a560670a9d637ebf78e1a67eab92304cd19189ac8666c7e088d3edb7a93b462b

Analysis

max time kernel
139s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
10-10-2023 21:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfaee70b2c350d333f2b7659cb6b5c55_JC.exe
Size

100KB
MD5

dfaee70b2c350d333f2b7659cb6b5c55
SHA1

208d3ea2db145f209a915792e214200afb71cdfb
SHA256

a560670a9d637ebf78e1a67eab92304cd19189ac8666c7e088d3edb7a93b462b
SHA512

7e99cd2aa4c0bfbf655c76a19e1a6802dd3fd6426196045d1a4a9fe81d7cb677c968f5a56aeccd1ecf5c756f77d05b0e1fa5c12ba496fe47584d2102d9c3e55f
SSDEEP

1536:DQn9YpOlzvDx8FZtWwSiEwwsq//z+pCttttttttttttttittttttZvttttttOOOd:EnqpOlzVkeFV9OO5xQQMFR8n5j8YD

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncmhko32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cgcmjd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nefped32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lggldm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ddgplado.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Baannc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fgdbnmji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Neoieenp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cjgpfk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mokmdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Bochmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nmbjcljl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Klggli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pamiaboj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hgmgqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lgepom32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Odoogi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qoelkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lhnhajba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnifekmd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eojiqb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ieagmcmq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fplpll32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjfnedho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kkpbin32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Popbpqjh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Dngjff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aeaanjkl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhpfqcln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gnqfcbnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkafmd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ffaong32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mjahlgpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Napjdpcn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Omjpeo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onkidm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkhpdcab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oaompd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Glengm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lmpkadnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gpgind32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Loacdc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dcigeooj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Aaenbd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdmfllhn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dgeenfog.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eghkjdoa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fpmggb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejlbhh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Knalji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ebaplnie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Noppeaed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pjoppf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Efccmidp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jlolpq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfjfecno.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iialhaad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oophlo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hpmpnp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohcegi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gkaclqkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cimcan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbpdblmo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdpmbc32.exe

Executes dropped EXE 64 IoCs

pid	Process
2612	Bjcmebie.exe
652	Bclang32.exe
3412	Ccnncgmc.exe
4852	Cabomkll.exe
640	Cimcan32.exe
4276	Cgndoeag.exe
4396	Cpihcgoa.exe
2992	Cibmlmeb.exe
2016	Cgcmjd32.exe
4316	Dapkni32.exe
3980	Dabhdinj.exe
1596	Dinmhkke.exe
2368	Dhomfc32.exe
4636	Emlenj32.exe
4280	Efdjgo32.exe
1208	Ejbbmnnb.exe
2696	Ejdocm32.exe
2616	Edmclccp.exe
1580	Edopabqn.exe
4560	Facqkg32.exe
3248	Ffpicn32.exe
436	Fhofmq32.exe
4980	Fmlneg32.exe
2660	Fgdbnmji.exe
1816	Fpmggb32.exe
4336	Ghkeio32.exe
4140	Gnhnaf32.exe
1484	Ghmbno32.exe
1952	Gnjjfegi.exe
2632	Ggbook32.exe
4256	Gnlgleef.exe
1480	Hgelek32.exe
860	Hpmpnp32.exe
1932	Hgghjjid.exe
928	Hpomcp32.exe
3268	Hjhalefe.exe
3580	Hdmein32.exe
3892	Hpdfnolo.exe
1320	Hjlkge32.exe
5000	Igqkqiai.exe
2008	Ijogmdqm.exe
2576	Igchfiof.exe
2984	Iahlcaol.exe
4124	Ihbdplfi.exe
2352	Iakiia32.exe
3596	Ikcmbfcj.exe
1868	Iqpfjnba.exe
1876	Igjngh32.exe
2304	Ijhjcchb.exe
2184	Jdnoplhh.exe
3908	Jjjghcfp.exe
464	Jqdoem32.exe
1652	Jkjcbe32.exe
1068	Jqglkmlj.exe
2168	Jklphekp.exe
3400	Jdedak32.exe
1464	Jnmijq32.exe
1820	Jgenbfoa.exe
3988	Jnpfop32.exe
2832	Kghjhemo.exe
3300	Knbbep32.exe
2372	Kelkaj32.exe
3284	Kkfcndce.exe
2820	Kenggi32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Ghmbno32.exe	Gnhnaf32.exe
File created	C:\Windows\SysWOW64\Aboncdme.dll	Hpdfnolo.exe
File created	C:\Windows\SysWOW64\Nkbjmj32.dll	Kckqbj32.exe
File created	C:\Windows\SysWOW64\Gedhfp32.dll	Gegkpf32.exe
File created	C:\Windows\SysWOW64\Efccmidp.exe	Ejlbhh32.exe
File created	C:\Windows\SysWOW64\Bgjbbcpq.dll	Glgjlm32.exe
File created	C:\Windows\SysWOW64\Bmabggdm.exe	Bfgjjm32.exe
File created	C:\Windows\SysWOW64\Aolece32.dll	Fnipbc32.exe
File created	C:\Windows\SysWOW64\Akcoajfm.dll	Hmmfmhll.exe
File created	C:\Windows\SysWOW64\Bhamkipi.exe	Bohibc32.exe
File created	C:\Windows\SysWOW64\Dccledea.dll	Cjnffjkl.exe
File created	C:\Windows\SysWOW64\Edqnimdf.dll	Kgiiiidd.exe
File created	C:\Windows\SysWOW64\Kpibgp32.dll	Ojdgnn32.exe
File created	C:\Windows\SysWOW64\Jfmlqhcc.dll	Kibeoo32.exe
File created	C:\Windows\SysWOW64\Fmcldc32.dll	Ffpicn32.exe
File opened for modification	C:\Windows\SysWOW64\Kkgiimng.exe	Knchpiom.exe
File created	C:\Windows\SysWOW64\Ogpmdqpl.dll	Ddkbmj32.exe
File opened for modification	C:\Windows\SysWOW64\Fbmohmoh.exe	Eghkjdoa.exe
File created	C:\Windows\SysWOW64\Golneb32.dll	Gmiclo32.exe
File created	C:\Windows\SysWOW64\Ehlhih32.exe	Ebaplnie.exe
File created	C:\Windows\SysWOW64\Pjmnkgfc.dll	Ibqnkh32.exe
File created	C:\Windows\SysWOW64\Nmfmde32.exe	Njgqhicg.exe
File created	C:\Windows\SysWOW64\Njjmni32.exe	Ncpeaoih.exe
File created	C:\Windows\SysWOW64\Naecop32.exe	Njkkbehl.exe
File created	C:\Windows\SysWOW64\Qhmqdemc.exe	Qeodhjmo.exe
File opened for modification	C:\Windows\SysWOW64\Hedafk32.exe	Gpgind32.exe
File created	C:\Windows\SysWOW64\Ibfnqmpf.exe	Ifomll32.exe
File created	C:\Windows\SysWOW64\Mgloefco.exe	Mqafhl32.exe
File created	C:\Windows\SysWOW64\Leilnmkp.dll	Mokmdh32.exe
File created	C:\Windows\SysWOW64\Nbicmh32.dll	Fjohde32.exe
File created	C:\Windows\SysWOW64\Gckoph32.dll	Hibafp32.exe
File opened for modification	C:\Windows\SysWOW64\Glgcbf32.exe	Gfjkjo32.exe
File created	C:\Windows\SysWOW64\Imjfmjln.dll	Jjjghcfp.exe
File created	C:\Windows\SysWOW64\Nmnpml32.dll	Eplgeokq.exe
File created	C:\Windows\SysWOW64\Hgdejd32.exe	Hpjmnjqn.exe
File created	C:\Windows\SysWOW64\Cofnik32.exe	Cdpjlb32.exe
File opened for modification	C:\Windows\SysWOW64\Njgqhicg.exe	Ncmhko32.exe
File created	C:\Windows\SysWOW64\Mhfppabl.exe	Mehcdfch.exe
File opened for modification	C:\Windows\SysWOW64\Odalmibl.exe	Oodcdb32.exe
File created	C:\Windows\SysWOW64\Fklenm32.dll	Plpjoe32.exe
File created	C:\Windows\SysWOW64\Bafndi32.exe	Bohbhmfm.exe
File created	C:\Windows\SysWOW64\Eppjfgcp.exe	Eejeiocj.exe
File created	C:\Windows\SysWOW64\Onnnbnbp.dll	Pmkofa32.exe
File created	C:\Windows\SysWOW64\Nfjola32.exe	Nmbjcljl.exe
File created	C:\Windows\SysWOW64\Oqhoeb32.exe	Ojnfihmo.exe
File created	C:\Windows\SysWOW64\Pakllc32.exe	Pkadoiip.exe
File created	C:\Windows\SysWOW64\Ikkpgafg.exe	Ipflihfq.exe
File created	C:\Windows\SysWOW64\Jlgoek32.exe	Jemfhacc.exe
File created	C:\Windows\SysWOW64\Mjlalkmd.exe	Mbdiknlb.exe
File opened for modification	C:\Windows\SysWOW64\Fllkqn32.exe	Fjjnifbl.exe
File opened for modification	C:\Windows\SysWOW64\Dflfac32.exe	Doaneiop.exe
File opened for modification	C:\Windows\SysWOW64\Iidphgcn.exe	Ickglm32.exe
File created	C:\Windows\SysWOW64\Ebjjgd32.dll	Dolmodpi.exe
File opened for modification	C:\Windows\SysWOW64\Hgelek32.exe	Gnlgleef.exe
File created	C:\Windows\SysWOW64\Angdnk32.dll	Ddgplado.exe
File created	C:\Windows\SysWOW64\Bljlpjaf.dll	Bpfkpp32.exe
File created	C:\Windows\SysWOW64\Jekjcaef.exe	Jblmgf32.exe
File opened for modification	C:\Windows\SysWOW64\Cpihcgoa.exe	Cgndoeag.exe
File created	C:\Windows\SysWOW64\Jqdoem32.exe	Jjjghcfp.exe
File created	C:\Windows\SysWOW64\Efcagd32.dll	Mcjmel32.exe
File created	C:\Windows\SysWOW64\Eadhip32.dll	Cleegp32.exe
File created	C:\Windows\SysWOW64\Lngqkhda.dll	Pplobcpp.exe
File created	C:\Windows\SysWOW64\Ahfmpnql.exe	Aaldccip.exe
File opened for modification	C:\Windows\SysWOW64\Jemfhacc.exe	Jldbpl32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5216	5236	WerFault.exe	706

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ihbponja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lfgnho32.dll"	Pciqnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Kkfcndce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oejbfmpg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Cleegp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baaelkfn.dll"	Fbbpmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Qhjmdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjdiliki.dll"	Aoabad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jlkipgpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Knchpiom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cboeco32.dll"	Gmojkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plpjfnfg.dll"	Gnjjfegi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Llflea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bmhocd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hegaehem.dll"	Bedgjgkg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Figgdg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjmped32.dll"	Knbbep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kkjlic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhnjoi32.dll"	Fimhjl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dgjoif32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgflfoob.dll"	Gnlgleef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Efjimhnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hibafp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lnadagbm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gmojkj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkiocibf.dll"	Lmpkadnm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lbfecjhc.dll"	Gndick32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Leboon32.dll"	Kidben32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkpiopih.dll"	Qoelkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ddjmba32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hehkajig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hhfpbpdo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lghcocol.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mnphmkji.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nlmdbh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Badanigc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cofnik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Liokmchg.dll"	Efdjgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ckclhn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eejeiocj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnknop32.dll"	Jlgoek32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eblpgjha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bhpfqcln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hfcnpn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Phajna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bpfkpp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Camddhoi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Kcbfcigf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Afnqfkij.dll"	Dmlkhofd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lngqkhda.dll"	Pplobcpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Neoieenp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npbblbdb.dll"	Dfgcakon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qjalckog.dll"	Qeodhjmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gghdaa32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ikcmbfcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Knbbep32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nndjndbh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gndick32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Mjlalkmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Igqkqiai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lijlof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Qeodhjmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jghpbk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Dafppp32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 2612	1292	dfaee70b2c350d333f2b7659cb6b5c55_JC.exe	149
PID 1292 wrote to memory of 2612	1292	dfaee70b2c350d333f2b7659cb6b5c55_JC.exe	149
PID 1292 wrote to memory of 2612	1292	dfaee70b2c350d333f2b7659cb6b5c55_JC.exe	149
PID 2612 wrote to memory of 652	2612	Bjcmebie.exe	32
PID 2612 wrote to memory of 652	2612	Bjcmebie.exe	32
PID 2612 wrote to memory of 652	2612	Bjcmebie.exe	32
PID 652 wrote to memory of 3412	652	Bclang32.exe	33
PID 652 wrote to memory of 3412	652	Bclang32.exe	33
PID 652 wrote to memory of 3412	652	Bclang32.exe	33
PID 3412 wrote to memory of 4852	3412	Ccnncgmc.exe	34
PID 3412 wrote to memory of 4852	3412	Ccnncgmc.exe	34
PID 3412 wrote to memory of 4852	3412	Ccnncgmc.exe	34
PID 4852 wrote to memory of 640	4852	Cabomkll.exe	38
PID 4852 wrote to memory of 640	4852	Cabomkll.exe	38
PID 4852 wrote to memory of 640	4852	Cabomkll.exe	38
PID 640 wrote to memory of 4276	640	Cimcan32.exe	36
PID 640 wrote to memory of 4276	640	Cimcan32.exe	36
PID 640 wrote to memory of 4276	640	Cimcan32.exe	36
PID 4276 wrote to memory of 4396	4276	Cgndoeag.exe	35
PID 4276 wrote to memory of 4396	4276	Cgndoeag.exe	35
PID 4276 wrote to memory of 4396	4276	Cgndoeag.exe	35
PID 4396 wrote to memory of 2992	4396	Cpihcgoa.exe	37
PID 4396 wrote to memory of 2992	4396	Cpihcgoa.exe	37
PID 4396 wrote to memory of 2992	4396	Cpihcgoa.exe	37
PID 2992 wrote to memory of 2016	2992	Cibmlmeb.exe	146
PID 2992 wrote to memory of 2016	2992	Cibmlmeb.exe	146
PID 2992 wrote to memory of 2016	2992	Cibmlmeb.exe	146
PID 2016 wrote to memory of 4316	2016	Cgcmjd32.exe	144
PID 2016 wrote to memory of 4316	2016	Cgcmjd32.exe	144
PID 2016 wrote to memory of 4316	2016	Cgcmjd32.exe	144
PID 4316 wrote to memory of 3980	4316	Dapkni32.exe	142
PID 4316 wrote to memory of 3980	4316	Dapkni32.exe	142
PID 4316 wrote to memory of 3980	4316	Dapkni32.exe	142
PID 3980 wrote to memory of 1596	3980	Dabhdinj.exe	40
PID 3980 wrote to memory of 1596	3980	Dabhdinj.exe	40
PID 3980 wrote to memory of 1596	3980	Dabhdinj.exe	40
PID 1596 wrote to memory of 2368	1596	Dinmhkke.exe	141
PID 1596 wrote to memory of 2368	1596	Dinmhkke.exe	141
PID 1596 wrote to memory of 2368	1596	Dinmhkke.exe	141
PID 2368 wrote to memory of 4636	2368	Dhomfc32.exe	41
PID 2368 wrote to memory of 4636	2368	Dhomfc32.exe	41
PID 2368 wrote to memory of 4636	2368	Dhomfc32.exe	41
PID 4636 wrote to memory of 4280	4636	Emlenj32.exe	42
PID 4636 wrote to memory of 4280	4636	Emlenj32.exe	42
PID 4636 wrote to memory of 4280	4636	Emlenj32.exe	42
PID 4280 wrote to memory of 1208	4280	Efdjgo32.exe	136
PID 4280 wrote to memory of 1208	4280	Efdjgo32.exe	136
PID 4280 wrote to memory of 1208	4280	Efdjgo32.exe	136
PID 1208 wrote to memory of 2696	1208	Ejbbmnnb.exe	43
PID 1208 wrote to memory of 2696	1208	Ejbbmnnb.exe	43
PID 1208 wrote to memory of 2696	1208	Ejbbmnnb.exe	43
PID 2696 wrote to memory of 2616	2696	Ejdocm32.exe	44
PID 2696 wrote to memory of 2616	2696	Ejdocm32.exe	44
PID 2696 wrote to memory of 2616	2696	Ejdocm32.exe	44
PID 2616 wrote to memory of 1580	2616	Edmclccp.exe	45
PID 2616 wrote to memory of 1580	2616	Edmclccp.exe	45
PID 2616 wrote to memory of 1580	2616	Edmclccp.exe	45
PID 1580 wrote to memory of 4560	1580	Edopabqn.exe	46
PID 1580 wrote to memory of 4560	1580	Edopabqn.exe	46
PID 1580 wrote to memory of 4560	1580	Edopabqn.exe	46
PID 4560 wrote to memory of 3248	4560	Facqkg32.exe	47
PID 4560 wrote to memory of 3248	4560	Facqkg32.exe	47
PID 4560 wrote to memory of 3248	4560	Facqkg32.exe	47
PID 3248 wrote to memory of 436	3248	Ffpicn32.exe	48

C:\Users\Admin\AppData\Local\Temp\dfaee70b2c350d333f2b7659cb6b5c55_JC.exe
"C:\Users\Admin\AppData\Local\Temp\dfaee70b2c350d333f2b7659cb6b5c55_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SysWOW64\Bjcmebie.exe
  C:\Windows\system32\Bjcmebie.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2612

C:\Windows\SysWOW64\Bclang32.exe
C:\Windows\system32\Bclang32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\SysWOW64\Ccnncgmc.exe
  C:\Windows\system32\Ccnncgmc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\SysWOW64\Cabomkll.exe
    C:\Windows\system32\Cabomkll.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4852
  - - C:\Windows\SysWOW64\Cimcan32.exe
      C:\Windows\system32\Cimcan32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:640

C:\Windows\SysWOW64\Cpihcgoa.exe
C:\Windows\system32\Cpihcgoa.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\SysWOW64\Cibmlmeb.exe
  C:\Windows\system32\Cibmlmeb.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\SysWOW64\Cgcmjd32.exe
    C:\Windows\system32\Cgcmjd32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2016

C:\Windows\SysWOW64\Cgndoeag.exe
C:\Windows\system32\Cgndoeag.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4276

C:\Windows\SysWOW64\Dinmhkke.exe
C:\Windows\system32\Dinmhkke.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\SysWOW64\Dhomfc32.exe
  C:\Windows\system32\Dhomfc32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2368

C:\Windows\SysWOW64\Emlenj32.exe
C:\Windows\system32\Emlenj32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Windows\SysWOW64\Efdjgo32.exe
  C:\Windows\system32\Efdjgo32.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4280
- - C:\Windows\SysWOW64\Ejbbmnnb.exe
    C:\Windows\system32\Ejbbmnnb.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1208

C:\Windows\SysWOW64\Ejdocm32.exe
C:\Windows\system32\Ejdocm32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Windows\SysWOW64\Edmclccp.exe
  C:\Windows\system32\Edmclccp.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\SysWOW64\Edopabqn.exe
    C:\Windows\system32\Edopabqn.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1580
  - - C:\Windows\SysWOW64\Facqkg32.exe
      C:\Windows\system32\Facqkg32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4560
    - - C:\Windows\SysWOW64\Ffpicn32.exe
        
        C:\Windows\system32\Ffpicn32.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3248
      - C:\Windows\SysWOW64\Fhofmq32.exe
        
        C:\Windows\system32\Fhofmq32.exe
        6⤵
        Executes dropped EXE
        
        PID:436
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        7⤵
        Executes dropped EXE
        
        PID:4980
        
        C:\Windows\SysWOW64\Fgdbnmji.exe
        
        C:\Windows\system32\Fgdbnmji.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2660

C:\Windows\SysWOW64\Fpmggb32.exe
C:\Windows\system32\Fpmggb32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:1816
- C:\Windows\SysWOW64\Ghkeio32.exe
  C:\Windows\system32\Ghkeio32.exe
  2⤵
  - Executes dropped EXE
  PID:4336

C:\Windows\SysWOW64\Gnhnaf32.exe
C:\Windows\system32\Gnhnaf32.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4140
- C:\Windows\SysWOW64\Ghmbno32.exe
  C:\Windows\system32\Ghmbno32.exe
  2⤵
  - Executes dropped EXE
  PID:1484

C:\Windows\SysWOW64\Ggbook32.exe
C:\Windows\system32\Ggbook32.exe
1⤵
- Executes dropped EXE
PID:2632
- C:\Windows\SysWOW64\Gnlgleef.exe
  C:\Windows\system32\Gnlgleef.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  PID:4256
- - C:\Windows\SysWOW64\Hgelek32.exe
    C:\Windows\system32\Hgelek32.exe
    3⤵
    - Executes dropped EXE
    PID:1480

C:\Windows\SysWOW64\Hpmpnp32.exe
C:\Windows\system32\Hpmpnp32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
PID:860
- C:\Windows\SysWOW64\Hgghjjid.exe
  C:\Windows\system32\Hgghjjid.exe
  2⤵
  - Executes dropped EXE
  PID:1932
- - C:\Windows\SysWOW64\Hpomcp32.exe
    C:\Windows\system32\Hpomcp32.exe
    3⤵
    - Executes dropped EXE
    PID:928
  - - C:\Windows\SysWOW64\Hjhalefe.exe
      C:\Windows\system32\Hjhalefe.exe
      4⤵
      Executes dropped EXE
      PID:3268
    - - C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        5⤵
        Executes dropped EXE
        
        PID:3580

C:\Windows\SysWOW64\Hpdfnolo.exe
C:\Windows\system32\Hpdfnolo.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:3892
- C:\Windows\SysWOW64\Hjlkge32.exe
  C:\Windows\system32\Hjlkge32.exe
  2⤵
  - Executes dropped EXE
  PID:1320
- - C:\Windows\SysWOW64\Igqkqiai.exe
    C:\Windows\system32\Igqkqiai.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:5000
  - - C:\Windows\SysWOW64\Ijogmdqm.exe
      C:\Windows\system32\Ijogmdqm.exe
      4⤵
      Executes dropped EXE
      PID:2008
    - - C:\Windows\SysWOW64\Igchfiof.exe
        
        C:\Windows\system32\Igchfiof.exe
        5⤵
        Executes dropped EXE
        
        PID:2576
      - C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        6⤵
        Executes dropped EXE
        
        PID:2984
        
        C:\Windows\SysWOW64\Ihbdplfi.exe
        
        C:\Windows\system32\Ihbdplfi.exe
        7⤵
        Executes dropped EXE
        
        PID:4124
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        8⤵
        Executes dropped EXE
        
        PID:2352

C:\Windows\SysWOW64\Ikcmbfcj.exe
C:\Windows\system32\Ikcmbfcj.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:3596
- C:\Windows\SysWOW64\Iqpfjnba.exe
  C:\Windows\system32\Iqpfjnba.exe
  2⤵
  - Executes dropped EXE
  PID:1868
- - C:\Windows\SysWOW64\Igjngh32.exe
    C:\Windows\system32\Igjngh32.exe
    3⤵
    - Executes dropped EXE
    PID:1876
  - - C:\Windows\SysWOW64\Ijhjcchb.exe
      C:\Windows\system32\Ijhjcchb.exe
      4⤵
      Executes dropped EXE
      PID:2304
    - - C:\Windows\SysWOW64\Jdnoplhh.exe
        
        C:\Windows\system32\Jdnoplhh.exe
        5⤵
        Executes dropped EXE
        
        PID:2184
      - C:\Windows\SysWOW64\Jjjghcfp.exe
        
        C:\Windows\system32\Jjjghcfp.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3908
        
        C:\Windows\SysWOW64\Jqdoem32.exe
        
        C:\Windows\system32\Jqdoem32.exe
        7⤵
        Executes dropped EXE
        
        PID:464
        
        C:\Windows\SysWOW64\Jkjcbe32.exe
        
        C:\Windows\system32\Jkjcbe32.exe
        8⤵
        Executes dropped EXE
        
        PID:1652
        
        C:\Windows\SysWOW64\Jqglkmlj.exe
        
        C:\Windows\system32\Jqglkmlj.exe
        9⤵
        Executes dropped EXE
        
        PID:1068
        
        C:\Windows\SysWOW64\Jklphekp.exe
        
        C:\Windows\system32\Jklphekp.exe
        10⤵
        Executes dropped EXE
        
        PID:2168
        
        C:\Windows\SysWOW64\Jdedak32.exe
        
        C:\Windows\system32\Jdedak32.exe
        11⤵
        Executes dropped EXE
        
        PID:3400
        
        C:\Windows\SysWOW64\Jnmijq32.exe
        
        C:\Windows\system32\Jnmijq32.exe
        12⤵
        Executes dropped EXE
        
        PID:1464
        
        C:\Windows\SysWOW64\Jgenbfoa.exe
        
        C:\Windows\system32\Jgenbfoa.exe
        13⤵
        Executes dropped EXE
        
        PID:1820
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        14⤵
        Executes dropped EXE
        
        PID:3988
        
        C:\Windows\SysWOW64\Kghjhemo.exe
        
        C:\Windows\system32\Kghjhemo.exe
        15⤵
        Executes dropped EXE
        
        PID:2832

C:\Windows\SysWOW64\Kelkaj32.exe
C:\Windows\system32\Kelkaj32.exe
1⤵
- Executes dropped EXE
PID:2372
- C:\Windows\SysWOW64\Kkfcndce.exe
  C:\Windows\system32\Kkfcndce.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:3284

C:\Windows\SysWOW64\Kkhpdcab.exe
C:\Windows\system32\Kkhpdcab.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:3140
- C:\Windows\SysWOW64\Kkjlic32.exe
  C:\Windows\system32\Kkjlic32.exe
  2⤵
  - Modifies registry class
  PID:4652
- - C:\Windows\SysWOW64\Kbddfmgl.exe
    C:\Windows\system32\Kbddfmgl.exe
    3⤵
    PID:564
  - - C:\Windows\SysWOW64\Kkmioc32.exe
      C:\Windows\system32\Kkmioc32.exe
      4⤵
      PID:3388
    - - C:\Windows\SysWOW64\Lajagj32.exe
        
        C:\Windows\system32\Lajagj32.exe
        5⤵
        
        PID:4920
      - C:\Windows\SysWOW64\Lgcjdd32.exe
        
        C:\Windows\system32\Lgcjdd32.exe
        6⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\Lbinam32.exe
        
        C:\Windows\system32\Lbinam32.exe
        7⤵
        
        PID:892

C:\Windows\SysWOW64\Kenggi32.exe
C:\Windows\system32\Kenggi32.exe
1⤵
- Executes dropped EXE
PID:2820

C:\Windows\SysWOW64\Knbbep32.exe
C:\Windows\system32\Knbbep32.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:3300

C:\Windows\SysWOW64\Licfngjd.exe
C:\Windows\system32\Licfngjd.exe
1⤵
PID:2508
- C:\Windows\SysWOW64\Ljdceo32.exe
  C:\Windows\system32\Ljdceo32.exe
  2⤵
  PID:3356
- - C:\Windows\SysWOW64\Lankbigo.exe
    C:\Windows\system32\Lankbigo.exe
    3⤵
    PID:232
  - - C:\Windows\SysWOW64\Lghcocol.exe
      C:\Windows\system32\Lghcocol.exe
      4⤵
      Modifies registry class
      PID:4884
    - - C:\Windows\SysWOW64\Ljgpkonp.exe
        
        C:\Windows\system32\Ljgpkonp.exe
        5⤵
        
        PID:2292
      - C:\Windows\SysWOW64\Lelchgne.exe
        
        C:\Windows\system32\Lelchgne.exe
        6⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Llflea32.exe
        
        C:\Windows\system32\Llflea32.exe
        7⤵
        Modifies registry class
        
        PID:4556
        
        C:\Windows\SysWOW64\Lbpdblmo.exe
        
        C:\Windows\system32\Lbpdblmo.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2264
        
        C:\Windows\SysWOW64\Lijlof32.exe
        
        C:\Windows\system32\Lijlof32.exe
        9⤵
        Modifies registry class
        
        PID:948
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        10⤵
        
        PID:3824
        
        C:\Windows\SysWOW64\Meamcg32.exe
        
        C:\Windows\system32\Meamcg32.exe
        11⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\Mniallpq.exe
        
        C:\Windows\system32\Mniallpq.exe
        12⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Mahnhhod.exe
        
        C:\Windows\system32\Mahnhhod.exe
        13⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\Mhafeb32.exe
        
        C:\Windows\system32\Mhafeb32.exe
        14⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Mbgjbkfg.exe
        
        C:\Windows\system32\Mbgjbkfg.exe
        15⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Mhdckaeo.exe
        
        C:\Windows\system32\Mhdckaeo.exe
        16⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Mnnkgl32.exe
        
        C:\Windows\system32\Mnnkgl32.exe
        17⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Mehcdfch.exe
        
        C:\Windows\system32\Mehcdfch.exe
        18⤵
        Drops file in System32 directory
        
        PID:5400
        
        C:\Windows\SysWOW64\Mhfppabl.exe
        
        C:\Windows\system32\Mhfppabl.exe
        19⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Mnphmkji.exe
        
        C:\Windows\system32\Mnphmkji.exe
        20⤵
        Modifies registry class
        
        PID:5492
        
        C:\Windows\SysWOW64\Mifljdjo.exe
        
        C:\Windows\system32\Mifljdjo.exe
        21⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        22⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        23⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Neoieenp.exe
        
        C:\Windows\system32\Neoieenp.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5864
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        25⤵
        
        PID:5904
        
        C:\Windows\SysWOW64\Nognnj32.exe
        
        C:\Windows\system32\Nognnj32.exe
        26⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Neafjdkn.exe
        
        C:\Windows\system32\Neafjdkn.exe
        27⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Nlkngo32.exe
        
        C:\Windows\system32\Nlkngo32.exe
        28⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        29⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Neccpd32.exe
        
        C:\Windows\system32\Neccpd32.exe
        30⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        31⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Nolgijpk.exe
        
        C:\Windows\system32\Nolgijpk.exe
        32⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Nefped32.exe
        
        C:\Windows\system32\Nefped32.exe
        33⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5296
        
        C:\Windows\SysWOW64\Nlphbnoe.exe
        
        C:\Windows\system32\Nlphbnoe.exe
        34⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Oondnini.exe
        
        C:\Windows\system32\Oondnini.exe
        35⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        36⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        37⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Oaompd32.exe
        
        C:\Windows\system32\Oaompd32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5632
        
        C:\Windows\SysWOW64\Oifeab32.exe
        
        C:\Windows\system32\Oifeab32.exe
        39⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Okgaijaj.exe
        
        C:\Windows\system32\Okgaijaj.exe
        40⤵
        
        PID:5732

C:\Windows\SysWOW64\Gnjjfegi.exe
C:\Windows\system32\Gnjjfegi.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:1952

C:\Windows\SysWOW64\Dabhdinj.exe
C:\Windows\system32\Dabhdinj.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980

C:\Windows\SysWOW64\Dapkni32.exe
C:\Windows\system32\Dapkni32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316

C:\Windows\SysWOW64\Oemefcap.exe
C:\Windows\system32\Oemefcap.exe
1⤵
PID:5644
- C:\Windows\SysWOW64\Ooejohhq.exe
  C:\Windows\system32\Ooejohhq.exe
  2⤵
  PID:5852
- - C:\Windows\SysWOW64\Oeoblb32.exe
    C:\Windows\system32\Oeoblb32.exe
    3⤵
    PID:5916
  - - C:\Windows\SysWOW64\Olijhmgj.exe
      C:\Windows\system32\Olijhmgj.exe
      4⤵
      PID:5988
    - - C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        5⤵
        
        PID:6052
      - C:\Windows\SysWOW64\Oimkbaed.exe
        
        C:\Windows\system32\Oimkbaed.exe
        6⤵
        
        PID:6124
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        7⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Pojcjh32.exe
        
        C:\Windows\system32\Pojcjh32.exe
        8⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Pahpfc32.exe
        
        C:\Windows\system32\Pahpfc32.exe
        9⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Phbhcmjl.exe
        
        C:\Windows\system32\Phbhcmjl.exe
        10⤵
        
        PID:5528

C:\Windows\SysWOW64\Pkadoiip.exe
C:\Windows\system32\Pkadoiip.exe
1⤵
- Drops file in System32 directory
PID:5600
- C:\Windows\SysWOW64\Pakllc32.exe
  C:\Windows\system32\Pakllc32.exe
  2⤵
  PID:5708
- - C:\Windows\SysWOW64\Pibdmp32.exe
    C:\Windows\system32\Pibdmp32.exe
    3⤵
    PID:5740
  - - C:\Windows\SysWOW64\Plpqil32.exe
      C:\Windows\system32\Plpqil32.exe
      4⤵
      PID:5872
    - - C:\Windows\SysWOW64\Pamiaboj.exe
        
        C:\Windows\system32\Pamiaboj.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6032
      - C:\Windows\SysWOW64\Aoofle32.exe
        
        C:\Windows\system32\Aoofle32.exe
        6⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Afinioip.exe
        
        C:\Windows\system32\Afinioip.exe
        7⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Aoabad32.exe
        
        C:\Windows\system32\Aoabad32.exe
        8⤵
        Modifies registry class
        
        PID:5480
        
        C:\Windows\SysWOW64\Ajggomog.exe
        
        C:\Windows\system32\Ajggomog.exe
        9⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Akhcfe32.exe
        
        C:\Windows\system32\Akhcfe32.exe
        10⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Acokhc32.exe
        
        C:\Windows\system32\Acokhc32.exe
        11⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Blhpqhlh.exe
        
        C:\Windows\system32\Blhpqhlh.exe
        12⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Bbdhiojo.exe
        
        C:\Windows\system32\Bbdhiojo.exe
        13⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        14⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Bohibc32.exe
        
        C:\Windows\system32\Bohibc32.exe
        15⤵
        Drops file in System32 directory
        
        PID:5884
        
        C:\Windows\SysWOW64\Bhamkipi.exe
        
        C:\Windows\system32\Bhamkipi.exe
        16⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Bokehc32.exe
        
        C:\Windows\system32\Bokehc32.exe
        17⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Bhcjqinf.exe
        
        C:\Windows\system32\Bhcjqinf.exe
        18⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Bkafmd32.exe
        
        C:\Windows\system32\Bkafmd32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5588
        
        C:\Windows\SysWOW64\Bfgjjm32.exe
        
        C:\Windows\system32\Bfgjjm32.exe
        20⤵
        Drops file in System32 directory
        
        PID:5284

C:\Windows\SysWOW64\Bmabggdm.exe
C:\Windows\system32\Bmabggdm.exe
1⤵
PID:5444
- C:\Windows\SysWOW64\Bckkca32.exe
  C:\Windows\system32\Bckkca32.exe
  2⤵
  PID:6188
- - C:\Windows\SysWOW64\Cihclh32.exe
    C:\Windows\system32\Cihclh32.exe
    3⤵
    PID:6228
  - - C:\Windows\SysWOW64\Ccmgiaig.exe
      C:\Windows\system32\Ccmgiaig.exe
      4⤵
      PID:6276
    - - C:\Windows\SysWOW64\Cjgpfk32.exe
        
        C:\Windows\system32\Cjgpfk32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6316
      - C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        6⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Ccpdoqgd.exe
        
        C:\Windows\system32\Ccpdoqgd.exe
        7⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Cjjlkk32.exe
        
        C:\Windows\system32\Cjjlkk32.exe
        8⤵
        
        PID:6440

C:\Windows\SysWOW64\Cmhigf32.exe
C:\Windows\system32\Cmhigf32.exe
1⤵
PID:6484
- C:\Windows\SysWOW64\Cofecami.exe
  C:\Windows\system32\Cofecami.exe
  2⤵
  PID:6528
- - C:\Windows\SysWOW64\Cioilg32.exe
    C:\Windows\system32\Cioilg32.exe
    3⤵
    PID:6572
  - - C:\Windows\SysWOW64\Coiaiakf.exe
      C:\Windows\system32\Coiaiakf.exe
      4⤵
      PID:6624
    - - C:\Windows\SysWOW64\Cjnffjkl.exe
        
        C:\Windows\system32\Cjnffjkl.exe
        5⤵
        Drops file in System32 directory
        
        PID:6664
      - C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        6⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Dbjkkl32.exe
        
        C:\Windows\system32\Dbjkkl32.exe
        7⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        8⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6884
        
        C:\Windows\SysWOW64\Dfgcakon.exe
        
        C:\Windows\system32\Dfgcakon.exe
        10⤵
        Modifies registry class
        
        PID:6944
        
        C:\Windows\SysWOW64\Dpphjp32.exe
        
        C:\Windows\system32\Dpphjp32.exe
        11⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        12⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        13⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        14⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Ejlbhh32.exe
        
        C:\Windows\system32\Ejlbhh32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6164
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6248
        
        C:\Windows\SysWOW64\Eplgeokq.exe
        
        C:\Windows\system32\Eplgeokq.exe
        17⤵
        Drops file in System32 directory
        
        PID:6308
        
        C:\Windows\SysWOW64\Efepbi32.exe
        
        C:\Windows\system32\Efepbi32.exe
        18⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Epndknin.exe
        
        C:\Windows\system32\Epndknin.exe
        19⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Eblpgjha.exe
        
        C:\Windows\system32\Eblpgjha.exe
        20⤵
        Modifies registry class
        
        PID:6524
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        21⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        22⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        23⤵
        Modifies registry class
        
        PID:6736
        
        C:\Windows\SysWOW64\Emdajb32.exe
        
        C:\Windows\system32\Emdajb32.exe
        24⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Fbajbi32.exe
        
        C:\Windows\system32\Fbajbi32.exe
        25⤵
        
        PID:6780
        
        C:\Windows\SysWOW64\Fjhacf32.exe
        
        C:\Windows\system32\Fjhacf32.exe
        26⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        27⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Fjjnifbl.exe
        
        C:\Windows\system32\Fjjnifbl.exe
        28⤵
        Drops file in System32 directory
        
        PID:7148
        
        C:\Windows\SysWOW64\Fllkqn32.exe
        
        C:\Windows\system32\Fllkqn32.exe
        29⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Ffaong32.exe
        
        C:\Windows\system32\Ffaong32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6340
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        31⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        32⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Fjohde32.exe
        
        C:\Windows\system32\Fjohde32.exe
        33⤵
        Drops file in System32 directory
        
        PID:6672
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6808
        
        C:\Windows\SysWOW64\Fjadje32.exe
        
        C:\Windows\system32\Fjadje32.exe
        35⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        36⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        37⤵
        
        PID:6212

C:\Windows\SysWOW64\Gigaka32.exe
C:\Windows\system32\Gigaka32.exe
1⤵
PID:6296
- C:\Windows\SysWOW64\Glengm32.exe
  C:\Windows\system32\Glengm32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:6492
- - C:\Windows\SysWOW64\Gbofcghl.exe
    C:\Windows\system32\Gbofcghl.exe
    3⤵
    PID:6820
  - - C:\Windows\SysWOW64\Gjfnedho.exe
      C:\Windows\system32\Gjfnedho.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:6968
    - - C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        5⤵
        Drops file in System32 directory
        
        PID:7156
      - C:\Windows\SysWOW64\Gfmojenc.exe
        
        C:\Windows\system32\Gfmojenc.exe
        6⤵
        
        PID:6500

C:\Windows\SysWOW64\Gikkfqmf.exe
C:\Windows\system32\Gikkfqmf.exe
1⤵
PID:6616
- C:\Windows\SysWOW64\Gpecbk32.exe
  C:\Windows\system32\Gpecbk32.exe
  2⤵
  PID:7064
- - C:\Windows\SysWOW64\Gfokoelp.exe
    C:\Windows\system32\Gfokoelp.exe
    3⤵
    PID:6392
  - - C:\Windows\SysWOW64\Gmiclo32.exe
      C:\Windows\system32\Gmiclo32.exe
      4⤵
      Drops file in System32 directory
      PID:7104
    - - C:\Windows\SysWOW64\Gdcliikj.exe
        
        C:\Windows\system32\Gdcliikj.exe
        5⤵
        
        PID:6956
      - C:\Windows\SysWOW64\Hpjmnjqn.exe
        
        C:\Windows\system32\Hpjmnjqn.exe
        6⤵
        Drops file in System32 directory
        
        PID:6704
        
        C:\Windows\SysWOW64\Hgdejd32.exe
        
        C:\Windows\system32\Hgdejd32.exe
        7⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        8⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7248
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        9⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Hgkkkcbc.exe
        
        C:\Windows\system32\Hgkkkcbc.exe
        10⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Hmechmip.exe
        
        C:\Windows\system32\Hmechmip.exe
        11⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7456
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        13⤵
        Drops file in System32 directory
        
        PID:7496
        
        C:\Windows\SysWOW64\Ikkpgafg.exe
        
        C:\Windows\system32\Ikkpgafg.exe
        14⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        15⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        16⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Ipjedh32.exe
        
        C:\Windows\system32\Ipjedh32.exe
        17⤵
        
        PID:7676

C:\Windows\SysWOW64\Igdnabjh.exe
C:\Windows\system32\Igdnabjh.exe
1⤵
PID:7716
- C:\Windows\SysWOW64\Innfnl32.exe
  C:\Windows\system32\Innfnl32.exe
  2⤵
  PID:7760
- - C:\Windows\SysWOW64\Icknfcol.exe
    C:\Windows\system32\Icknfcol.exe
    3⤵
    PID:7804
  - - C:\Windows\SysWOW64\Ijegcm32.exe
      C:\Windows\system32\Ijegcm32.exe
      4⤵
      PID:7852
    - - C:\Windows\SysWOW64\Jncoikmp.exe
        
        C:\Windows\system32\Jncoikmp.exe
        5⤵
        
        PID:7896
      - C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        6⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Jjlmclqa.exe
        
        C:\Windows\system32\Jjlmclqa.exe
        7⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Jlkipgpe.exe
        
        C:\Windows\system32\Jlkipgpe.exe
        8⤵
        Modifies registry class
        
        PID:8024
        
        C:\Windows\SysWOW64\Jgpmmp32.exe
        
        C:\Windows\system32\Jgpmmp32.exe
        9⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Jqhafffk.exe
        
        C:\Windows\system32\Jqhafffk.exe
        10⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Jgbjbp32.exe
        
        C:\Windows\system32\Jgbjbp32.exe
        11⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        12⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        13⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7264
        
        C:\Windows\SysWOW64\Kqmkae32.exe
        
        C:\Windows\system32\Kqmkae32.exe
        15⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        16⤵
        
        PID:7468
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7520
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        18⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Kkeldnpi.exe
        
        C:\Windows\system32\Kkeldnpi.exe
        19⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Knchpiom.exe
        
        C:\Windows\system32\Knchpiom.exe
        20⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7748
        
        C:\Windows\SysWOW64\Kkgiimng.exe
        
        C:\Windows\system32\Kkgiimng.exe
        21⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        22⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7932
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        24⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        25⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        26⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        27⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7276
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7448
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        30⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        31⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7728
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        33⤵
        Modifies registry class
        
        PID:7848
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        34⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        35⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        36⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        37⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        38⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        39⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7924
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        41⤵
        Drops file in System32 directory
        
        PID:8172
        
        C:\Windows\SysWOW64\Manmoq32.exe
        
        C:\Windows\system32\Manmoq32.exe
        42⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        43⤵
        
        PID:3768
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8096
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        45⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        46⤵
        Modifies registry class
        
        PID:8076
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        47⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        48⤵
        Drops file in System32 directory
        
        PID:2668
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        49⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        50⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        51⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        52⤵
        
        PID:7392
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        53⤵
        Modifies registry class
        
        PID:8160
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        54⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8232
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        56⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        57⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Ojdnid32.exe
        
        C:\Windows\system32\Ojdnid32.exe
        58⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        59⤵
        Modifies registry class
        
        PID:8396
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        60⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        61⤵
        
        PID:8480
        
        C:\Windows\SysWOW64\Odoogi32.exe
        
        C:\Windows\system32\Odoogi32.exe
        62⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8520
        
        C:\Windows\SysWOW64\Oodcdb32.exe
        
        C:\Windows\system32\Oodcdb32.exe
        63⤵
        Drops file in System32 directory
        
        PID:8560
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        64⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8640
        
        C:\Windows\SysWOW64\Peahgl32.exe
        
        C:\Windows\system32\Peahgl32.exe
        66⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Pahilmoc.exe
        
        C:\Windows\system32\Pahilmoc.exe
        67⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Phaahggp.exe
        
        C:\Windows\system32\Phaahggp.exe
        68⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        69⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        70⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        71⤵
        Drops file in System32 directory
        
        PID:8888
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        72⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        73⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9012
        
        C:\Windows\SysWOW64\Pejkmk32.exe
        
        C:\Windows\system32\Pejkmk32.exe
        75⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Phigif32.exe
        
        C:\Windows\system32\Phigif32.exe
        76⤵
        
        PID:9092
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        77⤵
        
        PID:9132
        
        C:\Windows\SysWOW64\Qhkdof32.exe
        
        C:\Windows\system32\Qhkdof32.exe
        78⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        79⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4356
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        80⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8212
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        81⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        82⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8420
        
        C:\Windows\SysWOW64\Adikdfna.exe
        
        C:\Windows\system32\Adikdfna.exe
        84⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        85⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Ahgcjddh.exe
        
        C:\Windows\system32\Ahgcjddh.exe
        86⤵
        
        PID:8628

C:\Windows\SysWOW64\Akepfpcl.exe
C:\Windows\system32\Akepfpcl.exe
1⤵
PID:8700
- C:\Windows\SysWOW64\Aaohcj32.exe
  C:\Windows\system32\Aaohcj32.exe
  2⤵
  PID:8756
- - C:\Windows\SysWOW64\Ahippdbe.exe
    C:\Windows\system32\Ahippdbe.exe
    3⤵
    PID:8840
  - - C:\Windows\SysWOW64\Bochmn32.exe
      C:\Windows\system32\Bochmn32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:8908
    - - C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        5⤵
        
        PID:8980
      - C:\Windows\SysWOW64\Blgifbil.exe
        
        C:\Windows\system32\Blgifbil.exe
        6⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        7⤵
        Modifies registry class
        
        PID:9124

C:\Windows\SysWOW64\Bhnikc32.exe
C:\Windows\system32\Bhnikc32.exe
1⤵
PID:9184
- C:\Windows\SysWOW64\Bohbhmfm.exe
  C:\Windows\system32\Bohbhmfm.exe
  2⤵
  - Drops file in System32 directory
  PID:8224
- - C:\Windows\SysWOW64\Bafndi32.exe
    C:\Windows\system32\Bafndi32.exe
    3⤵
    PID:8324
  - - C:\Windows\SysWOW64\Bhpfqcln.exe
      C:\Windows\system32\Bhpfqcln.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Modifies registry class
      PID:8392
    - - C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        5⤵
        
        PID:8568
      - C:\Windows\SysWOW64\Bedgjgkg.exe
        
        C:\Windows\system32\Bedgjgkg.exe
        6⤵
        Modifies registry class
        
        PID:8668
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        7⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        8⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        9⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Ckclhn32.exe
        
        C:\Windows\system32\Ckclhn32.exe
        10⤵
        Modifies registry class
        
        PID:9140
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        11⤵
        Modifies registry class
        
        PID:8200
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        12⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        13⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Cfkmkf32.exe
        
        C:\Windows\system32\Cfkmkf32.exe
        14⤵
        
        PID:8752
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        15⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8872
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        16⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        17⤵
        Drops file in System32 directory
        
        PID:7336
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        18⤵
        Modifies registry class
        
        PID:8512
        
        C:\Windows\SysWOW64\Cdbfab32.exe
        
        C:\Windows\system32\Cdbfab32.exe
        19⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        20⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        21⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        22⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        23⤵
        Modifies registry class
        
        PID:9180
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        24⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Ddgplado.exe
        
        C:\Windows\system32\Ddgplado.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8876
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        26⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        27⤵
        Modifies registry class
        
        PID:9264
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        28⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        29⤵
        
        PID:9352
        
        C:\Windows\SysWOW64\Doaneiop.exe
        
        C:\Windows\system32\Doaneiop.exe
        30⤵
        Drops file in System32 directory
        
        PID:9392
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        31⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        32⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9476
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        33⤵
        
        PID:9520
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        34⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Eecphp32.exe
        
        C:\Windows\system32\Eecphp32.exe
        35⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        36⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Eiahnnph.exe
        
        C:\Windows\system32\Eiahnnph.exe
        37⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        38⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        39⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        40⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        41⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9844
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        42⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Felbnn32.exe
        
        C:\Windows\system32\Felbnn32.exe
        43⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        44⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        45⤵
        Modifies registry class
        
        PID:10020
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        46⤵
        Modifies registry class
        
        PID:10064
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        47⤵
        Drops file in System32 directory
        
        PID:10104
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        48⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        49⤵
        Modifies registry class
        
        PID:10184
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        50⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10232
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        51⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        52⤵
        Drops file in System32 directory
        
        PID:9320
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        53⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        54⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        55⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        56⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        57⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9672
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        58⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        59⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        60⤵
        Modifies registry class
        
        PID:9872
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        61⤵
        Drops file in System32 directory
        
        PID:9928
        
        C:\Windows\SysWOW64\Hoobdp32.exe
        
        C:\Windows\system32\Hoobdp32.exe
        62⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Hehkajig.exe
        
        C:\Windows\system32\Hehkajig.exe
        63⤵
        Modifies registry class
        
        PID:10088
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        64⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        65⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        66⤵
        
        PID:3576
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        67⤵
        
        PID:10156
        
        C:\Windows\SysWOW64\Iikmbh32.exe
        
        C:\Windows\system32\Iikmbh32.exe
        68⤵
        
        PID:10220
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        69⤵
        Drops file in System32 directory
        
        PID:9272
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        70⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        71⤵
        
        PID:9500
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        72⤵
        
        PID:9608
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        73⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        74⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        75⤵
        Drops file in System32 directory
        
        PID:112
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        76⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        77⤵
        Modifies registry class
        
        PID:488
        
        C:\Windows\SysWOW64\Jmbhoeid.exe
        
        C:\Windows\system32\Jmbhoeid.exe
        78⤵
        
        PID:768
        
        C:\Windows\SysWOW64\Jcoaglhk.exe
        
        C:\Windows\system32\Jcoaglhk.exe
        79⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        80⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Jphkkpbp.exe
        
        C:\Windows\system32\Jphkkpbp.exe
        81⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        82⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9776
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        84⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        85⤵
        
        PID:3232
        
        C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        86⤵
        Drops file in System32 directory
        
        PID:4916
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        87⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        88⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        89⤵
        Drops file in System32 directory
        
        PID:9796
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        90⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        91⤵
        Modifies registry class
        
        PID:10120
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        92⤵
        
        PID:9336
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        93⤵
        
        PID:9840
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        94⤵
        
        PID:1540
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        95⤵
        
        PID:9584
        
        C:\Windows\SysWOW64\Ljceqb32.exe
        
        C:\Windows\system32\Ljceqb32.exe
        96⤵
        
        PID:10136
        
        C:\Windows\SysWOW64\Lopmii32.exe
        
        C:\Windows\system32\Lopmii32.exe
        97⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10248
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        99⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        100⤵
        
        PID:10328
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        101⤵
        Drops file in System32 directory
        
        PID:10368
        
        C:\Windows\SysWOW64\Mgloefco.exe
        
        C:\Windows\system32\Mgloefco.exe
        102⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        103⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        104⤵
        
        PID:10484
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        105⤵
        
        PID:10528
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        106⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        107⤵
        
        PID:10616
        
        C:\Windows\SysWOW64\Mnjqmpgg.exe
        
        C:\Windows\system32\Mnjqmpgg.exe
        108⤵
        
        PID:10652
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10712
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        110⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        111⤵
        
        PID:10792
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        112⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10840
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        113⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        114⤵
        
        PID:10924
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        115⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        116⤵
        
        PID:11004
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        117⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        118⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        119⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        120⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        121⤵
        
        PID:11220
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11260
        
        C:\Windows\SysWOW64\Oplfkeob.exe
        
        C:\Windows\system32\Oplfkeob.exe
        123⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        124⤵
        
        PID:10348
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        125⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        126⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        127⤵
        Drops file in System32 directory
        
        PID:10556
        
        C:\Windows\SysWOW64\Oanokhdb.exe
        
        C:\Windows\system32\Oanokhdb.exe
        128⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        129⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        130⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Opclldhj.exe
        
        C:\Windows\system32\Opclldhj.exe
        131⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        132⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        133⤵
        
        PID:10964
        
        C:\Windows\SysWOW64\Ocaebc32.exe
        
        C:\Windows\system32\Ocaebc32.exe
        134⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\Ppgegd32.exe
        
        C:\Windows\system32\Ppgegd32.exe
        135⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        136⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Pnifekmd.exe
        
        C:\Windows\system32\Pnifekmd.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11240
        
        C:\Windows\SysWOW64\Ppjbmc32.exe
        
        C:\Windows\system32\Ppjbmc32.exe
        138⤵
        
        PID:10324
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        139⤵
        Modifies registry class
        
        PID:10432
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        140⤵
        
        PID:10560
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        141⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10636
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        142⤵
        
        PID:10780
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        143⤵
        
        PID:10864
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        144⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        145⤵
        
        PID:11148
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        146⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Qjfmkk32.exe
        
        C:\Windows\system32\Qjfmkk32.exe
        147⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        148⤵
        Modifies registry class
        
        PID:2524
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        149⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        150⤵
        
        PID:10980
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        151⤵
        
        PID:11132
        
        C:\Windows\SysWOW64\Aaenbd32.exe
        
        C:\Windows\system32\Aaenbd32.exe
        152⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10312
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        153⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        154⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        155⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        156⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Aokkahlo.exe
        
        C:\Windows\system32\Aokkahlo.exe
        157⤵
        
        PID:10744
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        158⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Aaldccip.exe
        
        C:\Windows\system32\Aaldccip.exe
        159⤵
        Drops file in System32 directory
        
        PID:10280
        
        C:\Windows\SysWOW64\Ahfmpnql.exe
        
        C:\Windows\system32\Ahfmpnql.exe
        160⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        161⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Bdmmeo32.exe
        
        C:\Windows\system32\Bdmmeo32.exe
        162⤵
        
        PID:11344
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        163⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11432
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        165⤵
        
        PID:11476
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        166⤵
        Modifies registry class
        
        PID:11512
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        167⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:11556
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        168⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Bkphhgfc.exe
        
        C:\Windows\system32\Bkphhgfc.exe
        169⤵
        
        PID:11648
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        170⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Cammjakm.exe
        
        C:\Windows\system32\Cammjakm.exe
        171⤵
        
        PID:11732
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        172⤵
        
        PID:11784
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        173⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11868
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        175⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        176⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Cnhgjaml.exe
        
        C:\Windows\system32\Cnhgjaml.exe
        177⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        178⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\Cgqlcg32.exe
        
        C:\Windows\system32\Cgqlcg32.exe
        179⤵
        
        PID:12080
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        180⤵
        Modifies registry class
        
        PID:12116
        
        C:\Windows\SysWOW64\Dhphmj32.exe
        
        C:\Windows\system32\Dhphmj32.exe
        181⤵
        
        PID:12160
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        182⤵
        
        PID:12204
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        183⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10688
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        185⤵
        Drops file in System32 directory
        
        PID:11316
        
        C:\Windows\SysWOW64\Dqnjgl32.exe
        
        C:\Windows\system32\Dqnjgl32.exe
        186⤵
        
        PID:11376
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        187⤵
        
        PID:11440
        
        C:\Windows\SysWOW64\Dnajppda.exe
        
        C:\Windows\system32\Dnajppda.exe
        188⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        189⤵
        Drops file in System32 directory
        
        PID:11588
        
        C:\Windows\SysWOW64\Dgjoif32.exe
        
        C:\Windows\system32\Dgjoif32.exe
        190⤵
        Modifies registry class
        
        PID:11644
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        191⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\Dglkoeio.exe
        
        C:\Windows\system32\Dglkoeio.exe
        192⤵
        
        PID:11772
        
        C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11804
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        194⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        195⤵
        
        PID:11900
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        196⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        197⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12060
        
        C:\Windows\SysWOW64\Eqlfhjig.exe
        
        C:\Windows\system32\Eqlfhjig.exe
        199⤵
        
        PID:12112
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        200⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        201⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:12280
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        203⤵
        
        PID:11292
        
        C:\Windows\SysWOW64\Figgdg32.exe
        
        C:\Windows\system32\Figgdg32.exe
        204⤵
        Modifies registry class
        
        PID:11360
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        205⤵
        
        PID:11508
        
        C:\Windows\SysWOW64\Fecadghc.exe
        
        C:\Windows\system32\Fecadghc.exe
        206⤵
        
        PID:11540
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        207⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        208⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        209⤵
        
        PID:11808
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        210⤵
        Drops file in System32 directory
        
        PID:4056
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4824
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        212⤵
        Modifies registry class
        
        PID:4316
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        213⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        214⤵
        Modifies registry class
        
        PID:1596
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        215⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        216⤵
        
        PID:12180
        
        C:\Windows\SysWOW64\Gaebef32.exe
        
        C:\Windows\system32\Gaebef32.exe
        217⤵
        
        PID:11280
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        218⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        219⤵
        
        PID:4696
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        220⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        221⤵
        
        PID:4740
        
        C:\Windows\SysWOW64\Hajkqfoe.exe
        
        C:\Windows\system32\Hajkqfoe.exe
        222⤵
        
        PID:11724
        
        C:\Windows\SysWOW64\Hpkknmgd.exe
        
        C:\Windows\system32\Hpkknmgd.exe
        223⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        224⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        225⤵
        Modifies registry class
        
        PID:3788
        
        C:\Windows\SysWOW64\Hbldphde.exe
        
        C:\Windows\system32\Hbldphde.exe
        226⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        227⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        228⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\Ibqnkh32.exe
        
        C:\Windows\system32\Ibqnkh32.exe
        229⤵
        Drops file in System32 directory
        
        PID:4852
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4788
        
        C:\Windows\SysWOW64\Ilkoim32.exe
        
        C:\Windows\system32\Ilkoim32.exe
        231⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        232⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        233⤵
        Modifies registry class
        
        PID:11496
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        234⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11620
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        235⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        236⤵
        
        PID:1084
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        237⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\Jblmgf32.exe
        
        C:\Windows\system32\Jblmgf32.exe
        238⤵
        Drops file in System32 directory
        
        PID:3440
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        239⤵
        
        PID:988
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        240⤵
        Drops file in System32 directory
        
        PID:12072
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        241⤵
        Drops file in System32 directory
        
        PID:12140
        
        C:\Windows\SysWOW64\Jlgoek32.exe
        
        C:\Windows\system32\Jlgoek32.exe
        242⤵
        Modifies registry class
        
        PID:3968
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        243⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        244⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\Jeapcq32.exe
        
        C:\Windows\system32\Jeapcq32.exe
        245⤵
        
        PID:784
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        246⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        247⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        248⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\Kibeoo32.exe
        
        C:\Windows\system32\Kibeoo32.exe
        249⤵
        Drops file in System32 directory
        
        PID:10600
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        250⤵
        
        PID:1096
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        251⤵
        Modifies registry class
        
        PID:11796
        
        C:\Windows\SysWOW64\Kapfiqoj.exe
        
        C:\Windows\system32\Kapfiqoj.exe
        252⤵
        
        PID:11892
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        253⤵
        
        PID:11984
        
        C:\Windows\SysWOW64\Kocgbend.exe
        
        C:\Windows\system32\Kocgbend.exe
        254⤵
        
        PID:11992
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        255⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        256⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1380
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        257⤵
        
        PID:1932
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4588
        
        C:\Windows\SysWOW64\Lcclncbh.exe
        
        C:\Windows\system32\Lcclncbh.exe
        259⤵
        
        PID:1556
        
        C:\Windows\SysWOW64\Legben32.exe
        
        C:\Windows\system32\Legben32.exe
        260⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        261⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        262⤵
        
        PID:552
        
        C:\Windows\SysWOW64\Ljdkll32.exe
        
        C:\Windows\system32\Ljdkll32.exe
        263⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1276
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        265⤵
        
        PID:2940
        
        C:\Windows\SysWOW64\Mledmg32.exe
        
        C:\Windows\system32\Mledmg32.exe
        266⤵
        
        PID:436
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        267⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        268⤵
        
        PID:228
        
        C:\Windows\SysWOW64\Mhldbh32.exe
        
        C:\Windows\system32\Mhldbh32.exe
        269⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\Mofmobmo.exe
        
        C:\Windows\system32\Mofmobmo.exe
        270⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\Mbdiknlb.exe
        
        C:\Windows\system32\Mbdiknlb.exe
        271⤵
        Drops file in System32 directory
        
        PID:3932
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        272⤵
        Modifies registry class
        
        PID:2864
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        273⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        274⤵
        
        PID:3176

C:\Windows\SysWOW64\Mhanngbl.exe
C:\Windows\system32\Mhanngbl.exe
1⤵
PID:3140
- C:\Windows\SysWOW64\Mcfbkpab.exe
  C:\Windows\system32\Mcfbkpab.exe
  2⤵
  PID:1208
- - C:\Windows\SysWOW64\Mjpjgj32.exe
    C:\Windows\system32\Mjpjgj32.exe
    3⤵
    PID:1844
  - - C:\Windows\SysWOW64\Nciopppp.exe
      C:\Windows\system32\Nciopppp.exe
      4⤵
      PID:3388
    - - C:\Windows\SysWOW64\Noppeaed.exe
        
        C:\Windows\system32\Noppeaed.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10740
      - C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        6⤵
        
        PID:1068
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        7⤵
        
        PID:1908
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5152
        
        C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        9⤵
        Drops file in System32 directory
        
        PID:908
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        10⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        11⤵
        Drops file in System32 directory
        
        PID:2872
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        12⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\Nqcejcha.exe
        
        C:\Windows\system32\Nqcejcha.exe
        13⤵
        
        PID:2796
        
        C:\Windows\SysWOW64\Nbebbk32.exe
        
        C:\Windows\system32\Nbebbk32.exe
        14⤵
        
        PID:4360
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        15⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Ocdnln32.exe
        
        C:\Windows\system32\Ocdnln32.exe
        16⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\Ojnfihmo.exe
        
        C:\Windows\system32\Ojnfihmo.exe
        17⤵
        Drops file in System32 directory
        
        PID:1720
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        18⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        19⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\Oonlfo32.exe
        
        C:\Windows\system32\Oonlfo32.exe
        20⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Oblhcj32.exe
        
        C:\Windows\system32\Oblhcj32.exe
        21⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Oifppdpd.exe
        
        C:\Windows\system32\Oifppdpd.exe
        22⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4816
        
        C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        24⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        25⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Obqanjdb.exe
        
        C:\Windows\system32\Obqanjdb.exe
        26⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Oikjkc32.exe
        
        C:\Windows\system32\Oikjkc32.exe
        27⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\Pcpnhl32.exe
        
        C:\Windows\system32\Pcpnhl32.exe
        28⤵
        
        PID:5552
        
        C:\Windows\SysWOW64\Pjjfdfbb.exe
        
        C:\Windows\system32\Pjjfdfbb.exe
        29⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\Ppgomnai.exe
        
        C:\Windows\system32\Ppgomnai.exe
        30⤵
        
        PID:4224
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        31⤵
        
        PID:5108
        
        C:\Windows\SysWOW64\Pmkofa32.exe
        
        C:\Windows\system32\Pmkofa32.exe
        32⤵
        Drops file in System32 directory
        
        PID:2228
        
        C:\Windows\SysWOW64\Pcegclgp.exe
        
        C:\Windows\system32\Pcegclgp.exe
        33⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2304
        
        C:\Windows\SysWOW64\Paihlpfi.exe
        
        C:\Windows\system32\Paihlpfi.exe
        35⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        36⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        37⤵
        Modifies registry class
        
        PID:11748
        
        C:\Windows\SysWOW64\Pfhmjf32.exe
        
        C:\Windows\system32\Pfhmjf32.exe
        38⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Pififb32.exe
        
        C:\Windows\system32\Pififb32.exe
        39⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5236 -s 424
        40⤵
        Program crash
        
        PID:5216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5236 -ip 5236
1⤵
PID:6140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aaldccip.exe

Filesize
100KB

MD5
fff21b0c37c319246fed388d1a251eb0

SHA1
b6e10751847123b158282f789fcf11ce3469e4be

SHA256
5df04b9638ebb833073ebf0e044e65709d8ebe3ade19111bc2174192cfc64653

SHA512
62508092636b07d99d26f570b05621cab4c1f4b85ee984d7ea0e7093ddcc1451fb3c90f2214c3b4f627a2f417f69e460fc4354fae0c2391928d3ddbb1b613f81

Download Submit
C:\Windows\SysWOW64\Aeaanjkl.exe

Filesize
100KB

MD5
6f611fb017c6faa1f6ba606464820afd

SHA1
648236e8b68819a74cb2713eb95e0346b195cc7e

SHA256
e9fd48985d39ed6b98a277d5838645f794308f821c03683c50f334f1dbf3a8da

SHA512
085276836e9a20c5822eba951aa73198420a47c75ae3aaa9366949fe7d6496966428b16915e6c5298b148f5df771b62618ee270fc4845284ee14e09933746066

Download Submit
C:\Windows\SysWOW64\Aehgnied.exe

Filesize
100KB

MD5
a16770af082730694998e2c30f2cbf41

SHA1
5be6ebef6790022d6a6afeb31b51f42b0e63919c

SHA256
15fe1d70a18fb6771b530ddf66b484cbf29ab92e0d869d8c399a5ba477f74d5e

SHA512
a4850fffbf9adf4cb9eeb4997fec3a60e71f7729b84628dacc68cd05b08a948240fe241a00ef12a73d30cfbd2134c399cef954e39241ef6bbb708cd229786a9c

Download Submit
C:\Windows\SysWOW64\Bclang32.exe

Filesize
100KB

MD5
b77e9c7dd860224f3c31e060ac9ff5f2

SHA1
93c2934cfffab83137113400be1dd1465fe39de8

SHA256
8c0259753d1c4f19801d2005e94952bb0615c313e37302b7beea9852ca029e2b

SHA512
445eaf84d543ff37e01e57ef476eb733e77a0d854c53829fd28f890587d43e8b88c8a2aa4750d49c4582cde55a836fb1f838423acc802b884cfea972ed870517

Download Submit
C:\Windows\SysWOW64\Bclang32.exe

Filesize
100KB

MD5
b77e9c7dd860224f3c31e060ac9ff5f2

SHA1
93c2934cfffab83137113400be1dd1465fe39de8

SHA256
8c0259753d1c4f19801d2005e94952bb0615c313e37302b7beea9852ca029e2b

SHA512
445eaf84d543ff37e01e57ef476eb733e77a0d854c53829fd28f890587d43e8b88c8a2aa4750d49c4582cde55a836fb1f838423acc802b884cfea972ed870517

Download Submit
C:\Windows\SysWOW64\Bfgjjm32.exe

Filesize
100KB

MD5
1547b18fc64fb43fd2c9cefda3c27d26

SHA1
a3fc86304e602183ccb4cb7d27ac05b67b5576d8

SHA256
da1b39271cfc33fe99804cad7154fe75c2c296f3e49f815a27075e428f508250

SHA512
a6fb0509bca263177d4dc4e5aa632748c31719a6aa122f0d05517d5ce2af9fc6242dd8adf964aa9185180ae619f99e42a9148374e124324bf7e883c5ba6e41f5

Download Submit
C:\Windows\SysWOW64\Bjcmebie.exe

Filesize
100KB

MD5
c340c42c78f09255b3e45ae5b9fb0833

SHA1
c7d5666e84440cb2a6be92354499629ef945782e

SHA256
25d72f8d5dec2a83286346785d2122724ecace1cff91ba3d45368a734f0702e6

SHA512
45f73fb8160f9933fc66113117388fffa3ec8f9387b98b91f341dfd5b387dd6c70738246e0144db2efd18953fcbc996046f76dbbf6c24a582722db61cc4c2a6c

Download Submit
C:\Windows\SysWOW64\Bjcmebie.exe

Filesize
100KB

MD5
c340c42c78f09255b3e45ae5b9fb0833

SHA1
c7d5666e84440cb2a6be92354499629ef945782e

SHA256
25d72f8d5dec2a83286346785d2122724ecace1cff91ba3d45368a734f0702e6

SHA512
45f73fb8160f9933fc66113117388fffa3ec8f9387b98b91f341dfd5b387dd6c70738246e0144db2efd18953fcbc996046f76dbbf6c24a582722db61cc4c2a6c

Download Submit
C:\Windows\SysWOW64\Bkaobnio.exe

Filesize
100KB

MD5
66fdbd3233f1c73d19ac21390b03bfb5

SHA1
8226f1130ca1efd71723d4c546dd2c3c8d2d9557

SHA256
963a52089688c65707047ebd94fd6c06fff389d495dc85f63eb29a90a1718030

SHA512
e96d74cce516bb94489e30774850f6b72c89e819d23ad144beea3750df337619c4a22aaa9e8aae4a27e9995b0d42e41c4f813579f696ec4b807b90198b6db1bf

Download Submit
C:\Windows\SysWOW64\Bklomh32.exe

Filesize
100KB

MD5
2d1b1082506379a636e4b7f724703b74

SHA1
a7c66ffc5fd27abeecbbac1ba78f4213b5fe8d4d

SHA256
18c87d97cd821ba660aacaa2e174883c5818ea5b14462ccabea3ca796c55665f

SHA512
4858d81dfceef0eaa32ba7b301eb0c35698aafc1582c3415b08ac3da576f55669a6c51bef779a23b1cf864e0a68c4ecfdb95ce48779d905e39054dc4a647f323

Download Submit
C:\Windows\SysWOW64\Cabomkll.exe

Filesize
100KB

MD5
06b3bf2ce368e6036336f3fb7cb7759a

SHA1
88f20ee14e3f50becb371e174aa0ceb2a1bee439

SHA256
0bfa54ffc1edbd429b0cfc53faf4746cf2c0adae333d3d049f6b410a04253ffb

SHA512
6cac8f9977c422b7fe33feda7875f2fe6b6f12fddd085f378260e2dd33142852ad230416ef4bcc64c86237ddc9c50b3d92925ec9164ab5f151e330326f89299e

Download Submit
C:\Windows\SysWOW64\Cabomkll.exe

Filesize
100KB

MD5
06b3bf2ce368e6036336f3fb7cb7759a

SHA1
88f20ee14e3f50becb371e174aa0ceb2a1bee439

SHA256
0bfa54ffc1edbd429b0cfc53faf4746cf2c0adae333d3d049f6b410a04253ffb

SHA512
6cac8f9977c422b7fe33feda7875f2fe6b6f12fddd085f378260e2dd33142852ad230416ef4bcc64c86237ddc9c50b3d92925ec9164ab5f151e330326f89299e

Download Submit
C:\Windows\SysWOW64\Ccnncgmc.exe

Filesize
100KB

MD5
81f4e222e5ab1a154a97586cb19adc93

SHA1
c5fc133d727abe65d602d3826d44068fa1ba49de

SHA256
bcc3a2a5a5cdf776056681d3eda6eaaecdf0631e359bf8e4a3e63fe02d2284d3

SHA512
bb935d274c1e03ad4c048a36aa5d6ecd8feb1d1eff528b0350ccc4c83df5ac5a3fc7ad2f14be072d18b6bed7d2eb91ed83b66a5510669568ae24217b19b92c4b

Download Submit
C:\Windows\SysWOW64\Ccnncgmc.exe

Filesize
100KB

MD5
81f4e222e5ab1a154a97586cb19adc93

SHA1
c5fc133d727abe65d602d3826d44068fa1ba49de

SHA256
bcc3a2a5a5cdf776056681d3eda6eaaecdf0631e359bf8e4a3e63fe02d2284d3

SHA512
bb935d274c1e03ad4c048a36aa5d6ecd8feb1d1eff528b0350ccc4c83df5ac5a3fc7ad2f14be072d18b6bed7d2eb91ed83b66a5510669568ae24217b19b92c4b

Download Submit
C:\Windows\SysWOW64\Ccnncgmc.exe

Filesize
100KB

MD5
81f4e222e5ab1a154a97586cb19adc93

SHA1
c5fc133d727abe65d602d3826d44068fa1ba49de

SHA256
bcc3a2a5a5cdf776056681d3eda6eaaecdf0631e359bf8e4a3e63fe02d2284d3

SHA512
bb935d274c1e03ad4c048a36aa5d6ecd8feb1d1eff528b0350ccc4c83df5ac5a3fc7ad2f14be072d18b6bed7d2eb91ed83b66a5510669568ae24217b19b92c4b

Download Submit
C:\Windows\SysWOW64\Cgcmjd32.exe

Filesize
100KB

MD5
b25cd37acfca6f38947db9f1472860c0

SHA1
ab7731452155348ddf8818f37fdc4ff0aba2127b

SHA256
5d44f749f7f72fa10bc47d4fe185c2a78e1a3ea8a60f2054cff5b77e003dd552

SHA512
13f452c753bb17607c7dbdc2e12d77fce21cfa95fc266de9807985f40b5b66c0d124b6735ea766f727a46c9de751124f2feca7c83c98486ada677a4372b45526

Download Submit
C:\Windows\SysWOW64\Cgcmjd32.exe

Filesize
100KB

MD5
b25cd37acfca6f38947db9f1472860c0

SHA1
ab7731452155348ddf8818f37fdc4ff0aba2127b

SHA256
5d44f749f7f72fa10bc47d4fe185c2a78e1a3ea8a60f2054cff5b77e003dd552

SHA512
13f452c753bb17607c7dbdc2e12d77fce21cfa95fc266de9807985f40b5b66c0d124b6735ea766f727a46c9de751124f2feca7c83c98486ada677a4372b45526

Download Submit
C:\Windows\SysWOW64\Cgndoeag.exe

Filesize
100KB

MD5
35d3e0255e290ea3483596661d16abeb

SHA1
c0f6e411d57db2a2ff0c08b78545af11a7b80726

SHA256
2b5ca1667f1a742078ec05e7208ee66515051899059a20b5edf3943719bb0ff5

SHA512
e2d0934ff8edc820c740e79aa1bf67cfdc82cc074458a0cd1b8d4cf7ab575b0ce53ed90141a74e9cc67a1b7398eb413388f286ce998db20f2fb53dc7243b78cb

Download Submit
C:\Windows\SysWOW64\Cgndoeag.exe

Filesize
100KB

MD5
35d3e0255e290ea3483596661d16abeb

SHA1
c0f6e411d57db2a2ff0c08b78545af11a7b80726

SHA256
2b5ca1667f1a742078ec05e7208ee66515051899059a20b5edf3943719bb0ff5

SHA512
e2d0934ff8edc820c740e79aa1bf67cfdc82cc074458a0cd1b8d4cf7ab575b0ce53ed90141a74e9cc67a1b7398eb413388f286ce998db20f2fb53dc7243b78cb

Download Submit
C:\Windows\SysWOW64\Cibmlmeb.exe

Filesize
100KB

MD5
b4593cdb8a59d7521ccad7dbc3e51930

SHA1
682b2d1f6beb1ec76a3fa9f627ad64dffb0c8126

SHA256
d0a5d070637319d11864986279ad6845321c42e9b145e415d04c7f2d118f3c37

SHA512
6f1a3bf4632c233f745aae80ab1e14cbec3fe37faa7e74a0c56df35d7b855dde57e3084ff369f5b59e994f3f8f4fa72393637696799f94213e29d4754969dd22

Download Submit
C:\Windows\SysWOW64\Cibmlmeb.exe

Filesize
100KB

MD5
b4593cdb8a59d7521ccad7dbc3e51930

SHA1
682b2d1f6beb1ec76a3fa9f627ad64dffb0c8126

SHA256
d0a5d070637319d11864986279ad6845321c42e9b145e415d04c7f2d118f3c37

SHA512
6f1a3bf4632c233f745aae80ab1e14cbec3fe37faa7e74a0c56df35d7b855dde57e3084ff369f5b59e994f3f8f4fa72393637696799f94213e29d4754969dd22

Download Submit
C:\Windows\SysWOW64\Cimcan32.exe

Filesize
100KB

MD5
f9a03edebf8d060371c1678a82d9c12e

SHA1
7485520322f76ec772fc7e48ddc5358f38a92271

SHA256
832edc9ebb44e0399457546f98fefbe09eacf79d618d2509a582f25674d8b9d0

SHA512
8c109a645efbe1e2ee2e9eb3dd0629b807a92b060b2a5ab0ad71873c3b5f6c086555d87e3580e61ae2aee052f568b999da19c802b2a18b6002d122caac17e48c

Download Submit
C:\Windows\SysWOW64\Cimcan32.exe

Filesize
100KB

MD5
f9a03edebf8d060371c1678a82d9c12e

SHA1
7485520322f76ec772fc7e48ddc5358f38a92271

SHA256
832edc9ebb44e0399457546f98fefbe09eacf79d618d2509a582f25674d8b9d0

SHA512
8c109a645efbe1e2ee2e9eb3dd0629b807a92b060b2a5ab0ad71873c3b5f6c086555d87e3580e61ae2aee052f568b999da19c802b2a18b6002d122caac17e48c

Download Submit
C:\Windows\SysWOW64\Cimcan32.exe

Filesize
100KB

MD5
f9a03edebf8d060371c1678a82d9c12e

SHA1
7485520322f76ec772fc7e48ddc5358f38a92271

SHA256
832edc9ebb44e0399457546f98fefbe09eacf79d618d2509a582f25674d8b9d0

SHA512
8c109a645efbe1e2ee2e9eb3dd0629b807a92b060b2a5ab0ad71873c3b5f6c086555d87e3580e61ae2aee052f568b999da19c802b2a18b6002d122caac17e48c

Download Submit
C:\Windows\SysWOW64\Cpihcgoa.exe

Filesize
100KB

MD5
f7ca63aab840d9c36a4dd2f2cdad6e82

SHA1
46284ba4c0679ca44a6cb733984a81f01312ac37

SHA256
e8f48198c1d92020d86dc7f53140dbc580d7f601fa742d2d2162b266fd7a9eb6

SHA512
7c6106d33d11baf8833ad0515f60af978854f868d56a12b34b164280e0490aac966ae233ad58e88ca4ec1b5bb845d96c85e05c5609aa827bf79211e6b240432b

Download Submit
C:\Windows\SysWOW64\Cpihcgoa.exe

Filesize
100KB

MD5
f7ca63aab840d9c36a4dd2f2cdad6e82

SHA1
46284ba4c0679ca44a6cb733984a81f01312ac37

SHA256
e8f48198c1d92020d86dc7f53140dbc580d7f601fa742d2d2162b266fd7a9eb6

SHA512
7c6106d33d11baf8833ad0515f60af978854f868d56a12b34b164280e0490aac966ae233ad58e88ca4ec1b5bb845d96c85e05c5609aa827bf79211e6b240432b

Download Submit
C:\Windows\SysWOW64\Dabhdinj.exe

Filesize
100KB

MD5
cf66755554d80e1044e51fdaf316c877

SHA1
c3f3b4eb8ff87e0062d09b127bdacac5f22ecc68

SHA256
d4ba494c4f1082ce9a39c9e95c6e224f0aa5e96248e7abf201e3e875e76670bf

SHA512
5ff441aeb63e6d7c55182b3ef73414bd0107af3faeba7eabf57a1019e35d918462da15ba6c4c337dcc1a7a5ab8423d7d2503393a002d48ce83ceff2ddaa89e40

Download Submit
C:\Windows\SysWOW64\Dabhdinj.exe

Filesize
100KB

MD5
cf66755554d80e1044e51fdaf316c877

SHA1
c3f3b4eb8ff87e0062d09b127bdacac5f22ecc68

SHA256
d4ba494c4f1082ce9a39c9e95c6e224f0aa5e96248e7abf201e3e875e76670bf

SHA512
5ff441aeb63e6d7c55182b3ef73414bd0107af3faeba7eabf57a1019e35d918462da15ba6c4c337dcc1a7a5ab8423d7d2503393a002d48ce83ceff2ddaa89e40

Download Submit
C:\Windows\SysWOW64\Dapkni32.exe

Filesize
100KB

MD5
65823479decc2b0ab0eacd323d556714

SHA1
a41d6f21cf11545e8f7c1a58d2c1fda86fc923e3

SHA256
ba3784b1a2ae4092faa93ab3de33b928fec3ac0ed6ae768b7e79e38f4798cf12

SHA512
98074a538d561cdf3c23ed4420a654b06f419e3194d87135734728a8c2f4a318f0003b78f1ee32ca9ad1390bb36237c1a27d647bfc998bb9d7cf4258d5c79296

Download Submit
C:\Windows\SysWOW64\Dapkni32.exe

Filesize
100KB

MD5
65823479decc2b0ab0eacd323d556714

SHA1
a41d6f21cf11545e8f7c1a58d2c1fda86fc923e3

SHA256
ba3784b1a2ae4092faa93ab3de33b928fec3ac0ed6ae768b7e79e38f4798cf12

SHA512
98074a538d561cdf3c23ed4420a654b06f419e3194d87135734728a8c2f4a318f0003b78f1ee32ca9ad1390bb36237c1a27d647bfc998bb9d7cf4258d5c79296

Download Submit
C:\Windows\SysWOW64\Dapkni32.exe

Filesize
100KB

MD5
65823479decc2b0ab0eacd323d556714

SHA1
a41d6f21cf11545e8f7c1a58d2c1fda86fc923e3

SHA256
ba3784b1a2ae4092faa93ab3de33b928fec3ac0ed6ae768b7e79e38f4798cf12

SHA512
98074a538d561cdf3c23ed4420a654b06f419e3194d87135734728a8c2f4a318f0003b78f1ee32ca9ad1390bb36237c1a27d647bfc998bb9d7cf4258d5c79296

Download Submit
C:\Windows\SysWOW64\Dbocfo32.exe

Filesize
100KB

MD5
fae7a36ad76c09383ec08732d103c065

SHA1
cc2a789b55324eec392b1e968b25175e0a159add

SHA256
d8a67ce3abdc7d4b702663aa88001fc8e9310112c88a864ee2bd0a352a3c4c3e

SHA512
65bf3ac7fd37fab3be301b1a935a8ec960697cc95a11d0d91a545785c138eed6c381c286cf3896d5569f3c8ca3beb6d38d463601dbfb85db7beb0b9d56eb33bd

Download Submit
C:\Windows\SysWOW64\Dglkaf32.dll

Filesize
7KB

MD5
a762391d573b34c0ed52f42a4fa7f3da

SHA1
8f05ce50ad63bb1437094efccee58e95d4a2dd5f

SHA256
2f1380086a9843c4606d58240a9cd80b52870b709afdfa888cc8ef16c65256f6

SHA512
25b2cdce026759862f538111b1af2fd3ded2b55ec68989408f41da36c163491727a654974e6816624d8e5c5d5ea4967cfe4c28e4f14a8674c667945461befd08

Download Submit
C:\Windows\SysWOW64\Dhomfc32.exe

Filesize
100KB

MD5
69409f7edded32d2414fefb473fa4d7d

SHA1
d1464129dbba0820b8ec0c9e2ad63f82f75f4cb6

SHA256
184dc099480a7c3b52e75d905ca7161752b86c59bfe51bb6cde5e3113e547965

SHA512
20fda2123d004819f886da5b210cef6556c6ffcdecd2e5e3fe4cb460f201ec7a7ef31540cc04b4b88e8dc7aeda2fd3de3c03fc230238cc31ff63957a28b37708

Download Submit
C:\Windows\SysWOW64\Dhomfc32.exe

Filesize
100KB

MD5
69409f7edded32d2414fefb473fa4d7d

SHA1
d1464129dbba0820b8ec0c9e2ad63f82f75f4cb6

SHA256
184dc099480a7c3b52e75d905ca7161752b86c59bfe51bb6cde5e3113e547965

SHA512
20fda2123d004819f886da5b210cef6556c6ffcdecd2e5e3fe4cb460f201ec7a7ef31540cc04b4b88e8dc7aeda2fd3de3c03fc230238cc31ff63957a28b37708

Download Submit
C:\Windows\SysWOW64\Dinmhkke.exe

Filesize
100KB

MD5
32da79eba175b6bf3d33c551746711e9

SHA1
bf8da2e35d255f620327e0fa979b3bb0ededefe7

SHA256
80746b3442e65d9c744b36f3d13a1a168ffcd6f8eeb60395b0585ca1b045a560

SHA512
2350d7dc49524261a27064c0c3bb2b054e97fc05e70b1f554658d5ad45a11bb3ff22dccc72bb6daf7b9880c204c3254e7d49f751fe7d8c1be9d52a6a4c859ea4

Download Submit
C:\Windows\SysWOW64\Dinmhkke.exe

Filesize
100KB

MD5
32da79eba175b6bf3d33c551746711e9

SHA1
bf8da2e35d255f620327e0fa979b3bb0ededefe7

SHA256
80746b3442e65d9c744b36f3d13a1a168ffcd6f8eeb60395b0585ca1b045a560

SHA512
2350d7dc49524261a27064c0c3bb2b054e97fc05e70b1f554658d5ad45a11bb3ff22dccc72bb6daf7b9880c204c3254e7d49f751fe7d8c1be9d52a6a4c859ea4

Download Submit
C:\Windows\SysWOW64\Edmclccp.exe

Filesize
100KB

MD5
73d7c4cb5eb19b8e2f1a45a4734a5927

SHA1
86d1e87e9ebc3695c50f55b26d76d11b5d9adb00

SHA256
e13dbca2ec01993b8a7491ab01397eb13d5a45ea30f2e59d31262b84c016d41b

SHA512
7dcf752cab19e5e263a5b065d46e22b0014b12673f662ce730d54ceb2fcc616da8029cd6457df7ed89e02173521c1596f68888ae70e6bd648694be1286a34455

Download Submit
C:\Windows\SysWOW64\Edmclccp.exe

Filesize
100KB

MD5
73d7c4cb5eb19b8e2f1a45a4734a5927

SHA1
86d1e87e9ebc3695c50f55b26d76d11b5d9adb00

SHA256
e13dbca2ec01993b8a7491ab01397eb13d5a45ea30f2e59d31262b84c016d41b

SHA512
7dcf752cab19e5e263a5b065d46e22b0014b12673f662ce730d54ceb2fcc616da8029cd6457df7ed89e02173521c1596f68888ae70e6bd648694be1286a34455

Download Submit
C:\Windows\SysWOW64\Edopabqn.exe

Filesize
100KB

MD5
21ea7482f91dd30c8a9b1c5520e0cd0e

SHA1
dbca5f3f8fd1c606165458281045e935c93f508c

SHA256
678bc52e0e2f22ae77bf270c230a2e055a2122ebca6bd15e3b80b8adce0c8043

SHA512
ad3a8d86bfebb1a8e0ec0aaf679fb5fcbcc05635f441d7917c88e393f4b2d6f6179fe86de1f22405ff4575b399abb9d2b47dab8253608eb83475b509ad23c420

Download Submit
C:\Windows\SysWOW64\Edopabqn.exe

Filesize
100KB

MD5
21ea7482f91dd30c8a9b1c5520e0cd0e

SHA1
dbca5f3f8fd1c606165458281045e935c93f508c

SHA256
678bc52e0e2f22ae77bf270c230a2e055a2122ebca6bd15e3b80b8adce0c8043

SHA512
ad3a8d86bfebb1a8e0ec0aaf679fb5fcbcc05635f441d7917c88e393f4b2d6f6179fe86de1f22405ff4575b399abb9d2b47dab8253608eb83475b509ad23c420

Download Submit
C:\Windows\SysWOW64\Efdjgo32.exe

Filesize
100KB

MD5
97248f1d1a4b8a20a7276e13e6744c51

SHA1
e7403f953dd3640edbdb31099c85a9b60d8f1bc3

SHA256
eb04ec0763d616c5531d043676ae781d926f27af33b24185ed42e645e9c3d43e

SHA512
67670e112e033a558c5d2bf9d345ae130170131253869493c0caa6a196eb56c51f14064ea7d5216d1e0f4d5cf9c061bbb56ff341f2318ce7f6c70187af792236

Download Submit
C:\Windows\SysWOW64\Efdjgo32.exe

Filesize
100KB

MD5
97248f1d1a4b8a20a7276e13e6744c51

SHA1
e7403f953dd3640edbdb31099c85a9b60d8f1bc3

SHA256
eb04ec0763d616c5531d043676ae781d926f27af33b24185ed42e645e9c3d43e

SHA512
67670e112e033a558c5d2bf9d345ae130170131253869493c0caa6a196eb56c51f14064ea7d5216d1e0f4d5cf9c061bbb56ff341f2318ce7f6c70187af792236

Download Submit
C:\Windows\SysWOW64\Ejbbmnnb.exe

Filesize
100KB

MD5
f884926973b6e177283b1331223744d6

SHA1
92b3969434462fdbde447866097c8f6df7f41290

SHA256
49919b74b505b730aa02de570cda0878733d67ee66f87788907a6aa5b3ba64db

SHA512
ce1ac84a875b5384b3a089ce4e461643ced2097b00663b93438217961b17f76ec39fafebd7bae422cf92f544239407f0f37f4a9f5112728ade21dba229428311

Download Submit
C:\Windows\SysWOW64\Ejbbmnnb.exe

Filesize
100KB

MD5
f884926973b6e177283b1331223744d6

SHA1
92b3969434462fdbde447866097c8f6df7f41290

SHA256
49919b74b505b730aa02de570cda0878733d67ee66f87788907a6aa5b3ba64db

SHA512
ce1ac84a875b5384b3a089ce4e461643ced2097b00663b93438217961b17f76ec39fafebd7bae422cf92f544239407f0f37f4a9f5112728ade21dba229428311

Download Submit
C:\Windows\SysWOW64\Ejdocm32.exe

Filesize
100KB

MD5
7c7ea0d18e621f3e328a10082a5fd946

SHA1
5117d3e50b429cd0268867b5c7a2edae63ffdcd9

SHA256
cac94fb3cf41a156ff781c3357957461f8a7caa0c31e9d8ae711962dd8637c75

SHA512
0c07bb50b8aa7b4c9047c1ecd77bfe4ed091d2e2d6afc8e873a38db756571f875e41f14d02b88af64c2f30e246a006d28272bd340e176a420b842d95c3921086

Download Submit
C:\Windows\SysWOW64\Ejdocm32.exe

Filesize
100KB

MD5
7c7ea0d18e621f3e328a10082a5fd946

SHA1
5117d3e50b429cd0268867b5c7a2edae63ffdcd9

SHA256
cac94fb3cf41a156ff781c3357957461f8a7caa0c31e9d8ae711962dd8637c75

SHA512
0c07bb50b8aa7b4c9047c1ecd77bfe4ed091d2e2d6afc8e873a38db756571f875e41f14d02b88af64c2f30e246a006d28272bd340e176a420b842d95c3921086

Download Submit
C:\Windows\SysWOW64\Ejdocm32.exe

Filesize
100KB

MD5
7c7ea0d18e621f3e328a10082a5fd946

SHA1
5117d3e50b429cd0268867b5c7a2edae63ffdcd9

SHA256
cac94fb3cf41a156ff781c3357957461f8a7caa0c31e9d8ae711962dd8637c75

SHA512
0c07bb50b8aa7b4c9047c1ecd77bfe4ed091d2e2d6afc8e873a38db756571f875e41f14d02b88af64c2f30e246a006d28272bd340e176a420b842d95c3921086

Download Submit
C:\Windows\SysWOW64\Emlenj32.exe

Filesize
100KB

MD5
a8e5fc97d55b103ea8f1845f1f6b2aec

SHA1
bab4e5b660e108382ee968c3b4cc5523f01f55cf

SHA256
36636856d2fe91f69ccd6d577fdca3e4361367599fcba5be8e44fe6efa066e3d

SHA512
e5bf86ea39e487c3bc5a14e197ad8b7b704df3540b76919bac7e26853f8dd8c6ac8feaf00ea271dc5b6f17f9ea1e14aac4a4ecf74daad5454635fb5f7f3397dd

Download Submit
C:\Windows\SysWOW64\Emlenj32.exe

Filesize
100KB

MD5
a8e5fc97d55b103ea8f1845f1f6b2aec

SHA1
bab4e5b660e108382ee968c3b4cc5523f01f55cf

SHA256
36636856d2fe91f69ccd6d577fdca3e4361367599fcba5be8e44fe6efa066e3d

SHA512
e5bf86ea39e487c3bc5a14e197ad8b7b704df3540b76919bac7e26853f8dd8c6ac8feaf00ea271dc5b6f17f9ea1e14aac4a4ecf74daad5454635fb5f7f3397dd

Download Submit
C:\Windows\SysWOW64\Facqkg32.exe

Filesize
100KB

MD5
757f7d5dca4d5e5b3ee41dc79a17d025

SHA1
7812e9bea82e7d704f3b5e30d7a45f1bbbaaf88d

SHA256
da8f0c5d978cc65c2d3a026d7de20d0bd503a96f739a8d7680e415a570e6d0b8

SHA512
f80eef367d2b8c5cf858e72f6d3eed5577525626ed51623cf873d6d462bd9f9754b41f9da8ce20dfebdb27bbedf3db269d4e8db1cf875d68e86f7e703b601751

Download Submit
C:\Windows\SysWOW64\Facqkg32.exe

Filesize
100KB

MD5
757f7d5dca4d5e5b3ee41dc79a17d025

SHA1
7812e9bea82e7d704f3b5e30d7a45f1bbbaaf88d

SHA256
da8f0c5d978cc65c2d3a026d7de20d0bd503a96f739a8d7680e415a570e6d0b8

SHA512
f80eef367d2b8c5cf858e72f6d3eed5577525626ed51623cf873d6d462bd9f9754b41f9da8ce20dfebdb27bbedf3db269d4e8db1cf875d68e86f7e703b601751

Download Submit
C:\Windows\SysWOW64\Fbbpmb32.exe

Filesize
100KB

MD5
bb6a93174954179daf7fdac57af6fcbd

SHA1
6b89d96641dc3e688d475df79fb8cd0b6142a748

SHA256
588ea33fb661d81184b8d6ad773844131649a629bc2b8c35d4aa782b80d8ac4a

SHA512
c889c68bb22eee6e00c429279510bcf61ae9d7d98d42e2166d873930d136714d591e1d9c2d6adba42b71d13afde2d7040a5c4f9afa5bc144bce383435cafb57b

Download Submit
C:\Windows\SysWOW64\Ffpicn32.exe

Filesize
100KB

MD5
ea69a0e9a4153d8be772fc83f9d8319b

SHA1
444d8d3e87bd9872bc45b04cc8aafbc9eb9e653f

SHA256
c6c79d8f43c0bebce1026d700507694e181a4b5af47003a4a77d8e9419608bac

SHA512
f960728833a3f05bbc13293286ec04e7b1a6dc4a47dbf19904dd9dc1852ca77da4ced6e30a3a9b4e05f1952decebf316aa54ec21af3055a9f3e30e7b86376c5b

Download Submit
C:\Windows\SysWOW64\Ffpicn32.exe

Filesize
100KB

MD5
ea69a0e9a4153d8be772fc83f9d8319b

SHA1
444d8d3e87bd9872bc45b04cc8aafbc9eb9e653f

SHA256
c6c79d8f43c0bebce1026d700507694e181a4b5af47003a4a77d8e9419608bac

SHA512
f960728833a3f05bbc13293286ec04e7b1a6dc4a47dbf19904dd9dc1852ca77da4ced6e30a3a9b4e05f1952decebf316aa54ec21af3055a9f3e30e7b86376c5b

Download Submit
C:\Windows\SysWOW64\Fgdbnmji.exe

Filesize
100KB

MD5
8f52751d09119ab50dedc0ce489ec075

SHA1
eb004ff74ab0a1f90fcbe8f1dc9eaf5654f8a758

SHA256
fea7cd29bd553c595af1f9938760c845b0d7682a011b1f95b192822dd16c09f0

SHA512
aa87f42b9528f710179b71513343867dd4571f87e6e11d43f4666581e6cb6c858c509c507599bad0d2ce954c3bbf58b59bfe7343ec7835c552fa2b6fc74a0e22

Download Submit
C:\Windows\SysWOW64\Fgdbnmji.exe

Filesize
100KB

MD5
8f52751d09119ab50dedc0ce489ec075

SHA1
eb004ff74ab0a1f90fcbe8f1dc9eaf5654f8a758

SHA256
fea7cd29bd553c595af1f9938760c845b0d7682a011b1f95b192822dd16c09f0

SHA512
aa87f42b9528f710179b71513343867dd4571f87e6e11d43f4666581e6cb6c858c509c507599bad0d2ce954c3bbf58b59bfe7343ec7835c552fa2b6fc74a0e22

Download Submit
C:\Windows\SysWOW64\Fhofmq32.exe

Filesize
100KB

MD5
4c691b611bc17a4a904667a1b46a694b

SHA1
1d64165fe491d86f83c0b09bc793768a9e0f66eb

SHA256
60525e1d3e906f40f8ec3b813f015e8a70cae55329fe5f4d4a6df450c71f29bb

SHA512
bd68cd9bba19dbe4cb97bb67eeeaa1d397ec42edbb9a8cbed51c9af44468fe33c55b598de30ca32d1e4cfac70b6120166e53a4463b2f6e04e77052dc07f995fe

Download Submit
C:\Windows\SysWOW64\Fhofmq32.exe

Filesize
100KB

MD5
4c691b611bc17a4a904667a1b46a694b

SHA1
1d64165fe491d86f83c0b09bc793768a9e0f66eb

SHA256
60525e1d3e906f40f8ec3b813f015e8a70cae55329fe5f4d4a6df450c71f29bb

SHA512
bd68cd9bba19dbe4cb97bb67eeeaa1d397ec42edbb9a8cbed51c9af44468fe33c55b598de30ca32d1e4cfac70b6120166e53a4463b2f6e04e77052dc07f995fe

Download Submit
C:\Windows\SysWOW64\Fmlneg32.exe

Filesize
100KB

MD5
1ea2229ca46059eb75b4c4fdbe95812a

SHA1
68c941d0646b7215bb84db7d02d2b3b0a5b18fa5

SHA256
e26ea91851cb799844cfa19a22282aa2d1642cc6ee89fc6b0b62119fe525393b

SHA512
a27b0a0355865b01a99305d8c5af5eafb54576cfa012fcb76611ae73e4df4cc821f02c3f10a1abff9b15abe9eec6d7a379d81de2d0cf57c6a3e71332b1989776

Download Submit
C:\Windows\SysWOW64\Fmlneg32.exe

Filesize
100KB

MD5
1ea2229ca46059eb75b4c4fdbe95812a

SHA1
68c941d0646b7215bb84db7d02d2b3b0a5b18fa5

SHA256
e26ea91851cb799844cfa19a22282aa2d1642cc6ee89fc6b0b62119fe525393b

SHA512
a27b0a0355865b01a99305d8c5af5eafb54576cfa012fcb76611ae73e4df4cc821f02c3f10a1abff9b15abe9eec6d7a379d81de2d0cf57c6a3e71332b1989776

Download Submit
C:\Windows\SysWOW64\Fpmggb32.exe

Filesize
100KB

MD5
48791d2dc16cbd7c11bbe53ed1c96160

SHA1
7f2658e0fb1ad61052101927e442b746d57be25a

SHA256
022b477df6414525e8906d6fd7d866498986a4051a4dd1d051b2b76809ed1fb7

SHA512
5816c72e0cd78e8ebb16bf1e810eda57fe49f55953bf061575ed772b19cd93d411d3296793da91f223a4bf419116402d4941bca578bfe63944f8a985c908a1b2

Download Submit
C:\Windows\SysWOW64\Fpmggb32.exe

Filesize
100KB

MD5
48791d2dc16cbd7c11bbe53ed1c96160

SHA1
7f2658e0fb1ad61052101927e442b746d57be25a

SHA256
022b477df6414525e8906d6fd7d866498986a4051a4dd1d051b2b76809ed1fb7

SHA512
5816c72e0cd78e8ebb16bf1e810eda57fe49f55953bf061575ed772b19cd93d411d3296793da91f223a4bf419116402d4941bca578bfe63944f8a985c908a1b2

Download Submit
C:\Windows\SysWOW64\Ggbook32.exe

Filesize
100KB

MD5
8cfd203770af89e405857c717a82081d

SHA1
bdb62b2786b23af9746acb59d894e36a6fea64d9

SHA256
fa8983ea90f4cd07e88dbcacaa8defd5ff17c3033a74b9de84daf12074853e29

SHA512
b0f26a8ff89b31c2423a00a123050949495593d40cd65e9ca6d9878f436832d8e31eb7c6353bdb5af78e02c708b75d1f323ca2a5cd855080f1f189f9d2f7bb75

Download Submit
C:\Windows\SysWOW64\Ggbook32.exe

Filesize
100KB

MD5
8cfd203770af89e405857c717a82081d

SHA1
bdb62b2786b23af9746acb59d894e36a6fea64d9

SHA256
fa8983ea90f4cd07e88dbcacaa8defd5ff17c3033a74b9de84daf12074853e29

SHA512
b0f26a8ff89b31c2423a00a123050949495593d40cd65e9ca6d9878f436832d8e31eb7c6353bdb5af78e02c708b75d1f323ca2a5cd855080f1f189f9d2f7bb75

Download Submit
C:\Windows\SysWOW64\Ghkeio32.exe

Filesize
100KB

MD5
a4c51ba9262ebda913ebaf488fdf3b6c

SHA1
88a009d5544b0829625e270edb32274d2228f9cd

SHA256
ec3c6f517e8a9e0066d075898173bb481423dbe78d1ba0e7b3804fdffd83a9a9

SHA512
80b4b01bcb05d4f657f8c1eec1dddf923469a41a14ba14d6219bf2de60323d77918b9bf97ff064ea30074d58985a80667bd118ec399d1f0ec8ecc77dc2aaef1f

Download Submit
C:\Windows\SysWOW64\Ghkeio32.exe

Filesize
100KB

MD5
a4c51ba9262ebda913ebaf488fdf3b6c

SHA1
88a009d5544b0829625e270edb32274d2228f9cd

SHA256
ec3c6f517e8a9e0066d075898173bb481423dbe78d1ba0e7b3804fdffd83a9a9

SHA512
80b4b01bcb05d4f657f8c1eec1dddf923469a41a14ba14d6219bf2de60323d77918b9bf97ff064ea30074d58985a80667bd118ec399d1f0ec8ecc77dc2aaef1f

Download Submit
C:\Windows\SysWOW64\Ghkeio32.exe

Filesize
100KB

MD5
a4c51ba9262ebda913ebaf488fdf3b6c

SHA1
88a009d5544b0829625e270edb32274d2228f9cd

SHA256
ec3c6f517e8a9e0066d075898173bb481423dbe78d1ba0e7b3804fdffd83a9a9

SHA512
80b4b01bcb05d4f657f8c1eec1dddf923469a41a14ba14d6219bf2de60323d77918b9bf97ff064ea30074d58985a80667bd118ec399d1f0ec8ecc77dc2aaef1f

Download Submit
C:\Windows\SysWOW64\Ghmbno32.exe

Filesize
100KB

MD5
f373ceee9f3021f6e9ed46553bec66cb

SHA1
9c49d8365bd8f96df858686fb09e1cf14d628318

SHA256
3dc8554fe5f4e1e649ea4339f06dad69eb17a432f174c782f391794133b785bf

SHA512
0aaced3be14eb21c443b96a2e384dadabd8a26f1810c090354f1ee8db743417f1f2a600903d00d985e3dffc8c7e60d30e5b2c04c44b82fce7219e57fb5018371

Download Submit
C:\Windows\SysWOW64\Ghmbno32.exe

Filesize
100KB

MD5
f373ceee9f3021f6e9ed46553bec66cb

SHA1
9c49d8365bd8f96df858686fb09e1cf14d628318

SHA256
3dc8554fe5f4e1e649ea4339f06dad69eb17a432f174c782f391794133b785bf

SHA512
0aaced3be14eb21c443b96a2e384dadabd8a26f1810c090354f1ee8db743417f1f2a600903d00d985e3dffc8c7e60d30e5b2c04c44b82fce7219e57fb5018371

Download Submit
C:\Windows\SysWOW64\Gnhnaf32.exe

Filesize
100KB

MD5
8d4340654eb5005ab55f3450985e323c

SHA1
d2d26ac3b99258d8319741be96c052cf435621b8

SHA256
e236285d25956941ffe63deabf51368a6f66b6c2f039f2862b91d8d6ef05e6e1

SHA512
43ce5e5d1f347fd220d94838b3abcd16d6afb5cd365892af4bf4b5f93a6398a6fcd619301ead215db441dbaa10d2eab41cc99b1da059e2c5d4451044e6411d2d

Download Submit
C:\Windows\SysWOW64\Gnhnaf32.exe

Filesize
100KB

MD5
8d4340654eb5005ab55f3450985e323c

SHA1
d2d26ac3b99258d8319741be96c052cf435621b8

SHA256
e236285d25956941ffe63deabf51368a6f66b6c2f039f2862b91d8d6ef05e6e1

SHA512
43ce5e5d1f347fd220d94838b3abcd16d6afb5cd365892af4bf4b5f93a6398a6fcd619301ead215db441dbaa10d2eab41cc99b1da059e2c5d4451044e6411d2d

Download Submit
C:\Windows\SysWOW64\Gnjjfegi.exe

Filesize
100KB

MD5
e352a85e0a490f3032b2b1ceabfb3354

SHA1
3116cef268612d6e4035f72e6f9fce917fbbd0d0

SHA256
42b7b31767528793edba99a57c39af66cae7f5c60390a443b843169edfdb9d5d

SHA512
cc9ff4857b376f6fdd3ec4dd5f688da716a5ab4b985807820c95503cc446b75b26e9354910db278491f809e2e74bc4de00e723eea80edff265a8298b5f7a2254

Download Submit
C:\Windows\SysWOW64\Gnjjfegi.exe

Filesize
100KB

MD5
e352a85e0a490f3032b2b1ceabfb3354

SHA1
3116cef268612d6e4035f72e6f9fce917fbbd0d0

SHA256
42b7b31767528793edba99a57c39af66cae7f5c60390a443b843169edfdb9d5d

SHA512
cc9ff4857b376f6fdd3ec4dd5f688da716a5ab4b985807820c95503cc446b75b26e9354910db278491f809e2e74bc4de00e723eea80edff265a8298b5f7a2254

Download Submit
C:\Windows\SysWOW64\Gnlgleef.exe

Filesize
100KB

MD5
93f58b36eab00a39d8480acbfbcd08c4

SHA1
09041638f2a167fc935dfc906f879be35734c46a

SHA256
af5677b6c3e3244fde2896a78bf21e5a232e74bd8f9685f86548acc7310f3b87

SHA512
aac0625f59669c70a7abfe1b08e23fedd251f21a40950d3165c3c947d8d56d9dc5d538d9ed00888cdcbae2255e30e8774408264f09ed8f3d89e462710a7b1ee6

Download Submit
C:\Windows\SysWOW64\Gnlgleef.exe

Filesize
100KB

MD5
93f58b36eab00a39d8480acbfbcd08c4

SHA1
09041638f2a167fc935dfc906f879be35734c46a

SHA256
af5677b6c3e3244fde2896a78bf21e5a232e74bd8f9685f86548acc7310f3b87

SHA512
aac0625f59669c70a7abfe1b08e23fedd251f21a40950d3165c3c947d8d56d9dc5d538d9ed00888cdcbae2255e30e8774408264f09ed8f3d89e462710a7b1ee6

Download Submit
C:\Windows\SysWOW64\Hgelek32.exe

Filesize
100KB

MD5
39aab6a45c9bef56b0b0e306059e0844

SHA1
76d6cd0c9f5f8fa8b68372272915964d6abdb81e

SHA256
445d2283e97f099a7351d2a5320a6606757ae98ef07505a15b42bc83843e854e

SHA512
989282eb311f95086b3bc8321cfebdddd814196bad002c25f7e61e76c9f29882cf700d735198a0b06b523b471f45f84259653da3638e5578ff2982c9b1d32cd4

Download Submit
C:\Windows\SysWOW64\Hgelek32.exe

Filesize
100KB

MD5
39aab6a45c9bef56b0b0e306059e0844

SHA1
76d6cd0c9f5f8fa8b68372272915964d6abdb81e

SHA256
445d2283e97f099a7351d2a5320a6606757ae98ef07505a15b42bc83843e854e

SHA512
989282eb311f95086b3bc8321cfebdddd814196bad002c25f7e61e76c9f29882cf700d735198a0b06b523b471f45f84259653da3638e5578ff2982c9b1d32cd4

Download Submit
C:\Windows\SysWOW64\Hgghjjid.exe

Filesize
100KB

MD5
ad360a9408f212cdfe6d8790863c1579

SHA1
092b92a37da57d1a33e69fd410a306797f8de536

SHA256
0f9cf9eecac39b60d5853b9104a61d3cb7ac7c8bc6c4d7b661220652aad5c47e

SHA512
673e6de502f7db53f71710ba64b47d2452d3fc0821c2370880e83b662a9c73c52ea8a08cf0f0d5567d24638e3ae4bf79c5c97ad77feecacda38d3e7226be7e78

Download Submit
C:\Windows\SysWOW64\Igjngh32.exe

Filesize
100KB

MD5
8f1201686feb91b9c1bd66a46aa65f91

SHA1
fddc7037a500ded7152f73e2c9e58cd84ba93c65

SHA256
16055c93b8236086d1be19e7090ae65f961d47033edd672893b267e0c94bec17

SHA512
12c9f23dfdc0ad0ed5c31af9817e10368c04f271f158fe94756a30c8cc260adeda258ab8806c8c608068464c437da75c92152acf12b3b5e9d529c53ec34b0bcc

Download Submit
C:\Windows\SysWOW64\Igqkqiai.exe

Filesize
100KB

MD5
e765eda485df03018a3ec816b15cc9fb

SHA1
d1feac68b105dd4dfc4a11276f43eb9fc5f42eb0

SHA256
df13ac73b97208642c560a8e02757667221d2ec4a45271058341410dcc8da7d5

SHA512
4899f5898e6f4c1b36c7c93eab155cfa02c8eba1b6c4fd37cd128b79708a57cb50b1fc1149df739a7bcbdddf5eeb802058e05707951c6b2ebf03f1725c5520fb

Download Submit
C:\Windows\SysWOW64\Jcoaglhk.exe

Filesize
100KB

MD5
cbb580652ccd5cdcf7e1993e63ad18e4

SHA1
8137b0ca4959d8303ca03bb5d00a0515fe920a22

SHA256
958d83033e5dee7a5273b8a0a2cdb8673be46154e359214fbd796a2a691dee98

SHA512
915be320109b7f9400bb64cd4dbea4774710d58ac8a2aee8b4debc6056a9e074bff878d3ac78a4449441936fae292d8596482f7d917affcd3e898020d6aa45ef

Download Submit
C:\Windows\SysWOW64\Jnmijq32.exe

Filesize
100KB

MD5
2c95cddba52566c745b90e2b4ef3e53d

SHA1
69cf4df468320469d20e1bb6277311a8e1ee3d44

SHA256
13c831c3635d505acaafc081574fded695f0424500a1c39ff60d63e5e2426522

SHA512
ce3b5c9ff879cfe4a953ee115f6d22195d932135d31905334665a6dfb865928d1251cd705bce6a24105823d5a39c69cd275cd8a4b3774f06d0ea825339211e7e

Download Submit
C:\Windows\SysWOW64\Kgninn32.exe

Filesize
100KB

MD5
094a95ac07c100ce3e1819a893ab2c29

SHA1
20e5e99c2f610e887c9685ca43d78b7ccc8c0af2

SHA256
698bf0873def7ec06065f2342dbb02e3090769e8407fbb80d682620ce4ff61e1

SHA512
73abc4a7b0adde31c65bf3a9bb63122a212deba0b77d21e8c7171d19454baf60ca2a66cc3fe0ef37338ef5b394db4e34c8f00e0455385cc8d40e3d2b6eb86bb6

Download Submit
C:\Windows\SysWOW64\Kjlopc32.exe

Filesize
100KB

MD5
ed64c80a063b2dc15285ecdb513d35a0

SHA1
adcdffb7f481020aac9ff8da1c4027cf028319dc

SHA256
eea86f392151dd83639adbfbc56cbf10a58250b6fd136f62b36467e530f07830

SHA512
53708338fdfeb2c477b60e3c84d334e7e0406deb2ac7f7a0bd739841dbf208e7840bd37c46bf15d4f6de1e53615b63860f412157e34b746d5c2df126ab8dfc3b

Download Submit
C:\Windows\SysWOW64\Knchpiom.exe

Filesize
100KB

MD5
f2a9b718ad996b375aff95e826637429

SHA1
90c419252e4135eb0c1e31dc97bea671c56d033e

SHA256
c2d1162b37a7a1b57938db7e37235305a05f9ff995b72d26d44d3a470dddf1bc

SHA512
a215491a496080dda6b7bf008fcefa4d11533226af5f2707372ab2e2ae539d3f29ed97a2fd153c64bd9c3609e3a1e38cea4137aabcbf4a3a7ec6038498e3c95a

Download Submit
C:\Windows\SysWOW64\Llflea32.exe

Filesize
100KB

MD5
d22faee66b1ed6585a68b8d03319d3c3

SHA1
5448bb312c9eb3ca3ad85db20541d9e37faf1e4f

SHA256
f84b35b7fcd5e987f8459c9e8beecf23b5992370b0015d08e5609943b966d327

SHA512
9e070421420beb69408dff2dfab9a57f1985400642c3e34f3172f0ed4f2d1b301d663d03ab6ef1c86f38e4051f032c0f46389b7cffd44936753b01475692a4ff

Download Submit
C:\Windows\SysWOW64\Llodgnja.exe

Filesize
100KB

MD5
88783f8866b5a1902b9d812bb77b5012

SHA1
e956fabe4d861ab2552433f6dfa426175cebbf4e

SHA256
769b7115db0cb04f9f750234ff5613a5655d759135cfd22ed5b3bfc1ce232801

SHA512
d711914eec20390a286414237ed7995883e27aa3f961cde2a250d4e597dbaa71a6b530ebcd3c69f4b41a9251a6d22ad5471f76d7909ddc116c6af0934d7237fa

Download Submit
C:\Windows\SysWOW64\Mhafeb32.exe

Filesize
100KB

MD5
b351d30b79ecf41df2f8a1b48d8c10c5

SHA1
5d28a229ae76f9d9aa59416f4c9d3896dd4b6fe9

SHA256
6197d51abfb2a18a5e9c7591c71e0a34513a151bdabc966a09db656e1f278dcb

SHA512
4a0bf39f17ca99386c6cb422c62d85a7846458fdcc992bad2f4b5f42b9fa8d6615bc7afb2347dc8863b5ad3c326894a06ece0b8e95cecd1518db174061878eaa

Download Submit
C:\Windows\SysWOW64\Mmnhcb32.exe

Filesize
100KB

MD5
945db03c59ca2824fdfce0e6716f830e

SHA1
dbc60af3774e72b5d37c93c90f8252c4780301a2

SHA256
c1db31627f840f0b576aabf7cc84713b8e6b9df75e43551f1e5a88a2e2348513

SHA512
1b549e2df8ad992215be7d4a3af75d9e0168249a4d35a115fbba1c0a2152cf2ea97c4916dc0e5271f913931b8346fee3a5237068c0f42059a63482d1bbe3ecce

Download Submit
C:\Windows\SysWOW64\Mmpmnl32.exe

Filesize
100KB

MD5
4ac2420658de6c4d22041846fc362859

SHA1
0be2c7148e45e7fcd63bf8cdd3ca2a272a01125f

SHA256
f3edd09c3633e24b27f9696ca148673567a087430ec6b0f7c8ceef6564988332

SHA512
46635b0e9ad68f2d6a4993c872895b0608b6446dd54d254b606bce0bb3118c3600055fb7c184c4842f5f0177fac8bec83e805a234212f8115ffa721a51b698b0

Download Submit
C:\Windows\SysWOW64\Mnphmkji.exe

Filesize
100KB

MD5
111d1c21f5455837a1c286dd045ee2a1

SHA1
d6757e035257b03c8ff4b593a66de50ced350551

SHA256
90752850beb2fea49d820dc5284375dcfa6e70a0eaedf2043842db029d253954

SHA512
e40c5f1b0a62738a7e8694e2ff469143bdf4c810ecdb3c0f8abe3b46052699da5419608065f53676254b8018b3e9c0db38fc94209df0fa6e7333e76c95869413

Download Submit
C:\Windows\SysWOW64\Nfaemp32.exe

Filesize
100KB

MD5
591b17e958f089ca9c5410848b2a0e2a

SHA1
e3a2d945b03bfadf44312c873f8b7cee11880f9e

SHA256
8c2e46863e0c7b827457f7a5ad2567657ed40a3ba549406e8623258fd2905f20

SHA512
fd09719508cf0ff6195a80f4813727709a6431d263d5b36308a17bab93638d7695484500a6eefad18031b4958d8966b387dbe18b8298d70a6ea5d7dc61642353

Download Submit
C:\Windows\SysWOW64\Nmbjcljl.exe

Filesize
100KB

MD5
83debae35d82f357addf2cf27e16aa25

SHA1
72f3f97816407ccd60d6625415d512d3ad8f0b49

SHA256
6ac9d8c89de4c1ffdda33b94569dbdf8b72f891cc03127bf1615cfa88a4e96f8

SHA512
703037b87d38a978a09af59efce0596f54d3fc5c93cf63fd27c70b1e4cf3a10ed01c9fe77afa248910b394feeb3d12bf3e388880299ac4aa0777891a38794545

Download Submit
C:\Windows\SysWOW64\Oidhlb32.exe

Filesize
100KB

MD5
d9b44959c874d8d4ee53b7b889a053a9

SHA1
f601398a93c7ab765ece04edd5392a38f52d7315

SHA256
5c0af96c99f083798baae1d497ef42f2807c702b430c40cc4ef812f8d9241040

SHA512
ad622a2a8dc67cb9ee8027b23a761852b128c9920dbf70048105d20d451cd13b156533c889c4cc0bce88214d9515af6cd9c69c7936da4856b4c729bf89461d1d

Download Submit
C:\Windows\SysWOW64\Onnmdcjm.exe

Filesize
100KB

MD5
0ac2032df3ad11ac9685c3a710bd90ac

SHA1
9674e034e502a07c0e39530ec56a7d298f61e41c

SHA256
df25aae5e23882c41677d028db59d892e366815372f8675e9f6a0c97e95f5b8a

SHA512
5c3a60218114571d167a906f3e4cb9be663c711ae5e8ccd382b3be1fa9b4c5fa0927205c15bf73648d14d9e6c288535925c8aad0c173de03671b31cce347a0b0

Download Submit
C:\Windows\SysWOW64\Phigif32.exe

Filesize
100KB

MD5
2839ca5a01c78f89dfff3cd81e177f61

SHA1
d3a6d3265196a1d0816eec073ee000a6dd92010c

SHA256
a76955b847abf22ebfa4f70088f29ca81d0fa16ba523518de084a659566a5b51

SHA512
cae4e58d643bd7dd5839eaac5d029259d52432b7fada35c066969d3e00b392f35c7c62c623338db21c574d2c7bb6f902d763500848461a9d9665de6a30932eb2

Download Submit
C:\Windows\SysWOW64\Popbpqjh.exe

Filesize
100KB

MD5
df9b0beea2b939c482213708ee164ca9

SHA1
844b5543266fe467ce6b6452e2341b8d8c667296

SHA256
4b47e30180d36b9de25e6d3886b4b49cdc5e448e6484d205a81e02af4f80b224

SHA512
3ed08ed83800f1462d0b05d20948745e16790eeb14c36a900d4d99a4ff80167fad35acdc5a9d3c0ec22e9db1aa9a90ca9b5fef94b2c7a04ecba7a034a3b43dd6

Download Submit
memory/436-176-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/464-376-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/640-39-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/652-15-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/860-262-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/928-274-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1068-388-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1208-127-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1292-0-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1320-298-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1464-406-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1480-256-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1484-224-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1580-151-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1596-96-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1652-382-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1816-199-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1820-414-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1868-346-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1876-352-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1932-268-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/1952-231-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2008-310-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2016-72-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2168-398-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2184-364-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2304-358-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2352-334-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2368-103-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2372-436-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2576-316-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2612-7-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2616-143-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2632-240-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2660-191-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2696-135-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2832-424-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2984-322-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/2992-63-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3248-168-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3268-280-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3284-442-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3300-430-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3400-400-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3412-23-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3580-286-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3596-340-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3892-292-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3908-370-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3980-87-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/3988-422-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4124-328-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4140-216-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4256-248-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4276-47-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4280-120-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4316-79-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4336-208-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4396-56-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4560-160-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4636-111-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4852-31-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/4980-183-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/5000-304-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads