baca9b70dabf144a7c9f82e42b228dccc6a0dd5c9ff19356952e6419c3b0a17d

Analysis

max time kernel
146s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c3ee421b2fac4c5035a0e6ee84862c4_JC.exe
Size

78KB
MD5

0c3ee421b2fac4c5035a0e6ee84862c4
SHA1

4f3032285fc2d7b4ec76d1b9cd3e44b1e919bbae
SHA256

baca9b70dabf144a7c9f82e42b228dccc6a0dd5c9ff19356952e6419c3b0a17d
SHA512

24cd34ec0bef5317e5e488c53fdf364fd9d83fd67a8d1cfecb848c084bfb32fa6855ee5a61cc565f582a476dd4292dc2a2bfa543d5dd1746da92dd191bf28cbf
SSDEEP

1536:k8eETQZN2PsG7wFRR+pKhP6ZNEQ+/jW9iVpN+zL20gJi1ie:dcN+3pCCZyQ+/jQiVpgzL20WKt

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qemhbj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbpchb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odljjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mankaked.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eieplhlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mekgdl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nhmofj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Clgbmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iipfmggc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Knqepc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lefkkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aioebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apimodmh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjiloqjb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gfeaopqo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mmkdcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bbhhlccb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jepjhg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amlogfel.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cpdgqmnb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hgabkoee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amnlme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Enkmfolf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Npgabc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bebjdgmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbgihaji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qjiipk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ooangh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Apkjddke.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnienqbi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jfgdkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lnqeqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Neppokal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qlgpod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Adkgje32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jlgepanl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jngbjd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lfgipd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Modgdicm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ojfcdnjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edplhjhi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djbbhafj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kelalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnbnhedj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdgged32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnbakghm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gnqfcbnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kgdpni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ddkbmj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gpolbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nlgbon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pdqcenmg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bomkcm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gbnoiqdq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Geohklaa.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbhool32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ahbjoe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckmonl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Glipgf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcfkpjng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncjdki32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjcmpepm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ibffhhek.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okkdic32.exe

Executes dropped EXE 64 IoCs

pid	Process
3064	Hkjafn32.exe
948	Hgabkoee.exe
5084	Ibffhhek.exe
4580	Iokgal32.exe
4184	Ikaggmii.exe
3372	Idjlpc32.exe
2012	Ibnligoc.exe
4104	Ikfabm32.exe
3684	Jngjch32.exe
2932	Joffnk32.exe
3648	Jpkphjeb.exe
1424	Jfgdkd32.exe
5068	Jghabl32.exe
3432	Kbnepe32.exe
976	Kelalp32.exe
3712	Kflnfcgg.exe
3776	Kpdboimg.exe
3356	Kimghn32.exe
4312	Kpgodhkd.exe
5012	Klmpiiai.exe
3628	Kbghfc32.exe
960	Kiaqcnpb.exe
5096	Lbjelc32.exe
624	Lnqeqd32.exe
1944	Lejnmncd.exe
728	Locbfd32.exe
5060	Lihfcm32.exe
3496	Leoghn32.exe
4612	Lbchba32.exe
3280	Mimpolee.exe
3588	Mojhgbdl.exe
4872	Mlnipg32.exe
3516	Mbhamajc.exe
1692	Mlpeff32.exe
3324	Mffjcopi.exe
3560	Mpnnle32.exe
1068	Mekgdl32.exe
1576	Mockmala.exe
640	Noehba32.exe
2788	Neppokal.exe
2780	Nhnlkfpp.exe
4440	Nohehq32.exe
3320	Nebmekoi.exe
4772	Npgabc32.exe
3900	Ncfmno32.exe
2724	Nedjjj32.exe
2140	Nhbfff32.exe
2884	Lgepom32.exe
4496	Lnohlgep.exe
4732	Ldipha32.exe
4552	Lnadagbm.exe
1600	Lqpamb32.exe
4148	Lkeekk32.exe
1756	Lqbncb32.exe
1420	Madjhb32.exe
856	Mjmoag32.exe
4648	Mgaokl32.exe
2552	Mnkggfkb.exe
544	Meepdp32.exe
744	Mjahlgpf.exe
1860	Nghekkmn.exe
2756	Nnbnhedj.exe
2876	Nelfeo32.exe
3744	Njinmf32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Hlkfbocp.exe	Gpdennml.exe
File created	C:\Windows\SysWOW64\Ioaegj32.dll	Mhjpceko.exe
File opened for modification	C:\Windows\SysWOW64\Mmmqhl32.exe	Mfchlbfd.exe
File opened for modification	C:\Windows\SysWOW64\Nglhld32.exe	Npepkf32.exe
File created	C:\Windows\SysWOW64\Kdding32.dll	Fbplml32.exe
File created	C:\Windows\SysWOW64\Nndbpeal.dll	Ggkqgaol.exe
File created	C:\Windows\SysWOW64\Ejoaandc.dll	Anclbkbp.exe
File created	C:\Windows\SysWOW64\Nlgbon32.exe	Ndpjnq32.exe
File created	C:\Windows\SysWOW64\Phiaee32.dll	Cbihmg32.exe
File opened for modification	C:\Windows\SysWOW64\Agcdnjcl.exe	Abflfc32.exe
File created	C:\Windows\SysWOW64\Hockka32.dll	Qjiipk32.exe
File opened for modification	C:\Windows\SysWOW64\Gijmad32.exe	Gacepg32.exe
File created	C:\Windows\SysWOW64\Oddfcg32.dll	Aednci32.exe
File created	C:\Windows\SysWOW64\Egjgdg32.dll	Adkgje32.exe
File created	C:\Windows\SysWOW64\Cajdjn32.dll	Knqepc32.exe
File created	C:\Windows\SysWOW64\Lhdbgapf.dll	Paeelgnj.exe
File opened for modification	C:\Windows\SysWOW64\Paeelgnj.exe	Pnfiplog.exe
File created	C:\Windows\SysWOW64\Fhjaco32.dll	Lolcnman.exe
File opened for modification	C:\Windows\SysWOW64\Pfncia32.exe	Pcpgmf32.exe
File created	C:\Windows\SysWOW64\Lhlaofoa.dll	Qbngeadf.exe
File created	C:\Windows\SysWOW64\Fmbdpnaj.dll	Gghdaa32.exe
File created	C:\Windows\SysWOW64\Dbooabbb.dll	Qifbll32.exe
File opened for modification	C:\Windows\SysWOW64\Cnhlgc32.exe	Bkjpkg32.exe
File opened for modification	C:\Windows\SysWOW64\Emoadlfo.exe	Eehicoel.exe
File opened for modification	C:\Windows\SysWOW64\Qacameaj.exe	Qjiipk32.exe
File created	C:\Windows\SysWOW64\Kioghlbd.dll	Qacameaj.exe
File created	C:\Windows\SysWOW64\Mpkcqhdh.dll	Ddnobj32.exe
File created	C:\Windows\SysWOW64\Akgjnj32.exe	Adnbapjp.exe
File opened for modification	C:\Windows\SysWOW64\Mffjcopi.exe	Mlpeff32.exe
File created	C:\Windows\SysWOW64\Iomoenej.exe	Imkbnf32.exe
File created	C:\Windows\SysWOW64\Ipoheakj.exe	Impliekg.exe
File created	C:\Windows\SysWOW64\Himfiblh.dll	Ihmfco32.exe
File created	C:\Windows\SysWOW64\Ieagmcmq.exe	Iogopi32.exe
File created	C:\Windows\SysWOW64\Bgaclkia.dll	Hmbphg32.exe
File created	C:\Windows\SysWOW64\Chdialdl.exe	Cpmapodj.exe
File opened for modification	C:\Windows\SysWOW64\Fbplml32.exe	Fgjhpcmo.exe
File opened for modification	C:\Windows\SysWOW64\Pokanf32.exe	Pdqcenmg.exe
File created	C:\Windows\SysWOW64\Hgabkoee.exe	Hkjafn32.exe
File created	C:\Windows\SysWOW64\Bhqndghj.dll	Cpmapodj.exe
File created	C:\Windows\SysWOW64\Lhcjbfag.exe	Ljoiibbm.exe
File opened for modification	C:\Windows\SysWOW64\Okkdic32.exe	Ohmhmh32.exe
File created	C:\Windows\SysWOW64\Omjpeo32.exe	Okkdic32.exe
File created	C:\Windows\SysWOW64\Aonoao32.exe	Ahdged32.exe
File opened for modification	C:\Windows\SysWOW64\Bffcpg32.exe	Bomkcm32.exe
File created	C:\Windows\SysWOW64\Hmbphg32.exe	Hekgfj32.exe
File opened for modification	C:\Windows\SysWOW64\Impliekg.exe	Iidphgcn.exe
File created	C:\Windows\SysWOW64\Hejqldci.exe	Hehdfdek.exe
File opened for modification	C:\Windows\SysWOW64\Mlgjhp32.exe	Mdpagc32.exe
File opened for modification	C:\Windows\SysWOW64\Cponen32.exe	Conanfli.exe
File created	C:\Windows\SysWOW64\Eghkjdoa.exe	Ebkbbmqj.exe
File opened for modification	C:\Windows\SysWOW64\Bpedeiff.exe	Bpcgpihi.exe
File created	C:\Windows\SysWOW64\Bohbhmfm.exe	Blielbfi.exe
File created	C:\Windows\SysWOW64\Ppihoe32.dll	Glipgf32.exe
File created	C:\Windows\SysWOW64\Chfhllkp.dll	Hpiecd32.exe
File created	C:\Windows\SysWOW64\Phcgcqab.exe	Pplobcpp.exe
File created	C:\Windows\SysWOW64\Qfildi32.dll	Idjlpc32.exe
File created	C:\Windows\SysWOW64\Odmbaj32.exe	Onpjichj.exe
File opened for modification	C:\Windows\SysWOW64\Adkgje32.exe	Aamknj32.exe
File created	C:\Windows\SysWOW64\Ganldgib.exe	Gegkpf32.exe
File created	C:\Windows\SysWOW64\Cpmapodj.exe	Bgelgi32.exe
File created	C:\Windows\SysWOW64\Nabfjpak.exe	Njinmf32.exe
File opened for modification	C:\Windows\SysWOW64\Aednci32.exe	Anmfbl32.exe
File created	C:\Windows\SysWOW64\Hmdlmg32.exe	Hbohpn32.exe
File opened for modification	C:\Windows\SysWOW64\Oaifpi32.exe	Onkidm32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7824	7204	WerFault.exe	678

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mekgdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Menbeg32.dll"	Ncfmno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eajbghaq.dll"	Hpioin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dppgmlhk.dll"	Cnhlgc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lnqeqd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jgpfbjlo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Edeeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bqpbboeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahippdbe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhhfif32.dll"	Johnamkm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iafphi32.dll"	Pjdpelnc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iohejo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Akkffkhk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pkabbgol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghndhd32.dll"	Mjcngpjh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cpmapodj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jaonbc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qifbll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hgddfeae.dll"	Jfgdkd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nebmekoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qgaeof32.dll"	Aoioli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hbnckkha.dll"	Edeeci32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odgqopeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qifbll32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bnoiqd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cqiehnml.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Imhfhnmm.dll"	Ikfabm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Odmbaj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ihbponja.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjdcihik.dll"	Kbnepe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebdcld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jgpfbjlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ochamg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jokpcmmj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njinmf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ndidna32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lqbncb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkccgodj.dll"	Ffqhcq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gldglf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Olieecnn.dll"	Jgpfbjlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Modgdicm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmephjke.dll"	Pplobcpp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iogopi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Encnaa32.dll"	Memalfcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fnfmbmbi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnfpinmi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ofhknodl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mdghhb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jngbjd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hpioin32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nfiagd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Adnbapjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iahgad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dimini32.dll"	Kelalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Klmpiiai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ahdged32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dnbakghm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fofdocoe.dll"	Dijbno32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ghfedh32.dll"	Fkjmlaac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ajiqfi32.dll"	Hlkfbocp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onpjichj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Memalfcb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mafofggd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhbfff32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 620 wrote to memory of 3064	620	0c3ee421b2fac4c5035a0e6ee84862c4_JC.exe	85
PID 620 wrote to memory of 3064	620	0c3ee421b2fac4c5035a0e6ee84862c4_JC.exe	85
PID 620 wrote to memory of 3064	620	0c3ee421b2fac4c5035a0e6ee84862c4_JC.exe	85
PID 3064 wrote to memory of 948	3064	Hkjafn32.exe	86
PID 3064 wrote to memory of 948	3064	Hkjafn32.exe	86
PID 3064 wrote to memory of 948	3064	Hkjafn32.exe	86
PID 948 wrote to memory of 5084	948	Hgabkoee.exe	87
PID 948 wrote to memory of 5084	948	Hgabkoee.exe	87
PID 948 wrote to memory of 5084	948	Hgabkoee.exe	87
PID 5084 wrote to memory of 4580	5084	Ibffhhek.exe	88
PID 5084 wrote to memory of 4580	5084	Ibffhhek.exe	88
PID 5084 wrote to memory of 4580	5084	Ibffhhek.exe	88
PID 4580 wrote to memory of 4184	4580	Iokgal32.exe	89
PID 4580 wrote to memory of 4184	4580	Iokgal32.exe	89
PID 4580 wrote to memory of 4184	4580	Iokgal32.exe	89
PID 4184 wrote to memory of 3372	4184	Ikaggmii.exe	90
PID 4184 wrote to memory of 3372	4184	Ikaggmii.exe	90
PID 4184 wrote to memory of 3372	4184	Ikaggmii.exe	90
PID 3372 wrote to memory of 2012	3372	Idjlpc32.exe	92
PID 3372 wrote to memory of 2012	3372	Idjlpc32.exe	92
PID 3372 wrote to memory of 2012	3372	Idjlpc32.exe	92
PID 2012 wrote to memory of 4104	2012	Ibnligoc.exe	93
PID 2012 wrote to memory of 4104	2012	Ibnligoc.exe	93
PID 2012 wrote to memory of 4104	2012	Ibnligoc.exe	93
PID 4104 wrote to memory of 3684	4104	Ikfabm32.exe	94
PID 4104 wrote to memory of 3684	4104	Ikfabm32.exe	94
PID 4104 wrote to memory of 3684	4104	Ikfabm32.exe	94
PID 3684 wrote to memory of 2932	3684	Jngjch32.exe	95
PID 3684 wrote to memory of 2932	3684	Jngjch32.exe	95
PID 3684 wrote to memory of 2932	3684	Jngjch32.exe	95
PID 2932 wrote to memory of 3648	2932	Joffnk32.exe	96
PID 2932 wrote to memory of 3648	2932	Joffnk32.exe	96
PID 2932 wrote to memory of 3648	2932	Joffnk32.exe	96
PID 3648 wrote to memory of 1424	3648	Jpkphjeb.exe	97
PID 3648 wrote to memory of 1424	3648	Jpkphjeb.exe	97
PID 3648 wrote to memory of 1424	3648	Jpkphjeb.exe	97
PID 1424 wrote to memory of 5068	1424	Jfgdkd32.exe	98
PID 1424 wrote to memory of 5068	1424	Jfgdkd32.exe	98
PID 1424 wrote to memory of 5068	1424	Jfgdkd32.exe	98
PID 5068 wrote to memory of 3432	5068	Jghabl32.exe	101
PID 5068 wrote to memory of 3432	5068	Jghabl32.exe	101
PID 5068 wrote to memory of 3432	5068	Jghabl32.exe	101
PID 3432 wrote to memory of 976	3432	Kbnepe32.exe	99
PID 3432 wrote to memory of 976	3432	Kbnepe32.exe	99
PID 3432 wrote to memory of 976	3432	Kbnepe32.exe	99
PID 976 wrote to memory of 3712	976	Kelalp32.exe	100
PID 976 wrote to memory of 3712	976	Kelalp32.exe	100
PID 976 wrote to memory of 3712	976	Kelalp32.exe	100
PID 3712 wrote to memory of 3776	3712	Kflnfcgg.exe	102
PID 3712 wrote to memory of 3776	3712	Kflnfcgg.exe	102
PID 3712 wrote to memory of 3776	3712	Kflnfcgg.exe	102
PID 3776 wrote to memory of 3356	3776	Kpdboimg.exe	103
PID 3776 wrote to memory of 3356	3776	Kpdboimg.exe	103
PID 3776 wrote to memory of 3356	3776	Kpdboimg.exe	103
PID 3356 wrote to memory of 4312	3356	Kimghn32.exe	104
PID 3356 wrote to memory of 4312	3356	Kimghn32.exe	104
PID 3356 wrote to memory of 4312	3356	Kimghn32.exe	104
PID 4312 wrote to memory of 5012	4312	Kpgodhkd.exe	105
PID 4312 wrote to memory of 5012	4312	Kpgodhkd.exe	105
PID 4312 wrote to memory of 5012	4312	Kpgodhkd.exe	105
PID 5012 wrote to memory of 3628	5012	Klmpiiai.exe	106
PID 5012 wrote to memory of 3628	5012	Klmpiiai.exe	106
PID 5012 wrote to memory of 3628	5012	Klmpiiai.exe	106
PID 3628 wrote to memory of 960	3628	Kbghfc32.exe	107

C:\Users\Admin\AppData\Local\Temp\0c3ee421b2fac4c5035a0e6ee84862c4_JC.exe
"C:\Users\Admin\AppData\Local\Temp\0c3ee421b2fac4c5035a0e6ee84862c4_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:620
- C:\Windows\SysWOW64\Hkjafn32.exe
  C:\Windows\system32\Hkjafn32.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3064
- - C:\Windows\SysWOW64\Hgabkoee.exe
    C:\Windows\system32\Hgabkoee.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:948
  - - C:\Windows\SysWOW64\Ibffhhek.exe
      C:\Windows\system32\Ibffhhek.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:5084
    - - C:\Windows\SysWOW64\Iokgal32.exe
        
        C:\Windows\system32\Iokgal32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4580
      - C:\Windows\SysWOW64\Ikaggmii.exe
        
        C:\Windows\system32\Ikaggmii.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Windows\SysWOW64\Idjlpc32.exe
        
        C:\Windows\system32\Idjlpc32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3372
        
        C:\Windows\SysWOW64\Ibnligoc.exe
        
        C:\Windows\system32\Ibnligoc.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2012
        
        C:\Windows\SysWOW64\Ikfabm32.exe
        
        C:\Windows\system32\Ikfabm32.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4104
        
        C:\Windows\SysWOW64\Jngjch32.exe
        
        C:\Windows\system32\Jngjch32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3684
        
        C:\Windows\SysWOW64\Joffnk32.exe
        
        C:\Windows\system32\Joffnk32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2932
        
        C:\Windows\SysWOW64\Jpkphjeb.exe
        
        C:\Windows\system32\Jpkphjeb.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3648
        
        C:\Windows\SysWOW64\Jfgdkd32.exe
        
        C:\Windows\system32\Jfgdkd32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1424
        
        C:\Windows\SysWOW64\Jghabl32.exe
        
        C:\Windows\system32\Jghabl32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5068
        
        C:\Windows\SysWOW64\Kbnepe32.exe
        
        C:\Windows\system32\Kbnepe32.exe
        15⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3432

C:\Windows\SysWOW64\Kelalp32.exe
C:\Windows\system32\Kelalp32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Executes dropped EXE
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:976
- C:\Windows\SysWOW64\Kflnfcgg.exe
  C:\Windows\system32\Kflnfcgg.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Windows\SysWOW64\Kpdboimg.exe
    C:\Windows\system32\Kpdboimg.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:3776
  - - C:\Windows\SysWOW64\Kimghn32.exe
      C:\Windows\system32\Kimghn32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3356
    - - C:\Windows\SysWOW64\Kpgodhkd.exe
        
        C:\Windows\system32\Kpgodhkd.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4312
      - C:\Windows\SysWOW64\Klmpiiai.exe
        
        C:\Windows\system32\Klmpiiai.exe
        6⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\Kbghfc32.exe
        
        C:\Windows\system32\Kbghfc32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3628
        
        C:\Windows\SysWOW64\Kiaqcnpb.exe
        
        C:\Windows\system32\Kiaqcnpb.exe
        8⤵
        Executes dropped EXE
        
        PID:960
        
        C:\Windows\SysWOW64\Lbjelc32.exe
        
        C:\Windows\system32\Lbjelc32.exe
        9⤵
        Executes dropped EXE
        
        PID:5096
        
        C:\Windows\SysWOW64\Lnqeqd32.exe
        
        C:\Windows\system32\Lnqeqd32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:624
        
        C:\Windows\SysWOW64\Lejnmncd.exe
        
        C:\Windows\system32\Lejnmncd.exe
        11⤵
        Executes dropped EXE
        
        PID:1944
        
        C:\Windows\SysWOW64\Locbfd32.exe
        
        C:\Windows\system32\Locbfd32.exe
        12⤵
        Executes dropped EXE
        
        PID:728
        
        C:\Windows\SysWOW64\Lihfcm32.exe
        
        C:\Windows\system32\Lihfcm32.exe
        13⤵
        Executes dropped EXE
        
        PID:5060
        
        C:\Windows\SysWOW64\Lpbopfag.exe
        
        C:\Windows\system32\Lpbopfag.exe
        14⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\Leoghn32.exe
        
        C:\Windows\system32\Leoghn32.exe
        15⤵
        Executes dropped EXE
        
        PID:3496
        
        C:\Windows\SysWOW64\Lbchba32.exe
        
        C:\Windows\system32\Lbchba32.exe
        16⤵
        Executes dropped EXE
        
        PID:4612
        
        C:\Windows\SysWOW64\Mimpolee.exe
        
        C:\Windows\system32\Mimpolee.exe
        17⤵
        Executes dropped EXE
        
        PID:3280
        
        C:\Windows\SysWOW64\Mojhgbdl.exe
        
        C:\Windows\system32\Mojhgbdl.exe
        18⤵
        Executes dropped EXE
        
        PID:3588
        
        C:\Windows\SysWOW64\Mlnipg32.exe
        
        C:\Windows\system32\Mlnipg32.exe
        19⤵
        Executes dropped EXE
        
        PID:4872
        
        C:\Windows\SysWOW64\Mbhamajc.exe
        
        C:\Windows\system32\Mbhamajc.exe
        20⤵
        Executes dropped EXE
        
        PID:3516
        
        C:\Windows\SysWOW64\Mlpeff32.exe
        
        C:\Windows\system32\Mlpeff32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1692
        
        C:\Windows\SysWOW64\Mffjcopi.exe
        
        C:\Windows\system32\Mffjcopi.exe
        22⤵
        Executes dropped EXE
        
        PID:3324
        
        C:\Windows\SysWOW64\Mpnnle32.exe
        
        C:\Windows\system32\Mpnnle32.exe
        23⤵
        Executes dropped EXE
        
        PID:3560
        
        C:\Windows\SysWOW64\Mekgdl32.exe
        
        C:\Windows\system32\Mekgdl32.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:1068
        
        C:\Windows\SysWOW64\Mockmala.exe
        
        C:\Windows\system32\Mockmala.exe
        25⤵
        Executes dropped EXE
        
        PID:1576
        
        C:\Windows\SysWOW64\Noehba32.exe
        
        C:\Windows\system32\Noehba32.exe
        26⤵
        Executes dropped EXE
        
        PID:640
        
        C:\Windows\SysWOW64\Neppokal.exe
        
        C:\Windows\system32\Neppokal.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2788
        
        C:\Windows\SysWOW64\Nhnlkfpp.exe
        
        C:\Windows\system32\Nhnlkfpp.exe
        28⤵
        Executes dropped EXE
        
        PID:2780
        
        C:\Windows\SysWOW64\Nohehq32.exe
        
        C:\Windows\system32\Nohehq32.exe
        29⤵
        Executes dropped EXE
        
        PID:4440
        
        C:\Windows\SysWOW64\Nebmekoi.exe
        
        C:\Windows\system32\Nebmekoi.exe
        30⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3320
        
        C:\Windows\SysWOW64\Npgabc32.exe
        
        C:\Windows\system32\Npgabc32.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4772
        
        C:\Windows\SysWOW64\Ncfmno32.exe
        
        C:\Windows\system32\Ncfmno32.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3900
        
        C:\Windows\SysWOW64\Nedjjj32.exe
        
        C:\Windows\system32\Nedjjj32.exe
        33⤵
        Executes dropped EXE
        
        PID:2724
        
        C:\Windows\SysWOW64\Nhbfff32.exe
        
        C:\Windows\system32\Nhbfff32.exe
        34⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2140
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        35⤵
        Executes dropped EXE
        
        PID:2884
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        36⤵
        Executes dropped EXE
        
        PID:4496
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        37⤵
        Executes dropped EXE
        
        PID:4732
        
        C:\Windows\SysWOW64\Lnadagbm.exe
        
        C:\Windows\system32\Lnadagbm.exe
        38⤵
        Executes dropped EXE
        
        PID:4552
        
        C:\Windows\SysWOW64\Lqpamb32.exe
        
        C:\Windows\system32\Lqpamb32.exe
        39⤵
        Executes dropped EXE
        
        PID:1600
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        40⤵
        Executes dropped EXE
        
        PID:4148
        
        C:\Windows\SysWOW64\Lqbncb32.exe
        
        C:\Windows\system32\Lqbncb32.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1756
        
        C:\Windows\SysWOW64\Madjhb32.exe
        
        C:\Windows\system32\Madjhb32.exe
        42⤵
        Executes dropped EXE
        
        PID:1420
        
        C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        43⤵
        Executes dropped EXE
        
        PID:856
        
        C:\Windows\SysWOW64\Mgaokl32.exe
        
        C:\Windows\system32\Mgaokl32.exe
        44⤵
        Executes dropped EXE
        
        PID:4648
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        45⤵
        Executes dropped EXE
        
        PID:2552
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        46⤵
        Executes dropped EXE
        
        PID:544
        
        C:\Windows\SysWOW64\Mjahlgpf.exe
        
        C:\Windows\system32\Mjahlgpf.exe
        47⤵
        Executes dropped EXE
        
        PID:744
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        48⤵
        Executes dropped EXE
        
        PID:1860
        
        C:\Windows\SysWOW64\Nnbnhedj.exe
        
        C:\Windows\system32\Nnbnhedj.exe
        49⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2756
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        50⤵
        Executes dropped EXE
        
        PID:2876
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:3744
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        52⤵
        
        PID:4960
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3460
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        54⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\Neqopnhb.exe
        
        C:\Windows\system32\Neqopnhb.exe
        55⤵
        
        PID:3836
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        56⤵
        
        PID:4044
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        57⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        58⤵
        
        PID:1364
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        59⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\Nlmdbh32.exe
        
        C:\Windows\system32\Nlmdbh32.exe
        60⤵
        
        PID:1652
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        61⤵
        
        PID:1064
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        62⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        63⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Oeheqm32.exe
        
        C:\Windows\system32\Oeheqm32.exe
        64⤵
        
        PID:1780
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        65⤵
        
        PID:2256
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        66⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4060
        
        C:\Windows\SysWOW64\Odmbaj32.exe
        
        C:\Windows\system32\Odmbaj32.exe
        67⤵
        Modifies registry class
        
        PID:1352
        
        C:\Windows\SysWOW64\Ohmhmh32.exe
        
        C:\Windows\system32\Ohmhmh32.exe
        68⤵
        Drops file in System32 directory
        
        PID:3596
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:228
        
        C:\Windows\SysWOW64\Omjpeo32.exe
        
        C:\Windows\system32\Omjpeo32.exe
        70⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        71⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Pknqoc32.exe
        
        C:\Windows\system32\Pknqoc32.exe
        72⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        73⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Pkpmdbfd.exe
        
        C:\Windows\system32\Pkpmdbfd.exe
        74⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Pmoiqneg.exe
        
        C:\Windows\system32\Pmoiqneg.exe
        75⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        76⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        77⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        78⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        79⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        80⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Pldcjeia.exe
        
        C:\Windows\system32\Pldcjeia.exe
        81⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Pocpfphe.exe
        
        C:\Windows\system32\Pocpfphe.exe
        82⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Qemhbj32.exe
        
        C:\Windows\system32\Qemhbj32.exe
        83⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5740
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5804
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        85⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Qdbdcg32.exe
        
        C:\Windows\system32\Qdbdcg32.exe
        86⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        87⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        88⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        89⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        90⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        91⤵
        Drops file in System32 directory
        
        PID:5204
        
        C:\Windows\SysWOW64\Aednci32.exe
        
        C:\Windows\system32\Aednci32.exe
        92⤵
        Drops file in System32 directory
        
        PID:5284
        
        C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5356
        
        C:\Windows\SysWOW64\Akqfkp32.exe
        
        C:\Windows\system32\Akqfkp32.exe
        94⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        95⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        96⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5572
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        97⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Aamknj32.exe
        
        C:\Windows\system32\Aamknj32.exe
        98⤵
        Drops file in System32 directory
        
        PID:5760
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        99⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5852
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        100⤵
        Drops file in System32 directory
        
        PID:5960
        
        C:\Windows\SysWOW64\Ahippdbe.exe
        
        C:\Windows\system32\Ahippdbe.exe
        101⤵
        Modifies registry class
        
        PID:6028
        
        C:\Windows\SysWOW64\Bdpaeehj.exe
        
        C:\Windows\system32\Bdpaeehj.exe
        102⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        103⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Bepmoh32.exe
        
        C:\Windows\system32\Bepmoh32.exe
        104⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Blielbfi.exe
        
        C:\Windows\system32\Blielbfi.exe
        105⤵
        Drops file in System32 directory
        
        PID:5508
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        106⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        107⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Bebjdgmj.exe
        
        C:\Windows\system32\Bebjdgmj.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5956
        
        C:\Windows\SysWOW64\Bkobmnka.exe
        
        C:\Windows\system32\Bkobmnka.exe
        109⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        110⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5316
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        112⤵
        
        PID:5536
        
        C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5836
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        114⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        115⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Camddhoi.exe
        
        C:\Windows\system32\Camddhoi.exe
        116⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Cfnjpfcl.exe
        
        C:\Windows\system32\Cfnjpfcl.exe
        117⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1696
        
        C:\Windows\SysWOW64\Cofnik32.exe
        
        C:\Windows\system32\Cofnik32.exe
        119⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        120⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        121⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Ckmonl32.exe
        
        C:\Windows\system32\Ckmonl32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6192
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        123⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Cfbcke32.exe
        
        C:\Windows\system32\Cfbcke32.exe
        124⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        125⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        126⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        127⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        128⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        129⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Dnbakghm.exe
        
        C:\Windows\system32\Dnbakghm.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6536
        
        C:\Windows\SysWOW64\Ddligq32.exe
        
        C:\Windows\system32\Ddligq32.exe
        131⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        132⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        133⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        134⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        135⤵
        Modifies registry class
        
        PID:6752
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        136⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        137⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        138⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        139⤵
        Modifies registry class
        
        PID:6924
        
        C:\Windows\SysWOW64\Eoideh32.exe
        
        C:\Windows\system32\Eoideh32.exe
        140⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Efblbbqd.exe
        
        C:\Windows\system32\Efblbbqd.exe
        141⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Emmdom32.exe
        
        C:\Windows\system32\Emmdom32.exe
        142⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        143⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        144⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        145⤵
        Drops file in System32 directory
        
        PID:5628
        
        C:\Windows\SysWOW64\Emoadlfo.exe
        
        C:\Windows\system32\Emoadlfo.exe
        146⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Enpmld32.exe
        
        C:\Windows\system32\Enpmld32.exe
        147⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        148⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        149⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        150⤵
        
        PID:1596
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6576
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        152⤵
        
        PID:6636
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        153⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        154⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        155⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        156⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        157⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        158⤵
        Modifies registry class
        
        PID:7136
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        159⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        160⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6392
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        162⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Fiaael32.exe
        
        C:\Windows\system32\Fiaael32.exe
        163⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        164⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6672
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        165⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Gnqfcbnj.exe
        
        C:\Windows\system32\Gnqfcbnj.exe
        166⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6864
        
        C:\Windows\SysWOW64\Gifkpknp.exe
        
        C:\Windows\system32\Gifkpknp.exe
        167⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        168⤵
        Modifies registry class
        
        PID:1216
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5780
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        170⤵
        
        PID:6344
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        171⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        172⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Geohklaa.exe
        
        C:\Windows\system32\Geohklaa.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6812
        
        C:\Windows\SysWOW64\Glipgf32.exe
        
        C:\Windows\system32\Glipgf32.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6952
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        175⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        176⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Hpiecd32.exe
        
        C:\Windows\system32\Hpiecd32.exe
        177⤵
        Drops file in System32 directory
        
        PID:6592
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        178⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        179⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Hplbickp.exe
        
        C:\Windows\system32\Hplbickp.exe
        180⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        181⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        182⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        183⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        184⤵
        Drops file in System32 directory
        
        PID:7192
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        185⤵
        Drops file in System32 directory
        
        PID:7228
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        186⤵
        Drops file in System32 directory
        
        PID:7276
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        187⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        188⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        189⤵
        
        PID:7412
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        190⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        191⤵
        Modifies registry class
        
        PID:7504
        
        C:\Windows\SysWOW64\Ifomll32.exe
        
        C:\Windows\system32\Ifomll32.exe
        192⤵
        
        PID:7544
        
        C:\Windows\SysWOW64\Imiehfao.exe
        
        C:\Windows\system32\Imiehfao.exe
        193⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        194⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7672
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        196⤵
        Drops file in System32 directory
        
        PID:7708
        
        C:\Windows\SysWOW64\Iomoenej.exe
        
        C:\Windows\system32\Iomoenej.exe
        197⤵
        
        PID:7752
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        198⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        199⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        200⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        201⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Iidphgcn.exe
        
        C:\Windows\system32\Iidphgcn.exe
        202⤵
        Drops file in System32 directory
        
        PID:7968
        
        C:\Windows\SysWOW64\Impliekg.exe
        
        C:\Windows\system32\Impliekg.exe
        203⤵
        Drops file in System32 directory
        
        PID:8012
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        204⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        205⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        206⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        207⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Jocefm32.exe
        
        C:\Windows\system32\Jocefm32.exe
        208⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        209⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7332
        
        C:\Windows\SysWOW64\Jofalmmp.exe
        
        C:\Windows\system32\Jofalmmp.exe
        211⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Jepjhg32.exe
        
        C:\Windows\system32\Jepjhg32.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4844
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7532
        
        C:\Windows\SysWOW64\Johnamkm.exe
        
        C:\Windows\system32\Johnamkm.exe
        214⤵
        Modifies registry class
        
        PID:7568
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        215⤵
        Modifies registry class
        
        PID:348
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        216⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        217⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Jokkgl32.exe
        
        C:\Windows\system32\Jokkgl32.exe
        218⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        219⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        220⤵
        
        PID:7952
        
        C:\Windows\SysWOW64\Jlolpq32.exe
        
        C:\Windows\system32\Jlolpq32.exe
        221⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        222⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Kgdpni32.exe
        
        C:\Windows\system32\Kgdpni32.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8184
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        224⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        225⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Keimof32.exe
        
        C:\Windows\system32\Keimof32.exe
        226⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Knqepc32.exe
        
        C:\Windows\system32\Knqepc32.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4388
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        228⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\Kcmmhj32.exe
        
        C:\Windows\system32\Kcmmhj32.exe
        229⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        230⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        231⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        232⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        233⤵
        
        PID:1176
        
        C:\Windows\SysWOW64\Kfpcoefj.exe
        
        C:\Windows\system32\Kfpcoefj.exe
        234⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Kngkqbgl.exe
        
        C:\Windows\system32\Kngkqbgl.exe
        235⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Lpfgmnfp.exe
        
        C:\Windows\system32\Lpfgmnfp.exe
        236⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        237⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        238⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        239⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\Lgbloglj.exe
        
        C:\Windows\system32\Lgbloglj.exe
        240⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Llodgnja.exe
        
        C:\Windows\system32\Llodgnja.exe
        241⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\Lcimdh32.exe
        
        C:\Windows\system32\Lcimdh32.exe
        242⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        243⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3760
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        244⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        245⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        246⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        247⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\Lgibpf32.exe
        
        C:\Windows\system32\Lgibpf32.exe
        248⤵
        
        PID:1588
        
        C:\Windows\SysWOW64\Ljhnlb32.exe
        
        C:\Windows\system32\Ljhnlb32.exe
        249⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Modgdicm.exe
        
        C:\Windows\system32\Modgdicm.exe
        250⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:4196
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        251⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        252⤵
        
        PID:676
        
        C:\Windows\SysWOW64\Mogcihaj.exe
        
        C:\Windows\system32\Mogcihaj.exe
        253⤵
        
        PID:3432
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        254⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        255⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:624
        
        C:\Windows\SysWOW64\Mcelpggq.exe
        
        C:\Windows\system32\Mcelpggq.exe
        256⤵
        
        PID:1972
        
        C:\Windows\SysWOW64\Mfchlbfd.exe
        
        C:\Windows\system32\Mfchlbfd.exe
        257⤵
        Drops file in System32 directory
        
        PID:3740
        
        C:\Windows\SysWOW64\Mmmqhl32.exe
        
        C:\Windows\system32\Mmmqhl32.exe
        258⤵
        
        PID:520
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        259⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        260⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        261⤵
        
        PID:64
        
        C:\Windows\SysWOW64\Mgeakekd.exe
        
        C:\Windows\system32\Mgeakekd.exe
        262⤵
        
        PID:960
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        263⤵
        Modifies registry class
        
        PID:4868
        
        C:\Windows\SysWOW64\Nmbjcljl.exe
        
        C:\Windows\system32\Nmbjcljl.exe
        264⤵
        
        PID:2012
        
        C:\Windows\SysWOW64\Nopfpgip.exe
        
        C:\Windows\system32\Nopfpgip.exe
        265⤵
        
        PID:4180
        
        C:\Windows\SysWOW64\Nggnadib.exe
        
        C:\Windows\system32\Nggnadib.exe
        266⤵
        
        PID:3356
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        267⤵
        
        PID:4712
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        268⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        269⤵
        
        PID:812
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        270⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        271⤵
        Drops file in System32 directory
        
        PID:2508
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        272⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        273⤵
        Modifies registry class
        
        PID:3516
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        274⤵
        
        PID:3496
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        275⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        276⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        277⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Nceefd32.exe
        
        C:\Windows\system32\Nceefd32.exe
        278⤵
        
        PID:8244
        
        C:\Windows\SysWOW64\Onkidm32.exe
        
        C:\Windows\system32\Onkidm32.exe
        279⤵
        Drops file in System32 directory
        
        PID:8292
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        280⤵
        
        PID:8332
        
        C:\Windows\SysWOW64\Ocgbld32.exe
        
        C:\Windows\system32\Ocgbld32.exe
        281⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        282⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        283⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        284⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Ofhknodl.exe
        
        C:\Windows\system32\Ofhknodl.exe
        285⤵
        Modifies registry class
        
        PID:8548
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        286⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        287⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        288⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Ojfcdnjc.exe
        
        C:\Windows\system32\Ojfcdnjc.exe
        289⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8732
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        290⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Ocohmc32.exe
        
        C:\Windows\system32\Ocohmc32.exe
        291⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Ondljl32.exe
        
        C:\Windows\system32\Ondljl32.exe
        292⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        293⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Ohlqcagj.exe
        
        C:\Windows\system32\Ohlqcagj.exe
        294⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        295⤵
        Drops file in System32 directory
        
        PID:8976
        
        C:\Windows\SysWOW64\Paeelgnj.exe
        
        C:\Windows\system32\Paeelgnj.exe
        296⤵
        Drops file in System32 directory
        
        PID:9024
        
        C:\Windows\SysWOW64\Pccahbmn.exe
        
        C:\Windows\system32\Pccahbmn.exe
        297⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Pfandnla.exe
        
        C:\Windows\system32\Pfandnla.exe
        298⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        299⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        300⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        301⤵
        
        PID:3560
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        302⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8240
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        303⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        304⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        305⤵
        
        PID:8352
        
        C:\Windows\SysWOW64\Palklf32.exe
        
        C:\Windows\system32\Palklf32.exe
        306⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\Phfcipoo.exe
        
        C:\Windows\system32\Phfcipoo.exe
        307⤵
        
        PID:5036
        
        C:\Windows\SysWOW64\Pjdpelnc.exe
        
        C:\Windows\system32\Pjdpelnc.exe
        308⤵
        Modifies registry class
        
        PID:8520
        
        C:\Windows\SysWOW64\Pmblagmf.exe
        
        C:\Windows\system32\Pmblagmf.exe
        309⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        310⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        311⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        312⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Qaqegecm.exe
        
        C:\Windows\system32\Qaqegecm.exe
        313⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Qhjmdp32.exe
        
        C:\Windows\system32\Qhjmdp32.exe
        314⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        315⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9012
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        316⤵
        Drops file in System32 directory
        
        PID:9068
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        317⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Akkffkhk.exe
        
        C:\Windows\system32\Akkffkhk.exe
        318⤵
        Modifies registry class
        
        PID:2216
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        319⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        320⤵
        Modifies registry class
        
        PID:8252
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8300
        
        C:\Windows\SysWOW64\Apjkcadp.exe
        
        C:\Windows\system32\Apjkcadp.exe
        322⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        323⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8604
        
        C:\Windows\SysWOW64\Apmhiq32.exe
        
        C:\Windows\system32\Apmhiq32.exe
        325⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        326⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        327⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        328⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Baegibae.exe
        
        C:\Windows\system32\Baegibae.exe
        329⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        330⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        331⤵
        Drops file in System32 directory
        
        PID:8232
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        332⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8372
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        333⤵
        
        PID:8536
        
        C:\Windows\SysWOW64\Conanfli.exe
        
        C:\Windows\system32\Conanfli.exe
        334⤵
        Drops file in System32 directory
        
        PID:8668
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        335⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        336⤵
        
        PID:3480
        
        C:\Windows\SysWOW64\Ckebcg32.exe
        
        C:\Windows\system32\Ckebcg32.exe
        337⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        338⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Cdmfllhn.exe
        
        C:\Windows\system32\Cdmfllhn.exe
        339⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        340⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Cnfkdb32.exe
        
        C:\Windows\system32\Cnfkdb32.exe
        341⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        342⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4212
        
        C:\Windows\SysWOW64\Ckjknfnh.exe
        
        C:\Windows\system32\Ckjknfnh.exe
        343⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        344⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Dafppp32.exe
        
        C:\Windows\system32\Dafppp32.exe
        345⤵
        
        PID:1772
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        346⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        347⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        348⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        349⤵
        
        PID:8504
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        350⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8724
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        351⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Dbocfo32.exe
        
        C:\Windows\system32\Dbocfo32.exe
        352⤵
        
        PID:8364

C:\Windows\SysWOW64\Ddnobj32.exe
C:\Windows\system32\Ddnobj32.exe
1⤵
- Drops file in System32 directory
PID:9136
- C:\Windows\SysWOW64\Ebaplnie.exe
  C:\Windows\system32\Ebaplnie.exe
  2⤵
  PID:8308
- - C:\Windows\SysWOW64\Edplhjhi.exe
    C:\Windows\system32\Edplhjhi.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:8992
  - - C:\Windows\SysWOW64\Ehlhih32.exe
      C:\Windows\system32\Ehlhih32.exe
      4⤵
      PID:6056
    - - C:\Windows\SysWOW64\Eoepebho.exe
        
        C:\Windows\system32\Eoepebho.exe
        5⤵
        
        PID:9268
      - C:\Windows\SysWOW64\Eqgmmk32.exe
        
        C:\Windows\system32\Eqgmmk32.exe
        6⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Ehndnh32.exe
        
        C:\Windows\system32\Ehndnh32.exe
        7⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Enkmfolf.exe
        
        C:\Windows\system32\Enkmfolf.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9396
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        9⤵
        Modifies registry class
        
        PID:9436
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        10⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        11⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        12⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Ebkbbmqj.exe
        
        C:\Windows\system32\Ebkbbmqj.exe
        13⤵
        Drops file in System32 directory
        
        PID:9612
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        14⤵
        
        PID:9660
        
        C:\Windows\SysWOW64\Fooclapd.exe
        
        C:\Windows\system32\Fooclapd.exe
        15⤵
        
        PID:9704
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        16⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        17⤵
        Drops file in System32 directory
        
        PID:9792
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        18⤵
        Drops file in System32 directory
        
        PID:9832
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        19⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        20⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        21⤵
        Modifies registry class
        
        PID:9956
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        22⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        23⤵
        Modifies registry class
        
        PID:10048
        
        C:\Windows\SysWOW64\Fofilp32.exe
        
        C:\Windows\system32\Fofilp32.exe
        24⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        25⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Fganqbgg.exe
        
        C:\Windows\system32\Fganqbgg.exe
        26⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        27⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Fiqjke32.exe
        
        C:\Windows\system32\Fiqjke32.exe
        28⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Fkofga32.exe
        
        C:\Windows\system32\Fkofga32.exe
        29⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        30⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        31⤵
        Drops file in System32 directory
        
        PID:9472
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        32⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        33⤵
        Drops file in System32 directory
        
        PID:9600
        
        C:\Windows\SysWOW64\Gpolbo32.exe
        
        C:\Windows\system32\Gpolbo32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9672
        
        C:\Windows\SysWOW64\Ggkqgaol.exe
        
        C:\Windows\system32\Ggkqgaol.exe
        35⤵
        Drops file in System32 directory
        
        PID:9744
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        36⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        37⤵
        Drops file in System32 directory
        
        PID:9864
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        38⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        39⤵
        Drops file in System32 directory
        
        PID:10012
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        40⤵
        Modifies registry class
        
        PID:5616
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        41⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\Hioflcbj.exe
        
        C:\Windows\system32\Hioflcbj.exe
        42⤵
        
        PID:10128
        
        C:\Windows\SysWOW64\Hpioin32.exe
        
        C:\Windows\system32\Hpioin32.exe
        43⤵
        Modifies registry class
        
        PID:10172
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        44⤵
        
        PID:10228
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        45⤵
        
        PID:9260
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        46⤵
        Drops file in System32 directory
        
        PID:9348
        
        C:\Windows\SysWOW64\Hejqldci.exe
        
        C:\Windows\system32\Hejqldci.exe
        47⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        48⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        49⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        50⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        51⤵
        Drops file in System32 directory
        
        PID:9904
        
        C:\Windows\SysWOW64\Iogopi32.exe
        
        C:\Windows\system32\Iogopi32.exe
        52⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:9988
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        53⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Ilkoim32.exe
        
        C:\Windows\system32\Ilkoim32.exe
        54⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        55⤵
        Modifies registry class
        
        PID:10212
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        56⤵
        Modifies registry class
        
        PID:2708
        
        C:\Windows\SysWOW64\Iefphb32.exe
        
        C:\Windows\system32\Iefphb32.exe
        57⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        58⤵
        
        PID:4600
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        59⤵
        
        PID:9844
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        60⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        61⤵
        
        PID:10072
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        62⤵
        Modifies registry class
        
        PID:4668
        
        C:\Windows\SysWOW64\Jifecp32.exe
        
        C:\Windows\system32\Jifecp32.exe
        63⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        64⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Banjnm32.exe
        
        C:\Windows\system32\Banjnm32.exe
        65⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\Biiobo32.exe
        
        C:\Windows\system32\Biiobo32.exe
        66⤵
        
        PID:2516
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        67⤵
        Drops file in System32 directory
        
        PID:9652
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        68⤵
        
        PID:9884
        
        C:\Windows\SysWOW64\Lolcnman.exe
        
        C:\Windows\system32\Lolcnman.exe
        69⤵
        Drops file in System32 directory
        
        PID:10156
        
        C:\Windows\SysWOW64\Lbhool32.exe
        
        C:\Windows\system32\Lbhool32.exe
        70⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9520
        
        C:\Windows\SysWOW64\Lefkkg32.exe
        
        C:\Windows\system32\Lefkkg32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9760
        
        C:\Windows\SysWOW64\Lcjldk32.exe
        
        C:\Windows\system32\Lcjldk32.exe
        72⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Mkepineo.exe
        
        C:\Windows\system32\Mkepineo.exe
        73⤵
        
        PID:2276
        
        C:\Windows\SysWOW64\Mclhjkfa.exe
        
        C:\Windows\system32\Mclhjkfa.exe
        74⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Mekdffee.exe
        
        C:\Windows\system32\Mekdffee.exe
        75⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\Mlemcq32.exe
        
        C:\Windows\system32\Mlemcq32.exe
        76⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\Mociol32.exe
        
        C:\Windows\system32\Mociol32.exe
        77⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Memalfcb.exe
        
        C:\Windows\system32\Memalfcb.exe
        78⤵
        Modifies registry class
        
        PID:3412
        
        C:\Windows\SysWOW64\Mdpagc32.exe
        
        C:\Windows\system32\Mdpagc32.exe
        79⤵
        Drops file in System32 directory
        
        PID:2404
        
        C:\Windows\SysWOW64\Mlgjhp32.exe
        
        C:\Windows\system32\Mlgjhp32.exe
        80⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\Mcabej32.exe
        
        C:\Windows\system32\Mcabej32.exe
        81⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Mhnjna32.exe
        
        C:\Windows\system32\Mhnjna32.exe
        82⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\Mklfjm32.exe
        
        C:\Windows\system32\Mklfjm32.exe
        83⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\Mafofggd.exe
        
        C:\Windows\system32\Mafofggd.exe
        84⤵
        Modifies registry class
        
        PID:768
        
        C:\Windows\SysWOW64\Mkocol32.exe
        
        C:\Windows\system32\Mkocol32.exe
        85⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Mcfkpjng.exe
        
        C:\Windows\system32\Mcfkpjng.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10304
        
        C:\Windows\SysWOW64\Mdghhb32.exe
        
        C:\Windows\system32\Mdghhb32.exe
        87⤵
        Modifies registry class
        
        PID:10352
        
        C:\Windows\SysWOW64\Nlnpio32.exe
        
        C:\Windows\system32\Nlnpio32.exe
        88⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Nakhaf32.exe
        
        C:\Windows\system32\Nakhaf32.exe
        89⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Ndidna32.exe
        
        C:\Windows\system32\Ndidna32.exe
        90⤵
        Modifies registry class
        
        PID:10488
        
        C:\Windows\SysWOW64\Nlqloo32.exe
        
        C:\Windows\system32\Nlqloo32.exe
        91⤵
        
        PID:10532
        
        C:\Windows\SysWOW64\Ncjdki32.exe
        
        C:\Windows\system32\Ncjdki32.exe
        92⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10580
        
        C:\Windows\SysWOW64\Nfiagd32.exe
        
        C:\Windows\system32\Nfiagd32.exe
        93⤵
        Modifies registry class
        
        PID:10616
        
        C:\Windows\SysWOW64\Nhgmcp32.exe
        
        C:\Windows\system32\Nhgmcp32.exe
        94⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Napameoi.exe
        
        C:\Windows\system32\Napameoi.exe
        95⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Ndpjnq32.exe
        
        C:\Windows\system32\Ndpjnq32.exe
        96⤵
        Drops file in System32 directory
        
        PID:10744
        
        C:\Windows\SysWOW64\Nlgbon32.exe
        
        C:\Windows\system32\Nlgbon32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10784
        
        C:\Windows\SysWOW64\Nofoki32.exe
        
        C:\Windows\system32\Nofoki32.exe
        98⤵
        
        PID:10832
        
        C:\Windows\SysWOW64\Nfpghccm.exe
        
        C:\Windows\system32\Nfpghccm.exe
        99⤵
        
        PID:10868
        
        C:\Windows\SysWOW64\Ohncdobq.exe
        
        C:\Windows\system32\Ohncdobq.exe
        100⤵
        
        PID:10912
        
        C:\Windows\SysWOW64\Okmpqjad.exe
        
        C:\Windows\system32\Okmpqjad.exe
        101⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Ofbdncaj.exe
        
        C:\Windows\system32\Ofbdncaj.exe
        102⤵
        
        PID:10996
        
        C:\Windows\SysWOW64\Ollljmhg.exe
        
        C:\Windows\system32\Ollljmhg.exe
        103⤵
        
        PID:11040
        
        C:\Windows\SysWOW64\Ookhfigk.exe
        
        C:\Windows\system32\Ookhfigk.exe
        104⤵
        
        PID:11084
        
        C:\Windows\SysWOW64\Ocfdgg32.exe
        
        C:\Windows\system32\Ocfdgg32.exe
        105⤵
        
        PID:11124
        
        C:\Windows\SysWOW64\Odgqopeb.exe
        
        C:\Windows\system32\Odgqopeb.exe
        106⤵
        Modifies registry class
        
        PID:11168
        
        C:\Windows\SysWOW64\Oloipmfd.exe
        
        C:\Windows\system32\Oloipmfd.exe
        107⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Ochamg32.exe
        
        C:\Windows\system32\Ochamg32.exe
        108⤵
        Modifies registry class
        
        PID:11256
        
        C:\Windows\SysWOW64\Ofgmib32.exe
        
        C:\Windows\system32\Ofgmib32.exe
        109⤵
        
        PID:10252
        
        C:\Windows\SysWOW64\Omaeem32.exe
        
        C:\Windows\system32\Omaeem32.exe
        110⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Odljjo32.exe
        
        C:\Windows\system32\Odljjo32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10364
        
        C:\Windows\SysWOW64\Omcbkl32.exe
        
        C:\Windows\system32\Omcbkl32.exe
        112⤵
        
        PID:10412
        
        C:\Windows\SysWOW64\Ooangh32.exe
        
        C:\Windows\system32\Ooangh32.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2676
        
        C:\Windows\SysWOW64\Obpkcc32.exe
        
        C:\Windows\system32\Obpkcc32.exe
        114⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Pdngpo32.exe
        
        C:\Windows\system32\Pdngpo32.exe
        115⤵
        
        PID:2552
        
        C:\Windows\SysWOW64\Pmeoqlpl.exe
        
        C:\Windows\system32\Pmeoqlpl.exe
        116⤵
        
        PID:10572
        
        C:\Windows\SysWOW64\Pcpgmf32.exe
        
        C:\Windows\system32\Pcpgmf32.exe
        117⤵
        Drops file in System32 directory
        
        PID:10644
        
        C:\Windows\SysWOW64\Pfncia32.exe
        
        C:\Windows\system32\Pfncia32.exe
        118⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Pdqcenmg.exe
        
        C:\Windows\system32\Pdqcenmg.exe
        119⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5008
        
        C:\Windows\SysWOW64\Pokanf32.exe
        
        C:\Windows\system32\Pokanf32.exe
        120⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Pbimjb32.exe
        
        C:\Windows\system32\Pbimjb32.exe
        121⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Pehjfm32.exe
        
        C:\Windows\system32\Pehjfm32.exe
        122⤵
        
        PID:4756
        
        C:\Windows\SysWOW64\Pkabbgol.exe
        
        C:\Windows\system32\Pkabbgol.exe
        123⤵
        Modifies registry class
        
        PID:10880
        
        C:\Windows\SysWOW64\Pbljoafi.exe
        
        C:\Windows\system32\Pbljoafi.exe
        124⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Qejfkmem.exe
        
        C:\Windows\system32\Qejfkmem.exe
        125⤵
        
        PID:1480
        
        C:\Windows\SysWOW64\Qifbll32.exe
        
        C:\Windows\system32\Qifbll32.exe
        126⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10988
        
        C:\Windows\SysWOW64\Qkdohg32.exe
        
        C:\Windows\system32\Qkdohg32.exe
        127⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Qppkhfec.exe
        
        C:\Windows\system32\Qppkhfec.exe
        128⤵
        
        PID:2272
        
        C:\Windows\SysWOW64\Qbngeadf.exe
        
        C:\Windows\system32\Qbngeadf.exe
        129⤵
        Drops file in System32 directory
        
        PID:11152
        
        C:\Windows\SysWOW64\Afqifo32.exe
        
        C:\Windows\system32\Afqifo32.exe
        130⤵
        
        PID:11200
        
        C:\Windows\SysWOW64\Aioebj32.exe
        
        C:\Windows\system32\Aioebj32.exe
        131⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11240
        
        C:\Windows\SysWOW64\Amkabind.exe
        
        C:\Windows\system32\Amkabind.exe
        132⤵
        
        PID:2684
        
        C:\Windows\SysWOW64\Apimodmh.exe
        
        C:\Windows\system32\Apimodmh.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3336
        
        C:\Windows\SysWOW64\Abgjkpll.exe
        
        C:\Windows\system32\Abgjkpll.exe
        134⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Aeffgkkp.exe
        
        C:\Windows\system32\Aeffgkkp.exe
        135⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\Ammnhilb.exe
        
        C:\Windows\system32\Ammnhilb.exe
        136⤵
        
        PID:10452
        
        C:\Windows\SysWOW64\Apkjddke.exe
        
        C:\Windows\system32\Apkjddke.exe
        137⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10496
        
        C:\Windows\SysWOW64\Acgfec32.exe
        
        C:\Windows\system32\Acgfec32.exe
        138⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Poagma32.exe
        
        C:\Windows\system32\Poagma32.exe
        139⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Beaohcmf.exe
        
        C:\Windows\system32\Beaohcmf.exe
        140⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Cbihmg32.exe
        
        C:\Windows\system32\Cbihmg32.exe
        141⤵
        Drops file in System32 directory
        
        PID:5404
        
        C:\Windows\SysWOW64\Eedmlo32.exe
        
        C:\Windows\system32\Eedmlo32.exe
        142⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\Jokpcmmj.exe
        
        C:\Windows\system32\Jokpcmmj.exe
        143⤵
        Modifies registry class
        
        PID:10752
        
        C:\Windows\SysWOW64\Kiaqnagj.exe
        
        C:\Windows\system32\Kiaqnagj.exe
        144⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Lagepl32.exe
        
        C:\Windows\system32\Lagepl32.exe
        145⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\Ljoiibbm.exe
        
        C:\Windows\system32\Ljoiibbm.exe
        146⤵
        Drops file in System32 directory
        
        PID:3744
        
        C:\Windows\SysWOW64\Lhcjbfag.exe
        
        C:\Windows\system32\Lhcjbfag.exe
        147⤵
        
        PID:10948
        
        C:\Windows\SysWOW64\Midfjnge.exe
        
        C:\Windows\system32\Midfjnge.exe
        148⤵
        
        PID:3460
        
        C:\Windows\SysWOW64\Mpnngh32.exe
        
        C:\Windows\system32\Mpnngh32.exe
        149⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\Migcpneb.exe
        
        C:\Windows\system32\Migcpneb.exe
        150⤵
        
        PID:11068
        
        C:\Windows\SysWOW64\Mankaked.exe
        
        C:\Windows\system32\Mankaked.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5456
        
        C:\Windows\SysWOW64\Mpqklh32.exe
        
        C:\Windows\system32\Mpqklh32.exe
        152⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Mjfoja32.exe
        
        C:\Windows\system32\Mjfoja32.exe
        153⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Mapgfk32.exe
        
        C:\Windows\system32\Mapgfk32.exe
        154⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Mpchbhjl.exe
        
        C:\Windows\system32\Mpchbhjl.exe
        155⤵
        
        PID:11232
        
        C:\Windows\SysWOW64\Mhjpceko.exe
        
        C:\Windows\system32\Mhjpceko.exe
        156⤵
        Drops file in System32 directory
        
        PID:5776
        
        C:\Windows\SysWOW64\Mjiloqjb.exe
        
        C:\Windows\system32\Mjiloqjb.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3676
        
        C:\Windows\SysWOW64\Mdaqhf32.exe
        
        C:\Windows\system32\Mdaqhf32.exe
        158⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Nfdfoala.exe
        
        C:\Windows\system32\Nfdfoala.exe
        159⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Najjmjkg.exe
        
        C:\Windows\system32\Najjmjkg.exe
        160⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Nplkhf32.exe
        
        C:\Windows\system32\Nplkhf32.exe
        161⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Nhcbidcd.exe
        
        C:\Windows\system32\Nhcbidcd.exe
        162⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Nkboeobh.exe
        
        C:\Windows\system32\Nkboeobh.exe
        163⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Nmpkakak.exe
        
        C:\Windows\system32\Nmpkakak.exe
        164⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Nkghqo32.exe
        
        C:\Windows\system32\Nkghqo32.exe
        165⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Adnbapjp.exe
        
        C:\Windows\system32\Adnbapjp.exe
        166⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5272
        
        C:\Windows\SysWOW64\Akgjnj32.exe
        
        C:\Windows\system32\Akgjnj32.exe
        167⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\Agnkck32.exe
        
        C:\Windows\system32\Agnkck32.exe
        168⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Ajodef32.exe
        
        C:\Windows\system32\Ajodef32.exe
        169⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Abflfc32.exe
        
        C:\Windows\system32\Abflfc32.exe
        170⤵
        Drops file in System32 directory
        
        PID:6424
        
        C:\Windows\SysWOW64\Agcdnjcl.exe
        
        C:\Windows\system32\Agcdnjcl.exe
        171⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Bbhhlccb.exe
        
        C:\Windows\system32\Bbhhlccb.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6596
        
        C:\Windows\SysWOW64\Bhbahm32.exe
        
        C:\Windows\system32\Bhbahm32.exe
        173⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Bjcmpepm.exe
        
        C:\Windows\system32\Bjcmpepm.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7156
        
        C:\Windows\SysWOW64\Bnoiqd32.exe
        
        C:\Windows\system32\Bnoiqd32.exe
        175⤵
        Modifies registry class
        
        PID:6440
        
        C:\Windows\SysWOW64\Bggnijof.exe
        
        C:\Windows\system32\Bggnijof.exe
        176⤵
        
        PID:3476
        
        C:\Windows\SysWOW64\Bnaffdfc.exe
        
        C:\Windows\system32\Bnaffdfc.exe
        177⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Bqpbboeg.exe
        
        C:\Windows\system32\Bqpbboeg.exe
        178⤵
        Modifies registry class
        
        PID:6652
        
        C:\Windows\SysWOW64\Bhgjcmfi.exe
        
        C:\Windows\system32\Bhgjcmfi.exe
        179⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\Bjhgke32.exe
        
        C:\Windows\system32\Bjhgke32.exe
        180⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\Bdnkhn32.exe
        
        C:\Windows\system32\Bdnkhn32.exe
        181⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Bglgdi32.exe
        
        C:\Windows\system32\Bglgdi32.exe
        182⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\Bjkcqdje.exe
        
        C:\Windows\system32\Bjkcqdje.exe
        183⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Bnfoac32.exe
        
        C:\Windows\system32\Bnfoac32.exe
        184⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Bdphnmjk.exe
        
        C:\Windows\system32\Bdphnmjk.exe
        185⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Bilcol32.exe
        
        C:\Windows\system32\Bilcol32.exe
        186⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Bkjpkg32.exe
        
        C:\Windows\system32\Bkjpkg32.exe
        187⤵
        Drops file in System32 directory
        
        PID:7596
        
        C:\Windows\SysWOW64\Cnhlgc32.exe
        
        C:\Windows\system32\Cnhlgc32.exe
        188⤵
        Modifies registry class
        
        PID:3796
        
        C:\Windows\SysWOW64\Cebdcmhh.exe
        
        C:\Windows\system32\Cebdcmhh.exe
        189⤵
        
        PID:3064
        
        C:\Windows\SysWOW64\Cnkilbni.exe
        
        C:\Windows\system32\Cnkilbni.exe
        190⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Cqiehnml.exe
        
        C:\Windows\system32\Cqiehnml.exe
        191⤵
        Modifies registry class
        
        PID:1780
        
        C:\Windows\SysWOW64\Ciqmjkno.exe
        
        C:\Windows\system32\Ciqmjkno.exe
        192⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Cgcmeh32.exe
        
        C:\Windows\system32\Cgcmeh32.exe
        193⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Cjaiac32.exe
        
        C:\Windows\system32\Cjaiac32.exe
        194⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Cicjokll.exe
        
        C:\Windows\system32\Cicjokll.exe
        195⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Cbknhqbl.exe
        
        C:\Windows\system32\Cbknhqbl.exe
        196⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Ckcbaf32.exe
        
        C:\Windows\system32\Ckcbaf32.exe
        197⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Cbnknpqj.exe
        
        C:\Windows\system32\Cbnknpqj.exe
        198⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Cgjcfgoa.exe
        
        C:\Windows\system32\Cgjcfgoa.exe
        199⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Dndlba32.exe
        
        C:\Windows\system32\Dndlba32.exe
        200⤵
        
        PID:6784
        
        C:\Windows\SysWOW64\Dgmpkg32.exe
        
        C:\Windows\system32\Dgmpkg32.exe
        201⤵
        
        PID:6916
        
        C:\Windows\SysWOW64\Dbbdip32.exe
        
        C:\Windows\system32\Dbbdip32.exe
        202⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Djmima32.exe
        
        C:\Windows\system32\Djmima32.exe
        203⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Dnienqbi.exe
        
        C:\Windows\system32\Dnienqbi.exe
        204⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7628
        
        C:\Windows\SysWOW64\Dioiki32.exe
        
        C:\Windows\system32\Dioiki32.exe
        205⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Dgaiffii.exe
        
        C:\Windows\system32\Dgaiffii.exe
        206⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Dajnol32.exe
        
        C:\Windows\system32\Dajnol32.exe
        207⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Dhcfleff.exe
        
        C:\Windows\system32\Dhcfleff.exe
        208⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Djbbhafj.exe
        
        C:\Windows\system32\Djbbhafj.exe
        209⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6660
        
        C:\Windows\SysWOW64\Dalkek32.exe
        
        C:\Windows\system32\Dalkek32.exe
        210⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Elaobdmm.exe
        
        C:\Windows\system32\Elaobdmm.exe
        211⤵
        
        PID:8116
        
        C:\Windows\SysWOW64\Enpknplq.exe
        
        C:\Windows\system32\Enpknplq.exe
        212⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Eblgon32.exe
        
        C:\Windows\system32\Eblgon32.exe
        213⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Eieplhlf.exe
        
        C:\Windows\system32\Eieplhlf.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6236
        
        C:\Windows\SysWOW64\Eldlhckj.exe
        
        C:\Windows\system32\Eldlhckj.exe
        215⤵
        
        PID:7204
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7204 -s 404
        216⤵
        Program crash
        
        PID:7824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 7204 -ip 7204
1⤵
PID:4576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Acgfec32.exe

Filesize
78KB

MD5
ee2da38719e896a0b77177b1b57cd5cd

SHA1
85c3f1b58915a21c44734f05cb9aad5028c39776

SHA256
9815a54e4fa9bb900bd6777049d76d071cd00ecf5fb54b984fa30b70d359a058

SHA512
de13902aeb4c3750be29363e72df708be5c98b2cb8609e10a888311fb3505c9937bdee538b7101b33f23e7d03005755f8577286e1b94d13a587c4e9f505126b1

Download Submit
C:\Windows\SysWOW64\Agnkck32.exe

Filesize
78KB

MD5
d106e26162eeee694291b84705b72a81

SHA1
2463c705c741140d8ebd9d4de5dcba6b055bb775

SHA256
541ba1f9cbec35e8de790a310f05b0dd6d7db5644e493490866623c6ffdeba91

SHA512
183be139573e0950f3ca5f18baea6500f8186b02887ac5445b3ca641abfcb1f598b32b6d25ef2e99d57675ef73e2bee6e230ac39e50d3ce1f59f58c6594fe096

Download Submit
C:\Windows\SysWOW64\Anclbkbp.exe

Filesize
78KB

MD5
e7b45eb9ab6ee568d991c5d9ca3795c4

SHA1
dc522e76abbda441df9d496b2b4637f95ac90e6c

SHA256
c46fb52ff09919e3827fcff351b19cf842d282bd78ea3da2feca315fd9d5b8c2

SHA512
d5cca4f37230e769a3b40fe01e6629f67b25e2ecd135995c18db249ead51652e4e4c17c1ff5e1316e57ab99954d1d5348e0e745442f479e33c7df6727135953b

Download Submit
C:\Windows\SysWOW64\Bdpaeehj.exe

Filesize
78KB

MD5
98522734b0e80f02c6e8ddd98bd9be40

SHA1
e0c78d28a5fac3c0a448e9852610bcc05181d8e2

SHA256
fb7abf97cf1a13432fc5b2528796255d2cce0c9e9e42754cfc1b178f8d010949

SHA512
b3c60aa8560bad368b03369f1d06a74f4b60fe68fb6c82ceb8161a6c796be69deb8fd427813e29b90dcaced1eda515ef2d0c4e278200a7991931e96808cd284b

Download Submit
C:\Windows\SysWOW64\Bgelgi32.exe

Filesize
78KB

MD5
2e0842164e1edf596979938d4020e3d5

SHA1
9945b7a4f446d2672720d6dd2c0c7babf9b37b6b

SHA256
224dbfc66e789a69af32d50cda8b894d164da63479055fae95661504c18c8325

SHA512
4fb8b2cc932064e38b878a60c636dcb1863f6ad89765c344505d67b3a7940b7b25bb2ac7396feddfb5c1aa4e7a7f73a40e6b2d006d63c7a8b0fbaec425fe9846

Download Submit
C:\Windows\SysWOW64\Bhgjcmfi.exe

Filesize
78KB

MD5
80848b41a611a76b058b4cb4b6d458bf

SHA1
fe6288b52ebd06d24408bf27c14b62a21270bf02

SHA256
56bc63e9d9570a1316161f645534d0a45db924d84ab652881ef1105128cd0897

SHA512
1c2e98885e325bbf9727033817c8b3c1a21693fd2e6af07a6ff9d7e9c2fe1f8051c59dbdce0f523afd0fb725c152278d9a6e5b0f27fbe910ea50fe3eec1bd550

Download Submit
C:\Windows\SysWOW64\Bhpofl32.exe

Filesize
78KB

MD5
2e0842164e1edf596979938d4020e3d5

SHA1
9945b7a4f446d2672720d6dd2c0c7babf9b37b6b

SHA256
224dbfc66e789a69af32d50cda8b894d164da63479055fae95661504c18c8325

SHA512
4fb8b2cc932064e38b878a60c636dcb1863f6ad89765c344505d67b3a7940b7b25bb2ac7396feddfb5c1aa4e7a7f73a40e6b2d006d63c7a8b0fbaec425fe9846

Download Submit
C:\Windows\SysWOW64\Bnfoac32.exe

Filesize
78KB

MD5
dd266544923a3b4f43abfc216498b316

SHA1
038e12460e00c01d6478b568a11ada42c81a3352

SHA256
d07487778d35b82cb9a93cb29821594b045e36d8ee747c52fb0f266862df5381

SHA512
6ab6a596d84616da606b3867ef3a08d4900034b29d846d7a102164bf5cfc77e38c04a1cf92e42de2ed98ad5f898ad8c0fe8201a3ed6728cd6b046422d26ba941

Download Submit
C:\Windows\SysWOW64\Cbknhqbl.exe

Filesize
78KB

MD5
08b2e4f1e6a9ff90789f2f1d3f364e4f

SHA1
5b6ab26f5022bb5dea4d8a696bfd636db9143c38

SHA256
6e0899316b47f068029e1c3c75d18218994b797d611623d7412d36bf79007ad2

SHA512
3424ab87e10e9a3c24248188ea06309b017b75523a345f4395230b20b0de2c7988ace4b35e0801d94e83482a539ea0c130bc3a826fa59f0e2f37686c831b21e2

Download Submit
C:\Windows\SysWOW64\Cbnknpqj.exe

Filesize
78KB

MD5
24bafa798156f8cf6934b7c469880913

SHA1
72d205b6e47c507f727afdd1df66c849909292cd

SHA256
ff1c7cbe99becba7a9a50af551509bbf1d1a85954b0047899fb82e821ab46119

SHA512
6c67567d016cca6a16d9d303671873fc875593b7ca2be68a6820d185cac392575dc1c260cdc6079daa06ab22a96b7a763a715f8e7b63a799351a4c3e2e270873

Download Submit
C:\Windows\SysWOW64\Chdialdl.exe

Filesize
64KB

MD5
38d6c4089b3aa7629772770c5da8cf17

SHA1
108669e7d2064aac8c184e1f3a6d46e9b9284de4

SHA256
92000773403b19b40f5237b2683889dfecfdab2717b913d3fe1e00bf00c33a87

SHA512
d23bf11eb0afa4a2fea5ca796e0140546e3a78129ee009868940cc03ab55b9c357c6abc4b962863c0db77e62927dd77b2a575bc186c98880e095c65f7b6ce6f8

Download Submit
C:\Windows\SysWOW64\Cjaiac32.exe

Filesize
78KB

MD5
48ceb1033d8fd2aea8cb0998fdaff2e9

SHA1
ea1624756c2d8356215d3aca15289505c975778c

SHA256
fa6341115ef6e94f0544d34d6be2454dd4b39241b513efed3fa1f66ccf66ba53

SHA512
3c1f9db72a577dd4e74215398bbb97d6b314066a601c9bc49020b28ad797fbee5964d91801c2370b5f0f497ab829ce285d1bd9416eda063cacfe518b49c67582

Download Submit
C:\Windows\SysWOW64\Ckjknfnh.exe

Filesize
78KB

MD5
ea6ebc728d4875dfd853ab02491329ac

SHA1
9dc5b7ff85aae06a09491293166247afebd8c351

SHA256
0decbe46eb87e9b9b837e9b55ab353af890b891e4d7633840ef5ac4bcd1dbe7b

SHA512
b905fcc8bdf31319e051e9ee97e8f03f4bd2094cb176c9e16ae39a6b21a538e43dc6dbd055fab547bfd1f868247ea8bc6e149aff6184cffd0a104e12a8448bc3

Download Submit
C:\Windows\SysWOW64\Dbbdip32.exe

Filesize
78KB

MD5
e2fc65db1b20614297123c9a91e6cd76

SHA1
2bd5fe967a6d32364f00bcbf99092994e7fca181

SHA256
2a1fbb0e96f5d063cc35516d58181118ee5fb207d1f0ca963c9a63e70ef6b4f9

SHA512
ac0d65cd8a3aa63d7c7697304aadae8dadf5c52c6f7ee0130b22b861862534bea3e2222b697f47729568ae87f7cdbf02cf84b7f191f9cd844c312fd29147bcbe

Download Submit
C:\Windows\SysWOW64\Dbkqfe32.exe

Filesize
78KB

MD5
51cf65ca853723128dad368860640e52

SHA1
5edb1a8da186dc02a6734943b9129d3f846c130e

SHA256
d5b96c7e79503ffd682f7fd61baf8ff9fb0d3d115e604fe8bd50edc0b6b8e775

SHA512
960aa5769ec67d2a8789d71296ed96d60672069550b0adb2c296a170d42e29482c49f296e6c5a16ffabe66b4db3fad2219d57ec04e38601ba34188d17b7620ea

Download Submit
C:\Windows\SysWOW64\Dnienqbi.exe

Filesize
78KB

MD5
e62ddf44237ee6de305839647cafe85e

SHA1
c6ef364fc1ffb5fd6daf6ce6c1de88e1d4c8153d

SHA256
25b1f4c22ad9f4dd51f944792f11ddde48352e11949f1c34bd51298a48a1ba4d

SHA512
7d3d4ae3368982daacb9f197a0a145f1758922df42b932a7ccb3adcfdc5eb65c994cf95599418b7faa65679a5eb42afbd0b68742ed788a0e87fdb1ec4fdf3552

Download Submit
C:\Windows\SysWOW64\Edgbii32.exe

Filesize
78KB

MD5
d4531d0a72bb3e7e6137ab37c36de7ad

SHA1
26241924e4a1ceb68221b59a8c2c8df487c5b7e9

SHA256
0fdc1b200e8f2b4a1aca931f40fdfdfe6d8c29cd65252faccdd6b3447fa67e0b

SHA512
43717679542f1fd4710b8369453edee68a1a199c6730353dcf3cdce2bece13a4eded8f73f46285a101f22cfd6d19d1135d42fc2d0509c4f45fedd6de58a415e2

Download Submit
C:\Windows\SysWOW64\Emanjldl.exe

Filesize
78KB

MD5
7fa0ed7d6fc8c24cf19406cffa8b6bc9

SHA1
1f208e8795c99a0acd0fb1d9b882af61d22cc35f

SHA256
c86f8a4110be356ac8747913d927e0b2a909bd3526e50a57639d2c6b55b2cd1c

SHA512
0ecb73733c649c5b92b99e7477cfedb90db820d453776a6ba2bd271a205bbb4090428614f87a0bd8c67395abbeb6e1330c648fe330bf274087a3054d2ba242bb

Download Submit
C:\Windows\SysWOW64\Emmdom32.exe

Filesize
78KB

MD5
0d953087cf91b90aed39a6ed8e22c2fb

SHA1
22ee7f1097d6361c8811928ceeb75b0c0682bf27

SHA256
e8fd69c3b8f55ee1c45dfacb3fb7a7351041f589433e25e0a94f63f196930a9d

SHA512
de208fcaea20f0f0819526adc372ff9240725050a030e75c36decdb47b555322b865d9c44f237d3b2651a47bedb45baf262a66cbea14f9397108ea65dcfdeb73

Download Submit
C:\Windows\SysWOW64\Fdnhih32.exe

Filesize
78KB

MD5
39334f2d595c15b8296fc9809835ca2a

SHA1
d5a343aecf40cc147ef6ad613d4479b65b87e9fc

SHA256
5239ea3d773cf958d6973b0f23e82d5c07f6e5376c1486e54f6ab99bdfbb580c

SHA512
7d33239c281d2ee25455b5c23207f2e4133b426e2ffc1b376d282f71fd81eb606fb71c4ab959f2329dc2e7be398b796253de35d57911004b07916de8b554c35b

Download Submit
C:\Windows\SysWOW64\Fealin32.exe

Filesize
78KB

MD5
416c48db00feda1631682b6590db9330

SHA1
6cca1da909a976cac48c058e08b29d85fc0babcc

SHA256
6fa53537a59df083bf37cb1a4a723d3fb82a186ef1cfe5a113feb53668f34ddb

SHA512
0e277d2bdb10b9a8b3a32dfa5bd3091b34b3494115b5b023d9d417c7bcec03b4af4fd56ea3f221f1fd9a790d5edf784684401523b09f191afd8b12e7e6e28d5b

Download Submit
C:\Windows\SysWOW64\Fganqbgg.exe

Filesize
78KB

MD5
6c6c0a4b432c7e3ceefd2bb53fe531fc

SHA1
10f8e77a766b51e8c944ab61638255b21bd8c8d1

SHA256
4ada2c4a5f215ef3c526aaa2efd1d3f790774be7260993e0ab225c21b0e53c67

SHA512
b1421f92fcf7a0dc88a36b1f43435f6fbfc279995c8f87167521642b7aae6069f9b49423b0655b68ad626dfe7e967380ead9f888ab0b8145231f1e5c5f9d2e61

Download Submit
C:\Windows\SysWOW64\Fkofga32.exe

Filesize
78KB

MD5
b4d60377139a9e042d524a8d91a3fd44

SHA1
c312cd043ea64cfe2b2e8a60c8ba6b36cd413801

SHA256
4ef2ec53d7a998de0cee841d30cdf9e285bb2f3a0740908e98335541746fd789

SHA512
971d0e02af4ee6fec631d6c9b9a1b93cea2cfd06c7ec09836eadd65567263da6b24ca5ae891a9978a95bc724fdbb763d2ec8f69e73db5f4918e31c308f3fcee3

Download Submit
C:\Windows\SysWOW64\Gldglf32.exe

Filesize
78KB

MD5
ca9ec694846eab94d3b3f389c99047d0

SHA1
95ea2b6007ce569d36844a6e521e7d2f3a3b818a

SHA256
9c6fb53648b8f8138e16a9ec03d4f85a95f65d7a7b425df2078763090fb2d0b4

SHA512
f4fb4d4f0fa8164beda258e5e19583e9d44874df137b43a43ec2816de882fddb35707d60572539c5abbe383fe44e53c0485b71081511041282f7ea10b4477410

Download Submit
C:\Windows\SysWOW64\Gmojkj32.exe

Filesize
78KB

MD5
15ee284a26e7ffb181069cd07ffee20f

SHA1
10a664064f14d01c99bfe97e3bc58ed8b8b729af

SHA256
b176c78dbf2250c27ce4fd0e697e4ff5aa78635f89eb648045133d98d1ef169d

SHA512
200753ff003c7a1c8a9c57ba0af12fb0971f8cf237dcbf1734566b3f5b377f1543ed42742cd85558971973cc7393723d32e3c991d7250e44ee0a058253bfbaa9

Download Submit
C:\Windows\SysWOW64\Hehdfdek.exe

Filesize
78KB

MD5
f36881cfd65922df82cdfa5ab4523b2c

SHA1
41456f201c58d4de18e1286e793520bea11818d3

SHA256
3bc4a06589b70c4003dfd64d427e546337185093eb1604032336fedf846bf0d1

SHA512
609eb003a487794f0c3190bb10914fa369fce12c3ea1d81ff538ee4ac7c9abbb956a4aa4c659c558ba86de3bd41ebc8631958434611a12a8e358db1bdf405298

Download Submit
C:\Windows\SysWOW64\Hgabkoee.exe

Filesize
78KB

MD5
768d35e08f74dc931c3405f6f2795693

SHA1
bf6bc3fedbd684350d81a31759372d7203a2e6b6

SHA256
cb078bc367db9753a27949b8c34ccd30b862cb5bca4f60cb4067f06252c87d41

SHA512
290e49c8ce95cd3bc7a3cf354b55734a61bbdf9d70d8a3f4595f71a142ee4a5145c791bdd38da89a8f3b5aa121d195e839b676e319e2bd99a82818309c31b247

Download Submit
C:\Windows\SysWOW64\Hgabkoee.exe

Filesize
78KB

MD5
768d35e08f74dc931c3405f6f2795693

SHA1
bf6bc3fedbd684350d81a31759372d7203a2e6b6

SHA256
cb078bc367db9753a27949b8c34ccd30b862cb5bca4f60cb4067f06252c87d41

SHA512
290e49c8ce95cd3bc7a3cf354b55734a61bbdf9d70d8a3f4595f71a142ee4a5145c791bdd38da89a8f3b5aa121d195e839b676e319e2bd99a82818309c31b247

Download Submit
C:\Windows\SysWOW64\Hkjafn32.exe

Filesize
78KB

MD5
fc652a948daa12f458617b0fcf34c576

SHA1
7fa8b251ab865164849b0cf2affd04033bde5ad2

SHA256
1d8066eff3167906c2251a2f60b15aed4b3dbda62399b3b55c8775657e9e2d6c

SHA512
ae83441e917de79b84af762759a1fa1b5cf5b92307fe1be2fb53a1182f19a8cd8a472032c5e497c6b649c9f21f0ebab70788797acc1e81f1086bc027bbdd0875

Download Submit
C:\Windows\SysWOW64\Hkjafn32.exe

Filesize
78KB

MD5
fc652a948daa12f458617b0fcf34c576

SHA1
7fa8b251ab865164849b0cf2affd04033bde5ad2

SHA256
1d8066eff3167906c2251a2f60b15aed4b3dbda62399b3b55c8775657e9e2d6c

SHA512
ae83441e917de79b84af762759a1fa1b5cf5b92307fe1be2fb53a1182f19a8cd8a472032c5e497c6b649c9f21f0ebab70788797acc1e81f1086bc027bbdd0875

Download Submit
C:\Windows\SysWOW64\Ibffhhek.exe

Filesize
78KB

MD5
dd45a835ec5b232b09b28d97731dc409

SHA1
0af1a52eeec5be278d12279dec668e64436ca99b

SHA256
c9e3318fa81e9e2ee71c1c4f98529f94a8016b6627a2cbc3d35129ff21bd8251

SHA512
389ab5cc13524f22eba6418e6c738e2b759ec5290f2811e021bc6c3b49e086e083645f4b2caf707bf20e3139032ed75e676ce3dc70a39b47613155dc5c29a226

Download Submit
C:\Windows\SysWOW64\Ibffhhek.exe

Filesize
78KB

MD5
dd45a835ec5b232b09b28d97731dc409

SHA1
0af1a52eeec5be278d12279dec668e64436ca99b

SHA256
c9e3318fa81e9e2ee71c1c4f98529f94a8016b6627a2cbc3d35129ff21bd8251

SHA512
389ab5cc13524f22eba6418e6c738e2b759ec5290f2811e021bc6c3b49e086e083645f4b2caf707bf20e3139032ed75e676ce3dc70a39b47613155dc5c29a226

Download Submit
C:\Windows\SysWOW64\Ibnligoc.exe

Filesize
78KB

MD5
e7e63fe4fb8f2708a0881aeada8a0bd5

SHA1
fa52891908b778e4a54e0d4ef8206eae384b02a6

SHA256
248a2207812fe619d0e31d70ab511ea0bc589135f0fa1015218e093aad595934

SHA512
48d2b983968df895a06d06d44153ad8b9a6b57019a1ffd39cbea54a1bfd7febf818bd66e7657c32160930dc1869c517cd235d9b23285b8c291d0689b67f6408d

Download Submit
C:\Windows\SysWOW64\Ibnligoc.exe

Filesize
78KB

MD5
e7e63fe4fb8f2708a0881aeada8a0bd5

SHA1
fa52891908b778e4a54e0d4ef8206eae384b02a6

SHA256
248a2207812fe619d0e31d70ab511ea0bc589135f0fa1015218e093aad595934

SHA512
48d2b983968df895a06d06d44153ad8b9a6b57019a1ffd39cbea54a1bfd7febf818bd66e7657c32160930dc1869c517cd235d9b23285b8c291d0689b67f6408d

Download Submit
C:\Windows\SysWOW64\Idjlpc32.exe

Filesize
78KB

MD5
6ed302f79ce42849d163050b9af1a3c9

SHA1
95e15e86459b47c4e729061d309f9e167f3a8cc1

SHA256
7889709eb914b3186b4e91320c71aa603bced69c013e0ee974a66aab45695bd2

SHA512
03cd19f2a6d877906648aa824ccacae976d048e5c6d711e243bf61ad53d0b38019efe9697db59d0b6594f477c1e7069820c0b3f6d8c8666733fec6d52344cc92

Download Submit
C:\Windows\SysWOW64\Idjlpc32.exe

Filesize
78KB

MD5
6ed302f79ce42849d163050b9af1a3c9

SHA1
95e15e86459b47c4e729061d309f9e167f3a8cc1

SHA256
7889709eb914b3186b4e91320c71aa603bced69c013e0ee974a66aab45695bd2

SHA512
03cd19f2a6d877906648aa824ccacae976d048e5c6d711e243bf61ad53d0b38019efe9697db59d0b6594f477c1e7069820c0b3f6d8c8666733fec6d52344cc92

Download Submit
C:\Windows\SysWOW64\Ihdldn32.exe

Filesize
78KB

MD5
ab4a11dbc91618c4b4f3f3b1245bf220

SHA1
7dd1a7d29f1fcbfb252f321c2b51bb846e70fbe7

SHA256
89ea7c50987038b670184d43c0fb46fe5060a4925cad12154310baace4fbd325

SHA512
75f6f6461c6550f388ec2e3f75c9106f6248deabdc8d56a4e07b30900193bfd331d153a55a05189a0208be5b2edf0a2a199ae7e4cf189de44419bc20f9f8843b

Download Submit
C:\Windows\SysWOW64\Ihmfco32.exe

Filesize
78KB

MD5
ca5aac1ebacc60bb5108bfcd2fccae0f

SHA1
487f3e22f6861163a36f34977d38335831a536f5

SHA256
d9ff1192898bf57dd3895c07adc8f6d91507fbe8927e19de404367f21d7b3b2f

SHA512
5366f0700fdaa9461c7428eee279c503510c3d2134d970edb16ee933563dffe59e3240c1e013d7367f6b39d2289a47745912dbfccfaf9e4ab17855692cd47256

Download Submit
C:\Windows\SysWOW64\Iidphgcn.exe

Filesize
78KB

MD5
f9dbef4a6729b51b38c054959dad304a

SHA1
909d5bdc2bbcd13963fbbb608ce61e75e826195f

SHA256
3d5e1ff8928ca66f2601c0fe6b94960ac819159306531aa4967d3dd7743d0ea2

SHA512
783e48d513e3666ee2da70aa392d4fb2791fc8f099797bdc63ef1013f13f56ce2f2410fd177e74878df1c6c3d8f352e2b6f7c3b3322de2408453b9458884c5ce

Download Submit
C:\Windows\SysWOW64\Ikaggmii.exe

Filesize
78KB

MD5
7805bc996c5820d3c7edd5fb53a31a65

SHA1
a2aa24cc10aea94e655aaacd706c05912bdf5608

SHA256
6bd94689942d0d2cc542e7ef83bfdd257c6e76d67fcc68a85e259da765d2a825

SHA512
56c05257b7808573e156ccee69eb395e8533dcc8d3ec82d087dcb72694e3c62e4534cc3ae62878415163046d838e9663a214283efff9a2021a8d0b8fecd334d6

Download Submit
C:\Windows\SysWOW64\Ikaggmii.exe

Filesize
78KB

MD5
7805bc996c5820d3c7edd5fb53a31a65

SHA1
a2aa24cc10aea94e655aaacd706c05912bdf5608

SHA256
6bd94689942d0d2cc542e7ef83bfdd257c6e76d67fcc68a85e259da765d2a825

SHA512
56c05257b7808573e156ccee69eb395e8533dcc8d3ec82d087dcb72694e3c62e4534cc3ae62878415163046d838e9663a214283efff9a2021a8d0b8fecd334d6

Download Submit
C:\Windows\SysWOW64\Ikfabm32.exe

Filesize
78KB

MD5
ba4f431e34772030a3e1ff1f0a2cd133

SHA1
a04457639fb35373e792de760dcf5cc932da24c6

SHA256
f433216fe2aa98a189d1af8a782a4db6c87d9d9cc2905d3c3de67a189adf9a80

SHA512
dbc26fb144cd126dcadebceaaeb11a972e83e8d6e42a39820de1c21721f6168e9ddba752221fddbdfa2afe320f78d8b10157f7514a1b73047e72c744a0d1c0aa

Download Submit
C:\Windows\SysWOW64\Ikfabm32.exe

Filesize
78KB

MD5
ba4f431e34772030a3e1ff1f0a2cd133

SHA1
a04457639fb35373e792de760dcf5cc932da24c6

SHA256
f433216fe2aa98a189d1af8a782a4db6c87d9d9cc2905d3c3de67a189adf9a80

SHA512
dbc26fb144cd126dcadebceaaeb11a972e83e8d6e42a39820de1c21721f6168e9ddba752221fddbdfa2afe320f78d8b10157f7514a1b73047e72c744a0d1c0aa

Download Submit
C:\Windows\SysWOW64\Imiehfao.exe

Filesize
78KB

MD5
8e49ee2ac4fdbb9de4a1b421f1adf03e

SHA1
a21b4541cfdcd862edb53e513c415baea2428792

SHA256
c99e73c91cc5875e458ae5ec245bcfb1fb684c4847fe3aefd9006a872bee3b03

SHA512
556887227d337f03fc458470779a0da0ebf80104503c1ac93a8cc10433d0ffd1cca9f9c640b94d523193573b201d67b12290bcb35d6e34f438f23d5cb4d74117

Download Submit
C:\Windows\SysWOW64\Imnocf32.exe

Filesize
78KB

MD5
79ecde97d09564d879e06ec074baf228

SHA1
2813709af902ab3a25471ecd8fef923d69001eaf

SHA256
07bee0bc8c9ee0dbdaaa791f8baefec2909b886fdbd04a1bc3dd6e7d72b35228

SHA512
74809ff16deef91d131792dfe28ca4078bb8a34f061bb5120c8dcbca4cd106854f656754bd5368bd050fdef25bf1eeca13bb02320394af2efaf49fe84d715508

Download Submit
C:\Windows\SysWOW64\Iokgal32.exe

Filesize
78KB

MD5
71e8458a9553bc0dc76ad7c9aa2e0701

SHA1
949fab40d9a706f80ee75fd5d65215c735affe2b

SHA256
a366a3a0fd095282e9f80735a088aa55fed5b1164cad42da1d5e709467c304f7

SHA512
0fa218849833a2b8455437e8ba2b6f705f0a1768953467cbe25e814fe7499171c4e103d76dace372d52f70eff80a9b233502cbfb8b9d38c328f222f0e68ce961

Download Submit
C:\Windows\SysWOW64\Iokgal32.exe

Filesize
78KB

MD5
71e8458a9553bc0dc76ad7c9aa2e0701

SHA1
949fab40d9a706f80ee75fd5d65215c735affe2b

SHA256
a366a3a0fd095282e9f80735a088aa55fed5b1164cad42da1d5e709467c304f7

SHA512
0fa218849833a2b8455437e8ba2b6f705f0a1768953467cbe25e814fe7499171c4e103d76dace372d52f70eff80a9b233502cbfb8b9d38c328f222f0e68ce961

Download Submit
C:\Windows\SysWOW64\Jfgdkd32.exe

Filesize
78KB

MD5
5fe7b5865e565c999377ca04659f0259

SHA1
60ceb103a3d6faf57f52571832a8ff68b7f43bab

SHA256
14d23c03a907fac0bb7e9cc9e8f8b55a1aecc701565277fe310f398a60e5e4d2

SHA512
764428b7a36163a9945fea78d223559b0f0bea40ecd1c370c5096fb33513d5863de7cf5a602f7fac6dbdc14cb932e1b8f01448f7f00ae88e095e9b46d1e273bc

Download Submit
C:\Windows\SysWOW64\Jfgdkd32.exe

Filesize
78KB

MD5
5fe7b5865e565c999377ca04659f0259

SHA1
60ceb103a3d6faf57f52571832a8ff68b7f43bab

SHA256
14d23c03a907fac0bb7e9cc9e8f8b55a1aecc701565277fe310f398a60e5e4d2

SHA512
764428b7a36163a9945fea78d223559b0f0bea40ecd1c370c5096fb33513d5863de7cf5a602f7fac6dbdc14cb932e1b8f01448f7f00ae88e095e9b46d1e273bc

Download Submit
C:\Windows\SysWOW64\Jghabl32.exe

Filesize
78KB

MD5
4c94a5531c9f389401c422c911dd2c8a

SHA1
3eecc81f594820726391eac27a9eb401e054d9c3

SHA256
22b3137a22fa3d3789ac27a5b9bc87e7c57991fd52fbde4cf6138d01c678a2bb

SHA512
aa155e7e765d9c74cd4adf7c17d25c51d9e6f195a0d2f5b535ed52210d26002e4402f8338b9de0dc8101b46820317dbfbedad537e732a737944bd72944b42b4f

Download Submit
C:\Windows\SysWOW64\Jghabl32.exe

Filesize
78KB

MD5
4c94a5531c9f389401c422c911dd2c8a

SHA1
3eecc81f594820726391eac27a9eb401e054d9c3

SHA256
22b3137a22fa3d3789ac27a5b9bc87e7c57991fd52fbde4cf6138d01c678a2bb

SHA512
aa155e7e765d9c74cd4adf7c17d25c51d9e6f195a0d2f5b535ed52210d26002e4402f8338b9de0dc8101b46820317dbfbedad537e732a737944bd72944b42b4f

Download Submit
C:\Windows\SysWOW64\Jlbejloe.exe

Filesize
78KB

MD5
4cae47a5cd7a1aac5239f5a1f15b1d59

SHA1
6193db8f2673bc6add6aa9f1c1be03139119f594

SHA256
809d23796c29a7eb4fb4b1821c39c2a1d1ba5e27249eeed681c3cea41539097b

SHA512
183d6500a9fdff1e3a5b82c616fd4d2e59859d2abce42173e14bee305ab86a3451b77ee78bf1f63da8dad7b7be91d24540c14e7ef3a047adf04486e6932b42cb

Download Submit
C:\Windows\SysWOW64\Jleijb32.exe

Filesize
78KB

MD5
0bcd1957707fc191819b050d99b19e7d

SHA1
211ca3313e16e6fa4601886198c1226579fafe71

SHA256
643ac1edc40ea2da887381c444eb62e1139f8c7cedb65bf3317ace0736b0dd1d

SHA512
74d3b94b12a9841adeb55bd2244d3483da9fcb0cb291eb82bbc4415b6993691e8b06ac976b9ff8df1b0cd71c2433b05e5b4da3b39d32f84d33ef258adbab2ded

Download Submit
C:\Windows\SysWOW64\Jngjch32.exe

Filesize
78KB

MD5
31a73172b5479bd6396f08c164a10aac

SHA1
f81d8b21f51133e166eb3d550c7e2b4d6bc748fb

SHA256
59d76266e8f6afd3198f273b6b356876ea61200f624c68fcca300d6b7f5d7233

SHA512
73f2930ad2d6628317ca914ddce9a5157ab3c2a71e0d4bfb151657b74da383e55a83892f33081c47cdcc8c163530306af67925d42f9590402041a984260a2db2

Download Submit
C:\Windows\SysWOW64\Jngjch32.exe

Filesize
78KB

MD5
31a73172b5479bd6396f08c164a10aac

SHA1
f81d8b21f51133e166eb3d550c7e2b4d6bc748fb

SHA256
59d76266e8f6afd3198f273b6b356876ea61200f624c68fcca300d6b7f5d7233

SHA512
73f2930ad2d6628317ca914ddce9a5157ab3c2a71e0d4bfb151657b74da383e55a83892f33081c47cdcc8c163530306af67925d42f9590402041a984260a2db2

Download Submit
C:\Windows\SysWOW64\Joffnk32.exe

Filesize
78KB

MD5
cb6afa2c77c10a9325309ae6a00849a8

SHA1
c0912d9116fd89c0d5e45a4d277facba1aacafeb

SHA256
add08fe3fc0f888d32de039d265ac67340c2f09b68ea961fea32fcca3b9e5388

SHA512
6d23b0c5a296dfbc7130ba52053768db6021b52f341ae2d5e63305bb8f163e695266d219269593e61ffa34ba506eb44d66d4cef8188589b8bdb414fd22e4937c

Download Submit
C:\Windows\SysWOW64\Joffnk32.exe

Filesize
78KB

MD5
cb6afa2c77c10a9325309ae6a00849a8

SHA1
c0912d9116fd89c0d5e45a4d277facba1aacafeb

SHA256
add08fe3fc0f888d32de039d265ac67340c2f09b68ea961fea32fcca3b9e5388

SHA512
6d23b0c5a296dfbc7130ba52053768db6021b52f341ae2d5e63305bb8f163e695266d219269593e61ffa34ba506eb44d66d4cef8188589b8bdb414fd22e4937c

Download Submit
C:\Windows\SysWOW64\Jpkphjeb.exe

Filesize
78KB

MD5
58b0f8866504fc158496e0a77415cd64

SHA1
785638840c32beba0401364c3a63114519585aa3

SHA256
e993682d60d278073414f679c234aa49628f2ae0583a6e669265bee84f91cb86

SHA512
c70180cdf1f033e25e8d8cb8c4fe1ca9685e8306ef9e978452e420f9a70ccae7567155b15e93849b5c8aef39c7b27adab387b3e55b66f96dd7c9c18cd4d206f6

Download Submit
C:\Windows\SysWOW64\Jpkphjeb.exe

Filesize
78KB

MD5
58b0f8866504fc158496e0a77415cd64

SHA1
785638840c32beba0401364c3a63114519585aa3

SHA256
e993682d60d278073414f679c234aa49628f2ae0583a6e669265bee84f91cb86

SHA512
c70180cdf1f033e25e8d8cb8c4fe1ca9685e8306ef9e978452e420f9a70ccae7567155b15e93849b5c8aef39c7b27adab387b3e55b66f96dd7c9c18cd4d206f6

Download Submit
C:\Windows\SysWOW64\Kbghfc32.exe

Filesize
78KB

MD5
10e543204f9a57baad6077d677a12d51

SHA1
65f37e194b949656fe3b6c3e01107b492ca2cf96

SHA256
3242cc3fcdebf7e35b19dec30a9ff296ba75c6df34c037fb93029d15abe9963e

SHA512
f499c9e204afd6977c05ef4610db3b2d28dd26a1df2d0ba978f310434adc2a1707a6f12d12479cc67aa0edc9878caf1d9958af57f79ff073f848a86aca567e92

Download Submit
C:\Windows\SysWOW64\Kbghfc32.exe

Filesize
78KB

MD5
10e543204f9a57baad6077d677a12d51

SHA1
65f37e194b949656fe3b6c3e01107b492ca2cf96

SHA256
3242cc3fcdebf7e35b19dec30a9ff296ba75c6df34c037fb93029d15abe9963e

SHA512
f499c9e204afd6977c05ef4610db3b2d28dd26a1df2d0ba978f310434adc2a1707a6f12d12479cc67aa0edc9878caf1d9958af57f79ff073f848a86aca567e92

Download Submit
C:\Windows\SysWOW64\Kbnepe32.exe

Filesize
78KB

MD5
81eac83be983da02dd30ccdb300d8dcd

SHA1
7ec2948988c58121b47469b788cf066e0caa7fe1

SHA256
613d74c4978aa37bf25fe7e2a3d618ccee8364cd7aa8dcb8466f4cf97491ca6d

SHA512
4ff6abc81cfc5d5efdfe893b5bb523267aa5d153281ee525095337ee704e834711eb8b60f7bb94ede484085fa6e791f188f62048269b1b3240f56a1ed0e7a19b

Download Submit
C:\Windows\SysWOW64\Kbnepe32.exe

Filesize
78KB

MD5
81eac83be983da02dd30ccdb300d8dcd

SHA1
7ec2948988c58121b47469b788cf066e0caa7fe1

SHA256
613d74c4978aa37bf25fe7e2a3d618ccee8364cd7aa8dcb8466f4cf97491ca6d

SHA512
4ff6abc81cfc5d5efdfe893b5bb523267aa5d153281ee525095337ee704e834711eb8b60f7bb94ede484085fa6e791f188f62048269b1b3240f56a1ed0e7a19b

Download Submit
C:\Windows\SysWOW64\Kelalp32.exe

Filesize
78KB

MD5
5c455ff2f6c3c1b19956fc42bdeb4e0a

SHA1
9e715ff0e5d43301a899cc2ac99c5e731ca7d4e7

SHA256
9cb0fc5ffaa9676734746f1bf424886f551697598d212b02f3c7d50552eb288c

SHA512
f43e2839b7e76e94f10b3929c54a93e2bbf91140ea2a8958afd64d6bb073acda5c763511da4ee07ef19e03348c4e51c75d6d2085b70993e87da7dc87640f59be

Download Submit
C:\Windows\SysWOW64\Kelalp32.exe

Filesize
78KB

MD5
5c455ff2f6c3c1b19956fc42bdeb4e0a

SHA1
9e715ff0e5d43301a899cc2ac99c5e731ca7d4e7

SHA256
9cb0fc5ffaa9676734746f1bf424886f551697598d212b02f3c7d50552eb288c

SHA512
f43e2839b7e76e94f10b3929c54a93e2bbf91140ea2a8958afd64d6bb073acda5c763511da4ee07ef19e03348c4e51c75d6d2085b70993e87da7dc87640f59be

Download Submit
C:\Windows\SysWOW64\Kflnfcgg.exe

Filesize
78KB

MD5
462e64c0417a0434a7a448d548294aed

SHA1
082c1da9609a2bca94a04a41dc6ad1eabf01dc79

SHA256
f41503623aaaa750b52b16a1cad4bc5c58e4f239e3fe965a21489ec5199ef7cf

SHA512
a9222bec65b78b798ea5f5a044c3820a6139707800641b00087870864a810733354a013c3e025cf3ac0b8e1e286130d9f05b2dcf0e9c917b9fc3889cf4231713

Download Submit
C:\Windows\SysWOW64\Kflnfcgg.exe

Filesize
78KB

MD5
462e64c0417a0434a7a448d548294aed

SHA1
082c1da9609a2bca94a04a41dc6ad1eabf01dc79

SHA256
f41503623aaaa750b52b16a1cad4bc5c58e4f239e3fe965a21489ec5199ef7cf

SHA512
a9222bec65b78b798ea5f5a044c3820a6139707800641b00087870864a810733354a013c3e025cf3ac0b8e1e286130d9f05b2dcf0e9c917b9fc3889cf4231713

Download Submit
C:\Windows\SysWOW64\Kiaqcnpb.exe

Filesize
78KB

MD5
1c75ebf5cb40e4292171ec8d1992055f

SHA1
d2e3433cbfa8d070416ef119c54fb3884406abef

SHA256
5dc28edbeadefde50227216163d1d00f7e42089f424d0cc4d38920dee2c7496c

SHA512
d44f80abc85ea9d459774bf39477ab75e983bd26007b5031e690de9639067b5d597291538611c43414bf87ff5b536c5d673f072d19c27c14ceeeefe33626560c

Download Submit
C:\Windows\SysWOW64\Kiaqcnpb.exe

Filesize
78KB

MD5
1c75ebf5cb40e4292171ec8d1992055f

SHA1
d2e3433cbfa8d070416ef119c54fb3884406abef

SHA256
5dc28edbeadefde50227216163d1d00f7e42089f424d0cc4d38920dee2c7496c

SHA512
d44f80abc85ea9d459774bf39477ab75e983bd26007b5031e690de9639067b5d597291538611c43414bf87ff5b536c5d673f072d19c27c14ceeeefe33626560c

Download Submit
C:\Windows\SysWOW64\Kimghn32.exe

Filesize
78KB

MD5
61e27f26a212a8841bb3076979a69744

SHA1
0247fd6e244b0e55a02683c55580120a6f334edf

SHA256
fe3c0ee9a85cfb9680fc8625471b4e343dc2b181e1a00be972074267ee0ab9dc

SHA512
f3199534fb09ad679aceb530d2597b8a0ebdb1cfc88670a6f0f5b564121110b4dd8e76eaf7d3376d03f3ed5ea1a148582ce5a153055cb6842305649d6d23e07d

Download Submit
C:\Windows\SysWOW64\Kimghn32.exe

Filesize
78KB

MD5
61e27f26a212a8841bb3076979a69744

SHA1
0247fd6e244b0e55a02683c55580120a6f334edf

SHA256
fe3c0ee9a85cfb9680fc8625471b4e343dc2b181e1a00be972074267ee0ab9dc

SHA512
f3199534fb09ad679aceb530d2597b8a0ebdb1cfc88670a6f0f5b564121110b4dd8e76eaf7d3376d03f3ed5ea1a148582ce5a153055cb6842305649d6d23e07d

Download Submit
C:\Windows\SysWOW64\Klmpiiai.exe

Filesize
78KB

MD5
a8a38b6bc59348c8ecb3ab112b2b670a

SHA1
0dc3d7ce824760baaf91f9858666b395dc99c8e8

SHA256
ff504a246134b10f4f667b0357f5daed413791cf848100ae9526cd57f8038689

SHA512
0b17af30ea50c7beedfa92aef7b8a39985d0b3dc6a2fcf725d51099f4ba149db8756568fe6f7aa8e895a355666bec1a62b8b4589324e6f9db9f1998028745ca3

Download Submit
C:\Windows\SysWOW64\Klmpiiai.exe

Filesize
78KB

MD5
a8a38b6bc59348c8ecb3ab112b2b670a

SHA1
0dc3d7ce824760baaf91f9858666b395dc99c8e8

SHA256
ff504a246134b10f4f667b0357f5daed413791cf848100ae9526cd57f8038689

SHA512
0b17af30ea50c7beedfa92aef7b8a39985d0b3dc6a2fcf725d51099f4ba149db8756568fe6f7aa8e895a355666bec1a62b8b4589324e6f9db9f1998028745ca3

Download Submit
C:\Windows\SysWOW64\Kpdboimg.exe

Filesize
78KB

MD5
5bae692a40d6741e8cb721820086a741

SHA1
80fb03ef635da281658659f5b6ca92e14f750b16

SHA256
b64c6439fafc59c9ec9a8186f689ee40e0fe10267bd05d212e106445312fcdd4

SHA512
f068b9e272e131af4161d58d99df7381c3046399db40cf5b42a5601fa2250fa1f6b17bfda0c62445c6673d66d282dbdc5d3a51d48ff04988a4aa3efbd3398652

Download Submit
C:\Windows\SysWOW64\Kpdboimg.exe

Filesize
78KB

MD5
5bae692a40d6741e8cb721820086a741

SHA1
80fb03ef635da281658659f5b6ca92e14f750b16

SHA256
b64c6439fafc59c9ec9a8186f689ee40e0fe10267bd05d212e106445312fcdd4

SHA512
f068b9e272e131af4161d58d99df7381c3046399db40cf5b42a5601fa2250fa1f6b17bfda0c62445c6673d66d282dbdc5d3a51d48ff04988a4aa3efbd3398652

Download Submit
C:\Windows\SysWOW64\Kpgodhkd.exe

Filesize
78KB

MD5
5e42dd07c7beff803df6806a6f821d48

SHA1
578c7cd7a432da7b96847bed8311582b6a3daa89

SHA256
e98d4a13c534e54eb8c3e6a0e8ca6a391e9043dffc626d5a6365b9972e621e09

SHA512
6cfe720b64cfa40984c9db5c230cf92695e63b06cfc6a2efc7e0c3c00a85f2076e212ed412078fbc73a84fc89643c95ea16cb4ff2c0996153eaeaeb51830b67e

Download Submit
C:\Windows\SysWOW64\Kpgodhkd.exe

Filesize
78KB

MD5
5e42dd07c7beff803df6806a6f821d48

SHA1
578c7cd7a432da7b96847bed8311582b6a3daa89

SHA256
e98d4a13c534e54eb8c3e6a0e8ca6a391e9043dffc626d5a6365b9972e621e09

SHA512
6cfe720b64cfa40984c9db5c230cf92695e63b06cfc6a2efc7e0c3c00a85f2076e212ed412078fbc73a84fc89643c95ea16cb4ff2c0996153eaeaeb51830b67e

Download Submit
C:\Windows\SysWOW64\Lbchba32.exe

Filesize
78KB

MD5
8e6d457f6f65c659d8957623a14c17fa

SHA1
a77e70bd923e687f1b84033ae4c87fd19c0231f3

SHA256
6d7648d28b2ba183c132f36c30d44a4fa825f1b8559607aa2fa8ee938e94290b

SHA512
593fa909b0240a4eace88ed4a4e7ffd8872d7a8cc63910ba1cba139377429f8276e16b010834a963663c8d3ef80ab27f972259cd43347a4507036ce7094bd78a

Download Submit
C:\Windows\SysWOW64\Lbchba32.exe

Filesize
78KB

MD5
8e6d457f6f65c659d8957623a14c17fa

SHA1
a77e70bd923e687f1b84033ae4c87fd19c0231f3

SHA256
6d7648d28b2ba183c132f36c30d44a4fa825f1b8559607aa2fa8ee938e94290b

SHA512
593fa909b0240a4eace88ed4a4e7ffd8872d7a8cc63910ba1cba139377429f8276e16b010834a963663c8d3ef80ab27f972259cd43347a4507036ce7094bd78a

Download Submit
C:\Windows\SysWOW64\Lbjelc32.exe

Filesize
78KB

MD5
98d6f04668188d0c9e17bfb63adc9d20

SHA1
5fa6ada19a1f7a9a6d5ccb51d733f60301288453

SHA256
9e5230e65c11dec1f5a58d8659eae884b25bb2cfc12125c866f766db6132da70

SHA512
8610b44311c95e591c1071a1de936cc8aaa83f8a94b438942683624f1ffa2dd8cc2cc2105dd705df35f7bac80c33ffa290521a16e58426145109b769f57f79e4

Download Submit
C:\Windows\SysWOW64\Lbjelc32.exe

Filesize
78KB

MD5
98d6f04668188d0c9e17bfb63adc9d20

SHA1
5fa6ada19a1f7a9a6d5ccb51d733f60301288453

SHA256
9e5230e65c11dec1f5a58d8659eae884b25bb2cfc12125c866f766db6132da70

SHA512
8610b44311c95e591c1071a1de936cc8aaa83f8a94b438942683624f1ffa2dd8cc2cc2105dd705df35f7bac80c33ffa290521a16e58426145109b769f57f79e4

Download Submit
C:\Windows\SysWOW64\Lejnmncd.exe

Filesize
78KB

MD5
2d20ebfd7635b69378fbe4ae7ef1ed53

SHA1
01e83400a422359d8cede0573e81a7fc4970ea06

SHA256
d5b7d4d25c911e7e44d7e6255e21cfdfd5892ce7fecdea61aef945f1a5dddb91

SHA512
71f426155ed66bc3f2615e4a69dc72d74e99cd54fc0f975473bcfc62062f4d2447184bb477c992089dcc6ce2c5ac74be80e1de03e0108dbd4b00db40288b50d8

Download Submit
C:\Windows\SysWOW64\Lejnmncd.exe

Filesize
78KB

MD5
2d20ebfd7635b69378fbe4ae7ef1ed53

SHA1
01e83400a422359d8cede0573e81a7fc4970ea06

SHA256
d5b7d4d25c911e7e44d7e6255e21cfdfd5892ce7fecdea61aef945f1a5dddb91

SHA512
71f426155ed66bc3f2615e4a69dc72d74e99cd54fc0f975473bcfc62062f4d2447184bb477c992089dcc6ce2c5ac74be80e1de03e0108dbd4b00db40288b50d8

Download Submit
C:\Windows\SysWOW64\Leoghn32.exe

Filesize
78KB

MD5
274932497510f5c4d86ed1a428a76db7

SHA1
6e35e7e093bfad3cc666d84765555f6b7789aa2c

SHA256
d3ff92aee96f469217559a73f29bb5c88089c4e68edfa582525459a7d591bf96

SHA512
9984c15c11ea5061fa1d1c170571f0b9341dbae696e516383aaa4be0519d2b05f2c46df68c3d1ccbb51c0d96a25b7c43e259c5efc6ddb8091de3df9438dfa3a2

Download Submit
C:\Windows\SysWOW64\Leoghn32.exe

Filesize
78KB

MD5
274932497510f5c4d86ed1a428a76db7

SHA1
6e35e7e093bfad3cc666d84765555f6b7789aa2c

SHA256
d3ff92aee96f469217559a73f29bb5c88089c4e68edfa582525459a7d591bf96

SHA512
9984c15c11ea5061fa1d1c170571f0b9341dbae696e516383aaa4be0519d2b05f2c46df68c3d1ccbb51c0d96a25b7c43e259c5efc6ddb8091de3df9438dfa3a2

Download Submit
C:\Windows\SysWOW64\Lihfcm32.exe

Filesize
78KB

MD5
4d145fbab12f596f7b84fe979a991a82

SHA1
5e29518b2c74fb4447561f1352f81bdfa9523062

SHA256
2fd9db37df2dae78321d9a257a3ec72bd8fa60b894ade597e04fbba75dc041e5

SHA512
24c627e5dfab55049ac8af62490759a5ca1debe76020e573717b70daf179a95097c5ba24c31acf063dbc94c6627a71a5b5e673a061885889cfb81507dc19dd4f

Download Submit
C:\Windows\SysWOW64\Lkeekk32.exe

Filesize
78KB

MD5
5d93f7fe80373dd703a8dd8ea6aff5c5

SHA1
6f5d8dc0080ccb38eeeb6e2f81c0cff1d87db172

SHA256
26be42c382c596a1a12c893bc9fce5f0e4b5d44dedfc80211dd0d5ae88cb5f09

SHA512
11c28035e739ab2bbf5742951bb9def7eae89b7e43c00a33f24957e5a387df5474433b32bd63f8e00ca9ca234ba07d136976b66636452f82ae5b2ed12f5248c3

Download Submit
C:\Windows\SysWOW64\Lnqeqd32.exe

Filesize
78KB

MD5
3849ab29a05e249df30b5c3547ae79c7

SHA1
368a324ca37bc10271dc4151a2e5992767803d2e

SHA256
756a1e046afd3c11af823015c32da6820877310d48232c910eee607d7f8a1ffc

SHA512
f36b78bd9d06dc503becb6fa055ae7bc23e55e7f09c8115a95a9b02189b0ba33f0616b1cc4f8cbf023f410f4ba7bbff3b22048791db3087a16f5eb20c349031d

Download Submit
C:\Windows\SysWOW64\Lnqeqd32.exe

Filesize
78KB

MD5
3849ab29a05e249df30b5c3547ae79c7

SHA1
368a324ca37bc10271dc4151a2e5992767803d2e

SHA256
756a1e046afd3c11af823015c32da6820877310d48232c910eee607d7f8a1ffc

SHA512
f36b78bd9d06dc503becb6fa055ae7bc23e55e7f09c8115a95a9b02189b0ba33f0616b1cc4f8cbf023f410f4ba7bbff3b22048791db3087a16f5eb20c349031d

Download Submit
C:\Windows\SysWOW64\Locbfd32.exe

Filesize
78KB

MD5
d6e7b2285f878d1448d81dfb400e49ea

SHA1
8b04b4bd540ff835d66d3c280c851aed59a80e72

SHA256
01a4b72536f88072e2317b2bb92207a63cc757a0f63f82d759673004d0e22446

SHA512
441ae79542e8e0376b846720f1f4b5595b93aa53f25c16e98820752563eb5f3b9318f367ebc3c13caa68ecc788c0d86c32dbbf7fcc775c78bc3092a7e6957ea5

Download Submit
C:\Windows\SysWOW64\Locbfd32.exe

Filesize
78KB

MD5
d6e7b2285f878d1448d81dfb400e49ea

SHA1
8b04b4bd540ff835d66d3c280c851aed59a80e72

SHA256
01a4b72536f88072e2317b2bb92207a63cc757a0f63f82d759673004d0e22446

SHA512
441ae79542e8e0376b846720f1f4b5595b93aa53f25c16e98820752563eb5f3b9318f367ebc3c13caa68ecc788c0d86c32dbbf7fcc775c78bc3092a7e6957ea5

Download Submit
C:\Windows\SysWOW64\Lpfgmnfp.exe

Filesize
78KB

MD5
bc8a3e61deb2b4a1db02d374a8cb50e5

SHA1
1e07358d6e96ee441cec563a1878573492cb5873

SHA256
3257e82e7ea8eee6e0cd48fd84dbd45ded75f1b4920ba2dd37a36bf58e97a992

SHA512
53d20decfd8875c4e3f8269a96460c4430a5bf6bf1ef20316312680061f5c072888740695653f364a8f897a57d25b8a5ea40e69ac276d33924a62628cd9f20f0

Download Submit
C:\Windows\SysWOW64\Mbhamajc.exe

Filesize
78KB

MD5
3334b642dd92f3199010000392ff9b5d

SHA1
cc7a9558fc44032b30ad5dc884fe2c3d84525c79

SHA256
c00dd214f8854978a34bb29797557836f014fea890411aa6e689923f56371181

SHA512
5f2f5b4c0e66713e04da1747d03ae1fbac892f5ec6e6ee07f10b218d4b60d72f8553512c7930a17b4d7b7a4ed6a0937d4ecc9b129aef9f732ff43bbcc9ff1f36

Download Submit
C:\Windows\SysWOW64\Mdaqhf32.exe

Filesize
78KB

MD5
c9179982d31ab6819bb25d8453b33f2b

SHA1
72a83f3ea8b4e73e182f40d85b7e8e967c088fc3

SHA256
bc447a7a67d61091091ce9db2a41df33c28b94785f4e4a300124c8b600588668

SHA512
c826f9fdcb32311430cbf5a4e796cae74fec44dafe48cfc33e2c3e6a748cf054bb0aef52011ddee293aa017771414856291220842ff1aeaad3e7f8b231be4e56

Download Submit
C:\Windows\SysWOW64\Mekdffee.exe

Filesize
78KB

MD5
659ba549b813c0d6cfe8205454c7cafe

SHA1
01565a7e4dfcce50037a21d786e941c336a843ea

SHA256
e0e29eb1da8e2e262b41592523f3713bd9a4e20149ace8f0d5034efa097c75a9

SHA512
5b21c1d0aca975cdf765a09bc80854eb0600bfbf2f35f9e90943e87a5cd328c6245b95312d9195f1041701117b56b34b0b34c6295908601b6d9c614e1f487e25

Download Submit
C:\Windows\SysWOW64\Mgaokl32.exe

Filesize
78KB

MD5
5b3afdf3591f836c3cd4d6124c032cda

SHA1
aae9d775787007742e6d4afc17b2aaedd0d054de

SHA256
32541fe82778c9da9d7f09df90213eb5f1188cf69517c33b74e341aed6d7bb47

SHA512
e92585386c869e30330eed7ee9e3413515ee3bdb38f2359ba2db5ea74024d5fc236397d1051beb39c6f701a75859e42f55300dd8da7a51c18ad2c4b0c6957499

Download Submit
C:\Windows\SysWOW64\Mimpolee.exe

Filesize
78KB

MD5
0d698939edef07558d151039d011f4fa

SHA1
4a09d4c088e1f06f063915d22a5d094e7af56cf4

SHA256
26142e73056fb446a77534197a26660febb871e0ca8030db22bb1bcea4b1d2a1

SHA512
c9c5fd29ff53c43f824536b984e40575eb8f641a12f7958307e9ffa9d7ecf391f32abb67f1379742cb6e30320733daa279a8edc13e530cdb031ca7c169994a39

Download Submit
C:\Windows\SysWOW64\Mimpolee.exe

Filesize
78KB

MD5
0d698939edef07558d151039d011f4fa

SHA1
4a09d4c088e1f06f063915d22a5d094e7af56cf4

SHA256
26142e73056fb446a77534197a26660febb871e0ca8030db22bb1bcea4b1d2a1

SHA512
c9c5fd29ff53c43f824536b984e40575eb8f641a12f7958307e9ffa9d7ecf391f32abb67f1379742cb6e30320733daa279a8edc13e530cdb031ca7c169994a39

Download Submit
C:\Windows\SysWOW64\Mlnipg32.exe

Filesize
78KB

MD5
d166079ca8f48ad5aa312d54c3a12407

SHA1
67736d84d7d5ec04f80fae03a2f46d57f9cdbc6f

SHA256
9246b47111c797ed4cdb8ca4d024cbe611396bef7bb913a5d8d9f8ad202301a0

SHA512
55a14589eb421c882a10774121a6ebce75c190127497d49ed69a10e0db60710ebbb5627824c536fb753cbca12596615ae0941c3677f393cf439488d69a8e0a4f

Download Submit
C:\Windows\SysWOW64\Mlnipg32.exe

Filesize
78KB

MD5
d166079ca8f48ad5aa312d54c3a12407

SHA1
67736d84d7d5ec04f80fae03a2f46d57f9cdbc6f

SHA256
9246b47111c797ed4cdb8ca4d024cbe611396bef7bb913a5d8d9f8ad202301a0

SHA512
55a14589eb421c882a10774121a6ebce75c190127497d49ed69a10e0db60710ebbb5627824c536fb753cbca12596615ae0941c3677f393cf439488d69a8e0a4f

Download Submit
C:\Windows\SysWOW64\Mojhgbdl.exe

Filesize
78KB

MD5
73148c32eb595549d483a735ab07ca2f

SHA1
1affa339c7bab047a57be95cad3df280df7d72ba

SHA256
ded75b87cc91ebb461f824f4e3700c729a3cb1e5c3671e41447e06153eeae6ce

SHA512
2eef3f9d6b4cb8d0d27bc1fc6ea5987f6ec3483c649d82641bafa64e430e5b5f21d5f4e6896ddda545e69211c113d87667706aff58979069e17ea7018fe92aa8

Download Submit
C:\Windows\SysWOW64\Mojhgbdl.exe

Filesize
78KB

MD5
73148c32eb595549d483a735ab07ca2f

SHA1
1affa339c7bab047a57be95cad3df280df7d72ba

SHA256
ded75b87cc91ebb461f824f4e3700c729a3cb1e5c3671e41447e06153eeae6ce

SHA512
2eef3f9d6b4cb8d0d27bc1fc6ea5987f6ec3483c649d82641bafa64e430e5b5f21d5f4e6896ddda545e69211c113d87667706aff58979069e17ea7018fe92aa8

Download Submit
C:\Windows\SysWOW64\Mpnngh32.exe

Filesize
78KB

MD5
325259b3c474dc262a8c4ba320698bfd

SHA1
e8ca13f0e96b616c44e35aeaa7f8bae38af44d86

SHA256
aac3e2122c1ad78bab917cc3a641cc20b9768f530a264afc9850b77c7e7f8bc8

SHA512
e25408e7a96b66ded890ef36913c0eecbabd0099f289230bb894217f268d10da3860c7d8cb5af34996ec399de9b9119749f9181c3f47836e2b96e7905618ea23

Download Submit
C:\Windows\SysWOW64\Nkboeobh.exe

Filesize
78KB

MD5
fb66d5cc4c4909cfa908df4fecbedc82

SHA1
412b4e29e3ac0ceb5326869826578a29fd793f9e

SHA256
7a3f8b3fd1c5ad7ccde49dc9f7319c22eb41bb699b8b6b59478f4499d82d975c

SHA512
ddc3867de0007a1972517cb42f57815f16b5739823e79ec1f1507af77f947de1e60dc292e33235a47ea0b60669b559ac8d2b043bd6730f874e55cf3ffd7fc3cd

Download Submit
C:\Windows\SysWOW64\Okmpqjad.exe

Filesize
78KB

MD5
4d17c9b4a2a765cb9fd143cc561574f2

SHA1
a33c0f1d634d6d2c141de5b39a0c2ffa711b7e2b

SHA256
223d659491e361b12bc1e346aba86678d13c40d6404a697ef48c4aa3b5a5d0d9

SHA512
55594f82f1ac0399271a4d38cb333d046182bc26f0762af51f8fd2c3161d5010f1f01461301039dbce68f6ff1d824e5067f6985c12e338ad0ca10d25d96d3413

Download Submit
C:\Windows\SysWOW64\Onnmdcjm.exe

Filesize
78KB

MD5
00f897784a3df9cf3234170c45781d06

SHA1
27ddcfb46a9f838bc507a847c54f0c24095e399b

SHA256
d19879596a0075f8e0cb7708a79a09f7a68fc009974379a730e5e5be295ef599

SHA512
1f2c54b82d24ca54fe082332492507920d07c87be06a53fc7bf23558a008574e3293c38a7a6624d113be9aec6063303b41f96121257ad3ecc29e67b9e5bb401b

Download Submit
C:\Windows\SysWOW64\Pdkoch32.exe

Filesize
78KB

MD5
d53febf3bb1ee21b468ee0ede3f267c3

SHA1
97eddbb06ebc7f566f765b791b50b8376cda12b8

SHA256
9ad0c7fceb63ddfd29a7cea3eced9642d047135639a4677b8a10bf8776cecdc9

SHA512
51c93b1351848a0b11c7d3b318406c9a16c75504a4a4df8daf2ebd1a7fd8f3a3b98f438ca131cf5f31a8508f484b2ae02dfd3043ab2178849a66d2d4f751fbf2

Download Submit
C:\Windows\SysWOW64\Pmcclm32.exe

Filesize
64KB

MD5
85c6947d65163a35b1df9cc693e5bbc1

SHA1
e1ebb820e33da6a9603ba9dddd92fcc7fd245265

SHA256
abefd78d071c7223ba02ff771327838215e1ab1eb6eac191677cbf9e238447a8

SHA512
90bee48ccf81e1398f91d1350c655f0cdc0aaf5426fca3ff7bc306bf7dd9c2a71d8ab42362c2bc57593479bde40fc36fe389d5f27263c4bf6ffd6f44b78000ee

Download Submit
memory/620-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/620-72-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/620-1-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/624-210-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/728-296-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/728-224-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/948-21-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/948-99-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/960-194-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/976-213-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/976-127-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1068-311-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1424-189-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1424-103-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1692-294-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1944-289-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/1944-219-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2012-143-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2012-56-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2932-171-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/2932-81-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3064-8-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3064-89-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3280-259-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3324-297-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3356-232-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3356-154-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3372-49-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3372-135-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3432-123-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3496-241-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3496-317-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3516-283-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3560-304-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3588-266-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3628-185-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3628-257-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3648-91-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3648-179-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3684-161-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3684-74-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3712-139-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3712-222-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3776-149-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4104-152-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4104-64-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4180-310-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4180-234-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4184-40-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4184-125-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4312-233-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4312-163-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4580-122-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4580-32-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4612-249-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4872-280-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5012-176-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5060-303-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5060-231-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5068-116-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5084-108-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5084-24-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5096-198-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/5096-275-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads