936
        
        C:\Windows\SysWOW64\Pckppl32.exe
        
        C:\Windows\system32\Pckppl32.exe
        165⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\Ppopjp32.exe
        
        C:\Windows\system32\Ppopjp32.exe
        166⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\Pgkelj32.exe
        
        C:\Windows\system32\Pgkelj32.exe
        167⤵
        Modifies registry class
        
        PID:1552
        
        C:\Windows\SysWOW64\Phlacbfm.exe
        
        C:\Windows\system32\Phlacbfm.exe
        168⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Pqcjepfo.exe
        
        C:\Windows\system32\Pqcjepfo.exe
        169⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Qcbfakec.exe
        
        C:\Windows\system32\Qcbfakec.exe
        170⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Qfpbmfdf.exe
        
        C:\Windows\system32\Qfpbmfdf.exe
        171⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\Qhonib32.exe
        
        C:\Windows\system32\Qhonib32.exe
        172⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\Agbkmijg.exe
        
        C:\Windows\system32\Agbkmijg.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2252
        
        C:\Windows\SysWOW64\Ahchda32.exe
        
        C:\Windows\system32\Ahchda32.exe
        174⤵
        
        PID:1372
        
        C:\Windows\SysWOW64\Aqkpeopg.exe
        
        C:\Windows\system32\Aqkpeopg.exe
        175⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\Ahfdjanb.exe
        
        C:\Windows\system32\Ahfdjanb.exe
        176⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\Boipmj32.exe
        
        C:\Windows\system32\Boipmj32.exe
        177⤵
        Modifies registry class
        
        PID:3496
        
        C:\Windows\SysWOW64\Biadeoce.exe
        
        C:\Windows\system32\Biadeoce.exe
        178⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\Boklbi32.exe
        
        C:\Windows\system32\Boklbi32.exe
        179⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\Bppfmigl.exe
        
        C:\Windows\system32\Bppfmigl.exe
        180⤵
        
        PID:524
        
        C:\Windows\SysWOW64\Bggnof32.exe
        
        C:\Windows\system32\Bggnof32.exe
        181⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\Bjfjka32.exe
        
        C:\Windows\system32\Bjfjka32.exe
        182⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\Cmdfgm32.exe
        
        C:\Windows\system32\Cmdfgm32.exe
        183⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\Ccnncgmc.exe
        
        C:\Windows\system32\Ccnncgmc.exe
        184⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\Cjhfpa32.exe
        
        C:\Windows\system32\Cjhfpa32.exe
        185⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\Cmklglpn.exe
        
        C:\Windows\system32\Cmklglpn.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:3240
        
        C:\Windows\SysWOW64\Cceddf32.exe
        
        C:\Windows\system32\Cceddf32.exe
        187⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\Dpckjfgg.exe
        
        C:\Windows\system32\Dpckjfgg.exe
        188⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\Edhjqc32.exe
        
        C:\Windows\system32\Edhjqc32.exe
        189⤵
        Drops file in System32 directory
        
        PID:4276
        
        C:\Windows\SysWOW64\Ejflhm32.exe
        
        C:\Windows\system32\Ejflhm32.exe
        190⤵
        
        PID:2660
        
        C:\Windows\SysWOW64\Emehdh32.exe
        
        C:\Windows\system32\Emehdh32.exe
        191⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4900
        
        C:\Windows\SysWOW64\Epcdqd32.exe
        
        C:\Windows\system32\Epcdqd32.exe
        192⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\Facqkg32.exe
        
        C:\Windows\system32\Facqkg32.exe
        193⤵
        
        PID:3084
        
        C:\Windows\SysWOW64\Fdamgb32.exe
        
        C:\Windows\system32\Fdamgb32.exe
        194⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\Fkkeclfh.exe
        
        C:\Windows\system32\Fkkeclfh.exe
        195⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\Faenpf32.exe
        
        C:\Windows\system32\Faenpf32.exe
        196⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        197⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\Fmnkkg32.exe
        
        C:\Windows\system32\Fmnkkg32.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1292
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        199⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\Hhdhon32.exe
        
        C:\Windows\system32\Hhdhon32.exe
        200⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\Hkbdki32.exe
        
        C:\Windows\system32\Hkbdki32.exe
        201⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Hdpbon32.exe
        
        C:\Windows\system32\Hdpbon32.exe
        202⤵
        
        PID:996
        
        C:\Windows\SysWOW64\Idbodn32.exe
        
        C:\Windows\system32\Idbodn32.exe
        203⤵
        
        PID:3152
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        204⤵
        
        PID:4688
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        205⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\Leenhhdn.exe
        
        C:\Windows\system32\Leenhhdn.exe
        206⤵
        
        PID:912
        
        C:\Windows\SysWOW64\Lejgch32.exe
        
        C:\Windows\system32\Lejgch32.exe
        207⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\Ljgpkonp.exe
        
        C:\Windows\system32\Ljgpkonp.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3912
        
        C:\Windows\SysWOW64\Mhoipb32.exe
        
        C:\Windows\system32\Mhoipb32.exe
        209⤵
        
        PID:4588
        
        C:\Windows\SysWOW64\Mjneln32.exe
        
        C:\Windows\system32\Mjneln32.exe
        210⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Mahnhhod.exe
        
        C:\Windows\system32\Mahnhhod.exe
        211⤵
        Drops file in System32 directory
        
        PID:2312
        
        C:\Windows\SysWOW64\Maodigil.exe
        
        C:\Windows\system32\Maodigil.exe
        212⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        213⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Oblmdhdo.exe
        
        C:\Windows\system32\Oblmdhdo.exe
        214⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Oekiqccc.exe
        
        C:\Windows\system32\Oekiqccc.exe
        215⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        216⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4108
        
        C:\Windows\SysWOW64\Oemefcap.exe
        
        C:\Windows\system32\Oemefcap.exe
        218⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\Oafcqcea.exe
        
        C:\Windows\system32\Oafcqcea.exe
        219⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\Polppg32.exe
        
        C:\Windows\system32\Polppg32.exe
        220⤵
        
        PID:2852
        
        C:\Windows\SysWOW64\Pefhlaie.exe
        
        C:\Windows\system32\Pefhlaie.exe
        221⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        222⤵
        Drops file in System32 directory
        
        PID:2280
        
        C:\Windows\SysWOW64\Poajkgnc.exe
        
        C:\Windows\system32\Poajkgnc.exe
        223⤵
        Drops file in System32 directory
        
        PID:1520
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        224⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        225⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\Pcobaedj.exe
        
        C:\Windows\system32\Pcobaedj.exe
        226⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2760
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        227⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\Bhldpj32.exe
        
        C:\Windows\system32\Bhldpj32.exe
        228⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        229⤵
        Modifies registry class
        
        PID:4844
        
        C:\Windows\SysWOW64\Bbdhiojo.exe
        
        C:\Windows\system32\Bbdhiojo.exe
        230⤵
        Drops file in System32 directory
        
        PID:1876
        
        C:\Windows\SysWOW64\Bjlpjm32.exe
        
        C:\Windows\system32\Bjlpjm32.exe
        231⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\Bkoigdom.exe
        
        C:\Windows\system32\Bkoigdom.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1360
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        233⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\Bopocbcq.exe
        
        C:\Windows\system32\Bopocbcq.exe
        234⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\Bbnkonbd.exe
        
        C:\Windows\system32\Bbnkonbd.exe
        235⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\Cjecpkcg.exe
        
        C:\Windows\system32\Cjecpkcg.exe
        236⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\Cmcolgbj.exe
        
        C:\Windows\system32\Cmcolgbj.exe
        237⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        238⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        239⤵
        Drops file in System32 directory
        
        PID:6236
        
        C:\Windows\SysWOW64\Dmalne32.exe
        
        C:\Windows\system32\Dmalne32.exe
        240⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        241⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6268
        
        C:\Windows\SysWOW64\Djhimica.exe
        
        C:\Windows\system32\Djhimica.exe
        242⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        243⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        244⤵
        Modifies registry class
        
        PID:6316
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        245⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        246⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        247⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        248⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6396
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        249⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6428
        
        C:\Windows\SysWOW64\Flqdlnde.exe
        
        C:\Windows\system32\Flqdlnde.exe
        251⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        252⤵
        Drops file in System32 directory
        
        PID:6492
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        253⤵
        Modifies registry class
        
        PID:6508
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        254⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6524
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6540
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        256⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Kcndbp32.exe
        
        C:\Windows\system32\Kcndbp32.exe
        257⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        258⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        259⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        260⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        261⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        262⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        263⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Ljfhqh32.exe
        
        C:\Windows\system32\Ljfhqh32.exe
        264⤵
        Modifies registry class
        
        PID:6716
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        265⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        266⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        267⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        268⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        269⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        270⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Nmenca32.exe
        
        C:\Windows\system32\Nmenca32.exe
        271⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        272⤵
        Modifies registry class
        
        PID:6884
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        273⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        274⤵
        Drops file in System32 directory
        
        PID:6916
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        275⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        276⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        277⤵
        Drops file in System32 directory
        
        PID:6964
        
        C:\Windows\SysWOW64\Nagpeo32.exe
        
        C:\Windows\system32\Nagpeo32.exe
        278⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6996
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        280⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7028
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        282⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7044
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        283⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        284⤵
        
        PID:7092
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        285⤵
        Modifies registry class
        
        PID:7152
        
        C:\Windows\SysWOW64\Olicnfco.exe
        
        C:\Windows\system32\Olicnfco.exe
        286⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\Pkegpb32.exe
        
        C:\Windows\system32\Pkegpb32.exe
        287⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        288⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        289⤵
        Modifies registry class
        
        PID:6216
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        290⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        291⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6308
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        293⤵
        
        PID:344
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2276
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        295⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1612
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        296⤵
        Modifies registry class
        
        PID:2652
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        297⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        298⤵
        Drops file in System32 directory
        
        PID:6472
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        299⤵
        Modifies registry class
        
        PID:4512
        
        C:\Windows\SysWOW64\Cfpffeaj.exe
        
        C:\Windows\system32\Cfpffeaj.exe
        300⤵
        
        PID:4196
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        301⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\Cohkokgj.exe
        
        C:\Windows\system32\Cohkokgj.exe
        302⤵
        Drops file in System32 directory
        
        PID:1036
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        303⤵
        
        PID:3584
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        304⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        305⤵
        Drops file in System32 directory
        
        PID:2564
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        306⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        307⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        308⤵
        
        PID:4192
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        309⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        310⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3060
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        311⤵
        Drops file in System32 directory
        
        PID:4204
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        312⤵
        
        PID:3744
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        313⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        314⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        315⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        316⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        317⤵
        Modifies registry class
        
        PID:4048
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        318⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        319⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        320⤵
        
        PID:2768
        
        C:\Windows\SysWOW64\Fpdcag32.exe
        
        C:\Windows\system32\Fpdcag32.exe
        321⤵
        
        PID:3552
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        322⤵
        
        PID:4940
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        323⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        324⤵
        
        PID:1184
        
        C:\Windows\SysWOW64\Flpmagqi.exe
        
        C:\Windows\system32\Flpmagqi.exe
        325⤵
        
        PID:3624
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        326⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        327⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Glbjggof.exe
        
        C:\Windows\system32\Glbjggof.exe
        328⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        329⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        330⤵
        
        PID:4328
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        331⤵
        Modifies registry class
        
        PID:4236
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        332⤵
        Modifies registry class
        
        PID:4480
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        333⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        334⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        335⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5168
        
        C:\Windows\SysWOW64\Hoclopne.exe
        
        C:\Windows\system32\Hoclopne.exe
        336⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        337⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        338⤵
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        339⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        340⤵
        
        PID:1896
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        341⤵
        Modifies registry class
        
        PID:5284
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        342⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        343⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        344⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        345⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        346⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        347⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5432
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        349⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Jpcapp32.exe
        
        C:\Windows\system32\Jpcapp32.exe
        350⤵
        Modifies registry class
        
        PID:5512
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5672
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        352⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4288
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        354⤵
        Modifies registry class
        
        PID:5624
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        355⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        356⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Nqpcjj32.exe
        
        C:\Windows\system32\Nqpcjj32.exe
        357⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        358⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        359⤵
        Modifies registry class
        
        PID:4444
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        360⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6808
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6828
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        362⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        363⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5760
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        364⤵
        Drops file in System32 directory
        
        PID:5796
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        365⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        366⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        367⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        368⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        369⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        370⤵
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        371⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Ahdpjn32.exe
        
        C:\Windows\system32\Ahdpjn32.exe
        372⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        373⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        374⤵
        Drops file in System32 directory
        
        PID:5516
        
        C:\Windows\SysWOW64\Adkqoohc.exe
        
        C:\Windows\system32\Adkqoohc.exe
        375⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        376⤵
        Drops file in System32 directory
        
        PID:6452
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        377⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        378⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        379⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6104
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        380⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Bpdnjple.exe
        
        C:\Windows\system32\Bpdnjple.exe
        381⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        382⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        383⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        384⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5652
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        385⤵
        Modifies registry class
        
        PID:5840
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        386⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        387⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5832
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        388⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        389⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        390⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:404
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        391⤵
        Drops file in System32 directory
        
        PID:3644
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        392⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4880
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        393⤵
        
        PID:3324
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        394⤵
        Modifies registry class
        
        PID:4240
        
        C:\Windows\SysWOW64\Fijdjfdb.exe
        
        C:\Windows\system32\Fijdjfdb.exe
        395⤵
        Modifies registry class
        
        PID:1436
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        396⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        397⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        398⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Filapfbo.exe
        
        C:\Windows\system32\Filapfbo.exe
        399⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        400⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        401⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        402⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Fganqbgg.exe
        
        C:\Windows\system32\Fganqbgg.exe
        403⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        404⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        405⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        406⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3092
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        407⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        408⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        409⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        410⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        411⤵
        
        PID:968
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        412⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        413⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        414⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4564
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        415⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        416⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        417⤵
        Modifies registry class
        
        PID:3576
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        418⤵
        
        PID:3268
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        419⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        420⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        421⤵
        
        PID:3168
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        422⤵
        Modifies registry class
        
        PID:756
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        423⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        424⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        425⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        426⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        427⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\Joekag32.exe
        
        C:\Windows\system32\Joekag32.exe
        428⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        429⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        430⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        431⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        432⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1252
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        433⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        434⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1548
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        435⤵
        Drops file in System32 directory
        
        PID:5052
        
        C:\Windows\SysWOW64\Lpochfji.exe
        
        C:\Windows\system32\Lpochfji.exe
        436⤵
        Modifies registry class
        
        PID:4616
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        437⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        438⤵
        
        PID:3216
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        439⤵
        
        PID:4260
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        440⤵
        
        PID:2136
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        441⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        442⤵
        
        PID:2056
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        443⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        444⤵
        
        PID:912
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        445⤵
        Modifies registry class
        
        PID:3912
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        446⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        447⤵
        Modifies registry class
        
        PID:4400
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        448⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        449⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        450⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        451⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        452⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4084
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2312
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        454⤵
        Modifies registry class
        
        PID:5632
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        455⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Pcbkml32.exe
        
        C:\Windows\system32\Pcbkml32.exe
        456⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2656
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        457⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Qpbnhl32.exe
        
        C:\Windows\system32\Qpbnhl32.exe
        458⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        459⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7208
        
        C:\Windows\SysWOW64\Qikbaaml.exe
        
        C:\Windows\system32\Qikbaaml.exe
        460⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Aabkbono.exe
        
        C:\Windows\system32\Aabkbono.exe
        461⤵
        Drops file in System32 directory
        
        PID:7240
        
        C:\Windows\SysWOW64\Abcgjg32.exe
        
        C:\Windows\system32\Abcgjg32.exe
        462⤵
        Drops file in System32 directory
        
        PID:7256
        
        C:\Windows\SysWOW64\Amikgpcc.exe
        
        C:\Windows\system32\Amikgpcc.exe
        463⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Aagdnn32.exe
        
        C:\Windows\system32\Aagdnn32.exe
        464⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Abhqefpg.exe
        
        C:\Windows\system32\Abhqefpg.exe
        465⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Ampaho32.exe
        
        C:\Windows\system32\Ampaho32.exe
        466⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Apnndj32.exe
        
        C:\Windows\system32\Apnndj32.exe
        467⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7380
        
        C:\Windows\SysWOW64\Abmjqe32.exe
        
        C:\Windows\system32\Abmjqe32.exe
        468⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Ajdbac32.exe
        
        C:\Windows\system32\Ajdbac32.exe
        469⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        470⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Bfmolc32.exe
        
        C:\Windows\system32\Bfmolc32.exe
        471⤵
        Drops file in System32 directory
        
        PID:7444
        
        C:\Windows\SysWOW64\Bdapehop.exe
        
        C:\Windows\system32\Bdapehop.exe
        472⤵
        Drops file in System32 directory
        
        PID:7464
        
        C:\Windows\SysWOW64\Bbfmgd32.exe
        
        C:\Windows\system32\Bbfmgd32.exe
        473⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Bipecnkd.exe
        
        C:\Windows\system32\Bipecnkd.exe
        474⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Bagmdllg.exe
        
        C:\Windows\system32\Bagmdllg.exe
        475⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Bbhildae.exe
        
        C:\Windows\system32\Bbhildae.exe
        476⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Ckpamabg.exe
        
        C:\Windows\system32\Ckpamabg.exe
        477⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Cmnnimak.exe
        
        C:\Windows\system32\Cmnnimak.exe
        478⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7560
        
        C:\Windows\SysWOW64\Cdhffg32.exe
        
        C:\Windows\system32\Cdhffg32.exe
        479⤵
        
        PID:7576
        
        C:\Windows\SysWOW64\Ckbncapd.exe
        
        C:\Windows\system32\Ckbncapd.exe
        480⤵
        Modifies registry class
        
        PID:7592
        
        C:\Windows\SysWOW64\Cmpjoloh.exe
        
        C:\Windows\system32\Cmpjoloh.exe
        481⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Cpogkhnl.exe
        
        C:\Windows\system32\Cpogkhnl.exe
        482⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Cgiohbfi.exe
        
        C:\Windows\system32\Cgiohbfi.exe
        483⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Cigkdmel.exe
        
        C:\Windows\system32\Cigkdmel.exe
        484⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Cancekeo.exe
        
        C:\Windows\system32\Cancekeo.exe
        485⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Cdmoafdb.exe
        
        C:\Windows\system32\Cdmoafdb.exe
        486⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Cgklmacf.exe
        
        C:\Windows\system32\Cgklmacf.exe
        487⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7736
        
        C:\Windows\SysWOW64\Cmedjl32.exe
        
        C:\Windows\system32\Cmedjl32.exe
        488⤵
        Drops file in System32 directory
        
        PID:7760
        
        C:\Windows\SysWOW64\Cpcpfg32.exe
        
        C:\Windows\system32\Cpcpfg32.exe
        489⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Ccblbb32.exe
        
        C:\Windows\system32\Ccblbb32.exe
        490⤵
        Modifies registry class
        
        PID:7796
        
        C:\Windows\SysWOW64\Ckidcpjl.exe
        
        C:\Windows\system32\Ckidcpjl.exe
        491⤵
        
        PID:7820
        
        C:\Windows\SysWOW64\Cacmpj32.exe
        
        C:\Windows\system32\Cacmpj32.exe
        492⤵
        Modifies registry class
        
        PID:7844
        
        C:\Windows\SysWOW64\Cdaile32.exe
        
        C:\Windows\system32\Cdaile32.exe
        493⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Dkkaiphj.exe
        
        C:\Windows\system32\Dkkaiphj.exe
        494⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Dajbaika.exe
        
        C:\Windows\system32\Dajbaika.exe
        495⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Dckoia32.exe
        
        C:\Windows\system32\Dckoia32.exe
        496⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Dkbgjo32.exe
        
        C:\Windows\system32\Dkbgjo32.exe
        497⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Egnajocq.exe
        
        C:\Windows\system32\Egnajocq.exe
        498⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Enhifi32.exe
        
        C:\Windows\system32\Enhifi32.exe
        499⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Epffbd32.exe
        
        C:\Windows\system32\Epffbd32.exe
        500⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Fjhmbihg.exe
        
        C:\Windows\system32\Fjhmbihg.exe
        501⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Fboecfii.exe
        
        C:\Windows\system32\Fboecfii.exe
        502⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8108
        
        C:\Windows\SysWOW64\Fcpakn32.exe
        
        C:\Windows\system32\Fcpakn32.exe
        503⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Gcnnllcg.exe
        
        C:\Windows\system32\Gcnnllcg.exe
        504⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Gqbneq32.exe
        
        C:\Windows\system32\Gqbneq32.exe
        505⤵
        Modifies registry class
        
        PID:8168
        
        C:\Windows\SysWOW64\Gglfbkin.exe
        
        C:\Windows\system32\Gglfbkin.exe
        506⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Hbknebqi.exe
        
        C:\Windows\system32\Hbknebqi.exe
        507⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\Hejjanpm.exe
        
        C:\Windows\system32\Hejjanpm.exe
        508⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3516
        
        C:\Windows\SysWOW64\Hkcbnh32.exe
        
        C:\Windows\system32\Hkcbnh32.exe
        509⤵
        Drops file in System32 directory
        
        PID:2468
        
        C:\Windows\SysWOW64\Iencmm32.exe
        
        C:\Windows\system32\Iencmm32.exe
        510⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\Ilhkigcd.exe
        
        C:\Windows\system32\Ilhkigcd.exe
        511⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Infhebbh.exe
        
        C:\Windows\system32\Infhebbh.exe
        512⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Iagqgn32.exe
        
        C:\Windows\system32\Iagqgn32.exe
        513⤵
        Modifies registry class
        
        PID:7320
        
        C:\Windows\SysWOW64\Ilmedf32.exe
        
        C:\Windows\system32\Ilmedf32.exe
        514⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Jhkljfok.exe
        
        C:\Windows\system32\Jhkljfok.exe
        515⤵
        
        PID:3568
        
        C:\Windows\SysWOW64\Khabke32.exe
        
        C:\Windows\system32\Khabke32.exe
        516⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3196
        
        C:\Windows\SysWOW64\Koljgppp.exe
        
        C:\Windows\system32\Koljgppp.exe
        517⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\Kefbdjgm.exe
        
        C:\Windows\system32\Kefbdjgm.exe
        518⤵
        
        PID:1940
        
        C:\Windows\SysWOW64\Kaopoj32.exe
        
        C:\Windows\system32\Kaopoj32.exe
        519⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\Kdmlkfjb.exe
        
        C:\Windows\system32\Kdmlkfjb.exe
        520⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\Kkgdhp32.exe
        
        C:\Windows\system32\Kkgdhp32.exe
        521⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\Leabphmp.exe
        
        C:\Windows\system32\Leabphmp.exe
        522⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Lhpnlclc.exe
        
        C:\Windows\system32\Lhpnlclc.exe
        523⤵
        Drops file in System32 directory
        
        PID:2420
        
        C:\Windows\SysWOW64\Lknjhokg.exe
        
        C:\Windows\system32\Lknjhokg.exe
        524⤵
        
        PID:5020
        
        C:\Windows\SysWOW64\Lolcnman.exe
        
        C:\Windows\system32\Lolcnman.exe
        525⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Lajokiaa.exe
        
        C:\Windows\system32\Lajokiaa.exe
        526⤵
        Drops file in System32 directory
        
        PID:7720
        
        C:\Windows\SysWOW64\Lhdggb32.exe
        
        C:\Windows\system32\Lhdggb32.exe
        527⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Loopdmpk.exe
        
        C:\Windows\system32\Loopdmpk.exe
        528⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\Lehhqg32.exe
        
        C:\Windows\system32\Lehhqg32.exe
        529⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Lhgdmb32.exe
        
        C:\Windows\system32\Lhgdmb32.exe
        530⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Mclhjkfa.exe
        
        C:\Windows\system32\Mclhjkfa.exe
        531⤵
        Drops file in System32 directory
        
        PID:7908
        
        C:\Windows\SysWOW64\Mdnebc32.exe
        
        C:\Windows\system32\Mdnebc32.exe
        532⤵
        
        PID:6264
        
        C:\Windows\SysWOW64\Mkgmoncl.exe
        
        C:\Windows\system32\Mkgmoncl.exe
        533⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Mcoepkdo.exe
        
        C:\Windows\system32\Mcoepkdo.exe
        534⤵
        Modifies registry class
        
        PID:6336
        
        C:\Windows\SysWOW64\Memalfcb.exe
        
        C:\Windows\system32\Memalfcb.exe
        535⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Mhknhabf.exe
        
        C:\Windows\system32\Mhknhabf.exe
        536⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Moefdljc.exe
        
        C:\Windows\system32\Moefdljc.exe
        537⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Madbagif.exe
        
        C:\Windows\system32\Madbagif.exe
        538⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Mdbnmbhj.exe
        
        C:\Windows\system32\Mdbnmbhj.exe
        539⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Mklfjm32.exe
        
        C:\Windows\system32\Mklfjm32.exe
        540⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Mafofggd.exe
        
        C:\Windows\system32\Mafofggd.exe
        541⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Nfnjbdep.exe
        
        C:\Windows\system32\Nfnjbdep.exe
        542⤵
        Modifies registry class
        
        PID:6400
        
        C:\Windows\SysWOW64\Odgqopeb.exe
        
        C:\Windows\system32\Odgqopeb.exe
        543⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Oloipmfd.exe
        
        C:\Windows\system32\Oloipmfd.exe
        544⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Ooangh32.exe
        
        C:\Windows\system32\Ooangh32.exe
        545⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6516
        
        C:\Windows\SysWOW64\Pmeoqlpl.exe
        
        C:\Windows\system32\Pmeoqlpl.exe
        546⤵
        
        PID:2424
        
        C:\Windows\SysWOW64\Pbimjb32.exe
        
        C:\Windows\system32\Pbimjb32.exe
        547⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Qfgfpp32.exe
        
        C:\Windows\system32\Qfgfpp32.exe
        548⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Qifbll32.exe
        
        C:\Windows\system32\Qifbll32.exe
        549⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Qppkhfec.exe
        
        C:\Windows\system32\Qppkhfec.exe
        550⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\Amfhgj32.exe
        
        C:\Windows\system32\Amfhgj32.exe
        551⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\Apddce32.exe
        
        C:\Windows\system32\Apddce32.exe
        552⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Abcppq32.exe
        
        C:\Windows\system32\Abcppq32.exe
        553⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Aealll32.exe
        
        C:\Windows\system32\Aealll32.exe
        554⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Alkeifga.exe
        
        C:\Windows\system32\Alkeifga.exe
        555⤵
        Modifies registry class
        
        PID:6580
        
        C:\Windows\SysWOW64\Aioebj32.exe
        
        C:\Windows\system32\Aioebj32.exe
        556⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Apimodmh.exe
        
        C:\Windows\system32\Apimodmh.exe
        557⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1360
        
        C:\Windows\SysWOW64\Aeffgkkp.exe
        
        C:\Windows\system32\Aeffgkkp.exe
        558⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Ammnhilb.exe
        
        C:\Windows\system32\Ammnhilb.exe
        559⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1816
        
        C:\Windows\SysWOW64\Apkjddke.exe
        
        C:\Windows\system32\Apkjddke.exe
        560⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Abjfqpji.exe
        
        C:\Windows\system32\Abjfqpji.exe
        561⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Aehbmk32.exe
        
        C:\Windows\system32\Aehbmk32.exe
        562⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Amoknh32.exe
        
        C:\Windows\system32\Amoknh32.exe
        563⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Apngjd32.exe
        
        C:\Windows\system32\Apngjd32.exe
        564⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Bblcfo32.exe
        
        C:\Windows\system32\Bblcfo32.exe
        565⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Bejobk32.exe
        
        C:\Windows\system32\Bejobk32.exe
        566⤵
        Drops file in System32 directory
        
        PID:6880
        
        C:\Windows\SysWOW64\Bldgoeog.exe
        
        C:\Windows\system32\Bldgoeog.exe
        567⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Bboplo32.exe
        
        C:\Windows\system32\Bboplo32.exe
        568⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Bihhhi32.exe
        
        C:\Windows\system32\Bihhhi32.exe
        569⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8072
        
        C:\Windows\SysWOW64\Bpbpecen.exe
        
        C:\Windows\system32\Bpbpecen.exe
        570⤵
        Drops file in System32 directory
        
        PID:6784

C:\Windows\SysWOW64\Bbalaoda.exe
C:\Windows\system32\Bbalaoda.exe
1⤵
PID:6856
- C:\Windows\SysWOW64\Bikeni32.exe
  C:\Windows\system32\Bikeni32.exe
  2⤵
  PID:6368
- - C:\Windows\SysWOW64\Bpemkcck.exe
    C:\Windows\system32\Bpemkcck.exe
    3⤵
    PID:7004
  - - C:\Windows\SysWOW64\Bbcignbo.exe
      C:\Windows\system32\Bbcignbo.exe
      4⤵
      PID:6884
    - - C:\Windows\SysWOW64\Bmimdg32.exe
        
        C:\Windows\system32\Bmimdg32.exe
        5⤵
        Modifies registry class
        
        PID:6900
      - C:\Windows\SysWOW64\Bcbeqaia.exe
        
        C:\Windows\system32\Bcbeqaia.exe
        6⤵
        Drops file in System32 directory
        
        PID:7056
        
        C:\Windows\SysWOW64\Cbmlmmjd.exe
        
        C:\Windows\system32\Cbmlmmjd.exe
        7⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6940
        
        C:\Windows\SysWOW64\Cekhihig.exe
        
        C:\Windows\system32\Cekhihig.exe
        8⤵
        Modifies registry class
        
        PID:6948
        
        C:\Windows\SysWOW64\Cmbpjfij.exe
        
        C:\Windows\system32\Cmbpjfij.exe
        9⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Cdlhgpag.exe
        
        C:\Windows\system32\Cdlhgpag.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7008
        
        C:\Windows\SysWOW64\Cfjeckpj.exe
        
        C:\Windows\system32\Cfjeckpj.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7012
        
        C:\Windows\SysWOW64\Cmdmpe32.exe
        
        C:\Windows\system32\Cmdmpe32.exe
        12⤵
        
        PID:1136
        
        C:\Windows\SysWOW64\Cdnelpod.exe
        
        C:\Windows\system32\Cdnelpod.exe
        13⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Cfmahknh.exe
        
        C:\Windows\system32\Cfmahknh.exe
        14⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\Cmgjee32.exe
        
        C:\Windows\system32\Cmgjee32.exe
        15⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Dpefaq32.exe
        
        C:\Windows\system32\Dpefaq32.exe
        16⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Dbcbnlcl.exe
        
        C:\Windows\system32\Dbcbnlcl.exe
        17⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Dinjjf32.exe
        
        C:\Windows\system32\Dinjjf32.exe
        18⤵
        
        PID:784
        
        C:\Windows\SysWOW64\Dlncla32.exe
        
        C:\Windows\system32\Dlncla32.exe
        19⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Ddekmo32.exe
        
        C:\Windows\system32\Ddekmo32.exe
        20⤵
        
        PID:708
        
        C:\Windows\SysWOW64\Dibdeegc.exe
        
        C:\Windows\system32\Dibdeegc.exe
        21⤵
        Drops file in System32 directory
        
        PID:6328
        
        C:\Windows\SysWOW64\Dpllbp32.exe
        
        C:\Windows\system32\Dpllbp32.exe
        22⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Dbkhnk32.exe
        
        C:\Windows\system32\Dbkhnk32.exe
        23⤵
        
        PID:4576
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4576 -s 400
        24⤵
        Program crash
        
        PID:6200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4576 -ip 4576
1⤵
PID:1624

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abqjjd32.exe

Filesize
51KB

MD5
ced0745d8e3412ad48d4fbda9eda65d2

SHA1
08ccb6e41d53dd8f187a7d039c1721fe1141ea48

SHA256
a56f53e8ce56c5ffdd8d6e71b8834951228d0638bfae0a8e49afc615d11f77ef

SHA512
dc6296713435c913d4996fd06af45a2a1e6ea86572e4527d7200939c95b2f36248037bc3831550687ec5c1b9550f5cfa1992ca4cd2436ecd4b2169f089239860

Download Submit
C:\Windows\SysWOW64\Abqjjd32.exe

Filesize
51KB

MD5
ced0745d8e3412ad48d4fbda9eda65d2

SHA1
08ccb6e41d53dd8f187a7d039c1721fe1141ea48

SHA256
a56f53e8ce56c5ffdd8d6e71b8834951228d0638bfae0a8e49afc615d11f77ef

SHA512
dc6296713435c913d4996fd06af45a2a1e6ea86572e4527d7200939c95b2f36248037bc3831550687ec5c1b9550f5cfa1992ca4cd2436ecd4b2169f089239860

Download Submit
C:\Windows\SysWOW64\Aiolam32.exe

Filesize
51KB

MD5
dd124f721444c691e34921e547c44ccf

SHA1
b2862a363c1adb4b430834cd3b9f6392aa713407

SHA256
9a1f1aff7b0cd52a5c4502208f8d1e7ccb1c83febba1a6273e3a735358c37c1a

SHA512
2ff48d0e87a1d2a0ae9118f32b4f82532656b92b48105222ccfd5767bc381c92bd653cf2de1bcfb906dc7b39465be10634db98601f0b4c6c2bf9648696ab96dd

Download Submit
C:\Windows\SysWOW64\Aiolam32.exe

Filesize
51KB

MD5
dd124f721444c691e34921e547c44ccf

SHA1
b2862a363c1adb4b430834cd3b9f6392aa713407

SHA256
9a1f1aff7b0cd52a5c4502208f8d1e7ccb1c83febba1a6273e3a735358c37c1a

SHA512
2ff48d0e87a1d2a0ae9118f32b4f82532656b92b48105222ccfd5767bc381c92bd653cf2de1bcfb906dc7b39465be10634db98601f0b4c6c2bf9648696ab96dd

Download Submit
C:\Windows\SysWOW64\Bifbbllg.exe

Filesize
51KB

MD5
63fd3dc14c14b38768ba6fb293a8518d

SHA1
e45c26857b08ff79ac90bea73621fd864c8752f1

SHA256
0fa77cadbfd1cf96a0ee983c6cfa4a8b60b40a3e58096bf79f1c80c513cc872d

SHA512
50adcd59c1d649d26bb72fddaa88e99aa68699b26cb15a0bdbdcea68f01716221dfb35052c0a0cfe15b24d6ad233eae0031b7d73aa057095e5029328d07f4afb

Download Submit
C:\Windows\SysWOW64\Bifbbllg.exe

Filesize
51KB

MD5
63fd3dc14c14b38768ba6fb293a8518d

SHA1
e45c26857b08ff79ac90bea73621fd864c8752f1

SHA256
0fa77cadbfd1cf96a0ee983c6cfa4a8b60b40a3e58096bf79f1c80c513cc872d

SHA512
50adcd59c1d649d26bb72fddaa88e99aa68699b26cb15a0bdbdcea68f01716221dfb35052c0a0cfe15b24d6ad233eae0031b7d73aa057095e5029328d07f4afb

Download Submit
C:\Windows\SysWOW64\Gjdcmj32.exe

Filesize
51KB

MD5
71cb5cf7637799754715cf6c3fcf7dc7

SHA1
36de578b38c33294d5cd5e28763caca734547474

SHA256
bf5b8228a3fc24da7ea8d9ecd055d608f243664bac7f36ee72702cacc2db0bc4

SHA512
08c472c7abb1a3831c90d0d2ec7e79b9c100aed19c6810a7580d472cedf46ecb282dc703f939b7a3aa8ec4cf688cc93840690f43a556f3e766774d933c74a098

Download Submit
C:\Windows\SysWOW64\Gjdcmj32.exe

Filesize
51KB

MD5
71cb5cf7637799754715cf6c3fcf7dc7

SHA1
36de578b38c33294d5cd5e28763caca734547474

SHA256
bf5b8228a3fc24da7ea8d9ecd055d608f243664bac7f36ee72702cacc2db0bc4

SHA512
08c472c7abb1a3831c90d0d2ec7e79b9c100aed19c6810a7580d472cedf46ecb282dc703f939b7a3aa8ec4cf688cc93840690f43a556f3e766774d933c74a098

Download Submit
C:\Windows\SysWOW64\Gpjfdbom.exe

Filesize
51KB

MD5
4fac2545506de086ea45891b02ad4d30

SHA1
3b8889299105c7470f8566cb5fdf840fcdd70153

SHA256
7e5554c8dcd5010bfab72cacda697b53c745920f1c97f5b772ecb01a708cd53b

SHA512
21e236bd3b6355623c1ecc43289ad544771382c59e348d2a99f7fd574a53a78ff9a6c9133d9ec6e6cc69936e067a41d9601cb3a6d91f2c6d2e518d1ee08eb538

Download Submit
C:\Windows\SysWOW64\Gpjfdbom.exe

Filesize
51KB

MD5
4fac2545506de086ea45891b02ad4d30

SHA1
3b8889299105c7470f8566cb5fdf840fcdd70153

SHA256
7e5554c8dcd5010bfab72cacda697b53c745920f1c97f5b772ecb01a708cd53b

SHA512
21e236bd3b6355623c1ecc43289ad544771382c59e348d2a99f7fd574a53a78ff9a6c9133d9ec6e6cc69936e067a41d9601cb3a6d91f2c6d2e518d1ee08eb538

Download Submit
C:\Windows\SysWOW64\Hdfklnic.exe

Filesize
51KB

MD5
77338a8d44d8ff947712ae561d1fef32

SHA1
cd3bb51128a8b29f13ec4d49d73cb2022694d220

SHA256
5ec10ef994da28d7b790997adb68cbe243d4143dbfb2969f48988340452dfd3d

SHA512
64a8defdebc966e8b50961b7f7bfc4d6d9333cf96b6893cd166f66158a9289d1c4c7fa89da63e9966ae0aefe7139d46af5b042a8759a97b2828116cdc96d20e5

Download Submit
C:\Windows\SysWOW64\Hdfklnic.exe

Filesize
51KB

MD5
77338a8d44d8ff947712ae561d1fef32

SHA1
cd3bb51128a8b29f13ec4d49d73cb2022694d220

SHA256
5ec10ef994da28d7b790997adb68cbe243d4143dbfb2969f48988340452dfd3d

SHA512
64a8defdebc966e8b50961b7f7bfc4d6d9333cf96b6893cd166f66158a9289d1c4c7fa89da63e9966ae0aefe7139d46af5b042a8759a97b2828116cdc96d20e5

Download Submit
C:\Windows\SysWOW64\Hdhgangq.exe

Filesize
51KB

MD5
56779437f4f3bce1048eb1212cd3ad38

SHA1
0689aa5cde2d6d5fd24ee563db0e0cf2220f30c8

SHA256
6e1d2b169863011136b1c2effc2d006a03f5930eb3d994b400c020c4416954f4

SHA512
d05e9731023415f2653cfcc71650f35b938368b8a4004a572609f8d6981015c56a4c0a0eca926bbd4c3a7afee46fa0be2bc8f0c4c572d11e902465d88a98b12f

Download Submit
C:\Windows\SysWOW64\Hdhgangq.exe

Filesize
51KB

MD5
56779437f4f3bce1048eb1212cd3ad38

SHA1
0689aa5cde2d6d5fd24ee563db0e0cf2220f30c8

SHA256
6e1d2b169863011136b1c2effc2d006a03f5930eb3d994b400c020c4416954f4

SHA512
d05e9731023415f2653cfcc71650f35b938368b8a4004a572609f8d6981015c56a4c0a0eca926bbd4c3a7afee46fa0be2bc8f0c4c572d11e902465d88a98b12f

Download Submit
C:\Windows\SysWOW64\Hfpnmj32.exe

Filesize
51KB

MD5
3fac124a45483a7bf7ec2cee5d6c4153

SHA1
71aee14dcffdee08794215cade716628672e655d

SHA256
e331fea099396dbc840d5791b35c785c56bfcb341497f4aa72bb51599b674ce2

SHA512
fc466d3453057a6a84ec653d8b174f20701e49ebfee30b6a4ad1791343cc7dde3405ecdd19317ba9b0738d33c40dcf0ec7050e544557dcb7fc80d62be0ade223

Download Submit
C:\Windows\SysWOW64\Hfpnmj32.exe

Filesize
51KB

MD5
3fac124a45483a7bf7ec2cee5d6c4153

SHA1
71aee14dcffdee08794215cade716628672e655d

SHA256
e331fea099396dbc840d5791b35c785c56bfcb341497f4aa72bb51599b674ce2

SHA512
fc466d3453057a6a84ec653d8b174f20701e49ebfee30b6a4ad1791343cc7dde3405ecdd19317ba9b0738d33c40dcf0ec7050e544557dcb7fc80d62be0ade223

Download Submit
C:\Windows\SysWOW64\Hhjqlngd.exe

Filesize
51KB

MD5
f5aa2b682db72a57da1e137cf53d027c

SHA1
3770b6966a17fab61854716cda112a4212649d6d

SHA256
6b33f76e238e6250a76f680d19c86c46c181f2401d8e395ecb2653ccefe16ebf

SHA512
e43ce9cc45917620ce097b4e4d5b119359def3b453599ff4cab3ca66519e4a981c018398ebbc743c1be8ceabfacd38880669145bc4162a72443f12e393183e61

Download Submit
C:\Windows\SysWOW64\Hhjqlngd.exe

Filesize
51KB

MD5
f5aa2b682db72a57da1e137cf53d027c

SHA1
3770b6966a17fab61854716cda112a4212649d6d

SHA256
6b33f76e238e6250a76f680d19c86c46c181f2401d8e395ecb2653ccefe16ebf

SHA512
e43ce9cc45917620ce097b4e4d5b119359def3b453599ff4cab3ca66519e4a981c018398ebbc743c1be8ceabfacd38880669145bc4162a72443f12e393183e61

Download Submit
C:\Windows\SysWOW64\Idjdgm32.exe

Filesize
51KB

MD5
395e30638a877f7613fec6ed1e270c13

SHA1
061a99c092fb002767c684b346330bdd02a5cab9

SHA256
47e92582b3ac05194bd57dd81cd11cda33efca7b49384efb89e66d2c8252c81e

SHA512
f04b574d68c7eeaa83ec6c8b5e84776e08642bc1537aeef55ba4fa4c3536566d13f9bdc46b74fea7153bc5fbab3ab1a06ad94142ea5c3e38603af461fe7daf4f

Download Submit
C:\Windows\SysWOW64\Idjdgm32.exe

Filesize
51KB

MD5
395e30638a877f7613fec6ed1e270c13

SHA1
061a99c092fb002767c684b346330bdd02a5cab9

SHA256
47e92582b3ac05194bd57dd81cd11cda33efca7b49384efb89e66d2c8252c81e

SHA512
f04b574d68c7eeaa83ec6c8b5e84776e08642bc1537aeef55ba4fa4c3536566d13f9bdc46b74fea7153bc5fbab3ab1a06ad94142ea5c3e38603af461fe7daf4f

Download Submit
C:\Windows\SysWOW64\Imeeeb32.exe

Filesize
51KB

MD5
af17ea52f57c1f2c4cad8b7d9b45d5de

SHA1
956e0d412c20b619f12b1fb7c66a001372f92537

SHA256
7f7ee0c0ce612a2c46365b5c3bc4d66f10cf21b8e2aafec1b0e25dc99b6d2c96

SHA512
d468b0a23fc0bb24772530eb114eb5f1dec38a9a6ddd02037a62ad237e6a2cc3043821772ee4cb766c5adbb2ff042c17521e72101963469987295a0a882f3b65

Download Submit
C:\Windows\SysWOW64\Imeeeb32.exe

Filesize
51KB

MD5
af17ea52f57c1f2c4cad8b7d9b45d5de

SHA1
956e0d412c20b619f12b1fb7c66a001372f92537

SHA256
7f7ee0c0ce612a2c46365b5c3bc4d66f10cf21b8e2aafec1b0e25dc99b6d2c96

SHA512
d468b0a23fc0bb24772530eb114eb5f1dec38a9a6ddd02037a62ad237e6a2cc3043821772ee4cb766c5adbb2ff042c17521e72101963469987295a0a882f3b65

Download Submit
C:\Windows\SysWOW64\Jpoaml32.exe

Filesize
51KB

MD5
dda5e8fd693b890399f058112b504d64

SHA1
f8b1d5eefa89a8dc4bb40c94f1603fad2f58fd95

SHA256
330e34b24217964fd665f768d70e36c53f341c656fdaa9e532acdb701360784f

SHA512
9009344ebd38436e03ac0357c04ba5ae8d94dffd81b69e62658458e67f6bf1e8d2847c9154f47ba730a2158911ee366eef39479974265f1e2788ad499643b6b2

Download Submit
C:\Windows\SysWOW64\Jpoaml32.exe

Filesize
51KB

MD5
dda5e8fd693b890399f058112b504d64

SHA1
f8b1d5eefa89a8dc4bb40c94f1603fad2f58fd95

SHA256
330e34b24217964fd665f768d70e36c53f341c656fdaa9e532acdb701360784f

SHA512
9009344ebd38436e03ac0357c04ba5ae8d94dffd81b69e62658458e67f6bf1e8d2847c9154f47ba730a2158911ee366eef39479974265f1e2788ad499643b6b2

Download Submit
C:\Windows\SysWOW64\Khpleh32.exe

Filesize
51KB

MD5
ea4cead44bb67e2403c5e1ed368eb553

SHA1
4c79b27dbbead38297e1c6341dc0acb1e0a2ab3d

SHA256
2c60faaffbe8130aa02587cfde62fe88142bbc67da1e3e31c66e59573a1c0d46

SHA512
091369522a92380013d1f22a5ad83ef6a94e6f7fd0307a66daa8a5676b78346f88523f4e99fca9685899acc47b2b7bb88a8986a7b94d1d602414dcd8415d0e09

Download Submit
C:\Windows\SysWOW64\Khpleh32.exe

Filesize
51KB

MD5
ea4cead44bb67e2403c5e1ed368eb553

SHA1
4c79b27dbbead38297e1c6341dc0acb1e0a2ab3d

SHA256
2c60faaffbe8130aa02587cfde62fe88142bbc67da1e3e31c66e59573a1c0d46

SHA512
091369522a92380013d1f22a5ad83ef6a94e6f7fd0307a66daa8a5676b78346f88523f4e99fca9685899acc47b2b7bb88a8986a7b94d1d602414dcd8415d0e09

Download Submit
C:\Windows\SysWOW64\Lafmol32.exe

Filesize
51KB

MD5
360119a128296dba53eb7e4126f98800

SHA1
f869d15f6bc4132ec2b1b56d92839e94982fd10a

SHA256
209ad7cdf25fdfccfe4b5af8229a8049ca485668af4ffa89c000b1a660d20e92

SHA512
322bf619bcc99ea393d99ec1efa219d79de9456ce92af65782a3e75ac75e049879c47e94d6ff9ad6aa38d0b8a1978a1949ce2aaa48e94c7e8b0a0833c08d8478

Download Submit
C:\Windows\SysWOW64\Lafmol32.exe

Filesize
51KB

MD5
360119a128296dba53eb7e4126f98800

SHA1
f869d15f6bc4132ec2b1b56d92839e94982fd10a

SHA256
209ad7cdf25fdfccfe4b5af8229a8049ca485668af4ffa89c000b1a660d20e92

SHA512
322bf619bcc99ea393d99ec1efa219d79de9456ce92af65782a3e75ac75e049879c47e94d6ff9ad6aa38d0b8a1978a1949ce2aaa48e94c7e8b0a0833c08d8478

Download Submit
C:\Windows\SysWOW64\Ldbleh32.exe

Filesize
51KB

MD5
6ad4c0823d8e32c78d690be2f4c90b3c

SHA1
db23dac377f712bff64a8403d514569cfac6f036

SHA256
54e95ec13cf2cf24864b0b2d858d2d22fd51930638a12977cd483cd24986a433

SHA512
15cfc7f485c1c827e4bad7107f3c18c55ce50ab6cda41b6c9bd97a08ac247e757cb7012d21a3e111805f014367cfd905acb5560ad622e2bea7df72cb8bd63ae5

Download Submit
C:\Windows\SysWOW64\Ldbleh32.exe

Filesize
51KB

MD5
6ad4c0823d8e32c78d690be2f4c90b3c

SHA1
db23dac377f712bff64a8403d514569cfac6f036

SHA256
54e95ec13cf2cf24864b0b2d858d2d22fd51930638a12977cd483cd24986a433

SHA512
15cfc7f485c1c827e4bad7107f3c18c55ce50ab6cda41b6c9bd97a08ac247e757cb7012d21a3e111805f014367cfd905acb5560ad622e2bea7df72cb8bd63ae5

Download Submit
C:\Windows\SysWOW64\Lnhdinkd.exe

Filesize
51KB

MD5
ecd86d18248ce3d9f4eb82adeafdd272

SHA1
8a59c264c1a0b94e67faa3846bafa23e2f920a9c

SHA256
7cb5503e5e591a33bc7bfc2f2c74fbedb954da419cadc8faa5c0f9cd8db80084

SHA512
b60ddeff65eca50fb06a5d61cc0f2615aa4649ec68277b7269413f782309ed2018877676ae128dc26ba0b139575206dcba3357dc60d2371c1a0701d39f12ba64

Download Submit
C:\Windows\SysWOW64\Lnhdinkd.exe

Filesize
51KB

MD5
ecd86d18248ce3d9f4eb82adeafdd272

SHA1
8a59c264c1a0b94e67faa3846bafa23e2f920a9c

SHA256
7cb5503e5e591a33bc7bfc2f2c74fbedb954da419cadc8faa5c0f9cd8db80084

SHA512
b60ddeff65eca50fb06a5d61cc0f2615aa4649ec68277b7269413f782309ed2018877676ae128dc26ba0b139575206dcba3357dc60d2371c1a0701d39f12ba64

Download Submit
C:\Windows\SysWOW64\Mgodcaed.exe

Filesize
51KB

MD5
bc85a9477c2336703085ae1211aed5ff

SHA1
f3b38649af2c7c515063f1f4a4307f0f221fa84f

SHA256
fc7a17e0d2cbcbb5b1a3f852c81a7e8506926b9a45437459418e29fd80b71aa2

SHA512
b4947c8846e137f33791e7b0eb372ffef947471fba6e587f3857aaf813230f385531269e9f704fe236c3a1b358bb1c9f24af9b9f37159ff26024de50df60b6fd

Download Submit
C:\Windows\SysWOW64\Mgodcaed.exe

Filesize
51KB

MD5
bc85a9477c2336703085ae1211aed5ff

SHA1
f3b38649af2c7c515063f1f4a4307f0f221fa84f

SHA256
fc7a17e0d2cbcbb5b1a3f852c81a7e8506926b9a45437459418e29fd80b71aa2

SHA512
b4947c8846e137f33791e7b0eb372ffef947471fba6e587f3857aaf813230f385531269e9f704fe236c3a1b358bb1c9f24af9b9f37159ff26024de50df60b6fd

Download Submit
C:\Windows\SysWOW64\Mhbaaf32.exe

Filesize
51KB

MD5
e963881af08badd25076c06b94cd2b98

SHA1
72ce1c4b3b55cd234c277640481630fdbf32379f

SHA256
0c44e03f5893d8e1e6b104953e017edade00b525b278da88ae5c6f7be4052a4c

SHA512
0ceca23f09475848448f04b0e126bd377211fef0a0d872ed27967c4464d200384c7595fc1a335a0e6450b5213b5ef5871a8076781ad0778f0a6b7f51532c9b93

Download Submit
C:\Windows\SysWOW64\Mhbaaf32.exe

Filesize
51KB

MD5
e963881af08badd25076c06b94cd2b98

SHA1
72ce1c4b3b55cd234c277640481630fdbf32379f

SHA256
0c44e03f5893d8e1e6b104953e017edade00b525b278da88ae5c6f7be4052a4c

SHA512
0ceca23f09475848448f04b0e126bd377211fef0a0d872ed27967c4464d200384c7595fc1a335a0e6450b5213b5ef5871a8076781ad0778f0a6b7f51532c9b93

Download Submit
C:\Windows\SysWOW64\Mkcjca32.exe

Filesize
51KB

MD5
8f73f0cb20fe6362700fa572567d6123

SHA1
373584c8c98f84d9efbc33bda8749be041b7c701

SHA256
d4b039aa931a19635b0b2d8e78c926967526a3b547deee319b62ee3be803e6f7

SHA512
2b77e1a43cadb93f8c666e9648e5ccfaf862e58befe309d08e43d2a167585a90111fbd723370e2d448a1b5b73414d71204b6e834586f663aa846d57b05fd8755

Download Submit
C:\Windows\SysWOW64\Mkcjca32.exe

Filesize
51KB

MD5
8f73f0cb20fe6362700fa572567d6123

SHA1
373584c8c98f84d9efbc33bda8749be041b7c701

SHA256
d4b039aa931a19635b0b2d8e78c926967526a3b547deee319b62ee3be803e6f7

SHA512
2b77e1a43cadb93f8c666e9648e5ccfaf862e58befe309d08e43d2a167585a90111fbd723370e2d448a1b5b73414d71204b6e834586f663aa846d57b05fd8755

Download Submit
C:\Windows\SysWOW64\Mndcdlqf.exe

Filesize
51KB

MD5
bf74ebeb87c7652053ddc39e6478fe85

SHA1
9829b2b089092712301d5926961af6f35fe7716a

SHA256
9b9d140aaf542532a7ee6106607d74a740fb5295e3864aaa7f22e1dd1479dde8

SHA512
1804fa70eccf3febca579192e2d26b4764efe837013afd6d829a0e006f339fb75ccb43701f3f017103b45406c7af34218a3129a0c5e65e2bec0b3a2110325313

Download Submit
C:\Windows\SysWOW64\Mndcdlqf.exe

Filesize
51KB

MD5
bf74ebeb87c7652053ddc39e6478fe85

SHA1
9829b2b089092712301d5926961af6f35fe7716a

SHA256
9b9d140aaf542532a7ee6106607d74a740fb5295e3864aaa7f22e1dd1479dde8

SHA512
1804fa70eccf3febca579192e2d26b4764efe837013afd6d829a0e006f339fb75ccb43701f3f017103b45406c7af34218a3129a0c5e65e2bec0b3a2110325313

Download Submit
C:\Windows\SysWOW64\Ndebbe32.exe

Filesize
51KB

MD5
8b5626a537c565489ff00534697c63c8

SHA1
7032cfbf8935dae889c7d5d3d9e7141bcba59784

SHA256
cdc0c622ffa684ef7ff353c69c424ec995bd1695bd141cbc355a174234d26e56

SHA512
87899efab5779b2ec320c8a197bf6d712c9cda9195404eb3d17030dc45b9a0bf19b94dbb72c2542bb8b56c24bc4f8e6b8e193fdda46e4cec9534fe9f806c7cdc

Download Submit
C:\Windows\SysWOW64\Ndebbe32.exe

Filesize
51KB

MD5
8b5626a537c565489ff00534697c63c8

SHA1
7032cfbf8935dae889c7d5d3d9e7141bcba59784

SHA256
cdc0c622ffa684ef7ff353c69c424ec995bd1695bd141cbc355a174234d26e56

SHA512
87899efab5779b2ec320c8a197bf6d712c9cda9195404eb3d17030dc45b9a0bf19b94dbb72c2542bb8b56c24bc4f8e6b8e193fdda46e4cec9534fe9f806c7cdc

Download Submit
C:\Windows\SysWOW64\Nghgipmj.exe

Filesize
51KB

MD5
fa190df64881a2ef2e9bbcd49db84ff1

SHA1
2fc55f6e8865c74959812e615c991edb6b9d9f9e

SHA256
cc9b444233ead5603db07ce997050d3b1607d306099fce17d799df2e8bc602c3

SHA512
b6181de2f59e123a21ec7c3e6fb1a638174b2c8baf1d682799dc7d359589a47046d4bb66dc4a0d17e2e813fa8c8b79ee335195297aeddeba618482e5df76c06c

Download Submit
C:\Windows\SysWOW64\Nghgipmj.exe

Filesize
51KB

MD5
fa190df64881a2ef2e9bbcd49db84ff1

SHA1
2fc55f6e8865c74959812e615c991edb6b9d9f9e

SHA256
cc9b444233ead5603db07ce997050d3b1607d306099fce17d799df2e8bc602c3

SHA512
b6181de2f59e123a21ec7c3e6fb1a638174b2c8baf1d682799dc7d359589a47046d4bb66dc4a0d17e2e813fa8c8b79ee335195297aeddeba618482e5df76c06c

Download Submit
C:\Windows\SysWOW64\Nnkiek32.exe

Filesize
51KB

MD5
a0bad09f44a04c6b27626e50fd357213

SHA1
af4c07f9254239fa41a0c7d5c6bf224cc11c2558

SHA256
b4efa8b2813277254e1052b00667e1bc06e28b817e6d4b2b1f9ad1a327c6ae5c

SHA512
9e3fe7f681c72e9435f5886b62e79f868c9b947724492f940526e21c3a2f98505fdbb4d54daa8450b7a150bfd435980c66514d5101a15f56c158031b25a9c284

Download Submit
C:\Windows\SysWOW64\Nnkiek32.exe

Filesize
51KB

MD5
a0bad09f44a04c6b27626e50fd357213

SHA1
af4c07f9254239fa41a0c7d5c6bf224cc11c2558

SHA256
b4efa8b2813277254e1052b00667e1bc06e28b817e6d4b2b1f9ad1a327c6ae5c

SHA512
9e3fe7f681c72e9435f5886b62e79f868c9b947724492f940526e21c3a2f98505fdbb4d54daa8450b7a150bfd435980c66514d5101a15f56c158031b25a9c284

Download Submit
C:\Windows\SysWOW64\Nnmfkkhl.exe

Filesize
51KB

MD5
5e4b19a8d1d7199ee6e34e213512cd2c

SHA1
857c360980f90df7e76f34469b607b283835bfcc

SHA256
e7ba0828d5bef4476752563b3760bf6414518640dcc8c99f39055becf9259f7f

SHA512
8a0633aa6337a290ab8a5c3c1084c0a32243486ee98920b742649ac12b80de0ec1cc90f311e2055085c4a4406b487fe47591b77a728aa314c44e2d0c7e6f6cb8

Download Submit
C:\Windows\SysWOW64\Nnmfkkhl.exe

Filesize
51KB

MD5
5e4b19a8d1d7199ee6e34e213512cd2c

SHA1
857c360980f90df7e76f34469b607b283835bfcc

SHA256
e7ba0828d5bef4476752563b3760bf6414518640dcc8c99f39055becf9259f7f

SHA512
8a0633aa6337a290ab8a5c3c1084c0a32243486ee98920b742649ac12b80de0ec1cc90f311e2055085c4a4406b487fe47591b77a728aa314c44e2d0c7e6f6cb8

Download Submit
C:\Windows\SysWOW64\Oijqibbj.exe

Filesize
51KB

MD5
c6acbeb8a45d2061821ab586651cec80

SHA1
38a74fc39159d21b65f4319b026a90da5a475497

SHA256
948374ca0104b6ade934f1f131c557b0eb32f016682c091ad54dc01a4c0d3b36

SHA512
2f5af23d85a6469393676c9a18239a573820743f66624a2c7b2bdf0e5cd0860e1c8377617519f6ab58171be0a36d5e6c055534999b2c69060bf5ac26ca889fff

Download Submit
C:\Windows\SysWOW64\Oijqibbj.exe

Filesize
51KB

MD5
c6acbeb8a45d2061821ab586651cec80

SHA1
38a74fc39159d21b65f4319b026a90da5a475497

SHA256
948374ca0104b6ade934f1f131c557b0eb32f016682c091ad54dc01a4c0d3b36

SHA512
2f5af23d85a6469393676c9a18239a573820743f66624a2c7b2bdf0e5cd0860e1c8377617519f6ab58171be0a36d5e6c055534999b2c69060bf5ac26ca889fff

Download Submit
C:\Windows\SysWOW64\Olocem32.exe

Filesize
51KB

MD5
473dcf488da08b5f34f473136cd6e648

SHA1
ac12bbc271d79560754fc65e6f90ba7dd7637aad

SHA256
47253cec200087b6eed71bd11719715e68176b46db16694901b6b35e79de9f9e

SHA512
be1c2cc87ea9d245b9c5d1fcf0e70e51a6598ffbfd1eb60c53b8090e976e41ed4ec68b922ac15cadc92c4ccf26725ae9e4ceddb4b01521c6ba82f671486c9f3f

Download Submit
C:\Windows\SysWOW64\Olocem32.exe

Filesize
51KB

MD5
473dcf488da08b5f34f473136cd6e648

SHA1
ac12bbc271d79560754fc65e6f90ba7dd7637aad

SHA256
47253cec200087b6eed71bd11719715e68176b46db16694901b6b35e79de9f9e

SHA512
be1c2cc87ea9d245b9c5d1fcf0e70e51a6598ffbfd1eb60c53b8090e976e41ed4ec68b922ac15cadc92c4ccf26725ae9e4ceddb4b01521c6ba82f671486c9f3f

Download Submit
C:\Windows\SysWOW64\Opmllk32.exe

Filesize
51KB

MD5
65b0acfc25a1344ebb85aa3a7589dc49

SHA1
6d8e31df3cbb90df75d496c6b8764e4401c60b77

SHA256
beb469691df360b6648c71675405eab5792aeb55e8226a258a4a85441b4466db

SHA512
8d3c751202a774dc9c3ab573180faec63edfb2dfcaa81a54c623d567f14e277d412d6804a2243e7c6eab2ad01b48fbd03b4b85c7f401c01201f9288cef05911d

Download Submit
C:\Windows\SysWOW64\Opmllk32.exe

Filesize
51KB

MD5
65b0acfc25a1344ebb85aa3a7589dc49

SHA1
6d8e31df3cbb90df75d496c6b8764e4401c60b77

SHA256
beb469691df360b6648c71675405eab5792aeb55e8226a258a4a85441b4466db

SHA512
8d3c751202a774dc9c3ab573180faec63edfb2dfcaa81a54c623d567f14e277d412d6804a2243e7c6eab2ad01b48fbd03b4b85c7f401c01201f9288cef05911d

Download Submit
C:\Windows\SysWOW64\Pbekne32.exe

Filesize
51KB

MD5
9e058c26f2a4fe8716c0ef9fb267583c

SHA1
b6e875a887645ec27cea1accf24fe02798069ab3

SHA256
2368e95399ad422cdf9f56a027594f42d8508e933941a4358d8a93096eb140c7

SHA512
1f853302b561764c2e599806dc287d0427b11df9100559f353f9a457d002cd540a9ae1de8a9098fa52a630ca79d034a95df8c6ec143d524aa6fdbd142e954a5f

Download Submit
C:\Windows\SysWOW64\Pbekne32.exe

Filesize
51KB

MD5
9e058c26f2a4fe8716c0ef9fb267583c

SHA1
b6e875a887645ec27cea1accf24fe02798069ab3

SHA256
2368e95399ad422cdf9f56a027594f42d8508e933941a4358d8a93096eb140c7

SHA512
1f853302b561764c2e599806dc287d0427b11df9100559f353f9a457d002cd540a9ae1de8a9098fa52a630ca79d034a95df8c6ec143d524aa6fdbd142e954a5f

Download Submit
C:\Windows\SysWOW64\Pelaib32.exe

Filesize
51KB

MD5
a13380aa4b23bf7d570990a2449315f3

SHA1
30528b2fa22d3009b105368e8ca6f900237126f9

SHA256
f1aa13ca117ee96d999ddddbff4a4fc940555cbd06248b528a475bbf67939c23

SHA512
430c6eb799f29fe56116ad2caee275bc151ff856b6a63632d14953bf44a50c131a8c970cac743b38b0677bc2c0204fd19ec5c439b3669fd3bb9f8fe2e790f207

Download Submit
C:\Windows\SysWOW64\Pelaib32.exe

Filesize
51KB

MD5
a13380aa4b23bf7d570990a2449315f3

SHA1
30528b2fa22d3009b105368e8ca6f900237126f9

SHA256
f1aa13ca117ee96d999ddddbff4a4fc940555cbd06248b528a475bbf67939c23

SHA512
430c6eb799f29fe56116ad2caee275bc151ff856b6a63632d14953bf44a50c131a8c970cac743b38b0677bc2c0204fd19ec5c439b3669fd3bb9f8fe2e790f207

Download Submit
C:\Windows\SysWOW64\Piockppb.exe

Filesize
51KB

MD5
ca5329a2646b289683747760b7cf87c6

SHA1
05f34f25643f2e97d7cda75b1f5a159f83bd70d2

SHA256
d22f606b62a0ac74558971d19f331ebf38bc05b14716017c6f8a9b5668d4f790

SHA512
f0b4b641feabfacc5e688721d3970c3aa82b4cac61c38f00213a6bb8805220bc6718201471df804fc08d027ef379b2efa49491f3cf2c3db9282902cb4fc2f2a2

Download Submit
C:\Windows\SysWOW64\Piockppb.exe

Filesize
51KB

MD5
ca5329a2646b289683747760b7cf87c6

SHA1
05f34f25643f2e97d7cda75b1f5a159f83bd70d2

SHA256
d22f606b62a0ac74558971d19f331ebf38bc05b14716017c6f8a9b5668d4f790

SHA512
f0b4b641feabfacc5e688721d3970c3aa82b4cac61c38f00213a6bb8805220bc6718201471df804fc08d027ef379b2efa49491f3cf2c3db9282902cb4fc2f2a2

Download Submit
C:\Windows\SysWOW64\Qajhobmm.exe

Filesize
51KB

MD5
8c26d5c4430e9b0c417f82df222d070f

SHA1
b6b1d9197f0c493b1e83f5e1e3058160950009b0

SHA256
19a8129f5aee2e0023d5057816ced58964b0e6c381c3408b37b73a4ebc5b2591

SHA512
c0e18334e63d6e2f3772dfd311171a0b4528fbfb3a5aaadd93e01d0bc829b57245b23e14ee2bc61eead3dc51de80c6e629f13e0d961942b43f9fb9f7cc959318

Download Submit
C:\Windows\SysWOW64\Qajhobmm.exe

Filesize
51KB

MD5
8c26d5c4430e9b0c417f82df222d070f

SHA1
b6b1d9197f0c493b1e83f5e1e3058160950009b0

SHA256
19a8129f5aee2e0023d5057816ced58964b0e6c381c3408b37b73a4ebc5b2591

SHA512
c0e18334e63d6e2f3772dfd311171a0b4528fbfb3a5aaadd93e01d0bc829b57245b23e14ee2bc61eead3dc51de80c6e629f13e0d961942b43f9fb9f7cc959318

Download Submit
C:\Windows\SysWOW64\Qpikgj32.exe

Filesize
51KB

MD5
2376ed50cac569c043fdd1ffb78abfb7

SHA1
1a34270984aa406481cf157739cf627df763c22d

SHA256
7b23059af613140ae01de1dd9220cf6548d84680a4cb6560f8b7ffe135b2f9a1

SHA512
9af155c273a9ea86a84276352071bebc932d6344b634f1de61b3ff4c552a8d2fae6ab631e308d303056ecd96af12bc155b5523bdc4f72011daad79b8ff964231

Download Submit
C:\Windows\SysWOW64\Qpikgj32.exe

Filesize
51KB

MD5
2376ed50cac569c043fdd1ffb78abfb7

SHA1
1a34270984aa406481cf157739cf627df763c22d

SHA256
7b23059af613140ae01de1dd9220cf6548d84680a4cb6560f8b7ffe135b2f9a1

SHA512
9af155c273a9ea86a84276352071bebc932d6344b634f1de61b3ff4c552a8d2fae6ab631e308d303056ecd96af12bc155b5523bdc4f72011daad79b8ff964231

Download Submit
memory/228-190-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/372-157-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/864-243-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1064-187-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1116-259-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1120-286-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1252-269-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1292-260-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1448-132-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1704-238-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1716-142-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1964-297-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2016-188-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2072-168-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2084-221-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2092-287-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2100-314-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2180-306-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2268-316-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2396-160-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2416-193-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2424-294-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2448-305-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2608-320-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2908-241-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3000-257-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3048-303-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3132-195-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3196-302-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3216-271-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3360-292-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3376-167-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3432-288-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3452-285-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3592-215-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3616-240-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3648-212-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3680-298-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3780-275-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3920-258-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3972-283-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3996-217-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4056-321-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4212-242-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4260-274-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4296-158-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4404-191-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4428-213-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4460-159-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4516-282-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4524-272-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4560-268-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4564-219-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4616-273-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4624-245-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4844-313-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4868-293-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4884-311-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4936-143-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4952-144-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4996-322-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5080-284-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5092-312-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5108-239-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download