fcef7ac954564b1e6f98f70606a95a5cfa28bf527dba9a6315599018faf00b8d

Analysis

max time kernel
91s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2022, 00:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fcef7ac954564b1e6f98f70606a95a5cfa28bf527dba9a6315599018faf00b8d.exe
Size

84KB
MD5

49da9a3a09576f9bc201af36b45df079
SHA1

62d25f6bbd605fa8181b848ae7b2a29c90c253f8
SHA256

fcef7ac954564b1e6f98f70606a95a5cfa28bf527dba9a6315599018faf00b8d
SHA512

76873e18ee7690ebf7e73edbdcc8c242f8799636e22a8feea1d50aaadcd9142cf37f07ddbcb5a02b611adaaf24f87ea48e7d3e2db77710e17bd8a510544448e5
SSDEEP

1536:V2klExyqjW5b8r179OOzBCm1pXg2r3XsyoRiiQfMvf2SL:xExy95b8B7BlXgy8yoznfzL

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkookjii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aljmgf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jdkdha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlgeengd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qaofloeo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pilgdm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oplfqbgj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjkcgodg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gaaojj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgelni32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdicpphg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckclmj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knphmefj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fcgqga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgdfbpai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aebjfeod.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Feooik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Glkdkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cqajpj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cqajpj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nonbgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bndjmd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onjmao32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Clohom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mllnhm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnecfpfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alooho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aphncnoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmmehe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oaocpg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnpkejfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Alooho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnndipmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Egpgkbhe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnpchead.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jfkhlgnp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhkopf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gdcljg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dcpflf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kfdcicio.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bcbjkhdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eilfboik.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmdebqbp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Alhpbfnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Loaamhlj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kbqdcjoj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfhppfme.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlnknlcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pfmdnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdmbgf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfimdb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nifnhi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omcbag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdoolf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jhlidp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Llpomn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cmfejbdp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ficlcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kcikmnld.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lmhefb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfofpe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Plgpqb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agobdl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npcaop32.exe

Executes dropped EXE 64 IoCs

pid	Process
2040	Nfnjinob.exe
4696	Nkjcaenj.exe
3280	Nadkno32.exe
4452	Nohkgcdp.exe
4544	Nkolmd32.exe
4536	Ofdqjm32.exe
460	Okdehdeo.exe
4956	Omcbag32.exe
4764	Ocmjna32.exe
5072	Oflfjl32.exe
4732	Okhocc32.exe
4628	Obbgpmif.exe
1596	Odaclihj.exe
1568	Pkklhc32.exe
4932	Pbedemgd.exe
3444	Piolagnq.exe
428	Pcdqopng.exe
1424	Pfbmkkmj.exe
1660	Pmmehe32.exe
2380	Pbimpl32.exe
2256	Pmoamebd.exe
5008	Pfgffk32.exe
348	Popkoppe.exe
3980	Cpqlml32.exe
4420	Cfjeifjm.exe
3876	Clgmbmid.exe
3388	Ciknka32.exe
3872	Cljjgl32.exe
1212	Cbcbdfno.exe
3648	Cmifaond.exe
3460	Cbfojfll.exe
452	Dmkcgo32.exe
3984	Dbhlof32.exe
1724	Dibdlpaf.exe
2044	Ddhhihal.exe
2052	Dmpmbn32.exe
3152	Dekafqeg.exe
4876	Ddladh32.exe
2656	Dennlpce.exe
4292	Dpcbii32.exe
3100	Egmjfcjh.exe
4952	Eilfboik.exe
312	Epeooh32.exe
2456	Egpgkbhe.exe
3156	Edcgeg32.exe
4284	Elolii32.exe
3708	Ecidfclf.exe
4404	Eibmbn32.exe
4176	Epmepgkp.exe
1976	Eckalcjd.exe
2364	Enqeil32.exe
3784	Fcmnab32.exe
3832	Fncbnk32.exe
4144	Fpanjg32.exe
2452	Fgkgga32.exe
1600	Fneodked.exe
1856	Fgncmq32.exe
4280	Fpfhefbe.exe
3972	Ffcpnmam.exe
3236	Fcgqga32.exe
4508	Gcinma32.exe
4656	Ggdimpfm.exe
4228	Gpmnfemn.exe
5084	Gjebok32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Pebaog32.exe	Pohibm32.exe
File opened for modification	C:\Windows\SysWOW64\Qbjkckhk.exe	Qplogpih.exe
File created	C:\Windows\SysWOW64\Bondjnnn.dll	Egpgkbhe.exe
File opened for modification	C:\Windows\SysWOW64\Jgjefjeb.exe	Jnbpme32.exe
File created	C:\Windows\SysWOW64\Maehbknk.exe	Mklpfa32.exe
File opened for modification	C:\Windows\SysWOW64\Qhinii32.exe	Qaofloeo.exe
File created	C:\Windows\SysWOW64\Lhhnic32.dll	Mpfcoeib.exe
File created	C:\Windows\SysWOW64\Nbglpp32.exe	Nkmdcfof.exe
File created	C:\Windows\SysWOW64\Aeafgjga.dll	Alelbpmi.exe
File created	C:\Windows\SysWOW64\Agkcnfoa.dll	Neopdhjd.exe
File created	C:\Windows\SysWOW64\Qhnegj32.dll	Bfchnpmi.exe
File created	C:\Windows\SysWOW64\Mdlgca32.exe	Kfmgnojo.exe
File created	C:\Windows\SysWOW64\Cpejoldk.dll	Nmpdnohb.exe
File created	C:\Windows\SysWOW64\Apaqan32.dll	Plgpqb32.exe
File created	C:\Windows\SysWOW64\Gacbeo32.dll	Apjkin32.exe
File created	C:\Windows\SysWOW64\Cpmqekmb.exe	Cnndipmo.exe
File created	C:\Windows\SysWOW64\Dennlpce.exe	Ddladh32.exe
File opened for modification	C:\Windows\SysWOW64\Kfmnienj.exe	Kelaam32.exe
File created	C:\Windows\SysWOW64\Llblbnmp.exe	Lfecjg32.exe
File created	C:\Windows\SysWOW64\Ikbipljn.dll	Aphendbf.exe
File created	C:\Windows\SysWOW64\Jjglef32.dll	Memjhjji.exe
File opened for modification	C:\Windows\SysWOW64\Adfndbil.exe	Apkbcd32.exe
File created	C:\Windows\SysWOW64\Cpmbod32.dll	Clcajlbf.exe
File opened for modification	C:\Windows\SysWOW64\Demgajpi.exe	Dbokenpe.exe
File opened for modification	C:\Windows\SysWOW64\Mkdamgga.exe	Mieealhn.exe
File created	C:\Windows\SysWOW64\Jlapcj32.dll	Oiandh32.exe
File created	C:\Windows\SysWOW64\Djmbif32.exe	Dgnfmj32.exe
File created	C:\Windows\SysWOW64\Nkmdcfof.exe	Miohgjpc.exe
File created	C:\Windows\SysWOW64\Jbccdmoc.dll	Pmmehe32.exe
File opened for modification	C:\Windows\SysWOW64\Jmkpoj32.exe	Joebpfoa.exe
File created	C:\Windows\SysWOW64\Apadhpeb.dll	Kjepogao.exe
File created	C:\Windows\SysWOW64\Cofqqp32.dll	Bgnmfmpe.exe
File opened for modification	C:\Windows\SysWOW64\Cnpihb32.exe	Cpnimeag.exe
File created	C:\Windows\SysWOW64\Fpgfnf32.dll	Lkhbai32.exe
File created	C:\Windows\SysWOW64\Eljbcn32.dll	Clmkimho.exe
File created	C:\Windows\SysWOW64\Ndbbfj32.dll	Obbgpmif.exe
File created	C:\Windows\SysWOW64\Gmhhfenl.exe	Gglpnope.exe
File created	C:\Windows\SysWOW64\Kbaklhpe.dll	Moleao32.exe
File created	C:\Windows\SysWOW64\Eijimb32.exe	Ebpqqhkg.exe
File created	C:\Windows\SysWOW64\Ikjmim32.exe	Ilglnqeg.exe
File created	C:\Windows\SysWOW64\Kakibhdn.dll	Keonfl32.exe
File created	C:\Windows\SysWOW64\Clfljp32.dll	Dhifheqp.exe
File opened for modification	C:\Windows\SysWOW64\Lciccknb.exe	Llblbnmp.exe
File created	C:\Windows\SysWOW64\Addanc32.exe	Aphendbf.exe
File created	C:\Windows\SysWOW64\Joebpfoa.exe	Ionmpgej.exe
File created	C:\Windows\SysWOW64\Amgeac32.exe	Aikiadip.exe
File created	C:\Windows\SysWOW64\Akofhnnj.dll	Flaaef32.exe
File opened for modification	C:\Windows\SysWOW64\Gmqjnl32.exe	Gjbnbq32.exe
File opened for modification	C:\Windows\SysWOW64\Oeffeg32.exe	Okqbhn32.exe
File opened for modification	C:\Windows\SysWOW64\Eahjgdml.exe	Ebejlg32.exe
File opened for modification	C:\Windows\SysWOW64\Mjfhfe32.exe	Mboqdh32.exe
File created	C:\Windows\SysWOW64\Ponoha32.dll	Pibmel32.exe
File created	C:\Windows\SysWOW64\Mojedjhg.dll	Okdnnq32.exe
File created	C:\Windows\SysWOW64\Jlnbopoo.exe	Iddnhb32.exe
File opened for modification	C:\Windows\SysWOW64\Dqkmfi32.exe	Dmoafjhi.exe
File opened for modification	C:\Windows\SysWOW64\Pkqddebh.exe	Phbhhjcd.exe
File created	C:\Windows\SysWOW64\Ijnqgk32.exe	Iohljb32.exe
File created	C:\Windows\SysWOW64\Endgek32.dll	Liofkc32.exe
File created	C:\Windows\SysWOW64\Cimjbo32.dll	Nljkjjhe.exe
File created	C:\Windows\SysWOW64\Kdlmoold.exe	Kfimdb32.exe
File created	C:\Windows\SysWOW64\Cjeenqcc.exe	Cggibe32.exe
File created	C:\Windows\SysWOW64\Cnqaoo32.exe	Cjeenqcc.exe
File created	C:\Windows\SysWOW64\Okifbd32.dll	Ofdqjm32.exe
File opened for modification	C:\Windows\SysWOW64\Janpdqph.exe	Jnpchead.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6592	7172	WerFault.exe	975

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Boqhik32.dll"	Ikmpicmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbnipb32.dll"	Nbjppfhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Habnio32.dll"	Lkbmpb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pfbfqeio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icnnejok.dll"	Qhjecoqh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ionmpgej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmdghc32.dll"	Jmkpoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nkghgi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dkkiho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Anjiaicb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dnfkpn32.dll"	Oidjignk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aomkdjcb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lehamk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Feojkebc.dll"	Cngoiabj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Palbgg32.dll"	Jlnbopoo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aagffdca.dll"	Lkohbh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pocpgnjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mmholm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Adiadh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fjfnfbji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cqajpj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iobcll32.dll"	Mminmpnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmipkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkjigi32.dll"	Apaome32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mjmcdn32.dll"	Qaofloeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jkhikkpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aebjfeod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Heodcg32.dll"	Aedgkema.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nbnbaoqk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cebcmc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jnbpme32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pcdlmb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fhkopf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fameaj32.dll"	Kkalajgf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nifnhi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kqkodfcl.dll"	Diepbbfi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aifmbeci.dll"	Kkdoap32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gehboi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkmgli32.dll"	Amibgbpg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Maehbknk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjkcgodg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cfgmhbml.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Omcbag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lapbcbid.dll"	Pnmjeggj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgpdlh32.dll"	Eplneagd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kiajjena.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nlpaiemd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Egmjfcjh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnfknk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pebaog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdcljg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lfnfoaad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mnidja32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pfgffk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dpcbii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Memjhjji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cfjnooga.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hjclhocn.dll"	Nplddj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nonebd32.dll"	Qmnbkdjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fqnfmf32.dll"	Apceho32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qfilad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnldpnfj.dll"	Bcenkn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aepmpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbapji32.dll"	Lkiiloej.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 2040	3136	fcef7ac954564b1e6f98f70606a95a5cfa28bf527dba9a6315599018faf00b8d.exe	81
PID 3136 wrote to memory of 2040	3136	fcef7ac954564b1e6f98f70606a95a5cfa28bf527dba9a6315599018faf00b8d.exe	81
PID 3136 wrote to memory of 2040	3136	fcef7ac954564b1e6f98f70606a95a5cfa28bf527dba9a6315599018faf00b8d.exe	81
PID 2040 wrote to memory of 4696	2040	Nfnjinob.exe	82
PID 2040 wrote to memory of 4696	2040	Nfnjinob.exe	82
PID 2040 wrote to memory of 4696	2040	Nfnjinob.exe	82
PID 4696 wrote to memory of 3280	4696	Nkjcaenj.exe	83
PID 4696 wrote to memory of 3280	4696	Nkjcaenj.exe	83
PID 4696 wrote to memory of 3280	4696	Nkjcaenj.exe	83
PID 3280 wrote to memory of 4452	3280	Nadkno32.exe	84
PID 3280 wrote to memory of 4452	3280	Nadkno32.exe	84
PID 3280 wrote to memory of 4452	3280	Nadkno32.exe	84
PID 4452 wrote to memory of 4544	4452	Nohkgcdp.exe	85
PID 4452 wrote to memory of 4544	4452	Nohkgcdp.exe	85
PID 4452 wrote to memory of 4544	4452	Nohkgcdp.exe	85
PID 4544 wrote to memory of 4536	4544	Nkolmd32.exe	86
PID 4544 wrote to memory of 4536	4544	Nkolmd32.exe	86
PID 4544 wrote to memory of 4536	4544	Nkolmd32.exe	86
PID 4536 wrote to memory of 460	4536	Ofdqjm32.exe	87
PID 4536 wrote to memory of 460	4536	Ofdqjm32.exe	87
PID 4536 wrote to memory of 460	4536	Ofdqjm32.exe	87
PID 460 wrote to memory of 4956	460	Okdehdeo.exe	88
PID 460 wrote to memory of 4956	460	Okdehdeo.exe	88
PID 460 wrote to memory of 4956	460	Okdehdeo.exe	88
PID 4956 wrote to memory of 4764	4956	Omcbag32.exe	89
PID 4956 wrote to memory of 4764	4956	Omcbag32.exe	89
PID 4956 wrote to memory of 4764	4956	Omcbag32.exe	89
PID 4764 wrote to memory of 5072	4764	Ocmjna32.exe	90
PID 4764 wrote to memory of 5072	4764	Ocmjna32.exe	90
PID 4764 wrote to memory of 5072	4764	Ocmjna32.exe	90
PID 5072 wrote to memory of 4732	5072	Oflfjl32.exe	91
PID 5072 wrote to memory of 4732	5072	Oflfjl32.exe	91
PID 5072 wrote to memory of 4732	5072	Oflfjl32.exe	91
PID 4732 wrote to memory of 4628	4732	Okhocc32.exe	92
PID 4732 wrote to memory of 4628	4732	Okhocc32.exe	92
PID 4732 wrote to memory of 4628	4732	Okhocc32.exe	92
PID 4628 wrote to memory of 1596	4628	Obbgpmif.exe	93
PID 4628 wrote to memory of 1596	4628	Obbgpmif.exe	93
PID 4628 wrote to memory of 1596	4628	Obbgpmif.exe	93
PID 1596 wrote to memory of 1568	1596	Odaclihj.exe	94
PID 1596 wrote to memory of 1568	1596	Odaclihj.exe	94
PID 1596 wrote to memory of 1568	1596	Odaclihj.exe	94
PID 1568 wrote to memory of 4932	1568	Pkklhc32.exe	95
PID 1568 wrote to memory of 4932	1568	Pkklhc32.exe	95
PID 1568 wrote to memory of 4932	1568	Pkklhc32.exe	95
PID 4932 wrote to memory of 3444	4932	Pbedemgd.exe	96
PID 4932 wrote to memory of 3444	4932	Pbedemgd.exe	96
PID 4932 wrote to memory of 3444	4932	Pbedemgd.exe	96
PID 3444 wrote to memory of 428	3444	Piolagnq.exe	97
PID 3444 wrote to memory of 428	3444	Piolagnq.exe	97
PID 3444 wrote to memory of 428	3444	Piolagnq.exe	97
PID 428 wrote to memory of 1424	428	Pcdqopng.exe	98
PID 428 wrote to memory of 1424	428	Pcdqopng.exe	98
PID 428 wrote to memory of 1424	428	Pcdqopng.exe	98
PID 1424 wrote to memory of 1660	1424	Pfbmkkmj.exe	99
PID 1424 wrote to memory of 1660	1424	Pfbmkkmj.exe	99
PID 1424 wrote to memory of 1660	1424	Pfbmkkmj.exe	99
PID 1660 wrote to memory of 2380	1660	Pmmehe32.exe	100
PID 1660 wrote to memory of 2380	1660	Pmmehe32.exe	100
PID 1660 wrote to memory of 2380	1660	Pmmehe32.exe	100
PID 2380 wrote to memory of 2256	2380	Pbimpl32.exe	101
PID 2380 wrote to memory of 2256	2380	Pbimpl32.exe	101
PID 2380 wrote to memory of 2256	2380	Pbimpl32.exe	101
PID 2256 wrote to memory of 5008	2256	Pmoamebd.exe	102

C:\Users\Admin\AppData\Local\Temp\fcef7ac954564b1e6f98f70606a95a5cfa28bf527dba9a6315599018faf00b8d.exe
"C:\Users\Admin\AppData\Local\Temp\fcef7ac954564b1e6f98f70606a95a5cfa28bf527dba9a6315599018faf00b8d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\SysWOW64\Nfnjinob.exe
  C:\Windows\system32\Nfnjinob.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Windows\SysWOW64\Nkjcaenj.exe
    C:\Windows\system32\Nkjcaenj.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\Windows\SysWOW64\Nadkno32.exe
      C:\Windows\system32\Nadkno32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3280
    - - C:\Windows\SysWOW64\Nohkgcdp.exe
        
        C:\Windows\system32\Nohkgcdp.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4452
      - C:\Windows\SysWOW64\Nkolmd32.exe
        
        C:\Windows\system32\Nkolmd32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\SysWOW64\Ofdqjm32.exe
        
        C:\Windows\system32\Ofdqjm32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4536
        
        C:\Windows\SysWOW64\Okdehdeo.exe
        
        C:\Windows\system32\Okdehdeo.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:460
        
        C:\Windows\SysWOW64\Omcbag32.exe
        
        C:\Windows\system32\Omcbag32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4956
        
        C:\Windows\SysWOW64\Ocmjna32.exe
        
        C:\Windows\system32\Ocmjna32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4764
        
        C:\Windows\SysWOW64\Oflfjl32.exe
        
        C:\Windows\system32\Oflfjl32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Windows\SysWOW64\Okhocc32.exe
        
        C:\Windows\system32\Okhocc32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4732
        
        C:\Windows\SysWOW64\Obbgpmif.exe
        
        C:\Windows\system32\Obbgpmif.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4628
        
        C:\Windows\SysWOW64\Odaclihj.exe
        
        C:\Windows\system32\Odaclihj.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1596
        
        C:\Windows\SysWOW64\Pkklhc32.exe
        
        C:\Windows\system32\Pkklhc32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1568
        
        C:\Windows\SysWOW64\Pbedemgd.exe
        
        C:\Windows\system32\Pbedemgd.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4932
        
        C:\Windows\SysWOW64\Piolagnq.exe
        
        C:\Windows\system32\Piolagnq.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3444
        
        C:\Windows\SysWOW64\Pcdqopng.exe
        
        C:\Windows\system32\Pcdqopng.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:428
        
        C:\Windows\SysWOW64\Pfbmkkmj.exe
        
        C:\Windows\system32\Pfbmkkmj.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1424
        
        C:\Windows\SysWOW64\Pmmehe32.exe
        
        C:\Windows\system32\Pmmehe32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1660
        
        C:\Windows\SysWOW64\Pbimpl32.exe
        
        C:\Windows\system32\Pbimpl32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2380
        
        C:\Windows\SysWOW64\Pmoamebd.exe
        
        C:\Windows\system32\Pmoamebd.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2256
        
        C:\Windows\SysWOW64\Pfgffk32.exe
        
        C:\Windows\system32\Pfgffk32.exe
        23⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5008
        
        C:\Windows\SysWOW64\Popkoppe.exe
        
        C:\Windows\system32\Popkoppe.exe
        24⤵
        Executes dropped EXE
        
        PID:348
        
        C:\Windows\SysWOW64\Cpqlml32.exe
        
        C:\Windows\system32\Cpqlml32.exe
        25⤵
        Executes dropped EXE
        
        PID:3980
        
        C:\Windows\SysWOW64\Cfjeifjm.exe
        
        C:\Windows\system32\Cfjeifjm.exe
        26⤵
        Executes dropped EXE
        
        PID:4420
        
        C:\Windows\SysWOW64\Clgmbmid.exe
        
        C:\Windows\system32\Clgmbmid.exe
        27⤵
        Executes dropped EXE
        
        PID:3876
        
        C:\Windows\SysWOW64\Ciknka32.exe
        
        C:\Windows\system32\Ciknka32.exe
        28⤵
        Executes dropped EXE
        
        PID:3388
        
        C:\Windows\SysWOW64\Cljjgl32.exe
        
        C:\Windows\system32\Cljjgl32.exe
        29⤵
        Executes dropped EXE
        
        PID:3872
        
        C:\Windows\SysWOW64\Cbcbdfno.exe
        
        C:\Windows\system32\Cbcbdfno.exe
        30⤵
        Executes dropped EXE
        
        PID:1212
        
        C:\Windows\SysWOW64\Cmifaond.exe
        
        C:\Windows\system32\Cmifaond.exe
        31⤵
        Executes dropped EXE
        
        PID:3648
        
        C:\Windows\SysWOW64\Cbfojfll.exe
        
        C:\Windows\system32\Cbfojfll.exe
        32⤵
        Executes dropped EXE
        
        PID:3460
        
        C:\Windows\SysWOW64\Dmkcgo32.exe
        
        C:\Windows\system32\Dmkcgo32.exe
        33⤵
        Executes dropped EXE
        
        PID:452
        
        C:\Windows\SysWOW64\Dbhlof32.exe
        
        C:\Windows\system32\Dbhlof32.exe
        34⤵
        Executes dropped EXE
        
        PID:3984
        
        C:\Windows\SysWOW64\Dibdlpaf.exe
        
        C:\Windows\system32\Dibdlpaf.exe
        35⤵
        Executes dropped EXE
        
        PID:1724
        
        C:\Windows\SysWOW64\Ddhhihal.exe
        
        C:\Windows\system32\Ddhhihal.exe
        36⤵
        Executes dropped EXE
        
        PID:2044
        
        C:\Windows\SysWOW64\Dmpmbn32.exe
        
        C:\Windows\system32\Dmpmbn32.exe
        37⤵
        Executes dropped EXE
        
        PID:2052
        
        C:\Windows\SysWOW64\Dekafqeg.exe
        
        C:\Windows\system32\Dekafqeg.exe
        38⤵
        Executes dropped EXE
        
        PID:3152
        
        C:\Windows\SysWOW64\Ddladh32.exe
        
        C:\Windows\system32\Ddladh32.exe
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4876
        
        C:\Windows\SysWOW64\Dennlpce.exe
        
        C:\Windows\system32\Dennlpce.exe
        40⤵
        Executes dropped EXE
        
        PID:2656
        
        C:\Windows\SysWOW64\Dpcbii32.exe
        
        C:\Windows\system32\Dpcbii32.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4292
        
        C:\Windows\SysWOW64\Egmjfcjh.exe
        
        C:\Windows\system32\Egmjfcjh.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3100
        
        C:\Windows\SysWOW64\Eilfboik.exe
        
        C:\Windows\system32\Eilfboik.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4952
        
        C:\Windows\SysWOW64\Epeooh32.exe
        
        C:\Windows\system32\Epeooh32.exe
        44⤵
        Executes dropped EXE
        
        PID:312
        
        C:\Windows\SysWOW64\Egpgkbhe.exe
        
        C:\Windows\system32\Egpgkbhe.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2456
        
        C:\Windows\SysWOW64\Edcgeg32.exe
        
        C:\Windows\system32\Edcgeg32.exe
        46⤵
        Executes dropped EXE
        
        PID:3156
        
        C:\Windows\SysWOW64\Elolii32.exe
        
        C:\Windows\system32\Elolii32.exe
        47⤵
        Executes dropped EXE
        
        PID:4284
        
        C:\Windows\SysWOW64\Ecidfclf.exe
        
        C:\Windows\system32\Ecidfclf.exe
        48⤵
        Executes dropped EXE
        
        PID:3708
        
        C:\Windows\SysWOW64\Eibmbn32.exe
        
        C:\Windows\system32\Eibmbn32.exe
        49⤵
        Executes dropped EXE
        
        PID:4404
        
        C:\Windows\SysWOW64\Epmepgkp.exe
        
        C:\Windows\system32\Epmepgkp.exe
        50⤵
        Executes dropped EXE
        
        PID:4176
        
        C:\Windows\SysWOW64\Eckalcjd.exe
        
        C:\Windows\system32\Eckalcjd.exe
        51⤵
        Executes dropped EXE
        
        PID:1976
        
        C:\Windows\SysWOW64\Enqeil32.exe
        
        C:\Windows\system32\Enqeil32.exe
        52⤵
        Executes dropped EXE
        
        PID:2364
        
        C:\Windows\SysWOW64\Fcmnab32.exe
        
        C:\Windows\system32\Fcmnab32.exe
        53⤵
        Executes dropped EXE
        
        PID:3784
        
        C:\Windows\SysWOW64\Fncbnk32.exe
        
        C:\Windows\system32\Fncbnk32.exe
        54⤵
        Executes dropped EXE
        
        PID:3832
        
        C:\Windows\SysWOW64\Fpanjg32.exe
        
        C:\Windows\system32\Fpanjg32.exe
        55⤵
        Executes dropped EXE
        
        PID:4144
        
        C:\Windows\SysWOW64\Fgkgga32.exe
        
        C:\Windows\system32\Fgkgga32.exe
        56⤵
        Executes dropped EXE
        
        PID:2452
        
        C:\Windows\SysWOW64\Fneodked.exe
        
        C:\Windows\system32\Fneodked.exe
        57⤵
        Executes dropped EXE
        
        PID:1600
        
        C:\Windows\SysWOW64\Fgncmq32.exe
        
        C:\Windows\system32\Fgncmq32.exe
        58⤵
        Executes dropped EXE
        
        PID:1856
        
        C:\Windows\SysWOW64\Fpfhefbe.exe
        
        C:\Windows\system32\Fpfhefbe.exe
        59⤵
        Executes dropped EXE
        
        PID:4280
        
        C:\Windows\SysWOW64\Ffcpnmam.exe
        
        C:\Windows\system32\Ffcpnmam.exe
        60⤵
        Executes dropped EXE
        
        PID:3972
        
        C:\Windows\SysWOW64\Fcgqga32.exe
        
        C:\Windows\system32\Fcgqga32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3236
        
        C:\Windows\SysWOW64\Gcinma32.exe
        
        C:\Windows\system32\Gcinma32.exe
        62⤵
        Executes dropped EXE
        
        PID:4508
        
        C:\Windows\SysWOW64\Ggdimpfm.exe
        
        C:\Windows\system32\Ggdimpfm.exe
        63⤵
        Executes dropped EXE
        
        PID:4656
        
        C:\Windows\SysWOW64\Gpmnfemn.exe
        
        C:\Windows\system32\Gpmnfemn.exe
        64⤵
        Executes dropped EXE
        
        PID:4228
        
        C:\Windows\SysWOW64\Gjebok32.exe
        
        C:\Windows\system32\Gjebok32.exe
        65⤵
        Executes dropped EXE
        
        PID:5084
        
        C:\Windows\SysWOW64\Ggicho32.exe
        
        C:\Windows\system32\Ggicho32.exe
        66⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\Gjhoej32.exe
        
        C:\Windows\system32\Gjhoej32.exe
        67⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\Gqagad32.exe
        
        C:\Windows\system32\Gqagad32.exe
        68⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\Gglpnope.exe
        
        C:\Windows\system32\Gglpnope.exe
        69⤵
        Drops file in System32 directory
        
        PID:1444
        
        C:\Windows\SysWOW64\Gmhhfenl.exe
        
        C:\Windows\system32\Gmhhfenl.exe
        70⤵
        
        PID:368
        
        C:\Windows\SysWOW64\Gqddgd32.exe
        
        C:\Windows\system32\Gqddgd32.exe
        71⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Ggnlcnnb.exe
        
        C:\Windows\system32\Ggnlcnnb.exe
        72⤵
        
        PID:3780
        
        C:\Windows\SysWOW64\Gmkelelj.exe
        
        C:\Windows\system32\Gmkelelj.exe
        73⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\Hdbmmb32.exe
        
        C:\Windows\system32\Hdbmmb32.exe
        74⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Hfciekbj.exe
        
        C:\Windows\system32\Hfciekbj.exe
        75⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\Hmmaae32.exe
        
        C:\Windows\system32\Hmmaae32.exe
        76⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\Hqinbcbp.exe
        
        C:\Windows\system32\Hqinbcbp.exe
        77⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\Hfefjjqg.exe
        
        C:\Windows\system32\Hfefjjqg.exe
        78⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Hnmnkhaj.exe
        
        C:\Windows\system32\Hnmnkhaj.exe
        79⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\Hqkjgcpn.exe
        
        C:\Windows\system32\Hqkjgcpn.exe
        80⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Hdgfhbig.exe
        
        C:\Windows\system32\Hdgfhbig.exe
        81⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\Hfhbpj32.exe
        
        C:\Windows\system32\Hfhbpj32.exe
        82⤵
        
        PID:4588
        
        C:\Windows\SysWOW64\Hggojmfh.exe
        
        C:\Windows\system32\Hggojmfh.exe
        83⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\Hqpcbb32.exe
        
        C:\Windows\system32\Hqpcbb32.exe
        84⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Hcnpon32.exe
        
        C:\Windows\system32\Hcnpon32.exe
        85⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Hgjlom32.exe
        
        C:\Windows\system32\Hgjlom32.exe
        86⤵
        
        PID:4192
        
        C:\Windows\SysWOW64\Hnddlgkb.exe
        
        C:\Windows\system32\Hnddlgkb.exe
        87⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\Idnlia32.exe
        
        C:\Windows\system32\Idnlia32.exe
        88⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\Ifoiqihm.exe
        
        C:\Windows\system32\Ifoiqihm.exe
        89⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\Imiamc32.exe
        
        C:\Windows\system32\Imiamc32.exe
        90⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\Ignejlpp.exe
        
        C:\Windows\system32\Ignejlpp.exe
        91⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\Ijmaggoc.exe
        
        C:\Windows\system32\Ijmaggoc.exe
        92⤵
        
        PID:888
        
        C:\Windows\SysWOW64\Iqgjca32.exe
        
        C:\Windows\system32\Iqgjca32.exe
        93⤵
        
        PID:984
        
        C:\Windows\SysWOW64\Ifcblh32.exe
        
        C:\Windows\system32\Ifcblh32.exe
        94⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\Inkjmf32.exe
        
        C:\Windows\system32\Inkjmf32.exe
        95⤵
        
        PID:8
        
        C:\Windows\SysWOW64\Ieebiplg.exe
        
        C:\Windows\system32\Ieebiplg.exe
        96⤵
        
        PID:1152
        
        C:\Windows\SysWOW64\Igcoeklj.exe
        
        C:\Windows\system32\Igcoeklj.exe
        97⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Inmgbecg.exe
        
        C:\Windows\system32\Inmgbecg.exe
        98⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\Iakcoabk.exe
        
        C:\Windows\system32\Iakcoabk.exe
        99⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Icjoklao.exe
        
        C:\Windows\system32\Icjoklao.exe
        100⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Jnpchead.exe
        
        C:\Windows\system32\Jnpchead.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5176
        
        C:\Windows\SysWOW64\Janpdqph.exe
        
        C:\Windows\system32\Janpdqph.exe
        102⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Jcllplol.exe
        
        C:\Windows\system32\Jcllplol.exe
        103⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Jfkhlgnp.exe
        
        C:\Windows\system32\Jfkhlgnp.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5244
        
        C:\Windows\SysWOW64\Jnbpme32.exe
        
        C:\Windows\system32\Jnbpme32.exe
        105⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5260
        
        C:\Windows\SysWOW64\Jgjefjeb.exe
        
        C:\Windows\system32\Jgjefjeb.exe
        106⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Jceofkga.exe
        
        C:\Windows\system32\Jceofkga.exe
        107⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Kaiopo32.exe
        
        C:\Windows\system32\Kaiopo32.exe
        108⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Kffhhf32.exe
        
        C:\Windows\system32\Kffhhf32.exe
        109⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Kalleo32.exe
        
        C:\Windows\system32\Kalleo32.exe
        110⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Kcjhaj32.exe
        
        C:\Windows\system32\Kcjhaj32.exe
        111⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Kjdqndji.exe
        
        C:\Windows\system32\Kjdqndji.exe
        112⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Kanikn32.exe
        
        C:\Windows\system32\Kanikn32.exe
        113⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Khhagh32.exe
        
        C:\Windows\system32\Khhagh32.exe
        114⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Kfkacepm.exe
        
        C:\Windows\system32\Kfkacepm.exe
        115⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Knbidbqo.exe
        
        C:\Windows\system32\Knbidbqo.exe
        116⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Kaqeqnpc.exe
        
        C:\Windows\system32\Kaqeqnpc.exe
        117⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Kelaam32.exe
        
        C:\Windows\system32\Kelaam32.exe
        118⤵
        Drops file in System32 directory
        
        PID:5480
        
        C:\Windows\SysWOW64\Kfmnienj.exe
        
        C:\Windows\system32\Kfmnienj.exe
        119⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Kjijic32.exe
        
        C:\Windows\system32\Kjijic32.exe
        120⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Kacbfnnp.exe
        
        C:\Windows\system32\Kacbfnnp.exe
        121⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Keonfl32.exe
        
        C:\Windows\system32\Keonfl32.exe
        122⤵
        Drops file in System32 directory
        
        PID:5584
        
        C:\Windows\SysWOW64\Khmjbhem.exe
        
        C:\Windows\system32\Khmjbhem.exe
        123⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Ljkgocdq.exe
        
        C:\Windows\system32\Ljkgocdq.exe
        124⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Lmjckocd.exe
        
        C:\Windows\system32\Lmjckocd.exe
        125⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Leaklldg.exe
        
        C:\Windows\system32\Leaklldg.exe
        126⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Lhoghgcj.exe
        
        C:\Windows\system32\Lhoghgcj.exe
        127⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Ljncdcbn.exe
        
        C:\Windows\system32\Ljncdcbn.exe
        128⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Lechalbd.exe
        
        C:\Windows\system32\Lechalbd.exe
        129⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Lhadng32.exe
        
        C:\Windows\system32\Lhadng32.exe
        130⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Lolljahd.exe
        
        C:\Windows\system32\Lolljahd.exe
        131⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Lajhgmhh.exe
        
        C:\Windows\system32\Lajhgmhh.exe
        132⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Lhdqcg32.exe
        
        C:\Windows\system32\Lhdqcg32.exe
        133⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Lkbmpb32.exe
        
        C:\Windows\system32\Lkbmpb32.exe
        134⤵
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Lmqiln32.exe
        
        C:\Windows\system32\Lmqiln32.exe
        135⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Lehamk32.exe
        
        C:\Windows\system32\Lehamk32.exe
        136⤵
        Modifies registry class
        
        PID:5928
        
        C:\Windows\SysWOW64\Lhfmif32.exe
        
        C:\Windows\system32\Lhfmif32.exe
        137⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Lmcfamkj.exe
        
        C:\Windows\system32\Lmcfamkj.exe
        138⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Lejnbkll.exe
        
        C:\Windows\system32\Lejnbkll.exe
        139⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Lhijofkp.exe
        
        C:\Windows\system32\Lhijofkp.exe
        140⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Mobbkp32.exe
        
        C:\Windows\system32\Mobbkp32.exe
        141⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Memjhjji.exe
        
        C:\Windows\system32\Memjhjji.exe
        142⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6024
        
        C:\Windows\SysWOW64\Mgngpb32.exe
        
        C:\Windows\system32\Mgngpb32.exe
        143⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Mmholm32.exe
        
        C:\Windows\system32\Mmholm32.exe
        144⤵
        Modifies registry class
        
        PID:6056
        
        C:\Windows\SysWOW64\Mdagigoa.exe
        
        C:\Windows\system32\Mdagigoa.exe
        145⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Mklpfa32.exe
        
        C:\Windows\system32\Mklpfa32.exe
        146⤵
        Drops file in System32 directory
        
        PID:6088
        
        C:\Windows\SysWOW64\Maehbknk.exe
        
        C:\Windows\system32\Maehbknk.exe
        147⤵
        Modifies registry class
        
        PID:6104
        
        C:\Windows\SysWOW64\Mhppoe32.exe
        
        C:\Windows\system32\Mhppoe32.exe
        148⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Mojhlold.exe
        
        C:\Windows\system32\Mojhlold.exe
        149⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Mdfadf32.exe
        
        C:\Windows\system32\Mdfadf32.exe
        150⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Moleao32.exe
        
        C:\Windows\system32\Moleao32.exe
        151⤵
        Drops file in System32 directory
        
        PID:5184
        
        C:\Windows\SysWOW64\Mefmnibo.exe
        
        C:\Windows\system32\Mefmnibo.exe
        152⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\Mdinjf32.exe
        
        C:\Windows\system32\Mdinjf32.exe
        153⤵
        
        PID:2688
        
        C:\Windows\SysWOW64\Nggjfa32.exe
        
        C:\Windows\system32\Nggjfa32.exe
        154⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\Nkbffppf.exe
        
        C:\Windows\system32\Nkbffppf.exe
        155⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\Nonbgo32.exe
        
        C:\Windows\system32\Nonbgo32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5524
        
        C:\Windows\SysWOW64\Nmabbkoj.exe
        
        C:\Windows\system32\Nmabbkoj.exe
        157⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Nehjci32.exe
        
        C:\Windows\system32\Nehjci32.exe
        158⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\Nkeblp32.exe
        
        C:\Windows\system32\Nkeblp32.exe
        159⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\Noqolnfm.exe
        
        C:\Windows\system32\Noqolnfm.exe
        160⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Naokijep.exe
        
        C:\Windows\system32\Naokijep.exe
        161⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Ndmgeedd.exe
        
        C:\Windows\system32\Ndmgeedd.exe
        162⤵
        
        PID:1748
        
        C:\Windows\SysWOW64\Nglcaqcg.exe
        
        C:\Windows\system32\Nglcaqcg.exe
        163⤵
        
        PID:2900
        
        C:\Windows\SysWOW64\Nkgoao32.exe
        
        C:\Windows\system32\Nkgoao32.exe
        164⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Nnfknk32.exe
        
        C:\Windows\system32\Nnfknk32.exe
        165⤵
        Modifies registry class
        
        PID:2272
        
        C:\Windows\SysWOW64\Ngnpfp32.exe
        
        C:\Windows\system32\Ngnpfp32.exe
        166⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Neopdhjd.exe
        
        C:\Windows\system32\Neopdhjd.exe
        167⤵
        Drops file in System32 directory
        
        PID:3888
        
        C:\Windows\SysWOW64\Ngqmlp32.exe
        
        C:\Windows\system32\Ngqmlp32.exe
        168⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Nohdmm32.exe
        
        C:\Windows\system32\Nohdmm32.exe
        169⤵
        
        PID:4272
        
        C:\Windows\SysWOW64\Oddmed32.exe
        
        C:\Windows\system32\Oddmed32.exe
        170⤵
        
        PID:2248
        
        C:\Windows\SysWOW64\Ogciapnp.exe
        
        C:\Windows\system32\Ogciapnp.exe
        171⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\Odgjkdli.exe
        
        C:\Windows\system32\Odgjkdli.exe
        172⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\Okqbhn32.exe
        
        C:\Windows\system32\Okqbhn32.exe
        173⤵
        Drops file in System32 directory
        
        PID:6148
        
        C:\Windows\SysWOW64\Oeffeg32.exe
        
        C:\Windows\system32\Oeffeg32.exe
        174⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Okcomnbc.exe
        
        C:\Windows\system32\Okcomnbc.exe
        175⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Oeicjfai.exe
        
        C:\Windows\system32\Oeicjfai.exe
        176⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Ogjpbo32.exe
        
        C:\Windows\system32\Ogjpbo32.exe
        177⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Oaocpg32.exe
        
        C:\Windows\system32\Oaocpg32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6228
        
        C:\Windows\SysWOW64\Odnplc32.exe
        
        C:\Windows\system32\Odnplc32.exe
        179⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Okhhhm32.exe
        
        C:\Windows\system32\Okhhhm32.exe
        180⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Oabpegek.exe
        
        C:\Windows\system32\Oabpegek.exe
        181⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Pdpmabdo.exe
        
        C:\Windows\system32\Pdpmabdo.exe
        182⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Pnhajh32.exe
        
        C:\Windows\system32\Pnhajh32.exe
        183⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Pdbigbbl.exe
        
        C:\Windows\system32\Pdbigbbl.exe
        184⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Pklacl32.exe
        
        C:\Windows\system32\Pklacl32.exe
        185⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Pbfjpf32.exe
        
        C:\Windows\system32\Pbfjpf32.exe
        186⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Pfbfqeio.exe
        
        C:\Windows\system32\Pfbfqeio.exe
        187⤵
        Modifies registry class
        
        PID:6392
        
        C:\Windows\SysWOW64\Phqbmqhb.exe
        
        C:\Windows\system32\Phqbmqhb.exe
        188⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Pojjik32.exe
        
        C:\Windows\system32\Pojjik32.exe
        189⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Pnmjeggj.exe
        
        C:\Windows\system32\Pnmjeggj.exe
        190⤵
        Modifies registry class
        
        PID:6472
        
        C:\Windows\SysWOW64\Pfdbfegl.exe
        
        C:\Windows\system32\Pfdbfegl.exe
        191⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Pkakolec.exe
        
        C:\Windows\system32\Pkakolec.exe
        192⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Pomgoj32.exe
        
        C:\Windows\system32\Pomgoj32.exe
        193⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Pghlcmkg.exe
        
        C:\Windows\system32\Pghlcmkg.exe
        194⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Pnbdpg32.exe
        
        C:\Windows\system32\Pnbdpg32.exe
        195⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Qfilad32.exe
        
        C:\Windows\system32\Qfilad32.exe
        196⤵
        Modifies registry class
        
        PID:6652
        
        C:\Windows\SysWOW64\Qhghnp32.exe
        
        C:\Windows\system32\Qhghnp32.exe
        197⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Qkfdjk32.exe
        
        C:\Windows\system32\Qkfdjk32.exe
        198⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Qndqff32.exe
        
        C:\Windows\system32\Qndqff32.exe
        199⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Qhjecoqh.exe
        
        C:\Windows\system32\Qhjecoqh.exe
        200⤵
        Modifies registry class
        
        PID:6716
        
        C:\Windows\SysWOW64\Qodmpi32.exe
        
        C:\Windows\system32\Qodmpi32.exe
        201⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Afnelcoa.exe
        
        C:\Windows\system32\Afnelcoa.exe
        202⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Agobdl32.exe
        
        C:\Windows\system32\Agobdl32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6772
        
        C:\Windows\SysWOW64\Aofjei32.exe
        
        C:\Windows\system32\Aofjei32.exe
        204⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Abdfad32.exe
        
        C:\Windows\system32\Abdfad32.exe
        205⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Agaojkcm.exe
        
        C:\Windows\system32\Agaojkcm.exe
        206⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Akmjjj32.exe
        
        C:\Windows\system32\Akmjjj32.exe
        207⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Abgcgdcc.exe
        
        C:\Windows\system32\Abgcgdcc.exe
        208⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Afbogb32.exe
        
        C:\Windows\system32\Afbogb32.exe
        209⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Aiakcn32.exe
        
        C:\Windows\system32\Aiakcn32.exe
        210⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Akogpj32.exe
        
        C:\Windows\system32\Akogpj32.exe
        211⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Abipmcap.exe
        
        C:\Windows\system32\Abipmcap.exe
        212⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Afekmb32.exe
        
        C:\Windows\system32\Afekmb32.exe
        213⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Agfhek32.exe
        
        C:\Windows\system32\Agfhek32.exe
        214⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Bobiagld.exe
        
        C:\Windows\system32\Bobiagld.exe
        215⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Bndjmd32.exe
        
        C:\Windows\system32\Bndjmd32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6352
        
        C:\Windows\SysWOW64\Bbpembkh.exe
        
        C:\Windows\system32\Bbpembkh.exe
        217⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Beobinjl.exe
        
        C:\Windows\system32\Beobinjl.exe
        218⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Bgmnejip.exe
        
        C:\Windows\system32\Bgmnejip.exe
        219⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Bngfbc32.exe
        
        C:\Windows\system32\Bngfbc32.exe
        220⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Bfnnca32.exe
        
        C:\Windows\system32\Bfnnca32.exe
        221⤵
        
        PID:6592
        
        C:\Windows\SysWOW64\Bgokkigm.exe
        
        C:\Windows\system32\Bgokkigm.exe
        222⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Bnichcnj.exe
        
        C:\Windows\system32\Bnichcnj.exe
        223⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Beckdn32.exe
        
        C:\Windows\system32\Beckdn32.exe
        224⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Bpipaf32.exe
        
        C:\Windows\system32\Bpipaf32.exe
        225⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Bfchnpmi.exe
        
        C:\Windows\system32\Bfchnpmi.exe
        226⤵
        Drops file in System32 directory
        
        PID:7144
        
        C:\Windows\SysWOW64\Beehjm32.exe
        
        C:\Windows\system32\Beehjm32.exe
        227⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Cpklgfcj.exe
        
        C:\Windows\system32\Cpklgfcj.exe
        228⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Cbjhcabn.exe
        
        C:\Windows\system32\Cbjhcabn.exe
        229⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Cicqpk32.exe
        
        C:\Windows\system32\Cicqpk32.exe
        230⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Cpnimeag.exe
        
        C:\Windows\system32\Cpnimeag.exe
        231⤵
        Drops file in System32 directory
        
        PID:7196
        
        C:\Windows\SysWOW64\Cnpihb32.exe
        
        C:\Windows\system32\Cnpihb32.exe
        232⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Cfgaip32.exe
        
        C:\Windows\system32\Cfgaip32.exe
        233⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Cifmfk32.exe
        
        C:\Windows\system32\Cifmfk32.exe
        234⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Cppebepd.exe
        
        C:\Windows\system32\Cppebepd.exe
        235⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Cfjnooga.exe
        
        C:\Windows\system32\Cfjnooga.exe
        236⤵
        Modifies registry class
        
        PID:7276
        
        C:\Windows\SysWOW64\Cihjkkfe.exe
        
        C:\Windows\system32\Cihjkkfe.exe
        237⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Clgfgfei.exe
        
        C:\Windows\system32\Clgfgfei.exe
        238⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Cnebcadl.exe
        
        C:\Windows\system32\Cnebcadl.exe
        239⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Cikgqjdb.exe
        
        C:\Windows\system32\Cikgqjdb.exe
        240⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Cpdond32.exe
        
        C:\Windows\system32\Cpdond32.exe
        241⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Cngoiabj.exe
        
        C:\Windows\system32\Cngoiabj.exe
        242⤵
        Modifies registry class
        
        PID:7372
        
        C:\Windows\SysWOW64\Cfogjo32.exe
        
        C:\Windows\system32\Cfogjo32.exe
        243⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Ceagfkjf.exe
        
        C:\Windows\system32\Ceagfkjf.exe
        244⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Cimcfj32.exe
        
        C:\Windows\system32\Cimcfj32.exe
        245⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Dlkpbe32.exe
        
        C:\Windows\system32\Dlkpbe32.exe
        246⤵
        
        PID:7440

C:\Windows\SysWOW64\Dnjloa32.exe
C:\Windows\system32\Dnjloa32.exe
1⤵
PID:7460
- C:\Windows\SysWOW64\Dbehophp.exe
  C:\Windows\system32\Dbehophp.exe
  2⤵
  PID:7484
- - C:\Windows\SysWOW64\Dfadpn32.exe
    C:\Windows\system32\Dfadpn32.exe
    3⤵
    PID:7512
  - - C:\Windows\SysWOW64\Dioplj32.exe
      C:\Windows\system32\Dioplj32.exe
      4⤵
      PID:7528
    - - C:\Windows\SysWOW64\Dlnlhe32.exe
        
        C:\Windows\system32\Dlnlhe32.exe
        5⤵
        
        PID:7560
      - C:\Windows\SysWOW64\Dpihhdgj.exe
        
        C:\Windows\system32\Dpihhdgj.exe
        6⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Didjgilh.exe
        
        C:\Windows\system32\Didjgilh.exe
        7⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Dlbfcdkk.exe
        
        C:\Windows\system32\Dlbfcdkk.exe
        8⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Dblnpo32.exe
        
        C:\Windows\system32\Dblnpo32.exe
        9⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Dhifheqp.exe
        
        C:\Windows\system32\Dhifheqp.exe
        10⤵
        Drops file in System32 directory
        
        PID:7728
        
        C:\Windows\SysWOW64\Dbokenpe.exe
        
        C:\Windows\system32\Dbokenpe.exe
        11⤵
        Drops file in System32 directory
        
        PID:7764
        
        C:\Windows\SysWOW64\Demgajpi.exe
        
        C:\Windows\system32\Demgajpi.exe
        12⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Eoekjo32.exe
        
        C:\Windows\system32\Eoekjo32.exe
        13⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Eplneagd.exe
        
        C:\Windows\system32\Eplneagd.exe
        14⤵
        Modifies registry class
        
        PID:7812
        
        C:\Windows\SysWOW64\Figocflb.exe
        
        C:\Windows\system32\Figocflb.exe
        15⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Flgheaic.exe
        
        C:\Windows\system32\Flgheaic.exe
        16⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Fohagm32.exe
        
        C:\Windows\system32\Fohagm32.exe
        17⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Gipbjech.exe
        
        C:\Windows\system32\Gipbjech.exe
        18⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Gibooeae.exe
        
        C:\Windows\system32\Gibooeae.exe
        19⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Hfjhkc32.exe
        
        C:\Windows\system32\Hfjhkc32.exe
        20⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Ihokhnbb.exe
        
        C:\Windows\system32\Ihokhnbb.exe
        21⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Ionmpgej.exe
        
        C:\Windows\system32\Ionmpgej.exe
        22⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8028
        
        C:\Windows\SysWOW64\Joebpfoa.exe
        
        C:\Windows\system32\Joebpfoa.exe
        23⤵
        Drops file in System32 directory
        
        PID:8044
        
        C:\Windows\SysWOW64\Jmkpoj32.exe
        
        C:\Windows\system32\Jmkpoj32.exe
        24⤵
        Modifies registry class
        
        PID:8060
        
        C:\Windows\SysWOW64\Kcjagd32.exe
        
        C:\Windows\system32\Kcjagd32.exe
        25⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Kapofhlg.exe
        
        C:\Windows\system32\Kapofhlg.exe
        26⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Kfmgnojo.exe
        
        C:\Windows\system32\Kfmgnojo.exe
        27⤵
        Drops file in System32 directory
        
        PID:8132
        
        C:\Windows\SysWOW64\Mdlgca32.exe
        
        C:\Windows\system32\Mdlgca32.exe
        28⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Mhjpipea.exe
        
        C:\Windows\system32\Mhjpipea.exe
        29⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Magnndhm.exe
        
        C:\Windows\system32\Magnndhm.exe
        30⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Mhafjo32.exe
        
        C:\Windows\system32\Mhafjo32.exe
        31⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Nhcbpnmg.exe
        
        C:\Windows\system32\Nhcbpnmg.exe
        32⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\Nieogf32.exe
        
        C:\Windows\system32\Nieogf32.exe
        33⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Nandncbd.exe
        
        C:\Windows\system32\Nandncbd.exe
        34⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Ndmpjoah.exe
        
        C:\Windows\system32\Ndmpjoah.exe
        35⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Nhhlkn32.exe
        
        C:\Windows\system32\Nhhlkn32.exe
        36⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Ngklfjpl.exe
        
        C:\Windows\system32\Ngklfjpl.exe
        37⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Nkghgi32.exe
        
        C:\Windows\system32\Nkghgi32.exe
        38⤵
        Modifies registry class
        
        PID:7840
        
        C:\Windows\SysWOW64\Nijhbfop.exe
        
        C:\Windows\system32\Nijhbfop.exe
        39⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Nmedcd32.exe
        
        C:\Windows\system32\Nmedcd32.exe
        40⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Naqqdcpb.exe
        
        C:\Windows\system32\Naqqdcpb.exe
        41⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Npcaop32.exe
        
        C:\Windows\system32\Npcaop32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7956
        
        C:\Windows\SysWOW64\Ndompooe.exe
        
        C:\Windows\system32\Ndompooe.exe
        43⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Nhkiqm32.exe
        
        C:\Windows\system32\Nhkiqm32.exe
        44⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Nilehemm.exe
        
        C:\Windows\system32\Nilehemm.exe
        45⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Ophjjobg.exe
        
        C:\Windows\system32\Ophjjobg.exe
        46⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Oahgdbjj.exe
        
        C:\Windows\system32\Oahgdbjj.exe
        47⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Pkganfjb.exe
        
        C:\Windows\system32\Pkganfjb.exe
        48⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Pgnbcgpf.exe
        
        C:\Windows\system32\Pgnbcgpf.exe
        49⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Pnjgea32.exe
        
        C:\Windows\system32\Pnjgea32.exe
        50⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Ppicam32.exe
        
        C:\Windows\system32\Ppicam32.exe
        51⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Pgbkng32.exe
        
        C:\Windows\system32\Pgbkng32.exe
        52⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Pnmckacn.exe
        
        C:\Windows\system32\Pnmckacn.exe
        53⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Ppkpgmba.exe
        
        C:\Windows\system32\Ppkpgmba.exe
        54⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Pdflgk32.exe
        
        C:\Windows\system32\Pdflgk32.exe
        55⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Phbhhjcd.exe
        
        C:\Windows\system32\Phbhhjcd.exe
        56⤵
        Drops file in System32 directory
        
        PID:8432
        
        C:\Windows\SysWOW64\Pkqddebh.exe
        
        C:\Windows\system32\Pkqddebh.exe
        57⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Pnoppqak.exe
        
        C:\Windows\system32\Pnoppqak.exe
        58⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Pdihmk32.exe
        
        C:\Windows\system32\Pdihmk32.exe
        59⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Pggeif32.exe
        
        C:\Windows\system32\Pggeif32.exe
        60⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Qkcaje32.exe
        
        C:\Windows\system32\Qkcaje32.exe
        61⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Qjfaeagp.exe
        
        C:\Windows\system32\Qjfaeagp.exe
        62⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Qnamfq32.exe
        
        C:\Windows\system32\Qnamfq32.exe
        63⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Qamifogb.exe
        
        C:\Windows\system32\Qamifogb.exe
        64⤵
        
        PID:8604
        
        C:\Windows\SysWOW64\Qkenod32.exe
        
        C:\Windows\system32\Qkenod32.exe
        65⤵
        
        PID:8620
        
        C:\Windows\SysWOW64\Qaofloeo.exe
        
        C:\Windows\system32\Qaofloeo.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:8636
        
        C:\Windows\SysWOW64\Qhinii32.exe
        
        C:\Windows\system32\Qhinii32.exe
        67⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Akgjedlp.exe
        
        C:\Windows\system32\Akgjedlp.exe
        68⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Aaaban32.exe
        
        C:\Windows\system32\Aaaban32.exe
        69⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Adponj32.exe
        
        C:\Windows\system32\Adponj32.exe
        70⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Agnkje32.exe
        
        C:\Windows\system32\Agnkje32.exe
        71⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Ajmgfq32.exe
        
        C:\Windows\system32\Ajmgfq32.exe
        72⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Aadogn32.exe
        
        C:\Windows\system32\Aadogn32.exe
        73⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Adbkci32.exe
        
        C:\Windows\system32\Adbkci32.exe
        74⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Ajodkp32.exe
        
        C:\Windows\system32\Ajodkp32.exe
        75⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Aqilhj32.exe
        
        C:\Windows\system32\Aqilhj32.exe
        76⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Ahpdih32.exe
        
        C:\Windows\system32\Ahpdih32.exe
        77⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Akopec32.exe
        
        C:\Windows\system32\Akopec32.exe
        78⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Abhibmmd.exe
        
        C:\Windows\system32\Abhibmmd.exe
        79⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Ahbaog32.exe
        
        C:\Windows\system32\Ahbaog32.exe
        80⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Ajdmfpkp.exe
        
        C:\Windows\system32\Ajdmfpkp.exe
        81⤵
        
        PID:8876
        
        C:\Windows\SysWOW64\Adiadh32.exe
        
        C:\Windows\system32\Adiadh32.exe
        82⤵
        Modifies registry class
        
        PID:8892
        
        C:\Windows\SysWOW64\Bkcjqbab.exe
        
        C:\Windows\system32\Bkcjqbab.exe
        83⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Bbmbmm32.exe
        
        C:\Windows\system32\Bbmbmm32.exe
        84⤵
        
        PID:8924
        
        C:\Windows\SysWOW64\Bgjjec32.exe
        
        C:\Windows\system32\Bgjjec32.exe
        85⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Bndbbnoc.exe
        
        C:\Windows\system32\Bndbbnoc.exe
        86⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Bdnkohfp.exe
        
        C:\Windows\system32\Bdnkohfp.exe
        87⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Bhigpf32.exe
        
        C:\Windows\system32\Bhigpf32.exe
        88⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Bkhclb32.exe
        
        C:\Windows\system32\Bkhclb32.exe
        89⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Bjkcgodg.exe
        
        C:\Windows\system32\Bjkcgodg.exe
        90⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9044
        
        C:\Windows\SysWOW64\Bnfphm32.exe
        
        C:\Windows\system32\Bnfphm32.exe
        91⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Bbbkhlej.exe
        
        C:\Windows\system32\Bbbkhlej.exe
        92⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Bilcef32.exe
        
        C:\Windows\system32\Bilcef32.exe
        93⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Bgodqcca.exe
        
        C:\Windows\system32\Bgodqcca.exe
        94⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Bjmpmnbe.exe
        
        C:\Windows\system32\Bjmpmnbe.exe
        95⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Bbdhnlcg.exe
        
        C:\Windows\system32\Bbdhnlcg.exe
        96⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Bqghih32.exe
        
        C:\Windows\system32\Bqghih32.exe
        97⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Bdbdjg32.exe
        
        C:\Windows\system32\Bdbdjg32.exe
        98⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Binpkfjd.exe
        
        C:\Windows\system32\Binpkfjd.exe
        99⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Bgaqfb32.exe
        
        C:\Windows\system32\Bgaqfb32.exe
        100⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Bjpmbn32.exe
        
        C:\Windows\system32\Bjpmbn32.exe
        101⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\Bqieohho.exe
        
        C:\Windows\system32\Bqieohho.exe
        102⤵
        
        PID:4232
        
        C:\Windows\SysWOW64\Ciqmpeha.exe
        
        C:\Windows\system32\Ciqmpeha.exe
        103⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\Cqlbdhfl.exe
        
        C:\Windows\system32\Cqlbdhfl.exe
        104⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Cgfjabmi.exe
        
        C:\Windows\system32\Cgfjabmi.exe
        105⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Cjdfmmlm.exe
        
        C:\Windows\system32\Cjdfmmlm.exe
        106⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Cqnojg32.exe
        
        C:\Windows\system32\Cqnojg32.exe
        107⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Cghggakf.exe
        
        C:\Windows\system32\Cghggakf.exe
        108⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Cnbocl32.exe
        
        C:\Windows\system32\Cnbocl32.exe
        109⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Caqkpg32.exe
        
        C:\Windows\system32\Caqkpg32.exe
        110⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Cigcqd32.exe
        
        C:\Windows\system32\Cigcqd32.exe
        111⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Cjiphm32.exe
        
        C:\Windows\system32\Cjiphm32.exe
        112⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Cbphjj32.exe
        
        C:\Windows\system32\Cbphjj32.exe
        113⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Cendfe32.exe
        
        C:\Windows\system32\Cendfe32.exe
        114⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\Cgmpba32.exe
        
        C:\Windows\system32\Cgmpba32.exe
        115⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Cjklnl32.exe
        
        C:\Windows\system32\Cjklnl32.exe
        116⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Daedkfna.exe
        
        C:\Windows\system32\Daedkfna.exe
        117⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Deqqke32.exe
        
        C:\Windows\system32\Deqqke32.exe
        118⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Dkkiho32.exe
        
        C:\Windows\system32\Dkkiho32.exe
        119⤵
        Modifies registry class
        
        PID:9292
        
        C:\Windows\SysWOW64\Dniedk32.exe
        
        C:\Windows\system32\Dniedk32.exe
        120⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Dagapf32.exe
        
        C:\Windows\system32\Dagapf32.exe
        121⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Dgajmpcl.exe
        
        C:\Windows\system32\Dgajmpcl.exe
        122⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Dnkbjj32.exe
        
        C:\Windows\system32\Dnkbjj32.exe
        123⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Dgdfbpai.exe
        
        C:\Windows\system32\Dgdfbpai.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9372
        
        C:\Windows\SysWOW64\Djbbokpm.exe
        
        C:\Windows\system32\Djbbokpm.exe
        125⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Dehgld32.exe
        
        C:\Windows\system32\Dehgld32.exe
        126⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Dhfchp32.exe
        
        C:\Windows\system32\Dhfchp32.exe
        127⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Dlaoingp.exe
        
        C:\Windows\system32\Dlaoingp.exe
        128⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Djdodk32.exe
        
        C:\Windows\system32\Djdodk32.exe
        129⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Dnpkejfc.exe
        
        C:\Windows\system32\Dnpkejfc.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9492
        
        C:\Windows\SysWOW64\Diepbbfi.exe
        
        C:\Windows\system32\Diepbbfi.exe
        131⤵
        Modifies registry class
        
        PID:9520
        
        C:\Windows\SysWOW64\Dldlnnem.exe
        
        C:\Windows\system32\Dldlnnem.exe
        132⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Ebndkhmj.exe
        
        C:\Windows\system32\Ebndkhmj.exe
        133⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Eelpgcln.exe
        
        C:\Windows\system32\Eelpgcln.exe
        134⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Eihlhb32.exe
        
        C:\Windows\system32\Eihlhb32.exe
        135⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Elfhdn32.exe
        
        C:\Windows\system32\Elfhdn32.exe
        136⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Ejiiojje.exe
        
        C:\Windows\system32\Ejiiojje.exe
        137⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Enedpi32.exe
        
        C:\Windows\system32\Enedpi32.exe
        138⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Ebpqqhkg.exe
        
        C:\Windows\system32\Ebpqqhkg.exe
        139⤵
        Drops file in System32 directory
        
        PID:9704
        
        C:\Windows\SysWOW64\Eijimb32.exe
        
        C:\Windows\system32\Eijimb32.exe
        140⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Elieim32.exe
        
        C:\Windows\system32\Elieim32.exe
        141⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Ebbmfgid.exe
        
        C:\Windows\system32\Ebbmfgid.exe
        142⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Eeajbc32.exe
        
        C:\Windows\system32\Eeajbc32.exe
        143⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Eimecapa.exe
        
        C:\Windows\system32\Eimecapa.exe
        144⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Ehpfnn32.exe
        
        C:\Windows\system32\Ehpfnn32.exe
        145⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Elkbomoe.exe
        
        C:\Windows\system32\Elkbomoe.exe
        146⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Ejnbjj32.exe
        
        C:\Windows\system32\Ejnbjj32.exe
        147⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Ebejlg32.exe
        
        C:\Windows\system32\Ebejlg32.exe
        148⤵
        Drops file in System32 directory
        
        PID:9908
        
        C:\Windows\SysWOW64\Eahjgdml.exe
        
        C:\Windows\system32\Eahjgdml.exe
        149⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Eecfhb32.exe
        
        C:\Windows\system32\Eecfhb32.exe
        150⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Eajgmckj.exe
        
        C:\Windows\system32\Eajgmckj.exe
        151⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Eiaona32.exe
        
        C:\Windows\system32\Eiaona32.exe
        152⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Ejbkeibj.exe
        
        C:\Windows\system32\Ejbkeibj.exe
        153⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Fbjcgfbl.exe
        
        C:\Windows\system32\Fbjcgfbl.exe
        154⤵
        
        PID:10012
        
        C:\Windows\SysWOW64\Ficlcq32.exe
        
        C:\Windows\system32\Ficlcq32.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10028
        
        C:\Windows\SysWOW64\Fjehkipg.exe
        
        C:\Windows\system32\Fjehkipg.exe
        156⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Faoqhc32.exe
        
        C:\Windows\system32\Faoqhc32.exe
        157⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Fejlhapn.exe
        
        C:\Windows\system32\Fejlhapn.exe
        158⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Fhiidm32.exe
        
        C:\Windows\system32\Fhiidm32.exe
        159⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Ikmpicmj.exe
        
        C:\Windows\system32\Ikmpicmj.exe
        160⤵
        Modifies registry class
        
        PID:9404
        
        C:\Windows\SysWOW64\Iohljb32.exe
        
        C:\Windows\system32\Iohljb32.exe
        161⤵
        Drops file in System32 directory
        
        PID:9460
        
        C:\Windows\SysWOW64\Ijnqgk32.exe
        
        C:\Windows\system32\Ijnqgk32.exe
        162⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Ikomoc32.exe
        
        C:\Windows\system32\Ikomoc32.exe
        163⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Icfepp32.exe
        
        C:\Windows\system32\Icfepp32.exe
        164⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Jjgcni32.exe
        
        C:\Windows\system32\Jjgcni32.exe
        165⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Jkhpeacm.exe
        
        C:\Windows\system32\Jkhpeacm.exe
        166⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Jbbhblkj.exe
        
        C:\Windows\system32\Jbbhblkj.exe
        167⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Jmhlodjp.exe
        
        C:\Windows\system32\Jmhlodjp.exe
        168⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Jbeegkig.exe
        
        C:\Windows\system32\Jbeegkig.exe
        169⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Jfpqhj32.exe
        
        C:\Windows\system32\Jfpqhj32.exe
        170⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Kmjiedhm.exe
        
        C:\Windows\system32\Kmjiedhm.exe
        171⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Koieapgq.exe
        
        C:\Windows\system32\Koieapgq.exe
        172⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Kfbmnjon.exe
        
        C:\Windows\system32\Kfbmnjon.exe
        173⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Kiajjena.exe
        
        C:\Windows\system32\Kiajjena.exe
        174⤵
        Modifies registry class
        
        PID:10216
        
        C:\Windows\SysWOW64\Kokbfo32.exe
        
        C:\Windows\system32\Kokbfo32.exe
        175⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Kjqfdh32.exe
        
        C:\Windows\system32\Kjqfdh32.exe
        176⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Kmobpc32.exe
        
        C:\Windows\system32\Kmobpc32.exe
        177⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Kcikmnld.exe
        
        C:\Windows\system32\Kcikmnld.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10268
        
        C:\Windows\SysWOW64\Kjccihca.exe
        
        C:\Windows\system32\Kjccihca.exe
        179⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Kkdoap32.exe
        
        C:\Windows\system32\Kkdoap32.exe
        180⤵
        Modifies registry class
        
        PID:10300
        
        C:\Windows\SysWOW64\Kckgbm32.exe
        
        C:\Windows\system32\Kckgbm32.exe
        181⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Kjepogao.exe
        
        C:\Windows\system32\Kjepogao.exe
        182⤵
        Drops file in System32 directory
        
        PID:10344
        
        C:\Windows\SysWOW64\Kobhgnof.exe
        
        C:\Windows\system32\Kobhgnof.exe
        183⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Kbqdcjoj.exe
        
        C:\Windows\system32\Kbqdcjoj.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10376
        
        C:\Windows\SysWOW64\Lijlpdff.exe
        
        C:\Windows\system32\Lijlpdff.exe
        185⤵
        
        PID:10392
        
        C:\Windows\SysWOW64\Lkiiloej.exe
        
        C:\Windows\system32\Lkiiloej.exe
        186⤵
        Modifies registry class
        
        PID:10408
        
        C:\Windows\SysWOW64\Lfnmihep.exe
        
        C:\Windows\system32\Lfnmihep.exe
        187⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Lmhefb32.exe
        
        C:\Windows\system32\Lmhefb32.exe
        188⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10440
        
        C:\Windows\SysWOW64\Lpgabn32.exe
        
        C:\Windows\system32\Lpgabn32.exe
        189⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Lfqjohbn.exe
        
        C:\Windows\system32\Lfqjohbn.exe
        190⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Liofkc32.exe
        
        C:\Windows\system32\Liofkc32.exe
        191⤵
        Drops file in System32 directory
        
        PID:10488
        
        C:\Windows\SysWOW64\Lknbgo32.exe
        
        C:\Windows\system32\Lknbgo32.exe
        192⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Lbgjdiha.exe
        
        C:\Windows\system32\Lbgjdiha.exe
        193⤵
        
        PID:10520
        
        C:\Windows\SysWOW64\Liabqc32.exe
        
        C:\Windows\system32\Liabqc32.exe
        194⤵
        
        PID:10536
        
        C:\Windows\SysWOW64\Llpomn32.exe
        
        C:\Windows\system32\Llpomn32.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10552
        
        C:\Windows\SysWOW64\Lfecjg32.exe
        
        C:\Windows\system32\Lfecjg32.exe
        196⤵
        Drops file in System32 directory
        
        PID:10568
        
        C:\Windows\SysWOW64\Llblbnmp.exe
        
        C:\Windows\system32\Llblbnmp.exe
        197⤵
        Drops file in System32 directory
        
        PID:10584
        
        C:\Windows\SysWOW64\Lciccknb.exe
        
        C:\Windows\system32\Lciccknb.exe
        198⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Lbldoh32.exe
        
        C:\Windows\system32\Lbldoh32.exe
        199⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Mfhppfme.exe
        
        C:\Windows\system32\Mfhppfme.exe
        200⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10648
        
        C:\Windows\SysWOW64\Mifllbli.exe
        
        C:\Windows\system32\Mifllbli.exe
        201⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Mmahlq32.exe
        
        C:\Windows\system32\Mmahlq32.exe
        202⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Mldhhnkm.exe
        
        C:\Windows\system32\Mldhhnkm.exe
        203⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Mboqdh32.exe
        
        C:\Windows\system32\Mboqdh32.exe
        204⤵
        Drops file in System32 directory
        
        PID:10756
        
        C:\Windows\SysWOW64\Mjfhfe32.exe
        
        C:\Windows\system32\Mjfhfe32.exe
        205⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Mihiaajf.exe
        
        C:\Windows\system32\Mihiaajf.exe
        206⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Mmdebqbp.exe
        
        C:\Windows\system32\Mmdebqbp.exe
        207⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10824
        
        C:\Windows\SysWOW64\Mlgemm32.exe
        
        C:\Windows\system32\Mlgemm32.exe
        208⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Mpbanlac.exe
        
        C:\Windows\system32\Mpbanlac.exe
        209⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\Mbamjgpg.exe
        
        C:\Windows\system32\Mbamjgpg.exe
        210⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Mflikf32.exe
        
        C:\Windows\system32\Mflikf32.exe
        211⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Mmfagppm.exe
        
        C:\Windows\system32\Mmfagppm.exe
        212⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Mpencloq.exe
        
        C:\Windows\system32\Mpencloq.exe
        213⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Mcpjdj32.exe
        
        C:\Windows\system32\Mcpjdj32.exe
        214⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Mbcjpgnd.exe
        
        C:\Windows\system32\Mbcjpgnd.exe
        215⤵
        
        PID:11012
        
        C:\Windows\SysWOW64\Mfofpe32.exe
        
        C:\Windows\system32\Mfofpe32.exe
        216⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11032
        
        C:\Windows\SysWOW64\Mjjbadog.exe
        
        C:\Windows\system32\Mjjbadog.exe
        217⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\Mminmpnj.exe
        
        C:\Windows\system32\Mminmpnj.exe
        218⤵
        Modifies registry class
        
        PID:11076
        
        C:\Windows\SysWOW64\Mllnhm32.exe
        
        C:\Windows\system32\Mllnhm32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11100
        
        C:\Windows\SysWOW64\Mlnknlcb.exe
        
        C:\Windows\system32\Mlnknlcb.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11116
        
        C:\Windows\SysWOW64\Nbhckf32.exe
        
        C:\Windows\system32\Nbhckf32.exe
        221⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Nfcokebh.exe
        
        C:\Windows\system32\Nfcokebh.exe
        222⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Niblgqal.exe
        
        C:\Windows\system32\Niblgqal.exe
        223⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Nplddj32.exe
        
        C:\Windows\system32\Nplddj32.exe
        224⤵
        Modifies registry class
        
        PID:11180
        
        C:\Windows\SysWOW64\Nbjppfhl.exe
        
        C:\Windows\system32\Nbjppfhl.exe
        225⤵
        Modifies registry class
        
        PID:11196
        
        C:\Windows\SysWOW64\Nmpdnohb.exe
        
        C:\Windows\system32\Nmpdnohb.exe
        226⤵
        Drops file in System32 directory
        
        PID:11212
        
        C:\Windows\SysWOW64\Ndjlji32.exe
        
        C:\Windows\system32\Ndjlji32.exe
        227⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Nbmmfefj.exe
        
        C:\Windows\system32\Nbmmfefj.exe
        228⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Njdegcgl.exe
        
        C:\Windows\system32\Njdegcgl.exe
        229⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\Nmdnin32.exe
        
        C:\Windows\system32\Nmdnin32.exe
        230⤵
        
        PID:10644
        
        C:\Windows\SysWOW64\Npcjei32.exe
        
        C:\Windows\system32\Npcjei32.exe
        231⤵
        
        PID:1276
        
        C:\Windows\SysWOW64\Ndofehkj.exe
        
        C:\Windows\system32\Ndofehkj.exe
        232⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\Nfmbacjn.exe
        
        C:\Windows\system32\Nfmbacjn.exe
        233⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Nljkjjhe.exe
        
        C:\Windows\system32\Nljkjjhe.exe
        234⤵
        Drops file in System32 directory
        
        PID:10820
        
        C:\Windows\SysWOW64\Odabkhig.exe
        
        C:\Windows\system32\Odabkhig.exe
        235⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Ojkkhbqd.exe
        
        C:\Windows\system32\Ojkkhbqd.exe
        236⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Ollgoj32.exe
        
        C:\Windows\system32\Ollgoj32.exe
        237⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Odcoqg32.exe
        
        C:\Windows\system32\Odcoqg32.exe
        238⤵
        
        PID:4256
        
        C:\Windows\SysWOW64\Oibdnnci.exe
        
        C:\Windows\system32\Oibdnnci.exe
        239⤵
        
        PID:2040
        
        C:\Windows\SysWOW64\Offehbbc.exe
        
        C:\Windows\system32\Offehbbc.exe
        240⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\Okbaha32.exe
        
        C:\Windows\system32\Okbaha32.exe
        241⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Oidadnaf.exe
        
        C:\Windows\system32\Oidadnaf.exe
        242⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\Ompmdl32.exe
        
        C:\Windows\system32\Ompmdl32.exe
        243⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\Olcmpiqj.exe
        
        C:\Windows\system32\Olcmpiqj.exe
        244⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\Ofhambpp.exe
        
        C:\Windows\system32\Ofhambpp.exe
        245⤵
        
        PID:3052
        
        C:\Windows\SysWOW64\Okdnnq32.exe
        
        C:\Windows\system32\Okdnnq32.exe
        246⤵
        Drops file in System32 directory
        
        PID:872
        
        C:\Windows\SysWOW64\Oignimod.exe
        
        C:\Windows\system32\Oignimod.exe
        247⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\Opaffggq.exe
        
        C:\Windows\system32\Opaffggq.exe
        248⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\Pdmbgf32.exe
        
        C:\Windows\system32\Pdmbgf32.exe
        249⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11284
        
        C:\Windows\SysWOW64\Pbobbcfd.exe
        
        C:\Windows\system32\Pbobbcfd.exe
        250⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Pgknca32.exe
        
        C:\Windows\system32\Pgknca32.exe
        251⤵
        
        PID:11328
        
        C:\Windows\SysWOW64\Pmefplej.exe
        
        C:\Windows\system32\Pmefplej.exe
        252⤵
        
        PID:11348
        
        C:\Windows\SysWOW64\Plhgkh32.exe
        
        C:\Windows\system32\Plhgkh32.exe
        253⤵
        
        PID:11368
        
        C:\Windows\SysWOW64\Ppcclgen.exe
        
        C:\Windows\system32\Ppcclgen.exe
        254⤵
        
        PID:11388
        
        C:\Windows\SysWOW64\Pdoolf32.exe
        
        C:\Windows\system32\Pdoolf32.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11404
        
        C:\Windows\SysWOW64\Pgmkha32.exe
        
        C:\Windows\system32\Pgmkha32.exe
        256⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Pilgdm32.exe
        
        C:\Windows\system32\Pilgdm32.exe
        257⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11452
        
        C:\Windows\SysWOW64\Pcdlmb32.exe
        
        C:\Windows\system32\Pcdlmb32.exe
        258⤵
        Modifies registry class
        
        PID:11468
        
        C:\Windows\SysWOW64\Pmipkk32.exe
        
        C:\Windows\system32\Pmipkk32.exe
        259⤵
        Modifies registry class
        
        PID:11484
        
        C:\Windows\SysWOW64\Pphlgf32.exe
        
        C:\Windows\system32\Pphlgf32.exe
        260⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Pknqdo32.exe
        
        C:\Windows\system32\Pknqdo32.exe
        261⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Plomlgfm.exe
        
        C:\Windows\system32\Plomlgfm.exe
        262⤵
        
        PID:11532
        
        C:\Windows\SysWOW64\Pciehanj.exe
        
        C:\Windows\system32\Pciehanj.exe
        263⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\Pibmel32.exe
        
        C:\Windows\system32\Pibmel32.exe
        264⤵
        Drops file in System32 directory
        
        PID:11564
        
        C:\Windows\SysWOW64\Qpmfbfmc.exe
        
        C:\Windows\system32\Qpmfbfmc.exe
        265⤵
        
        PID:11580
        
        C:\Windows\SysWOW64\Qgfnop32.exe
        
        C:\Windows\system32\Qgfnop32.exe
        266⤵
        
        PID:11596
        
        C:\Windows\SysWOW64\Qmqfkjkm.exe
        
        C:\Windows\system32\Qmqfkjkm.exe
        267⤵
        
        PID:11612
        
        C:\Windows\SysWOW64\Qpobgekq.exe
        
        C:\Windows\system32\Qpobgekq.exe
        268⤵
        
        PID:11628
        
        C:\Windows\SysWOW64\Qcmoca32.exe
        
        C:\Windows\system32\Qcmoca32.exe
        269⤵
        
        PID:11644
        
        C:\Windows\SysWOW64\Qiggpkaa.exe
        
        C:\Windows\system32\Qiggpkaa.exe
        270⤵
        
        PID:11660
        
        C:\Windows\SysWOW64\Alfclfpe.exe
        
        C:\Windows\system32\Alfclfpe.exe
        271⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Apaome32.exe
        
        C:\Windows\system32\Apaome32.exe
        272⤵
        Modifies registry class
        
        PID:11692
        
        C:\Windows\SysWOW64\Acpkiq32.exe
        
        C:\Windows\system32\Acpkiq32.exe
        273⤵
        
        PID:11708
        
        C:\Windows\SysWOW64\Akgcjn32.exe
        
        C:\Windows\system32\Akgcjn32.exe
        274⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Alhpbfnb.exe
        
        C:\Windows\system32\Alhpbfnb.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11740
        
        C:\Windows\SysWOW64\Apclbe32.exe
        
        C:\Windows\system32\Apclbe32.exe
        276⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\Acbhopeo.exe
        
        C:\Windows\system32\Acbhopeo.exe
        277⤵
        
        PID:11772
        
        C:\Windows\SysWOW64\Akippnfa.exe
        
        C:\Windows\system32\Akippnfa.exe
        278⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\Anhlliee.exe
        
        C:\Windows\system32\Anhlliee.exe
        279⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Aljmgf32.exe
        
        C:\Windows\system32\Aljmgf32.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11820
        
        C:\Windows\SysWOW64\Adadic32.exe
        
        C:\Windows\system32\Adadic32.exe
        281⤵
        
        PID:11836
        
        C:\Windows\SysWOW64\Agpqeo32.exe
        
        C:\Windows\system32\Agpqeo32.exe
        282⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Ajnmaj32.exe
        
        C:\Windows\system32\Ajnmaj32.exe
        283⤵
        
        PID:11880
        
        C:\Windows\SysWOW64\Anjiaicb.exe
        
        C:\Windows\system32\Anjiaicb.exe
        284⤵
        Modifies registry class
        
        PID:11900
        
        C:\Windows\SysWOW64\Aphendbf.exe
        
        C:\Windows\system32\Aphendbf.exe
        285⤵
        Drops file in System32 directory
        
        PID:11924
        
        C:\Windows\SysWOW64\Addanc32.exe
        
        C:\Windows\system32\Addanc32.exe
        286⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Agbnjnjc.exe
        
        C:\Windows\system32\Agbnjnjc.exe
        287⤵
        
        PID:11976
        
        C:\Windows\SysWOW64\Aknikm32.exe
        
        C:\Windows\system32\Aknikm32.exe
        288⤵
        
        PID:11992
        
        C:\Windows\SysWOW64\Anlfgh32.exe
        
        C:\Windows\system32\Anlfgh32.exe
        289⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\Alofbehj.exe
        
        C:\Windows\system32\Alofbehj.exe
        290⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\Apkbcd32.exe
        
        C:\Windows\system32\Apkbcd32.exe
        291⤵
        Drops file in System32 directory
        
        PID:12064
        
        C:\Windows\SysWOW64\Adfndbil.exe
        
        C:\Windows\system32\Adfndbil.exe
        292⤵
        
        PID:12088
        
        C:\Windows\SysWOW64\Acinoo32.exe
        
        C:\Windows\system32\Acinoo32.exe
        293⤵
        
        PID:12108
        
        C:\Windows\SysWOW64\Agdjpnhp.exe
        
        C:\Windows\system32\Agdjpnhp.exe
        294⤵
        
        PID:12124
        
        C:\Windows\SysWOW64\Ajcfligd.exe
        
        C:\Windows\system32\Ajcfligd.exe
        295⤵
        
        PID:12144
        
        C:\Windows\SysWOW64\Blabhefg.exe
        
        C:\Windows\system32\Blabhefg.exe
        296⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\Bpmoic32.exe
        
        C:\Windows\system32\Bpmoic32.exe
        297⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Bgggenfn.exe
        
        C:\Windows\system32\Bgggenfn.exe
        298⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\Bkbcflng.exe
        
        C:\Windows\system32\Bkbcflng.exe
        299⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\Bjecai32.exe
        
        C:\Windows\system32\Bjecai32.exe
        300⤵
        
        PID:12268
        
        C:\Windows\SysWOW64\Bnaobhmj.exe
        
        C:\Windows\system32\Bnaobhmj.exe
        301⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\Bpokncln.exe
        
        C:\Windows\system32\Bpokncln.exe
        302⤵
        
        PID:11292
        
        C:\Windows\SysWOW64\Bgickm32.exe
        
        C:\Windows\system32\Bgickm32.exe
        303⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\Bjhpgi32.exe
        
        C:\Windows\system32\Bjhpgi32.exe
        304⤵
        
        PID:2024
        
        C:\Windows\SysWOW64\Blflcd32.exe
        
        C:\Windows\system32\Blflcd32.exe
        305⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\Bcpdpnio.exe
        
        C:\Windows\system32\Bcpdpnio.exe
        306⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\Blhiidpp.exe
        
        C:\Windows\system32\Blhiidpp.exe
        307⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\Bdpajaqb.exe
        
        C:\Windows\system32\Bdpajaqb.exe
        308⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\Bgnmfmpe.exe
        
        C:\Windows\system32\Bgnmfmpe.exe
        309⤵
        Drops file in System32 directory
        
        PID:1596
        
        C:\Windows\SysWOW64\Bnhecg32.exe
        
        C:\Windows\system32\Bnhecg32.exe
        310⤵
        
        PID:4512
        
        C:\Windows\SysWOW64\Bqfaob32.exe
        
        C:\Windows\system32\Bqfaob32.exe
        311⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\Bcenkn32.exe
        
        C:\Windows\system32\Bcenkn32.exe
        312⤵
        Modifies registry class
        
        PID:1316
        
        C:\Windows\SysWOW64\Cnjbhfep.exe
        
        C:\Windows\system32\Cnjbhfep.exe
        313⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\Cqindbdc.exe
        
        C:\Windows\system32\Cqindbdc.exe
        314⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\Ccgjqmcg.exe
        
        C:\Windows\system32\Ccgjqmcg.exe
        315⤵
        
        PID:11876
        
        C:\Windows\SysWOW64\Cnmonfcm.exe
        
        C:\Windows\system32\Cnmonfcm.exe
        316⤵
        
        PID:11920
        
        C:\Windows\SysWOW64\Cmblob32.exe
        
        C:\Windows\system32\Cmblob32.exe
        317⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\Cdicpphg.exe
        
        C:\Windows\system32\Cdicpphg.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12008
        
        C:\Windows\SysWOW64\Ckclmj32.exe
        
        C:\Windows\system32\Ckclmj32.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12056
        
        C:\Windows\SysWOW64\Cmdhdbfb.exe
        
        C:\Windows\system32\Cmdhdbfb.exe
        320⤵
        
        PID:12136
        
        C:\Windows\SysWOW64\Cdkpfpfd.exe
        
        C:\Windows\system32\Cdkpfpfd.exe
        321⤵
        
        PID:12192
        
        C:\Windows\SysWOW64\Cjhinfdl.exe
        
        C:\Windows\system32\Cjhinfdl.exe
        322⤵
        
        PID:12204
        
        C:\Windows\SysWOW64\Cmfejbdp.exe
        
        C:\Windows\system32\Cmfejbdp.exe
        323⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5112
        
        C:\Windows\SysWOW64\Cdnmko32.exe
        
        C:\Windows\system32\Cdnmko32.exe
        324⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\Dkhehilo.exe
        
        C:\Windows\system32\Dkhehilo.exe
        325⤵
        
        PID:11416
        
        C:\Windows\SysWOW64\Dnfadekb.exe
        
        C:\Windows\system32\Dnfadekb.exe
        326⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Dqdnppjf.exe
        
        C:\Windows\system32\Dqdnppjf.exe
        327⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Dgnfmj32.exe
        
        C:\Windows\system32\Dgnfmj32.exe
        328⤵
        Drops file in System32 directory
        
        PID:10712
        
        C:\Windows\SysWOW64\Djmbif32.exe
        
        C:\Windows\system32\Djmbif32.exe
        329⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\Dnhnjdip.exe
        
        C:\Windows\system32\Dnhnjdip.exe
        330⤵
        
        PID:2776
        
        C:\Windows\SysWOW64\Ddbffopl.exe
        
        C:\Windows\system32\Ddbffopl.exe
        331⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\Dcegbk32.exe
        
        C:\Windows\system32\Dcegbk32.exe
        332⤵
        
        PID:936
        
        C:\Windows\SysWOW64\Dgabbjpp.exe
        
        C:\Windows\system32\Dgabbjpp.exe
        333⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Dkloci32.exe
        
        C:\Windows\system32\Dkloci32.exe
        334⤵
        
        PID:3856
        
        C:\Windows\SysWOW64\Djoooeod.exe
        
        C:\Windows\system32\Djoooeod.exe
        335⤵
        
        PID:3284
        
        C:\Windows\SysWOW64\Dnkkod32.exe
        
        C:\Windows\system32\Dnkkod32.exe
        336⤵
        
        PID:3416

C:\Windows\SysWOW64\Dqigkp32.exe
C:\Windows\system32\Dqigkp32.exe
1⤵
PID:12304
- C:\Windows\SysWOW64\Dcgcgk32.exe
  C:\Windows\system32\Dcgcgk32.exe
  2⤵
  PID:12328
- - C:\Windows\SysWOW64\Dgcohjmn.exe
    C:\Windows\system32\Dgcohjmn.exe
    3⤵
    PID:12348
  - - C:\Windows\SysWOW64\Djaldema.exe
      C:\Windows\system32\Djaldema.exe
      4⤵
      PID:12368
    - - C:\Windows\SysWOW64\Dmphpqle.exe
        
        C:\Windows\system32\Dmphpqle.exe
        5⤵
        
        PID:12396
      - C:\Windows\SysWOW64\Dqkdao32.exe
        
        C:\Windows\system32\Dqkdao32.exe
        6⤵
        
        PID:12412
        
        C:\Windows\SysWOW64\Degpanlg.exe
        
        C:\Windows\system32\Degpanlg.exe
        7⤵
        
        PID:12440
        
        C:\Windows\SysWOW64\Dcjpmk32.exe
        
        C:\Windows\system32\Dcjpmk32.exe
        8⤵
        
        PID:12456
        
        C:\Windows\SysWOW64\Dgelni32.exe
        
        C:\Windows\system32\Dgelni32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12480
        
        C:\Windows\SysWOW64\Dclmbjao.exe
        
        C:\Windows\system32\Dclmbjao.exe
        10⤵
        
        PID:12496
        
        C:\Windows\SysWOW64\Ejfeod32.exe
        
        C:\Windows\system32\Ejfeod32.exe
        11⤵
        
        PID:12512
        
        C:\Windows\SysWOW64\Eapmlopi.exe
        
        C:\Windows\system32\Eapmlopi.exe
        12⤵
        
        PID:12528
        
        C:\Windows\SysWOW64\Ecoihjol.exe
        
        C:\Windows\system32\Ecoihjol.exe
        13⤵
        
        PID:12544
        
        C:\Windows\SysWOW64\Ekfaig32.exe
        
        C:\Windows\system32\Ekfaig32.exe
        14⤵
        
        PID:12560
        
        C:\Windows\SysWOW64\Emgnapem.exe
        
        C:\Windows\system32\Emgnapem.exe
        15⤵
        
        PID:12576
        
        C:\Windows\SysWOW64\Ecafnj32.exe
        
        C:\Windows\system32\Ecafnj32.exe
        16⤵
        
        PID:12592
        
        C:\Windows\SysWOW64\Ekhnog32.exe
        
        C:\Windows\system32\Ekhnog32.exe
        17⤵
        
        PID:12608
        
        C:\Windows\SysWOW64\Enfjkb32.exe
        
        C:\Windows\system32\Enfjkb32.exe
        18⤵
        
        PID:12624
        
        C:\Windows\SysWOW64\Eaeggn32.exe
        
        C:\Windows\system32\Eaeggn32.exe
        19⤵
        
        PID:12640
        
        C:\Windows\SysWOW64\Egoodhcp.exe
        
        C:\Windows\system32\Egoodhcp.exe
        20⤵
        
        PID:12656
        
        C:\Windows\SysWOW64\Ejmkpcbd.exe
        
        C:\Windows\system32\Ejmkpcbd.exe
        21⤵
        
        PID:12672
        
        C:\Windows\SysWOW64\Eagcmnjq.exe
        
        C:\Windows\system32\Eagcmnjq.exe
        22⤵
        
        PID:12688
        
        C:\Windows\SysWOW64\Ecepiiid.exe
        
        C:\Windows\system32\Ecepiiid.exe
        23⤵
        
        PID:12704
        
        C:\Windows\SysWOW64\Ejphec32.exe
        
        C:\Windows\system32\Ejphec32.exe
        24⤵
        
        PID:12720
        
        C:\Windows\SysWOW64\Emndao32.exe
        
        C:\Windows\system32\Emndao32.exe
        25⤵
        
        PID:12736
        
        C:\Windows\SysWOW64\Eeelcl32.exe
        
        C:\Windows\system32\Eeelcl32.exe
        26⤵
        
        PID:12752
        
        C:\Windows\SysWOW64\Flodpfgd.exe
        
        C:\Windows\system32\Flodpfgd.exe
        27⤵
        
        PID:12768
        
        C:\Windows\SysWOW64\Fnnqla32.exe
        
        C:\Windows\system32\Fnnqla32.exe
        28⤵
        
        PID:12784
        
        C:\Windows\SysWOW64\Fegihlnd.exe
        
        C:\Windows\system32\Fegihlnd.exe
        29⤵
        
        PID:12800
        
        C:\Windows\SysWOW64\Flaaef32.exe
        
        C:\Windows\system32\Flaaef32.exe
        30⤵
        Drops file in System32 directory
        
        PID:12816
        
        C:\Windows\SysWOW64\Fnpmaa32.exe
        
        C:\Windows\system32\Fnpmaa32.exe
        31⤵
        
        PID:12832
        
        C:\Windows\SysWOW64\Fanimm32.exe
        
        C:\Windows\system32\Fanimm32.exe
        32⤵
        
        PID:12848
        
        C:\Windows\SysWOW64\Fhhbjgke.exe
        
        C:\Windows\system32\Fhhbjgke.exe
        33⤵
        
        PID:12868
        
        C:\Windows\SysWOW64\Fjfnfbji.exe
        
        C:\Windows\system32\Fjfnfbji.exe
        34⤵
        Modifies registry class
        
        PID:12884
        
        C:\Windows\SysWOW64\Fmejbnim.exe
        
        C:\Windows\system32\Fmejbnim.exe
        35⤵
        
        PID:12916
        
        C:\Windows\SysWOW64\Faqfclaf.exe
        
        C:\Windows\system32\Faqfclaf.exe
        36⤵
        
        PID:12932
        
        C:\Windows\SysWOW64\Felbck32.exe
        
        C:\Windows\system32\Felbck32.exe
        37⤵
        
        PID:12956
        
        C:\Windows\SysWOW64\Fhkopf32.exe
        
        C:\Windows\system32\Fhkopf32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12984
        
        C:\Windows\SysWOW64\Fjiklb32.exe
        
        C:\Windows\system32\Fjiklb32.exe
        39⤵
        
        PID:13004
        
        C:\Windows\SysWOW64\Fndglqqp.exe
        
        C:\Windows\system32\Fndglqqp.exe
        40⤵
        
        PID:13024
        
        C:\Windows\SysWOW64\Fmgghm32.exe
        
        C:\Windows\system32\Fmgghm32.exe
        41⤵
        
        PID:13048
        
        C:\Windows\SysWOW64\Feooik32.exe
        
        C:\Windows\system32\Feooik32.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13080
        
        C:\Windows\SysWOW64\Fhmkef32.exe
        
        C:\Windows\system32\Fhmkef32.exe
        43⤵
        
        PID:13096
        
        C:\Windows\SysWOW64\Flhgfeoi.exe
        
        C:\Windows\system32\Flhgfeoi.exe
        44⤵
        
        PID:13116
        
        C:\Windows\SysWOW64\Fjkgaa32.exe
        
        C:\Windows\system32\Fjkgaa32.exe
        45⤵
        
        PID:13136
        
        C:\Windows\SysWOW64\Fngcbpom.exe
        
        C:\Windows\system32\Fngcbpom.exe
        46⤵
        
        PID:13156
        
        C:\Windows\SysWOW64\Faepnlnq.exe
        
        C:\Windows\system32\Faepnlnq.exe
        47⤵
        
        PID:13184
        
        C:\Windows\SysWOW64\Gdcljg32.exe
        
        C:\Windows\system32\Gdcljg32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:13204
        
        C:\Windows\SysWOW64\Glkdkd32.exe
        
        C:\Windows\system32\Glkdkd32.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13224
        
        C:\Windows\SysWOW64\Gjndgada.exe
        
        C:\Windows\system32\Gjndgada.exe
        50⤵
        
        PID:13248
        
        C:\Windows\SysWOW64\Gnipgp32.exe
        
        C:\Windows\system32\Gnipgp32.exe
        51⤵
        
        PID:13284
        
        C:\Windows\SysWOW64\Ghadpeck.exe
        
        C:\Windows\system32\Ghadpeck.exe
        52⤵
        
        PID:13300
        
        C:\Windows\SysWOW64\Gdheefio.exe
        
        C:\Windows\system32\Gdheefio.exe
        53⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Gjbnbq32.exe
        
        C:\Windows\system32\Gjbnbq32.exe
        54⤵
        Drops file in System32 directory
        
        PID:12316
        
        C:\Windows\SysWOW64\Gmqjnl32.exe
        
        C:\Windows\system32\Gmqjnl32.exe
        55⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\Gehboi32.exe
        
        C:\Windows\system32\Gehboi32.exe
        56⤵
        Modifies registry class
        
        PID:4884
        
        C:\Windows\SysWOW64\Glbjlcgo.exe
        
        C:\Windows\system32\Glbjlcgo.exe
        57⤵
        
        PID:12392
        
        C:\Windows\SysWOW64\Gmcfcl32.exe
        
        C:\Windows\system32\Gmcfcl32.exe
        58⤵
        
        PID:12424
        
        C:\Windows\SysWOW64\Gdmopfdj.exe
        
        C:\Windows\system32\Gdmopfdj.exe
        59⤵
        
        PID:12468
        
        C:\Windows\SysWOW64\Gobcno32.exe
        
        C:\Windows\system32\Gobcno32.exe
        60⤵
        
        PID:2532
        
        C:\Windows\SysWOW64\Gaaojj32.exe
        
        C:\Windows\system32\Gaaojj32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3812
        
        C:\Windows\SysWOW64\Hhkgfdkp.exe
        
        C:\Windows\system32\Hhkgfdkp.exe
        62⤵
        
        PID:5096
        
        C:\Windows\SysWOW64\Hkicbpjd.exe
        
        C:\Windows\system32\Hkicbpjd.exe
        63⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\Heohphjj.exe
        
        C:\Windows\system32\Heohphjj.exe
        64⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\Hlnihbma.exe
        
        C:\Windows\system32\Hlnihbma.exe
        65⤵
        
        PID:2964
        
        C:\Windows\SysWOW64\Hefnqgcb.exe
        
        C:\Windows\system32\Hefnqgcb.exe
        66⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\Hhdjmcce.exe
        
        C:\Windows\system32\Hhdjmcce.exe
        67⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\Hkbfinbi.exe
        
        C:\Windows\system32\Hkbfinbi.exe
        68⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Hmacejam.exe
        
        C:\Windows\system32\Hmacejam.exe
        69⤵
        
        PID:3932
        
        C:\Windows\SysWOW64\Iamoeh32.exe
        
        C:\Windows\system32\Iamoeh32.exe
        70⤵
        
        PID:4292
        
        C:\Windows\SysWOW64\Iehkfgao.exe
        
        C:\Windows\system32\Iehkfgao.exe
        71⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\Idkkad32.exe
        
        C:\Windows\system32\Idkkad32.exe
        72⤵
        
        PID:4056
        
        C:\Windows\SysWOW64\Ihggbbqc.exe
        
        C:\Windows\system32\Ihggbbqc.exe
        73⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\Ilbcca32.exe
        
        C:\Windows\system32\Ilbcca32.exe
        74⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\Ioqoomhp.exe
        
        C:\Windows\system32\Ioqoomhp.exe
        75⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\Imcpji32.exe
        
        C:\Windows\system32\Imcpji32.exe
        76⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\Iaokkhgc.exe
        
        C:\Windows\system32\Iaokkhgc.exe
        77⤵
        
        PID:12924
        
        C:\Windows\SysWOW64\Iekglg32.exe
        
        C:\Windows\system32\Iekglg32.exe
        78⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\Idmhgcfg.exe
        
        C:\Windows\system32\Idmhgcfg.exe
        79⤵
        
        PID:13012
        
        C:\Windows\SysWOW64\Ildphqgi.exe
        
        C:\Windows\system32\Ildphqgi.exe
        80⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\Ikgpdn32.exe
        
        C:\Windows\system32\Ikgpdn32.exe
        81⤵
        
        PID:13088
        
        C:\Windows\SysWOW64\Iocldlfm.exe
        
        C:\Windows\system32\Iocldlfm.exe
        82⤵
        
        PID:13148
        
        C:\Windows\SysWOW64\Inflpi32.exe
        
        C:\Windows\system32\Inflpi32.exe
        83⤵
        
        PID:13168
        
        C:\Windows\SysWOW64\Ihkpma32.exe
        
        C:\Windows\system32\Ihkpma32.exe
        84⤵
        
        PID:13212
        
        C:\Windows\SysWOW64\Ilglnqeg.exe
        
        C:\Windows\system32\Ilglnqeg.exe
        85⤵
        Drops file in System32 directory
        
        PID:2452
        
        C:\Windows\SysWOW64\Ikjmim32.exe
        
        C:\Windows\system32\Ikjmim32.exe
        86⤵
        
        PID:532

C:\Windows\SysWOW64\Ioeijldj.exe
C:\Windows\system32\Ioeijldj.exe
1⤵
PID:4220
- C:\Windows\SysWOW64\Inhiei32.exe
  C:\Windows\system32\Inhiei32.exe
  2⤵
  PID:1856
- - C:\Windows\SysWOW64\Iadefg32.exe
    C:\Windows\system32\Iadefg32.exe
    3⤵
    PID:4028
  - - C:\Windows\SysWOW64\Idbabc32.exe
      C:\Windows\system32\Idbabc32.exe
      4⤵
      PID:2760
    - - C:\Windows\SysWOW64\Ihnmcakk.exe
        
        C:\Windows\system32\Ihnmcakk.exe
        5⤵
        
        PID:2648
      - C:\Windows\SysWOW64\Iafalg32.exe
        
        C:\Windows\system32\Iafalg32.exe
        6⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\Iddnhb32.exe
        
        C:\Windows\system32\Iddnhb32.exe
        7⤵
        Drops file in System32 directory
        
        PID:448
        
        C:\Windows\SysWOW64\Jlnbopoo.exe
        
        C:\Windows\system32\Jlnbopoo.exe
        8⤵
        Modifies registry class
        
        PID:4656
        
        C:\Windows\SysWOW64\Jakkgfmf.exe
        
        C:\Windows\system32\Jakkgfmf.exe
        9⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\Jdigcalj.exe
        
        C:\Windows\system32\Jdigcalj.exe
        10⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\Jkcppl32.exe
        
        C:\Windows\system32\Jkcppl32.exe
        11⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\Jnallg32.exe
        
        C:\Windows\system32\Jnallg32.exe
        12⤵
        
        PID:3476
        
        C:\Windows\SysWOW64\Jdkdha32.exe
        
        C:\Windows\system32\Jdkdha32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4892
        
        C:\Windows\SysWOW64\Jkelelad.exe
        
        C:\Windows\system32\Jkelelad.exe
        14⤵
        
        PID:2112
        
        C:\Windows\SysWOW64\Jndhagqg.exe
        
        C:\Windows\system32\Jndhagqg.exe
        15⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\Jhimopqn.exe
        
        C:\Windows\system32\Jhimopqn.exe
        16⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Jkhikkpa.exe
        
        C:\Windows\system32\Jkhikkpa.exe
        17⤵
        Modifies registry class
        
        PID:1308
        
        C:\Windows\SysWOW64\Jabage32.exe
        
        C:\Windows\system32\Jabage32.exe
        18⤵
        
        PID:932
        
        C:\Windows\SysWOW64\Jhlidp32.exe
        
        C:\Windows\system32\Jhlidp32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:216
        
        C:\Windows\SysWOW64\Jlgeengd.exe
        
        C:\Windows\system32\Jlgeengd.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1876
        
        C:\Windows\SysWOW64\Jofaaifh.exe
        
        C:\Windows\system32\Jofaaifh.exe
        21⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Kadnmeek.exe
        
        C:\Windows\system32\Kadnmeek.exe
        22⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Khnfjo32.exe
        
        C:\Windows\system32\Khnfjo32.exe
        23⤵
        
        PID:2656
        
        C:\Windows\SysWOW64\Kklbfj32.exe
        
        C:\Windows\system32\Kklbfj32.exe
        24⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Knkobf32.exe
        
        C:\Windows\system32\Knkobf32.exe
        25⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Kfbfcc32.exe
        
        C:\Windows\system32\Kfbfcc32.exe
        26⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\Khqcoo32.exe
        
        C:\Windows\system32\Khqcoo32.exe
        27⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Kkookjii.exe
        
        C:\Windows\system32\Kkookjii.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12952
        
        C:\Windows\SysWOW64\Kojkli32.exe
        
        C:\Windows\system32\Kojkli32.exe
        29⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\Kbighd32.exe
        
        C:\Windows\system32\Kbighd32.exe
        30⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\Kfdcicio.exe
        
        C:\Windows\system32\Kfdcicio.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4588
        
        C:\Windows\SysWOW64\Khcpenhc.exe
        
        C:\Windows\system32\Khcpenhc.exe
        32⤵
        
        PID:2600
        
        C:\Windows\SysWOW64\Kkalajgf.exe
        
        C:\Windows\system32\Kkalajgf.exe
        33⤵
        Modifies registry class
        
        PID:3892
        
        C:\Windows\SysWOW64\Komhah32.exe
        
        C:\Windows\system32\Komhah32.exe
        34⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\Knphmefj.exe
        
        C:\Windows\system32\Knphmefj.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4620
        
        C:\Windows\SysWOW64\Kbkdnd32.exe
        
        C:\Windows\system32\Kbkdnd32.exe
        36⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\Kfgpnbgl.exe
        
        C:\Windows\system32\Kfgpnbgl.exe
        37⤵
        
        PID:2696
        
        C:\Windows\SysWOW64\Kheljnfp.exe
        
        C:\Windows\system32\Kheljnfp.exe
        38⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Knbdbe32.exe
        
        C:\Windows\system32\Knbdbe32.exe
        39⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\Kfimdb32.exe
        
        C:\Windows\system32\Kfimdb32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:880
        
        C:\Windows\SysWOW64\Kdlmoold.exe
        
        C:\Windows\system32\Kdlmoold.exe
        41⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\Khgipn32.exe
        
        C:\Windows\system32\Khgipn32.exe
        42⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Klceqlmg.exe
        
        C:\Windows\system32\Klceqlmg.exe
        43⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Loaamhlj.exe
        
        C:\Windows\system32\Loaamhlj.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5176
        
        C:\Windows\SysWOW64\Lfkiib32.exe
        
        C:\Windows\system32\Lfkiib32.exe
        45⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Ldnjeoja.exe
        
        C:\Windows\system32\Ldnjeoja.exe
        46⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Lkhbai32.exe
        
        C:\Windows\system32\Lkhbai32.exe
        47⤵
        Drops file in System32 directory
        
        PID:5412
        
        C:\Windows\SysWOW64\Lnfnndqb.exe
        
        C:\Windows\system32\Lnfnndqb.exe
        48⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Lbbjnc32.exe
        
        C:\Windows\system32\Lbbjnc32.exe
        49⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Lfnfoaad.exe
        
        C:\Windows\system32\Lfnfoaad.exe
        50⤵
        Modifies registry class
        
        PID:5264
        
        C:\Windows\SysWOW64\Lhlbkmph.exe
        
        C:\Windows\system32\Lhlbkmph.exe
        51⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Lofjhg32.exe
        
        C:\Windows\system32\Lofjhg32.exe
        52⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Lnikcdop.exe
        
        C:\Windows\system32\Lnikcdop.exe
        53⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Lialfl32.exe
        
        C:\Windows\system32\Lialfl32.exe
        54⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Lkohbh32.exe
        
        C:\Windows\system32\Lkohbh32.exe
        55⤵
        Modifies registry class
        
        PID:5256
        
        C:\Windows\SysWOW64\Lbipobbc.exe
        
        C:\Windows\system32\Lbipobbc.exe
        56⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Ldglkmbg.exe
        
        C:\Windows\system32\Ldglkmbg.exe
        57⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Lmodlkbi.exe
        
        C:\Windows\system32\Lmodlkbi.exe
        58⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Momqhfam.exe
        
        C:\Windows\system32\Momqhfam.exe
        59⤵
        
        PID:1828
        
        C:\Windows\SysWOW64\Mblmdaqq.exe
        
        C:\Windows\system32\Mblmdaqq.exe
        60⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Mfgiepij.exe
        
        C:\Windows\system32\Mfgiepij.exe
        61⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Mieealhn.exe
        
        C:\Windows\system32\Mieealhn.exe
        62⤵
        Drops file in System32 directory
        
        PID:5312
        
        C:\Windows\SysWOW64\Mkdamgga.exe
        
        C:\Windows\system32\Mkdamgga.exe
        63⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Mnbnibfe.exe
        
        C:\Windows\system32\Mnbnibfe.exe
        64⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Mfiekpgg.exe
        
        C:\Windows\system32\Mfiekpgg.exe
        65⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Mihbgkfk.exe
        
        C:\Windows\system32\Mihbgkfk.exe
        66⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Mobjce32.exe
        
        C:\Windows\system32\Mobjce32.exe
        67⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Mflbpp32.exe
        
        C:\Windows\system32\Mflbpp32.exe
        68⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Mijolk32.exe
        
        C:\Windows\system32\Mijolk32.exe
        69⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Modgieke.exe
        
        C:\Windows\system32\Modgieke.exe
        70⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Mfnofo32.exe
        
        C:\Windows\system32\Mfnofo32.exe
        71⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Mmhgbijo.exe
        
        C:\Windows\system32\Mmhgbijo.exe
        72⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Mpfcoeib.exe
        
        C:\Windows\system32\Mpfcoeib.exe
        73⤵
        Drops file in System32 directory
        
        PID:5904
        
        C:\Windows\SysWOW64\Mnidja32.exe
        
        C:\Windows\system32\Mnidja32.exe
        74⤵
        Modifies registry class
        
        PID:5516
        
        C:\Windows\SysWOW64\Mfqlko32.exe
        
        C:\Windows\system32\Mfqlko32.exe
        75⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Miohgjpc.exe
        
        C:\Windows\system32\Miohgjpc.exe
        76⤵
        Drops file in System32 directory
        
        PID:5544
        
        C:\Windows\SysWOW64\Nkmdcfof.exe
        
        C:\Windows\system32\Nkmdcfof.exe
        77⤵
        Drops file in System32 directory
        
        PID:5956
        
        C:\Windows\SysWOW64\Nbglpp32.exe
        
        C:\Windows\system32\Nbglpp32.exe
        78⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Nefilk32.exe
        
        C:\Windows\system32\Nefilk32.exe
        79⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Niadmjnp.exe
        
        C:\Windows\system32\Niadmjnp.exe
        80⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Nlpaiemd.exe
        
        C:\Windows\system32\Nlpaiemd.exe
        81⤵
        Modifies registry class
        
        PID:5760
        
        C:\Windows\SysWOW64\Nbjifp32.exe
        
        C:\Windows\system32\Nbjifp32.exe
        82⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Nfeefnmj.exe
        
        C:\Windows\system32\Nfeefnmj.exe
        83⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Nehebk32.exe
        
        C:\Windows\system32\Nehebk32.exe
        84⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Nlbnoe32.exe
        
        C:\Windows\system32\Nlbnoe32.exe
        85⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Nblfkobn.exe
        
        C:\Windows\system32\Nblfkobn.exe
        86⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Nifnhi32.exe
        
        C:\Windows\system32\Nifnhi32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5960
        
        C:\Windows\SysWOW64\Nldjde32.exe
        
        C:\Windows\system32\Nldjde32.exe
        88⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Nppfecah.exe
        
        C:\Windows\system32\Nppfecah.exe
        89⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Nbnbaoqk.exe
        
        C:\Windows\system32\Nbnbaoqk.exe
        90⤵
        Modifies registry class
        
        PID:4348
        
        C:\Windows\SysWOW64\Nemomjpo.exe
        
        C:\Windows\system32\Nemomjpo.exe
        91⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Nmdgnhpa.exe
        
        C:\Windows\system32\Nmdgnhpa.exe
        92⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Npbcjc32.exe
        
        C:\Windows\system32\Npbcjc32.exe
        93⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Nnecfpfp.exe
        
        C:\Windows\system32\Nnecfpfp.exe
        94⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6020
        
        C:\Windows\SysWOW64\Nflkgmgb.exe
        
        C:\Windows\system32\Nflkgmgb.exe
        95⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Omfcdg32.exe
        
        C:\Windows\system32\Omfcdg32.exe
        96⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Olidodei.exe
        
        C:\Windows\system32\Olidodei.exe
        97⤵
        
        PID:1048
        
        C:\Windows\SysWOW64\Obclln32.exe
        
        C:\Windows\system32\Obclln32.exe
        98⤵
        
        PID:948
        
        C:\Windows\SysWOW64\Oeahhj32.exe
        
        C:\Windows\system32\Oeahhj32.exe
        99⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Onjmao32.exe
        
        C:\Windows\system32\Onjmao32.exe
        100⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5992
        
        C:\Windows\SysWOW64\Ofaebm32.exe
        
        C:\Windows\system32\Ofaebm32.exe
        101⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Omkmogji.exe
        
        C:\Windows\system32\Omkmogji.exe
        102⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\Opiikbim.exe
        
        C:\Windows\system32\Opiikbim.exe
        103⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\Onlifo32.exe
        
        C:\Windows\system32\Onlifo32.exe
        104⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Oiandh32.exe
        
        C:\Windows\system32\Oiandh32.exe
        105⤵
        Drops file in System32 directory
        
        PID:3604
        
        C:\Windows\SysWOW64\Oplfqbgj.exe
        
        C:\Windows\system32\Oplfqbgj.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4708
        
        C:\Windows\SysWOW64\Objbmm32.exe
        
        C:\Windows\system32\Objbmm32.exe
        107⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Oidjignk.exe
        
        C:\Windows\system32\Oidjignk.exe
        108⤵
        Modifies registry class
        
        PID:5652
        
        C:\Windows\SysWOW64\Olbfecmo.exe
        
        C:\Windows\system32\Olbfecmo.exe
        109⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Ooqcanlb.exe
        
        C:\Windows\system32\Ooqcanlb.exe
        110⤵
        
        PID:5748
        
        C:\Windows\SysWOW64\Oblobm32.exe
        
        C:\Windows\system32\Oblobm32.exe
        111⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Oekknh32.exe
        
        C:\Windows\system32\Oekknh32.exe
        112⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Pleckbkl.exe
        
        C:\Windows\system32\Pleckbkl.exe
        113⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\Pocpgnjp.exe
        
        C:\Windows\system32\Pocpgnjp.exe
        114⤵
        Modifies registry class
        
        PID:6172
        
        C:\Windows\SysWOW64\Pemhdhal.exe
        
        C:\Windows\system32\Pemhdhal.exe
        115⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Piiddg32.exe
        
        C:\Windows\system32\Piiddg32.exe
        116⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\Plgpqb32.exe
        
        C:\Windows\system32\Plgpqb32.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4976
        
        C:\Windows\SysWOW64\Poelmn32.exe
        
        C:\Windows\system32\Poelmn32.exe
        118⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Pfmdnk32.exe
        
        C:\Windows\system32\Pfmdnk32.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5568
        
        C:\Windows\SysWOW64\Pmflkepl.exe
        
        C:\Windows\system32\Pmflkepl.exe
        120⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Pohibm32.exe
        
        C:\Windows\system32\Pohibm32.exe
        121⤵
        Drops file in System32 directory
        
        PID:5712
        
        C:\Windows\SysWOW64\Pebaog32.exe
        
        C:\Windows\system32\Pebaog32.exe
        122⤵
        Modifies registry class
        
        PID:4808
        
        C:\Windows\SysWOW64\Pimmpfep.exe
        
        C:\Windows\system32\Pimmpfep.exe
        123⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Ppgelp32.exe
        
        C:\Windows\system32\Ppgelp32.exe
        124⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\Pipjefcn.exe
        
        C:\Windows\system32\Pipjefcn.exe
        125⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Plnfaaba.exe
        
        C:\Windows\system32\Plnfaaba.exe
        126⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Polbmmbe.exe
        
        C:\Windows\system32\Polbmmbe.exe
        127⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Pfcjojbg.exe
        
        C:\Windows\system32\Pfcjojbg.exe
        128⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Qmnbkdjd.exe
        
        C:\Windows\system32\Qmnbkdjd.exe
        129⤵
        Modifies registry class
        
        PID:6180
        
        C:\Windows\SysWOW64\Qlqcga32.exe
        
        C:\Windows\system32\Qlqcga32.exe
        130⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Qplogpih.exe
        
        C:\Windows\system32\Qplogpih.exe
        131⤵
        Drops file in System32 directory
        
        PID:6488
        
        C:\Windows\SysWOW64\Qbjkckhk.exe
        
        C:\Windows\system32\Qbjkckhk.exe
        132⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Qffgdj32.exe
        
        C:\Windows\system32\Qffgdj32.exe
        133⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Qeigpfgo.exe
        
        C:\Windows\system32\Qeigpfgo.exe
        134⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Qmpoadha.exe
        
        C:\Windows\system32\Qmpoadha.exe
        135⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Qlcplq32.exe
        
        C:\Windows\system32\Qlcplq32.exe
        136⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Afhdji32.exe
        
        C:\Windows\system32\Afhdji32.exe
        137⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Alelbpmi.exe
        
        C:\Windows\system32\Alelbpmi.exe
        138⤵
        Drops file in System32 directory
        
        PID:6408
        
        C:\Windows\SysWOW64\Abodoj32.exe
        
        C:\Windows\system32\Abodoj32.exe
        139⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Agkqoilo.exe
        
        C:\Windows\system32\Agkqoilo.exe
        140⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Aenqkf32.exe
        
        C:\Windows\system32\Aenqkf32.exe
        141⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Aiimkdkc.exe
        
        C:\Windows\system32\Aiimkdkc.exe
        142⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Amdilc32.exe
        
        C:\Windows\system32\Amdilc32.exe
        143⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Algigpkf.exe
        
        C:\Windows\system32\Algigpkf.exe
        144⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Apceho32.exe
        
        C:\Windows\system32\Apceho32.exe
        145⤵
        Modifies registry class
        
        PID:6520
        
        C:\Windows\SysWOW64\Aofeckjj.exe
        
        C:\Windows\system32\Aofeckjj.exe
        146⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Abaadj32.exe
        
        C:\Windows\system32\Abaadj32.exe
        147⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Agmmeijl.exe
        
        C:\Windows\system32\Agmmeijl.exe
        148⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Aepmpe32.exe
        
        C:\Windows\system32\Aepmpe32.exe
        149⤵
        Modifies registry class
        
        PID:6636
        
        C:\Windows\SysWOW64\Aikiadip.exe
        
        C:\Windows\system32\Aikiadip.exe
        150⤵
        Drops file in System32 directory
        
        PID:6936
        
        C:\Windows\SysWOW64\Amgeac32.exe
        
        C:\Windows\system32\Amgeac32.exe
        151⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Apeannam.exe
        
        C:\Windows\system32\Apeannam.exe
        152⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Apeannam.exe
        
        C:\Windows\system32\Apeannam.exe
        153⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Acdnjjpq.exe
        
        C:\Windows\system32\Acdnjjpq.exe
        154⤵
        
        PID:13324
        
        C:\Windows\SysWOW64\Agojjh32.exe
        
        C:\Windows\system32\Agojjh32.exe
        155⤵
        
        PID:13344
        
        C:\Windows\SysWOW64\Aebjfeod.exe
        
        C:\Windows\system32\Aebjfeod.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:13364
        
        C:\Windows\SysWOW64\Ainffd32.exe
        
        C:\Windows\system32\Ainffd32.exe
        157⤵
        
        PID:13388
        
        C:\Windows\SysWOW64\Amibgbpg.exe
        
        C:\Windows\system32\Amibgbpg.exe
        158⤵
        Modifies registry class
        
        PID:13416
        
        C:\Windows\SysWOW64\Allbbo32.exe
        
        C:\Windows\system32\Allbbo32.exe
        159⤵
        
        PID:13432
        
        C:\Windows\SysWOW64\Aphncnoj.exe
        
        C:\Windows\system32\Aphncnoj.exe
        160⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13464
        
        C:\Windows\SysWOW64\Aedgkema.exe
        
        C:\Windows\system32\Aedgkema.exe
        161⤵
        Modifies registry class
        
        PID:13480
        
        C:\Windows\SysWOW64\Aipclc32.exe
        
        C:\Windows\system32\Aipclc32.exe
        162⤵
        
        PID:13500
        
        C:\Windows\SysWOW64\Amlombnd.exe
        
        C:\Windows\system32\Amlombnd.exe
        163⤵
        
        PID:13524
        
        C:\Windows\SysWOW64\Alooho32.exe
        
        C:\Windows\system32\Alooho32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13540
        
        C:\Windows\SysWOW64\Apjkin32.exe
        
        C:\Windows\system32\Apjkin32.exe
        165⤵
        Drops file in System32 directory
        
        PID:13564
        
        C:\Windows\SysWOW64\Aomkdjcb.exe
        
        C:\Windows\system32\Aomkdjcb.exe
        166⤵
        Modifies registry class
        
        PID:13580
        
        C:\Windows\SysWOW64\Begcad32.exe
        
        C:\Windows\system32\Begcad32.exe
        167⤵
        
        PID:13600
        
        C:\Windows\SysWOW64\Blalnobl.exe
        
        C:\Windows\system32\Blalnobl.exe
        168⤵
        
        PID:13616
        
        C:\Windows\SysWOW64\Bckdji32.exe
        
        C:\Windows\system32\Bckdji32.exe
        169⤵
        
        PID:13632
        
        C:\Windows\SysWOW64\Bielgcae.exe
        
        C:\Windows\system32\Bielgcae.exe
        170⤵
        
        PID:13648
        
        C:\Windows\SysWOW64\Boaeojpm.exe
        
        C:\Windows\system32\Boaeojpm.exe
        171⤵
        
        PID:13664
        
        C:\Windows\SysWOW64\Bigimb32.exe
        
        C:\Windows\system32\Bigimb32.exe
        172⤵
        
        PID:13680
        
        C:\Windows\SysWOW64\Bleein32.exe
        
        C:\Windows\system32\Bleein32.exe
        173⤵
        
        PID:13696
        
        C:\Windows\SysWOW64\Bgkifg32.exe
        
        C:\Windows\system32\Bgkifg32.exe
        174⤵
        
        PID:13712
        
        C:\Windows\SysWOW64\Bneacaei.exe
        
        C:\Windows\system32\Bneacaei.exe
        175⤵
        
        PID:13728
        
        C:\Windows\SysWOW64\Bpcnoldm.exe
        
        C:\Windows\system32\Bpcnoldm.exe
        176⤵
        
        PID:13744
        
        C:\Windows\SysWOW64\Bcbjkhdq.exe
        
        C:\Windows\system32\Bcbjkhdq.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13760
        
        C:\Windows\SysWOW64\Bepfgc32.exe
        
        C:\Windows\system32\Bepfgc32.exe
        178⤵
        
        PID:13776
        
        C:\Windows\SysWOW64\Bngnhq32.exe
        
        C:\Windows\system32\Bngnhq32.exe
        179⤵
        
        PID:13792
        
        C:\Windows\SysWOW64\Boikpiie.exe
        
        C:\Windows\system32\Boikpiie.exe
        180⤵
        
        PID:13808
        
        C:\Windows\SysWOW64\Cebcmc32.exe
        
        C:\Windows\system32\Cebcmc32.exe
        181⤵
        Modifies registry class
        
        PID:13824
        
        C:\Windows\SysWOW64\Cnjknp32.exe
        
        C:\Windows\system32\Cnjknp32.exe
        182⤵
        
        PID:13840
        
        C:\Windows\SysWOW64\Clmkimho.exe
        
        C:\Windows\system32\Clmkimho.exe
        183⤵
        Drops file in System32 directory
        
        PID:13856
        
        C:\Windows\SysWOW64\Cgbpgf32.exe
        
        C:\Windows\system32\Cgbpgf32.exe
        184⤵
        
        PID:13872
        
        C:\Windows\SysWOW64\Cjqlca32.exe
        
        C:\Windows\system32\Cjqlca32.exe
        185⤵
        
        PID:13888
        
        C:\Windows\SysWOW64\Clohom32.exe
        
        C:\Windows\system32\Clohom32.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:13904
        
        C:\Windows\SysWOW64\Cciplgni.exe
        
        C:\Windows\system32\Cciplgni.exe
        187⤵
        
        PID:13920
        
        C:\Windows\SysWOW64\Cfgmhbml.exe
        
        C:\Windows\system32\Cfgmhbml.exe
        188⤵
        Modifies registry class
        
        PID:13936
        
        C:\Windows\SysWOW64\Cnndipmo.exe
        
        C:\Windows\system32\Cnndipmo.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:13952
        
        C:\Windows\SysWOW64\Cpmqekmb.exe
        
        C:\Windows\system32\Cpmqekmb.exe
        190⤵
        
        PID:13968
        
        C:\Windows\SysWOW64\Cggibe32.exe
        
        C:\Windows\system32\Cggibe32.exe
        191⤵
        Drops file in System32 directory
        
        PID:13988
        
        C:\Windows\SysWOW64\Cjeenqcc.exe
        
        C:\Windows\system32\Cjeenqcc.exe
        192⤵
        Drops file in System32 directory
        
        PID:14008
        
        C:\Windows\SysWOW64\Cnqaoo32.exe
        
        C:\Windows\system32\Cnqaoo32.exe
        193⤵
        
        PID:14024
        
        C:\Windows\SysWOW64\Clcajlbf.exe
        
        C:\Windows\system32\Clcajlbf.exe
        194⤵
        Drops file in System32 directory
        
        PID:14044
        
        C:\Windows\SysWOW64\Cpomkk32.exe
        
        C:\Windows\system32\Cpomkk32.exe
        195⤵
        
        PID:14064
        
        C:\Windows\SysWOW64\Cobnfgaj.exe
        
        C:\Windows\system32\Cobnfgaj.exe
        196⤵
        
        PID:14084
        
        C:\Windows\SysWOW64\Ccnjgf32.exe
        
        C:\Windows\system32\Ccnjgf32.exe
        197⤵
        
        PID:14104
        
        C:\Windows\SysWOW64\Cgifgebl.exe
        
        C:\Windows\system32\Cgifgebl.exe
        198⤵
        
        PID:14140
        
        C:\Windows\SysWOW64\Cjgbcpap.exe
        
        C:\Windows\system32\Cjgbcpap.exe
        199⤵
        
        PID:14160
        
        C:\Windows\SysWOW64\Cncndo32.exe
        
        C:\Windows\system32\Cncndo32.exe
        200⤵
        
        PID:14180
        
        C:\Windows\SysWOW64\Cqajpj32.exe
        
        C:\Windows\system32\Cqajpj32.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:14200
        
        C:\Windows\SysWOW64\Dodjlgog.exe
        
        C:\Windows\system32\Dodjlgog.exe
        202⤵
        
        PID:14220
        
        C:\Windows\SysWOW64\Dcpflf32.exe
        
        C:\Windows\system32\Dcpflf32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:14240
        
        C:\Windows\SysWOW64\Dgkbmdpj.exe
        
        C:\Windows\system32\Dgkbmdpj.exe
        204⤵
        
        PID:14272
        
        C:\Windows\SysWOW64\Djjoipon.exe
        
        C:\Windows\system32\Djjoipon.exe
        205⤵
        
        PID:14292
        
        C:\Windows\SysWOW64\Dnekjogg.exe
        
        C:\Windows\system32\Dnekjogg.exe
        206⤵
        
        PID:14316
        
        C:\Windows\SysWOW64\Dqdgfjfj.exe
        
        C:\Windows\system32\Dqdgfjfj.exe
        207⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Dgnobd32.exe
        
        C:\Windows\system32\Dgnobd32.exe
        208⤵
        
        PID:13396

C:\Windows\SysWOW64\Djlkop32.exe
C:\Windows\system32\Djlkop32.exe
1⤵
PID:13404
- C:\Windows\SysWOW64\Dnhgoned.exe
  C:\Windows\system32\Dnhgoned.exe
  2⤵
  PID:13472
- - C:\Windows\SysWOW64\Dmkgkk32.exe
    C:\Windows\system32\Dmkgkk32.exe
    3⤵
    PID:6776
  - - C:\Windows\SysWOW64\Dqfckjdh.exe
      C:\Windows\system32\Dqfckjdh.exe
      4⤵
      PID:6800
    - - C:\Windows\SysWOW64\Dgplhd32.exe
        
        C:\Windows\system32\Dgplhd32.exe
        5⤵
        
        PID:6876
      - C:\Windows\SysWOW64\Djohdo32.exe
        
        C:\Windows\system32\Djohdo32.exe
        6⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Dokqlfip.exe
        
        C:\Windows\system32\Dokqlfip.exe
        7⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Dgbhncjb.exe
        
        C:\Windows\system32\Dgbhncjb.exe
        8⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Dmoafjhi.exe
        
        C:\Windows\system32\Dmoafjhi.exe
        9⤵
        Drops file in System32 directory
        
        PID:6600

C:\Windows\SysWOW64\Dqkmfi32.exe
C:\Windows\system32\Dqkmfi32.exe
1⤵
PID:7072
- C:\Windows\SysWOW64\Donmbfgm.exe
  C:\Windows\system32\Donmbfgm.exe
  2⤵
  PID:6444
- - C:\Windows\SysWOW64\Dfheop32.exe
    C:\Windows\system32\Dfheop32.exe
    3⤵
    PID:7128
  - - C:\Windows\SysWOW64\Djcaoogc.exe
      C:\Windows\system32\Djcaoogc.exe
      4⤵
      PID:7172
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7172 -s 408
        5⤵
        Program crash
        
        PID:6592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 7172 -ip 7172
1⤵
PID:6576

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Cbcbdfno.exe

Filesize
84KB

MD5
ce2837942da29988d6493a655428390c

SHA1
00696c28ed912e0f382208e12c25feed596d0de3

SHA256
0cafd6ccd867b127670f7b444b0b8313f221b87d215a80b8b1c89d0ac7c85ea9

SHA512
125a3b9d4c271d30adb56bf3abeca10fba208f3be25d0dba2284428ad7f69efe1584ca1c35b58590133d17dcdcea37f4eb197162042e27c47560a5795da19341

Download Submit
C:\Windows\SysWOW64\Cbcbdfno.exe

Filesize
84KB

MD5
ce2837942da29988d6493a655428390c

SHA1
00696c28ed912e0f382208e12c25feed596d0de3

SHA256
0cafd6ccd867b127670f7b444b0b8313f221b87d215a80b8b1c89d0ac7c85ea9

SHA512
125a3b9d4c271d30adb56bf3abeca10fba208f3be25d0dba2284428ad7f69efe1584ca1c35b58590133d17dcdcea37f4eb197162042e27c47560a5795da19341

Download Submit
C:\Windows\SysWOW64\Cbfojfll.exe

Filesize
84KB

MD5
f5b9d5302141e221a2ada03bf07f4a2d

SHA1
249a8dcd5e8c10f70644cfa5679c2bc7b3f276f4

SHA256
f2610ea16092db3485410977b583c49ad37c5e03f9582a089a09f955137c2437

SHA512
ca9338119053842078ae5df8ed5e68bc1134f98b1276949a2e34a4ffbabd74b0be8c94306be907ea537f9ecf7c5ca725b36be9c3cb6821056f7375998d1c959c

Download Submit
C:\Windows\SysWOW64\Cbfojfll.exe

Filesize
84KB

MD5
f5b9d5302141e221a2ada03bf07f4a2d

SHA1
249a8dcd5e8c10f70644cfa5679c2bc7b3f276f4

SHA256
f2610ea16092db3485410977b583c49ad37c5e03f9582a089a09f955137c2437

SHA512
ca9338119053842078ae5df8ed5e68bc1134f98b1276949a2e34a4ffbabd74b0be8c94306be907ea537f9ecf7c5ca725b36be9c3cb6821056f7375998d1c959c

Download Submit
C:\Windows\SysWOW64\Cfjeifjm.exe

Filesize
84KB

MD5
449350de670fc0de111bf5f327f7f905

SHA1
aa152a7232777b114621935f682abb5ee2808630

SHA256
7dec3aa3c1f3f7c70fee642726aab4aef1ed9fb7a8e404ba33c4a4ba8295099c

SHA512
34f7cb920e93c4c2c4742687cb2c130658438ef13a2d0568a163de6ced2f786d4d7e2413dad8e7f0f34796a96f5a8e2afe75c0c7d3796a384535c7c38b62edb0

Download Submit
C:\Windows\SysWOW64\Cfjeifjm.exe

Filesize
84KB

MD5
449350de670fc0de111bf5f327f7f905

SHA1
aa152a7232777b114621935f682abb5ee2808630

SHA256
7dec3aa3c1f3f7c70fee642726aab4aef1ed9fb7a8e404ba33c4a4ba8295099c

SHA512
34f7cb920e93c4c2c4742687cb2c130658438ef13a2d0568a163de6ced2f786d4d7e2413dad8e7f0f34796a96f5a8e2afe75c0c7d3796a384535c7c38b62edb0

Download Submit
C:\Windows\SysWOW64\Ciknka32.exe

Filesize
84KB

MD5
860b7c304a852029cfbc8e10cc728ae1

SHA1
1999d62ca327b46de352dab043d9af725c0f95b2

SHA256
3458a0fe48b2edecc6b6db171c5737f5cc312789fc8ed2fc4ebd77686b7a2052

SHA512
6582d03de8eff3bc6c9466f74d00be3975fd7a2efccf15d38219c721ab575c12904cb49b7df7b3f2c688bd8b925caefba63db790d15f13984f8b1340466be27c

Download Submit
C:\Windows\SysWOW64\Ciknka32.exe

Filesize
84KB

MD5
860b7c304a852029cfbc8e10cc728ae1

SHA1
1999d62ca327b46de352dab043d9af725c0f95b2

SHA256
3458a0fe48b2edecc6b6db171c5737f5cc312789fc8ed2fc4ebd77686b7a2052

SHA512
6582d03de8eff3bc6c9466f74d00be3975fd7a2efccf15d38219c721ab575c12904cb49b7df7b3f2c688bd8b925caefba63db790d15f13984f8b1340466be27c

Download Submit
C:\Windows\SysWOW64\Clgmbmid.exe

Filesize
84KB

MD5
2ccb9903d8c12819806809950bb35522

SHA1
140d86f03c121b1461cbf0212cbcc558a2220c46

SHA256
2c2578b338243587c9f517ce0283c1090ed2e3ffbf314a85f8376abd3c415177

SHA512
6bec7b3d9cb765e7f5e1f985ec537475f770a61bd59e91ab8b78c07392266602569bc1b99730345a3411bb295541b480d15991ed886530d5b42116c6e21c79d0

Download Submit
C:\Windows\SysWOW64\Clgmbmid.exe

Filesize
84KB

MD5
2ccb9903d8c12819806809950bb35522

SHA1
140d86f03c121b1461cbf0212cbcc558a2220c46

SHA256
2c2578b338243587c9f517ce0283c1090ed2e3ffbf314a85f8376abd3c415177

SHA512
6bec7b3d9cb765e7f5e1f985ec537475f770a61bd59e91ab8b78c07392266602569bc1b99730345a3411bb295541b480d15991ed886530d5b42116c6e21c79d0

Download Submit
C:\Windows\SysWOW64\Cljjgl32.exe

Filesize
84KB

MD5
9f27bc89bc1c1ec1f9c586ceea65f91b

SHA1
b9727cbb5b69e6af9870379d935afdcdd03addac

SHA256
e6aa9e8bb329cec2cbfa9a1f7a79465721768ed9e8af0e1d42bca9caf012b221

SHA512
d7ec73836e9debbce38ad7dbdf692643c8cb4c1fa741b52c0d80f61266c6422c3635f51610b4c48e131c4ec9e0b020efee839a737fc864f683b98fdafa8b35d7

Download Submit
C:\Windows\SysWOW64\Cljjgl32.exe

Filesize
84KB

MD5
9f27bc89bc1c1ec1f9c586ceea65f91b

SHA1
b9727cbb5b69e6af9870379d935afdcdd03addac

SHA256
e6aa9e8bb329cec2cbfa9a1f7a79465721768ed9e8af0e1d42bca9caf012b221

SHA512
d7ec73836e9debbce38ad7dbdf692643c8cb4c1fa741b52c0d80f61266c6422c3635f51610b4c48e131c4ec9e0b020efee839a737fc864f683b98fdafa8b35d7

Download Submit
C:\Windows\SysWOW64\Cmifaond.exe

Filesize
84KB

MD5
28ae2a5bd2aeeb9a3faa84ea0ec06a96

SHA1
d0edbbb27dbb2f7593a5b41a5d2a4e9f6103b38e

SHA256
54bc57c9920a7c4aaefb5b13060dd229e9dfa1210ee197a6d627b9cf66c27458

SHA512
484312170993aa79d15fa1ef7b92b191e6c645807f89a6331b0984b63eb97d23c0998f6710f9625f9f052057a112c91022148bb9a5b913205b05931ab4549f73

Download Submit
C:\Windows\SysWOW64\Cmifaond.exe

Filesize
84KB

MD5
28ae2a5bd2aeeb9a3faa84ea0ec06a96

SHA1
d0edbbb27dbb2f7593a5b41a5d2a4e9f6103b38e

SHA256
54bc57c9920a7c4aaefb5b13060dd229e9dfa1210ee197a6d627b9cf66c27458

SHA512
484312170993aa79d15fa1ef7b92b191e6c645807f89a6331b0984b63eb97d23c0998f6710f9625f9f052057a112c91022148bb9a5b913205b05931ab4549f73

Download Submit
C:\Windows\SysWOW64\Cpqlml32.exe

Filesize
84KB

MD5
861c89e635069e2daccdbc6c91dbb15f

SHA1
3d930692c9773e04804733d81f31482d8569d156

SHA256
dee76936d656f5fed5663bedd931e2a85e283a1c843e0572ed7a9c04fe3a5e72

SHA512
66db75ce54a72dbb7811cb06a4b555b2b2827d100f4bcae49be26574638d64a9d0fe1cddc34fa1fc792ecff91e7361227bc6a1782c2501002c18029a943718d3

Download Submit
C:\Windows\SysWOW64\Cpqlml32.exe

Filesize
84KB

MD5
861c89e635069e2daccdbc6c91dbb15f

SHA1
3d930692c9773e04804733d81f31482d8569d156

SHA256
dee76936d656f5fed5663bedd931e2a85e283a1c843e0572ed7a9c04fe3a5e72

SHA512
66db75ce54a72dbb7811cb06a4b555b2b2827d100f4bcae49be26574638d64a9d0fe1cddc34fa1fc792ecff91e7361227bc6a1782c2501002c18029a943718d3

Download Submit
C:\Windows\SysWOW64\Dmkcgo32.exe

Filesize
84KB

MD5
916b598a2ded1d8d49cba3d894456b05

SHA1
2fdc36e52d1d1ced9da5bf386cd36e03b7e7454e

SHA256
250f38559638220b082643baa2a2d2e2ba4ee6e88cf957001e13ea7225bd70f0

SHA512
3c91473755929f25dc194a9711cee96fdfeec43daf120e8d98158d3e8dff847ce4cdc689b2f1aa8112c04acdad6f34cff4599962cb7669bcbd72b2cb2b203db7

Download Submit
C:\Windows\SysWOW64\Dmkcgo32.exe

Filesize
84KB

MD5
916b598a2ded1d8d49cba3d894456b05

SHA1
2fdc36e52d1d1ced9da5bf386cd36e03b7e7454e

SHA256
250f38559638220b082643baa2a2d2e2ba4ee6e88cf957001e13ea7225bd70f0

SHA512
3c91473755929f25dc194a9711cee96fdfeec43daf120e8d98158d3e8dff847ce4cdc689b2f1aa8112c04acdad6f34cff4599962cb7669bcbd72b2cb2b203db7

Download Submit
C:\Windows\SysWOW64\Nadkno32.exe

Filesize
84KB

MD5
1797e789dd4c66835f9dcd833e103198

SHA1
792e06eb43d4b881c443ca1cb0ffd1dcac103645

SHA256
9a2a7b3c5d20426b31c68ed7e94d1c32b9f02f87ea51b2976fd0f917c5269e27

SHA512
b0ee90295b2845f332747c5ce59cedf53f39458a7e0c25191b4b138cfc248a0ba44df813f9b6eb1bafaf39eb24d3f2c2b4c80275820c32e068d0c1780ebf2957

Download Submit
C:\Windows\SysWOW64\Nadkno32.exe

Filesize
84KB

MD5
1797e789dd4c66835f9dcd833e103198

SHA1
792e06eb43d4b881c443ca1cb0ffd1dcac103645

SHA256
9a2a7b3c5d20426b31c68ed7e94d1c32b9f02f87ea51b2976fd0f917c5269e27

SHA512
b0ee90295b2845f332747c5ce59cedf53f39458a7e0c25191b4b138cfc248a0ba44df813f9b6eb1bafaf39eb24d3f2c2b4c80275820c32e068d0c1780ebf2957

Download Submit
C:\Windows\SysWOW64\Nfnjinob.exe

Filesize
84KB

MD5
3bb239a12da1073bf79d4ffcb80da907

SHA1
e55d1c44434fb8400c294392055f071c8cb9baca

SHA256
2c6a99698c97dd8dc1f58741d0ef6845f39971fd1b99b2545d018898c9644ff3

SHA512
a08fe6dad55f99fbde86c03397a870eccc032b9b0cb49b84693f5f64dd7d6b26248d59d4f9146bcbe3e29127c3cc5b28ab1333b8541135ba9b9cfe6dbc1cedc1

Download Submit
C:\Windows\SysWOW64\Nfnjinob.exe

Filesize
84KB

MD5
3bb239a12da1073bf79d4ffcb80da907

SHA1
e55d1c44434fb8400c294392055f071c8cb9baca

SHA256
2c6a99698c97dd8dc1f58741d0ef6845f39971fd1b99b2545d018898c9644ff3

SHA512
a08fe6dad55f99fbde86c03397a870eccc032b9b0cb49b84693f5f64dd7d6b26248d59d4f9146bcbe3e29127c3cc5b28ab1333b8541135ba9b9cfe6dbc1cedc1

Download Submit
C:\Windows\SysWOW64\Nkjcaenj.exe

Filesize
84KB

MD5
29e96c4b32ad27a160929eafae4197cd

SHA1
2375c2d9dc00488cf76071cc9163ea32f5c4838d

SHA256
70ce833b65f9a0108e87b6bbbf3a937fecf06a86ef2d42ddbd8e28d87c38b1de

SHA512
a1dab62dd70a416d285c1e66f5f4550d5a9af9be6b73f2c1c3666708a04211e0548261b1b3490e424d27b01e6867990e6188bc3c20878501d379d30f4ecefc35

Download Submit
C:\Windows\SysWOW64\Nkjcaenj.exe

Filesize
84KB

MD5
29e96c4b32ad27a160929eafae4197cd

SHA1
2375c2d9dc00488cf76071cc9163ea32f5c4838d

SHA256
70ce833b65f9a0108e87b6bbbf3a937fecf06a86ef2d42ddbd8e28d87c38b1de

SHA512
a1dab62dd70a416d285c1e66f5f4550d5a9af9be6b73f2c1c3666708a04211e0548261b1b3490e424d27b01e6867990e6188bc3c20878501d379d30f4ecefc35

Download Submit
C:\Windows\SysWOW64\Nkolmd32.exe

Filesize
84KB

MD5
b7a9563f1f0d03e812214019d8c3f0e5

SHA1
81c248eabcf814d3729aa9b1fbefdf989e4010c0

SHA256
488d44725cfed69085b5f0114da99524c4ba02fa25dfa4b2cfc601e5f8c21bf2

SHA512
2e6446be374864edb91c91b0b96c8c56f78937f99c67fedd17edc911b37cbfc907ccdbe6c9a2035f5dabfa1770035024aa33aa8f704d3107d82fe76de0f96012

Download Submit
C:\Windows\SysWOW64\Nkolmd32.exe

Filesize
84KB

MD5
b7a9563f1f0d03e812214019d8c3f0e5

SHA1
81c248eabcf814d3729aa9b1fbefdf989e4010c0

SHA256
488d44725cfed69085b5f0114da99524c4ba02fa25dfa4b2cfc601e5f8c21bf2

SHA512
2e6446be374864edb91c91b0b96c8c56f78937f99c67fedd17edc911b37cbfc907ccdbe6c9a2035f5dabfa1770035024aa33aa8f704d3107d82fe76de0f96012

Download Submit
C:\Windows\SysWOW64\Nohkgcdp.exe

Filesize
84KB

MD5
35e133c4b98b032074f851d5875890f2

SHA1
ab5cf724abf0d8ed84c09f79eaa683c4b0a5e3af

SHA256
cb0289807a024a29edd675f13e4c0cc9ef64310f13669b4545a40c5c36c0f526

SHA512
c84dce381215fd644e72c777b80cea26229f688cf6c7bcf4a4fe852084c144e75dfb23d4a783c40f4b042752c2712504a4d0f68edee9c53a7f86f63803767fb3

Download Submit
C:\Windows\SysWOW64\Nohkgcdp.exe

Filesize
84KB

MD5
35e133c4b98b032074f851d5875890f2

SHA1
ab5cf724abf0d8ed84c09f79eaa683c4b0a5e3af

SHA256
cb0289807a024a29edd675f13e4c0cc9ef64310f13669b4545a40c5c36c0f526

SHA512
c84dce381215fd644e72c777b80cea26229f688cf6c7bcf4a4fe852084c144e75dfb23d4a783c40f4b042752c2712504a4d0f68edee9c53a7f86f63803767fb3

Download Submit
C:\Windows\SysWOW64\Obbgpmif.exe

Filesize
84KB

MD5
1a45c7140e013dc794411ba1fe34c538

SHA1
6e01e91530c12951723245e83aeb231c40b89042

SHA256
ea0c0d67b6b084e0b2b3831bb4f24814403da45d8679878ee2400d61d1464c8f

SHA512
eccf521102dfc7bd287a52e089281763b51e1b6f4eeea23c42238d3b5fc25172f1f4df39e0f2b2d0725de9960ccd257dda9f7359bceb13e5f7d00e6f635563e9

Download Submit
C:\Windows\SysWOW64\Obbgpmif.exe

Filesize
84KB

MD5
1a45c7140e013dc794411ba1fe34c538

SHA1
6e01e91530c12951723245e83aeb231c40b89042

SHA256
ea0c0d67b6b084e0b2b3831bb4f24814403da45d8679878ee2400d61d1464c8f

SHA512
eccf521102dfc7bd287a52e089281763b51e1b6f4eeea23c42238d3b5fc25172f1f4df39e0f2b2d0725de9960ccd257dda9f7359bceb13e5f7d00e6f635563e9

Download Submit
C:\Windows\SysWOW64\Ocmjna32.exe

Filesize
84KB

MD5
f8e4310dea4924a8b212f630445179ba

SHA1
920d6a16be45cc52994f8a39daeb75605e0bee94

SHA256
c8f2a4c600bd387bd529e4b05a150c1ab997cbe59a356991764c4fb1eb3fc548

SHA512
e7a7457028550dd022b28604f9d76a10a90538f9f0fe1d1dd7d0a2a32c86670fd7fac835d25efde1e017a76555537831b4b84ad708327de73649554610b8f82d

Download Submit
C:\Windows\SysWOW64\Ocmjna32.exe

Filesize
84KB

MD5
f8e4310dea4924a8b212f630445179ba

SHA1
920d6a16be45cc52994f8a39daeb75605e0bee94

SHA256
c8f2a4c600bd387bd529e4b05a150c1ab997cbe59a356991764c4fb1eb3fc548

SHA512
e7a7457028550dd022b28604f9d76a10a90538f9f0fe1d1dd7d0a2a32c86670fd7fac835d25efde1e017a76555537831b4b84ad708327de73649554610b8f82d

Download Submit
C:\Windows\SysWOW64\Odaclihj.exe

Filesize
84KB

MD5
ceb269db7670792cfeac8f516209b705

SHA1
32d52dfc3490e846530e050119c6a0872f1bca11

SHA256
a82b32e3bbb8011c5b22f969f240c7dd1c51437ec5ae70f619e0543ab1026185

SHA512
1710a78410fa7982f41135373b6400c2b2bfb0f1c89c68cd8332e88123086fc7d9ba6b56c80b834705ce48d22998cd58510554385bbea612f23804f8347d2464

Download Submit
C:\Windows\SysWOW64\Odaclihj.exe

Filesize
84KB

MD5
ceb269db7670792cfeac8f516209b705

SHA1
32d52dfc3490e846530e050119c6a0872f1bca11

SHA256
a82b32e3bbb8011c5b22f969f240c7dd1c51437ec5ae70f619e0543ab1026185

SHA512
1710a78410fa7982f41135373b6400c2b2bfb0f1c89c68cd8332e88123086fc7d9ba6b56c80b834705ce48d22998cd58510554385bbea612f23804f8347d2464

Download Submit
C:\Windows\SysWOW64\Ofdqjm32.exe

Filesize
84KB

MD5
2ff87f08c0f5ebb4079d8db101379020

SHA1
af254b80bb9464914407b2928656b40ee6a49a09

SHA256
6998148949d34dfa53b47bcdc8c08bb6a1889764bf305a0d2a549634c5261adc

SHA512
deff1471595a5d87bae2b396cc811f4f18e5b9ecdc7fe1ac585dc6c551cb9aefc703702d98e44b7de7dde1cd2332ce76b770285c89d58edb59bc64c928a7de50

Download Submit
C:\Windows\SysWOW64\Ofdqjm32.exe

Filesize
84KB

MD5
2ff87f08c0f5ebb4079d8db101379020

SHA1
af254b80bb9464914407b2928656b40ee6a49a09

SHA256
6998148949d34dfa53b47bcdc8c08bb6a1889764bf305a0d2a549634c5261adc

SHA512
deff1471595a5d87bae2b396cc811f4f18e5b9ecdc7fe1ac585dc6c551cb9aefc703702d98e44b7de7dde1cd2332ce76b770285c89d58edb59bc64c928a7de50

Download Submit
C:\Windows\SysWOW64\Oflfjl32.exe

Filesize
84KB

MD5
04ee94cc71833da0e334b60d2b95c578

SHA1
1e84fc251a2b76c37c1b61b9927cc284aa3dc42e

SHA256
dca85f9bb1d28015e3b6445454ed880dd16f1ee61cdea0d73266f29b1bb1bb97

SHA512
45f4430d79dcdba16ae7af250eee65d6a7951ff4d5ee9891e69afcaf097e23427f986991ec220a11cbccd99487b2fb88856f7e88af8681e2da9e223ddc519b31

Download Submit
C:\Windows\SysWOW64\Oflfjl32.exe

Filesize
84KB

MD5
04ee94cc71833da0e334b60d2b95c578

SHA1
1e84fc251a2b76c37c1b61b9927cc284aa3dc42e

SHA256
dca85f9bb1d28015e3b6445454ed880dd16f1ee61cdea0d73266f29b1bb1bb97

SHA512
45f4430d79dcdba16ae7af250eee65d6a7951ff4d5ee9891e69afcaf097e23427f986991ec220a11cbccd99487b2fb88856f7e88af8681e2da9e223ddc519b31

Download Submit
C:\Windows\SysWOW64\Okdehdeo.exe

Filesize
84KB

MD5
7f82a38188cce12fa69e8976cd5c7c4a

SHA1
6b42acc241e4bfddf18505c3c2a512dab6bc55e5

SHA256
d8212d1d96af8295a4012028584b69ad2534e3f1d84b18b0953b273a8a4ac29e

SHA512
f8776b41abaf3c973cec162cb50280958551439ba743ba1f702c9ffd66b35df4905fe759d77e18c99ff0bb8604129a66ff601d3e8a54d25e89985f78b7d73ea6

Download Submit
C:\Windows\SysWOW64\Okdehdeo.exe

Filesize
84KB

MD5
7f82a38188cce12fa69e8976cd5c7c4a

SHA1
6b42acc241e4bfddf18505c3c2a512dab6bc55e5

SHA256
d8212d1d96af8295a4012028584b69ad2534e3f1d84b18b0953b273a8a4ac29e

SHA512
f8776b41abaf3c973cec162cb50280958551439ba743ba1f702c9ffd66b35df4905fe759d77e18c99ff0bb8604129a66ff601d3e8a54d25e89985f78b7d73ea6

Download Submit
C:\Windows\SysWOW64\Okhocc32.exe

Filesize
84KB

MD5
fb725f382d1103d96b51f37afa950690

SHA1
ddd2574f7e38c900590c9eb400a9ffbbcd76b659

SHA256
94018d642210eb29ed6f9994496208e5f718478c566f34709129627586adbd6c

SHA512
7288e3e8b34071632155a5eb8bc48b829af6941f0b4b57c0ff3a00ec3429a6a900b96eff336c79c451a7513943b52f0d6742f3da423b2e596048eb7628e263e8

Download Submit
C:\Windows\SysWOW64\Okhocc32.exe

Filesize
84KB

MD5
fb725f382d1103d96b51f37afa950690

SHA1
ddd2574f7e38c900590c9eb400a9ffbbcd76b659

SHA256
94018d642210eb29ed6f9994496208e5f718478c566f34709129627586adbd6c

SHA512
7288e3e8b34071632155a5eb8bc48b829af6941f0b4b57c0ff3a00ec3429a6a900b96eff336c79c451a7513943b52f0d6742f3da423b2e596048eb7628e263e8

Download Submit
C:\Windows\SysWOW64\Omcbag32.exe

Filesize
84KB

MD5
df322b0d07f5c9330bbee5999cd8c072

SHA1
37f60c8594000fb2aaff894deeb1346027fede5f

SHA256
f9c89629865e649373aded4e88bd7891e8fe5f2963eefec4e61f8605dd70e58e

SHA512
7ed39a4d0a057e5d73466f3b88145cf674ce20ac47d7a1d5f4ad2dd480a45c74b18bd327e346f8d981d07c8a260bed85fc240af62c542cbb2eb5746f26e8af18

Download Submit
C:\Windows\SysWOW64\Omcbag32.exe

Filesize
84KB

MD5
df322b0d07f5c9330bbee5999cd8c072

SHA1
37f60c8594000fb2aaff894deeb1346027fede5f

SHA256
f9c89629865e649373aded4e88bd7891e8fe5f2963eefec4e61f8605dd70e58e

SHA512
7ed39a4d0a057e5d73466f3b88145cf674ce20ac47d7a1d5f4ad2dd480a45c74b18bd327e346f8d981d07c8a260bed85fc240af62c542cbb2eb5746f26e8af18

Download Submit
C:\Windows\SysWOW64\Pbedemgd.exe

Filesize
84KB

MD5
1fcf6bc6de2c4e0e97e9e78275abb86d

SHA1
1303e768efb2512b963cdb133e33d72e6ba42dc0

SHA256
013e6f505f1f263ddd41a0f40bc222f7640f5f906994ec309650dd107148f07e

SHA512
ce4008d107e52302cd08fb757c59efdb48b974653605595cd493e30a3c917d84d3ae438d3db20e23e410e7add63df619be200cd6e912ca6401f702f251397840

Download Submit
C:\Windows\SysWOW64\Pbedemgd.exe

Filesize
84KB

MD5
1fcf6bc6de2c4e0e97e9e78275abb86d

SHA1
1303e768efb2512b963cdb133e33d72e6ba42dc0

SHA256
013e6f505f1f263ddd41a0f40bc222f7640f5f906994ec309650dd107148f07e

SHA512
ce4008d107e52302cd08fb757c59efdb48b974653605595cd493e30a3c917d84d3ae438d3db20e23e410e7add63df619be200cd6e912ca6401f702f251397840

Download Submit
C:\Windows\SysWOW64\Pbimpl32.exe

Filesize
84KB

MD5
441a6b281a8aa5d7b109da4b78798c74

SHA1
20712c275d31872f8505863e5df03478213f5859

SHA256
16b4727786fc1e5ee6f8d3e88fb3d21db78ffcd958b0e217953598f9cebacafc

SHA512
ee53ce9793abcf65ddd8a4095e6de4e51c2f0bc6320ae6f6a769580facb53dea884fe74dcf57d1ec576f269b0cc2c8080d5d287d31fa8add3d56012020ad30be

Download Submit
C:\Windows\SysWOW64\Pbimpl32.exe

Filesize
84KB

MD5
441a6b281a8aa5d7b109da4b78798c74

SHA1
20712c275d31872f8505863e5df03478213f5859

SHA256
16b4727786fc1e5ee6f8d3e88fb3d21db78ffcd958b0e217953598f9cebacafc

SHA512
ee53ce9793abcf65ddd8a4095e6de4e51c2f0bc6320ae6f6a769580facb53dea884fe74dcf57d1ec576f269b0cc2c8080d5d287d31fa8add3d56012020ad30be

Download Submit
C:\Windows\SysWOW64\Pcdqopng.exe

Filesize
84KB

MD5
398af5605e451491df6236ef7661835a

SHA1
ffbe14ab86abb3abf4534b871c927d60f595749f

SHA256
c4adfa15a9661f3141de74df6c36ccb2ccc6c0128152f95a3891e9a855d6926f

SHA512
55e9747fb698966351ca5d8e1edd3ab57d10dbabc8aa70026e1ef0822f06459796651122383ff87371b7fffd878ac0a7bc826e874dded4f596580b53826d61eb

Download Submit
C:\Windows\SysWOW64\Pcdqopng.exe

Filesize
84KB

MD5
398af5605e451491df6236ef7661835a

SHA1
ffbe14ab86abb3abf4534b871c927d60f595749f

SHA256
c4adfa15a9661f3141de74df6c36ccb2ccc6c0128152f95a3891e9a855d6926f

SHA512
55e9747fb698966351ca5d8e1edd3ab57d10dbabc8aa70026e1ef0822f06459796651122383ff87371b7fffd878ac0a7bc826e874dded4f596580b53826d61eb

Download Submit
C:\Windows\SysWOW64\Pfbmkkmj.exe

Filesize
84KB

MD5
b62ba59a3d9a66041342c6f5097519b7

SHA1
d98e3ed348f93b97062ba47b77334ba328318b8d

SHA256
585dc2bca7e6fce4446ef7b38446c41cfd7af8ed4727d724ca1fed197eb8b976

SHA512
99c2e8823c58d7d30ec8cb84b89e750da7d88a1b7f1b48456e3ef0045634b3383d02e9909607b20514ab9a85f8e42cd950f528b01731cbaddeb354bc361f177e

Download Submit
C:\Windows\SysWOW64\Pfbmkkmj.exe

Filesize
84KB

MD5
b62ba59a3d9a66041342c6f5097519b7

SHA1
d98e3ed348f93b97062ba47b77334ba328318b8d

SHA256
585dc2bca7e6fce4446ef7b38446c41cfd7af8ed4727d724ca1fed197eb8b976

SHA512
99c2e8823c58d7d30ec8cb84b89e750da7d88a1b7f1b48456e3ef0045634b3383d02e9909607b20514ab9a85f8e42cd950f528b01731cbaddeb354bc361f177e

Download Submit
C:\Windows\SysWOW64\Pfgffk32.exe

Filesize
84KB

MD5
420d2e2d1d858c0b8e91129d81fbfdf3

SHA1
71958682e4058f592caaab62b65327b0c1660be7

SHA256
e25cb6603a0790f6bfe8e8c5db502aea36d0aa8670cf85e4c68e432c74ec8a24

SHA512
970856c6ac7876e87b354169f15eef3b01fb6227d0e42c6c70041a21b44e758d827427a0eee570fd8d2842d647443c8662caa1e3de0ac9218cde3d0f78b42f53

Download Submit
C:\Windows\SysWOW64\Pfgffk32.exe

Filesize
84KB

MD5
420d2e2d1d858c0b8e91129d81fbfdf3

SHA1
71958682e4058f592caaab62b65327b0c1660be7

SHA256
e25cb6603a0790f6bfe8e8c5db502aea36d0aa8670cf85e4c68e432c74ec8a24

SHA512
970856c6ac7876e87b354169f15eef3b01fb6227d0e42c6c70041a21b44e758d827427a0eee570fd8d2842d647443c8662caa1e3de0ac9218cde3d0f78b42f53

Download Submit
C:\Windows\SysWOW64\Piolagnq.exe

Filesize
84KB

MD5
41b217ed17b70cf56a112a6638378fc2

SHA1
cb8301bf680acbfa4148825be1953798edcb20e8

SHA256
c4ea33e535ef65320382671a32edcffcbd9dfe994ec393d1d39faa9a57171b9b

SHA512
d2b1f9b302344503e271da8dcc56c47bf2efb8565ffdec75f3a4276f903fadd0add2441f017bd9f3cb8c7b98c3dbc8d44156ffc95d79ee452033ec28ca997d94

Download Submit
C:\Windows\SysWOW64\Piolagnq.exe

Filesize
84KB

MD5
41b217ed17b70cf56a112a6638378fc2

SHA1
cb8301bf680acbfa4148825be1953798edcb20e8

SHA256
c4ea33e535ef65320382671a32edcffcbd9dfe994ec393d1d39faa9a57171b9b

SHA512
d2b1f9b302344503e271da8dcc56c47bf2efb8565ffdec75f3a4276f903fadd0add2441f017bd9f3cb8c7b98c3dbc8d44156ffc95d79ee452033ec28ca997d94

Download Submit
C:\Windows\SysWOW64\Pkklhc32.exe

Filesize
84KB

MD5
052245492554d6b4485bd812f2cce1d4

SHA1
88b2bfbe395f03ff154176d59e0e159aa39e69fc

SHA256
b184d3df27b166556e5b1127d34816b4fa62a93df072ba0217e8c2b8aa7b1eac

SHA512
910aa77f44405edc91b087c08324eae3bdc799276c59fba01571a8c2a7ab5b1e29459c7b940f68c0da1e5ce9969bb8b286cafe7622117d47563267dcdf71766b

Download Submit
C:\Windows\SysWOW64\Pkklhc32.exe

Filesize
84KB

MD5
052245492554d6b4485bd812f2cce1d4

SHA1
88b2bfbe395f03ff154176d59e0e159aa39e69fc

SHA256
b184d3df27b166556e5b1127d34816b4fa62a93df072ba0217e8c2b8aa7b1eac

SHA512
910aa77f44405edc91b087c08324eae3bdc799276c59fba01571a8c2a7ab5b1e29459c7b940f68c0da1e5ce9969bb8b286cafe7622117d47563267dcdf71766b

Download Submit
C:\Windows\SysWOW64\Pmmehe32.exe

Filesize
84KB

MD5
1ef85ad99f631d425551a4f4bfaa3cb5

SHA1
ea901e31529f3241caa813a63db1c7d4137fb883

SHA256
f814f12ef46e3b43add6a4c9b90d0c0dc433afba9b50f041417708d1dd52696d

SHA512
eec96066bb9382172b75d1d696a8e013be67f6474c6bd8207e19b55187a9d92f2b43eeb32f37437a7046ee3621cd232d2ff4df14ddabc2c925159edb3f8af955

Download Submit
C:\Windows\SysWOW64\Pmmehe32.exe

Filesize
84KB

MD5
1ef85ad99f631d425551a4f4bfaa3cb5

SHA1
ea901e31529f3241caa813a63db1c7d4137fb883

SHA256
f814f12ef46e3b43add6a4c9b90d0c0dc433afba9b50f041417708d1dd52696d

SHA512
eec96066bb9382172b75d1d696a8e013be67f6474c6bd8207e19b55187a9d92f2b43eeb32f37437a7046ee3621cd232d2ff4df14ddabc2c925159edb3f8af955

Download Submit
C:\Windows\SysWOW64\Pmoamebd.exe

Filesize
84KB

MD5
db8962037d820a8d88e218b29b23385a

SHA1
147b1a692052f1ec9393d5c8e25e949c2fc0674f

SHA256
2ed0eeefa8a092cf558503f0461fe15b32670921588579acbd617c25eacc34a5

SHA512
2fcd3c723fd067da48512bdcb5c72f3f2f6ae5d7544228e0c6ad49200c8b6f8e7868934aec9bc4778d8edb0cc06b54bc6e745e3b4eba35d518ac9dd82e723e54

Download Submit
C:\Windows\SysWOW64\Pmoamebd.exe

Filesize
84KB

MD5
db8962037d820a8d88e218b29b23385a

SHA1
147b1a692052f1ec9393d5c8e25e949c2fc0674f

SHA256
2ed0eeefa8a092cf558503f0461fe15b32670921588579acbd617c25eacc34a5

SHA512
2fcd3c723fd067da48512bdcb5c72f3f2f6ae5d7544228e0c6ad49200c8b6f8e7868934aec9bc4778d8edb0cc06b54bc6e745e3b4eba35d518ac9dd82e723e54

Download Submit
C:\Windows\SysWOW64\Popkoppe.exe

Filesize
84KB

MD5
d3328374dd33e2438a57c63214bd85c8

SHA1
13e422a67ca25a6b044e92758dda85c9cd0d7d56

SHA256
98d790be575e3d2251fe0edd444d71293b0333a96ab4426e452d678c4233580b

SHA512
94128da48d03ea02b6db2d4d17dea6cf2866fc3931c9e74635079167ad604e1c497dbc358994988ffd59d8d7de1cc29b6c2f8c5979fa46a7bb6261556327631c

Download Submit
C:\Windows\SysWOW64\Popkoppe.exe

Filesize
84KB

MD5
d3328374dd33e2438a57c63214bd85c8

SHA1
13e422a67ca25a6b044e92758dda85c9cd0d7d56

SHA256
98d790be575e3d2251fe0edd444d71293b0333a96ab4426e452d678c4233580b

SHA512
94128da48d03ea02b6db2d4d17dea6cf2866fc3931c9e74635079167ad604e1c497dbc358994988ffd59d8d7de1cc29b6c2f8c5979fa46a7bb6261556327631c

Download Submit
memory/312-298-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/348-223-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/428-217-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/452-264-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/460-203-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1212-260-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1424-218-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1568-213-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1596-211-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1600-316-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1660-219-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1724-285-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1856-317-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1976-308-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2040-142-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2044-287-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2052-288-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2256-221-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2364-310-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2380-220-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2452-315-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2456-300-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2656-293-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3100-296-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3136-141-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3152-290-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3156-301-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3236-320-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3280-145-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3388-257-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3444-216-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3460-263-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3648-261-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3708-305-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3784-312-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3832-313-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3872-259-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3876-256-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3972-319-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3980-253-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/3984-265-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4144-314-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4176-307-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4228-323-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4280-318-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4284-303-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4292-294-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4404-306-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4420-254-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4452-197-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4508-321-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4536-201-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4544-198-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4628-210-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4656-322-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4696-143-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4732-209-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4764-207-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4876-291-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4932-214-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4952-297-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/4956-204-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5008-222-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/5072-208-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download