a79a6dae62d933881f26124b7b07a0e3cbbcafed43bb6f522e53836b23947d5e

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
23-09-2023 10:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ee8524aa1e0f05ca8b5b97b473014d2_JC.exe
Size

64KB
MD5

2ee8524aa1e0f05ca8b5b97b473014d2
SHA1

f241c6d658f2578e00766eefbb1c6f84dbbeb1d4
SHA256

a79a6dae62d933881f26124b7b07a0e3cbbcafed43bb6f522e53836b23947d5e
SHA512

ceb71bdcdf9bd35387d75a0c3e237aeeb9d899cd2f63d765b7405c3892e7fcc7be5726a11d90234eab7ae8ebd0141745398ff147c40479f7c5719c3a8c0ddc6f
SSDEEP

1536:TH3GldRh02xWzQLDkac9Uc8IbnJm2L5nM:TH3G3zHxWckZGWZ5nM

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hildmn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hldiinke.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mplafeil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Phbhcmjl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knfeeimj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Flmqlg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppdbgncl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fmnkkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqpamb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njmhhefi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibhkfm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dqbcbkab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hhaggp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkcpql32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Llgcph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Olgemcli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfldelik.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkalplel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ickglm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eghkjdoa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Noblkqca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbplml32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ppamophb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dakacjdb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibmeoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nknobkje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gipdap32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hienlpel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pfandnla.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gpdennml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Omalpc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmbbhkjf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hjhalefe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bhblllfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gbnhoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pabblb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lqhdbm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdjgha32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fdkdibjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aokcklid.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jqdoem32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oohgdhfn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Keimof32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ihmfco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Joqafgni.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfmojenc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Imkbnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmipdk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnhmnn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Klndfj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdlfjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgehfkop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efeihb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmlfqh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Conanfli.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnnljj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kofdhd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bljlfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnhkbfme.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnldla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnafno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qfbobf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Illfdc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdenmbkk.exe

Executes dropped EXE 64 IoCs

pid	Process
4956	Llgcph32.exe
4780	Leoghn32.exe
1204	Lpekef32.exe
2392	Mhppji32.exe
4004	Medqcmki.exe
3132	Mhbmphjm.exe
3828	Mplafeil.exe
2344	Mehjol32.exe
1628	Mpnnle32.exe
3848	Mekgdl32.exe
4428	Nemcjk32.exe
348	Nbadcpbh.exe
2516	Nlihle32.exe
4596	Nebmekoi.exe
4580	Npgabc32.exe
4320	Ngaionfl.exe
1676	Npjnhc32.exe
956	Neffpj32.exe
1900	Nlqomd32.exe
1516	Ncjginjn.exe
512	Ooagno32.exe
4896	Oekpkigo.exe
1636	Ohjlgefb.exe
2304	Oocddono.exe
1680	Olgemcli.exe
2488	Ocamjm32.exe
3156	Opemca32.exe
952	Ollnhb32.exe
3096	Pfgogh32.exe
2296	Ppmcdq32.exe
4856	Plcdiabk.exe
4884	Pjgebf32.exe
2580	Ppamophb.exe
2844	Pgkelj32.exe
3636	Pofjpl32.exe
1016	Qoifflkg.exe
4440	Qfbobf32.exe
4232	Aokcklid.exe
2428	Afelhf32.exe
1536	Ajcdnd32.exe
452	Amaqjp32.exe
3996	Ackigjmh.exe
4116	Ajeadd32.exe
3792	Aqoiqn32.exe
4020	Aijnep32.exe
1908	Afnnnd32.exe
1228	Bqdblmhl.exe
3360	Bgnkhg32.exe
4840	Boipmj32.exe
3796	Bfchidda.exe
3040	Boklbi32.exe
4948	Bjaqpbkh.exe
4416	Bpnihiio.exe
1784	Bjcmebie.exe
3892	Bppfmigl.exe
232	Cmdfgm32.exe
3884	Cflkpblf.exe
4068	Cmfclm32.exe
1448	Cpeohh32.exe
4180	Cjjcfabm.exe
3260	Cadlbk32.exe
2912	Cgndoeag.exe
2292	Cceddf32.exe
1864	Cjomap32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Cceddf32.exe	Cmklglpn.exe
File created	C:\Windows\SysWOW64\Qhlkilba.exe	Pabblb32.exe
File created	C:\Windows\SysWOW64\Lippqp32.dll	Flmqlg32.exe
File opened for modification	C:\Windows\SysWOW64\Jgbchj32.exe	Jcfggkac.exe
File created	C:\Windows\SysWOW64\Bdcmkgmm.exe	Bphqji32.exe
File opened for modification	C:\Windows\SysWOW64\Cpeohh32.exe	Cmfclm32.exe
File created	C:\Windows\SysWOW64\Cfapoa32.dll	Bbgeno32.exe
File created	C:\Windows\SysWOW64\Pknqoc32.exe	Omjpeo32.exe
File created	C:\Windows\SysWOW64\Hemmac32.exe	Hppeim32.exe
File created	C:\Windows\SysWOW64\Ncjiib32.dll	Dalofi32.exe
File opened for modification	C:\Windows\SysWOW64\Dpckjfgg.exe	Diicml32.exe
File created	C:\Windows\SysWOW64\Bcpeei32.dll	Dkdliame.exe
File opened for modification	C:\Windows\SysWOW64\Njinmf32.exe	Ngjbaj32.exe
File created	C:\Windows\SysWOW64\Dbfpagon.dll	Amjbbfgo.exe
File opened for modification	C:\Windows\SysWOW64\Ekonpckp.exe	Eqiibjlj.exe
File created	C:\Windows\SysWOW64\Cflkpblf.exe	Cmdfgm32.exe
File created	C:\Windows\SysWOW64\Omjpeo32.exe	Ojigdcll.exe
File created	C:\Windows\SysWOW64\Gejopl32.exe	Gidnkkpc.exe
File created	C:\Windows\SysWOW64\Ahmjjoig.exe	Qmgelf32.exe
File created	C:\Windows\SysWOW64\Pghien32.dll	Cglbhhga.exe
File opened for modification	C:\Windows\SysWOW64\Dkbocbog.exe	Dmoohe32.exe
File created	C:\Windows\SysWOW64\Nmocfo32.dll	Pjdpelnc.exe
File opened for modification	C:\Windows\SysWOW64\Jbkbpoog.exe	Jjdjoane.exe
File created	C:\Windows\SysWOW64\Gckoph32.dll	Hplicjok.exe
File created	C:\Windows\SysWOW64\Mgclpkac.exe	Meepdp32.exe
File created	C:\Windows\SysWOW64\Dohnnkjk.dll	Ajjokd32.exe
File created	C:\Windows\SysWOW64\Bpqjjjjl.exe	Banjnm32.exe
File created	C:\Windows\SysWOW64\Hkhomj32.dll	Ppmcdq32.exe
File created	C:\Windows\SysWOW64\Facqkg32.exe	Filiii32.exe
File opened for modification	C:\Windows\SysWOW64\Oocmii32.exe	Ooqqdi32.exe
File created	C:\Windows\SysWOW64\Maggnali.exe	Mnhkbfme.exe
File created	C:\Windows\SysWOW64\Dgpamjnb.dll	Gpdennml.exe
File created	C:\Windows\SysWOW64\Gddbcp32.exe	Gklnjj32.exe
File created	C:\Windows\SysWOW64\Lflbkcll.exe	Lqojclne.exe
File opened for modification	C:\Windows\SysWOW64\Ajjokd32.exe	Acqgojmb.exe
File created	C:\Windows\SysWOW64\Eaecci32.dll	Ecdbop32.exe
File created	C:\Windows\SysWOW64\Pnnlinml.dll	Iciaqc32.exe
File created	C:\Windows\SysWOW64\Khfclo32.dll	Cbdjeg32.exe
File created	C:\Windows\SysWOW64\Ilgonc32.dll	Pjpfjl32.exe
File created	C:\Windows\SysWOW64\Pfgogh32.exe	Ollnhb32.exe
File created	C:\Windows\SysWOW64\Ppamophb.exe	Pjgebf32.exe
File opened for modification	C:\Windows\SysWOW64\Knhakh32.exe	Kjmfjj32.exe
File created	C:\Windows\SysWOW64\Pqhfnd32.dll	Hfjdqmng.exe
File created	C:\Windows\SysWOW64\Dalofi32.exe	Dggkipii.exe
File opened for modification	C:\Windows\SysWOW64\Dabhdinj.exe	Djhpgofm.exe
File created	C:\Windows\SysWOW64\Iloidijb.exe	Iknmla32.exe
File opened for modification	C:\Windows\SysWOW64\Baegibae.exe	Bgpcliao.exe
File created	C:\Windows\SysWOW64\Hjcbmgnb.dll	Nfqnbjfi.exe
File created	C:\Windows\SysWOW64\Engdno32.dll	Afcmfe32.exe
File created	C:\Windows\SysWOW64\Nemcjk32.exe	Mekgdl32.exe
File opened for modification	C:\Windows\SysWOW64\Ooqqdi32.exe	Oidhlb32.exe
File created	C:\Windows\SysWOW64\Jhpqaiji.exe	Jgadgf32.exe
File opened for modification	C:\Windows\SysWOW64\Jqlefl32.exe	Jjamia32.exe
File opened for modification	C:\Windows\SysWOW64\Cfldelik.exe	Ccmgiaig.exe
File opened for modification	C:\Windows\SysWOW64\Cjjcfabm.exe	Cpeohh32.exe
File created	C:\Windows\SysWOW64\Fgcjfbed.exe	Feenjgfq.exe
File opened for modification	C:\Windows\SysWOW64\Gnohnffc.exe	Gqkhda32.exe
File opened for modification	C:\Windows\SysWOW64\Aoioli32.exe	Ahofoogd.exe
File opened for modification	C:\Windows\SysWOW64\Omdieb32.exe	Obnehj32.exe
File created	C:\Windows\SysWOW64\Ejojljqa.exe	Ecdbop32.exe
File opened for modification	C:\Windows\SysWOW64\Lllagh32.exe	Lljdai32.exe
File created	C:\Windows\SysWOW64\Plgkkjnn.dll	Hglaej32.exe
File created	C:\Windows\SysWOW64\Aedkdf32.dll	Kjffdalb.exe
File opened for modification	C:\Windows\SysWOW64\Gmggfp32.exe	Gfmojenc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7908	7872	WerFault.exe	829

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pefabkej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lblldc32.dll"	Igajal32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jbfjlb32.dll"	Llgcph32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enkjji32.dll"	Mbenmk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hqomopfd.dll"	Nknobkje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fajbad32.dll"	Hginecde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfmmaj32.dll"	Gpelhd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kpjgaoqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjdpelnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pggdhe32.dll"	Hajkqfoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Icifhjkc.dll"	Amkhmoap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjfogbjb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qoifflkg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jqlefl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jqlefl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dflmlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbddol32.dll"	Ciihjmcj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ngaionfl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofmdio32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nbebbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lalceb32.dll"	Bbaclegm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kjffdalb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Negcig32.dll"	Ajggomog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odgpqgeo.dll"	Madjhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gokbgpeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gjaphgpl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jgbchj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfkcaoef.dll"	Nnafno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bnoddcef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhbebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jocnlg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncbafoge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bbaclegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgbiiion.dll"	Dclkee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jjamia32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dflmlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Danihi32.dll"	Qdbdcg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ghmbno32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lnldla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ofmdio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iacngdgj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajeadd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bqdblmhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jihdpleo.dll"	Gmiclo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cnggkf32.dll"	Ekonpckp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gghdaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hbenoi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcmjja32.dll"	Jifecp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hnfjbdmk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mlmbfqoj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omqmop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omgmeigd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Chiigadc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cacckp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mpnnle32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kqpoakco.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hginecde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhlkdj32.dll"	Pdkoch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nhokljge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pmmnjnld.dll"	Njmhhefi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eklajcmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ilfennic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnldla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjamidgd.dll"	Ahofoogd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 4956	3136	2ee8524aa1e0f05ca8b5b97b473014d2_JC.exe	86
PID 3136 wrote to memory of 4956	3136	2ee8524aa1e0f05ca8b5b97b473014d2_JC.exe	86
PID 3136 wrote to memory of 4956	3136	2ee8524aa1e0f05ca8b5b97b473014d2_JC.exe	86
PID 4956 wrote to memory of 4780	4956	Llgcph32.exe	87
PID 4956 wrote to memory of 4780	4956	Llgcph32.exe	87
PID 4956 wrote to memory of 4780	4956	Llgcph32.exe	87
PID 4780 wrote to memory of 1204	4780	Leoghn32.exe	88
PID 4780 wrote to memory of 1204	4780	Leoghn32.exe	88
PID 4780 wrote to memory of 1204	4780	Leoghn32.exe	88
PID 1204 wrote to memory of 2392	1204	Lpekef32.exe	89
PID 1204 wrote to memory of 2392	1204	Lpekef32.exe	89
PID 1204 wrote to memory of 2392	1204	Lpekef32.exe	89
PID 2392 wrote to memory of 4004	2392	Mhppji32.exe	90
PID 2392 wrote to memory of 4004	2392	Mhppji32.exe	90
PID 2392 wrote to memory of 4004	2392	Mhppji32.exe	90
PID 4004 wrote to memory of 3132	4004	Medqcmki.exe	91
PID 4004 wrote to memory of 3132	4004	Medqcmki.exe	91
PID 4004 wrote to memory of 3132	4004	Medqcmki.exe	91
PID 3132 wrote to memory of 3828	3132	Mhbmphjm.exe	92
PID 3132 wrote to memory of 3828	3132	Mhbmphjm.exe	92
PID 3132 wrote to memory of 3828	3132	Mhbmphjm.exe	92
PID 3828 wrote to memory of 2344	3828	Mplafeil.exe	93
PID 3828 wrote to memory of 2344	3828	Mplafeil.exe	93
PID 3828 wrote to memory of 2344	3828	Mplafeil.exe	93
PID 2344 wrote to memory of 1628	2344	Mehjol32.exe	94
PID 2344 wrote to memory of 1628	2344	Mehjol32.exe	94
PID 2344 wrote to memory of 1628	2344	Mehjol32.exe	94
PID 1628 wrote to memory of 3848	1628	Mpnnle32.exe	95
PID 1628 wrote to memory of 3848	1628	Mpnnle32.exe	95
PID 1628 wrote to memory of 3848	1628	Mpnnle32.exe	95
PID 3848 wrote to memory of 4428	3848	Mekgdl32.exe	96
PID 3848 wrote to memory of 4428	3848	Mekgdl32.exe	96
PID 3848 wrote to memory of 4428	3848	Mekgdl32.exe	96
PID 4428 wrote to memory of 348	4428	Nemcjk32.exe	97
PID 4428 wrote to memory of 348	4428	Nemcjk32.exe	97
PID 4428 wrote to memory of 348	4428	Nemcjk32.exe	97
PID 348 wrote to memory of 2516	348	Nbadcpbh.exe	98
PID 348 wrote to memory of 2516	348	Nbadcpbh.exe	98
PID 348 wrote to memory of 2516	348	Nbadcpbh.exe	98
PID 2516 wrote to memory of 4596	2516	Nlihle32.exe	99
PID 2516 wrote to memory of 4596	2516	Nlihle32.exe	99
PID 2516 wrote to memory of 4596	2516	Nlihle32.exe	99
PID 4596 wrote to memory of 4580	4596	Nebmekoi.exe	100
PID 4596 wrote to memory of 4580	4596	Nebmekoi.exe	100
PID 4596 wrote to memory of 4580	4596	Nebmekoi.exe	100
PID 4580 wrote to memory of 4320	4580	Npgabc32.exe	101
PID 4580 wrote to memory of 4320	4580	Npgabc32.exe	101
PID 4580 wrote to memory of 4320	4580	Npgabc32.exe	101
PID 4320 wrote to memory of 1676	4320	Ngaionfl.exe	102
PID 4320 wrote to memory of 1676	4320	Ngaionfl.exe	102
PID 4320 wrote to memory of 1676	4320	Ngaionfl.exe	102
PID 1676 wrote to memory of 956	1676	Npjnhc32.exe	103
PID 1676 wrote to memory of 956	1676	Npjnhc32.exe	103
PID 1676 wrote to memory of 956	1676	Npjnhc32.exe	103
PID 956 wrote to memory of 1900	956	Neffpj32.exe	104
PID 956 wrote to memory of 1900	956	Neffpj32.exe	104
PID 956 wrote to memory of 1900	956	Neffpj32.exe	104
PID 1900 wrote to memory of 1516	1900	Nlqomd32.exe	105
PID 1900 wrote to memory of 1516	1900	Nlqomd32.exe	105
PID 1900 wrote to memory of 1516	1900	Nlqomd32.exe	105
PID 1516 wrote to memory of 512	1516	Ncjginjn.exe	106
PID 1516 wrote to memory of 512	1516	Ncjginjn.exe	106
PID 1516 wrote to memory of 512	1516	Ncjginjn.exe	106
PID 512 wrote to memory of 4896	512	Ooagno32.exe	107

C:\Users\Admin\AppData\Local\Temp\2ee8524aa1e0f05ca8b5b97b473014d2_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2ee8524aa1e0f05ca8b5b97b473014d2_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\SysWOW64\Llgcph32.exe
  C:\Windows\system32\Llgcph32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\SysWOW64\Leoghn32.exe
    C:\Windows\system32\Leoghn32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4780
  - - C:\Windows\SysWOW64\Lpekef32.exe
      C:\Windows\system32\Lpekef32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1204
    - - C:\Windows\SysWOW64\Mhppji32.exe
        
        C:\Windows\system32\Mhppji32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2392
      - C:\Windows\SysWOW64\Medqcmki.exe
        
        C:\Windows\system32\Medqcmki.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Windows\SysWOW64\Mhbmphjm.exe
        
        C:\Windows\system32\Mhbmphjm.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Windows\SysWOW64\Mplafeil.exe
        
        C:\Windows\system32\Mplafeil.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3828
        
        C:\Windows\SysWOW64\Mehjol32.exe
        
        C:\Windows\system32\Mehjol32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2344
        
        C:\Windows\SysWOW64\Mpnnle32.exe
        
        C:\Windows\system32\Mpnnle32.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1628
        
        C:\Windows\SysWOW64\Mekgdl32.exe
        
        C:\Windows\system32\Mekgdl32.exe
        11⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3848
        
        C:\Windows\SysWOW64\Nemcjk32.exe
        
        C:\Windows\system32\Nemcjk32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4428
        
        C:\Windows\SysWOW64\Nbadcpbh.exe
        
        C:\Windows\system32\Nbadcpbh.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:348
        
        C:\Windows\SysWOW64\Nlihle32.exe
        
        C:\Windows\system32\Nlihle32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2516
        
        C:\Windows\SysWOW64\Nebmekoi.exe
        
        C:\Windows\system32\Nebmekoi.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Windows\SysWOW64\Npgabc32.exe
        
        C:\Windows\system32\Npgabc32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4580
        
        C:\Windows\SysWOW64\Ngaionfl.exe
        
        C:\Windows\system32\Ngaionfl.exe
        17⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4320
        
        C:\Windows\SysWOW64\Npjnhc32.exe
        
        C:\Windows\system32\Npjnhc32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1676
        
        C:\Windows\SysWOW64\Neffpj32.exe
        
        C:\Windows\system32\Neffpj32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:956
        
        C:\Windows\SysWOW64\Nlqomd32.exe
        
        C:\Windows\system32\Nlqomd32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1900
        
        C:\Windows\SysWOW64\Ncjginjn.exe
        
        C:\Windows\system32\Ncjginjn.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1516
        
        C:\Windows\SysWOW64\Ooagno32.exe
        
        C:\Windows\system32\Ooagno32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:512
        
        C:\Windows\SysWOW64\Oekpkigo.exe
        
        C:\Windows\system32\Oekpkigo.exe
        23⤵
        Executes dropped EXE
        
        PID:4896
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        24⤵
        Executes dropped EXE
        
        PID:1636
        
        C:\Windows\SysWOW64\Oocddono.exe
        
        C:\Windows\system32\Oocddono.exe
        25⤵
        Executes dropped EXE
        
        PID:2304
        
        C:\Windows\SysWOW64\Olgemcli.exe
        
        C:\Windows\system32\Olgemcli.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1680
        
        C:\Windows\SysWOW64\Ocamjm32.exe
        
        C:\Windows\system32\Ocamjm32.exe
        27⤵
        Executes dropped EXE
        
        PID:2488
        
        C:\Windows\SysWOW64\Opemca32.exe
        
        C:\Windows\system32\Opemca32.exe
        28⤵
        Executes dropped EXE
        
        PID:3156
        
        C:\Windows\SysWOW64\Ollnhb32.exe
        
        C:\Windows\system32\Ollnhb32.exe
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:952
        
        C:\Windows\SysWOW64\Pfgogh32.exe
        
        C:\Windows\system32\Pfgogh32.exe
        30⤵
        Executes dropped EXE
        
        PID:3096
        
        C:\Windows\SysWOW64\Ppmcdq32.exe
        
        C:\Windows\system32\Ppmcdq32.exe
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2296
        
        C:\Windows\SysWOW64\Plcdiabk.exe
        
        C:\Windows\system32\Plcdiabk.exe
        32⤵
        Executes dropped EXE
        
        PID:4856
        
        C:\Windows\SysWOW64\Pjgebf32.exe
        
        C:\Windows\system32\Pjgebf32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4884
        
        C:\Windows\SysWOW64\Ppamophb.exe
        
        C:\Windows\system32\Ppamophb.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2580
        
        C:\Windows\SysWOW64\Pgkelj32.exe
        
        C:\Windows\system32\Pgkelj32.exe
        35⤵
        Executes dropped EXE
        
        PID:2844
        
        C:\Windows\SysWOW64\Pofjpl32.exe
        
        C:\Windows\system32\Pofjpl32.exe
        36⤵
        Executes dropped EXE
        
        PID:3636
        
        C:\Windows\SysWOW64\Qoifflkg.exe
        
        C:\Windows\system32\Qoifflkg.exe
        37⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1016
        
        C:\Windows\SysWOW64\Qfbobf32.exe
        
        C:\Windows\system32\Qfbobf32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4440
        
        C:\Windows\SysWOW64\Aokcklid.exe
        
        C:\Windows\system32\Aokcklid.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4232
        
        C:\Windows\SysWOW64\Afelhf32.exe
        
        C:\Windows\system32\Afelhf32.exe
        40⤵
        Executes dropped EXE
        
        PID:2428
        
        C:\Windows\SysWOW64\Ajcdnd32.exe
        
        C:\Windows\system32\Ajcdnd32.exe
        41⤵
        Executes dropped EXE
        
        PID:1536
        
        C:\Windows\SysWOW64\Amaqjp32.exe
        
        C:\Windows\system32\Amaqjp32.exe
        42⤵
        Executes dropped EXE
        
        PID:452
        
        C:\Windows\SysWOW64\Ackigjmh.exe
        
        C:\Windows\system32\Ackigjmh.exe
        43⤵
        Executes dropped EXE
        
        PID:3996
        
        C:\Windows\SysWOW64\Ajeadd32.exe
        
        C:\Windows\system32\Ajeadd32.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4116
        
        C:\Windows\SysWOW64\Aqoiqn32.exe
        
        C:\Windows\system32\Aqoiqn32.exe
        45⤵
        Executes dropped EXE
        
        PID:3792
        
        C:\Windows\SysWOW64\Aijnep32.exe
        
        C:\Windows\system32\Aijnep32.exe
        46⤵
        Executes dropped EXE
        
        PID:4020
        
        C:\Windows\SysWOW64\Afnnnd32.exe
        
        C:\Windows\system32\Afnnnd32.exe
        47⤵
        Executes dropped EXE
        
        PID:1908
        
        C:\Windows\SysWOW64\Bqdblmhl.exe
        
        C:\Windows\system32\Bqdblmhl.exe
        48⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1228
        
        C:\Windows\SysWOW64\Bgnkhg32.exe
        
        C:\Windows\system32\Bgnkhg32.exe
        49⤵
        Executes dropped EXE
        
        PID:3360
        
        C:\Windows\SysWOW64\Boipmj32.exe
        
        C:\Windows\system32\Boipmj32.exe
        50⤵
        Executes dropped EXE
        
        PID:4840
        
        C:\Windows\SysWOW64\Bfchidda.exe
        
        C:\Windows\system32\Bfchidda.exe
        51⤵
        Executes dropped EXE
        
        PID:3796
        
        C:\Windows\SysWOW64\Boklbi32.exe
        
        C:\Windows\system32\Boklbi32.exe
        52⤵
        Executes dropped EXE
        
        PID:3040
        
        C:\Windows\SysWOW64\Bjaqpbkh.exe
        
        C:\Windows\system32\Bjaqpbkh.exe
        53⤵
        Executes dropped EXE
        
        PID:4948
        
        C:\Windows\SysWOW64\Bpnihiio.exe
        
        C:\Windows\system32\Bpnihiio.exe
        54⤵
        Executes dropped EXE
        
        PID:4416
        
        C:\Windows\SysWOW64\Bjcmebie.exe
        
        C:\Windows\system32\Bjcmebie.exe
        55⤵
        Executes dropped EXE
        
        PID:1784
        
        C:\Windows\SysWOW64\Bppfmigl.exe
        
        C:\Windows\system32\Bppfmigl.exe
        56⤵
        Executes dropped EXE
        
        PID:3892
        
        C:\Windows\SysWOW64\Cmdfgm32.exe
        
        C:\Windows\system32\Cmdfgm32.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:232
        
        C:\Windows\SysWOW64\Cflkpblf.exe
        
        C:\Windows\system32\Cflkpblf.exe
        58⤵
        Executes dropped EXE
        
        PID:3884
        
        C:\Windows\SysWOW64\Cmfclm32.exe
        
        C:\Windows\system32\Cmfclm32.exe
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4068
        
        C:\Windows\SysWOW64\Cpeohh32.exe
        
        C:\Windows\system32\Cpeohh32.exe
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1448
        
        C:\Windows\SysWOW64\Cjjcfabm.exe
        
        C:\Windows\system32\Cjjcfabm.exe
        61⤵
        Executes dropped EXE
        
        PID:4180
        
        C:\Windows\SysWOW64\Cadlbk32.exe
        
        C:\Windows\system32\Cadlbk32.exe
        62⤵
        Executes dropped EXE
        
        PID:3260
        
        C:\Windows\SysWOW64\Cgndoeag.exe
        
        C:\Windows\system32\Cgndoeag.exe
        63⤵
        Executes dropped EXE
        
        PID:2912
        
        C:\Windows\SysWOW64\Cmklglpn.exe
        
        C:\Windows\system32\Cmklglpn.exe
        64⤵
        Drops file in System32 directory
        
        PID:3852
        
        C:\Windows\SysWOW64\Cceddf32.exe
        
        C:\Windows\system32\Cceddf32.exe
        65⤵
        Executes dropped EXE
        
        PID:2292
        
        C:\Windows\SysWOW64\Cjomap32.exe
        
        C:\Windows\system32\Cjomap32.exe
        66⤵
        Executes dropped EXE
        
        PID:1864
        
        C:\Windows\SysWOW64\Cmniml32.exe
        
        C:\Windows\system32\Cmniml32.exe
        67⤵
        
        PID:4604
        
        C:\Windows\SysWOW64\Cgcmjd32.exe
        
        C:\Windows\system32\Cgcmjd32.exe
        68⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\Dakacjdb.exe
        
        C:\Windows\system32\Dakacjdb.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1088
        
        C:\Windows\SysWOW64\Dgejpd32.exe
        
        C:\Windows\system32\Dgejpd32.exe
        70⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\Diffglam.exe
        
        C:\Windows\system32\Diffglam.exe
        71⤵
        
        PID:4172
        
        C:\Windows\SysWOW64\Dmbbhkjf.exe
        
        C:\Windows\system32\Dmbbhkjf.exe
        72⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2748
        
        C:\Windows\SysWOW64\Dclkee32.exe
        
        C:\Windows\system32\Dclkee32.exe
        73⤵
        Modifies registry class
        
        PID:5080
        
        C:\Windows\SysWOW64\Dfjgaq32.exe
        
        C:\Windows\system32\Dfjgaq32.exe
        74⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\Diicml32.exe
        
        C:\Windows\system32\Diicml32.exe
        75⤵
        Drops file in System32 directory
        
        PID:5144
        
        C:\Windows\SysWOW64\Dpckjfgg.exe
        
        C:\Windows\system32\Dpckjfgg.exe
        76⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Djhpgofm.exe
        
        C:\Windows\system32\Djhpgofm.exe
        77⤵
        Drops file in System32 directory
        
        PID:5236
        
        C:\Windows\SysWOW64\Dabhdinj.exe
        
        C:\Windows\system32\Dabhdinj.exe
        78⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Dmihij32.exe
        
        C:\Windows\system32\Dmihij32.exe
        79⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Dhomfc32.exe
        
        C:\Windows\system32\Dhomfc32.exe
        80⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Eipinkib.exe
        
        C:\Windows\system32\Eipinkib.exe
        81⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Eaindh32.exe
        
        C:\Windows\system32\Eaindh32.exe
        82⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Ejbbmnnb.exe
        
        C:\Windows\system32\Ejbbmnnb.exe
        83⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Eigonjcj.exe
        
        C:\Windows\system32\Eigonjcj.exe
        84⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Ehhpla32.exe
        
        C:\Windows\system32\Ehhpla32.exe
        85⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Eaqdegaj.exe
        
        C:\Windows\system32\Eaqdegaj.exe
        86⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Filiii32.exe
        
        C:\Windows\system32\Filiii32.exe
        87⤵
        Drops file in System32 directory
        
        PID:5672
        
        C:\Windows\SysWOW64\Facqkg32.exe
        
        C:\Windows\system32\Facqkg32.exe
        88⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Fmjaphek.exe
        
        C:\Windows\system32\Fmjaphek.exe
        89⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Fgbfhmll.exe
        
        C:\Windows\system32\Fgbfhmll.exe
        90⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Fgdbnmji.exe
        
        C:\Windows\system32\Fgdbnmji.exe
        91⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Fmnkkg32.exe
        
        C:\Windows\system32\Fmnkkg32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5892
        
        C:\Windows\SysWOW64\Fpodlbng.exe
        
        C:\Windows\system32\Fpodlbng.exe
        93⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Ghhhcomg.exe
        
        C:\Windows\system32\Ghhhcomg.exe
        94⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Gacjadad.exe
        
        C:\Windows\system32\Gacjadad.exe
        95⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Ghmbno32.exe
        
        C:\Windows\system32\Ghmbno32.exe
        96⤵
        Modifies registry class
        
        PID:6060
        
        C:\Windows\SysWOW64\Gklnjj32.exe
        
        C:\Windows\system32\Gklnjj32.exe
        97⤵
        Drops file in System32 directory
        
        PID:6112
        
        C:\Windows\SysWOW64\Gddbcp32.exe
        
        C:\Windows\system32\Gddbcp32.exe
        98⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Gpkchqdj.exe
        
        C:\Windows\system32\Gpkchqdj.exe
        99⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Hgelek32.exe
        
        C:\Windows\system32\Hgelek32.exe
        100⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Hpmpnp32.exe
        
        C:\Windows\system32\Hpmpnp32.exe
        101⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Hammhcij.exe
        
        C:\Windows\system32\Hammhcij.exe
        102⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Hjhalefe.exe
        
        C:\Windows\system32\Hjhalefe.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5528
        
        C:\Windows\SysWOW64\Haoimcgg.exe
        
        C:\Windows\system32\Haoimcgg.exe
        104⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Hglaej32.exe
        
        C:\Windows\system32\Hglaej32.exe
        105⤵
        Drops file in System32 directory
        
        PID:5704
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        106⤵
        Modifies registry class
        
        PID:5784
        
        C:\Windows\SysWOW64\Hgnoki32.exe
        
        C:\Windows\system32\Hgnoki32.exe
        107⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Hjlkge32.exe
        
        C:\Windows\system32\Hjlkge32.exe
        108⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Igedlh32.exe
        
        C:\Windows\system32\Igedlh32.exe
        109⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Ijcahd32.exe
        
        C:\Windows\system32\Ijcahd32.exe
        110⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        111⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Ibmeoq32.exe
        
        C:\Windows\system32\Ibmeoq32.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5204
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        113⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Indfca32.exe
        
        C:\Windows\system32\Indfca32.exe
        114⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Jglklggl.exe
        
        C:\Windows\system32\Jglklggl.exe
        115⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5724
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        117⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Jbdlop32.exe
        
        C:\Windows\system32\Jbdlop32.exe
        118⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Jgadgf32.exe
        
        C:\Windows\system32\Jgadgf32.exe
        119⤵
        Drops file in System32 directory
        
        PID:6032
        
        C:\Windows\SysWOW64\Jhpqaiji.exe
        
        C:\Windows\system32\Jhpqaiji.exe
        120⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        121⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Jjamia32.exe
        
        C:\Windows\system32\Jjamia32.exe
        122⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5460
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        123⤵
        Modifies registry class
        
        PID:5660
        
        C:\Windows\SysWOW64\Jgenbfoa.exe
        
        C:\Windows\system32\Jgenbfoa.exe
        124⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\Jjdjoane.exe
        
        C:\Windows\system32\Jjdjoane.exe
        125⤵
        Drops file in System32 directory
        
        PID:5900
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        126⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Kdinljnk.exe
        
        C:\Windows\system32\Kdinljnk.exe
        127⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        128⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Kjffdalb.exe
        
        C:\Windows\system32\Kjffdalb.exe
        129⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4588
        
        C:\Windows\SysWOW64\Kqpoakco.exe
        
        C:\Windows\system32\Kqpoakco.exe
        130⤵
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        131⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Kgjgne32.exe
        
        C:\Windows\system32\Kgjgne32.exe
        132⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\Kbpkkn32.exe
        
        C:\Windows\system32\Kbpkkn32.exe
        133⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        134⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Kgmcce32.exe
        
        C:\Windows\system32\Kgmcce32.exe
        135⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Keqdmihc.exe
        
        C:\Windows\system32\Keqdmihc.exe
        136⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Kjmmepfj.exe
        
        C:\Windows\system32\Kjmmepfj.exe
        137⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        138⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Kinmcg32.exe
        
        C:\Windows\system32\Kinmcg32.exe
        139⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Kgamnded.exe
        
        C:\Windows\system32\Kgamnded.exe
        140⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Leenhhdn.exe
        
        C:\Windows\system32\Leenhhdn.exe
        141⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Lkofdbkj.exe
        
        C:\Windows\system32\Lkofdbkj.exe
        142⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Lbinam32.exe
        
        C:\Windows\system32\Lbinam32.exe
        143⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Legjmh32.exe
        
        C:\Windows\system32\Legjmh32.exe
        144⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Licfngjd.exe
        
        C:\Windows\system32\Licfngjd.exe
        145⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Lbkkgl32.exe
        
        C:\Windows\system32\Lbkkgl32.exe
        146⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Lankbigo.exe
        
        C:\Windows\system32\Lankbigo.exe
        147⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        148⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        149⤵
        
        PID:6640
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        150⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        151⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Llhikacp.exe
        
        C:\Windows\system32\Llhikacp.exe
        152⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Mbbagk32.exe
        
        C:\Windows\system32\Mbbagk32.exe
        153⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Mjneln32.exe
        
        C:\Windows\system32\Mjneln32.exe
        154⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Mbenmk32.exe
        
        C:\Windows\system32\Mbenmk32.exe
        155⤵
        Modifies registry class
        
        PID:6912
        
        C:\Windows\SysWOW64\Mlmbfqoj.exe
        
        C:\Windows\system32\Mlmbfqoj.exe
        156⤵
        Modifies registry class
        
        PID:6964
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        157⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Meefofek.exe
        
        C:\Windows\system32\Meefofek.exe
        158⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Mhdckaeo.exe
        
        C:\Windows\system32\Mhdckaeo.exe
        159⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        160⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        161⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Mblcnj32.exe
        
        C:\Windows\system32\Mblcnj32.exe
        162⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Njghbl32.exe
        
        C:\Windows\system32\Njghbl32.exe
        163⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Nbnpcj32.exe
        
        C:\Windows\system32\Nbnpcj32.exe
        164⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        165⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Nafjjf32.exe
        
        C:\Windows\system32\Nafjjf32.exe
        166⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        167⤵
        
        PID:6668
        
        C:\Windows\SysWOW64\Nknobkje.exe
        
        C:\Windows\system32\Nknobkje.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6748
        
        C:\Windows\SysWOW64\Nahgoe32.exe
        
        C:\Windows\system32\Nahgoe32.exe
        169⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Niooqcad.exe
        
        C:\Windows\system32\Niooqcad.exe
        170⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        171⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        172⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        173⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        174⤵
        Drops file in System32 directory
        
        PID:6184
        
        C:\Windows\SysWOW64\Ooqqdi32.exe
        
        C:\Windows\system32\Ooqqdi32.exe
        175⤵
        Drops file in System32 directory
        
        PID:6344
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        176⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Oaajed32.exe
        
        C:\Windows\system32\Oaajed32.exe
        177⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Ooejohhq.exe
        
        C:\Windows\system32\Ooejohhq.exe
        178⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Oiknlagg.exe
        
        C:\Windows\system32\Oiknlagg.exe
        179⤵
        
        PID:6776
        
        C:\Windows\SysWOW64\Olijhmgj.exe
        
        C:\Windows\system32\Olijhmgj.exe
        180⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Oohgdhfn.exe
        
        C:\Windows\system32\Oohgdhfn.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7004
        
        C:\Windows\SysWOW64\Ohpkmn32.exe
        
        C:\Windows\system32\Ohpkmn32.exe
        182⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Pahpfc32.exe
        
        C:\Windows\system32\Pahpfc32.exe
        183⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Phbhcmjl.exe
        
        C:\Windows\system32\Phbhcmjl.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6360
        
        C:\Windows\SysWOW64\Plndcl32.exe
        
        C:\Windows\system32\Plndcl32.exe
        185⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Pchlpfjb.exe
        
        C:\Windows\system32\Pchlpfjb.exe
        186⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        187⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        188⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Phganm32.exe
        
        C:\Windows\system32\Phganm32.exe
        189⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Papfgbmg.exe
        
        C:\Windows\system32\Papfgbmg.exe
        190⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Plejdkmm.exe
        
        C:\Windows\system32\Plejdkmm.exe
        191⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        192⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7088
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        193⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\Qcaofebg.exe
        
        C:\Windows\system32\Qcaofebg.exe
        194⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Qljcoj32.exe
        
        C:\Windows\system32\Qljcoj32.exe
        195⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Qohpkf32.exe
        
        C:\Windows\system32\Qohpkf32.exe
        196⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Qebhhp32.exe
        
        C:\Windows\system32\Qebhhp32.exe
        197⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Allpejfe.exe
        
        C:\Windows\system32\Allpejfe.exe
        198⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Aojlaeei.exe
        
        C:\Windows\system32\Aojlaeei.exe
        199⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Aeddnp32.exe
        
        C:\Windows\system32\Aeddnp32.exe
        200⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Achegd32.exe
        
        C:\Windows\system32\Achegd32.exe
        201⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Aoabad32.exe
        
        C:\Windows\system32\Aoabad32.exe
        202⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        203⤵
        Modifies registry class
        
        PID:7348
        
        C:\Windows\SysWOW64\Akhcfe32.exe
        
        C:\Windows\system32\Akhcfe32.exe
        204⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        205⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        206⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Bbdhiojo.exe
        
        C:\Windows\system32\Bbdhiojo.exe
        207⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7560
        
        C:\Windows\SysWOW64\Bbgeno32.exe
        
        C:\Windows\system32\Bbgeno32.exe
        209⤵
        Drops file in System32 directory
        
        PID:7604
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        210⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        211⤵
        
        PID:7716
        
        C:\Windows\SysWOW64\Bhcjqinf.exe
        
        C:\Windows\system32\Bhcjqinf.exe
        212⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Bmofagfp.exe
        
        C:\Windows\system32\Bmofagfp.exe
        213⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Bblnindg.exe
        
        C:\Windows\system32\Bblnindg.exe
        214⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Bheffh32.exe
        
        C:\Windows\system32\Bheffh32.exe
        215⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Bkdcbd32.exe
        
        C:\Windows\system32\Bkdcbd32.exe
        216⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Bckkca32.exe
        
        C:\Windows\system32\Bckkca32.exe
        217⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        218⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        219⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Ccmgiaig.exe
        
        C:\Windows\system32\Ccmgiaig.exe
        220⤵
        Drops file in System32 directory
        
        PID:8164
        
        C:\Windows\SysWOW64\Cfldelik.exe
        
        C:\Windows\system32\Cfldelik.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6724
        
        C:\Windows\SysWOW64\Ccpdoqgd.exe
        
        C:\Windows\system32\Ccpdoqgd.exe
        222⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Ccbadp32.exe
        
        C:\Windows\system32\Ccbadp32.exe
        223⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Cbeapmll.exe
        
        C:\Windows\system32\Cbeapmll.exe
        224⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        225⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        226⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        227⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        228⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Dmoohe32.exe
        
        C:\Windows\system32\Dmoohe32.exe
        229⤵
        Drops file in System32 directory
        
        PID:7756
        
        C:\Windows\SysWOW64\Dkbocbog.exe
        
        C:\Windows\system32\Dkbocbog.exe
        230⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Dblgpl32.exe
        
        C:\Windows\system32\Dblgpl32.exe
        231⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Djcoai32.exe
        
        C:\Windows\system32\Djcoai32.exe
        232⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Dmalne32.exe
        
        C:\Windows\system32\Dmalne32.exe
        233⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Dkdliame.exe
        
        C:\Windows\system32\Dkdliame.exe
        234⤵
        Drops file in System32 directory
        
        PID:7188
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        235⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        236⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Dpbdopck.exe
        
        C:\Windows\system32\Dpbdopck.exe
        237⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Dflmlj32.exe
        
        C:\Windows\system32\Dflmlj32.exe
        238⤵
        Modifies registry class
        
        PID:7620
        
        C:\Windows\SysWOW64\Dikihe32.exe
        
        C:\Windows\system32\Dikihe32.exe
        239⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        240⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Dcpmen32.exe
        
        C:\Windows\system32\Dcpmen32.exe
        241⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Djjebh32.exe
        
        C:\Windows\system32\Djjebh32.exe
        242⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Dpgnjo32.exe
        
        C:\Windows\system32\Dpgnjo32.exe
        243⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        244⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Elnoopdj.exe
        
        C:\Windows\system32\Elnoopdj.exe
        245⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Ebhglj32.exe
        
        C:\Windows\system32\Ebhglj32.exe
        246⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        247⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        248⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        249⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        250⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        251⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Ebommi32.exe
        
        C:\Windows\system32\Ebommi32.exe
        252⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Eiieicml.exe
        
        C:\Windows\system32\Eiieicml.exe
        253⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Fcniglmb.exe
        
        C:\Windows\system32\Fcniglmb.exe
        254⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        255⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        256⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        257⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        258⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        259⤵
        
        PID:2124
        
        C:\Windows\SysWOW64\Gmdjapgb.exe
        
        C:\Windows\system32\Gmdjapgb.exe
        260⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Gdobnj32.exe
        
        C:\Windows\system32\Gdobnj32.exe
        261⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Gfmojenc.exe
        
        C:\Windows\system32\Gfmojenc.exe
        262⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4260
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        263⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        264⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Gingkqkd.exe
        
        C:\Windows\system32\Gingkqkd.exe
        265⤵
        
        PID:2676
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        266⤵
        Modifies registry class
        
        PID:5040
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        267⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        268⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7892
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        269⤵
        
        PID:1440
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        270⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        271⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        272⤵
        Drops file in System32 directory
        
        PID:8332
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        273⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Hienlpel.exe
        
        C:\Windows\system32\Hienlpel.exe
        274⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8412
        
        C:\Windows\SysWOW64\Hginecde.exe
        
        C:\Windows\system32\Hginecde.exe
        275⤵
        Modifies registry class
        
        PID:8464
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        276⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Hpabni32.exe
        
        C:\Windows\system32\Hpabni32.exe
        277⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        278⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        279⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        280⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8684
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        281⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        282⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        283⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        284⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Iknmla32.exe
        
        C:\Windows\system32\Iknmla32.exe
        285⤵
        Drops file in System32 directory
        
        PID:8896
        
        C:\Windows\SysWOW64\Iloidijb.exe
        
        C:\Windows\system32\Iloidijb.exe
        286⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        287⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Iciaqc32.exe
        
        C:\Windows\system32\Iciaqc32.exe
        288⤵
        Drops file in System32 directory
        
        PID:9192
        
        C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        289⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Icknfcol.exe
        
        C:\Windows\system32\Icknfcol.exe
        290⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        291⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        292⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        293⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        294⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Jnelok32.exe
        
        C:\Windows\system32\Jnelok32.exe
        295⤵
        
        PID:8632
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        296⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        297⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        298⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Jjoiil32.exe
        
        C:\Windows\system32\Jjoiil32.exe
        299⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        300⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Jlobkg32.exe
        
        C:\Windows\system32\Jlobkg32.exe
        301⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Kjccdkki.exe
        
        C:\Windows\system32\Kjccdkki.exe
        302⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        303⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        304⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        305⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        306⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        307⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        308⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Kcpahpmd.exe
        
        C:\Windows\system32\Kcpahpmd.exe
        309⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        310⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        311⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8792
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        312⤵
        Drops file in System32 directory
        
        PID:8928
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        313⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        314⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        315⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Lcggio32.exe
        
        C:\Windows\system32\Lcggio32.exe
        316⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        317⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Lkalplel.exe
        
        C:\Windows\system32\Lkalplel.exe
        318⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8604
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        319⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        320⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8944
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        321⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Lenicahg.exe
        
        C:\Windows\system32\Lenicahg.exe
        322⤵
        
        PID:8232
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        323⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        324⤵
        Modifies registry class
        
        PID:8848
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        325⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Mgobel32.exe
        
        C:\Windows\system32\Mgobel32.exe
        326⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8520
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        328⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        329⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        330⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        331⤵
        Drops file in System32 directory
        
        PID:8916
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        332⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Megljppl.exe
        
        C:\Windows\system32\Megljppl.exe
        333⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9316
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        335⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        336⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        337⤵
        Drops file in System32 directory
        
        PID:9456
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        338⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        339⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        340⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Ncabfkqo.exe
        
        C:\Windows\system32\Ncabfkqo.exe
        341⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        342⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        343⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        344⤵
        
        PID:9768
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        345⤵
        Modifies registry class
        
        PID:9812
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        346⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9856
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        347⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        348⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        349⤵
        Modifies registry class
        
        PID:9984
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        350⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        351⤵
        
        PID:10092
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        352⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        353⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Oaqbkn32.exe
        
        C:\Windows\system32\Oaqbkn32.exe
        354⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Ojigdcll.exe
        
        C:\Windows\system32\Ojigdcll.exe
        355⤵
        Drops file in System32 directory
        
        PID:9252
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        356⤵
        Drops file in System32 directory
        
        PID:9296
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        357⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        358⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        359⤵
        
        PID:9512
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        360⤵
        Modifies registry class
        
        PID:9572
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        361⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        362⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        363⤵
        Modifies registry class
        
        PID:9800
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        364⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        365⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        366⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        367⤵
        
        PID:10032
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        368⤵
        Modifies registry class
        
        PID:10104
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        369⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        370⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        371⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        372⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        373⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Alelqb32.exe
        
        C:\Windows\system32\Alelqb32.exe
        374⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Bnfihkqm.exe
        
        C:\Windows\system32\Bnfihkqm.exe
        375⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        376⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        377⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        378⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        379⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        380⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        381⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        382⤵
        
        PID:9424
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        383⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        384⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        385⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        386⤵
        
        PID:10036
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        387⤵
        Modifies registry class
        
        PID:10224
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        388⤵
        Drops file in System32 directory
        
        PID:9468
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        389⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        390⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        391⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        392⤵
        
        PID:9836
        
        C:\Windows\SysWOW64\Ddnfmqng.exe
        
        C:\Windows\system32\Ddnfmqng.exe
        393⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        394⤵
        
        PID:9524
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        395⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Eiokinbk.exe
        
        C:\Windows\system32\Eiokinbk.exe
        396⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        397⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10336
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        398⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        399⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Flmqlg32.exe
        
        C:\Windows\system32\Flmqlg32.exe
        400⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10456
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        401⤵
        
        PID:10496
        
        C:\Windows\SysWOW64\Gidnkkpc.exe
        
        C:\Windows\system32\Gidnkkpc.exe
        402⤵
        Drops file in System32 directory
        
        PID:10540
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        403⤵
        
        PID:10584
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        404⤵
        
        PID:10628
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        405⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Gflhoo32.exe
        
        C:\Windows\system32\Gflhoo32.exe
        406⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        407⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        408⤵
        Modifies registry class
        
        PID:10796
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        409⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        410⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        411⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        412⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        413⤵
        Drops file in System32 directory
        
        PID:11008
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        414⤵
        
        PID:11048
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        415⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Illfdc32.exe
        
        C:\Windows\system32\Illfdc32.exe
        416⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11128
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        417⤵
        Modifies registry class
        
        PID:11164
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        418⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        419⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11248
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        420⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10168
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        421⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10308
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        422⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Jcmdaljn.exe
        
        C:\Windows\system32\Jcmdaljn.exe
        423⤵
        
        PID:10448
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        424⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        425⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        426⤵
        
        PID:10696
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        427⤵
        Drops file in System32 directory
        
        PID:10752
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        428⤵
        Modifies registry class
        
        PID:10828
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        429⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        430⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        431⤵
        Modifies registry class
        
        PID:11044
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        432⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        433⤵
        
        PID:11188
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        434⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9608
        
        C:\Windows\SysWOW64\Kpanan32.exe
        
        C:\Windows\system32\Kpanan32.exe
        435⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        436⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        437⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        438⤵
        
        PID:10612
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        439⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        440⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10872
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        441⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        442⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11080
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        443⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        444⤵
        
        PID:10304
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        445⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        446⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        447⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Ljeafb32.exe
        
        C:\Windows\system32\Ljeafb32.exe
        448⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        449⤵
        Drops file in System32 directory
        
        PID:9656
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        450⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        451⤵
        
        PID:10808
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        452⤵
        
        PID:3660
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        453⤵
        
        PID:10364
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        454⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        455⤵
        
        PID:10960
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        456⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        457⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        458⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\Nnafno32.exe
        
        C:\Windows\system32\Nnafno32.exe
        459⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3044
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        460⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        461⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        462⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        463⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        464⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2344
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        465⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        466⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        467⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2220
        
        C:\Windows\SysWOW64\Nagiji32.exe
        
        C:\Windows\system32\Nagiji32.exe
        468⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        469⤵
        
        PID:4956
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        470⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        471⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        472⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        473⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Ofmdio32.exe
        
        C:\Windows\system32\Ofmdio32.exe
        474⤵
        Modifies registry class
        
        PID:4812
        
        C:\Windows\SysWOW64\Omgmeigd.exe
        
        C:\Windows\system32\Omgmeigd.exe
        475⤵
        Modifies registry class
        
        PID:4372
        
        C:\Windows\SysWOW64\Pjkmomfn.exe
        
        C:\Windows\system32\Pjkmomfn.exe
        476⤵
        
        PID:2664
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        477⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        478⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2816
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        479⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5060
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        480⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        481⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2304
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        482⤵
        Drops file in System32 directory
        
        PID:1976
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        483⤵
        
        PID:1100
        
        C:\Windows\SysWOW64\Pmnbfhal.exe
        
        C:\Windows\system32\Pmnbfhal.exe
        484⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        485⤵
        
        PID:11308
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        486⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        487⤵
        
        PID:11400
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        488⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        489⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11480
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        490⤵
        
        PID:11528
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        491⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11564
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        492⤵
        
        PID:11624
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        493⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        494⤵
        Drops file in System32 directory
        
        PID:11720
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        495⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        496⤵
        
        PID:11800
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        497⤵
        Drops file in System32 directory
        
        PID:11844
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        498⤵
        
        PID:11884
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        499⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11928
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        500⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        501⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        502⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Aajhndkb.exe
        
        C:\Windows\system32\Aajhndkb.exe
        503⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        504⤵
        
        PID:12168
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        505⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        506⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\Amkhmoap.exe
        
        C:\Windows\system32\Amkhmoap.exe
        155⤵
        Modifies registry class
        
        PID:7032
        
        C:\Windows\SysWOW64\Abhqefpg.exe
        
        C:\Windows\system32\Abhqefpg.exe
        156⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Afcmfe32.exe
        
        C:\Windows\system32\Afcmfe32.exe
        157⤵
        Drops file in System32 directory
        
        PID:5400
        
        C:\Windows\SysWOW64\Abjmkf32.exe
        
        C:\Windows\system32\Abjmkf32.exe
        158⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Aalmimfd.exe
        
        C:\Windows\system32\Aalmimfd.exe
        159⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Abmjqe32.exe
        
        C:\Windows\system32\Abmjqe32.exe
        160⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\Banjnm32.exe
        
        C:\Windows\system32\Banjnm32.exe
        161⤵
        Drops file in System32 directory
        
        PID:6264
        
        C:\Windows\SysWOW64\Bpqjjjjl.exe
        
        C:\Windows\system32\Bpqjjjjl.exe
        162⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\Bdlfjh32.exe
        
        C:\Windows\system32\Bdlfjh32.exe
        163⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7004
        
        C:\Windows\SysWOW64\Bfkbfd32.exe
        
        C:\Windows\system32\Bfkbfd32.exe
        164⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Bjfogbjb.exe
        
        C:\Windows\system32\Bjfogbjb.exe
        165⤵
        Modifies registry class
        
        PID:6880
        
        C:\Windows\SysWOW64\Biiobo32.exe
        
        C:\Windows\system32\Biiobo32.exe
        166⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Bapgdm32.exe
        
        C:\Windows\system32\Bapgdm32.exe
        167⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Bdocph32.exe
        
        C:\Windows\system32\Bdocph32.exe
        168⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Bbaclegm.exe
        
        C:\Windows\system32\Bbaclegm.exe
        169⤵
        Modifies registry class
        
        PID:6388
        
        C:\Windows\SysWOW64\Biklho32.exe
        
        C:\Windows\system32\Biklho32.exe
        170⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Babcil32.exe
        
        C:\Windows\system32\Babcil32.exe
        171⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        172⤵
        
        PID:3452
        
        C:\Windows\SysWOW64\Binhnomg.exe
        
        C:\Windows\system32\Binhnomg.exe
        173⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Mljmhflh.exe
        
        C:\Windows\system32\Mljmhflh.exe
        123⤵
        
        PID:6248

C:\Windows\SysWOW64\Aopemh32.exe
C:\Windows\system32\Aopemh32.exe
1⤵
PID:4968
- C:\Windows\SysWOW64\Aaoaic32.exe
  C:\Windows\system32\Aaoaic32.exe
  2⤵
  PID:11296
- - C:\Windows\SysWOW64\Apaadpng.exe
    C:\Windows\system32\Apaadpng.exe
    3⤵
    PID:11328
  - - C:\Windows\SysWOW64\Bkgeainn.exe
      C:\Windows\system32\Bkgeainn.exe
      4⤵
      PID:11412
    - - C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        5⤵
        
        PID:11456
      - C:\Windows\SysWOW64\Bdagpnbk.exe
        
        C:\Windows\system32\Bdagpnbk.exe
        6⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        7⤵
        Drops file in System32 directory
        
        PID:2888
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        8⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        9⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2296
        
        C:\Windows\SysWOW64\Bnoddcef.exe
        
        C:\Windows\system32\Bnoddcef.exe
        11⤵
        Modifies registry class
        
        PID:11796
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11880
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        13⤵
        
        PID:11920
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        14⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Caojpaij.exe
        
        C:\Windows\system32\Caojpaij.exe
        15⤵
        
        PID:5008
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        16⤵
        
        PID:5000
        
        C:\Windows\SysWOW64\Cglbhhga.exe
        
        C:\Windows\system32\Cglbhhga.exe
        17⤵
        Drops file in System32 directory
        
        PID:12104
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        18⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        19⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        20⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        21⤵
        Modifies registry class
        
        PID:12284
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        22⤵
        
        PID:11316
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        23⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\Dhbebj32.exe
        
        C:\Windows\system32\Dhbebj32.exe
        24⤵
        Modifies registry class
        
        PID:11436
        
        C:\Windows\SysWOW64\Dkcndeen.exe
        
        C:\Windows\system32\Dkcndeen.exe
        25⤵
        
        PID:11516
        
        C:\Windows\SysWOW64\Dndgfpbo.exe
        
        C:\Windows\system32\Dndgfpbo.exe
        26⤵
        
        PID:3156
        
        C:\Windows\SysWOW64\Dqbcbkab.exe
        
        C:\Windows\system32\Dqbcbkab.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11592

C:\Windows\SysWOW64\Eqgmmk32.exe
C:\Windows\system32\Eqgmmk32.exe
1⤵
PID:11768
- C:\Windows\SysWOW64\Eklajcmc.exe
  C:\Windows\system32\Eklajcmc.exe
  2⤵
  - Modifies registry class
  PID:11812
- - C:\Windows\SysWOW64\Eqiibjlj.exe
    C:\Windows\system32\Eqiibjlj.exe
    3⤵
    - Drops file in System32 directory
    PID:4316
  - - C:\Windows\SysWOW64\Ekonpckp.exe
      C:\Windows\system32\Ekonpckp.exe
      4⤵
      Modifies registry class
      PID:4016
    - - C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        5⤵
        
        PID:3040
      - C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        6⤵
        
        PID:12052
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        7⤵
        
        PID:12100
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3812
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        9⤵
        
        PID:2000
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        10⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        11⤵
        
        PID:468
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        12⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11360
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        14⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        15⤵
        
        PID:11376
        
        C:\Windows\SysWOW64\Fkhpfbce.exe
        
        C:\Windows\system32\Fkhpfbce.exe
        16⤵
        
        PID:11452

C:\Windows\SysWOW64\Ekjded32.exe
C:\Windows\system32\Ekjded32.exe
1⤵
PID:11708

C:\Windows\SysWOW64\Dglkoeio.exe
C:\Windows\system32\Dglkoeio.exe
1⤵
PID:2328

C:\Windows\SysWOW64\Fnfmbmbi.exe
C:\Windows\system32\Fnfmbmbi.exe
1⤵
PID:4664
- C:\Windows\SysWOW64\Fqeioiam.exe
  C:\Windows\system32\Fqeioiam.exe
  2⤵
  PID:11524
- - C:\Windows\SysWOW64\Feqeog32.exe
    C:\Windows\system32\Feqeog32.exe
    3⤵
    PID:4604
  - - C:\Windows\SysWOW64\Fgoakc32.exe
      C:\Windows\system32\Fgoakc32.exe
      4⤵
      PID:5388
    - - C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        5⤵
        
        PID:4248
      - C:\Windows\SysWOW64\Fganqbgg.exe
        
        C:\Windows\system32\Fganqbgg.exe
        6⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        7⤵
        Drops file in System32 directory
        
        PID:5080
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        8⤵
        
        PID:11748
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        9⤵
        Modifies registry class
        
        PID:11784
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        10⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        11⤵
        Modifies registry class
        
        PID:11956

C:\Windows\SysWOW64\Gbnhoj32.exe
C:\Windows\system32\Gbnhoj32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:11964
- C:\Windows\SysWOW64\Ggkqgaol.exe
  C:\Windows\system32\Ggkqgaol.exe
  2⤵
  PID:2040
- - C:\Windows\SysWOW64\Gndick32.exe
    C:\Windows\system32\Gndick32.exe
    3⤵
    PID:1016
  - - C:\Windows\SysWOW64\Gacepg32.exe
      C:\Windows\system32\Gacepg32.exe
      4⤵
      PID:12252
    - - C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        5⤵
        
        PID:4232
      - C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4676
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        7⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\Gbbajjlp.exe
        
        C:\Windows\system32\Gbbajjlp.exe
        8⤵
        
        PID:2904
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        9⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\Hpfbcn32.exe
        
        C:\Windows\system32\Hpfbcn32.exe
        10⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        11⤵
        Modifies registry class
        
        PID:11464
        
        C:\Windows\SysWOW64\Hahokfag.exe
        
        C:\Windows\system32\Hahokfag.exe
        12⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        13⤵
        
        PID:11620
        
        C:\Windows\SysWOW64\Hhaggp32.exe
        
        C:\Windows\system32\Hhaggp32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5648
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        15⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        16⤵
        
        PID:10620
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        17⤵
        Modifies registry class
        
        PID:5516
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        18⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        19⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11936
        
        C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        21⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Hifmmb32.exe
        
        C:\Windows\system32\Hifmmb32.exe
        22⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5084
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        24⤵
        Drops file in System32 directory
        
        PID:3816
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        25⤵
        
        PID:2724
        
        C:\Windows\SysWOW64\Ilfennic.exe
        
        C:\Windows\system32\Ilfennic.exe
        26⤵
        Modifies registry class
        
        PID:11340
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        27⤵
        
        PID:11380
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        28⤵
        Modifies registry class
        
        PID:1252
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4852
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        30⤵
        
        PID:5024
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        31⤵
        
        PID:396
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        32⤵
        
        PID:1180
        
        C:\Windows\SysWOW64\Ibgdlg32.exe
        
        C:\Windows\system32\Ibgdlg32.exe
        33⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        34⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        35⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        36⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Iamamcop.exe
        
        C:\Windows\system32\Iamamcop.exe
        37⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        38⤵
        
        PID:12268
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2644
        
        C:\Windows\SysWOW64\Jifecp32.exe
        
        C:\Windows\system32\Jifecp32.exe
        40⤵
        Modifies registry class
        
        PID:5940
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        41⤵
        Modifies registry class
        
        PID:11468
        
        C:\Windows\SysWOW64\Jihbip32.exe
        
        C:\Windows\system32\Jihbip32.exe
        42⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        43⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\Jpgdai32.exe
        
        C:\Windows\system32\Jpgdai32.exe
        44⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        45⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5736
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        47⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Kakmna32.exe
        
        C:\Windows\system32\Kakmna32.exe
        48⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        49⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Khgbqkhj.exe
        
        C:\Windows\system32\Khgbqkhj.exe
        50⤵
        
        PID:5912

C:\Windows\SysWOW64\Koajmepf.exe
C:\Windows\system32\Koajmepf.exe
1⤵
PID:2764
- C:\Windows\SysWOW64\Kcoccc32.exe
  C:\Windows\system32\Kcoccc32.exe
  2⤵
  PID:5996
- - C:\Windows\SysWOW64\Kofdhd32.exe
    C:\Windows\system32\Kofdhd32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:4600
  - - C:\Windows\SysWOW64\Lljdai32.exe
      C:\Windows\system32\Lljdai32.exe
      4⤵
      Drops file in System32 directory
      PID:6068
    - - C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        5⤵
        
        PID:5608
      - C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        6⤵
        
        PID:1892
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        7⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        8⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        9⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        10⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        11⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Lcmodajm.exe
        
        C:\Windows\system32\Lcmodajm.exe
        12⤵
        
        PID:12164
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        13⤵
        
        PID:5772

C:\Windows\SysWOW64\Mbgeqmjp.exe
C:\Windows\system32\Mbgeqmjp.exe
1⤵
PID:1448
- C:\Windows\SysWOW64\Mhanngbl.exe
  C:\Windows\system32\Mhanngbl.exe
  2⤵
  PID:6052
- - C:\Windows\SysWOW64\Mqhfoebo.exe
    C:\Windows\system32\Mqhfoebo.exe
    3⤵
    PID:3260
  - - C:\Windows\SysWOW64\Mokfja32.exe
      C:\Windows\system32\Mokfja32.exe
      4⤵
      PID:5468
    - - C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        5⤵
        
        PID:2156
      - C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        6⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        7⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Njbgmjgl.exe
        
        C:\Windows\system32\Njbgmjgl.exe
        8⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6104
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        10⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        11⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        12⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        13⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        14⤵
        Modifies registry class
        
        PID:6420
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        15⤵
        Modifies registry class
        
        PID:5896
        
        C:\Windows\SysWOW64\Nfqnbjfi.exe
        
        C:\Windows\system32\Nfqnbjfi.exe
        16⤵
        Drops file in System32 directory
        
        PID:2932
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        17⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Nmjfodne.exe
        
        C:\Windows\system32\Nmjfodne.exe
        18⤵
        
        PID:3748
        
        C:\Windows\SysWOW64\Nqfbpb32.exe
        
        C:\Windows\system32\Nqfbpb32.exe
        19⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        20⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5404
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        22⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        23⤵
        Drops file in System32 directory
        
        PID:6124
        
        C:\Windows\SysWOW64\Omdieb32.exe
        
        C:\Windows\system32\Omdieb32.exe
        24⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        25⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        26⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Ppdbgncl.exe
        
        C:\Windows\system32\Ppdbgncl.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5288
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        28⤵
        
        PID:3640
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        29⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        30⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        31⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Pbjddh32.exe
        
        C:\Windows\system32\Pbjddh32.exe
        32⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Pjaleemj.exe
        
        C:\Windows\system32\Pjaleemj.exe
        33⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        34⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Qamago32.exe
        
        C:\Windows\system32\Qamago32.exe
        35⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Qpbnhl32.exe
        
        C:\Windows\system32\Qpbnhl32.exe
        36⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Qbajeg32.exe
        
        C:\Windows\system32\Qbajeg32.exe
        37⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Acqgojmb.exe
        
        C:\Windows\system32\Acqgojmb.exe
        38⤵
        Drops file in System32 directory
        
        PID:6772
        
        C:\Windows\SysWOW64\Ajjokd32.exe
        
        C:\Windows\system32\Ajjokd32.exe
        39⤵
        Drops file in System32 directory
        
        PID:6976
        
        C:\Windows\SysWOW64\Aimogakj.exe
        
        C:\Windows\system32\Aimogakj.exe
        40⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Amikgpcc.exe
        
        C:\Windows\system32\Amikgpcc.exe
        41⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Abfdpfaj.exe
        
        C:\Windows\system32\Abfdpfaj.exe
        42⤵
        
        PID:6872

C:\Windows\SysWOW64\Mbdiknlb.exe
C:\Windows\system32\Mbdiknlb.exe
1⤵
PID:5460

C:\Windows\SysWOW64\Bphqji32.exe
C:\Windows\system32\Bphqji32.exe
1⤵
- Drops file in System32 directory
PID:6580
- C:\Windows\SysWOW64\Bdcmkgmm.exe
  C:\Windows\system32\Bdcmkgmm.exe
  2⤵
  PID:7288
- - C:\Windows\SysWOW64\Bgdemb32.exe
    C:\Windows\system32\Bgdemb32.exe
    3⤵
    PID:6672
  - - C:\Windows\SysWOW64\Cgfbbb32.exe
      C:\Windows\system32\Cgfbbb32.exe
      4⤵
      PID:6804
    - - C:\Windows\SysWOW64\Cienon32.exe
        
        C:\Windows\system32\Cienon32.exe
        5⤵
        
        PID:7452
      - C:\Windows\SysWOW64\Cgiohbfi.exe
        
        C:\Windows\system32\Cgiohbfi.exe
        6⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Cdmoafdb.exe
        
        C:\Windows\system32\Cdmoafdb.exe
        7⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Cgklmacf.exe
        
        C:\Windows\system32\Cgklmacf.exe
        8⤵
        
        PID:12240
        
        C:\Windows\SysWOW64\Ciihjmcj.exe
        
        C:\Windows\system32\Ciihjmcj.exe
        9⤵
        Modifies registry class
        
        PID:6508
        
        C:\Windows\SysWOW64\Cmedjl32.exe
        
        C:\Windows\system32\Cmedjl32.exe
        10⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Ckidcpjl.exe
        
        C:\Windows\system32\Ckidcpjl.exe
        11⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Daeifj32.exe
        
        C:\Windows\system32\Daeifj32.exe
        12⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Dphiaffa.exe
        
        C:\Windows\system32\Dphiaffa.exe
        13⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Dgbanq32.exe
        
        C:\Windows\system32\Dgbanq32.exe
        14⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Dkpjdo32.exe
        
        C:\Windows\system32\Dkpjdo32.exe
        15⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Dajbaika.exe
        
        C:\Windows\system32\Dajbaika.exe
        16⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Dggkipii.exe
        
        C:\Windows\system32\Dggkipii.exe
        17⤵
        Drops file in System32 directory
        
        PID:7348
        
        C:\Windows\SysWOW64\Dalofi32.exe
        
        C:\Windows\system32\Dalofi32.exe
        18⤵
        Drops file in System32 directory
        
        PID:6664
        
        C:\Windows\SysWOW64\Dncpkjoc.exe
        
        C:\Windows\system32\Dncpkjoc.exe
        19⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Ddmhhd32.exe
        
        C:\Windows\system32\Ddmhhd32.exe
        20⤵
        
        PID:6856

C:\Windows\SysWOW64\Ecdbop32.exe
C:\Windows\system32\Ecdbop32.exe
1⤵
- Drops file in System32 directory
PID:7412
- C:\Windows\SysWOW64\Ejojljqa.exe
  C:\Windows\system32\Ejojljqa.exe
  2⤵
  PID:5800
- - C:\Windows\SysWOW64\Ekngemhd.exe
    C:\Windows\system32\Ekngemhd.exe
    3⤵
    PID:6984
  - - C:\Windows\SysWOW64\Enlcahgh.exe
      C:\Windows\system32\Enlcahgh.exe
      4⤵
      PID:6556
    - - C:\Windows\SysWOW64\Fclhpo32.exe
        
        C:\Windows\system32\Fclhpo32.exe
        5⤵
        
        PID:8168
      - C:\Windows\SysWOW64\Fkcpql32.exe
        
        C:\Windows\system32\Fkcpql32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8028

C:\Windows\SysWOW64\Epdime32.exe
C:\Windows\system32\Epdime32.exe
1⤵
PID:7272

C:\Windows\SysWOW64\Famhmfkl.exe
C:\Windows\system32\Famhmfkl.exe
1⤵
PID:6368
- C:\Windows\SysWOW64\Fdkdibjp.exe
  C:\Windows\system32\Fdkdibjp.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:6592
- - C:\Windows\SysWOW64\Fdmaoahm.exe
    C:\Windows\system32\Fdmaoahm.exe
    3⤵
    PID:4412
  - - C:\Windows\SysWOW64\Fkgillpj.exe
      C:\Windows\system32\Fkgillpj.exe
      4⤵
      PID:6920
    - - C:\Windows\SysWOW64\Fjjjgh32.exe
        
        C:\Windows\system32\Fjjjgh32.exe
        5⤵
        
        PID:7588
      - C:\Windows\SysWOW64\Fnffhgon.exe
        
        C:\Windows\system32\Fnffhgon.exe
        6⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Fqdbdbna.exe
        
        C:\Windows\system32\Fqdbdbna.exe
        7⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Fbdnne32.exe
        
        C:\Windows\system32\Fbdnne32.exe
        8⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Fjocbhbo.exe
        
        C:\Windows\system32\Fjocbhbo.exe
        9⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Fbfkceca.exe
        
        C:\Windows\system32\Fbfkceca.exe
        10⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Fqikob32.exe
        
        C:\Windows\system32\Fqikob32.exe
        11⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Gjaphgpl.exe
        
        C:\Windows\system32\Gjaphgpl.exe
        12⤵
        Modifies registry class
        
        PID:7600
        
        C:\Windows\SysWOW64\Gnmlhf32.exe
        
        C:\Windows\system32\Gnmlhf32.exe
        13⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Gqkhda32.exe
        
        C:\Windows\system32\Gqkhda32.exe
        14⤵
        Drops file in System32 directory
        
        PID:7260
        
        C:\Windows\SysWOW64\Gnohnffc.exe
        
        C:\Windows\system32\Gnohnffc.exe
        15⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Gbkdod32.exe
        
        C:\Windows\system32\Gbkdod32.exe
        16⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Gqnejaff.exe
        
        C:\Windows\system32\Gqnejaff.exe
        17⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Gggmgk32.exe
        
        C:\Windows\system32\Gggmgk32.exe
        18⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\Gbmadd32.exe
        
        C:\Windows\system32\Gbmadd32.exe
        19⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7872 -s 408
        20⤵
        Program crash
        
        PID:7908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 7872 -ip 7872
1⤵
PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Ahpmjejp.exe

Filesize
64KB

MD5
a5c329890be2aec603e04fc8eec167e3

SHA1
5831401d4bceb6d0bee30838b4e42798dfb0b78a

SHA256
519c7eb8d5892c0d261d70b7be37fce40bffc044eabe0f5c81250dbe5a7034fd

SHA512
72a3934f35e08669c40aed90c2d9571e6537d980317812aaa89ffcbac07835ba2077e3a7678b5ca5d650d9a7383ab4b6c326e35b95bd6b0fcb6ef395bd35b7aa

Download Submit
C:\Windows\SysWOW64\Bjaqpbkh.exe

Filesize
64KB

MD5
ff8668056dfa11ffbc1449934f7c77f6

SHA1
c2f5ccfb57fd17219f2e8d2cd49f52b9325661da

SHA256
464f649720554a6c252ed532d279790729ade38b32a1b46322370fffdc166bb9

SHA512
7813a123f13bc893e5e8e910478c2849ab311c1cadf6f34018408434323fd478348fe31ca00a0603f3c26e2351e830c037e128ab544b5527d98aef965f0751f9

Download Submit
C:\Windows\SysWOW64\Cmjemflb.exe

Filesize
64KB

MD5
1f3612adc5db1a74ed90a8247a52e512

SHA1
fc161ad4fded3e3fa0f36d6fe435a87dbeac724f

SHA256
b0ce5e564b67088f424d9e92115b6be6e9b38af9c3fc60ce0193f17a04f6797e

SHA512
d771dc5de9b9d0eee7f64d1bfb131c32f547cb6a7a96911acf45d5ed2824d5f91fe9e58a39e7b04e3be77df6e91ed539a8c7d65ef34ace67ae42ce92e0590eb8

Download Submit
C:\Windows\SysWOW64\Dbkqfe32.exe

Filesize
64KB

MD5
21af73805d9189de0f3073e704eb3eea

SHA1
39e95e6567b4dcd0cd2a02337555be6839261416

SHA256
c5bf5fdb6b7e9490f64f1dcf8d0991ab4db2b34fae41200b54d289f33473d186

SHA512
601dba4614d3879a100a24acaabc59bad06d6eb5bbd58580c40df3a1bc57cf61344270d5271aa1f55e19e44fdfca6fe361d0126a663552e2601a6dec7b3436ca

Download Submit
C:\Windows\SysWOW64\Ebhglj32.exe

Filesize
64KB

MD5
a2fbe7ccfbb1b5f5f8a82d1170444b88

SHA1
9f62af903d2ed06b7c5f0888dc8c2bc322380579

SHA256
4517bd8e0a4c6336b1923cb28450321a3a692fa8f95bba1ea77ee5fd6b243d16

SHA512
02d25dc2438cd8e8ca36ce275b04b5c83a214c307b5a14832542691b6faccf260a74ef61423e0961b055612cb23006806d3f7fb13a1013365272adb4e2007c59

Download Submit
C:\Windows\SysWOW64\Eigonjcj.exe

Filesize
64KB

MD5
72a5ae1bd785e2c82ffed54fe325dd9b

SHA1
7c919cb84371a6dd47c702f59f898dbd193d9340

SHA256
7f4127069933c45688d5dab5d78faa713b67ef205e28e46c960549c063b18aaa

SHA512
1cd22210fa34f3545455b14d7f62a3870e16f490022cd2273795764584a31523ddb22f6db29941945a9c3189202131cf914d0333e03d937e14157940066527b7

Download Submit
C:\Windows\SysWOW64\Eiokinbk.exe

Filesize
64KB

MD5
047399000889710d25728e123e120faa

SHA1
e0142876b3137caf3c22b06731d06297b88916bd

SHA256
64a3ab53c49e91c12de644b4725ae081d352a3c51215a25df65004ce096bd8df

SHA512
50ddd2cb9560a6acc50e00ec39ad07cb45b48abfebe7e585b13e3342278d20fb21827b84026410da71df3a5cde6d5ec834684bd8cd01adae2bde0496eb3302e1

Download Submit
C:\Windows\SysWOW64\Emanjldl.exe

Filesize
64KB

MD5
346d602a8348d1f4cb9a6525b447550e

SHA1
bfb5ffcb9f0b0cab927854d22a7e8631f9d02b10

SHA256
4016cdf10eec6d9ac639d20c31aacc51d5e37182c7cb1047e36765c9ec96cf23

SHA512
4c2733d69be94e96f8251bd24403c97954a6eeb3a29faaf3af8f5bc0e5d44fae731ee6fbff5600e0910baa83cd00f0180cd149cc74d23ccfe5e7c161bbd5e287

Download Submit
C:\Windows\SysWOW64\Flmqlg32.exe

Filesize
64KB

MD5
dd0f4883fc6b58ade844fee0004eb582

SHA1
0ac004cb03715f18842ffb4f5d874a6ad90a1982

SHA256
b55f596e73185f29ac06b9f46f0450dc435beaff23c54b3cde43c7abfb6f13c4

SHA512
93b09af2242cdbea01477e3a3d0daecac244acaef97747af8c28efeaaba234fd4311e59a25f0043ffe97556d8360c3c5fcdb640447cd2ed0993d012cfa31857d

Download Submit
C:\Windows\SysWOW64\Fpodlbng.exe

Filesize
64KB

MD5
a3296d4e5ac73326560bc1f5e5a36df1

SHA1
7cbcc17333183e22aaa5aea39622d0c7c4081f43

SHA256
c5c4f7233a431b3319703075d6274daa5a56c2d8aba5d796dce0c9e78e8e6c82

SHA512
1aff6b3fd791c9a81de3da31e687b5a39e9371086fea0c40e573931f1da547cf4ecb24eb978625f01b989db7be3b66047f377f4e0e375a010e5af6c84072ad5f

Download Submit
C:\Windows\SysWOW64\Geohklaa.exe

Filesize
64KB

MD5
be37b07591b401a5b42fb9eb3c38b384

SHA1
015fb8958d0dc5ea003a86b79246ec1589ffe26f

SHA256
c8634750b91c6b4ad0d2ade03426e70a9018382ee0573f7eaa4566aa32a31ba1

SHA512
81bac672393fbc7dee7b34ef26a958dc9bca2555bebba48e58e48d984108c3c079b1ea2bfad0f885b612983be570347941498035016878786787d1966b73cfe3

Download Submit
C:\Windows\SysWOW64\Gidnkkpc.exe

Filesize
64KB

MD5
21f3d79face37d62497fb83b935bfd0b

SHA1
c483cc12f93492cdfa21f64d1cd4ba28c0b44af1

SHA256
2f828c5ab2b02f0dd6ac8caf1f43345af212bd6534e4fcbd777add2c3b5888db

SHA512
88ecd44472b8a9620ec3dbf88e551042770b0838d7072f8cebebf8d6f79a1a04e35b8d18940adab9556a158ced537100f9fb158adaddb202f7e0b7e1dbd1b739

Download Submit
C:\Windows\SysWOW64\Gihgfk32.exe

Filesize
64KB

MD5
156e86209854e9fcb09cc3f6258d70c1

SHA1
8c7eedbbb0e609d0ad3e8dcdbc9beaff402df547

SHA256
0d68cacea04d65baa33a81a725429455a20ecce9b4909ae87e240df43ed51b8f

SHA512
25eaeb4b33bc1ad4b63af31a0d7f7aa0b8363b63a044ada269a476db436c9c6fd58fe4d5bb04fec94da1a87d1a092e731ac65519e3580a1eb4a3c1a941a0d79a

Download Submit
C:\Windows\SysWOW64\Hlpfhe32.exe

Filesize
64KB

MD5
64515634121b43b5c77a2376d225a21c

SHA1
8a2e47b51f6787da7492276aeaa6025c28bc321e

SHA256
aab059446930049653850a79d4dd440afe272c7f3aaa80ee6834d925efbbafe2

SHA512
455ce29f4fba903be6264bf77b9593068d712c74e52aceecfe5e4b07833a828f933c22b6995c7f45adf61bac610397d0110c8fef2021f25f0ec01d8ed8c7f12e

Download Submit
C:\Windows\SysWOW64\Hpchib32.exe

Filesize
64KB

MD5
840a7e9f1bca73315d5954319ec3c8fb

SHA1
11f4f9a31d216339a0bdb163c87804630095b4e7

SHA256
bde7b8f4d42dc0688676ada4fd6b845e632b5d3316787d0b14bdcec8cf345003

SHA512
e66fc482069a6e3b00083d3a1a35b02807defdfcd5776fd535012e5f2797e4461cabf05a1456d9eadfe3921ee388ecd1480f27bacb3431143fe52dbd036c2097

Download Submit
C:\Windows\SysWOW64\Ickglm32.exe

Filesize
64KB

MD5
12342610858f0cd9a9f25665145eec5e

SHA1
312e13363ae720fe392afee7d1e02df1fd6ef6e1

SHA256
5675fa3d991304811f83d3f7f3fe5cb9a9ca5ebe8092282c23c15951d09f3c0b

SHA512
4aeff1a8f69cb0bca158f9f2514bde32c74a395b56fe9901285e69325e1b659e3ce81ea81f251aee1d7b99ca9841d2ceea4ad5827ab7cf8f9903bf4458f67b15

Download Submit
C:\Windows\SysWOW64\Leoghn32.exe

Filesize
64KB

MD5
bd0715e2d05b462c0b35071fd5e9894a

SHA1
ebdc763cebbaddf24928244fb82cb83ac5570cec

SHA256
b30f780fee047a6608fb1b4d79d5db54af83bc95363f5581b8e56408cf54b238

SHA512
128c8e8dcb09d4c9e17762e05f6f8a41fcc10de86a5be54400aeb85fb43e76e5645faa8957293b299550ce8b2a984205c90b876313ca8dee42dd0ce0b0d2c01e

Download Submit
C:\Windows\SysWOW64\Leoghn32.exe

Filesize
64KB

MD5
bd0715e2d05b462c0b35071fd5e9894a

SHA1
ebdc763cebbaddf24928244fb82cb83ac5570cec

SHA256
b30f780fee047a6608fb1b4d79d5db54af83bc95363f5581b8e56408cf54b238

SHA512
128c8e8dcb09d4c9e17762e05f6f8a41fcc10de86a5be54400aeb85fb43e76e5645faa8957293b299550ce8b2a984205c90b876313ca8dee42dd0ce0b0d2c01e

Download Submit
C:\Windows\SysWOW64\Lkalplel.exe

Filesize
64KB

MD5
6a939e30af6b96e0dde67e00b83cc4d0

SHA1
62127f5c09d06ce2be4bcc3d5fcb37a6bff2929a

SHA256
e9d5969ea30674460cbfcfb49a1344a755749b6dfc3f54de2bd65696fcdb7cc5

SHA512
1933dc578bba33ea05bf595c84fe13b6e8326c58f42867730f7b06de5ebdbe059e1e3d21c8722541525cb56a2799e12dc1a363af1f6bb716d45ec604a2bd9708

Download Submit
C:\Windows\SysWOW64\Llgcph32.exe

Filesize
64KB

MD5
4548110e90e14310d566129011dbf493

SHA1
b105280fc7b0a5aa06466d30a30afc5fd24c4ac6

SHA256
f68f3d803599ad0c4bc97918b523cfe4832587dd7b6d05f730ff05b74c7f6bd1

SHA512
5775a78fc33bb99a312b7f80295c51292052f6c1b1c29af81c8ffa80b083801880ac228aedf2bbba4b35a6244499cddb3a21cc296034efb9e5807f9791778c22

Download Submit
C:\Windows\SysWOW64\Llgcph32.exe

Filesize
64KB

MD5
4548110e90e14310d566129011dbf493

SHA1
b105280fc7b0a5aa06466d30a30afc5fd24c4ac6

SHA256
f68f3d803599ad0c4bc97918b523cfe4832587dd7b6d05f730ff05b74c7f6bd1

SHA512
5775a78fc33bb99a312b7f80295c51292052f6c1b1c29af81c8ffa80b083801880ac228aedf2bbba4b35a6244499cddb3a21cc296034efb9e5807f9791778c22

Download Submit
C:\Windows\SysWOW64\Lpekef32.exe

Filesize
64KB

MD5
c9676424f330371944cec8b171988cfe

SHA1
820f6ac47f3b29e5d814fb418af957c80996ea4b

SHA256
2cb0b002c3ff85c3713586db4888e4c492efeffb9f25740b420023f2123e86e1

SHA512
0c5f2ef708e7c6981af1f8193749f5fae721c534c3994a59dbf4e71bd4013d8b40fe1599959b43e884920430443226bdb79478adbeb85569afb1742d1c918ce1

Download Submit
C:\Windows\SysWOW64\Lpekef32.exe

Filesize
64KB

MD5
c9676424f330371944cec8b171988cfe

SHA1
820f6ac47f3b29e5d814fb418af957c80996ea4b

SHA256
2cb0b002c3ff85c3713586db4888e4c492efeffb9f25740b420023f2123e86e1

SHA512
0c5f2ef708e7c6981af1f8193749f5fae721c534c3994a59dbf4e71bd4013d8b40fe1599959b43e884920430443226bdb79478adbeb85569afb1742d1c918ce1

Download Submit
C:\Windows\SysWOW64\Medqcmki.exe

Filesize
64KB

MD5
ad25f644d8a7528096b23cc3f82c8651

SHA1
bc9700715205c49a09069ae240e2a4db8229f052

SHA256
43db56e446d8227f8a2038572b1c0f471d16fda549ec66a8b4fa4f1cd81305b6

SHA512
77616aca1be28ea5cfc2f71d0cb6cf695a68cbdfa5971f511e1f4d3425d6325c41142f4d5b62e3f2c274f5654f568691cab4b782b0f69994bfee61245bf7bab8

Download Submit
C:\Windows\SysWOW64\Medqcmki.exe

Filesize
64KB

MD5
ad25f644d8a7528096b23cc3f82c8651

SHA1
bc9700715205c49a09069ae240e2a4db8229f052

SHA256
43db56e446d8227f8a2038572b1c0f471d16fda549ec66a8b4fa4f1cd81305b6

SHA512
77616aca1be28ea5cfc2f71d0cb6cf695a68cbdfa5971f511e1f4d3425d6325c41142f4d5b62e3f2c274f5654f568691cab4b782b0f69994bfee61245bf7bab8

Download Submit
C:\Windows\SysWOW64\Mehjol32.exe

Filesize
64KB

MD5
f900a4237306abb33897d8e0879600f4

SHA1
26e69450cc30fe4a9766cd7a0039e8f91a685882

SHA256
4b9287023f9416048fe30fa51d67247b7c8bdfc35ac6e6e9b4874437168f604a

SHA512
632aab7f07935e052123a442dca5c412fcd4a93047c1865897ccc4f4a830ffd83c169b188fcc20180177611e79e40279ece906faf289f4c9ac10803139d92081

Download Submit
C:\Windows\SysWOW64\Mehjol32.exe

Filesize
64KB

MD5
f900a4237306abb33897d8e0879600f4

SHA1
26e69450cc30fe4a9766cd7a0039e8f91a685882

SHA256
4b9287023f9416048fe30fa51d67247b7c8bdfc35ac6e6e9b4874437168f604a

SHA512
632aab7f07935e052123a442dca5c412fcd4a93047c1865897ccc4f4a830ffd83c169b188fcc20180177611e79e40279ece906faf289f4c9ac10803139d92081

Download Submit
C:\Windows\SysWOW64\Mekgdl32.exe

Filesize
64KB

MD5
7972a0ec41db4f4ed4862d70519457f2

SHA1
80470885c2105e0c507b424587b989af8712e96f

SHA256
ace244258cf8c49bbde75eb7a904f63b6b1a8b7a0cbb9b1c98fc6dd322354d67

SHA512
c916a9b7f4ba6602109f442baa63e7ffec55ae31e85ab85f4f9bf3a3dd9d6a623df59cfeccaf75e707c339b0affc6d589eb51fa8f5592b91a3dcc6f0e897e108

Download Submit
C:\Windows\SysWOW64\Mekgdl32.exe

Filesize
64KB

MD5
7972a0ec41db4f4ed4862d70519457f2

SHA1
80470885c2105e0c507b424587b989af8712e96f

SHA256
ace244258cf8c49bbde75eb7a904f63b6b1a8b7a0cbb9b1c98fc6dd322354d67

SHA512
c916a9b7f4ba6602109f442baa63e7ffec55ae31e85ab85f4f9bf3a3dd9d6a623df59cfeccaf75e707c339b0affc6d589eb51fa8f5592b91a3dcc6f0e897e108

Download Submit
C:\Windows\SysWOW64\Mhbmphjm.exe

Filesize
64KB

MD5
488cbc77a9b9aed9cc1d628657d0fbfe

SHA1
d39de97f5fd52f65598c3bffee7394233ac6b08c

SHA256
86205e4b892bd641a129e507a42e4fc61f9c3ffbffe473126d9f70922175b292

SHA512
a1e76655b805d587ac4c63ca34a1a5d0e3915c0033f9f88525d8704f90b993bfb73d35cd3bc998d571cbc00da9ce4059e1a1ec9a691f44281296e33784a0edaa

Download Submit
C:\Windows\SysWOW64\Mhbmphjm.exe

Filesize
64KB

MD5
488cbc77a9b9aed9cc1d628657d0fbfe

SHA1
d39de97f5fd52f65598c3bffee7394233ac6b08c

SHA256
86205e4b892bd641a129e507a42e4fc61f9c3ffbffe473126d9f70922175b292

SHA512
a1e76655b805d587ac4c63ca34a1a5d0e3915c0033f9f88525d8704f90b993bfb73d35cd3bc998d571cbc00da9ce4059e1a1ec9a691f44281296e33784a0edaa

Download Submit
C:\Windows\SysWOW64\Mhppji32.exe

Filesize
64KB

MD5
c9676424f330371944cec8b171988cfe

SHA1
820f6ac47f3b29e5d814fb418af957c80996ea4b

SHA256
2cb0b002c3ff85c3713586db4888e4c492efeffb9f25740b420023f2123e86e1

SHA512
0c5f2ef708e7c6981af1f8193749f5fae721c534c3994a59dbf4e71bd4013d8b40fe1599959b43e884920430443226bdb79478adbeb85569afb1742d1c918ce1

Download Submit
C:\Windows\SysWOW64\Mhppji32.exe

Filesize
64KB

MD5
f657b7a7853bbef7fb29692cd8599d10

SHA1
3bdadd520689bda5e675c140d7e1610b4e2f33ee

SHA256
bac62064b52289a9f9fc0d87250368c4a1b73c3b54e3b18a68f04c3497cce756

SHA512
b42fa5ec4b9b1e0ac228c61d3f397cfdf787fa3ecd802ebdf7bae1c301c988b3776d30f336d08c36fe4c3dd1fca02e3885307d058a0b82b1ade2e15cff5b1caf

Download Submit
C:\Windows\SysWOW64\Mhppji32.exe

Filesize
64KB

MD5
f657b7a7853bbef7fb29692cd8599d10

SHA1
3bdadd520689bda5e675c140d7e1610b4e2f33ee

SHA256
bac62064b52289a9f9fc0d87250368c4a1b73c3b54e3b18a68f04c3497cce756

SHA512
b42fa5ec4b9b1e0ac228c61d3f397cfdf787fa3ecd802ebdf7bae1c301c988b3776d30f336d08c36fe4c3dd1fca02e3885307d058a0b82b1ade2e15cff5b1caf

Download Submit
C:\Windows\SysWOW64\Mplafeil.exe

Filesize
64KB

MD5
891c035589c53c7c631f08800f966cd6

SHA1
c6a7a21c0de8ce677846e1d7ade39b79ca4815cb

SHA256
4082e9f5f5cfd52b5971fdc97026690c7a388404d3555177c65f2ddfc6389ed1

SHA512
ee6921202527477433334220470157ed8488a0d77d7365abb308b1941cba3310b415727d5eac871f61264e3d8a7cb35397c5b8db5f955e6b55957a7b52863484

Download Submit
C:\Windows\SysWOW64\Mplafeil.exe

Filesize
64KB

MD5
891c035589c53c7c631f08800f966cd6

SHA1
c6a7a21c0de8ce677846e1d7ade39b79ca4815cb

SHA256
4082e9f5f5cfd52b5971fdc97026690c7a388404d3555177c65f2ddfc6389ed1

SHA512
ee6921202527477433334220470157ed8488a0d77d7365abb308b1941cba3310b415727d5eac871f61264e3d8a7cb35397c5b8db5f955e6b55957a7b52863484

Download Submit
C:\Windows\SysWOW64\Mpnnle32.exe

Filesize
64KB

MD5
c0af4b2536ed0f971d361d68cad34eb4

SHA1
1cb2c7bb5cbfb53c3db8921aa704266b0573d52b

SHA256
87d42d9faef2245e13916c08ac17b32f33be9872d3c25e3fc69331f9fa9607c7

SHA512
02c89ac4bbb57f4103f2dbdefcec311cf45b39324c421fcc7f75aacd21d1452676e00e512e75d917d55175b7d11ef527b75896f62facfbe5d107edb7110b8442

Download Submit
C:\Windows\SysWOW64\Mpnnle32.exe

Filesize
64KB

MD5
c0af4b2536ed0f971d361d68cad34eb4

SHA1
1cb2c7bb5cbfb53c3db8921aa704266b0573d52b

SHA256
87d42d9faef2245e13916c08ac17b32f33be9872d3c25e3fc69331f9fa9607c7

SHA512
02c89ac4bbb57f4103f2dbdefcec311cf45b39324c421fcc7f75aacd21d1452676e00e512e75d917d55175b7d11ef527b75896f62facfbe5d107edb7110b8442

Download Submit
C:\Windows\SysWOW64\Nbadcpbh.exe

Filesize
64KB

MD5
3b52b72996308ede7273efa37c5af496

SHA1
5fbc2054094489be265bad1485501583ca2b425c

SHA256
f9b8b4d943e686bc13419c56248300fb33bdc5f04107c4a08d38ed33afee7433

SHA512
a1633fb9d29d1ca9335de8cf5bb137c84e199fc2777922b623aac4be89b7ac53d34a15981048fbffdb912559d2d2cb4f8652d4fd627ae63f5b787ac32068669d

Download Submit
C:\Windows\SysWOW64\Nbadcpbh.exe

Filesize
64KB

MD5
3b52b72996308ede7273efa37c5af496

SHA1
5fbc2054094489be265bad1485501583ca2b425c

SHA256
f9b8b4d943e686bc13419c56248300fb33bdc5f04107c4a08d38ed33afee7433

SHA512
a1633fb9d29d1ca9335de8cf5bb137c84e199fc2777922b623aac4be89b7ac53d34a15981048fbffdb912559d2d2cb4f8652d4fd627ae63f5b787ac32068669d

Download Submit
C:\Windows\SysWOW64\Ncjginjn.exe

Filesize
64KB

MD5
cb4db8aa8921ffd0262ba066c753f7fd

SHA1
c04d532563b2192277cc9283cfc94f026a3110e7

SHA256
17721e774c6543f9c82f77f27d4ca837fc166fb199081470683074262f9124c9

SHA512
71ba93c030934ce3dc2526f4b6a587c38cd47bfbb7b568f3bb14daa462fa26a79dd799abafab9b554b80da801b9c46c89d666616a9893da1bfd2f83ca9ee8ac4

Download Submit
C:\Windows\SysWOW64\Ncjginjn.exe

Filesize
64KB

MD5
cb4db8aa8921ffd0262ba066c753f7fd

SHA1
c04d532563b2192277cc9283cfc94f026a3110e7

SHA256
17721e774c6543f9c82f77f27d4ca837fc166fb199081470683074262f9124c9

SHA512
71ba93c030934ce3dc2526f4b6a587c38cd47bfbb7b568f3bb14daa462fa26a79dd799abafab9b554b80da801b9c46c89d666616a9893da1bfd2f83ca9ee8ac4

Download Submit
C:\Windows\SysWOW64\Nebmekoi.exe

Filesize
64KB

MD5
d2b574705b8dfa2f73457d296a8872cc

SHA1
9d97b6ec5f269778ddc7e14f545263605f6fbf7f

SHA256
f3dffca840bcc4e9a535c1028cbd9c349fc88d044d7ddfa2e59965dfd7f3357a

SHA512
f23d18abc17b078420b860201e1dca651c569d9a93b031af8879c3311094c52ee926a41b49c9a7481e2374b481bd9039a1a1b055562992cff23d1184671bd516

Download Submit
C:\Windows\SysWOW64\Nebmekoi.exe

Filesize
64KB

MD5
d2b574705b8dfa2f73457d296a8872cc

SHA1
9d97b6ec5f269778ddc7e14f545263605f6fbf7f

SHA256
f3dffca840bcc4e9a535c1028cbd9c349fc88d044d7ddfa2e59965dfd7f3357a

SHA512
f23d18abc17b078420b860201e1dca651c569d9a93b031af8879c3311094c52ee926a41b49c9a7481e2374b481bd9039a1a1b055562992cff23d1184671bd516

Download Submit
C:\Windows\SysWOW64\Neffpj32.exe

Filesize
64KB

MD5
89ab67a5a49f4ab90f75cb43327c80eb

SHA1
e71a5249afcb292f6df8c412d22d9c6187468f29

SHA256
a11acb07d78c0a88cd2698bc4d96aabbe85b753956653c9b164f26cc36e6e317

SHA512
e7c63f8c4c41858b60a1eb0aae565f141fcc4b36aa697fcb8deb562046eeb718567926018f729d74f0ded28ab68de03f0e5a330a6b7e19861a605462533b1aaf

Download Submit
C:\Windows\SysWOW64\Neffpj32.exe

Filesize
64KB

MD5
89ab67a5a49f4ab90f75cb43327c80eb

SHA1
e71a5249afcb292f6df8c412d22d9c6187468f29

SHA256
a11acb07d78c0a88cd2698bc4d96aabbe85b753956653c9b164f26cc36e6e317

SHA512
e7c63f8c4c41858b60a1eb0aae565f141fcc4b36aa697fcb8deb562046eeb718567926018f729d74f0ded28ab68de03f0e5a330a6b7e19861a605462533b1aaf

Download Submit
C:\Windows\SysWOW64\Nemcjk32.exe

Filesize
64KB

MD5
7972e8a9675e53fc1cf87935fca03d83

SHA1
26196a722d339949a412c37c72014a9bd8c23c24

SHA256
bdc740ff9d9f09b17b4459ddfe67e202d7606401ae59be96cc05eb7b4015850f

SHA512
4efaf7ab8f6f4f8d293260c17fcfdce8022bc47971fe11b9561868b1c2cfd0291bd5058f88922ca9c9c1c00c3f72a28822bf8f8c4e9009541c493809630da1c3

Download Submit
C:\Windows\SysWOW64\Nemcjk32.exe

Filesize
64KB

MD5
7972e8a9675e53fc1cf87935fca03d83

SHA1
26196a722d339949a412c37c72014a9bd8c23c24

SHA256
bdc740ff9d9f09b17b4459ddfe67e202d7606401ae59be96cc05eb7b4015850f

SHA512
4efaf7ab8f6f4f8d293260c17fcfdce8022bc47971fe11b9561868b1c2cfd0291bd5058f88922ca9c9c1c00c3f72a28822bf8f8c4e9009541c493809630da1c3

Download Submit
C:\Windows\SysWOW64\Ngaionfl.exe

Filesize
64KB

MD5
3d38df39b5612de5eee4a40dfa247b40

SHA1
ae54e9145ddb11696bf3596579a989ba99dc3ceb

SHA256
a6aa2da02a3d9f65c7dd509360b531a72cb80659cee6ffb24ffbacff0bb6f859

SHA512
211f19c235971c25128fb5ae2c864d689a3a1c9fb81e51dbf27ec7d5c992a82b473a8d5f0ac1412169374a731c67dccc3b1c4cd29a3ae76f49c6f5f3e29be503

Download Submit
C:\Windows\SysWOW64\Ngaionfl.exe

Filesize
64KB

MD5
3d38df39b5612de5eee4a40dfa247b40

SHA1
ae54e9145ddb11696bf3596579a989ba99dc3ceb

SHA256
a6aa2da02a3d9f65c7dd509360b531a72cb80659cee6ffb24ffbacff0bb6f859

SHA512
211f19c235971c25128fb5ae2c864d689a3a1c9fb81e51dbf27ec7d5c992a82b473a8d5f0ac1412169374a731c67dccc3b1c4cd29a3ae76f49c6f5f3e29be503

Download Submit
C:\Windows\SysWOW64\Nlihle32.exe

Filesize
64KB

MD5
e4f797e6dcc241845f04aac08031703c

SHA1
fd3bf59cb36ba933cb7a5626ae3e0ce2c3793cfc

SHA256
f2d5a5d0c313cbe15336362966969beb37ca2872599700e0974096aecf4e87ba

SHA512
620b5e3a10c427cbc8c850cbaafed6d78e3ed2d138df9ab3b8ead0c65c4970cd930f1f8c2b1dd94563d83aa57efbecac32f3851e90fcf5bcd6f019d020dc042d

Download Submit
C:\Windows\SysWOW64\Nlihle32.exe

Filesize
64KB

MD5
e4f797e6dcc241845f04aac08031703c

SHA1
fd3bf59cb36ba933cb7a5626ae3e0ce2c3793cfc

SHA256
f2d5a5d0c313cbe15336362966969beb37ca2872599700e0974096aecf4e87ba

SHA512
620b5e3a10c427cbc8c850cbaafed6d78e3ed2d138df9ab3b8ead0c65c4970cd930f1f8c2b1dd94563d83aa57efbecac32f3851e90fcf5bcd6f019d020dc042d

Download Submit
C:\Windows\SysWOW64\Nlqomd32.exe

Filesize
64KB

MD5
ab43c1127801ca8f0eb292548cb7f75d

SHA1
1009d69b517c2ff38dc5ad6c39a11b26c5bad243

SHA256
ff3eae1aeedacc18d2888af9ee2c1f72132238fbeffe849629c050e049d82db9

SHA512
dba102ebc3b7fb05458812142fc464e2300bb9ed4c3d5f56d1e0fba1a130eda09d1c922c5a76ed2c3423f94db5ab2a2fe67a740e041a5bfdd92bd6649e881539

Download Submit
C:\Windows\SysWOW64\Nlqomd32.exe

Filesize
64KB

MD5
ab43c1127801ca8f0eb292548cb7f75d

SHA1
1009d69b517c2ff38dc5ad6c39a11b26c5bad243

SHA256
ff3eae1aeedacc18d2888af9ee2c1f72132238fbeffe849629c050e049d82db9

SHA512
dba102ebc3b7fb05458812142fc464e2300bb9ed4c3d5f56d1e0fba1a130eda09d1c922c5a76ed2c3423f94db5ab2a2fe67a740e041a5bfdd92bd6649e881539

Download Submit
C:\Windows\SysWOW64\Npgabc32.exe

Filesize
64KB

MD5
168c4987a2d0a03875072ae52d2b2058

SHA1
2ed2f90b957b0f68098f044daf14c8573613ea96

SHA256
db05112c407c80387a4fadf322696b2e19fa0efa652bdd724e6e71fb370e93be

SHA512
cd0d6128ece05fa99c22521ff9143ede2c2c0663abaa903ec87df0edf9dbad9f9e185366f55127b39daab935f8665c5b72577ce0c3db94ad88cd7b2d6ab34df8

Download Submit
C:\Windows\SysWOW64\Npgabc32.exe

Filesize
64KB

MD5
168c4987a2d0a03875072ae52d2b2058

SHA1
2ed2f90b957b0f68098f044daf14c8573613ea96

SHA256
db05112c407c80387a4fadf322696b2e19fa0efa652bdd724e6e71fb370e93be

SHA512
cd0d6128ece05fa99c22521ff9143ede2c2c0663abaa903ec87df0edf9dbad9f9e185366f55127b39daab935f8665c5b72577ce0c3db94ad88cd7b2d6ab34df8

Download Submit
C:\Windows\SysWOW64\Npjnhc32.exe

Filesize
64KB

MD5
f44e298d59654aa9046b92b824e0b71c

SHA1
a0bd0c72831c59228528074f5c20b58d6ea5fc96

SHA256
c47e2e0cb6bc5290cddc1d0d08fcd3fd7b84726f7a48b0ffeaaea3e36fd9e5ad

SHA512
fef95d0b01c7ef91c756c27d024c6697fd535a5671af48736a427efa8e357b41fa8bc6f9851eaee0fadabfd98065dfec8668d2ea837637c35e1aad41f3004be4

Download Submit
C:\Windows\SysWOW64\Npjnhc32.exe

Filesize
64KB

MD5
f44e298d59654aa9046b92b824e0b71c

SHA1
a0bd0c72831c59228528074f5c20b58d6ea5fc96

SHA256
c47e2e0cb6bc5290cddc1d0d08fcd3fd7b84726f7a48b0ffeaaea3e36fd9e5ad

SHA512
fef95d0b01c7ef91c756c27d024c6697fd535a5671af48736a427efa8e357b41fa8bc6f9851eaee0fadabfd98065dfec8668d2ea837637c35e1aad41f3004be4

Download Submit
C:\Windows\SysWOW64\Ocamjm32.exe

Filesize
64KB

MD5
d10f7b8606e933763dead152d260139e

SHA1
46fdb2263751402005b9d938d3c277020a907d45

SHA256
584167db64886bfc0feedbcb6a3c8852b6529e79e42732fc3f5e6be94f04c707

SHA512
168d641dc3277f25aefb945b7272a9efbcc142a8986a31732cea8dd1db90280bae6300006b2d3cf0736b4581bb954ee61302262a30814d51b364ffc48d4ee574

Download Submit
C:\Windows\SysWOW64\Ocamjm32.exe

Filesize
64KB

MD5
d10f7b8606e933763dead152d260139e

SHA1
46fdb2263751402005b9d938d3c277020a907d45

SHA256
584167db64886bfc0feedbcb6a3c8852b6529e79e42732fc3f5e6be94f04c707

SHA512
168d641dc3277f25aefb945b7272a9efbcc142a8986a31732cea8dd1db90280bae6300006b2d3cf0736b4581bb954ee61302262a30814d51b364ffc48d4ee574

Download Submit
C:\Windows\SysWOW64\Oekpkigo.exe

Filesize
64KB

MD5
07ea71e9d90e535a1ff4d2aa3f47f0bd

SHA1
1fabf296e8d6bde399bb622dd03cae09f1d30442

SHA256
f6dda4479072f44fbc8e6d767b040083fbc81e9ce3aba15eb25b0eebee0cca9a

SHA512
1a14ba890953d98bf86ee53b54eaf8e79b6e5cc194df033652fe824fa789d3a123ac124f23ea46a4e3c071fa291bec9017bb43bdbc1b2258d0e2469194cafafc

Download Submit
C:\Windows\SysWOW64\Oekpkigo.exe

Filesize
64KB

MD5
07ea71e9d90e535a1ff4d2aa3f47f0bd

SHA1
1fabf296e8d6bde399bb622dd03cae09f1d30442

SHA256
f6dda4479072f44fbc8e6d767b040083fbc81e9ce3aba15eb25b0eebee0cca9a

SHA512
1a14ba890953d98bf86ee53b54eaf8e79b6e5cc194df033652fe824fa789d3a123ac124f23ea46a4e3c071fa291bec9017bb43bdbc1b2258d0e2469194cafafc

Download Submit
C:\Windows\SysWOW64\Ohjlgefb.exe

Filesize
64KB

MD5
121f0e573707b43c0178dd2775d020d6

SHA1
c4312c82b4b69fa411b916528f8e50f164c28769

SHA256
b381c4110f65f1e25c5bd120fa6a396ee62a0c10486b1774b4e38fcdd5a3f201

SHA512
8f34939f24d88fd29b5646b2274d092ef89178e000f216f6e4dff4e3985f4711205300f1ab53e00d932c7b36fe0915a6e084a1aa83d2ff8005120ae94a2c71ca

Download Submit
C:\Windows\SysWOW64\Ohjlgefb.exe

Filesize
64KB

MD5
121f0e573707b43c0178dd2775d020d6

SHA1
c4312c82b4b69fa411b916528f8e50f164c28769

SHA256
b381c4110f65f1e25c5bd120fa6a396ee62a0c10486b1774b4e38fcdd5a3f201

SHA512
8f34939f24d88fd29b5646b2274d092ef89178e000f216f6e4dff4e3985f4711205300f1ab53e00d932c7b36fe0915a6e084a1aa83d2ff8005120ae94a2c71ca

Download Submit
C:\Windows\SysWOW64\Olgemcli.exe

Filesize
64KB

MD5
2154163d30b8aed521bd3880f83a331e

SHA1
f59667596129887ed2e994d4812b85970df86ca9

SHA256
201d8e8eb9fcead7777336e47b5d747753a74f9844bc7fbf66268e8470eea015

SHA512
df732dc7410ceb9591512e5d056bf46e3fa529fa9c6f4e21accbc35a347cd607bf1ec965072d92e71c37cf91c216a233685369b8aebcae1f038fa0b29aa11108

Download Submit
C:\Windows\SysWOW64\Olgemcli.exe

Filesize
64KB

MD5
2154163d30b8aed521bd3880f83a331e

SHA1
f59667596129887ed2e994d4812b85970df86ca9

SHA256
201d8e8eb9fcead7777336e47b5d747753a74f9844bc7fbf66268e8470eea015

SHA512
df732dc7410ceb9591512e5d056bf46e3fa529fa9c6f4e21accbc35a347cd607bf1ec965072d92e71c37cf91c216a233685369b8aebcae1f038fa0b29aa11108

Download Submit
C:\Windows\SysWOW64\Ollnhb32.exe

Filesize
64KB

MD5
d1238d6e22b5f2240ef83ca43e3158a2

SHA1
19d48daf39919d08fc0c1292e954f48d2ad72b53

SHA256
758b381a44a1a8efc8ed9de213186573a7f4e091270f401e7ab7984f577656dc

SHA512
13b57de74293fa72a81840fbb0193d0a1e8c9f4707d7f838658ad3f85702ffc87bd1db9b3041b9760a72bdc06adcc2d587a22f1680acc62f0c8377a13ead893e

Download Submit
C:\Windows\SysWOW64\Ollnhb32.exe

Filesize
64KB

MD5
377c57290a56acb48c31230a539ae312

SHA1
72222dab136f193e00fa54a6cb15bd6ee37dec54

SHA256
22f418f9d78dccce945cc38d366e877cfec14c4c979a701f5b935af1485c0c15

SHA512
97a9580d7a08cf765f922e06424403dc9f9de0d360d0ad117e0409a2863abc3b4b761493eaa5fdb9e741f47a513aa9f3f76705e7357d36e5e6de84b1d76b3350

Download Submit
C:\Windows\SysWOW64\Ollnhb32.exe

Filesize
64KB

MD5
377c57290a56acb48c31230a539ae312

SHA1
72222dab136f193e00fa54a6cb15bd6ee37dec54

SHA256
22f418f9d78dccce945cc38d366e877cfec14c4c979a701f5b935af1485c0c15

SHA512
97a9580d7a08cf765f922e06424403dc9f9de0d360d0ad117e0409a2863abc3b4b761493eaa5fdb9e741f47a513aa9f3f76705e7357d36e5e6de84b1d76b3350

Download Submit
C:\Windows\SysWOW64\Omjpeo32.exe

Filesize
64KB

MD5
70dc1d3fbbb833dc79f70699a220eaaa

SHA1
7170fe8f1e9fb5edbb6e0765aaedf6e4ce0a4c1e

SHA256
c8e0e133aaeb500d744c9355462bdf0842aab487cadfcb67d09e125e6552aa35

SHA512
25b1f6cd4338a77356ec3bdec788462baa402e7ec452abb6438b1ac661430bc8574ae65190b2d805098c42e3dff949ecc48d940e6caa88f4259e0e4ee41de712

Download Submit
C:\Windows\SysWOW64\Ooagno32.exe

Filesize
64KB

MD5
d0d3afe050853fee7022b67b0cf8994f

SHA1
47146e040fdc2375be1a9e5089b91a3a3c0a83c8

SHA256
c5651b77de13708b5e6b9b6909ec22edf9d7aa33fd563ff9a5f7228052233b72

SHA512
38775a0571f4a8d6b280c7266570a4e9e0941d6c13210243526b2896299f5a957f3d87823f55f2215eabf5eef851efd74c3a6e5bf31ad7d921360c53c517b7e0

Download Submit
C:\Windows\SysWOW64\Ooagno32.exe

Filesize
64KB

MD5
d0d3afe050853fee7022b67b0cf8994f

SHA1
47146e040fdc2375be1a9e5089b91a3a3c0a83c8

SHA256
c5651b77de13708b5e6b9b6909ec22edf9d7aa33fd563ff9a5f7228052233b72

SHA512
38775a0571f4a8d6b280c7266570a4e9e0941d6c13210243526b2896299f5a957f3d87823f55f2215eabf5eef851efd74c3a6e5bf31ad7d921360c53c517b7e0

Download Submit
C:\Windows\SysWOW64\Oocddono.exe

Filesize
64KB

MD5
979f2538d6b17f374fbb9ac003b2a04e

SHA1
7b1d33fced4482dbc9b164243f7cc460b5c4e3df

SHA256
6f6ea209f1956ee1e91a66b357e093b00677e2db1196c2ef132a944fb1aec59a

SHA512
9aff8419d73f0efe081ec76ac97ba6135afe4adb9a6c6dbc2cd58f12945fcbfda533854d9ffe881768fb73d32edc0ffcff634a9aab6439e12521b5135e39485a

Download Submit
C:\Windows\SysWOW64\Oocddono.exe

Filesize
64KB

MD5
979f2538d6b17f374fbb9ac003b2a04e

SHA1
7b1d33fced4482dbc9b164243f7cc460b5c4e3df

SHA256
6f6ea209f1956ee1e91a66b357e093b00677e2db1196c2ef132a944fb1aec59a

SHA512
9aff8419d73f0efe081ec76ac97ba6135afe4adb9a6c6dbc2cd58f12945fcbfda533854d9ffe881768fb73d32edc0ffcff634a9aab6439e12521b5135e39485a

Download Submit
C:\Windows\SysWOW64\Opemca32.exe

Filesize
64KB

MD5
d1238d6e22b5f2240ef83ca43e3158a2

SHA1
19d48daf39919d08fc0c1292e954f48d2ad72b53

SHA256
758b381a44a1a8efc8ed9de213186573a7f4e091270f401e7ab7984f577656dc

SHA512
13b57de74293fa72a81840fbb0193d0a1e8c9f4707d7f838658ad3f85702ffc87bd1db9b3041b9760a72bdc06adcc2d587a22f1680acc62f0c8377a13ead893e

Download Submit
C:\Windows\SysWOW64\Opemca32.exe

Filesize
64KB

MD5
d1238d6e22b5f2240ef83ca43e3158a2

SHA1
19d48daf39919d08fc0c1292e954f48d2ad72b53

SHA256
758b381a44a1a8efc8ed9de213186573a7f4e091270f401e7ab7984f577656dc

SHA512
13b57de74293fa72a81840fbb0193d0a1e8c9f4707d7f838658ad3f85702ffc87bd1db9b3041b9760a72bdc06adcc2d587a22f1680acc62f0c8377a13ead893e

Download Submit
C:\Windows\SysWOW64\Pefabkej.exe

Filesize
64KB

MD5
d519a3c65a5e96e5bde934760e60fec3

SHA1
e690e5b0248f1b8820ad0fca1ed6267e14c10dbd

SHA256
ae0f644ca504699a4567f129527544fce4c28052860d5eeac3c3cac3d6626e83

SHA512
34f60a18eebae55120ab2bf170e44529b0fef3a5b010aee277abffa67c7d6061075a9449cbcd9a1ac10733353d15663a4e1b6fce25667ca3e0648e8278152710

Download Submit
C:\Windows\SysWOW64\Pejkmk32.exe

Filesize
64KB

MD5
d7617e2535546bd305c815d62768cdf8

SHA1
aafada59808605921fa57a1da89688d66f7d1804

SHA256
22787d66d348ff4b4d18b88ea3f9e6bbdf92586a03b0995609154b926401d579

SHA512
a09fbd60eb24e31424dcfcc7d0fa7abcacf3b81fc35608c61efb160340a0b5cea947ca0c3672de27b6719090234ded8d65e9273216f931bef43865fde25e74ff

Download Submit
C:\Windows\SysWOW64\Pfgogh32.exe

Filesize
64KB

MD5
21b32730c1fedbd85a1ec61843d1186f

SHA1
7ee5c1804a5d2db99fac6153ff7d413e07a0f465

SHA256
e4826dd23d641a23f9cc5e6006d184fe9998a8c8478f5ef39743c2153810a909

SHA512
40246d70ab98454bd81216c4a75524805aacc6bbf5b6a57cb73f976b58d39d1e1a207b7dae33841da9951b1bdf9cdb091d605ce8d9b543792865d295eb029243

Download Submit
C:\Windows\SysWOW64\Pfgogh32.exe

Filesize
64KB

MD5
21b32730c1fedbd85a1ec61843d1186f

SHA1
7ee5c1804a5d2db99fac6153ff7d413e07a0f465

SHA256
e4826dd23d641a23f9cc5e6006d184fe9998a8c8478f5ef39743c2153810a909

SHA512
40246d70ab98454bd81216c4a75524805aacc6bbf5b6a57cb73f976b58d39d1e1a207b7dae33841da9951b1bdf9cdb091d605ce8d9b543792865d295eb029243

Download Submit
C:\Windows\SysWOW64\Pjgebf32.exe

Filesize
64KB

MD5
ddb5561e98df72226e7b887276971d5f

SHA1
a8e030f2170bf82bbe5f98e2e1aca8f8a5d604c9

SHA256
04f6c5f9cd55a14bf0050bf3f506e838a96bc2baa81a76a582289e430905b6d6

SHA512
c32a21f921e9b8529bdc0feabe7ffe5f420d5248e1b28b815490ba278c85ccc38b5f046e99ac64a05b73dfecb22d55a91dff7821a5567f603deb8ca49e3bdcff

Download Submit
C:\Windows\SysWOW64\Pjgebf32.exe

Filesize
64KB

MD5
ddb5561e98df72226e7b887276971d5f

SHA1
a8e030f2170bf82bbe5f98e2e1aca8f8a5d604c9

SHA256
04f6c5f9cd55a14bf0050bf3f506e838a96bc2baa81a76a582289e430905b6d6

SHA512
c32a21f921e9b8529bdc0feabe7ffe5f420d5248e1b28b815490ba278c85ccc38b5f046e99ac64a05b73dfecb22d55a91dff7821a5567f603deb8ca49e3bdcff

Download Submit
C:\Windows\SysWOW64\Plcdiabk.exe

Filesize
64KB

MD5
5b7b18cad48521c43de6088e48c53fdb

SHA1
1751530bf87dfc9dbcccce91ff0fb4b14816ca38

SHA256
9eac8b9e53e78a5330f01d6a59792c716ad6d68234703a545cc6d3847a55bf8a

SHA512
5b5d5b7aab8cc06c3d69aa141800a8d3daf0e8677f31c73c58d5a45c219515a8b384cca795206b7193bd73410023906cc44760bf9abc722fc0e704ea09ecf830

Download Submit
C:\Windows\SysWOW64\Plcdiabk.exe

Filesize
64KB

MD5
5b7b18cad48521c43de6088e48c53fdb

SHA1
1751530bf87dfc9dbcccce91ff0fb4b14816ca38

SHA256
9eac8b9e53e78a5330f01d6a59792c716ad6d68234703a545cc6d3847a55bf8a

SHA512
5b5d5b7aab8cc06c3d69aa141800a8d3daf0e8677f31c73c58d5a45c219515a8b384cca795206b7193bd73410023906cc44760bf9abc722fc0e704ea09ecf830

Download Submit
C:\Windows\SysWOW64\Ppmcdq32.exe

Filesize
64KB

MD5
20c163d5c711c8b6c51a9250165620f7

SHA1
91681567c4ac8e9f0b23ffa583b182905b16c5ac

SHA256
eb7207e370d197727528c20576178a392bda5fc702914bd9911cdb53e273f352

SHA512
f67dba014467fe64336c2857403fdfde743bfbc93acb93d9ba6f1780cf4e23ce92e8ea01eac1ceb7ef24d3d366c7b9a90d04d534025ccd0718fd2cb0697129a4

Download Submit
C:\Windows\SysWOW64\Ppmcdq32.exe

Filesize
64KB

MD5
20c163d5c711c8b6c51a9250165620f7

SHA1
91681567c4ac8e9f0b23ffa583b182905b16c5ac

SHA256
eb7207e370d197727528c20576178a392bda5fc702914bd9911cdb53e273f352

SHA512
f67dba014467fe64336c2857403fdfde743bfbc93acb93d9ba6f1780cf4e23ce92e8ea01eac1ceb7ef24d3d366c7b9a90d04d534025ccd0718fd2cb0697129a4

Download Submit
memory/232-402-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/348-98-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/452-312-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/512-169-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/952-230-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/956-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1016-282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1204-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1228-348-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1448-420-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1516-161-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1536-306-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1628-72-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1636-186-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1676-138-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1680-201-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1784-390-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1900-154-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1908-342-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2296-241-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2304-194-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2344-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2392-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2428-300-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2488-209-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2516-105-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2580-268-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2844-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3040-372-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3096-234-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3132-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3136-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3136-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3136-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3156-217-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3260-432-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3360-354-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3636-276-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3792-330-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3796-366-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3828-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3848-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3884-412-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3892-400-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3996-318-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4004-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4020-336-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4068-414-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4116-324-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4180-426-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4232-294-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4320-129-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4416-384-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4428-90-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4440-288-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4580-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4596-113-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4780-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4840-360-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4856-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4884-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4896-182-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4948-378-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4956-13-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads