8ecf0ce46182f8321105f19ba1e50cd68925e481a9b7c64088a8d93039333914

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
23/09/2023, 12:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e5e85b87b0a5d6470b847ee3a76ac01_JC.exe
Size

155KB
MD5

8e5e85b87b0a5d6470b847ee3a76ac01
SHA1

b6e0d79528f0af642a099a1dfa22b8480200969c
SHA256

8ecf0ce46182f8321105f19ba1e50cd68925e481a9b7c64088a8d93039333914
SHA512

f88c3acb968fbc0f59b3d4a1c259d8b3282edde4bf155b2b89bf2b1d94cfa33c50cc4d1e70291e2c6a200919ac4d2a76dddf636847bf52d12b472d32716ec1f6
SSDEEP

3072:TrCgnNFlJaA9L2/qM5wUVryEznYfzB9BSwWO:Tr72A9L+51VryYOzLcK

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Coknoaic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hdjbiheb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pldcjeia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bmidnm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhflnpoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mbgjbkfg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qkipkani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Loacdc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqaiecjd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bipecnkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohmhmh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aggpfkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Iondqhpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eahobg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpnmbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgepom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Qkipkani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pmpolgoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpgind32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hajpbckl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bnmoijje.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Geohklaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Noblkqca.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dggkipii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kkcfid32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Difpmfna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Napjdpcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Plkpcfal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Apmhiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Daeifj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pakllc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bblnindg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ompfej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iahlcaol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jbfheo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnbakghm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fbelcblk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glipgf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnojho32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkphhgfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mokfja32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjdaodja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qpcecb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aggpfkjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkmjaa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pemomqcn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hmbfbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hemdlj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enfckp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ehbnigjj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dkhnjk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jnlkedai.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lopmii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qikbaaml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fcpakn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Codhnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Djelgied.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhahaiec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdbnjdfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Amlogfel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnonkq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Doagjc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bpedeiff.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lijlof32.exe

Executes dropped EXE 64 IoCs

pid	Process
2832	Efhcbodf.exe
1768	Ehhpla32.exe
1400	Emehdh32.exe
4824	Facqkg32.exe
3012	Ffpicn32.exe
4532	Fknbil32.exe
208	Fgdbnmji.exe
4244	Fggocmhf.exe
3056	Fhflnpoi.exe
4556	Gaopfe32.exe
4088	Gdoihpbk.exe
444	Ghmbno32.exe
4780	Gphgbafl.exe
2252	Gahcmd32.exe
1296	Hajpbckl.exe
3212	Hammhcij.exe
408	Hkeaqi32.exe
3944	Hdpbon32.exe
2884	Hpfcdojl.exe
3952	Iahlcaol.exe
2796	Igedlh32.exe
3224	Idieem32.exe
448	Jjjghcfp.exe
1192	Jqdoem32.exe
1536	Jnhpoamf.exe
3652	Jhndljll.exe
4948	Jbfheo32.exe
2900	Jjamia32.exe
3712	Jibmgi32.exe
2412	Jbkbpoog.exe
3904	Kkcfid32.exe
5096	Kelkaj32.exe
4680	Kjhcjq32.exe
4628	Kijchhbo.exe
4212	Keqdmihc.exe
1804	Kkmioc32.exe
4408	Lajagj32.exe
2308	Lbinam32.exe
1456	Licfngjd.exe
1036	Lnpofnhk.exe
2320	Lghcocol.exe
2092	Laqhhi32.exe
388	Ljilqnlm.exe
4724	Lijlof32.exe
4236	Meamcg32.exe
4916	Mbenmk32.exe
4792	Mhafeb32.exe
4656	Mbgjbkfg.exe
3248	Mhdckaeo.exe
2132	Mbighjdd.exe
3300	Mhfppabl.exe
4200	Mblcnj32.exe
3312	Mldhfpib.exe
2520	Naaqofgj.exe
4720	Nbqmiinl.exe
3268	Nijeec32.exe
3948	Nognnj32.exe
3916	Nimbkc32.exe
804	Nahgoe32.exe
2036	Nhbolp32.exe
4568	Nefped32.exe
4356	Okchnk32.exe
2968	Oampjeml.exe
3396	Okedcjcm.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Pkbjjbda.exe	Pefabkej.exe
File created	C:\Windows\SysWOW64\Popbpqjh.exe	Pehngkcg.exe
File created	C:\Windows\SysWOW64\Qfohjf32.dll	Pldcjeia.exe
File created	C:\Windows\SysWOW64\Hplbickp.exe	Hibjli32.exe
File opened for modification	C:\Windows\SysWOW64\Olijhmgj.exe	Oiknlagg.exe
File created	C:\Windows\SysWOW64\Lnjnqh32.exe	Lgqfdnah.exe
File opened for modification	C:\Windows\SysWOW64\Nenbjo32.exe	Nndjndbh.exe
File created	C:\Windows\SysWOW64\Neqopnhb.exe	Nmigoagp.exe
File created	C:\Windows\SysWOW64\Lcnfohmi.exe	Lmdnbn32.exe
File created	C:\Windows\SysWOW64\Mjodla32.exe	Moipoh32.exe
File created	C:\Windows\SysWOW64\Ocgbld32.exe	Oaifpi32.exe
File created	C:\Windows\SysWOW64\Pgdhilkd.dll	Johggfha.exe
File created	C:\Windows\SysWOW64\Enqjamin.dll	Jhndljll.exe
File created	C:\Windows\SysWOW64\Klkfenfk.dll	Gmimai32.exe
File opened for modification	C:\Windows\SysWOW64\Kegpifod.exe	Komhll32.exe
File opened for modification	C:\Windows\SysWOW64\Lopmii32.exe	Lnoaaaad.exe
File created	C:\Windows\SysWOW64\Eidlnd32.exe	Ebjcajjd.exe
File created	C:\Windows\SysWOW64\Dakdmb32.dll	Gpnmbl32.exe
File created	C:\Windows\SysWOW64\Hihibbjo.exe	Hnbeeiji.exe
File created	C:\Windows\SysWOW64\Idllbp32.dll	Aafemk32.exe
File opened for modification	C:\Windows\SysWOW64\Dahmfpap.exe	Dkndie32.exe
File created	C:\Windows\SysWOW64\Eclhcj32.dll	Ecikjoep.exe
File created	C:\Windows\SysWOW64\Kijchhbo.exe	Kjhcjq32.exe
File created	C:\Windows\SysWOW64\Ljalni32.dll	Bckkca32.exe
File created	C:\Windows\SysWOW64\Ckjinf32.dll	Gfhndpol.exe
File created	C:\Windows\SysWOW64\Ekellcop.dll	Egaejeej.exe
File created	C:\Windows\SysWOW64\Dcigeooj.exe	Dkbocbog.exe
File opened for modification	C:\Windows\SysWOW64\Nopfpgip.exe	Nnojho32.exe
File created	C:\Windows\SysWOW64\Gkdpbpih.exe	Giecfejd.exe
File opened for modification	C:\Windows\SysWOW64\Dkkaiphj.exe	Cdaile32.exe
File opened for modification	C:\Windows\SysWOW64\Jbfheo32.exe	Jhndljll.exe
File created	C:\Windows\SysWOW64\Qcanijap.dll	Alnmjjdb.exe
File created	C:\Windows\SysWOW64\Fqehjpfj.dll	Enigke32.exe
File created	C:\Windows\SysWOW64\Lpfgmnfp.exe	Kjlopc32.exe
File opened for modification	C:\Windows\SysWOW64\Hkpqkcpd.exe	Hpjmnjqn.exe
File opened for modification	C:\Windows\SysWOW64\Mjdebfnd.exe	Mjahlgpf.exe
File opened for modification	C:\Windows\SysWOW64\Eddnic32.exe	Enjfli32.exe
File opened for modification	C:\Windows\SysWOW64\Ggahedjn.exe	Gmiclo32.exe
File opened for modification	C:\Windows\SysWOW64\Nglhld32.exe	Nqbpojnp.exe
File opened for modification	C:\Windows\SysWOW64\Cienon32.exe	Bbhildae.exe
File created	C:\Windows\SysWOW64\Hfhgkmpj.exe	Hpnoncim.exe
File created	C:\Windows\SysWOW64\Igajal32.exe	Imiehfao.exe
File created	C:\Windows\SysWOW64\Fknofqcc.dll	Pjlcjf32.exe
File opened for modification	C:\Windows\SysWOW64\Ddklbd32.exe	Dnqcfjae.exe
File created	C:\Windows\SysWOW64\Coohhlpe.exe	Blqllqqa.exe
File created	C:\Windows\SysWOW64\Kncaec32.exe	Kgiiiidd.exe
File created	C:\Windows\SysWOW64\Dbfpagon.dll	Akkffkhk.exe
File created	C:\Windows\SysWOW64\Ghehjh32.dll	Eghkjdoa.exe
File created	C:\Windows\SysWOW64\Lokdnjkg.exe	Lnjgfb32.exe
File created	C:\Windows\SysWOW64\Giecfejd.exe	Gbkkik32.exe
File created	C:\Windows\SysWOW64\Gmimai32.exe	Gfodeohd.exe
File created	C:\Windows\SysWOW64\Gbnblldi.dll	Hnibokbd.exe
File created	C:\Windows\SysWOW64\Hpkdfd32.dll	Oikjkc32.exe
File created	C:\Windows\SysWOW64\Leeigm32.dll	Qfmfefni.exe
File opened for modification	C:\Windows\SysWOW64\Egnajocq.exe	Epdime32.exe
File opened for modification	C:\Windows\SysWOW64\Fhflnpoi.exe	Fggocmhf.exe
File opened for modification	C:\Windows\SysWOW64\Gaopfe32.exe	Fhflnpoi.exe
File created	C:\Windows\SysWOW64\Nmkmjjaa.exe	Nfaemp32.exe
File created	C:\Windows\SysWOW64\Hlohlk32.dll	Aopemh32.exe
File created	C:\Windows\SysWOW64\Lhnoigkk.dll	Ocnabm32.exe
File created	C:\Windows\SysWOW64\Ckjfdocc.dll	Qikbaaml.exe
File created	C:\Windows\SysWOW64\Dbcdbi32.dll	Biiobo32.exe
File created	C:\Windows\SysWOW64\Mhfppabl.exe	Mbighjdd.exe
File opened for modification	C:\Windows\SysWOW64\Cjgpfk32.exe	Cobkhb32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
13104	13016	WerFault.exe	768

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oemefcap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnfdcegm.dll"	Ggahedjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fgoakc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfookdli.dll"	Njmhhefi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hfhgkmpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cmbgdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Pocfpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hiiggoaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nenbjo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ldcadhpd.dll"	Jpdhkf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leeigm32.dll"	Qfmfefni.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bmaioi32.dll"	Doaneiop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ncnofeof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bopnkd32.dll"	Dpmcmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nailkcbb.dll"	Fdkdibjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fcpakn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Facqkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hiikaj32.dll"	Nognnj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iepaaico.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opkpck32.dll"	Hkpqkcpd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Opeiadfg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pbhgoh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bailkjga.dll"	Dickplko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fjmfmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Igedlh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ilmjim32.dll"	Gbnoiqdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Llcghg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Digehphc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mogcihaj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ompfej32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hclkag32.dll"	Gbnhoj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gihpkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ipoheakj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nglhld32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ebdlangb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Fgdbnmji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddjmba32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Laiipofp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jfniqp32.dll"	Olfghg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Adndoe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjecbd32.dll"	Bogkmgba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npmknd32.dll"	Jekjcaef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Benibond.dll"	Jeapcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gahcmd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jdqlliil.dll"	Cjliajmo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nmigoagp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cnjdpaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bhpfqcln.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gemkelcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehojko32.dll"	Bknlbhhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nlhkgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cimjkpjn.dll"	Ipbaol32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kncaec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pdpjda32.dll"	Kijchhbo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Okedcjcm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Abhemohm.dll"	Koodbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjmkmfbo.dll"	Kbhmbdle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgjbbcpq.dll"	Gpcfmkff.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ahbjoe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Iehmmb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ekngemhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pioelhgj.dll"	Ipjedh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jgnqgqan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hnbeeiji.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2832	1196	8e5e85b87b0a5d6470b847ee3a76ac01_JC.exe	82
PID 1196 wrote to memory of 2832	1196	8e5e85b87b0a5d6470b847ee3a76ac01_JC.exe	82
PID 1196 wrote to memory of 2832	1196	8e5e85b87b0a5d6470b847ee3a76ac01_JC.exe	82
PID 2832 wrote to memory of 1768	2832	Efhcbodf.exe	83
PID 2832 wrote to memory of 1768	2832	Efhcbodf.exe	83
PID 2832 wrote to memory of 1768	2832	Efhcbodf.exe	83
PID 1768 wrote to memory of 1400	1768	Ehhpla32.exe	84
PID 1768 wrote to memory of 1400	1768	Ehhpla32.exe	84
PID 1768 wrote to memory of 1400	1768	Ehhpla32.exe	84
PID 1400 wrote to memory of 4824	1400	Emehdh32.exe	86
PID 1400 wrote to memory of 4824	1400	Emehdh32.exe	86
PID 1400 wrote to memory of 4824	1400	Emehdh32.exe	86
PID 4824 wrote to memory of 3012	4824	Facqkg32.exe	87
PID 4824 wrote to memory of 3012	4824	Facqkg32.exe	87
PID 4824 wrote to memory of 3012	4824	Facqkg32.exe	87
PID 3012 wrote to memory of 4532	3012	Ffpicn32.exe	88
PID 3012 wrote to memory of 4532	3012	Ffpicn32.exe	88
PID 3012 wrote to memory of 4532	3012	Ffpicn32.exe	88
PID 4532 wrote to memory of 208	4532	Fknbil32.exe	89
PID 4532 wrote to memory of 208	4532	Fknbil32.exe	89
PID 4532 wrote to memory of 208	4532	Fknbil32.exe	89
PID 208 wrote to memory of 4244	208	Fgdbnmji.exe	90
PID 208 wrote to memory of 4244	208	Fgdbnmji.exe	90
PID 208 wrote to memory of 4244	208	Fgdbnmji.exe	90
PID 4244 wrote to memory of 3056	4244	Fggocmhf.exe	91
PID 4244 wrote to memory of 3056	4244	Fggocmhf.exe	91
PID 4244 wrote to memory of 3056	4244	Fggocmhf.exe	91
PID 3056 wrote to memory of 4556	3056	Fhflnpoi.exe	92
PID 3056 wrote to memory of 4556	3056	Fhflnpoi.exe	92
PID 3056 wrote to memory of 4556	3056	Fhflnpoi.exe	92
PID 4556 wrote to memory of 4088	4556	Gaopfe32.exe	93
PID 4556 wrote to memory of 4088	4556	Gaopfe32.exe	93
PID 4556 wrote to memory of 4088	4556	Gaopfe32.exe	93
PID 4088 wrote to memory of 444	4088	Gdoihpbk.exe	94
PID 4088 wrote to memory of 444	4088	Gdoihpbk.exe	94
PID 4088 wrote to memory of 444	4088	Gdoihpbk.exe	94
PID 444 wrote to memory of 4780	444	Ghmbno32.exe	95
PID 444 wrote to memory of 4780	444	Ghmbno32.exe	95
PID 444 wrote to memory of 4780	444	Ghmbno32.exe	95
PID 4780 wrote to memory of 2252	4780	Gphgbafl.exe	96
PID 4780 wrote to memory of 2252	4780	Gphgbafl.exe	96
PID 4780 wrote to memory of 2252	4780	Gphgbafl.exe	96
PID 2252 wrote to memory of 1296	2252	Gahcmd32.exe	97
PID 2252 wrote to memory of 1296	2252	Gahcmd32.exe	97
PID 2252 wrote to memory of 1296	2252	Gahcmd32.exe	97
PID 1296 wrote to memory of 3212	1296	Hajpbckl.exe	98
PID 1296 wrote to memory of 3212	1296	Hajpbckl.exe	98
PID 1296 wrote to memory of 3212	1296	Hajpbckl.exe	98
PID 3212 wrote to memory of 408	3212	Hammhcij.exe	99
PID 3212 wrote to memory of 408	3212	Hammhcij.exe	99
PID 3212 wrote to memory of 408	3212	Hammhcij.exe	99
PID 408 wrote to memory of 3944	408	Hkeaqi32.exe	100
PID 408 wrote to memory of 3944	408	Hkeaqi32.exe	100
PID 408 wrote to memory of 3944	408	Hkeaqi32.exe	100
PID 3944 wrote to memory of 2884	3944	Hdpbon32.exe	101
PID 3944 wrote to memory of 2884	3944	Hdpbon32.exe	101
PID 3944 wrote to memory of 2884	3944	Hdpbon32.exe	101
PID 2884 wrote to memory of 3952	2884	Hpfcdojl.exe	103
PID 2884 wrote to memory of 3952	2884	Hpfcdojl.exe	103
PID 2884 wrote to memory of 3952	2884	Hpfcdojl.exe	103
PID 3952 wrote to memory of 2796	3952	Iahlcaol.exe	104
PID 3952 wrote to memory of 2796	3952	Iahlcaol.exe	104
PID 3952 wrote to memory of 2796	3952	Iahlcaol.exe	104
PID 2796 wrote to memory of 3224	2796	Igedlh32.exe	105

C:\Users\Admin\AppData\Local\Temp\8e5e85b87b0a5d6470b847ee3a76ac01_JC.exe
"C:\Users\Admin\AppData\Local\Temp\8e5e85b87b0a5d6470b847ee3a76ac01_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Windows\SysWOW64\Efhcbodf.exe
  C:\Windows\system32\Efhcbodf.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\SysWOW64\Ehhpla32.exe
    C:\Windows\system32\Ehhpla32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Windows\SysWOW64\Emehdh32.exe
      C:\Windows\system32\Emehdh32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1400
    - - C:\Windows\SysWOW64\Facqkg32.exe
        
        C:\Windows\system32\Facqkg32.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4824
      - C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3012
        
        C:\Windows\SysWOW64\Fknbil32.exe
        
        C:\Windows\system32\Fknbil32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4532
        
        C:\Windows\SysWOW64\Fgdbnmji.exe
        
        C:\Windows\system32\Fgdbnmji.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:208
        
        C:\Windows\SysWOW64\Fggocmhf.exe
        
        C:\Windows\system32\Fggocmhf.exe
        9⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4244
        
        C:\Windows\SysWOW64\Fhflnpoi.exe
        
        C:\Windows\system32\Fhflnpoi.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3056
        
        C:\Windows\SysWOW64\Gaopfe32.exe
        
        C:\Windows\system32\Gaopfe32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4556
        
        C:\Windows\SysWOW64\Gdoihpbk.exe
        
        C:\Windows\system32\Gdoihpbk.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4088
        
        C:\Windows\SysWOW64\Ghmbno32.exe
        
        C:\Windows\system32\Ghmbno32.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:444
        
        C:\Windows\SysWOW64\Gphgbafl.exe
        
        C:\Windows\system32\Gphgbafl.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4780
        
        C:\Windows\SysWOW64\Gahcmd32.exe
        
        C:\Windows\system32\Gahcmd32.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2252
        
        C:\Windows\SysWOW64\Hajpbckl.exe
        
        C:\Windows\system32\Hajpbckl.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1296
        
        C:\Windows\SysWOW64\Hammhcij.exe
        
        C:\Windows\system32\Hammhcij.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3212
        
        C:\Windows\SysWOW64\Hkeaqi32.exe
        
        C:\Windows\system32\Hkeaqi32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:408
        
        C:\Windows\SysWOW64\Hdpbon32.exe
        
        C:\Windows\system32\Hdpbon32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3944
        
        C:\Windows\SysWOW64\Hpfcdojl.exe
        
        C:\Windows\system32\Hpfcdojl.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2884
        
        C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3952
        
        C:\Windows\SysWOW64\Igedlh32.exe
        
        C:\Windows\system32\Igedlh32.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2796
        
        C:\Windows\SysWOW64\Idieem32.exe
        
        C:\Windows\system32\Idieem32.exe
        23⤵
        Executes dropped EXE
        
        PID:3224
        
        C:\Windows\SysWOW64\Jjjghcfp.exe
        
        C:\Windows\system32\Jjjghcfp.exe
        24⤵
        Executes dropped EXE
        
        PID:448
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        25⤵
        Executes dropped EXE
        
        PID:1192
        
        C:\Windows\SysWOW64\Jnhpoamf.exe
        
        C:\Windows\system32\Jnhpoamf.exe
        26⤵
        Executes dropped EXE
        
        PID:1536
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3652
        
        C:\Windows\SysWOW64\Jbfheo32.exe
        
        C:\Windows\system32\Jbfheo32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4948
        
        C:\Windows\SysWOW64\Jjamia32.exe
        
        C:\Windows\system32\Jjamia32.exe
        29⤵
        Executes dropped EXE
        
        PID:2900
        
        C:\Windows\SysWOW64\Jibmgi32.exe
        
        C:\Windows\system32\Jibmgi32.exe
        30⤵
        Executes dropped EXE
        
        PID:3712
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        31⤵
        Executes dropped EXE
        
        PID:2412
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3904
        
        C:\Windows\SysWOW64\Kelkaj32.exe
        
        C:\Windows\system32\Kelkaj32.exe
        33⤵
        Executes dropped EXE
        
        PID:5096
        
        C:\Windows\SysWOW64\Kjhcjq32.exe
        
        C:\Windows\system32\Kjhcjq32.exe
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4680
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        35⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4628
        
        C:\Windows\SysWOW64\Keqdmihc.exe
        
        C:\Windows\system32\Keqdmihc.exe
        36⤵
        Executes dropped EXE
        
        PID:4212
        
        C:\Windows\SysWOW64\Kkmioc32.exe
        
        C:\Windows\system32\Kkmioc32.exe
        37⤵
        Executes dropped EXE
        
        PID:1804
        
        C:\Windows\SysWOW64\Lajagj32.exe
        
        C:\Windows\system32\Lajagj32.exe
        38⤵
        Executes dropped EXE
        
        PID:4408
        
        C:\Windows\SysWOW64\Lbinam32.exe
        
        C:\Windows\system32\Lbinam32.exe
        39⤵
        Executes dropped EXE
        
        PID:2308
        
        C:\Windows\SysWOW64\Licfngjd.exe
        
        C:\Windows\system32\Licfngjd.exe
        40⤵
        Executes dropped EXE
        
        PID:1456
        
        C:\Windows\SysWOW64\Lnpofnhk.exe
        
        C:\Windows\system32\Lnpofnhk.exe
        41⤵
        Executes dropped EXE
        
        PID:1036
        
        C:\Windows\SysWOW64\Lghcocol.exe
        
        C:\Windows\system32\Lghcocol.exe
        42⤵
        Executes dropped EXE
        
        PID:2320
        
        C:\Windows\SysWOW64\Laqhhi32.exe
        
        C:\Windows\system32\Laqhhi32.exe
        43⤵
        Executes dropped EXE
        
        PID:2092
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        44⤵
        Executes dropped EXE
        
        PID:388
        
        C:\Windows\SysWOW64\Lijlof32.exe
        
        C:\Windows\system32\Lijlof32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4724
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        46⤵
        Executes dropped EXE
        
        PID:4236
        
        C:\Windows\SysWOW64\Mbenmk32.exe
        
        C:\Windows\system32\Mbenmk32.exe
        47⤵
        Executes dropped EXE
        
        PID:4916
        
        C:\Windows\SysWOW64\Mhafeb32.exe
        
        C:\Windows\system32\Mhafeb32.exe
        48⤵
        Executes dropped EXE
        
        PID:4792
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4656
        
        C:\Windows\SysWOW64\Mhdckaeo.exe
        
        C:\Windows\system32\Mhdckaeo.exe
        50⤵
        Executes dropped EXE
        
        PID:3248
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2132
        
        C:\Windows\SysWOW64\Mhfppabl.exe
        
        C:\Windows\system32\Mhfppabl.exe
        52⤵
        Executes dropped EXE
        
        PID:3300
        
        C:\Windows\SysWOW64\Mblcnj32.exe
        
        C:\Windows\system32\Mblcnj32.exe
        53⤵
        Executes dropped EXE
        
        PID:4200
        
        C:\Windows\SysWOW64\Mldhfpib.exe
        
        C:\Windows\system32\Mldhfpib.exe
        54⤵
        Executes dropped EXE
        
        PID:3312
        
        C:\Windows\SysWOW64\Naaqofgj.exe
        
        C:\Windows\system32\Naaqofgj.exe
        55⤵
        Executes dropped EXE
        
        PID:2520
        
        C:\Windows\SysWOW64\Nbqmiinl.exe
        
        C:\Windows\system32\Nbqmiinl.exe
        56⤵
        Executes dropped EXE
        
        PID:4720
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        57⤵
        Executes dropped EXE
        
        PID:3268
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        58⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3948
        
        C:\Windows\SysWOW64\Nimbkc32.exe
        
        C:\Windows\system32\Nimbkc32.exe
        59⤵
        Executes dropped EXE
        
        PID:3916
        
        C:\Windows\SysWOW64\Nahgoe32.exe
        
        C:\Windows\system32\Nahgoe32.exe
        60⤵
        Executes dropped EXE
        
        PID:804
        
        C:\Windows\SysWOW64\Nhbolp32.exe
        
        C:\Windows\system32\Nhbolp32.exe
        61⤵
        Executes dropped EXE
        
        PID:2036
        
        C:\Windows\SysWOW64\Nefped32.exe
        
        C:\Windows\system32\Nefped32.exe
        62⤵
        Executes dropped EXE
        
        PID:4568
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        63⤵
        Executes dropped EXE
        
        PID:4356
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        64⤵
        Executes dropped EXE
        
        PID:2968
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        65⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3396
        
        C:\Windows\SysWOW64\Oifeab32.exe
        
        C:\Windows\system32\Oifeab32.exe
        66⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        67⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\Oemefcap.exe
        
        C:\Windows\system32\Oemefcap.exe
        68⤵
        Modifies registry class
        
        PID:840
        
        C:\Windows\SysWOW64\Okjnnj32.exe
        
        C:\Windows\system32\Okjnnj32.exe
        69⤵
        
        PID:936
        
        C:\Windows\SysWOW64\Oiknlagg.exe
        
        C:\Windows\system32\Oiknlagg.exe
        70⤵
        Drops file in System32 directory
        
        PID:5040
        
        C:\Windows\SysWOW64\Olijhmgj.exe
        
        C:\Windows\system32\Olijhmgj.exe
        71⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\Oafcqcea.exe
        
        C:\Windows\system32\Oafcqcea.exe
        72⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\Pkogiikb.exe
        
        C:\Windows\system32\Pkogiikb.exe
        73⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\Piphgq32.exe
        
        C:\Windows\system32\Piphgq32.exe
        74⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1312
        
        C:\Windows\SysWOW64\Pcjiff32.exe
        
        C:\Windows\system32\Pcjiff32.exe
        76⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\Pidabppl.exe
        
        C:\Windows\system32\Pidabppl.exe
        77⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\Pcmeke32.exe
        
        C:\Windows\system32\Pcmeke32.exe
        78⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\Phincl32.exe
        
        C:\Windows\system32\Phincl32.exe
        79⤵
        
        PID:1776
        
        C:\Windows\SysWOW64\Pocfpf32.exe
        
        C:\Windows\system32\Pocfpf32.exe
        80⤵
        Modifies registry class
        
        PID:3340
        
        C:\Windows\SysWOW64\Pemomqcn.exe
        
        C:\Windows\system32\Pemomqcn.exe
        81⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3256
        
        C:\Windows\SysWOW64\Qofcff32.exe
        
        C:\Windows\system32\Qofcff32.exe
        82⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\Qepkbpak.exe
        
        C:\Windows\system32\Qepkbpak.exe
        83⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\Qkmdkgob.exe
        
        C:\Windows\system32\Qkmdkgob.exe
        84⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\Qaflgago.exe
        
        C:\Windows\system32\Qaflgago.exe
        85⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\Allpejfe.exe
        
        C:\Windows\system32\Allpejfe.exe
        86⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\Aeddnp32.exe
        
        C:\Windows\system32\Aeddnp32.exe
        87⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\Alnmjjdb.exe
        
        C:\Windows\system32\Alnmjjdb.exe
        88⤵
        Drops file in System32 directory
        
        PID:2744
        
        C:\Windows\SysWOW64\Alqjpi32.exe
        
        C:\Windows\system32\Alqjpi32.exe
        89⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\Afinioip.exe
        
        C:\Windows\system32\Afinioip.exe
        90⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\Aoabad32.exe
        
        C:\Windows\system32\Aoabad32.exe
        91⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        92⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        93⤵
        
        PID:5212
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        94⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        95⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        96⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Bjnmpl32.exe
        
        C:\Windows\system32\Bjnmpl32.exe
        97⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Bkoigdom.exe
        
        C:\Windows\system32\Bkoigdom.exe
        98⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Bcfahbpo.exe
        
        C:\Windows\system32\Bcfahbpo.exe
        99⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        100⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Bombmcec.exe
        
        C:\Windows\system32\Bombmcec.exe
        101⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Bblnindg.exe
        
        C:\Windows\system32\Bblnindg.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5608
        
        C:\Windows\SysWOW64\Bmabggdm.exe
        
        C:\Windows\system32\Bmabggdm.exe
        103⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Bckkca32.exe
        
        C:\Windows\system32\Bckkca32.exe
        104⤵
        Drops file in System32 directory
        
        PID:5696
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        105⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        106⤵
        Drops file in System32 directory
        
        PID:5784
        
        C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        107⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5880
        
        C:\Windows\SysWOW64\Cfnqklgh.exe
        
        C:\Windows\system32\Cfnqklgh.exe
        109⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Cofecami.exe
        
        C:\Windows\system32\Cofecami.exe
        110⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Cjliajmo.exe
        
        C:\Windows\system32\Cjliajmo.exe
        111⤵
        Modifies registry class
        
        PID:6036
        
        C:\Windows\SysWOW64\Ckmehb32.exe
        
        C:\Windows\system32\Ckmehb32.exe
        112⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Ciafbg32.exe
        
        C:\Windows\system32\Ciafbg32.exe
        113⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Coknoaic.exe
        
        C:\Windows\system32\Coknoaic.exe
        114⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5152
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        115⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Dkbocbog.exe
        
        C:\Windows\system32\Dkbocbog.exe
        116⤵
        Drops file in System32 directory
        
        PID:5292
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        117⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5444
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        119⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        120⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Djelgied.exe
        
        C:\Windows\system32\Djelgied.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5640
        
        C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        122⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Elpkep32.exe
        
        C:\Windows\system32\Elpkep32.exe
        123⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Ebjcajjd.exe
        
        C:\Windows\system32\Ebjcajjd.exe
        124⤵
        Drops file in System32 directory
        
        PID:5856
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        125⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        126⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Eblpgjha.exe
        
        C:\Windows\system32\Eblpgjha.exe
        127⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Eleepoob.exe
        
        C:\Windows\system32\Eleepoob.exe
        128⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        129⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Fpbmfn32.exe
        
        C:\Windows\system32\Fpbmfn32.exe
        130⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        131⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        132⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Fbcfhibj.exe
        
        C:\Windows\system32\Fbcfhibj.exe
        133⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Fllkqn32.exe
        
        C:\Windows\system32\Fllkqn32.exe
        134⤵
        
        PID:5864
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        135⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        136⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        137⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Ffclcgfn.exe
        
        C:\Windows\system32\Ffclcgfn.exe
        138⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        139⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        140⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Fjadje32.exe
        
        C:\Windows\system32\Fjadje32.exe
        141⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6052
        
        C:\Windows\SysWOW64\Gjdaodja.exe
        
        C:\Windows\system32\Gjdaodja.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5336
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        144⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        145⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        146⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        147⤵
        Modifies registry class
        
        PID:5488
        
        C:\Windows\SysWOW64\Gfmojenc.exe
        
        C:\Windows\system32\Gfmojenc.exe
        148⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        149⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        150⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        151⤵
        Drops file in System32 directory
        
        PID:5164
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        152⤵
        Modifies registry class
        
        PID:6188
        
        C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        153⤵
        Drops file in System32 directory
        
        PID:6232
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        154⤵
        Modifies registry class
        
        PID:6276
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        155⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        156⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6408
        
        C:\Windows\SysWOW64\Hmbfbn32.exe
        
        C:\Windows\system32\Hmbfbn32.exe
        158⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6472
        
        C:\Windows\SysWOW64\Hiiggoaf.exe
        
        C:\Windows\system32\Hiiggoaf.exe
        159⤵
        Modifies registry class
        
        PID:6532
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        160⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        161⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        162⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        163⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        164⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Injmcmej.exe
        
        C:\Windows\system32\Injmcmej.exe
        165⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        166⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        167⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Ipjedh32.exe
        
        C:\Windows\system32\Ipjedh32.exe
        168⤵
        Modifies registry class
        
        PID:6932
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        169⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Ijcjmmil.exe
        
        C:\Windows\system32\Ijcjmmil.exe
        170⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        171⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        172⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Ipoopgnf.exe
        
        C:\Windows\system32\Ipoopgnf.exe
        173⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        174⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Jlfpdh32.exe
        
        C:\Windows\system32\Jlfpdh32.exe
        175⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Jgkdbacp.exe
        
        C:\Windows\system32\Jgkdbacp.exe
        176⤵
        
        PID:6292
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        177⤵
        Modifies registry class
        
        PID:6356
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        178⤵
        Modifies registry class
        
        PID:6448
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        179⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Jcdala32.exe
        
        C:\Windows\system32\Jcdala32.exe
        180⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        181⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Jddnfd32.exe
        
        C:\Windows\system32\Jddnfd32.exe
        182⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        183⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        184⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        185⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        186⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        187⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        188⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Kkjeomld.exe
        
        C:\Windows\system32\Kkjeomld.exe
        189⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        190⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Kqfngd32.exe
        
        C:\Windows\system32\Kqfngd32.exe
        191⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Lgqfdnah.exe
        
        C:\Windows\system32\Lgqfdnah.exe
        192⤵
        Drops file in System32 directory
        
        PID:6608
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        193⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        194⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        195⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Lnmkfh32.exe
        
        C:\Windows\system32\Lnmkfh32.exe
        196⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7092
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        198⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        199⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        200⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        201⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        202⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        203⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        204⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        205⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        206⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        207⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        208⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        209⤵
        Drops file in System32 directory
        
        PID:6172
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        210⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        211⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        212⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7248
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        214⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        215⤵
        Drops file in System32 directory
        
        PID:7344
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        216⤵
        Modifies registry class
        
        PID:7388
        
        C:\Windows\SysWOW64\Nlhkgi32.exe
        
        C:\Windows\system32\Nlhkgi32.exe
        217⤵
        Modifies registry class
        
        PID:7428
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        218⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7464
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        219⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        220⤵
        Modifies registry class
        
        PID:7572
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        221⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7680
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        223⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        224⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        225⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        226⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        227⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        228⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        229⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Olfghg32.exe
        
        C:\Windows\system32\Olfghg32.exe
        230⤵
        Modifies registry class
        
        PID:8036
        
        C:\Windows\SysWOW64\Oacoqnci.exe
        
        C:\Windows\system32\Oacoqnci.exe
        231⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8140
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        233⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        234⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7300
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        236⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        237⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        238⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        239⤵
        Drops file in System32 directory
        
        PID:7588
        
        C:\Windows\SysWOW64\Pkbjjbda.exe
        
        C:\Windows\system32\Pkbjjbda.exe
        240⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        241⤵
        Drops file in System32 directory
        
        PID:7760
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        242⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        243⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        244⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7968
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        245⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        246⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8172
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        247⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        248⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        249⤵
        Drops file in System32 directory
        
        PID:7416
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        250⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        251⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        252⤵
        Modifies registry class
        
        PID:7796
        
        C:\Windows\SysWOW64\Aolblopj.exe
        
        C:\Windows\system32\Aolblopj.exe
        253⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        254⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        255⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        256⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        257⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        258⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        259⤵
        Modifies registry class
        
        PID:7900
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        260⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        261⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        262⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        263⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7892
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        265⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        266⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        267⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        268⤵
        Modifies registry class
        
        PID:8024
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7780
        
        C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        270⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Blnoga32.exe
        
        C:\Windows\system32\Blnoga32.exe
        271⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Bnoknihb.exe
        
        C:\Windows\system32\Bnoknihb.exe
        272⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        273⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        274⤵
        Drops file in System32 directory
        
        PID:8360
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        275⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        276⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        277⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        278⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Ckhecmcf.exe
        
        C:\Windows\system32\Ckhecmcf.exe
        279⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        280⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        281⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        282⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        283⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        284⤵
        
        PID:8792
        
        C:\Windows\SysWOW64\Chqogq32.exe
        
        C:\Windows\system32\Chqogq32.exe
        285⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Dkokcl32.exe
        
        C:\Windows\system32\Dkokcl32.exe
        286⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        287⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        288⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        289⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        290⤵
        Modifies registry class
        
        PID:9048
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        291⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        292⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9128
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        293⤵
        Modifies registry class
        
        PID:9168
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        294⤵
        Modifies registry class
        
        PID:9212
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        295⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\Dkhnjk32.exe
        
        C:\Windows\system32\Dkhnjk32.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8220
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        297⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Deqcbpld.exe
        
        C:\Windows\system32\Deqcbpld.exe
        298⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        299⤵
        Drops file in System32 directory
        
        PID:8384
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        300⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        301⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        302⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        303⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        304⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        305⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        306⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        307⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        308⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        309⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        310⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        311⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        312⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\Fbelcblk.exe
        
        C:\Windows\system32\Fbelcblk.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3856
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        314⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        315⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        316⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        317⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        318⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\Gfhndpol.exe
        
        C:\Windows\system32\Gfhndpol.exe
        319⤵
        Drops file in System32 directory
        
        PID:8820
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        320⤵
        Modifies registry class
        
        PID:8940
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        321⤵
        Modifies registry class
        
        PID:9072
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        322⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        323⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8352
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        325⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8564
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        326⤵
        Drops file in System32 directory
        
        PID:8692
        
        C:\Windows\SysWOW64\Gmimai32.exe
        
        C:\Windows\system32\Gmimai32.exe
        327⤵
        Drops file in System32 directory
        
        PID:8988
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        328⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9124
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        329⤵
        
        PID:1432
        
        C:\Windows\SysWOW64\Hlnjbedi.exe
        
        C:\Windows\system32\Hlnjbedi.exe
        330⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        331⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        332⤵
        Drops file in System32 directory
        
        PID:9024
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        333⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        334⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        335⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        336⤵
        Drops file in System32 directory
        
        PID:9016
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        337⤵
        Modifies registry class
        
        PID:8768
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        338⤵
        
        PID:8992
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        339⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9232
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        340⤵
        Modifies registry class
        
        PID:9272
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        341⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Ibcaknbi.exe
        
        C:\Windows\system32\Ibcaknbi.exe
        342⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        343⤵
        Drops file in System32 directory
        
        PID:9396
        
        C:\Windows\SysWOW64\Igajal32.exe
        
        C:\Windows\system32\Igajal32.exe
        344⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        345⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        346⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        347⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        348⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        349⤵
        Modifies registry class
        
        PID:9656
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        350⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        351⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        352⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Jiiicf32.exe
        
        C:\Windows\system32\Jiiicf32.exe
        353⤵
        
        PID:9820
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        354⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        355⤵
        
        PID:9904
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        356⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        357⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        358⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        359⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        360⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        361⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10148
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        362⤵
        Drops file in System32 directory
        
        PID:10192
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        363⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Klahfp32.exe
        
        C:\Windows\system32\Klahfp32.exe
        364⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        365⤵
        Modifies registry class
        
        PID:9336
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        366⤵
        
        PID:9404
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        367⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        368⤵
        Drops file in System32 directory
        
        PID:9560
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        369⤵
        Modifies registry class
        
        PID:9636
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        370⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        371⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        372⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        373⤵
        Drops file in System32 directory
        
        PID:9900
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        374⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        375⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Lnjgfb32.exe
        
        C:\Windows\system32\Lnjgfb32.exe
        376⤵
        Drops file in System32 directory
        
        PID:10100
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        377⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        378⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        379⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        380⤵
        Drops file in System32 directory
        
        PID:9460
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        381⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9568
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        382⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        383⤵
        Drops file in System32 directory
        
        PID:9752
        
        C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        384⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        385⤵
        Modifies registry class
        
        PID:9968
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        386⤵
        
        PID:10096
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        387⤵
        
        PID:10172
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        388⤵
        Drops file in System32 directory
        
        PID:9296
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        389⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        390⤵
        
        PID:9472
        
        C:\Windows\SysWOW64\Mgbefe32.exe
        
        C:\Windows\system32\Mgbefe32.exe
        391⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        392⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        393⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        394⤵
        
        PID:9540
        
        C:\Windows\SysWOW64\Nnojho32.exe
        
        C:\Windows\system32\Nnojho32.exe
        395⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9780
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        396⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        397⤵
        
        PID:9304
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        398⤵
        
        PID:412
        
        C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        399⤵
        Modifies registry class
        
        PID:9224
        
        C:\Windows\SysWOW64\Njhgbp32.exe
        
        C:\Windows\system32\Njhgbp32.exe
        400⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        401⤵
        Drops file in System32 directory
        
        PID:9292
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        402⤵
        Modifies registry class
        
        PID:10272
        
        C:\Windows\SysWOW64\Njjdho32.exe
        
        C:\Windows\system32\Njjdho32.exe
        403⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        404⤵
        
        PID:10356
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        405⤵
        Drops file in System32 directory
        
        PID:10392
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        406⤵
        
        PID:10436
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        407⤵
        
        PID:10484
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        408⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        409⤵
        Drops file in System32 directory
        
        PID:10568
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        410⤵
        
        PID:10608
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        411⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        412⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10688
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        413⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        414⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        415⤵
        
        PID:10824
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        416⤵
        
        PID:10860
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        417⤵
        
        PID:10908
        
        C:\Windows\SysWOW64\Ogjdmbil.exe
        
        C:\Windows\system32\Ogjdmbil.exe
        418⤵
        
        PID:10952
        
        C:\Windows\SysWOW64\Opeiadfg.exe
        
        C:\Windows\system32\Opeiadfg.exe
        419⤵
        Modifies registry class
        
        PID:10992
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        420⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        421⤵
        
        PID:11072
        
        C:\Windows\SysWOW64\Pjmjdm32.exe
        
        C:\Windows\system32\Pjmjdm32.exe
        422⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Pagbaglh.exe
        
        C:\Windows\system32\Pagbaglh.exe
        423⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Pjpfjl32.exe
        
        C:\Windows\system32\Pjpfjl32.exe
        424⤵
        
        PID:11204
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        425⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        426⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        427⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10324
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        428⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        429⤵
        
        PID:10472
        
        C:\Windows\SysWOW64\Pdmdnadc.exe
        
        C:\Windows\system32\Pdmdnadc.exe
        430⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        431⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        432⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10696
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        433⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        434⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        435⤵
        Drops file in System32 directory
        
        PID:10900
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        436⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        437⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        438⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11096
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        439⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        440⤵
        
        PID:11224
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        441⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10252
        
        C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        442⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10352
        
        C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        443⤵
        
        PID:10456
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        444⤵
        Drops file in System32 directory
        
        PID:10564
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        445⤵
        
        PID:10656
        
        C:\Windows\SysWOW64\Bobabg32.exe
        
        C:\Windows\system32\Bobabg32.exe
        446⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        447⤵
        
        PID:10904
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        448⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        449⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        450⤵
        Modifies registry class
        
        PID:11256
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        451⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        452⤵
        Modifies registry class
        
        PID:10500
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        453⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        454⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        455⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11044
        
        C:\Windows\SysWOW64\Cdimqm32.exe
        
        C:\Windows\system32\Cdimqm32.exe
        456⤵
        
        PID:11212
        
        C:\Windows\SysWOW64\Ckbemgcp.exe
        
        C:\Windows\system32\Ckbemgcp.exe
        457⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        458⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        459⤵
        
        PID:11016
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        460⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        461⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        462⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\Cdpcal32.exe
        
        C:\Windows\system32\Cdpcal32.exe
        463⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        464⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\Cacckp32.exe
        
        C:\Windows\system32\Cacckp32.exe
        465⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        466⤵
        
        PID:11368
        
        C:\Windows\SysWOW64\Cnjdpaki.exe
        
        C:\Windows\system32\Cnjdpaki.exe
        467⤵
        Modifies registry class
        
        PID:11404
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        468⤵
        
        PID:11448
        
        C:\Windows\SysWOW64\Dkndie32.exe
        
        C:\Windows\system32\Dkndie32.exe
        469⤵
        Drops file in System32 directory
        
        PID:11488
        
        C:\Windows\SysWOW64\Dahmfpap.exe
        
        C:\Windows\system32\Dahmfpap.exe
        470⤵
        
        PID:11540
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        471⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\Dnonkq32.exe
        
        C:\Windows\system32\Dnonkq32.exe
        472⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11628
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        473⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        474⤵
        
        PID:11708
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        475⤵
        
        PID:11756
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        476⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11800
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        477⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11840
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        478⤵
        
        PID:11884
        
        C:\Windows\SysWOW64\Ebdlangb.exe
        
        C:\Windows\system32\Ebdlangb.exe
        479⤵
        Modifies registry class
        
        PID:11932
        
        C:\Windows\SysWOW64\Egaejeej.exe
        
        C:\Windows\system32\Egaejeej.exe
        480⤵
        Drops file in System32 directory
        
        PID:11968
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        481⤵
        
        PID:12016
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        482⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        483⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12096
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        484⤵
        Drops file in System32 directory
        
        PID:12140
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        485⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        486⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\Foapaa32.exe
        
        C:\Windows\system32\Foapaa32.exe
        487⤵
        
        PID:12268
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        488⤵
        
        PID:11272
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        489⤵
        
        PID:11340
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        490⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        491⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        492⤵
        Modifies registry class
        
        PID:11556
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        493⤵
        
        PID:11616
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        494⤵
        
        PID:11656
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        495⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11740
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        496⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        497⤵
        
        PID:11876
        
        C:\Windows\SysWOW64\Gokbgpeg.exe
        
        C:\Windows\system32\Gokbgpeg.exe
        498⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        499⤵
        
        PID:12000
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        500⤵
        
        PID:12080
        
        C:\Windows\SysWOW64\Gbkkik32.exe
        
        C:\Windows\system32\Gbkkik32.exe
        501⤵
        Drops file in System32 directory
        
        PID:12148
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        502⤵
        Drops file in System32 directory
        
        PID:12216
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        503⤵
        
        PID:12252
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        504⤵
        Modifies registry class
        
        PID:11348
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        505⤵
        Modifies registry class
        
        PID:11400
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        506⤵
        
        PID:11504
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        507⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        508⤵
        
        PID:11684
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        509⤵
        
        PID:1400
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        510⤵
        
        PID:1924
        
        C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        511⤵
        
        PID:11924
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        512⤵
        Drops file in System32 directory
        
        PID:112
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        513⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\Bipecnkd.exe
        
        C:\Windows\system32\Bipecnkd.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5088
        
        C:\Windows\SysWOW64\Bpjmph32.exe
        
        C:\Windows\system32\Bpjmph32.exe
        85⤵
        
        PID:3024
        
        C:\Windows\SysWOW64\Bbhildae.exe
        
        C:\Windows\system32\Bbhildae.exe
        86⤵
        Drops file in System32 directory
        
        PID:5544
        
        C:\Windows\SysWOW64\Cienon32.exe
        
        C:\Windows\system32\Cienon32.exe
        87⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\Cdjblf32.exe
        
        C:\Windows\system32\Cdjblf32.exe
        88⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Cgiohbfi.exe
        
        C:\Windows\system32\Cgiohbfi.exe
        89⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Cmbgdl32.exe
        
        C:\Windows\system32\Cmbgdl32.exe
        90⤵
        Modifies registry class
        
        PID:5580
        
        C:\Windows\SysWOW64\Ccppmc32.exe
        
        C:\Windows\system32\Ccppmc32.exe
        91⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Cmedjl32.exe
        
        C:\Windows\system32\Cmedjl32.exe
        92⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Cdolgfbp.exe
        
        C:\Windows\system32\Cdolgfbp.exe
        93⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Cgmhcaac.exe
        
        C:\Windows\system32\Cgmhcaac.exe
        94⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Cmgqpkip.exe
        
        C:\Windows\system32\Cmgqpkip.exe
        95⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\Cdaile32.exe
        
        C:\Windows\system32\Cdaile32.exe
        96⤵
        Drops file in System32 directory
        
        PID:5124
        
        C:\Windows\SysWOW64\Dkkaiphj.exe
        
        C:\Windows\system32\Dkkaiphj.exe
        97⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Daeifj32.exe
        
        C:\Windows\system32\Daeifj32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5480
        
        C:\Windows\SysWOW64\Dcffnbee.exe
        
        C:\Windows\system32\Dcffnbee.exe
        99⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Dahfkimd.exe
        
        C:\Windows\system32\Dahfkimd.exe
        100⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Dcibca32.exe
        
        C:\Windows\system32\Dcibca32.exe
        101⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Dickplko.exe
        
        C:\Windows\system32\Dickplko.exe
        102⤵
        Modifies registry class
        
        PID:5880
        
        C:\Windows\SysWOW64\Dpmcmf32.exe
        
        C:\Windows\system32\Dpmcmf32.exe
        103⤵
        Modifies registry class
        
        PID:5968
        
        C:\Windows\SysWOW64\Dggkipii.exe
        
        C:\Windows\system32\Dggkipii.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5788
        
        C:\Windows\SysWOW64\Dnqcfjae.exe
        
        C:\Windows\system32\Dnqcfjae.exe
        105⤵
        Drops file in System32 directory
        
        PID:6056
        
        C:\Windows\SysWOW64\Ddklbd32.exe
        
        C:\Windows\system32\Ddklbd32.exe
        106⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Djgdkk32.exe
        
        C:\Windows\system32\Djgdkk32.exe
        107⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Dpalgenf.exe
        
        C:\Windows\system32\Dpalgenf.exe
        108⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Ekgqennl.exe
        
        C:\Windows\system32\Ekgqennl.exe
        109⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Epdime32.exe
        
        C:\Windows\system32\Epdime32.exe
        110⤵
        Drops file in System32 directory
        
        PID:5240
        
        C:\Windows\SysWOW64\Egnajocq.exe
        
        C:\Windows\system32\Egnajocq.exe
        111⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Enhifi32.exe
        
        C:\Windows\system32\Enhifi32.exe
        112⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Edaaccbj.exe
        
        C:\Windows\system32\Edaaccbj.exe
        113⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Egpnooan.exe
        
        C:\Windows\system32\Egpnooan.exe
        114⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Enjfli32.exe
        
        C:\Windows\system32\Enjfli32.exe
        115⤵
        Drops file in System32 directory
        
        PID:6096
        
        C:\Windows\SysWOW64\Eddnic32.exe
        
        C:\Windows\system32\Eddnic32.exe
        116⤵
        
        PID:12308
        
        C:\Windows\SysWOW64\Ekngemhd.exe
        
        C:\Windows\system32\Ekngemhd.exe
        117⤵
        Modifies registry class
        
        PID:12352
        
        C:\Windows\SysWOW64\Eahobg32.exe
        
        C:\Windows\system32\Eahobg32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12388
        
        C:\Windows\SysWOW64\Ecikjoep.exe
        
        C:\Windows\system32\Ecikjoep.exe
        119⤵
        Drops file in System32 directory
        
        PID:12432
        
        C:\Windows\SysWOW64\Ekqckmfb.exe
        
        C:\Windows\system32\Ekqckmfb.exe
        120⤵
        
        PID:12472
        
        C:\Windows\SysWOW64\Eqmlccdi.exe
        
        C:\Windows\system32\Eqmlccdi.exe
        121⤵
        
        PID:12516
        
        C:\Windows\SysWOW64\Fggdpnkf.exe
        
        C:\Windows\system32\Fggdpnkf.exe
        122⤵
        
        PID:12564
        
        C:\Windows\SysWOW64\Fnalmh32.exe
        
        C:\Windows\system32\Fnalmh32.exe
        123⤵
        
        PID:12604
        
        C:\Windows\SysWOW64\Fdkdibjp.exe
        
        C:\Windows\system32\Fdkdibjp.exe
        124⤵
        Modifies registry class
        
        PID:12644
        
        C:\Windows\SysWOW64\Fkemfl32.exe
        
        C:\Windows\system32\Fkemfl32.exe
        125⤵
        
        PID:12688
        
        C:\Windows\SysWOW64\Fboecfii.exe
        
        C:\Windows\system32\Fboecfii.exe
        126⤵
        
        PID:12728
        
        C:\Windows\SysWOW64\Fcpakn32.exe
        
        C:\Windows\system32\Fcpakn32.exe
        127⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12764
        
        C:\Windows\SysWOW64\Fbaahf32.exe
        
        C:\Windows\system32\Fbaahf32.exe
        128⤵
        
        PID:12812
        
        C:\Windows\SysWOW64\Fcbnpnme.exe
        
        C:\Windows\system32\Fcbnpnme.exe
        129⤵
        
        PID:12852
        
        C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        130⤵
        Modifies registry class
        
        PID:12892
        
        C:\Windows\SysWOW64\Fdbkja32.exe
        
        C:\Windows\system32\Fdbkja32.exe
        131⤵
        
        PID:12932
        
        C:\Windows\SysWOW64\Fnjocf32.exe
        
        C:\Windows\system32\Fnjocf32.exe
        132⤵
        
        PID:12976
        
        C:\Windows\SysWOW64\Gddgpqbe.exe
        
        C:\Windows\system32\Gddgpqbe.exe
        133⤵
        
        PID:13016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 13016 -s 216
        134⤵
        Program crash
        
        PID:13104

C:\Windows\SysWOW64\Hnlodjpa.exe
C:\Windows\system32\Hnlodjpa.exe
1⤵
PID:12188
- C:\Windows\SysWOW64\Heegad32.exe
  C:\Windows\system32\Heegad32.exe
  2⤵
  PID:12256
- - C:\Windows\SysWOW64\Hpkknmgd.exe
    C:\Windows\system32\Hpkknmgd.exe
    3⤵
    PID:11412
  - - C:\Windows\SysWOW64\Hicpgc32.exe
      C:\Windows\system32\Hicpgc32.exe
      4⤵
      PID:11476
    - - C:\Windows\SysWOW64\Hpmhdmea.exe
        
        C:\Windows\system32\Hpmhdmea.exe
        5⤵
        
        PID:4244
      - C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        6⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Hhimhobl.exe
        
        C:\Windows\system32\Hhimhobl.exe
        7⤵
        
        PID:11796
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        8⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11920
        
        C:\Windows\SysWOW64\Hihibbjo.exe
        
        C:\Windows\system32\Hihibbjo.exe
        9⤵
        
        PID:4944
        
        C:\Windows\SysWOW64\Ipbaol32.exe
        
        C:\Windows\system32\Ipbaol32.exe
        10⤵
        Modifies registry class
        
        PID:12208
        
        C:\Windows\SysWOW64\Iijfhbhl.exe
        
        C:\Windows\system32\Iijfhbhl.exe
        11⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        12⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        13⤵
        
        PID:968
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        14⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        15⤵
        
        PID:11744
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        16⤵
        
        PID:11892
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        17⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        18⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2776
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        20⤵
        Modifies registry class
        
        PID:11456
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        21⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        22⤵
        Modifies registry class
        
        PID:4224
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        23⤵
        
        PID:12008
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        24⤵
        
        PID:3944
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        25⤵
        Drops file in System32 directory
        
        PID:11308
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        26⤵
        Modifies registry class
        
        PID:5048
        
        C:\Windows\SysWOW64\Jbepme32.exe
        
        C:\Windows\system32\Jbepme32.exe
        27⤵
        
        PID:1408
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        28⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\Kbhmbdle.exe
        
        C:\Windows\system32\Kbhmbdle.exe
        29⤵
        Modifies registry class
        
        PID:1304
        
        C:\Windows\SysWOW64\Kamjda32.exe
        
        C:\Windows\system32\Kamjda32.exe
        30⤵
        
        PID:2252
        
        C:\Windows\SysWOW64\Kpnjah32.exe
        
        C:\Windows\system32\Kpnjah32.exe
        31⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        32⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        33⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Khlklj32.exe
        
        C:\Windows\system32\Khlklj32.exe
        34⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        35⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\Likhem32.exe
        
        C:\Windows\system32\Likhem32.exe
        36⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        37⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        38⤵
        
        PID:4524
        
        C:\Windows\SysWOW64\Laiipofp.exe
        
        C:\Windows\system32\Laiipofp.exe
        39⤵
        Modifies registry class
        
        PID:4532
        
        C:\Windows\SysWOW64\Llnnmhfe.exe
        
        C:\Windows\system32\Llnnmhfe.exe
        40⤵
        
        PID:444
        
        C:\Windows\SysWOW64\Lomjicei.exe
        
        C:\Windows\system32\Lomjicei.exe
        41⤵
        
        PID:1056
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        42⤵
        
        PID:12192
        
        C:\Windows\SysWOW64\Llqjbhdc.exe
        
        C:\Windows\system32\Llqjbhdc.exe
        43⤵
        
        PID:448
        
        C:\Windows\SysWOW64\Lfiokmkc.exe
        
        C:\Windows\system32\Lfiokmkc.exe
        44⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        45⤵
        Modifies registry class
        
        PID:2524
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4180
        
        C:\Windows\SysWOW64\Mfkkqmiq.exe
        
        C:\Windows\system32\Mfkkqmiq.exe
        47⤵
        
        PID:864
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        48⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        49⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        50⤵
        
        PID:632
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        51⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        52⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        53⤵
        
        PID:688
        
        C:\Windows\SysWOW64\Mlljnf32.exe
        
        C:\Windows\system32\Mlljnf32.exe
        54⤵
        
        PID:1248
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3036
        
        C:\Windows\SysWOW64\Mfenglqf.exe
        
        C:\Windows\system32\Mfenglqf.exe
        56⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        57⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        58⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        59⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        60⤵
        
        PID:1396
        
        C:\Windows\SysWOW64\Noblkqca.exe
        
        C:\Windows\system32\Noblkqca.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1456
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        62⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\Nqaiecjd.exe
        
        C:\Windows\system32\Nqaiecjd.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3112
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        64⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\Nimmifgo.exe
        
        C:\Windows\system32\Nimmifgo.exe
        65⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        66⤵
        
        PID:548
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        67⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Ommceclc.exe
        
        C:\Windows\system32\Ommceclc.exe
        68⤵
        
        PID:1384
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        69⤵
        
        PID:4016
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        70⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        71⤵
        
        PID:1112
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        72⤵
        
        PID:388
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        73⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        74⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\Oihmedma.exe
        
        C:\Windows\system32\Oihmedma.exe
        75⤵
        
        PID:11580
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        76⤵
        Drops file in System32 directory
        
        PID:1756
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        77⤵
        Drops file in System32 directory
        
        PID:2168
        
        C:\Windows\SysWOW64\Pqbala32.exe
        
        C:\Windows\system32\Pqbala32.exe
        78⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\Pfojdh32.exe
        
        C:\Windows\system32\Pfojdh32.exe
        79⤵
        
        PID:12260
        
        C:\Windows\SysWOW64\Pmhbqbae.exe
        
        C:\Windows\system32\Pmhbqbae.exe
        80⤵
        
        PID:644
        
        C:\Windows\SysWOW64\Pbekii32.exe
        
        C:\Windows\system32\Pbekii32.exe
        81⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\Pjlcjf32.exe
        
        C:\Windows\system32\Pjlcjf32.exe
        82⤵
        Drops file in System32 directory
        
        PID:2728
        
        C:\Windows\SysWOW64\Pafkgphl.exe
        
        C:\Windows\system32\Pafkgphl.exe
        83⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\Pbhgoh32.exe
        
        C:\Windows\system32\Pbhgoh32.exe
        84⤵
        Modifies registry class
        
        PID:804
        
        C:\Windows\SysWOW64\Piapkbeg.exe
        
        C:\Windows\system32\Piapkbeg.exe
        85⤵
        
        PID:4568
        
        C:\Windows\SysWOW64\Pcgdhkem.exe
        
        C:\Windows\system32\Pcgdhkem.exe
        86⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        87⤵
        
        PID:840
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        88⤵
        
        PID:1368
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        89⤵
        
        PID:2036
        
        C:\Windows\SysWOW64\Pmbegqjk.exe
        
        C:\Windows\system32\Pmbegqjk.exe
        90⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Qclmck32.exe
        
        C:\Windows\system32\Qclmck32.exe
        91⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\Qmdblp32.exe
        
        C:\Windows\system32\Qmdblp32.exe
        92⤵
        
        PID:1284
        
        C:\Windows\SysWOW64\Qpbnhl32.exe
        
        C:\Windows\system32\Qpbnhl32.exe
        93⤵
        
        PID:4112
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        94⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4044
        
        C:\Windows\SysWOW64\Qikbaaml.exe
        
        C:\Windows\system32\Qikbaaml.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:1044
        
        C:\Windows\SysWOW64\Abcgjg32.exe
        
        C:\Windows\system32\Abcgjg32.exe
        96⤵
        
        PID:4796
        
        C:\Windows\SysWOW64\Aimogakj.exe
        
        C:\Windows\system32\Aimogakj.exe
        97⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\Aadghn32.exe
        
        C:\Windows\system32\Aadghn32.exe
        98⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\Ajmladbl.exe
        
        C:\Windows\system32\Ajmladbl.exe
        99⤵
        
        PID:2516
        
        C:\Windows\SysWOW64\Abhqefpg.exe
        
        C:\Windows\system32\Abhqefpg.exe
        100⤵
        
        PID:11872
        
        C:\Windows\SysWOW64\Aibibp32.exe
        
        C:\Windows\system32\Aibibp32.exe
        101⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\Aaiqcnhg.exe
        
        C:\Windows\system32\Aaiqcnhg.exe
        102⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\Affikdfn.exe
        
        C:\Windows\system32\Affikdfn.exe
        103⤵
        
        PID:1468
        
        C:\Windows\SysWOW64\Ampaho32.exe
        
        C:\Windows\system32\Ampaho32.exe
        104⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\Adjjeieh.exe
        
        C:\Windows\system32\Adjjeieh.exe
        105⤵
        
        PID:1388
        
        C:\Windows\SysWOW64\Bigbmpco.exe
        
        C:\Windows\system32\Bigbmpco.exe
        106⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\Bboffejp.exe
        
        C:\Windows\system32\Bboffejp.exe
        107⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\Biiobo32.exe
        
        C:\Windows\system32\Biiobo32.exe
        108⤵
        Drops file in System32 directory
        
        PID:3480
        
        C:\Windows\SysWOW64\Bdocph32.exe
        
        C:\Windows\system32\Bdocph32.exe
        109⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\Biklho32.exe
        
        C:\Windows\system32\Biklho32.exe
        110⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1956
        
        C:\Windows\SysWOW64\Bkkhbb32.exe
        
        C:\Windows\system32\Bkkhbb32.exe
        112⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\Bmidnm32.exe
        
        C:\Windows\system32\Bmidnm32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3140
        
        C:\Windows\SysWOW64\Bbfmgd32.exe
        
        C:\Windows\system32\Bbfmgd32.exe
        114⤵
        
        PID:4648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 13016 -ip 13016
1⤵
PID:13080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aoabad32.exe

Filesize
64KB

MD5
dd92afdafa79999ce4af12a74a3df5a4

SHA1
ba385caccb3523513c620e96f829ff8b50c48e06

SHA256
b030b9121ffd9b63b80ea39da81c4659a410581dc3ed63d982605e4e8779531a

SHA512
39633902fc362c671183518d5588044546cff6008960ad39467343e58170c24818fd9422ededd008b3539bbc62e9394cdbc7c59ca285f31f917a8a7a1c585124

Download Submit
C:\Windows\SysWOW64\Bacjdbch.exe

Filesize
155KB

MD5
2c4425dd458c6559d00475ecfa49b125

SHA1
d905a2e86d2e6dadf90f73dfeef42e112f61fc7c

SHA256
a757d65a7f08d36a55636ea091b4ddfeac54aaa57da461e95868e196ec1ab58e

SHA512
8f6ceea4b4da7484c95fcf2a4678b48cae0e7b96d93f6decf8ab8c5c83c99aec3725db8d582b8564de0ec827999673c029148e551a3ae5b063061bb22753253d

Download Submit
C:\Windows\SysWOW64\Bemqih32.exe

Filesize
155KB

MD5
011e5d3cd2d80df4aa870ceccdb06792

SHA1
d7ff223a63a83118647ca320b23f71f64d7e949f

SHA256
b87daefc53954047657233fc3051f368779c35a87fccf3baf051155ce2652b72

SHA512
50b0c6b149303ce56e1481ebe51b12bf402418884647f9ff4839ba2a4c6a278b3480342f31ec994e80093353e8aac7b5fca1e0506397c0818703d84b44971595

Download Submit
C:\Windows\SysWOW64\Ebdlangb.exe

Filesize
155KB

MD5
566bbbdfb0b6c2da25c48b7242244d7c

SHA1
43fc98d77bd9cb97ceeedd865e26711a712a45c2

SHA256
a7b7849b183b5db31cf10a3057a640e1fb1c075b1e3564c59222a52849bc221b

SHA512
3d477889d2d89a5ea7303ce4f7b6a636add2e00394f726615e4b3086e53e77d49fd5f05b2f80b6437befbebc5d9d5a14866461c446f4fdc07857b48c24a18208

Download Submit
C:\Windows\SysWOW64\Efhcbodf.exe

Filesize
155KB

MD5
d55bddb91f7287a780a30ced1bb29207

SHA1
d2f14eb5403afc6a053c770d39b61d0c9814ee50

SHA256
19e2ab30e3ae4e1a5b8022432da9c94b53a0612a2119491de96b28ca497434f1

SHA512
6e8ccde8cb76896a2c8f4a4b319c300c06e8b72ff03187c77dd94ca7baf2a352bed450df536d36fee1bb3aaf4dfc7f0e708cf43d849b6545ebbd2f090dfb3b8a

Download Submit
C:\Windows\SysWOW64\Efhcbodf.exe

Filesize
155KB

MD5
d55bddb91f7287a780a30ced1bb29207

SHA1
d2f14eb5403afc6a053c770d39b61d0c9814ee50

SHA256
19e2ab30e3ae4e1a5b8022432da9c94b53a0612a2119491de96b28ca497434f1

SHA512
6e8ccde8cb76896a2c8f4a4b319c300c06e8b72ff03187c77dd94ca7baf2a352bed450df536d36fee1bb3aaf4dfc7f0e708cf43d849b6545ebbd2f090dfb3b8a

Download Submit
C:\Windows\SysWOW64\Ehhpla32.exe

Filesize
155KB

MD5
fb4ccff28db146532da87831edefb792

SHA1
f1b491e1647bc7af2f407f47611ab3162ba275ea

SHA256
bbccad2683d837235c49d1c26a8e7301077cbc8cd78281a53d1429669086f4ac

SHA512
2225f587a5ae3a7148015385112e59c27626d3e3f51f62ac8339958b099725542112591afa977a3384235ada2f0e000e4e16a1635419afd02a98a2e1dd0e3c19

Download Submit
C:\Windows\SysWOW64\Ehhpla32.exe

Filesize
155KB

MD5
fb4ccff28db146532da87831edefb792

SHA1
f1b491e1647bc7af2f407f47611ab3162ba275ea

SHA256
bbccad2683d837235c49d1c26a8e7301077cbc8cd78281a53d1429669086f4ac

SHA512
2225f587a5ae3a7148015385112e59c27626d3e3f51f62ac8339958b099725542112591afa977a3384235ada2f0e000e4e16a1635419afd02a98a2e1dd0e3c19

Download Submit
C:\Windows\SysWOW64\Emehdh32.exe

Filesize
155KB

MD5
a826d8bf5df9b22b9e47f7cee6701042

SHA1
8c78b935add07ee89fd5dfd41e609802fc5e53b0

SHA256
7a43c8957e11a2dbfad8d9a346e64c5cde493e490c0882397ec75e718e2b5d33

SHA512
23a7490f1a34052c060329f6f7b257db6e5070bbce9ca0e5b3fc293dc021905171ed5fabea9ddc816007956334b7a7ce52b24c1e88dd2e9d95b7d9ff772d12cb

Download Submit
C:\Windows\SysWOW64\Emehdh32.exe

Filesize
155KB

MD5
a826d8bf5df9b22b9e47f7cee6701042

SHA1
8c78b935add07ee89fd5dfd41e609802fc5e53b0

SHA256
7a43c8957e11a2dbfad8d9a346e64c5cde493e490c0882397ec75e718e2b5d33

SHA512
23a7490f1a34052c060329f6f7b257db6e5070bbce9ca0e5b3fc293dc021905171ed5fabea9ddc816007956334b7a7ce52b24c1e88dd2e9d95b7d9ff772d12cb

Download Submit
C:\Windows\SysWOW64\Facqkg32.exe

Filesize
155KB

MD5
f24fd1ab03671e54d843d289f1d000e3

SHA1
49eff647295b20939d09b7eca5300940476cedb2

SHA256
5d0c9965d00682112502ba8e0a4edca6c3226938f14c01fb3c91f8f965b955e3

SHA512
1cec34fdd901b866e38cd43796df34571aeb12ff57964e508aaa69dede40810fcb6fc512d2bfd928cb828ebbf0a25812e950ad430189bd843f9c68303df9d539

Download Submit
C:\Windows\SysWOW64\Facqkg32.exe

Filesize
155KB

MD5
f24fd1ab03671e54d843d289f1d000e3

SHA1
49eff647295b20939d09b7eca5300940476cedb2

SHA256
5d0c9965d00682112502ba8e0a4edca6c3226938f14c01fb3c91f8f965b955e3

SHA512
1cec34fdd901b866e38cd43796df34571aeb12ff57964e508aaa69dede40810fcb6fc512d2bfd928cb828ebbf0a25812e950ad430189bd843f9c68303df9d539

Download Submit
C:\Windows\SysWOW64\Ffpicn32.exe

Filesize
155KB

MD5
53244d6b85579babdefb79b1928227ab

SHA1
200cb545d358b8ec5b556565ead15d938c50ae1e

SHA256
f1afa2c0c680ed0ddce92c6bc486510ca7dfc381d25908ea63448811486054c9

SHA512
c5cf81f6186b61b21c3a104c4e5e057cc793218217ee0111c79162687641de8b9c599cb4dcc2200bab6e3cb1bbc4d0c4240bbb273d85e8faa431a3180bcf7a64

Download Submit
C:\Windows\SysWOW64\Ffpicn32.exe

Filesize
155KB

MD5
53244d6b85579babdefb79b1928227ab

SHA1
200cb545d358b8ec5b556565ead15d938c50ae1e

SHA256
f1afa2c0c680ed0ddce92c6bc486510ca7dfc381d25908ea63448811486054c9

SHA512
c5cf81f6186b61b21c3a104c4e5e057cc793218217ee0111c79162687641de8b9c599cb4dcc2200bab6e3cb1bbc4d0c4240bbb273d85e8faa431a3180bcf7a64

Download Submit
C:\Windows\SysWOW64\Fgdbnmji.exe

Filesize
155KB

MD5
f455ce286649a1ef21b6d92f06327403

SHA1
1b67299d3b7763470e9e1552beb5ef20fe564eb4

SHA256
19b9e24633c6015c4c35cce3a070351621a123e5d25df9fdc3c4d3ad41abe476

SHA512
7291ffb4851dd5f7704edc7a62ec0f189f6a4e7c2606f3983573e86574aece41ffe6ad0cb94fb9dcefe71d8461f0dbaedc16d34c663d46241163847904015486

Download Submit
C:\Windows\SysWOW64\Fgdbnmji.exe

Filesize
155KB

MD5
f455ce286649a1ef21b6d92f06327403

SHA1
1b67299d3b7763470e9e1552beb5ef20fe564eb4

SHA256
19b9e24633c6015c4c35cce3a070351621a123e5d25df9fdc3c4d3ad41abe476

SHA512
7291ffb4851dd5f7704edc7a62ec0f189f6a4e7c2606f3983573e86574aece41ffe6ad0cb94fb9dcefe71d8461f0dbaedc16d34c663d46241163847904015486

Download Submit
C:\Windows\SysWOW64\Fggocmhf.exe

Filesize
155KB

MD5
0db4d7b5413bf25faa0af4b36f783280

SHA1
09968030f82423eb90c6df32866e6f057f9e107f

SHA256
a784a54c8f78e5eeb59e35acde38c80cccf440a84a7783dbe9ce63ec123715b4

SHA512
9507352b98d14aa29b79d1fd0bf0e23fc5dd35f9c1a5d430faf16b3867b9fedd05ae61eb8e66ee36ed5dfe70d9eb295d1e040fc466a7a8b985ef7d517228a88f

Download Submit
C:\Windows\SysWOW64\Fggocmhf.exe

Filesize
155KB

MD5
0db4d7b5413bf25faa0af4b36f783280

SHA1
09968030f82423eb90c6df32866e6f057f9e107f

SHA256
a784a54c8f78e5eeb59e35acde38c80cccf440a84a7783dbe9ce63ec123715b4

SHA512
9507352b98d14aa29b79d1fd0bf0e23fc5dd35f9c1a5d430faf16b3867b9fedd05ae61eb8e66ee36ed5dfe70d9eb295d1e040fc466a7a8b985ef7d517228a88f

Download Submit
C:\Windows\SysWOW64\Fhflnpoi.exe

Filesize
155KB

MD5
f0d0382f59a7a49074b288648b9318cb

SHA1
4c4f072ebd0d2f81ca7d24341b4a2463a57862b7

SHA256
85744785b942af6d001d180a829ed5b6cda553f896ab7f6b1ddccd623d1865dc

SHA512
a30e6741d00a467986ea81efe00279fe87ccef0c0ebed4d4e0068046813445a57c97423f3783f6dbd4da3e82335c41a2a1f24c1312335c04f7fd71b49d7d8a69

Download Submit
C:\Windows\SysWOW64\Fhflnpoi.exe

Filesize
155KB

MD5
f0d0382f59a7a49074b288648b9318cb

SHA1
4c4f072ebd0d2f81ca7d24341b4a2463a57862b7

SHA256
85744785b942af6d001d180a829ed5b6cda553f896ab7f6b1ddccd623d1865dc

SHA512
a30e6741d00a467986ea81efe00279fe87ccef0c0ebed4d4e0068046813445a57c97423f3783f6dbd4da3e82335c41a2a1f24c1312335c04f7fd71b49d7d8a69

Download Submit
C:\Windows\SysWOW64\Fknbil32.exe

Filesize
155KB

MD5
62428cf0a907801d6da083f02ed38ec5

SHA1
d550ceb61f3c17df651a3e224900a8fd4d0fc15c

SHA256
af02d1d16e2e04c5dd3cc9e0c4a8af8d6bcc2ee281eda8f448cfa23279a89759

SHA512
02d01b0f99e70ac7f3db8a0fd8178536c8f4ca4d9bdd281e7c65ae374495598dc688a1f747758c3e47567f64bb82be8fa02283dd33ee06b71008efc215f2d70e

Download Submit
C:\Windows\SysWOW64\Fknbil32.exe

Filesize
155KB

MD5
62428cf0a907801d6da083f02ed38ec5

SHA1
d550ceb61f3c17df651a3e224900a8fd4d0fc15c

SHA256
af02d1d16e2e04c5dd3cc9e0c4a8af8d6bcc2ee281eda8f448cfa23279a89759

SHA512
02d01b0f99e70ac7f3db8a0fd8178536c8f4ca4d9bdd281e7c65ae374495598dc688a1f747758c3e47567f64bb82be8fa02283dd33ee06b71008efc215f2d70e

Download Submit
C:\Windows\SysWOW64\Gahcmd32.exe

Filesize
155KB

MD5
9257a6bd43b645c9b8f3334dcafcc877

SHA1
56a84f7b07e473a79fa482c6f310b350468604ce

SHA256
37930eced7f11dafeba97a6ee73d8d3d6d9631974533d3f5f9b6bd30b29504c8

SHA512
d91125768b40bbf0b93316e940723dd73dc9f37be85fa3e35e6a07ec073dc98cf8cd9ee0a664e8a60f279612525eb22015a8e81949f750870ff1845e9ded24e8

Download Submit
C:\Windows\SysWOW64\Gahcmd32.exe

Filesize
155KB

MD5
9257a6bd43b645c9b8f3334dcafcc877

SHA1
56a84f7b07e473a79fa482c6f310b350468604ce

SHA256
37930eced7f11dafeba97a6ee73d8d3d6d9631974533d3f5f9b6bd30b29504c8

SHA512
d91125768b40bbf0b93316e940723dd73dc9f37be85fa3e35e6a07ec073dc98cf8cd9ee0a664e8a60f279612525eb22015a8e81949f750870ff1845e9ded24e8

Download Submit
C:\Windows\SysWOW64\Gaopfe32.exe

Filesize
155KB

MD5
f7fb80628700a6933a584c63df559fc7

SHA1
834d26f2bafc3d89b837b1b0dc23d567a5262e0f

SHA256
35bceb1158360db349b13cff31d9df0d6a1ff9cee529ec4c40cb252252844cb7

SHA512
ac02c316e0f762e5008b0c7fa804a929bd11074f0bb3c40ed84ce0a1980bb77edb733bd08ef36f21aa7f4e811873a38a81f9ea70116d4495c7bc81f5139187f7

Download Submit
C:\Windows\SysWOW64\Gaopfe32.exe

Filesize
155KB

MD5
f7fb80628700a6933a584c63df559fc7

SHA1
834d26f2bafc3d89b837b1b0dc23d567a5262e0f

SHA256
35bceb1158360db349b13cff31d9df0d6a1ff9cee529ec4c40cb252252844cb7

SHA512
ac02c316e0f762e5008b0c7fa804a929bd11074f0bb3c40ed84ce0a1980bb77edb733bd08ef36f21aa7f4e811873a38a81f9ea70116d4495c7bc81f5139187f7

Download Submit
C:\Windows\SysWOW64\Gdoihpbk.exe

Filesize
155KB

MD5
8ec8f371efa577969d7e57f5504a2df9

SHA1
a574243bcc9ae1e6dbfd72d1dc40c00e7f78f829

SHA256
99eeef70d6978fa1275d695b34901763c7e881de033595aafb09780705c7d8cf

SHA512
705fe1da5d552ca1814c69b56e55c932b1bb7afd88c6ffa7e38b1a6459fa35d466d8c828e4e5a348a6062fd0c0c697ef79db1d68706f4a9a353754d41ba376eb

Download Submit
C:\Windows\SysWOW64\Gdoihpbk.exe

Filesize
155KB

MD5
8ec8f371efa577969d7e57f5504a2df9

SHA1
a574243bcc9ae1e6dbfd72d1dc40c00e7f78f829

SHA256
99eeef70d6978fa1275d695b34901763c7e881de033595aafb09780705c7d8cf

SHA512
705fe1da5d552ca1814c69b56e55c932b1bb7afd88c6ffa7e38b1a6459fa35d466d8c828e4e5a348a6062fd0c0c697ef79db1d68706f4a9a353754d41ba376eb

Download Submit
C:\Windows\SysWOW64\Ghmbno32.exe

Filesize
155KB

MD5
ec205d27e1f64e6bd2bf276a40ac79c7

SHA1
e9ad7a635ea3affe63dfd34ff12769407e51dcb0

SHA256
726a073316879f0ec38995f68e39447ea425273f9ba541d35734fdfcc7c7f5d9

SHA512
ac670cd8888e5e3da3d7f4f469546724910bb5e449fa5574382fc456ec50d4ba10ec67bdc431477bda4ce64184221cc5a063bfdcd61b7dbf397b1fbd60d04e07

Download Submit
C:\Windows\SysWOW64\Ghmbno32.exe

Filesize
155KB

MD5
ec205d27e1f64e6bd2bf276a40ac79c7

SHA1
e9ad7a635ea3affe63dfd34ff12769407e51dcb0

SHA256
726a073316879f0ec38995f68e39447ea425273f9ba541d35734fdfcc7c7f5d9

SHA512
ac670cd8888e5e3da3d7f4f469546724910bb5e449fa5574382fc456ec50d4ba10ec67bdc431477bda4ce64184221cc5a063bfdcd61b7dbf397b1fbd60d04e07

Download Submit
C:\Windows\SysWOW64\Gphgbafl.exe

Filesize
155KB

MD5
7dba1e89e105683ee4bce882ec2d0370

SHA1
01d19f58ef4dc127bfabac6c43453e05a2758973

SHA256
721bcb9ba258b62d3d88e53ae2c13690a4a80c3616f49631ba085cf8def9969e

SHA512
adf41eaf0a0d7c78c2f5d6623b8759b6e81e6657fc2278402b239c135e9fa74eac83b5b1a74ace39b4029149ba6126780b507fa29bef0a27a8edb047085f113a

Download Submit
C:\Windows\SysWOW64\Gphgbafl.exe

Filesize
155KB

MD5
7dba1e89e105683ee4bce882ec2d0370

SHA1
01d19f58ef4dc127bfabac6c43453e05a2758973

SHA256
721bcb9ba258b62d3d88e53ae2c13690a4a80c3616f49631ba085cf8def9969e

SHA512
adf41eaf0a0d7c78c2f5d6623b8759b6e81e6657fc2278402b239c135e9fa74eac83b5b1a74ace39b4029149ba6126780b507fa29bef0a27a8edb047085f113a

Download Submit
C:\Windows\SysWOW64\Hajpbckl.exe

Filesize
155KB

MD5
0b99384466aa9ae6dc8ccab4781b323b

SHA1
96c54b83598c7b7057cc675b3b64feae1d71bb4b

SHA256
f9256f9c3c37c02603ad1e0407240ae1fa2ea12823e5892c4598f61084fa927f

SHA512
07b8432af5e0d2975254b2f8da9493c6e686d24b9b32e01909b592783c6a16ba9be952d78f27f7bc7862b92fc1eb8e2de5ade022fbc887d838c96684d5fce442

Download Submit
C:\Windows\SysWOW64\Hajpbckl.exe

Filesize
155KB

MD5
0b99384466aa9ae6dc8ccab4781b323b

SHA1
96c54b83598c7b7057cc675b3b64feae1d71bb4b

SHA256
f9256f9c3c37c02603ad1e0407240ae1fa2ea12823e5892c4598f61084fa927f

SHA512
07b8432af5e0d2975254b2f8da9493c6e686d24b9b32e01909b592783c6a16ba9be952d78f27f7bc7862b92fc1eb8e2de5ade022fbc887d838c96684d5fce442

Download Submit
C:\Windows\SysWOW64\Hammhcij.exe

Filesize
155KB

MD5
e6b23c36657ada5ebc26ec064dbb7469

SHA1
221961a539bbd2e77a78607a04075271a139ee46

SHA256
01cd3efe79123f9733949bd077809990870da8618df0bd098564b33976ff3e4a

SHA512
c02cc70436e9fef4227ad898aad9d2f5508b069ee669dada4233e9aa5f6e4347240d4a9929708689d4523ec9f2d2269d6eb50427994883a90351171e85a7d002

Download Submit
C:\Windows\SysWOW64\Hammhcij.exe

Filesize
155KB

MD5
e6b23c36657ada5ebc26ec064dbb7469

SHA1
221961a539bbd2e77a78607a04075271a139ee46

SHA256
01cd3efe79123f9733949bd077809990870da8618df0bd098564b33976ff3e4a

SHA512
c02cc70436e9fef4227ad898aad9d2f5508b069ee669dada4233e9aa5f6e4347240d4a9929708689d4523ec9f2d2269d6eb50427994883a90351171e85a7d002

Download Submit
C:\Windows\SysWOW64\Hdpbon32.exe

Filesize
155KB

MD5
528b2d3a98618510bc968d04041b7735

SHA1
e40f7a1087f1c738068316fbf343e4d0cad1a52d

SHA256
e3293ca7d1bfe9fe801dddd1b891b4951f983830312c882ea1320a76e5117163

SHA512
9bc3314210de1ddbc3b51beb0c99f55199802722ea0c1a4f8a25fa1b2ff12be72b44b064eef8e4010aa4cacb8900ad9e73c9c0616f6088cdf35aa173c8124470

Download Submit
C:\Windows\SysWOW64\Hdpbon32.exe

Filesize
155KB

MD5
528b2d3a98618510bc968d04041b7735

SHA1
e40f7a1087f1c738068316fbf343e4d0cad1a52d

SHA256
e3293ca7d1bfe9fe801dddd1b891b4951f983830312c882ea1320a76e5117163

SHA512
9bc3314210de1ddbc3b51beb0c99f55199802722ea0c1a4f8a25fa1b2ff12be72b44b064eef8e4010aa4cacb8900ad9e73c9c0616f6088cdf35aa173c8124470

Download Submit
C:\Windows\SysWOW64\Hkeaqi32.exe

Filesize
155KB

MD5
4dd834ac1438c2d7c09ab06d6c4b4c8e

SHA1
cd9a394e56d5fbdaf22b0e5797f4f5e2d39dba7f

SHA256
7b8b0202d29cfad059ce014f099b82196de55a217e7aef4cdde2e077321868a3

SHA512
c81fd3d8b3594e807988f7ceab3fa1600897e33a9c6f814dd0cf4205438e3d76cce39b655cd72abbec99fc5e0085de5ac98551ffb9ceaed9bac7030873c43b40

Download Submit
C:\Windows\SysWOW64\Hkeaqi32.exe

Filesize
155KB

MD5
4dd834ac1438c2d7c09ab06d6c4b4c8e

SHA1
cd9a394e56d5fbdaf22b0e5797f4f5e2d39dba7f

SHA256
7b8b0202d29cfad059ce014f099b82196de55a217e7aef4cdde2e077321868a3

SHA512
c81fd3d8b3594e807988f7ceab3fa1600897e33a9c6f814dd0cf4205438e3d76cce39b655cd72abbec99fc5e0085de5ac98551ffb9ceaed9bac7030873c43b40

Download Submit
C:\Windows\SysWOW64\Hlmchoan.exe

Filesize
155KB

MD5
a227b2b0e790fc23fb32fc0ce4b5a74a

SHA1
e3b36823cb055776efa9756da7c281b50dde783a

SHA256
70479dc03f9f77534d30e7ca6a48abdcd26ce3c80b6418240d3268c15657102c

SHA512
6d61c9d1f361ca3019f20cf6a89aea87793e3e24117b92bf02cc04de8f4f8155e1d8973972f5fce0802b0e00c0c51ca0dd0196f003cf65981358a5d1aea95d21

Download Submit
C:\Windows\SysWOW64\Hmbfbn32.exe

Filesize
155KB

MD5
f519a1afa55182f50c9afd6e34893193

SHA1
6c2035bfd83c4ccb1f23f32d595c8209962cb409

SHA256
63a81ef3d83090c75f2cb7f5adfcb45aef3537a233974b6215d1a5c36774e70e

SHA512
760b5d498e9257e42414646e7d18e88de557057c89668dabc1402876ca9a03b49940252a6fbe38affbe87b8ae1366d04254df7ff2d56bcdc10ba1b3b8c2e24b6

Download Submit
C:\Windows\SysWOW64\Hpfcdojl.exe

Filesize
155KB

MD5
528b2d3a98618510bc968d04041b7735

SHA1
e40f7a1087f1c738068316fbf343e4d0cad1a52d

SHA256
e3293ca7d1bfe9fe801dddd1b891b4951f983830312c882ea1320a76e5117163

SHA512
9bc3314210de1ddbc3b51beb0c99f55199802722ea0c1a4f8a25fa1b2ff12be72b44b064eef8e4010aa4cacb8900ad9e73c9c0616f6088cdf35aa173c8124470

Download Submit
C:\Windows\SysWOW64\Hpfcdojl.exe

Filesize
155KB

MD5
19c8e36aeab38002928cb885d1a88f3b

SHA1
194e6d1dbaf28426929530bf9540cb50b645e815

SHA256
6421cd380ca7e8dd4fc32bf6dfe01412ad7d6b6372a28737f2311347f671c104

SHA512
8a789244459224ce795301f3439fbc2dbc894958379bd9899d9513b2f274dfa30592fdb4872ffb495760db42b2bfd80f338ba5a9978d68ae1f7083546dad3d0f

Download Submit
C:\Windows\SysWOW64\Hpfcdojl.exe

Filesize
155KB

MD5
19c8e36aeab38002928cb885d1a88f3b

SHA1
194e6d1dbaf28426929530bf9540cb50b645e815

SHA256
6421cd380ca7e8dd4fc32bf6dfe01412ad7d6b6372a28737f2311347f671c104

SHA512
8a789244459224ce795301f3439fbc2dbc894958379bd9899d9513b2f274dfa30592fdb4872ffb495760db42b2bfd80f338ba5a9978d68ae1f7083546dad3d0f

Download Submit
C:\Windows\SysWOW64\Iahlcaol.exe

Filesize
155KB

MD5
7faa6ba819d70eefb8a7c2f9ad92fe8c

SHA1
6ff0ec4729c0b4998e02848cd5c40399b1e1c069

SHA256
d8f74509bdb7b36894af6d4dde0e948dbe3f613ee9338acbb80d210f89f2d6ab

SHA512
6a42a7ae6861156a50f7374886833b3bdff7ed067b40e8296e751a0bd74e2145a24b0fd2266ebfa045df4ef7240d0a8e05852ebd20ec8285bd5e97fbb8d40708

Download Submit
C:\Windows\SysWOW64\Iahlcaol.exe

Filesize
155KB

MD5
7faa6ba819d70eefb8a7c2f9ad92fe8c

SHA1
6ff0ec4729c0b4998e02848cd5c40399b1e1c069

SHA256
d8f74509bdb7b36894af6d4dde0e948dbe3f613ee9338acbb80d210f89f2d6ab

SHA512
6a42a7ae6861156a50f7374886833b3bdff7ed067b40e8296e751a0bd74e2145a24b0fd2266ebfa045df4ef7240d0a8e05852ebd20ec8285bd5e97fbb8d40708

Download Submit
C:\Windows\SysWOW64\Idieem32.exe

Filesize
155KB

MD5
222c6edf3c2810e127fc8681488e628a

SHA1
0e2bdf508b4af410bb8111b8b8392db65d858319

SHA256
2714606563dd26a55efa218517ff9b9e0c24f2e609a2daaa7f5dba860bf07e5d

SHA512
e199a7095f240107101666f122d1e3f38151f8643f7fde535656e5d1d7f8b8655831183290e6b4d4b460263befc2ad41530812a60d00f5c0e0203cb0df3fc420

Download Submit
C:\Windows\SysWOW64\Idieem32.exe

Filesize
155KB

MD5
222c6edf3c2810e127fc8681488e628a

SHA1
0e2bdf508b4af410bb8111b8b8392db65d858319

SHA256
2714606563dd26a55efa218517ff9b9e0c24f2e609a2daaa7f5dba860bf07e5d

SHA512
e199a7095f240107101666f122d1e3f38151f8643f7fde535656e5d1d7f8b8655831183290e6b4d4b460263befc2ad41530812a60d00f5c0e0203cb0df3fc420

Download Submit
C:\Windows\SysWOW64\Idieem32.exe

Filesize
155KB

MD5
222c6edf3c2810e127fc8681488e628a

SHA1
0e2bdf508b4af410bb8111b8b8392db65d858319

SHA256
2714606563dd26a55efa218517ff9b9e0c24f2e609a2daaa7f5dba860bf07e5d

SHA512
e199a7095f240107101666f122d1e3f38151f8643f7fde535656e5d1d7f8b8655831183290e6b4d4b460263befc2ad41530812a60d00f5c0e0203cb0df3fc420

Download Submit
C:\Windows\SysWOW64\Igedlh32.exe

Filesize
155KB

MD5
cfcf0ee868e846892a4342982d8725f5

SHA1
0c12217f3ec8fabed4a95d7021b9a42e7cb1e4f7

SHA256
3f23af3b551d904ff2587c3a6cec133eedbe13483175ce0a5c893eac554df02b

SHA512
def35a470fb4f56432317181439a9fd5682cec20d481ba424c1de02b3db9f812dbdc279639807b2f9bb1c9b51fa387af1f1d514f119ed946a7cbbbd51f5ca062

Download Submit
C:\Windows\SysWOW64\Igedlh32.exe

Filesize
155KB

MD5
cfcf0ee868e846892a4342982d8725f5

SHA1
0c12217f3ec8fabed4a95d7021b9a42e7cb1e4f7

SHA256
3f23af3b551d904ff2587c3a6cec133eedbe13483175ce0a5c893eac554df02b

SHA512
def35a470fb4f56432317181439a9fd5682cec20d481ba424c1de02b3db9f812dbdc279639807b2f9bb1c9b51fa387af1f1d514f119ed946a7cbbbd51f5ca062

Download Submit
C:\Windows\SysWOW64\Jaajhb32.exe

Filesize
155KB

MD5
520dfce1b6e0ff5aa96ffe58490346ad

SHA1
9ef3f249ea249a4b24f0a4b1d4f348f95218a8c4

SHA256
1af54a0d71233f4816fc123574e5df168d23cf7b8e959db599ad105bbf0c3af3

SHA512
1e496c677e25e9b34b542c9748e16fb13b6463d32396e8f5a2a95589863b76345d803cdbbf5fbb4560ce00178af34e70ef9de65737f65fca1a07cc5f100051cc

Download Submit
C:\Windows\SysWOW64\Jbfheo32.exe

Filesize
155KB

MD5
b719af2e117055bd443d673794c5bd5d

SHA1
f9023340d1dfe2715a3804ac17c194b51145f801

SHA256
426724202e66d5f3548bf1513d19fb446060e78e54d3378667f5712a41aed704

SHA512
9466e26595719629e7a6b67ce3381bb9f02e7eb7daabb5da210fc559db2f84d455a0810726fe6dcb2b63fd285998c7fde69b187f08ce76149147300a6b9c5cb9

Download Submit
C:\Windows\SysWOW64\Jbfheo32.exe

Filesize
155KB

MD5
b719af2e117055bd443d673794c5bd5d

SHA1
f9023340d1dfe2715a3804ac17c194b51145f801

SHA256
426724202e66d5f3548bf1513d19fb446060e78e54d3378667f5712a41aed704

SHA512
9466e26595719629e7a6b67ce3381bb9f02e7eb7daabb5da210fc559db2f84d455a0810726fe6dcb2b63fd285998c7fde69b187f08ce76149147300a6b9c5cb9

Download Submit
C:\Windows\SysWOW64\Jbkbpoog.exe

Filesize
155KB

MD5
943d4236ad79f58b4522ed7a0f17d351

SHA1
099f0c40697739535ff1ccd70d27a19e832a7c72

SHA256
0df64b923181a74eccf4b26315c7ea6250c10f6ad9c7bd77eb3c3416d7dff3fb

SHA512
9a94dfaf0f5b0c017022a83c65c8280662a3d11d1b136235e4b858e04c69787d1af5f026a9a82513e0b890f813489dc6624d1edf25d8f381f69fe59715b16be8

Download Submit
C:\Windows\SysWOW64\Jbkbpoog.exe

Filesize
155KB

MD5
943d4236ad79f58b4522ed7a0f17d351

SHA1
099f0c40697739535ff1ccd70d27a19e832a7c72

SHA256
0df64b923181a74eccf4b26315c7ea6250c10f6ad9c7bd77eb3c3416d7dff3fb

SHA512
9a94dfaf0f5b0c017022a83c65c8280662a3d11d1b136235e4b858e04c69787d1af5f026a9a82513e0b890f813489dc6624d1edf25d8f381f69fe59715b16be8

Download Submit
C:\Windows\SysWOW64\Jgkdbacp.exe

Filesize
155KB

MD5
90621cff2335cc168ee5e2a72232f10b

SHA1
f522807caea0ce1eb38d01cb86cb714a35b4d14a

SHA256
b28edb9ebdbff8ce41df75b28c9fddc071018e1528828bcdd9a6b688e8b67c3a

SHA512
90dbe65991256fc0c8694c850ae633f962d82aa440c012350aaf2cf4b824fc969081baed70a90ea854271d1ba025a1bee7b935578c01b5e642f95b65e0e73c9a

Download Submit
C:\Windows\SysWOW64\Jhndljll.exe

Filesize
155KB

MD5
8b0d517c6895ada68a86e592c9cded07

SHA1
38cef959089c25089a47079c401a2f8a0dfbf1d8

SHA256
7f97843d29265ca88ec81677c3034b3ac6dcce6e95e51d3f64b549f0ee0683f7

SHA512
afcf2204c2d6069e539f81960e98b225bcea5c24fc44a8e10f9d89ac56eb4a59bb5729a9d054e238630dada08c9c0ccafd19eb0b43e1c98916b6540d0ceb3cd8

Download Submit
C:\Windows\SysWOW64\Jhndljll.exe

Filesize
155KB

MD5
8b0d517c6895ada68a86e592c9cded07

SHA1
38cef959089c25089a47079c401a2f8a0dfbf1d8

SHA256
7f97843d29265ca88ec81677c3034b3ac6dcce6e95e51d3f64b549f0ee0683f7

SHA512
afcf2204c2d6069e539f81960e98b225bcea5c24fc44a8e10f9d89ac56eb4a59bb5729a9d054e238630dada08c9c0ccafd19eb0b43e1c98916b6540d0ceb3cd8

Download Submit
C:\Windows\SysWOW64\Jibmgi32.exe

Filesize
155KB

MD5
9fd93474d6cc82b0ff1c5be393f850fd

SHA1
2f99013a17c49130fa4a698f56bf93ba773b6db6

SHA256
e2dadfdb9942c91fb04d59c2f2fef908600a74112ebeca10507bea6941628fe2

SHA512
98090cccede42744b6b2c2e8a8209c5414a03c8005ac545f8b1f159c4f4829fc9bc18910e44fa832fc61388a6376f55dce57559b86a24791cfa58cb7651b3193

Download Submit
C:\Windows\SysWOW64\Jibmgi32.exe

Filesize
155KB

MD5
9fd93474d6cc82b0ff1c5be393f850fd

SHA1
2f99013a17c49130fa4a698f56bf93ba773b6db6

SHA256
e2dadfdb9942c91fb04d59c2f2fef908600a74112ebeca10507bea6941628fe2

SHA512
98090cccede42744b6b2c2e8a8209c5414a03c8005ac545f8b1f159c4f4829fc9bc18910e44fa832fc61388a6376f55dce57559b86a24791cfa58cb7651b3193

Download Submit
C:\Windows\SysWOW64\Jjamia32.exe

Filesize
155KB

MD5
4b5d8c423d6b94cf91ae759986d92216

SHA1
72d06ce31e7090a98ca8d9035319d6694e47bf49

SHA256
8071ce4d784ad7add1c07611706766406838090abc2fc484eb1c4e1e8c3609a6

SHA512
6fda56e1ace844c681b24593f876e5ca96f00d8555afa36664c625a8145ee47647ddcabf7aaeae63b952a006b48f37be6131faad0c3853030859c3e51bbb6d2d

Download Submit
C:\Windows\SysWOW64\Jjamia32.exe

Filesize
155KB

MD5
4b5d8c423d6b94cf91ae759986d92216

SHA1
72d06ce31e7090a98ca8d9035319d6694e47bf49

SHA256
8071ce4d784ad7add1c07611706766406838090abc2fc484eb1c4e1e8c3609a6

SHA512
6fda56e1ace844c681b24593f876e5ca96f00d8555afa36664c625a8145ee47647ddcabf7aaeae63b952a006b48f37be6131faad0c3853030859c3e51bbb6d2d

Download Submit
C:\Windows\SysWOW64\Jjjghcfp.exe

Filesize
155KB

MD5
7725a54c7b4442797989f1bb71f2fb5e

SHA1
fb9bf0535ab7d0b35a917cdbdd0fcd01cea29783

SHA256
0ab8ce9e1569cccbb4e9a5c38c20f28eeb117827d3b838ed612b3bf8797a20fa

SHA512
6ad529484ffb7c5b9a72dd9f7572bb3d9d19a06696b6e3868a286b214a9eda3ec62b45b9779e481773a3e1a47279ce83b574fae1046fc571ab2e27d68c599fdd

Download Submit
C:\Windows\SysWOW64\Jjjghcfp.exe

Filesize
155KB

MD5
7725a54c7b4442797989f1bb71f2fb5e

SHA1
fb9bf0535ab7d0b35a917cdbdd0fcd01cea29783

SHA256
0ab8ce9e1569cccbb4e9a5c38c20f28eeb117827d3b838ed612b3bf8797a20fa

SHA512
6ad529484ffb7c5b9a72dd9f7572bb3d9d19a06696b6e3868a286b214a9eda3ec62b45b9779e481773a3e1a47279ce83b574fae1046fc571ab2e27d68c599fdd

Download Submit
C:\Windows\SysWOW64\Jnhpoamf.exe

Filesize
155KB

MD5
4ef5fd3fb9a4f0bab19d11b2a0b11ec3

SHA1
ee6f44b8305bde33e9ec8a0b2f7eff846f63f68e

SHA256
e867cc36cd9461422692b1fe13558835676da0e1a37e4af5fc6a1b7e177da505

SHA512
e8cef38590b2894a499e7a6b892f8e2bf29dc3068e4640642d4c1b80bb5a49c5a5d700b214b7c8507bf2b57812890677c0907afbf086672a7c3172f0fcfe251d

Download Submit
C:\Windows\SysWOW64\Jnhpoamf.exe

Filesize
155KB

MD5
4ef5fd3fb9a4f0bab19d11b2a0b11ec3

SHA1
ee6f44b8305bde33e9ec8a0b2f7eff846f63f68e

SHA256
e867cc36cd9461422692b1fe13558835676da0e1a37e4af5fc6a1b7e177da505

SHA512
e8cef38590b2894a499e7a6b892f8e2bf29dc3068e4640642d4c1b80bb5a49c5a5d700b214b7c8507bf2b57812890677c0907afbf086672a7c3172f0fcfe251d

Download Submit
C:\Windows\SysWOW64\Jqdoem32.exe

Filesize
155KB

MD5
ab8938f583db118df2d3dbf32ce35440

SHA1
1a308188088ea475e6bb7898d0dfc631767687ef

SHA256
b4b36d330b7872ba363c7130a5c0735013ba2f90f98fd9d2f4cad8c962b4f572

SHA512
6093a1c5f0af480e38b7a7827724a5dcbedfb7ec9cb3fd1ab687c0fd190b4de1c77401c37711d512f270670431b97147edcf3b65661599d82b84d1b2179ac10e

Download Submit
C:\Windows\SysWOW64\Jqdoem32.exe

Filesize
155KB

MD5
ab8938f583db118df2d3dbf32ce35440

SHA1
1a308188088ea475e6bb7898d0dfc631767687ef

SHA256
b4b36d330b7872ba363c7130a5c0735013ba2f90f98fd9d2f4cad8c962b4f572

SHA512
6093a1c5f0af480e38b7a7827724a5dcbedfb7ec9cb3fd1ab687c0fd190b4de1c77401c37711d512f270670431b97147edcf3b65661599d82b84d1b2179ac10e

Download Submit
C:\Windows\SysWOW64\Kelkaj32.exe

Filesize
155KB

MD5
86a4379e970edf72e0ecf8884f7813c6

SHA1
a54dd2453b71ed1112136987c6f1fc7959147410

SHA256
28975dce49321bf89b9ac479cd35170e00a29c11ecf5e7319412c1500a992e1b

SHA512
2f3f594a7005922ed79d9f4f501e67f806488adf5c3710a2100405e18022d82f1a06b35acfa3147527866d06541f5a460d252e07fc96b369859c042a558559a1

Download Submit
C:\Windows\SysWOW64\Kelkaj32.exe

Filesize
155KB

MD5
86a4379e970edf72e0ecf8884f7813c6

SHA1
a54dd2453b71ed1112136987c6f1fc7959147410

SHA256
28975dce49321bf89b9ac479cd35170e00a29c11ecf5e7319412c1500a992e1b

SHA512
2f3f594a7005922ed79d9f4f501e67f806488adf5c3710a2100405e18022d82f1a06b35acfa3147527866d06541f5a460d252e07fc96b369859c042a558559a1

Download Submit
C:\Windows\SysWOW64\Kijchhbo.exe

Filesize
155KB

MD5
e53891639a9e82f280137cc7497057d3

SHA1
706cbf40d8b7e9d3a597473f2e546743d6450a1c

SHA256
51f78bf1084533188fe4cb830bbb41d6235d26ef074c8cf1a9fdbb7da035c965

SHA512
8cff6a083cc09e361f12bc1edd3567f23af88d04f0f2b859f4d1762b11b209d0b646cbf35dcb4626b2b05d7db18e98043f0201652c5e2f3df63a0653511747f2

Download Submit
C:\Windows\SysWOW64\Kkcfid32.exe

Filesize
155KB

MD5
ee39a88fdd176dedfbd7276e989d68fc

SHA1
4d62f6db1871ceef81321518df422f26a1a1eb55

SHA256
7645cf6d1a1853ba27af1bb44422a8747ca9529846a02f71bff4fd347fb8780a

SHA512
c30f7e96f0564b0f1b9d19661813fd79b3f1aec8bab0d8117e51a0d754b7168b3dc13313b985d35125ebe8fe3bf74057f13cee8425fd8582029596f02ee42a5b

Download Submit
C:\Windows\SysWOW64\Kkcfid32.exe

Filesize
155KB

MD5
ee39a88fdd176dedfbd7276e989d68fc

SHA1
4d62f6db1871ceef81321518df422f26a1a1eb55

SHA256
7645cf6d1a1853ba27af1bb44422a8747ca9529846a02f71bff4fd347fb8780a

SHA512
c30f7e96f0564b0f1b9d19661813fd79b3f1aec8bab0d8117e51a0d754b7168b3dc13313b985d35125ebe8fe3bf74057f13cee8425fd8582029596f02ee42a5b

Download Submit
C:\Windows\SysWOW64\Likhem32.exe

Filesize
155KB

MD5
5d8520fdbcba8ac0c1e8c5a590d8f38f

SHA1
f21787aa00232276f95a166afebad53a9ec6b2c8

SHA256
4252357cb3b63171c93d0a73afe64bacf3bda605e105b4589ddfc9790642cca2

SHA512
22edd71aa3dc5fd3af1024bece349f0657f28bb60aab02d238e89840f80f9f27ffd549d6ee5949e909dc4e748e05eb4c040edb8e94e754f6f641be20d7d559e5

Download Submit
C:\Windows\SysWOW64\Ljilqnlm.exe

Filesize
155KB

MD5
9f2b7714533bb74d0185485a4020d621

SHA1
0cf58367fd4974fc7ead6442c0956c0b73646996

SHA256
945722be3603856dc36f284b759c2d92dc88650768e03d2ca39da8427542d05b

SHA512
76aafe373cbf7410beba98440669da690f411d676da26aebf2ca8a61711f72fd16273d853b07760dc895007154b44ef94f0272ac302d934ee2a7e32150e2b743

Download Submit
C:\Windows\SysWOW64\Lmgabcge.exe

Filesize
155KB

MD5
508e830871ac02849220790a50be37f6

SHA1
e929e7c03353b2d05839d84015b78329c7e9a349

SHA256
830adf8d42a093e99aeab37a3e7e6e3e87a6f5809154de77e514bff88389dcb5

SHA512
916f0a00b36543959509be4a612e183e4beb031869662f5acead0fbd1b8e3561666cdffaabf718a347412bda1d98780a6272de675e752e8d0e7ea9338e2f8c72

Download Submit
C:\Windows\SysWOW64\Lnpofnhk.exe

Filesize
155KB

MD5
026820716e73838f7faf340796dd646e

SHA1
607a25ce0f00cbc471f6c0f9e6228eb47c7a552a

SHA256
e96b3824ecbf5274678a45315ac4559d2aa44faef897aa6b73ea775b27d75571

SHA512
d5762563433d9fb482090d494a6db7a2d9207a3550884fe29ad0bac368d4c151d570913996a9fc278a35d2621707cb1cc75b744c72cefb5366d97fc207d0fc99

Download Submit
C:\Windows\SysWOW64\Lqpamb32.exe

Filesize
155KB

MD5
4e93dab3e56c5736911e595362e0039e

SHA1
25bce981f7a095ba743b01d019cf97ea37b097de

SHA256
6857a6dda2a627d4b6a421fd49b88f9422567b42db90eb84e56cc574b5d15613

SHA512
04bc615d0120a42f66235d677e74c85d2897f26e934b6497f779b5faf2bc8d8a1305a5373c80212c90b54f6bc49f74f45efdc2ccf836fbf6f8e2851f130eba3a

Download Submit
C:\Windows\SysWOW64\Mjdebfnd.exe

Filesize
155KB

MD5
dab5ece276b82abb49b50843c9c81d95

SHA1
b4f9f6adb960f8a01b3b52b498952d62c713b493

SHA256
18632a048c35d861b6e31fedee3d490b9d7cf3ccfad7ae48ff0a2a35c1d2bb5f

SHA512
0b98e67eea1ea7a92628b5fccc02c5cd6965fc95ed59dbd4b4634801bb50df8a39a418c41f21e438ea8e4c87e3dd0817acaabb4b0945f30309384424f44baf65

Download Submit
C:\Windows\SysWOW64\Mjlalkmd.exe

Filesize
155KB

MD5
44d55e0890edf737d5adf2229fe0cb35

SHA1
fe04d2fec3eb58921a4c871747cb2579373f1f07

SHA256
0573c13e99ac4eba6abdc309a479cb9aa0c44b844155501fe31304cb19c512ac

SHA512
1a7aa139fb766d19f2ebfb0d157b14664914cc13021e62f506373585834cc1743abac97b46dd9b55e7837bd0c089529ad17a4be9adb49e0814e78bbec3f4c0e1

Download Submit
C:\Windows\SysWOW64\Moqeaphi.dll

Filesize
7KB

MD5
ae68946a65a6daaf74043060bd2cb55c

SHA1
8111bef1eb8451b33c4792e3a622e04f9ec953cd

SHA256
673747906e40273c05548b269c44adebfdbe1061e22652a85460a3be4605ba7e

SHA512
dbf38e54a13f7875b2294e8af5ae4af6a115e5dea2421b185907e6bdb120477a44506523dd75bbf72b4ec6990190a2741e642ec4c0e933f3900902ecd3164e55

Download Submit
C:\Windows\SysWOW64\Okjnnj32.exe

Filesize
155KB

MD5
cf133d9ac06c303e76eadf2773d18965

SHA1
d2804def2f97b0b603da1b3a253b0500b39648a4

SHA256
3c09bafa2fb7225684f6d147def9be286172e4c7195ed8b41fe57b9a8e3c135c

SHA512
1ffefc0690c05fd92f84d829a2ff1ab698ed4ea0ba1cde21c899a867fb7b60b38422e2dd503bda1fdef44384a2bc30b7f4b066d3f04c247a34e31eafacb3de36

Download Submit
C:\Windows\SysWOW64\Pakllc32.exe

Filesize
155KB

MD5
c3cbeef7ac9a8f7b0180271b55d68597

SHA1
ca710577d4a94c9313bfa4ecfae45d1991d9f5b8

SHA256
ad681d77b2d1bcd0c194cb92eb57b349785f984af243e29fdbe9a4d516ea001a

SHA512
93814e8863cf87368841e8f545a9b4dd455e6b1648cb6b23c059ba8eb5063c801a46055ffd1b6a88614ef4b565f4de34746dcbfb846b836c84ed1a617f465a6d

Download Submit
C:\Windows\SysWOW64\Pcgdhkem.exe

Filesize
155KB

MD5
40dd07d404515ddb085fa03a4e68078c

SHA1
7a9f5a0380876b7f3c9115d62dc2080aafb038bc

SHA256
547a0685e10a7c23a123ca7dd02742dbc70c2439dce24a6daa03a082345fb70c

SHA512
93abcb8ce6e15c2a2d59c4c2198107509f4a07cac0db230e00dee08d39143a3e5ef00dc0e4f0480a3f370b6b31376fe7eb84a90b3740007cc8ad9739af069c4c

Download Submit
memory/208-55-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/388-322-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/408-135-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/444-95-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/448-184-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/804-418-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1036-304-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1192-192-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1196-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1296-119-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1400-23-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1456-298-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1536-200-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1768-16-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1804-280-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2036-424-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2092-316-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2132-364-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2252-111-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2308-292-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2320-310-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2412-239-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2520-388-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2796-168-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2832-7-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2884-151-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2900-224-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/2968-442-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3012-39-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3056-72-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3212-127-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3224-175-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3248-358-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3268-400-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3300-370-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3312-382-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3652-207-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3712-231-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3904-248-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3916-412-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3944-144-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3948-410-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/3952-160-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4088-87-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4200-376-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4212-274-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4236-334-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4244-64-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4356-436-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4408-286-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4532-48-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4556-79-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4568-430-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4628-268-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4656-352-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4680-262-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4720-394-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4724-328-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4780-103-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4792-346-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4824-32-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4916-340-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4948-216-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/5096-256-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads