ca94ff779cc84bbb1df3933f087778e23af0519a119bc268a1aee78a203adf8d

Analysis

max time kernel
137s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f66cd965006e38ef70dd9fb3c7b91f49_JC.exe
Size

325KB
MD5

f66cd965006e38ef70dd9fb3c7b91f49
SHA1

e0036e9ad3187886ab8c7e3b7479275cfb8c2297
SHA256

ca94ff779cc84bbb1df3933f087778e23af0519a119bc268a1aee78a203adf8d
SHA512

75d29d50b59ba121ee130c2853e9b69d0257896696a52683a06f52fc4ade892584c014235e0b01c64cb569f70e9c54df4c2c7a285d2829bbf3346cfee32e150e
SSDEEP

6144:POLzcS0Rs+Hsohxd2Quohdbd0zscwIGUKfvUJ43ewmxteZekR+1b/KVC0CLzg:6cXHxdzZdxGwsYIL0

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qciebg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eepbabjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkmapc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Echbad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Onceji32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Foebmn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Elfhmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eacaej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cqfahh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hlipfh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jognokdi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npcokpln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Odocbmfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlobmd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejglcq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nmhglopl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Neebkkgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chbenm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ppdjpcng.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Djpfbahm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbbldp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ongijo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gojgkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgbfka32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kojdkhdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlqpaafg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnabladg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Adpogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnfoac32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Elkbhbeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Okcccdkp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnhncjom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oeekbhif.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Piepnfnj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iapjeq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mgggaamn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ggicbe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gdeqaa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfemkdbm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kekljlkp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbglgg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chkjpm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kklkej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dekobaki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Chpangnk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bnfoac32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Idjdqc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lkbkkbdj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iejcco32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pgbijg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibagmiie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aioebj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjdqhjpf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nalgbi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hedhoc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gcbnopkj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fempbm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fakfglhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Djihhoao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iapjeq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lbnggpfj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmkbeg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eenflbll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gfmhjb32.exe

Executes dropped EXE 64 IoCs

pid	Process
4456	Pkabbgol.exe
4616	Abpcja32.exe
1540	Acppddig.exe
3272	Aimhmkgn.exe
1988	Aioebj32.exe
760	Alpnde32.exe
2628	Amoknh32.exe
1532	Ddekmo32.exe
1440	Dlqpaafg.exe
3248	Fgkfqgce.exe
1616	Gnjhhpgl.exe
2528	Gjqinamq.exe
548	Gfgjbb32.exe
1652	Gqokekph.exe
1640	Ggicbe32.exe
4692	Hqddqj32.exe
5028	Hcembe32.exe
4772	Hqimlihn.exe
4776	Hdffah32.exe
2212	Hqmggi32.exe
900	Icqmncof.exe
3224	Ijmapm32.exe
3740	Inkjfk32.exe
4664	Jnmglk32.exe
3436	Jgekdq32.exe
2000	Jjfdfl32.exe
1144	Jjhalkjc.exe
232	Jjknakhq.exe
4484	Jepbodhg.exe
1380	Kagbdenk.exe
4960	Kdhlepkl.exe
3972	Kallod32.exe
2480	Kjdqhjpf.exe
2448	Kanidd32.exe
4688	Kmeiie32.exe
4180	Lndfchdj.exe
3176	Lmjcdd32.exe
4652	Loiong32.exe
2816	Lokldg32.exe
1572	Lkbmih32.exe
3060	Mdkabmjf.exe
4736	Mopeofjl.exe
1512	Mhkgnkoj.exe
1624	Moeoje32.exe
5000	Nnabladg.exe
4872	Nkebee32.exe
2888	Nnfkgp32.exe
4504	Ndpcdjho.exe
1072	Oakjnnap.exe
1948	Oookgbpj.exe
404	Odkcpi32.exe
464	Pdnpeh32.exe
1176	Pnfdnnbo.exe
2148	Pnhacn32.exe
4448	Pgaelcgm.exe
1116	Pdeffgff.exe
3516	Pnmjomlg.exe
1568	Qomghp32.exe
2936	Qhekaejj.exe
2176	Qbmpjkqk.exe
1256	Qhghge32.exe
2220	Aijeme32.exe
4228	Adqeaf32.exe
1736	Aofjoo32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Npbhdogo.dll	Eclmlpfl.exe
File created	C:\Windows\SysWOW64\Jehffpod.dll	Olkqnjhd.exe
File created	C:\Windows\SysWOW64\Qimfoe32.exe	Pbbnbkpe.exe
File opened for modification	C:\Windows\SysWOW64\Mdkabmjf.exe	Lkbmih32.exe
File created	C:\Windows\SysWOW64\Jloibkhh.exe	Ihjjln32.exe
File created	C:\Windows\SysWOW64\Lfbpae32.dll	Anccjp32.exe
File opened for modification	C:\Windows\SysWOW64\Caeiam32.exe	Chmehhpn.exe
File opened for modification	C:\Windows\SysWOW64\Cajblmci.exe	Clmjcfdb.exe
File created	C:\Windows\SysWOW64\Fbihdhhf.exe	Fkopgn32.exe
File opened for modification	C:\Windows\SysWOW64\Cbnbhfde.exe	Cejaobel.exe
File opened for modification	C:\Windows\SysWOW64\Agkgceeh.exe	Anccjp32.exe
File created	C:\Windows\SysWOW64\Ccigpbga.exe	Cnmoglij.exe
File created	C:\Windows\SysWOW64\Dqajjp32.exe	Copajm32.exe
File opened for modification	C:\Windows\SysWOW64\Gfgjbb32.exe	Gjqinamq.exe
File created	C:\Windows\SysWOW64\Kpfkkl32.dll	Onlipd32.exe
File created	C:\Windows\SysWOW64\Cibagpgg.exe	Chbenm32.exe
File created	C:\Windows\SysWOW64\Gkmlilej.exe	Ghlcga32.exe
File created	C:\Windows\SysWOW64\Kdbbihid.dll	Gqokekph.exe
File opened for modification	C:\Windows\SysWOW64\Eleikb32.exe	Eaoenjqa.exe
File created	C:\Windows\SysWOW64\Eilgkh32.dll	Mmgfmg32.exe
File created	C:\Windows\SysWOW64\Ekajjh32.dll	Iiffoc32.exe
File opened for modification	C:\Windows\SysWOW64\Gaglma32.exe	Gjkgkg32.exe
File created	C:\Windows\SysWOW64\Nifele32.exe	Npnqcpmc.exe
File created	C:\Windows\SysWOW64\Doepod32.dll	Hoiihcde.exe
File created	C:\Windows\SysWOW64\Kmjaif32.dll	Dofpqfof.exe
File opened for modification	C:\Windows\SysWOW64\Njokei32.exe	Nipokfil.exe
File opened for modification	C:\Windows\SysWOW64\Aebjokda.exe	Aljefena.exe
File created	C:\Windows\SysWOW64\Dhlhei32.dll	Bcfkiock.exe
File created	C:\Windows\SysWOW64\Dmbbmbea.dll	Eciilj32.exe
File created	C:\Windows\SysWOW64\Dbjjok32.dll	Aenpeoom.exe
File created	C:\Windows\SysWOW64\Imabnofj.exe	Hlmiagbo.exe
File created	C:\Windows\SysWOW64\Bbbpnc32.exe	Aenpeoom.exe
File opened for modification	C:\Windows\SysWOW64\Cnmebblf.exe	Cbfema32.exe
File opened for modification	C:\Windows\SysWOW64\Adpogp32.exe	Ajjjjghg.exe
File opened for modification	C:\Windows\SysWOW64\Qpkppbho.exe	Pjlnhi32.exe
File created	C:\Windows\SysWOW64\Lbhojo32.exe	Kedoqkbe.exe
File created	C:\Windows\SysWOW64\Cfbcfh32.exe	Cjlbag32.exe
File created	C:\Windows\SysWOW64\Bdgfpe32.dll	Gojgkl32.exe
File opened for modification	C:\Windows\SysWOW64\Bqahmhpi.exe	Bcngddao.exe
File created	C:\Windows\SysWOW64\Hfmqapcl.exe	Haphiiee.exe
File opened for modification	C:\Windows\SysWOW64\Lpmfnj32.exe	Libnapmg.exe
File opened for modification	C:\Windows\SysWOW64\Eedkniob.exe	Eojcao32.exe
File opened for modification	C:\Windows\SysWOW64\Gedohfmp.exe	Gojgkl32.exe
File created	C:\Windows\SysWOW64\Naamaled.dll	Oqpeaeel.exe
File created	C:\Windows\SysWOW64\Kdiobd32.exe	Jmpgfjmd.exe
File opened for modification	C:\Windows\SysWOW64\Pekkhn32.exe	Ppnbpg32.exe
File opened for modification	C:\Windows\SysWOW64\Hoiihcde.exe	Hhpaki32.exe
File created	C:\Windows\SysWOW64\Hoepmd32.exe	Hhkgpjqn.exe
File created	C:\Windows\SysWOW64\Pnhacn32.exe	Pnfdnnbo.exe
File created	C:\Windows\SysWOW64\Gfcgpkhk.exe	Gcbnopkj.exe
File created	C:\Windows\SysWOW64\Kngcfgbg.dll	Ajikhfpg.exe
File opened for modification	C:\Windows\SysWOW64\Eepbabjj.exe	Eenflbll.exe
File opened for modification	C:\Windows\SysWOW64\Hjmfmnhp.exe	Hnfehm32.exe
File created	C:\Windows\SysWOW64\Fbhnec32.exe	Epiaig32.exe
File created	C:\Windows\SysWOW64\Himgjbii.exe	Hccomh32.exe
File opened for modification	C:\Windows\SysWOW64\Lmkbeg32.exe	Lbnggpfj.exe
File created	C:\Windows\SysWOW64\Cmdfcmid.dll	Lbgjmnno.exe
File created	C:\Windows\SysWOW64\Pcihbdla.dll	Mdfopf32.exe
File opened for modification	C:\Windows\SysWOW64\Dbckcf32.exe	Dhmgfm32.exe
File created	C:\Windows\SysWOW64\Ffmkieab.dll	Eefhcimp.exe
File created	C:\Windows\SysWOW64\Hkheeg32.dll	Qpkppbho.exe
File created	C:\Windows\SysWOW64\Hedhoc32.exe	Hkodak32.exe
File created	C:\Windows\SysWOW64\Jbfphh32.exe	Jaddpppa.exe
File created	C:\Windows\SysWOW64\Ichkdj32.dll	Laqlclga.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4320	9316	WerFault.exe	748

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjqcippa.dll"	Lfpcngdo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bdkbgj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Elkbhbeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mkqloeip.dll"	Mdibplaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iffmmihf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpeefhck.dll"	Jgekdq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fbhnec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kpipcb32.dll"	Cjlbag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eckfaj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lmqggncn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Efljmi32.dll"	Okjbimal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jognokdi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oiojmgcb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jaljaoii.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Eaoenjqa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jjfdfl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iiepoemj.dll"	Ihkpgg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bajqpe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmkbeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aefcif32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Emlgedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iemdkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aoaebjii.dll"	Hadkib32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmdkmnkd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcdpakhk.dll"	Bkfmjnii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjlnhi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eelpqi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Foqacehl.dll"	Ggldde32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mopeofjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fcepbooa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmbbmbea.dll"	Eciilj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pikkqb32.dll"	Inkjfk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lkcaeige.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jpkfmfok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nmhglopl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Npqplk32.dll"	Olpjii32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Beapkcaf.dll"	Dcjfpfnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baeenn32.dll"	Kmjinjnj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mgbnfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kdbbihid.dll"	Gqokekph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kpilekqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bqpbboeg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Odpkpbgq.dll"	Mojmbf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hjhfgi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qhekaejj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bhmhiaka.dll"	Nifele32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eenflbll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ebplen32.dll"	Aefcif32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bcngddao.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pafkbh32.dll"	Kimnlj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hjlaoioh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opkflmkn.dll"	Gjkgkg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmjaif32.dll"	Dofpqfof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lifmdfkg.dll"	Enpknplq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ndbnkefp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kanidd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dhgoimlo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djihhoao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pmiijjcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gcciib32.dll"	Clmjcfdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ijjombcn.dll"	Ojcidelf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jjknakhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Phioej32.dll"	Mbamcm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggliem32.dll"	Hlmiagbo.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3228 wrote to memory of 4456	3228	f66cd965006e38ef70dd9fb3c7b91f49_JC.exe	86
PID 3228 wrote to memory of 4456	3228	f66cd965006e38ef70dd9fb3c7b91f49_JC.exe	86
PID 3228 wrote to memory of 4456	3228	f66cd965006e38ef70dd9fb3c7b91f49_JC.exe	86
PID 4456 wrote to memory of 4616	4456	Pkabbgol.exe	87
PID 4456 wrote to memory of 4616	4456	Pkabbgol.exe	87
PID 4456 wrote to memory of 4616	4456	Pkabbgol.exe	87
PID 4616 wrote to memory of 1540	4616	Abpcja32.exe	88
PID 4616 wrote to memory of 1540	4616	Abpcja32.exe	88
PID 4616 wrote to memory of 1540	4616	Abpcja32.exe	88
PID 1540 wrote to memory of 3272	1540	Acppddig.exe	89
PID 1540 wrote to memory of 3272	1540	Acppddig.exe	89
PID 1540 wrote to memory of 3272	1540	Acppddig.exe	89
PID 3272 wrote to memory of 1988	3272	Aimhmkgn.exe	90
PID 3272 wrote to memory of 1988	3272	Aimhmkgn.exe	90
PID 3272 wrote to memory of 1988	3272	Aimhmkgn.exe	90
PID 1988 wrote to memory of 760	1988	Aioebj32.exe	91
PID 1988 wrote to memory of 760	1988	Aioebj32.exe	91
PID 1988 wrote to memory of 760	1988	Aioebj32.exe	91
PID 760 wrote to memory of 2628	760	Alpnde32.exe	92
PID 760 wrote to memory of 2628	760	Alpnde32.exe	92
PID 760 wrote to memory of 2628	760	Alpnde32.exe	92
PID 2628 wrote to memory of 1532	2628	Amoknh32.exe	93
PID 2628 wrote to memory of 1532	2628	Amoknh32.exe	93
PID 2628 wrote to memory of 1532	2628	Amoknh32.exe	93
PID 1532 wrote to memory of 1440	1532	Ddekmo32.exe	94
PID 1532 wrote to memory of 1440	1532	Ddekmo32.exe	94
PID 1532 wrote to memory of 1440	1532	Ddekmo32.exe	94
PID 1440 wrote to memory of 3248	1440	Dlqpaafg.exe	95
PID 1440 wrote to memory of 3248	1440	Dlqpaafg.exe	95
PID 1440 wrote to memory of 3248	1440	Dlqpaafg.exe	95
PID 3248 wrote to memory of 1616	3248	Fgkfqgce.exe	96
PID 3248 wrote to memory of 1616	3248	Fgkfqgce.exe	96
PID 3248 wrote to memory of 1616	3248	Fgkfqgce.exe	96
PID 1616 wrote to memory of 2528	1616	Gnjhhpgl.exe	97
PID 1616 wrote to memory of 2528	1616	Gnjhhpgl.exe	97
PID 1616 wrote to memory of 2528	1616	Gnjhhpgl.exe	97
PID 2528 wrote to memory of 548	2528	Gjqinamq.exe	98
PID 2528 wrote to memory of 548	2528	Gjqinamq.exe	98
PID 2528 wrote to memory of 548	2528	Gjqinamq.exe	98
PID 548 wrote to memory of 1652	548	Gfgjbb32.exe	99
PID 548 wrote to memory of 1652	548	Gfgjbb32.exe	99
PID 548 wrote to memory of 1652	548	Gfgjbb32.exe	99
PID 1652 wrote to memory of 1640	1652	Gqokekph.exe	100
PID 1652 wrote to memory of 1640	1652	Gqokekph.exe	100
PID 1652 wrote to memory of 1640	1652	Gqokekph.exe	100
PID 1640 wrote to memory of 4692	1640	Ggicbe32.exe	101
PID 1640 wrote to memory of 4692	1640	Ggicbe32.exe	101
PID 1640 wrote to memory of 4692	1640	Ggicbe32.exe	101
PID 4692 wrote to memory of 5028	4692	Hqddqj32.exe	102
PID 4692 wrote to memory of 5028	4692	Hqddqj32.exe	102
PID 4692 wrote to memory of 5028	4692	Hqddqj32.exe	102
PID 5028 wrote to memory of 4772	5028	Hcembe32.exe	103
PID 5028 wrote to memory of 4772	5028	Hcembe32.exe	103
PID 5028 wrote to memory of 4772	5028	Hcembe32.exe	103
PID 4772 wrote to memory of 4776	4772	Hqimlihn.exe	104
PID 4772 wrote to memory of 4776	4772	Hqimlihn.exe	104
PID 4772 wrote to memory of 4776	4772	Hqimlihn.exe	104
PID 4776 wrote to memory of 2212	4776	Hdffah32.exe	105
PID 4776 wrote to memory of 2212	4776	Hdffah32.exe	105
PID 4776 wrote to memory of 2212	4776	Hdffah32.exe	105
PID 2212 wrote to memory of 900	2212	Hqmggi32.exe	106
PID 2212 wrote to memory of 900	2212	Hqmggi32.exe	106
PID 2212 wrote to memory of 900	2212	Hqmggi32.exe	106
PID 900 wrote to memory of 3224	900	Icqmncof.exe	107

C:\Users\Admin\AppData\Local\Temp\f66cd965006e38ef70dd9fb3c7b91f49_JC.exe
"C:\Users\Admin\AppData\Local\Temp\f66cd965006e38ef70dd9fb3c7b91f49_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\SysWOW64\Pkabbgol.exe
  C:\Windows\system32\Pkabbgol.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Windows\SysWOW64\Abpcja32.exe
    C:\Windows\system32\Abpcja32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Windows\SysWOW64\Acppddig.exe
      C:\Windows\system32\Acppddig.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1540
    - - C:\Windows\SysWOW64\Aimhmkgn.exe
        
        C:\Windows\system32\Aimhmkgn.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3272
      - C:\Windows\SysWOW64\Aioebj32.exe
        
        C:\Windows\system32\Aioebj32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1988
        
        C:\Windows\SysWOW64\Alpnde32.exe
        
        C:\Windows\system32\Alpnde32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:760
        
        C:\Windows\SysWOW64\Amoknh32.exe
        
        C:\Windows\system32\Amoknh32.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2628
        
        C:\Windows\SysWOW64\Ddekmo32.exe
        
        C:\Windows\system32\Ddekmo32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1532
        
        C:\Windows\SysWOW64\Dlqpaafg.exe
        
        C:\Windows\system32\Dlqpaafg.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1440
        
        C:\Windows\SysWOW64\Fgkfqgce.exe
        
        C:\Windows\system32\Fgkfqgce.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3248
        
        C:\Windows\SysWOW64\Gnjhhpgl.exe
        
        C:\Windows\system32\Gnjhhpgl.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1616
        
        C:\Windows\SysWOW64\Gjqinamq.exe
        
        C:\Windows\system32\Gjqinamq.exe
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2528
        
        C:\Windows\SysWOW64\Gfgjbb32.exe
        
        C:\Windows\system32\Gfgjbb32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:548
        
        C:\Windows\SysWOW64\Gqokekph.exe
        
        C:\Windows\system32\Gqokekph.exe
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1652
        
        C:\Windows\SysWOW64\Ggicbe32.exe
        
        C:\Windows\system32\Ggicbe32.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1640
        
        C:\Windows\SysWOW64\Hqddqj32.exe
        
        C:\Windows\system32\Hqddqj32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4692
        
        C:\Windows\SysWOW64\Hcembe32.exe
        
        C:\Windows\system32\Hcembe32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5028
        
        C:\Windows\SysWOW64\Hqimlihn.exe
        
        C:\Windows\system32\Hqimlihn.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4772
        
        C:\Windows\SysWOW64\Hdffah32.exe
        
        C:\Windows\system32\Hdffah32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4776
        
        C:\Windows\SysWOW64\Hqmggi32.exe
        
        C:\Windows\system32\Hqmggi32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\SysWOW64\Icqmncof.exe
        
        C:\Windows\system32\Icqmncof.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:900
        
        C:\Windows\SysWOW64\Ijmapm32.exe
        
        C:\Windows\system32\Ijmapm32.exe
        23⤵
        Executes dropped EXE
        
        PID:3224
        
        C:\Windows\SysWOW64\Inkjfk32.exe
        
        C:\Windows\system32\Inkjfk32.exe
        24⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3740
        
        C:\Windows\SysWOW64\Jnmglk32.exe
        
        C:\Windows\system32\Jnmglk32.exe
        25⤵
        Executes dropped EXE
        
        PID:4664
        
        C:\Windows\SysWOW64\Jgekdq32.exe
        
        C:\Windows\system32\Jgekdq32.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3436
        
        C:\Windows\SysWOW64\Jjfdfl32.exe
        
        C:\Windows\system32\Jjfdfl32.exe
        27⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2000
        
        C:\Windows\SysWOW64\Jjhalkjc.exe
        
        C:\Windows\system32\Jjhalkjc.exe
        28⤵
        Executes dropped EXE
        
        PID:1144
        
        C:\Windows\SysWOW64\Jjknakhq.exe
        
        C:\Windows\system32\Jjknakhq.exe
        29⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:232
        
        C:\Windows\SysWOW64\Jepbodhg.exe
        
        C:\Windows\system32\Jepbodhg.exe
        30⤵
        Executes dropped EXE
        
        PID:4484
        
        C:\Windows\SysWOW64\Kagbdenk.exe
        
        C:\Windows\system32\Kagbdenk.exe
        31⤵
        Executes dropped EXE
        
        PID:1380
        
        C:\Windows\SysWOW64\Kdhlepkl.exe
        
        C:\Windows\system32\Kdhlepkl.exe
        32⤵
        Executes dropped EXE
        
        PID:4960
        
        C:\Windows\SysWOW64\Kallod32.exe
        
        C:\Windows\system32\Kallod32.exe
        33⤵
        Executes dropped EXE
        
        PID:3972
        
        C:\Windows\SysWOW64\Kjdqhjpf.exe
        
        C:\Windows\system32\Kjdqhjpf.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2480

C:\Windows\SysWOW64\Kanidd32.exe
C:\Windows\system32\Kanidd32.exe
1⤵
- Executes dropped EXE
- Modifies registry class
PID:2448
- C:\Windows\SysWOW64\Kmeiie32.exe
  C:\Windows\system32\Kmeiie32.exe
  2⤵
  - Executes dropped EXE
  PID:4688
- - C:\Windows\SysWOW64\Lndfchdj.exe
    C:\Windows\system32\Lndfchdj.exe
    3⤵
    - Executes dropped EXE
    PID:4180
  - - C:\Windows\SysWOW64\Lmjcdd32.exe
      C:\Windows\system32\Lmjcdd32.exe
      4⤵
      Executes dropped EXE
      PID:3176
    - - C:\Windows\SysWOW64\Loiong32.exe
        
        C:\Windows\system32\Loiong32.exe
        5⤵
        Executes dropped EXE
        
        PID:4652
      - C:\Windows\SysWOW64\Lokldg32.exe
        
        C:\Windows\system32\Lokldg32.exe
        6⤵
        Executes dropped EXE
        
        PID:2816
        
        C:\Windows\SysWOW64\Lkbmih32.exe
        
        C:\Windows\system32\Lkbmih32.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1572
        
        C:\Windows\SysWOW64\Mdkabmjf.exe
        
        C:\Windows\system32\Mdkabmjf.exe
        8⤵
        Executes dropped EXE
        
        PID:3060
        
        C:\Windows\SysWOW64\Mopeofjl.exe
        
        C:\Windows\system32\Mopeofjl.exe
        9⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4736
        
        C:\Windows\SysWOW64\Mhkgnkoj.exe
        
        C:\Windows\system32\Mhkgnkoj.exe
        10⤵
        Executes dropped EXE
        
        PID:1512
        
        C:\Windows\SysWOW64\Moeoje32.exe
        
        C:\Windows\system32\Moeoje32.exe
        11⤵
        Executes dropped EXE
        
        PID:1624
        
        C:\Windows\SysWOW64\Nnabladg.exe
        
        C:\Windows\system32\Nnabladg.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:5000
        
        C:\Windows\SysWOW64\Nkebee32.exe
        
        C:\Windows\system32\Nkebee32.exe
        13⤵
        Executes dropped EXE
        
        PID:4872
        
        C:\Windows\SysWOW64\Nnfkgp32.exe
        
        C:\Windows\system32\Nnfkgp32.exe
        14⤵
        Executes dropped EXE
        
        PID:2888
        
        C:\Windows\SysWOW64\Ndpcdjho.exe
        
        C:\Windows\system32\Ndpcdjho.exe
        15⤵
        Executes dropped EXE
        
        PID:4504
        
        C:\Windows\SysWOW64\Oakjnnap.exe
        
        C:\Windows\system32\Oakjnnap.exe
        16⤵
        Executes dropped EXE
        
        PID:1072
        
        C:\Windows\SysWOW64\Oookgbpj.exe
        
        C:\Windows\system32\Oookgbpj.exe
        17⤵
        Executes dropped EXE
        
        PID:1948
        
        C:\Windows\SysWOW64\Odkcpi32.exe
        
        C:\Windows\system32\Odkcpi32.exe
        18⤵
        Executes dropped EXE
        
        PID:404
        
        C:\Windows\SysWOW64\Pdnpeh32.exe
        
        C:\Windows\system32\Pdnpeh32.exe
        19⤵
        Executes dropped EXE
        
        PID:464
        
        C:\Windows\SysWOW64\Pnfdnnbo.exe
        
        C:\Windows\system32\Pnfdnnbo.exe
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1176
        
        C:\Windows\SysWOW64\Pnhacn32.exe
        
        C:\Windows\system32\Pnhacn32.exe
        21⤵
        Executes dropped EXE
        
        PID:2148
        
        C:\Windows\SysWOW64\Pgaelcgm.exe
        
        C:\Windows\system32\Pgaelcgm.exe
        22⤵
        Executes dropped EXE
        
        PID:4448
        
        C:\Windows\SysWOW64\Pdeffgff.exe
        
        C:\Windows\system32\Pdeffgff.exe
        23⤵
        Executes dropped EXE
        
        PID:1116
        
        C:\Windows\SysWOW64\Pnmjomlg.exe
        
        C:\Windows\system32\Pnmjomlg.exe
        24⤵
        Executes dropped EXE
        
        PID:3516
        
        C:\Windows\SysWOW64\Qomghp32.exe
        
        C:\Windows\system32\Qomghp32.exe
        25⤵
        Executes dropped EXE
        
        PID:1568
        
        C:\Windows\SysWOW64\Qhekaejj.exe
        
        C:\Windows\system32\Qhekaejj.exe
        26⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2936
        
        C:\Windows\SysWOW64\Qbmpjkqk.exe
        
        C:\Windows\system32\Qbmpjkqk.exe
        27⤵
        Executes dropped EXE
        
        PID:2176
        
        C:\Windows\SysWOW64\Qhghge32.exe
        
        C:\Windows\system32\Qhghge32.exe
        28⤵
        Executes dropped EXE
        
        PID:1256
        
        C:\Windows\SysWOW64\Aijeme32.exe
        
        C:\Windows\system32\Aijeme32.exe
        29⤵
        Executes dropped EXE
        
        PID:2220
        
        C:\Windows\SysWOW64\Adqeaf32.exe
        
        C:\Windows\system32\Adqeaf32.exe
        30⤵
        Executes dropped EXE
        
        PID:4228
        
        C:\Windows\SysWOW64\Aofjoo32.exe
        
        C:\Windows\system32\Aofjoo32.exe
        31⤵
        Executes dropped EXE
        
        PID:1736
        
        C:\Windows\SysWOW64\Bghddp32.exe
        
        C:\Windows\system32\Bghddp32.exe
        32⤵
        
        PID:216
        
        C:\Windows\SysWOW64\Belemd32.exe
        
        C:\Windows\system32\Belemd32.exe
        33⤵
        
        PID:2872
        
        C:\Windows\SysWOW64\Bkfmjnii.exe
        
        C:\Windows\system32\Bkfmjnii.exe
        34⤵
        Modifies registry class
        
        PID:2328
        
        C:\Windows\SysWOW64\Bgmnooom.exe
        
        C:\Windows\system32\Bgmnooom.exe
        35⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Bgokdomj.exe
        
        C:\Windows\system32\Bgokdomj.exe
        36⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\Bnicai32.exe
        
        C:\Windows\system32\Bnicai32.exe
        37⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\Cbglgg32.exe
        
        C:\Windows\system32\Cbglgg32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:848
        
        C:\Windows\SysWOW64\Clpppmqn.exe
        
        C:\Windows\system32\Clpppmqn.exe
        39⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\Cbihmg32.exe
        
        C:\Windows\system32\Cbihmg32.exe
        40⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\Cpmifkgd.exe
        
        C:\Windows\system32\Cpmifkgd.exe
        41⤵
        
        PID:2524
        
        C:\Windows\SysWOW64\Cejaobel.exe
        
        C:\Windows\system32\Cejaobel.exe
        42⤵
        Drops file in System32 directory
        
        PID:4476
        
        C:\Windows\SysWOW64\Cbnbhfde.exe
        
        C:\Windows\system32\Cbnbhfde.exe
        43⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\Chkjpm32.exe
        
        C:\Windows\system32\Chkjpm32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:180
        
        C:\Windows\SysWOW64\Cnebmgjj.exe
        
        C:\Windows\system32\Cnebmgjj.exe
        45⤵
        
        PID:700
        
        C:\Windows\SysWOW64\Dhmgfm32.exe
        
        C:\Windows\system32\Dhmgfm32.exe
        46⤵
        Drops file in System32 directory
        
        PID:2372
        
        C:\Windows\SysWOW64\Dbckcf32.exe
        
        C:\Windows\system32\Dbckcf32.exe
        47⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\Dimcppgm.exe
        
        C:\Windows\system32\Dimcppgm.exe
        48⤵
        
        PID:1900
        
        C:\Windows\SysWOW64\Dpglmjoj.exe
        
        C:\Windows\system32\Dpglmjoj.exe
        49⤵
        
        PID:3620
        
        C:\Windows\SysWOW64\Dpihbjmg.exe
        
        C:\Windows\system32\Dpihbjmg.exe
        50⤵
        
        PID:3488
        
        C:\Windows\SysWOW64\Efhjjcpo.exe
        
        C:\Windows\system32\Efhjjcpo.exe
        51⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\Epiaig32.exe
        
        C:\Windows\system32\Epiaig32.exe
        52⤵
        Drops file in System32 directory
        
        PID:4168
        
        C:\Windows\SysWOW64\Fbhnec32.exe
        
        C:\Windows\system32\Fbhnec32.exe
        53⤵
        Modifies registry class
        
        PID:5156
        
        C:\Windows\SysWOW64\Flpbnh32.exe
        
        C:\Windows\system32\Flpbnh32.exe
        54⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Fpqgjf32.exe
        
        C:\Windows\system32\Fpqgjf32.exe
        55⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Fempbm32.exe
        
        C:\Windows\system32\Fempbm32.exe
        56⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5280
        
        C:\Windows\SysWOW64\Fcaqka32.exe
        
        C:\Windows\system32\Fcaqka32.exe
        57⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Gebimmco.exe
        
        C:\Windows\system32\Gebimmco.exe
        58⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Gcfjfqah.exe
        
        C:\Windows\system32\Gcfjfqah.exe
        59⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Glnnofhi.exe
        
        C:\Windows\system32\Glnnofhi.exe
        60⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Gheodg32.exe
        
        C:\Windows\system32\Gheodg32.exe
        61⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Hcommoin.exe
        
        C:\Windows\system32\Hcommoin.exe
        62⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Hofmaq32.exe
        
        C:\Windows\system32\Hofmaq32.exe
        63⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Hjlaoioh.exe
        
        C:\Windows\system32\Hjlaoioh.exe
        64⤵
        Modifies registry class
        
        PID:5628
        
        C:\Windows\SysWOW64\Hohjgpmo.exe
        
        C:\Windows\system32\Hohjgpmo.exe
        65⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Hjnndime.exe
        
        C:\Windows\system32\Hjnndime.exe
        66⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Hokgmpkl.exe
        
        C:\Windows\system32\Hokgmpkl.exe
        67⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Ijedehgm.exe
        
        C:\Windows\system32\Ijedehgm.exe
        68⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Iqombb32.exe
        
        C:\Windows\system32\Iqombb32.exe
        69⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Ijgakgej.exe
        
        C:\Windows\system32\Ijgakgej.exe
        70⤵
        
        PID:5940
        
        C:\Windows\SysWOW64\Ifqoehhl.exe
        
        C:\Windows\system32\Ifqoehhl.exe
        71⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Imjgbb32.exe
        
        C:\Windows\system32\Imjgbb32.exe
        72⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Jfehpg32.exe
        
        C:\Windows\system32\Jfehpg32.exe
        73⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Jjcqffkm.exe
        
        C:\Windows\system32\Jjcqffkm.exe
        74⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Jqmicpbj.exe
        
        C:\Windows\system32\Jqmicpbj.exe
        75⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Jmdjha32.exe
        
        C:\Windows\system32\Jmdjha32.exe
        76⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Jcnbekok.exe
        
        C:\Windows\system32\Jcnbekok.exe
        77⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Kpilekqj.exe
        
        C:\Windows\system32\Kpilekqj.exe
        78⤵
        Modifies registry class
        
        PID:5352
        
        C:\Windows\SysWOW64\Kjopbd32.exe
        
        C:\Windows\system32\Kjopbd32.exe
        79⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Kcgekjgp.exe
        
        C:\Windows\system32\Kcgekjgp.exe
        80⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Kmpido32.exe
        
        C:\Windows\system32\Kmpido32.exe
        81⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Kpnepk32.exe
        
        C:\Windows\system32\Kpnepk32.exe
        82⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Kjcjmclj.exe
        
        C:\Windows\system32\Kjcjmclj.exe
        83⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\Kanbjn32.exe
        
        C:\Windows\system32\Kanbjn32.exe
        84⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Kggjghkd.exe
        
        C:\Windows\system32\Kggjghkd.exe
        85⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Liifnp32.exe
        
        C:\Windows\system32\Liifnp32.exe
        86⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Lcnkli32.exe
        
        C:\Windows\system32\Lcnkli32.exe
        87⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Likcdpop.exe
        
        C:\Windows\system32\Likcdpop.exe
        88⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Lpjelibg.exe
        
        C:\Windows\system32\Lpjelibg.exe
        89⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Lfcmhc32.exe
        
        C:\Windows\system32\Lfcmhc32.exe
        90⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\Mdlgmgdh.exe
        
        C:\Windows\system32\Mdlgmgdh.exe
        91⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Mfkcibdl.exe
        
        C:\Windows\system32\Mfkcibdl.exe
        92⤵
        
        PID:5356
        
        C:\Windows\SysWOW64\Mapgfk32.exe
        
        C:\Windows\system32\Mapgfk32.exe
        93⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Nkpbpp32.exe
        
        C:\Windows\system32\Nkpbpp32.exe
        94⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Nhcbidcd.exe
        
        C:\Windows\system32\Nhcbidcd.exe
        95⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Nalgbi32.exe
        
        C:\Windows\system32\Nalgbi32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5808
        
        C:\Windows\SysWOW64\Ngipjp32.exe
        
        C:\Windows\system32\Ngipjp32.exe
        97⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Nmbhgjoi.exe
        
        C:\Windows\system32\Nmbhgjoi.exe
        98⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Ogbbqo32.exe
        
        C:\Windows\system32\Ogbbqo32.exe
        99⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Oiqomj32.exe
        
        C:\Windows\system32\Oiqomj32.exe
        100⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Pjjaci32.exe
        
        C:\Windows\system32\Pjjaci32.exe
        101⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Ppdjpcng.exe
        
        C:\Windows\system32\Ppdjpcng.exe
        102⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5648
        
        C:\Windows\SysWOW64\Pjlnhi32.exe
        
        C:\Windows\system32\Pjlnhi32.exe
        103⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5904
        
        C:\Windows\SysWOW64\Qpkppbho.exe
        
        C:\Windows\system32\Qpkppbho.exe
        104⤵
        Drops file in System32 directory
        
        PID:6068
        
        C:\Windows\SysWOW64\Aqbfaa32.exe
        
        C:\Windows\system32\Aqbfaa32.exe
        105⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Ajjjjghg.exe
        
        C:\Windows\system32\Ajjjjghg.exe
        106⤵
        Drops file in System32 directory
        
        PID:5460
        
        C:\Windows\SysWOW64\Adpogp32.exe
        
        C:\Windows\system32\Adpogp32.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6084
        
        C:\Windows\SysWOW64\Addhbo32.exe
        
        C:\Windows\system32\Addhbo32.exe
        108⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Bggnijof.exe
        
        C:\Windows\system32\Bggnijof.exe
        109⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Bqpbboeg.exe
        
        C:\Windows\system32\Bqpbboeg.exe
        110⤵
        Modifies registry class
        
        PID:5260
        
        C:\Windows\SysWOW64\Bnfoac32.exe
        
        C:\Windows\system32\Bnfoac32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2792
        
        C:\Windows\SysWOW64\Bgodjiio.exe
        
        C:\Windows\system32\Bgodjiio.exe
        112⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Cbfema32.exe
        
        C:\Windows\system32\Cbfema32.exe
        113⤵
        Drops file in System32 directory
        
        PID:6200
        
        C:\Windows\SysWOW64\Cnmebblf.exe
        
        C:\Windows\system32\Cnmebblf.exe
        114⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Cejjdlap.exe
        
        C:\Windows\system32\Cejjdlap.exe
        115⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Ckfofe32.exe
        
        C:\Windows\system32\Ckfofe32.exe
        116⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Djpfbahm.exe
        
        C:\Windows\system32\Djpfbahm.exe
        117⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6392
        
        C:\Windows\SysWOW64\Dlobmd32.exe
        
        C:\Windows\system32\Dlobmd32.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6432
        
        C:\Windows\SysWOW64\Dehgejep.exe
        
        C:\Windows\system32\Dehgejep.exe
        119⤵
        
        PID:6476
        
        C:\Windows\SysWOW64\Enpknplq.exe
        
        C:\Windows\system32\Enpknplq.exe
        120⤵
        Modifies registry class
        
        PID:6528
        
        C:\Windows\SysWOW64\Eejcki32.exe
        
        C:\Windows\system32\Eejcki32.exe
        121⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Ejglcq32.exe
        
        C:\Windows\system32\Ejglcq32.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6616
        
        C:\Windows\SysWOW64\Eelpqi32.exe
        
        C:\Windows\system32\Eelpqi32.exe
        123⤵
        Modifies registry class
        
        PID:6664
        
        C:\Windows\SysWOW64\Elfhmc32.exe
        
        C:\Windows\system32\Elfhmc32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6708
        
        C:\Windows\SysWOW64\Eacaej32.exe
        
        C:\Windows\system32\Eacaej32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6748
        
        C:\Windows\SysWOW64\Ejkenpnp.exe
        
        C:\Windows\system32\Ejkenpnp.exe
        126⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Eaenkj32.exe
        
        C:\Windows\system32\Eaenkj32.exe
        127⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Elkbhbeb.exe
        
        C:\Windows\system32\Elkbhbeb.exe
        128⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6912
        
        C:\Windows\SysWOW64\Fhbbmc32.exe
        
        C:\Windows\system32\Fhbbmc32.exe
        129⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Fbggkl32.exe
        
        C:\Windows\system32\Fbggkl32.exe
        130⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Fiaogfai.exe
        
        C:\Windows\system32\Fiaogfai.exe
        131⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Flgadake.exe
        
        C:\Windows\system32\Flgadake.exe
        132⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Facjlhil.exe
        
        C:\Windows\system32\Facjlhil.exe
        133⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Gimoce32.exe
        
        C:\Windows\system32\Gimoce32.exe
        134⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Gojgkl32.exe
        
        C:\Windows\system32\Gojgkl32.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6256
        
        C:\Windows\SysWOW64\Gedohfmp.exe
        
        C:\Windows\system32\Gedohfmp.exe
        136⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\Gekeie32.exe
        
        C:\Windows\system32\Gekeie32.exe
        137⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Haafnf32.exe
        
        C:\Windows\system32\Haafnf32.exe
        138⤵
        
        PID:6548
        
        C:\Windows\SysWOW64\Hccomh32.exe
        
        C:\Windows\system32\Hccomh32.exe
        139⤵
        Drops file in System32 directory
        
        PID:6608
        
        C:\Windows\SysWOW64\Himgjbii.exe
        
        C:\Windows\system32\Himgjbii.exe
        140⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Hkodak32.exe
        
        C:\Windows\system32\Hkodak32.exe
        141⤵
        Drops file in System32 directory
        
        PID:6772
        
        C:\Windows\SysWOW64\Hedhoc32.exe
        
        C:\Windows\system32\Hedhoc32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6888
        
        C:\Windows\SysWOW64\Ihjjln32.exe
        
        C:\Windows\system32\Ihjjln32.exe
        143⤵
        Drops file in System32 directory
        
        PID:6984
        
        C:\Windows\SysWOW64\Jloibkhh.exe
        
        C:\Windows\system32\Jloibkhh.exe
        144⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Joaojf32.exe
        
        C:\Windows\system32\Joaojf32.exe
        145⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Kjipmoai.exe
        
        C:\Windows\system32\Kjipmoai.exe
        146⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Kmjinjnj.exe
        
        C:\Windows\system32\Kmjinjnj.exe
        147⤵
        Modifies registry class
        
        PID:3204
        
        C:\Windows\SysWOW64\Kcfnqccd.exe
        
        C:\Windows\system32\Kcfnqccd.exe
        148⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Kfggbope.exe
        
        C:\Windows\system32\Kfggbope.exe
        149⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Lbnggpfj.exe
        
        C:\Windows\system32\Lbnggpfj.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6688
        
        C:\Windows\SysWOW64\Lmkbeg32.exe
        
        C:\Windows\system32\Lmkbeg32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6756
        
        C:\Windows\SysWOW64\Lbgjmnno.exe
        
        C:\Windows\system32\Lbgjmnno.exe
        152⤵
        Drops file in System32 directory
        
        PID:6948
        
        C:\Windows\SysWOW64\Lmmokgne.exe
        
        C:\Windows\system32\Lmmokgne.exe
        153⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Mbjgcnll.exe
        
        C:\Windows\system32\Mbjgcnll.exe
        154⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Mcicma32.exe
        
        C:\Windows\system32\Mcicma32.exe
        155⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Mmdekf32.exe
        
        C:\Windows\system32\Mmdekf32.exe
        156⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Mbamcm32.exe
        
        C:\Windows\system32\Mbamcm32.exe
        157⤵
        Modifies registry class
        
        PID:6536
        
        C:\Windows\SysWOW64\Mmfaafej.exe
        
        C:\Windows\system32\Mmfaafej.exe
        158⤵
        
        PID:6656
        
        C:\Windows\SysWOW64\Mcpjnp32.exe
        
        C:\Windows\system32\Mcpjnp32.exe
        159⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\Nlknbb32.exe
        
        C:\Windows\system32\Nlknbb32.exe
        160⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Nipokfil.exe
        
        C:\Windows\system32\Nipokfil.exe
        161⤵
        Drops file in System32 directory
        
        PID:7132
        
        C:\Windows\SysWOW64\Njokei32.exe
        
        C:\Windows\system32\Njokei32.exe
        162⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Nbjpjl32.exe
        
        C:\Windows\system32\Nbjpjl32.exe
        163⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Npnqcpmc.exe
        
        C:\Windows\system32\Npnqcpmc.exe
        164⤵
        Drops file in System32 directory
        
        PID:4164
        
        C:\Windows\SysWOW64\Nifele32.exe
        
        C:\Windows\system32\Nifele32.exe
        165⤵
        Modifies registry class
        
        PID:7136
        
        C:\Windows\SysWOW64\Ndliin32.exe
        
        C:\Windows\system32\Ndliin32.exe
        166⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Obfpejcl.exe
        
        C:\Windows\system32\Obfpejcl.exe
        167⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Offeahhp.exe
        
        C:\Windows\system32\Offeahhp.exe
        168⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Pdchakoo.exe
        
        C:\Windows\system32\Pdchakoo.exe
        169⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Qkmqne32.exe
        
        C:\Windows\system32\Qkmqne32.exe
        170⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Qciebg32.exe
        
        C:\Windows\system32\Qciebg32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7208
        
        C:\Windows\SysWOW64\Qdhalj32.exe
        
        C:\Windows\system32\Qdhalj32.exe
        172⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Apobakpn.exe
        
        C:\Windows\system32\Apobakpn.exe
        173⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Anccjp32.exe
        
        C:\Windows\system32\Anccjp32.exe
        174⤵
        Drops file in System32 directory
        
        PID:7344
        
        C:\Windows\SysWOW64\Agkgceeh.exe
        
        C:\Windows\system32\Agkgceeh.exe
        175⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Alhpkldp.exe
        
        C:\Windows\system32\Alhpkldp.exe
        176⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Bgggockk.exe
        
        C:\Windows\system32\Bgggockk.exe
        177⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Bcngddao.exe
        
        C:\Windows\system32\Bcngddao.exe
        178⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7520
        
        C:\Windows\SysWOW64\Bqahmhpi.exe
        
        C:\Windows\system32\Bqahmhpi.exe
        179⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Cqfahh32.exe
        
        C:\Windows\system32\Cqfahh32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7636
        
        C:\Windows\SysWOW64\Cklffq32.exe
        
        C:\Windows\system32\Cklffq32.exe
        181⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Cmmbmiag.exe
        
        C:\Windows\system32\Cmmbmiag.exe
        182⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Cgbfka32.exe
        
        C:\Windows\system32\Cgbfka32.exe
        183⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7776
        
        C:\Windows\SysWOW64\Cnmoglij.exe
        
        C:\Windows\system32\Cnmoglij.exe
        184⤵
        Drops file in System32 directory
        
        PID:7824
        
        C:\Windows\SysWOW64\Ccigpbga.exe
        
        C:\Windows\system32\Ccigpbga.exe
        185⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Cnokmkfh.exe
        
        C:\Windows\system32\Cnokmkfh.exe
        186⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Cjflblll.exe
        
        C:\Windows\system32\Cjflblll.exe
        187⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Dqbadf32.exe
        
        C:\Windows\system32\Dqbadf32.exe
        188⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Dkgeao32.exe
        
        C:\Windows\system32\Dkgeao32.exe
        189⤵
        
        PID:8064
        
        C:\Windows\SysWOW64\Dnhncjom.exe
        
        C:\Windows\system32\Dnhncjom.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8100
        
        C:\Windows\SysWOW64\Dklomnmf.exe
        
        C:\Windows\system32\Dklomnmf.exe
        191⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Eclmlpfl.exe
        
        C:\Windows\system32\Eclmlpfl.exe
        192⤵
        Drops file in System32 directory
        
        PID:812
        
        C:\Windows\SysWOW64\Ecoiapdj.exe
        
        C:\Windows\system32\Ecoiapdj.exe
        193⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Eenflbll.exe
        
        C:\Windows\system32\Eenflbll.exe
        194⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:7280
        
        C:\Windows\SysWOW64\Eepbabjj.exe
        
        C:\Windows\system32\Eepbabjj.exe
        195⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7380
        
        C:\Windows\SysWOW64\Emlgedge.exe
        
        C:\Windows\system32\Emlgedge.exe
        196⤵
        Modifies registry class
        
        PID:2120
        
        C:\Windows\SysWOW64\Fcepbooa.exe
        
        C:\Windows\system32\Fcepbooa.exe
        197⤵
        Modifies registry class
        
        PID:408
        
        C:\Windows\SysWOW64\Fjphoi32.exe
        
        C:\Windows\system32\Fjphoi32.exe
        198⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Flodilma.exe
        
        C:\Windows\system32\Flodilma.exe
        199⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Fhfenmbe.exe
        
        C:\Windows\system32\Fhfenmbe.exe
        200⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Fdmfcn32.exe
        
        C:\Windows\system32\Fdmfcn32.exe
        201⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\Fnbjpf32.exe
        
        C:\Windows\system32\Fnbjpf32.exe
        202⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Felbmqpl.exe
        
        C:\Windows\system32\Felbmqpl.exe
        203⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Genobp32.exe
        
        C:\Windows\system32\Genobp32.exe
        204⤵
        
        PID:7676
        
        C:\Windows\SysWOW64\Gjkgkg32.exe
        
        C:\Windows\system32\Gjkgkg32.exe
        205⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7788
        
        C:\Windows\SysWOW64\Gaglma32.exe
        
        C:\Windows\system32\Gaglma32.exe
        206⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Ghadjkhh.exe
        
        C:\Windows\system32\Ghadjkhh.exe
        207⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Gjpaffhl.exe
        
        C:\Windows\system32\Gjpaffhl.exe
        208⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Gdheol32.exe
        
        C:\Windows\system32\Gdheol32.exe
        209⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Gonilenb.exe
        
        C:\Windows\system32\Gonilenb.exe
        210⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Gkdjaf32.exe
        
        C:\Windows\system32\Gkdjaf32.exe
        211⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\Hdmojkjg.exe
        
        C:\Windows\system32\Hdmojkjg.exe
        212⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Hhkgpjqn.exe
        
        C:\Windows\system32\Hhkgpjqn.exe
        213⤵
        Drops file in System32 directory
        
        PID:7328
        
        C:\Windows\SysWOW64\Hoepmd32.exe
        
        C:\Windows\system32\Hoepmd32.exe
        214⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\Hlipfh32.exe
        
        C:\Windows\system32\Hlipfh32.exe
        215⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4048
        
        C:\Windows\SysWOW64\Hmjmnpmb.exe
        
        C:\Windows\system32\Hmjmnpmb.exe
        216⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Hhpaki32.exe
        
        C:\Windows\system32\Hhpaki32.exe
        217⤵
        Drops file in System32 directory
        
        PID:7572
        
        C:\Windows\SysWOW64\Hoiihcde.exe
        
        C:\Windows\system32\Hoiihcde.exe
        218⤵
        Drops file in System32 directory
        
        PID:1944
        
        C:\Windows\SysWOW64\Hlmiagbo.exe
        
        C:\Windows\system32\Hlmiagbo.exe
        219⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7668
        
        C:\Windows\SysWOW64\Imabnofj.exe
        
        C:\Windows\system32\Imabnofj.exe
        220⤵
        
        PID:1532
        
        C:\Windows\SysWOW64\Iemdkl32.exe
        
        C:\Windows\system32\Iemdkl32.exe
        221⤵
        Modifies registry class
        
        PID:7812
        
        C:\Windows\SysWOW64\Ihkpgg32.exe
        
        C:\Windows\system32\Ihkpgg32.exe
        222⤵
        Modifies registry class
        
        PID:4912
        
        C:\Windows\SysWOW64\Jafaem32.exe
        
        C:\Windows\system32\Jafaem32.exe
        223⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Jhpjbgne.exe
        
        C:\Windows\system32\Jhpjbgne.exe
        224⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\Jehcfj32.exe
        
        C:\Windows\system32\Jehcfj32.exe
        225⤵
        
        PID:2340
        
        C:\Windows\SysWOW64\Jlblcdpf.exe
        
        C:\Windows\system32\Jlblcdpf.exe
        226⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Klgend32.exe
        
        C:\Windows\system32\Klgend32.exe
        227⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Knhbflbp.exe
        
        C:\Windows\system32\Knhbflbp.exe
        228⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\Kfbfmi32.exe
        
        C:\Windows\system32\Kfbfmi32.exe
        229⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Kojkeogp.exe
        
        C:\Windows\system32\Kojkeogp.exe
        230⤵
        
        PID:4296
        
        C:\Windows\SysWOW64\Lmcejbbd.exe
        
        C:\Windows\system32\Lmcejbbd.exe
        231⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Loaafnah.exe
        
        C:\Windows\system32\Loaafnah.exe
        232⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Ldqfddml.exe
        
        C:\Windows\system32\Ldqfddml.exe
        233⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Lfpcngdo.exe
        
        C:\Windows\system32\Lfpcngdo.exe
        234⤵
        Modifies registry class
        
        PID:7912
        
        C:\Windows\SysWOW64\Lohggm32.exe
        
        C:\Windows\system32\Lohggm32.exe
        235⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Lfbpcgbl.exe
        
        C:\Windows\system32\Lfbpcgbl.exe
        236⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\Mbiphhhq.exe
        
        C:\Windows\system32\Mbiphhhq.exe
        237⤵
        
        PID:760
        
        C:\Windows\SysWOW64\Mkadam32.exe
        
        C:\Windows\system32\Mkadam32.exe
        238⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\Mflbjejb.exe
        
        C:\Windows\system32\Mflbjejb.exe
        239⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\Nmhglopl.exe
        
        C:\Windows\system32\Nmhglopl.exe
        240⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2088
        
        C:\Windows\SysWOW64\Nldjnk32.exe
        
        C:\Windows\system32\Nldjnk32.exe
        241⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\Omdghmfo.exe
        
        C:\Windows\system32\Omdghmfo.exe
        242⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\Oflkqc32.exe
        
        C:\Windows\system32\Oflkqc32.exe
        243⤵
        
        PID:3292
        
        C:\Windows\SysWOW64\Ongpeejj.exe
        
        C:\Windows\system32\Ongpeejj.exe
        244⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\Olkqnjhd.exe
        
        C:\Windows\system32\Olkqnjhd.exe
        245⤵
        Drops file in System32 directory
        
        PID:2392
        
        C:\Windows\SysWOW64\Oioahn32.exe
        
        C:\Windows\system32\Oioahn32.exe
        246⤵
        
        PID:2540
        
        C:\Windows\SysWOW64\Onlipd32.exe
        
        C:\Windows\system32\Onlipd32.exe
        247⤵
        Drops file in System32 directory
        
        PID:7956
        
        C:\Windows\SysWOW64\Olpjii32.exe
        
        C:\Windows\system32\Olpjii32.exe
        248⤵
        Modifies registry class
        
        PID:7892
        
        C:\Windows\SysWOW64\Pfenga32.exe
        
        C:\Windows\system32\Pfenga32.exe
        249⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\Ppnbpg32.exe
        
        C:\Windows\system32\Ppnbpg32.exe
        250⤵
        Drops file in System32 directory
        
        PID:2060
        
        C:\Windows\SysWOW64\Pekkhn32.exe
        
        C:\Windows\system32\Pekkhn32.exe
        251⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Pocpqcpm.exe
        
        C:\Windows\system32\Pocpqcpm.exe
        252⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Pfmdgq32.exe
        
        C:\Windows\system32\Pfmdgq32.exe
        253⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\Pohilc32.exe
        
        C:\Windows\system32\Pohilc32.exe
        254⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Pmiijjcf.exe
        
        C:\Windows\system32\Pmiijjcf.exe
        255⤵
        Modifies registry class
        
        PID:220
        
        C:\Windows\SysWOW64\Qbeaba32.exe
        
        C:\Windows\system32\Qbeaba32.exe
        256⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\Qbhnga32.exe
        
        C:\Windows\system32\Qbhnga32.exe
        257⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Aploae32.exe
        
        C:\Windows\system32\Aploae32.exe
        258⤵
        
        PID:232
        
        C:\Windows\SysWOW64\Abmhbplf.exe
        
        C:\Windows\system32\Abmhbplf.exe
        259⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\Apqhldjp.exe
        
        C:\Windows\system32\Apqhldjp.exe
        260⤵
        
        PID:2780
        
        C:\Windows\SysWOW64\Aiimejap.exe
        
        C:\Windows\system32\Aiimejap.exe
        261⤵
        
        PID:2692
        
        C:\Windows\SysWOW64\Acaanp32.exe
        
        C:\Windows\system32\Acaanp32.exe
        262⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Aljefena.exe
        
        C:\Windows\system32\Aljefena.exe
        263⤵
        Drops file in System32 directory
        
        PID:884
        
        C:\Windows\SysWOW64\Aebjokda.exe
        
        C:\Windows\system32\Aebjokda.exe
        264⤵
        
        PID:5076
        
        C:\Windows\SysWOW64\Bcfkiock.exe
        
        C:\Windows\system32\Bcfkiock.exe
        265⤵
        Drops file in System32 directory
        
        PID:640
        
        C:\Windows\SysWOW64\Bipcei32.exe
        
        C:\Windows\system32\Bipcei32.exe
        266⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\Bomknp32.exe
        
        C:\Windows\system32\Bomknp32.exe
        267⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\Bibpkiie.exe
        
        C:\Windows\system32\Bibpkiie.exe
        268⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\Boohcpgm.exe
        
        C:\Windows\system32\Boohcpgm.exe
        269⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\Bidlqhgc.exe
        
        C:\Windows\system32\Bidlqhgc.exe
        270⤵
        
        PID:1948
        
        C:\Windows\SysWOW64\Bpodmb32.exe
        
        C:\Windows\system32\Bpodmb32.exe
        271⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Bodano32.exe
        
        C:\Windows\system32\Bodano32.exe
        272⤵
        
        PID:1268
        
        C:\Windows\SysWOW64\Bjielh32.exe
        
        C:\Windows\system32\Bjielh32.exe
        273⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\Ccajdmin.exe
        
        C:\Windows\system32\Ccajdmin.exe
        274⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\Cjlbag32.exe
        
        C:\Windows\system32\Cjlbag32.exe
        275⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7664
        
        C:\Windows\SysWOW64\Cfbcfh32.exe
        
        C:\Windows\system32\Cfbcfh32.exe
        276⤵
        
        PID:3496
        
        C:\Windows\SysWOW64\Cgbppknb.exe
        
        C:\Windows\system32\Cgbppknb.exe
        277⤵
        
        PID:7836
        
        C:\Windows\SysWOW64\Cjbhbf32.exe
        
        C:\Windows\system32\Cjbhbf32.exe
        278⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Copajm32.exe
        
        C:\Windows\system32\Copajm32.exe
        279⤵
        Drops file in System32 directory
        
        PID:8032
        
        C:\Windows\SysWOW64\Dqajjp32.exe
        
        C:\Windows\system32\Dqajjp32.exe
        280⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Dqdgop32.exe
        
        C:\Windows\system32\Dqdgop32.exe
        281⤵
        
        PID:7180
        
        C:\Windows\SysWOW64\Dnhgidka.exe
        
        C:\Windows\system32\Dnhgidka.exe
        282⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\Dqhpjohb.exe
        
        C:\Windows\system32\Dqhpjohb.exe
        283⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\Eciilj32.exe
        
        C:\Windows\system32\Eciilj32.exe
        284⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4500
        
        C:\Windows\SysWOW64\Enomic32.exe
        
        C:\Windows\system32\Enomic32.exe
        285⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\Eckfaj32.exe
        
        C:\Windows\system32\Eckfaj32.exe
        286⤵
        Modifies registry class
        
        PID:3712
        
        C:\Windows\SysWOW64\Enajobbf.exe
        
        C:\Windows\system32\Enajobbf.exe
        287⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\Eobffk32.exe
        
        C:\Windows\system32\Eobffk32.exe
        288⤵
        
        PID:3220
        
        C:\Windows\SysWOW64\Eqbcqnph.exe
        
        C:\Windows\system32\Eqbcqnph.exe
        289⤵
        
        PID:4580
        
        C:\Windows\SysWOW64\Efolidno.exe
        
        C:\Windows\system32\Efolidno.exe
        290⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\Eqdpfm32.exe
        
        C:\Windows\system32\Eqdpfm32.exe
        291⤵
        
        PID:3288
        
        C:\Windows\SysWOW64\Ffahnd32.exe
        
        C:\Windows\system32\Ffahnd32.exe
        292⤵
        
        PID:1424
        
        C:\Windows\SysWOW64\Fgqehgco.exe
        
        C:\Windows\system32\Fgqehgco.exe
        293⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\Fmmmqnaf.exe
        
        C:\Windows\system32\Fmmmqnaf.exe
        294⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\Fcgemhic.exe
        
        C:\Windows\system32\Fcgemhic.exe
        295⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\Fakfglhm.exe
        
        C:\Windows\system32\Fakfglhm.exe
        296⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3224
        
        C:\Windows\SysWOW64\Fgencf32.exe
        
        C:\Windows\system32\Fgencf32.exe
        297⤵
        
        PID:1108
        
        C:\Windows\SysWOW64\Fjfgealk.exe
        
        C:\Windows\system32\Fjfgealk.exe
        298⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\Fpbpmhjb.exe
        
        C:\Windows\system32\Fpbpmhjb.exe
        299⤵
        
        PID:180
        
        C:\Windows\SysWOW64\Gfmhjb32.exe
        
        C:\Windows\system32\Gfmhjb32.exe
        300⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3752
        
        C:\Windows\SysWOW64\Gmfpgmil.exe
        
        C:\Windows\system32\Gmfpgmil.exe
        301⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\Ggldde32.exe
        
        C:\Windows\system32\Ggldde32.exe
        302⤵
        Modifies registry class
        
        PID:4684
        
        C:\Windows\SysWOW64\Gmimll32.exe
        
        C:\Windows\system32\Gmimll32.exe
        303⤵
        
        PID:2184
        
        C:\Windows\SysWOW64\Gjmmfq32.exe
        
        C:\Windows\system32\Gjmmfq32.exe
        304⤵
        
        PID:32
        
        C:\Windows\SysWOW64\Ghanoeel.exe
        
        C:\Windows\system32\Ghanoeel.exe
        305⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\Gmnfglcd.exe
        
        C:\Windows\system32\Gmnfglcd.exe
        306⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Gffkpa32.exe
        
        C:\Windows\system32\Gffkpa32.exe
        307⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\Galonj32.exe
        
        C:\Windows\system32\Galonj32.exe
        308⤵
        
        PID:2200
        
        C:\Windows\SysWOW64\Hfhgfaha.exe
        
        C:\Windows\system32\Hfhgfaha.exe
        309⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\Hanlcjgh.exe
        
        C:\Windows\system32\Hanlcjgh.exe
        310⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Hfkdkqeo.exe
        
        C:\Windows\system32\Hfkdkqeo.exe
        311⤵
        
        PID:3372
        
        C:\Windows\SysWOW64\Haphiiee.exe
        
        C:\Windows\system32\Haphiiee.exe
        312⤵
        Drops file in System32 directory
        
        PID:4168
        
        C:\Windows\SysWOW64\Hfmqapcl.exe
        
        C:\Windows\system32\Hfmqapcl.exe
        313⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Hmginjki.exe
        
        C:\Windows\system32\Hmginjki.exe
        314⤵
        
        PID:1832
        
        C:\Windows\SysWOW64\Hdaajd32.exe
        
        C:\Windows\system32\Hdaajd32.exe
        315⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\Hnfehm32.exe
        
        C:\Windows\system32\Hnfehm32.exe
        316⤵
        Drops file in System32 directory
        
        PID:2148
        
        C:\Windows\SysWOW64\Hjmfmnhp.exe
        
        C:\Windows\system32\Hjmfmnhp.exe
        317⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\Idfkednq.exe
        
        C:\Windows\system32\Idfkednq.exe
        318⤵
        
        PID:348
        
        C:\Windows\SysWOW64\Imnoni32.exe
        
        C:\Windows\system32\Imnoni32.exe
        319⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Ionlhlld.exe
        
        C:\Windows\system32\Ionlhlld.exe
        320⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Idjdqc32.exe
        
        C:\Windows\system32\Idjdqc32.exe
        321⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2176
        
        C:\Windows\SysWOW64\Iophnl32.exe
        
        C:\Windows\system32\Iophnl32.exe
        322⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Ipaeedpp.exe
        
        C:\Windows\system32\Ipaeedpp.exe
        323⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Iobecl32.exe
        
        C:\Windows\system32\Iobecl32.exe
        324⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Ihkila32.exe
        
        C:\Windows\system32\Ihkila32.exe
        325⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Imgbdh32.exe
        
        C:\Windows\system32\Imgbdh32.exe
        326⤵
        
        PID:564
        
        C:\Windows\SysWOW64\Jognokdi.exe
        
        C:\Windows\system32\Jognokdi.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5492
        
        C:\Windows\SysWOW64\Jhocgqjj.exe
        
        C:\Windows\system32\Jhocgqjj.exe
        328⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Jmlkpgia.exe
        
        C:\Windows\system32\Jmlkpgia.exe
        329⤵
        
        PID:5564
        
        C:\Windows\SysWOW64\Jolhjj32.exe
        
        C:\Windows\system32\Jolhjj32.exe
        330⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Jdhpba32.exe
        
        C:\Windows\system32\Jdhpba32.exe
        331⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Jkbhok32.exe
        
        C:\Windows\system32\Jkbhok32.exe
        332⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Jgiiclkl.exe
        
        C:\Windows\system32\Jgiiclkl.exe
        333⤵
        
        PID:380
        
        C:\Windows\SysWOW64\Kpanmb32.exe
        
        C:\Windows\system32\Kpanmb32.exe
        334⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\Kgnbol32.exe
        
        C:\Windows\system32\Kgnbol32.exe
        335⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Kpfggang.exe
        
        C:\Windows\system32\Kpfggang.exe
        336⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\Kklkej32.exe
        
        C:\Windows\system32\Kklkej32.exe
        337⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2604
        
        C:\Windows\SysWOW64\Kafcadej.exe
        
        C:\Windows\system32\Kafcadej.exe
        338⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Khplnn32.exe
        
        C:\Windows\system32\Khplnn32.exe
        339⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Kojdkhdd.exe
        
        C:\Windows\system32\Kojdkhdd.exe
        340⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5992
        
        C:\Windows\SysWOW64\Kpkqbq32.exe
        
        C:\Windows\system32\Kpkqbq32.exe
        341⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\Kkqepi32.exe
        
        C:\Windows\system32\Kkqepi32.exe
        342⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\Lpmmhpgp.exe
        
        C:\Windows\system32\Lpmmhpgp.exe
        343⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Lkcaeige.exe
        
        C:\Windows\system32\Lkcaeige.exe
        344⤵
        Modifies registry class
        
        PID:5160
        
        C:\Windows\SysWOW64\Lhgbomfo.exe
        
        C:\Windows\system32\Lhgbomfo.exe
        345⤵
        
        PID:5868
        
        C:\Windows\SysWOW64\Laofhbmp.exe
        
        C:\Windows\system32\Laofhbmp.exe
        346⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Lkgkqh32.exe
        
        C:\Windows\system32\Lkgkqh32.exe
        347⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Lnhdbc32.exe
        
        C:\Windows\system32\Lnhdbc32.exe
        348⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Lkldlgok.exe
        
        C:\Windows\system32\Lkldlgok.exe
        349⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Mddidm32.exe
        
        C:\Windows\system32\Mddidm32.exe
        350⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Mojmbf32.exe
        
        C:\Windows\system32\Mojmbf32.exe
        351⤵
        Modifies registry class
        
        PID:6036
        
        C:\Windows\SysWOW64\Mqkijnkp.exe
        
        C:\Windows\system32\Mqkijnkp.exe
        352⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Mgebfhcl.exe
        
        C:\Windows\system32\Mgebfhcl.exe
        353⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Mnojcb32.exe
        
        C:\Windows\system32\Mnojcb32.exe
        354⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Mdibplaf.exe
        
        C:\Windows\system32\Mdibplaf.exe
        355⤵
        Modifies registry class
        
        PID:5636
        
        C:\Windows\SysWOW64\Mbmbiqqp.exe
        
        C:\Windows\system32\Mbmbiqqp.exe
        356⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\Mhgkfkhl.exe
        
        C:\Windows\system32\Mhgkfkhl.exe
        357⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Mbpoop32.exe
        
        C:\Windows\system32\Mbpoop32.exe
        358⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Mhihkjfj.exe
        
        C:\Windows\system32\Mhihkjfj.exe
        359⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Nbbldp32.exe
        
        C:\Windows\system32\Nbbldp32.exe
        360⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3360

C:\Windows\SysWOW64\Nkjqme32.exe
C:\Windows\system32\Nkjqme32.exe
1⤵
PID:6088
- C:\Windows\SysWOW64\Nkmmbe32.exe
  C:\Windows\system32\Nkmmbe32.exe
  2⤵
  PID:6048
- - C:\Windows\SysWOW64\Neebkkgi.exe
    C:\Windows\system32\Neebkkgi.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:5848
  - - C:\Windows\SysWOW64\Nqlbqlmm.exe
      C:\Windows\system32\Nqlbqlmm.exe
      4⤵
      PID:5368
    - - C:\Windows\SysWOW64\Nombnc32.exe
        
        C:\Windows\system32\Nombnc32.exe
        5⤵
        
        PID:5948
      - C:\Windows\SysWOW64\Okcccdkp.exe
        
        C:\Windows\system32\Okcccdkp.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5420
        
        C:\Windows\SysWOW64\Oapllk32.exe
        
        C:\Windows\system32\Oapllk32.exe
        7⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Oabiak32.exe
        
        C:\Windows\system32\Oabiak32.exe
        8⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\Ongijo32.exe
        
        C:\Windows\system32\Ongijo32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5704
        
        C:\Windows\SysWOW64\Opfedb32.exe
        
        C:\Windows\system32\Opfedb32.exe
        10⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Oiojmgcb.exe
        
        C:\Windows\system32\Oiojmgcb.exe
        11⤵
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Ophbja32.exe
        
        C:\Windows\system32\Ophbja32.exe
        12⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Oeekbhif.exe
        
        C:\Windows\system32\Oeekbhif.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5940
        
        C:\Windows\SysWOW64\Ppkopail.exe
        
        C:\Windows\system32\Ppkopail.exe
        14⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Pnplqn32.exe
        
        C:\Windows\system32\Pnplqn32.exe
        15⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Piepnfnj.exe
        
        C:\Windows\system32\Piepnfnj.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6128
        
        C:\Windows\SysWOW64\Pnbifmla.exe
        
        C:\Windows\system32\Pnbifmla.exe
        17⤵
        
        PID:636
        
        C:\Windows\SysWOW64\Pihmcflg.exe
        
        C:\Windows\system32\Pihmcflg.exe
        18⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Pneelmjo.exe
        
        C:\Windows\system32\Pneelmjo.exe
        19⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Pijiif32.exe
        
        C:\Windows\system32\Pijiif32.exe
        20⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Pbbnbkpe.exe
        
        C:\Windows\system32\Pbbnbkpe.exe
        21⤵
        Drops file in System32 directory
        
        PID:5480
        
        C:\Windows\SysWOW64\Qimfoe32.exe
        
        C:\Windows\system32\Qimfoe32.exe
        22⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Qecgcfmf.exe
        
        C:\Windows\system32\Qecgcfmf.exe
        23⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Qpikao32.exe
        
        C:\Windows\system32\Qpikao32.exe
        24⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Aefcif32.exe
        
        C:\Windows\system32\Aefcif32.exe
        25⤵
        Modifies registry class
        
        PID:6052
        
        C:\Windows\SysWOW64\Alplfpbp.exe
        
        C:\Windows\system32\Alplfpbp.exe
        26⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Aehpof32.exe
        
        C:\Windows\system32\Aehpof32.exe
        27⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Aoqegk32.exe
        
        C:\Windows\system32\Aoqegk32.exe
        28⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Aified32.exe
        
        C:\Windows\system32\Aified32.exe
        29⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Aoenbkll.exe
        
        C:\Windows\system32\Aoenbkll.exe
        30⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Alioloje.exe
        
        C:\Windows\system32\Alioloje.exe
        31⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Bimoecio.exe
        
        C:\Windows\system32\Bimoecio.exe
        32⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Bajqpe32.exe
        
        C:\Windows\system32\Bajqpe32.exe
        33⤵
        Modifies registry class
        
        PID:8328
        
        C:\Windows\SysWOW64\Bplammmf.exe
        
        C:\Windows\system32\Bplammmf.exe
        34⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Cccppgcp.exe
        
        C:\Windows\system32\Cccppgcp.exe
        35⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Cpgqik32.exe
        
        C:\Windows\system32\Cpgqik32.exe
        36⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Chbenm32.exe
        
        C:\Windows\system32\Chbenm32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8540
        
        C:\Windows\SysWOW64\Cibagpgg.exe
        
        C:\Windows\system32\Cibagpgg.exe
        38⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Dcjfpfnh.exe
        
        C:\Windows\system32\Dcjfpfnh.exe
        39⤵
        Modifies registry class
        
        PID:8628
        
        C:\Windows\SysWOW64\Dhgoimlo.exe
        
        C:\Windows\system32\Dhgoimlo.exe
        40⤵
        Modifies registry class
        
        PID:8676
        
        C:\Windows\SysWOW64\Dekobaki.exe
        
        C:\Windows\system32\Dekobaki.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8720
        
        C:\Windows\SysWOW64\Dpqcoj32.exe
        
        C:\Windows\system32\Dpqcoj32.exe
        42⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Djihhoao.exe
        
        C:\Windows\system32\Djihhoao.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8816
        
        C:\Windows\SysWOW64\Dofpqfof.exe
        
        C:\Windows\system32\Dofpqfof.exe
        44⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8860
        
        C:\Windows\SysWOW64\Djkdnool.exe
        
        C:\Windows\system32\Djkdnool.exe
        45⤵
        
        PID:8904
        
        C:\Windows\SysWOW64\Dohmff32.exe
        
        C:\Windows\system32\Dohmff32.exe
        46⤵
        
        PID:8960
        
        C:\Windows\SysWOW64\Djnaco32.exe
        
        C:\Windows\system32\Djnaco32.exe
        47⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Dphipidf.exe
        
        C:\Windows\system32\Dphipidf.exe
        48⤵
        
        PID:9040
        
        C:\Windows\SysWOW64\Ebifha32.exe
        
        C:\Windows\system32\Ebifha32.exe
        49⤵
        
        PID:9088
        
        C:\Windows\SysWOW64\Elojej32.exe
        
        C:\Windows\system32\Elojej32.exe
        50⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Echbad32.exe
        
        C:\Windows\system32\Echbad32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9172
        
        C:\Windows\SysWOW64\Ejbknnid.exe
        
        C:\Windows\system32\Ejbknnid.exe
        52⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Efikco32.exe
        
        C:\Windows\system32\Efikco32.exe
        53⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Ecmlmcmb.exe
        
        C:\Windows\system32\Ecmlmcmb.exe
        54⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Eodlad32.exe
        
        C:\Windows\system32\Eodlad32.exe
        55⤵
        
        PID:8336
        
        C:\Windows\SysWOW64\Ehlakjig.exe
        
        C:\Windows\system32\Ehlakjig.exe
        56⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Fjlmdmqj.exe
        
        C:\Windows\system32\Fjlmdmqj.exe
        57⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Foifmcoa.exe
        
        C:\Windows\system32\Foifmcoa.exe
        58⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Fokbbcmo.exe
        
        C:\Windows\system32\Fokbbcmo.exe
        59⤵
        
        PID:8508
        
        C:\Windows\SysWOW64\Fmoclg32.exe
        
        C:\Windows\system32\Fmoclg32.exe
        60⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Ffjdjmpf.exe
        
        C:\Windows\system32\Ffjdjmpf.exe
        61⤵
        
        PID:8608
        
        C:\Windows\SysWOW64\Gbqeonfj.exe
        
        C:\Windows\system32\Gbqeonfj.exe
        62⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Godehbed.exe
        
        C:\Windows\system32\Godehbed.exe
        63⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Gjjjfkdj.exe
        
        C:\Windows\system32\Gjjjfkdj.exe
        64⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Gcbnopkj.exe
        
        C:\Windows\system32\Gcbnopkj.exe
        65⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8852
        
        C:\Windows\SysWOW64\Gfcgpkhk.exe
        
        C:\Windows\system32\Gfcgpkhk.exe
        66⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Gpkliaol.exe
        
        C:\Windows\system32\Gpkliaol.exe
        67⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Gjapfjnb.exe
        
        C:\Windows\system32\Gjapfjnb.exe
        68⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Hmaihekc.exe
        
        C:\Windows\system32\Hmaihekc.exe
        69⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Hboaql32.exe
        
        C:\Windows\system32\Hboaql32.exe
        70⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Hcnnjoam.exe
        
        C:\Windows\system32\Hcnnjoam.exe
        71⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\Hjhfgi32.exe
        
        C:\Windows\system32\Hjhfgi32.exe
        72⤵
        Modifies registry class
        
        PID:6828
        
        C:\Windows\SysWOW64\Hbcklkee.exe
        
        C:\Windows\system32\Hbcklkee.exe
        73⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Hadkib32.exe
        
        C:\Windows\system32\Hadkib32.exe
        74⤵
        Modifies registry class
        
        PID:6532
        
        C:\Windows\SysWOW64\Iippne32.exe
        
        C:\Windows\system32\Iippne32.exe
        75⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Ipihkobl.exe
        
        C:\Windows\system32\Ipihkobl.exe
        76⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Ijolhg32.exe
        
        C:\Windows\system32\Ijolhg32.exe
        77⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Ipldpo32.exe
        
        C:\Windows\system32\Ipldpo32.exe
        78⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Iffmmihf.exe
        
        C:\Windows\system32\Iffmmihf.exe
        79⤵
        Modifies registry class
        
        PID:6320
        
        C:\Windows\SysWOW64\Ipnaen32.exe
        
        C:\Windows\system32\Ipnaen32.exe
        80⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Iiffoc32.exe
        
        C:\Windows\system32\Iiffoc32.exe
        81⤵
        Drops file in System32 directory
        
        PID:6932
        
        C:\Windows\SysWOW64\Idljll32.exe
        
        C:\Windows\system32\Idljll32.exe
        82⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Ijfbhflj.exe
        
        C:\Windows\system32\Ijfbhflj.exe
        83⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Iapjeq32.exe
        
        C:\Windows\system32\Iapjeq32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8784
        
        C:\Windows\SysWOW64\Ibagmiie.exe
        
        C:\Windows\system32\Ibagmiie.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7052
        
        C:\Windows\SysWOW64\Jabgkpad.exe
        
        C:\Windows\system32\Jabgkpad.exe
        86⤵
        
        PID:8912

C:\Windows\SysWOW64\Jfopcgpk.exe
C:\Windows\system32\Jfopcgpk.exe
1⤵
PID:8988
- C:\Windows\SysWOW64\Jaddpppa.exe
  C:\Windows\system32\Jaddpppa.exe
  2⤵
  - Drops file in System32 directory
  PID:7148
- - C:\Windows\SysWOW64\Jbfphh32.exe
    C:\Windows\system32\Jbfphh32.exe
    3⤵
    PID:9100
  - - C:\Windows\SysWOW64\Jmkdeaee.exe
      C:\Windows\system32\Jmkdeaee.exe
      4⤵
      PID:6716
    - - C:\Windows\SysWOW64\Jdembk32.exe
        
        C:\Windows\system32\Jdembk32.exe
        5⤵
        
        PID:6280
      - C:\Windows\SysWOW64\Jjoeoedo.exe
        
        C:\Windows\system32\Jjoeoedo.exe
        6⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\Jdhigk32.exe
        
        C:\Windows\system32\Jdhigk32.exe
        7⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Jkaadebl.exe
        
        C:\Windows\system32\Jkaadebl.exe
        8⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Jaljaoii.exe
        
        C:\Windows\system32\Jaljaoii.exe
        9⤵
        Modifies registry class
        
        PID:8408
        
        C:\Windows\SysWOW64\Kfhbifgq.exe
        
        C:\Windows\system32\Kfhbifgq.exe
        10⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Kanffogf.exe
        
        C:\Windows\system32\Kanffogf.exe
        11⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\Kkfkod32.exe
        
        C:\Windows\system32\Kkfkod32.exe
        12⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Kpccgk32.exe
        
        C:\Windows\system32\Kpccgk32.exe
        13⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Kmgdaokh.exe
        
        C:\Windows\system32\Kmgdaokh.exe
        14⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Kcdmifip.exe
        
        C:\Windows\system32\Kcdmifip.exe
        15⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Kinefp32.exe
        
        C:\Windows\system32\Kinefp32.exe
        16⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Kkmapc32.exe
        
        C:\Windows\system32\Kkmapc32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8952
        
        C:\Windows\SysWOW64\Libnapmg.exe
        
        C:\Windows\system32\Libnapmg.exe
        18⤵
        Drops file in System32 directory
        
        PID:7164
        
        C:\Windows\SysWOW64\Lpmfnj32.exe
        
        C:\Windows\system32\Lpmfnj32.exe
        19⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Lkbkkbdj.exe
        
        C:\Windows\system32\Lkbkkbdj.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6748
        
        C:\Windows\SysWOW64\Lmqggncn.exe
        
        C:\Windows\system32\Lmqggncn.exe
        21⤵
        Modifies registry class
        
        PID:7124
        
        C:\Windows\SysWOW64\Lgikpc32.exe
        
        C:\Windows\system32\Lgikpc32.exe
        22⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Lpapiipo.exe
        
        C:\Windows\system32\Lpapiipo.exe
        23⤵
        
        PID:8828
        
        C:\Windows\SysWOW64\Laqlclga.exe
        
        C:\Windows\system32\Laqlclga.exe
        24⤵
        Drops file in System32 directory
        
        PID:6604
        
        C:\Windows\SysWOW64\Lgnekcei.exe
        
        C:\Windows\system32\Lgnekcei.exe
        25⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Lpfidh32.exe
        
        C:\Windows\system32\Lpfidh32.exe
        26⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Mgbnfb32.exe
        
        C:\Windows\system32\Mgbnfb32.exe
        27⤵
        Modifies registry class
        
        PID:8208
        
        C:\Windows\SysWOW64\Mahbck32.exe
        
        C:\Windows\system32\Mahbck32.exe
        28⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Mdfopf32.exe
        
        C:\Windows\system32\Mdfopf32.exe
        29⤵
        Drops file in System32 directory
        
        PID:6160
        
        C:\Windows\SysWOW64\Mkpglqgj.exe
        
        C:\Windows\system32\Mkpglqgj.exe
        30⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Mgggaamn.exe
        
        C:\Windows\system32\Mgggaamn.exe
        31⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8568
        
        C:\Windows\SysWOW64\Mncmck32.exe
        
        C:\Windows\system32\Mncmck32.exe
        32⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Ncpelbap.exe
        
        C:\Windows\system32\Ncpelbap.exe
        33⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Nneiikqe.exe
        
        C:\Windows\system32\Nneiikqe.exe
        34⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\Ncbaabom.exe
        
        C:\Windows\system32\Ncbaabom.exe
        35⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Ndbnkefp.exe
        
        C:\Windows\system32\Ndbnkefp.exe
        36⤵
        Modifies registry class
        
        PID:9024
        
        C:\Windows\SysWOW64\Ngbgmpcq.exe
        
        C:\Windows\system32\Ngbgmpcq.exe
        37⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Oqmhlego.exe
        
        C:\Windows\system32\Oqmhlego.exe
        38⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Oqpeaeel.exe
        
        C:\Windows\system32\Oqpeaeel.exe
        39⤵
        Drops file in System32 directory
        
        PID:8352
        
        C:\Windows\SysWOW64\Onceji32.exe
        
        C:\Windows\system32\Onceji32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6276
        
        C:\Windows\SysWOW64\Onfbpi32.exe
        
        C:\Windows\system32\Onfbpi32.exe
        41⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Okjbimal.exe
        
        C:\Windows\system32\Okjbimal.exe
        42⤵
        Modifies registry class
        
        PID:6996
        
        C:\Windows\SysWOW64\Obdkfg32.exe
        
        C:\Windows\system32\Obdkfg32.exe
        43⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Ojopki32.exe
        
        C:\Windows\system32\Ojopki32.exe
        44⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Pbhdafdd.exe
        
        C:\Windows\system32\Pbhdafdd.exe
        45⤵
        
        PID:9168
        
        C:\Windows\SysWOW64\Peimcaae.exe
        
        C:\Windows\system32\Peimcaae.exe
        46⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Pjffkhpl.exe
        
        C:\Windows\system32\Pjffkhpl.exe
        47⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\Peljha32.exe
        
        C:\Windows\system32\Peljha32.exe
        48⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Pbpjbe32.exe
        
        C:\Windows\system32\Pbpjbe32.exe
        49⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Pglcjl32.exe
        
        C:\Windows\system32\Pglcjl32.exe
        50⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Qnfkgfdp.exe
        
        C:\Windows\system32\Qnfkgfdp.exe
        51⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Qgopplkq.exe
        
        C:\Windows\system32\Qgopplkq.exe
        52⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Qagdia32.exe
        
        C:\Windows\system32\Qagdia32.exe
        53⤵
        
        PID:972
        
        C:\Windows\SysWOW64\Qlmhfj32.exe
        
        C:\Windows\system32\Qlmhfj32.exe
        54⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Abfqbdhd.exe
        
        C:\Windows\system32\Abfqbdhd.exe
        55⤵
        
        PID:1680
        
        C:\Windows\SysWOW64\Aegidp32.exe
        
        C:\Windows\system32\Aegidp32.exe
        56⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Alcofi32.exe
        
        C:\Windows\system32\Alcofi32.exe
        57⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\Aelcooap.exe
        
        C:\Windows\system32\Aelcooap.exe
        58⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Ajikhfpg.exe
        
        C:\Windows\system32\Ajikhfpg.exe
        59⤵
        Drops file in System32 directory
        
        PID:6208
        
        C:\Windows\SysWOW64\Aenpeoom.exe
        
        C:\Windows\system32\Aenpeoom.exe
        60⤵
        Drops file in System32 directory
        
        PID:7032
        
        C:\Windows\SysWOW64\Bbbpnc32.exe
        
        C:\Windows\system32\Bbbpnc32.exe
        61⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Blkdgheg.exe
        
        C:\Windows\system32\Blkdgheg.exe
        62⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Bdfilkbb.exe
        
        C:\Windows\system32\Bdfilkbb.exe
        63⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Boknic32.exe
        
        C:\Windows\system32\Boknic32.exe
        64⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Beefenie.exe
        
        C:\Windows\system32\Beefenie.exe
        65⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Bbifobho.exe
        
        C:\Windows\system32\Bbifobho.exe
        66⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Bdkbgj32.exe
        
        C:\Windows\system32\Bdkbgj32.exe
        67⤵
        Modifies registry class
        
        PID:7276
        
        C:\Windows\SysWOW64\Bblcda32.exe
        
        C:\Windows\system32\Bblcda32.exe
        68⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Chhkmh32.exe
        
        C:\Windows\system32\Chhkmh32.exe
        69⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Cobciblp.exe
        
        C:\Windows\system32\Cobciblp.exe
        70⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Cdolbijg.exe
        
        C:\Windows\system32\Cdolbijg.exe
        71⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Coepob32.exe
        
        C:\Windows\system32\Coepob32.exe
        72⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Chmehhpn.exe
        
        C:\Windows\system32\Chmehhpn.exe
        73⤵
        Drops file in System32 directory
        
        PID:6328
        
        C:\Windows\SysWOW64\Caeiam32.exe
        
        C:\Windows\system32\Caeiam32.exe
        74⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Chpangnk.exe
        
        C:\Windows\system32\Chpangnk.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7440
        
        C:\Windows\SysWOW64\Coijja32.exe
        
        C:\Windows\system32\Coijja32.exe
        76⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Clmjcfdb.exe
        
        C:\Windows\system32\Clmjcfdb.exe
        77⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7436
        
        C:\Windows\SysWOW64\Cajblmci.exe
        
        C:\Windows\system32\Cajblmci.exe
        78⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Dbjofp32.exe
        
        C:\Windows\system32\Dbjofp32.exe
        79⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Daolgl32.exe
        
        C:\Windows\system32\Daolgl32.exe
        80⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Dememj32.exe
        
        C:\Windows\system32\Dememj32.exe
        81⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Dcaefo32.exe
        
        C:\Windows\system32\Dcaefo32.exe
        82⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Dhnnoe32.exe
        
        C:\Windows\system32\Dhnnoe32.exe
        83⤵
        
        PID:6468
        
        C:\Windows\SysWOW64\Dogfkpih.exe
        
        C:\Windows\system32\Dogfkpih.exe
        84⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Eojcao32.exe
        
        C:\Windows\system32\Eojcao32.exe
        85⤵
        Drops file in System32 directory
        
        PID:7828
        
        C:\Windows\SysWOW64\Eedkniob.exe
        
        C:\Windows\system32\Eedkniob.exe
        86⤵
        
        PID:7872
        
        C:\Windows\SysWOW64\Eefhcimp.exe
        
        C:\Windows\system32\Eefhcimp.exe
        87⤵
        Drops file in System32 directory
        
        PID:7684
        
        C:\Windows\SysWOW64\Eamhhjbd.exe
        
        C:\Windows\system32\Eamhhjbd.exe
        88⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Elbmebbj.exe
        
        C:\Windows\system32\Elbmebbj.exe
        89⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Eaoenjqa.exe
        
        C:\Windows\system32\Eaoenjqa.exe
        90⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7520
        
        C:\Windows\SysWOW64\Eleikb32.exe
        
        C:\Windows\system32\Eleikb32.exe
        91⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Eaabci32.exe
        
        C:\Windows\system32\Eaabci32.exe
        92⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Foebmn32.exe
        
        C:\Windows\system32\Foebmn32.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7400
        
        C:\Windows\SysWOW64\Fhngfcdi.exe
        
        C:\Windows\system32\Fhngfcdi.exe
        94⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\Fcckcl32.exe
        
        C:\Windows\system32\Fcckcl32.exe
        95⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Fkopgn32.exe
        
        C:\Windows\system32\Fkopgn32.exe
        96⤵
        Drops file in System32 directory
        
        PID:6068
        
        C:\Windows\SysWOW64\Fbihdhhf.exe
        
        C:\Windows\system32\Fbihdhhf.exe
        97⤵
        
        PID:7536

C:\Windows\SysWOW64\Flnlaahl.exe
C:\Windows\system32\Flnlaahl.exe
1⤵
PID:7336
- C:\Windows\SysWOW64\Glcelq32.exe
  C:\Windows\system32\Glcelq32.exe
  2⤵
  PID:8064
- - C:\Windows\SysWOW64\Gfkjef32.exe
    C:\Windows\system32\Gfkjef32.exe
    3⤵
    PID:7796
  - - C:\Windows\SysWOW64\Ghlcga32.exe
      C:\Windows\system32\Ghlcga32.exe
      4⤵
      Drops file in System32 directory
      PID:7688
    - - C:\Windows\SysWOW64\Gkmlilej.exe
        
        C:\Windows\system32\Gkmlilej.exe
        5⤵
        
        PID:7280
      - C:\Windows\SysWOW64\Gdeqaa32.exe
        
        C:\Windows\system32\Gdeqaa32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7460
        
        C:\Windows\SysWOW64\Hfemkdbm.exe
        
        C:\Windows\system32\Hfemkdbm.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7556
        
        C:\Windows\SysWOW64\Hkaedk32.exe
        
        C:\Windows\system32\Hkaedk32.exe
        8⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\Hfgjad32.exe
        
        C:\Windows\system32\Hfgjad32.exe
        9⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Hbnjfefo.exe
        
        C:\Windows\system32\Hbnjfefo.exe
        10⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Hoakpi32.exe
        
        C:\Windows\system32\Hoakpi32.exe
        11⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Icbpkg32.exe
        
        C:\Windows\system32\Icbpkg32.exe
        12⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Ikmepj32.exe
        
        C:\Windows\system32\Ikmepj32.exe
        13⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\Icgjfgef.exe
        
        C:\Windows\system32\Icgjfgef.exe
        14⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Iejcco32.exe
        
        C:\Windows\system32\Iejcco32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7468
        
        C:\Windows\SysWOW64\Ippgqg32.exe
        
        C:\Windows\system32\Ippgqg32.exe
        16⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\Iihkjm32.exe
        
        C:\Windows\system32\Iihkjm32.exe
        17⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Jcnpgf32.exe
        
        C:\Windows\system32\Jcnpgf32.exe
        18⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Jmfdpkeo.exe
        
        C:\Windows\system32\Jmfdpkeo.exe
        19⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Jbcmhb32.exe
        
        C:\Windows\system32\Jbcmhb32.exe
        20⤵
        
        PID:3228
        
        C:\Windows\SysWOW64\Jimeelkc.exe
        
        C:\Windows\system32\Jimeelkc.exe
        21⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Jioajliq.exe
        
        C:\Windows\system32\Jioajliq.exe
        22⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Jbgfca32.exe
        
        C:\Windows\system32\Jbgfca32.exe
        23⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Jpkfmfok.exe
        
        C:\Windows\system32\Jpkfmfok.exe
        24⤵
        Modifies registry class
        
        PID:7788
        
        C:\Windows\SysWOW64\Jmpgfjmd.exe
        
        C:\Windows\system32\Jmpgfjmd.exe
        25⤵
        Drops file in System32 directory
        
        PID:7864
        
        C:\Windows\SysWOW64\Kdiobd32.exe
        
        C:\Windows\system32\Kdiobd32.exe
        26⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Kekljlkp.exe
        
        C:\Windows\system32\Kekljlkp.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7380
        
        C:\Windows\SysWOW64\Kppphe32.exe
        
        C:\Windows\system32\Kppphe32.exe
        28⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Kfjhdobb.exe
        
        C:\Windows\system32\Kfjhdobb.exe
        29⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Kpbmme32.exe
        
        C:\Windows\system32\Kpbmme32.exe
        30⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Kdqecc32.exe
        
        C:\Windows\system32\Kdqecc32.exe
        31⤵
        
        PID:7668
        
        C:\Windows\SysWOW64\Kimnlj32.exe
        
        C:\Windows\system32\Kimnlj32.exe
        32⤵
        Modifies registry class
        
        PID:4544
        
        C:\Windows\SysWOW64\Kedoqkbe.exe
        
        C:\Windows\system32\Kedoqkbe.exe
        33⤵
        Drops file in System32 directory
        
        PID:7620
        
        C:\Windows\SysWOW64\Lbhojo32.exe
        
        C:\Windows\system32\Lbhojo32.exe
        34⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Libggiik.exe
        
        C:\Windows\system32\Libggiik.exe
        35⤵
        
        PID:7584
        
        C:\Windows\SysWOW64\Lplpcc32.exe
        
        C:\Windows\system32\Lplpcc32.exe
        36⤵
        
        PID:1688
        
        C:\Windows\SysWOW64\Liddligi.exe
        
        C:\Windows\system32\Liddligi.exe
        37⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Lfhdem32.exe
        
        C:\Windows\system32\Lfhdem32.exe
        38⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Llemnd32.exe
        
        C:\Windows\system32\Llemnd32.exe
        39⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Lboeknkf.exe
        
        C:\Windows\system32\Lboeknkf.exe
        40⤵
        
        PID:9416
        
        C:\Windows\SysWOW64\Lmdihgkl.exe
        
        C:\Windows\system32\Lmdihgkl.exe
        41⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Ldoadabi.exe
        
        C:\Windows\system32\Ldoadabi.exe
        42⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Mmgfmg32.exe
        
        C:\Windows\system32\Mmgfmg32.exe
        43⤵
        Drops file in System32 directory
        
        PID:9544
        
        C:\Windows\SysWOW64\Mccofn32.exe
        
        C:\Windows\system32\Mccofn32.exe
        44⤵
        
        PID:9596
        
        C:\Windows\SysWOW64\Mingbhon.exe
        
        C:\Windows\system32\Mingbhon.exe
        45⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Mcfkkmeo.exe
        
        C:\Windows\system32\Mcfkkmeo.exe
        46⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Mmlphfed.exe
        
        C:\Windows\system32\Mmlphfed.exe
        47⤵
        
        PID:9724
        
        C:\Windows\SysWOW64\Mchhamcl.exe
        
        C:\Windows\system32\Mchhamcl.exe
        48⤵
        
        PID:9772
        
        C:\Windows\SysWOW64\Mplhjabe.exe
        
        C:\Windows\system32\Mplhjabe.exe
        49⤵
        
        PID:9816
        
        C:\Windows\SysWOW64\Midmcgif.exe
        
        C:\Windows\system32\Midmcgif.exe
        50⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Nigjifgc.exe
        
        C:\Windows\system32\Nigjifgc.exe
        51⤵
        
        PID:9920
        
        C:\Windows\SysWOW64\Npabeq32.exe
        
        C:\Windows\system32\Npabeq32.exe
        52⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Nenjng32.exe
        
        C:\Windows\system32\Nenjng32.exe
        53⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Npcokpln.exe
        
        C:\Windows\system32\Npcokpln.exe
        54⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10052
        
        C:\Windows\SysWOW64\Ngmggj32.exe
        
        C:\Windows\system32\Ngmggj32.exe
        55⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Ndagao32.exe
        
        C:\Windows\system32\Ndagao32.exe
        56⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Nebdighb.exe
        
        C:\Windows\system32\Nebdighb.exe
        57⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Nllleapo.exe
        
        C:\Windows\system32\Nllleapo.exe
        58⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Njploeoi.exe
        
        C:\Windows\system32\Njploeoi.exe
        59⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Ndfqlnno.exe
        
        C:\Windows\system32\Ndfqlnno.exe
        60⤵
        
        PID:9288
        
        C:\Windows\SysWOW64\Ojcidelf.exe
        
        C:\Windows\system32\Ojcidelf.exe
        61⤵
        Modifies registry class
        
        PID:7944
        
        C:\Windows\SysWOW64\Opmaaodc.exe
        
        C:\Windows\system32\Opmaaodc.exe
        62⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Ofijifbj.exe
        
        C:\Windows\system32\Ofijifbj.exe
        63⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Opongobp.exe
        
        C:\Windows\system32\Opongobp.exe
        64⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Ocmjcjad.exe
        
        C:\Windows\system32\Ocmjcjad.exe
        65⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Oncopcqj.exe
        
        C:\Windows\system32\Oncopcqj.exe
        66⤵
        
        PID:4564
        
        C:\Windows\SysWOW64\Ocpghj32.exe
        
        C:\Windows\system32\Ocpghj32.exe
        67⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Odocbmfd.exe
        
        C:\Windows\system32\Odocbmfd.exe
        68⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9708
        
        C:\Windows\SysWOW64\Onhhkb32.exe
        
        C:\Windows\system32\Onhhkb32.exe
        69⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\Pfcmpdjp.exe
        
        C:\Windows\system32\Pfcmpdjp.exe
        70⤵
        
        PID:9848
        
        C:\Windows\SysWOW64\Pgbijg32.exe
        
        C:\Windows\system32\Pgbijg32.exe
        71⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9912
        
        C:\Windows\SysWOW64\Pdfjcl32.exe
        
        C:\Windows\system32\Pdfjcl32.exe
        72⤵
        
        PID:9984
        
        C:\Windows\SysWOW64\Pmangnmg.exe
        
        C:\Windows\system32\Pmangnmg.exe
        73⤵
        
        PID:10044
        
        C:\Windows\SysWOW64\Pckfdh32.exe
        
        C:\Windows\system32\Pckfdh32.exe
        74⤵
        
        PID:10116
        
        C:\Windows\SysWOW64\Pmdkmnkd.exe
        
        C:\Windows\system32\Pmdkmnkd.exe
        75⤵
        Modifies registry class
        
        PID:10172
        
        C:\Windows\SysWOW64\Pgiojf32.exe
        
        C:\Windows\system32\Pgiojf32.exe
        76⤵
        
        PID:10232
        
        C:\Windows\SysWOW64\Pmfhbm32.exe
        
        C:\Windows\system32\Pmfhbm32.exe
        77⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Qfolkcpb.exe
        
        C:\Windows\system32\Qfolkcpb.exe
        78⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9316 -s 404
        79⤵
        Program crash
        
        PID:4320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 9316 -ip 9316
1⤵
PID:2000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abpcja32.exe

Filesize
325KB

MD5
6fa6f5523b1db3606fd2dd21bd855755

SHA1
863a66c01c2ce3a1f4c9dd0b5182f4c7be3c264d

SHA256
2aeb1827f7517e1bbb19790e042509797326aac1d19ffdaf9d4f91578a870f12

SHA512
987b7c8834d6e39764212359cd20217d669952f6f3608b380398298bc6ec652f3f7e5266259f743c7897015f13face50b178d748cfcf72c37abc10f49b5d3f1c

Download Submit
C:\Windows\SysWOW64\Abpcja32.exe

Filesize
325KB

MD5
6fa6f5523b1db3606fd2dd21bd855755

SHA1
863a66c01c2ce3a1f4c9dd0b5182f4c7be3c264d

SHA256
2aeb1827f7517e1bbb19790e042509797326aac1d19ffdaf9d4f91578a870f12

SHA512
987b7c8834d6e39764212359cd20217d669952f6f3608b380398298bc6ec652f3f7e5266259f743c7897015f13face50b178d748cfcf72c37abc10f49b5d3f1c

Download Submit
C:\Windows\SysWOW64\Acppddig.exe

Filesize
325KB

MD5
d03384ab431a0dbcc21d8ee528722131

SHA1
ba6c160a0efd520dff915858bfac63d1e8966f9c

SHA256
1f4fe078352241d1c8d14cc3721883063350739925276145b58bea9a8e23f4fe

SHA512
737f6ae9a6b6f3a9b11408935dcf17c9f36863f1562a4aff87759f7c211fa9b25c2c582fa8d3f83e4c097246c9bd1a9edb0cbf16e7801cf01fc1980a7eb20bfe

Download Submit
C:\Windows\SysWOW64\Acppddig.exe

Filesize
325KB

MD5
d03384ab431a0dbcc21d8ee528722131

SHA1
ba6c160a0efd520dff915858bfac63d1e8966f9c

SHA256
1f4fe078352241d1c8d14cc3721883063350739925276145b58bea9a8e23f4fe

SHA512
737f6ae9a6b6f3a9b11408935dcf17c9f36863f1562a4aff87759f7c211fa9b25c2c582fa8d3f83e4c097246c9bd1a9edb0cbf16e7801cf01fc1980a7eb20bfe

Download Submit
C:\Windows\SysWOW64\Aimhmkgn.exe

Filesize
325KB

MD5
fb7760480459f350a6b8b8515089d5b3

SHA1
e3b5f8c4c34af065a4d5a6eecbd0d6b62f134ccb

SHA256
de2ba2cf3a1d252626f6e55474cc391039f581b447216a58c2111e771c87525a

SHA512
773d2269f5efe60fe2a708512657bea7ffbd0e8328469583fbf0bb5a67430e108117629cc4d7229d07fb894f0c82049101869046333564af36938c6cd66c8ebf

Download Submit
C:\Windows\SysWOW64\Aimhmkgn.exe

Filesize
325KB

MD5
fb7760480459f350a6b8b8515089d5b3

SHA1
e3b5f8c4c34af065a4d5a6eecbd0d6b62f134ccb

SHA256
de2ba2cf3a1d252626f6e55474cc391039f581b447216a58c2111e771c87525a

SHA512
773d2269f5efe60fe2a708512657bea7ffbd0e8328469583fbf0bb5a67430e108117629cc4d7229d07fb894f0c82049101869046333564af36938c6cd66c8ebf

Download Submit
C:\Windows\SysWOW64\Aioebj32.exe

Filesize
325KB

MD5
b4558ed37d26f242327ce0edf7cb7963

SHA1
0e0cff1ef3b575e814af0c23c48a8b111080a352

SHA256
bdabdcd5ae0d6d6df83aa8a5b1ffe203aabdf575f7b1933e12af456256853316

SHA512
67d0d5c48cd859ad1bce1db719a3e51091f10bbd717101ec32272a90ce962720fa2a4aabe12aa9777d8a632340c79627c9e84120bf0971f04f87b2f297bfee5c

Download Submit
C:\Windows\SysWOW64\Aioebj32.exe

Filesize
325KB

MD5
b4558ed37d26f242327ce0edf7cb7963

SHA1
0e0cff1ef3b575e814af0c23c48a8b111080a352

SHA256
bdabdcd5ae0d6d6df83aa8a5b1ffe203aabdf575f7b1933e12af456256853316

SHA512
67d0d5c48cd859ad1bce1db719a3e51091f10bbd717101ec32272a90ce962720fa2a4aabe12aa9777d8a632340c79627c9e84120bf0971f04f87b2f297bfee5c

Download Submit
C:\Windows\SysWOW64\Alpnde32.exe

Filesize
325KB

MD5
2e74dfd8fe082252dcbf8798324d8577

SHA1
55f7ea386cf8025f935618ed4c29fb84af23f4ca

SHA256
7b3ff71094f1369d95db493748b82a8e88189a2ec0d8e70c00a63ab9bb3eb04d

SHA512
3182938387931b93aacc17d8acf6242d9429d823afb4a2233157e714a37aee536b98729381d4f9a94e760418e4b3c6e2f88701dcae9875ddeafcb4097badfa59

Download Submit
C:\Windows\SysWOW64\Alpnde32.exe

Filesize
325KB

MD5
2e74dfd8fe082252dcbf8798324d8577

SHA1
55f7ea386cf8025f935618ed4c29fb84af23f4ca

SHA256
7b3ff71094f1369d95db493748b82a8e88189a2ec0d8e70c00a63ab9bb3eb04d

SHA512
3182938387931b93aacc17d8acf6242d9429d823afb4a2233157e714a37aee536b98729381d4f9a94e760418e4b3c6e2f88701dcae9875ddeafcb4097badfa59

Download Submit
C:\Windows\SysWOW64\Amoknh32.exe

Filesize
325KB

MD5
abecb6b854b12500fbb373041945693d

SHA1
cf44e52ce2bb3af318a4146c780610859f08f580

SHA256
eb1b56dd1aeed46b00a8caad0c820f5acd96d326c0cbb5b5c3f7616eb9de7b66

SHA512
2c5a3352ff56047764cf224a81b4b79375a7882a79b8f85703d54a65f7d77a48c8b8264a8bb5438f324ac059e0966980a7ce09cb8f0047296f1a2a680552c85d

Download Submit
C:\Windows\SysWOW64\Amoknh32.exe

Filesize
325KB

MD5
abecb6b854b12500fbb373041945693d

SHA1
cf44e52ce2bb3af318a4146c780610859f08f580

SHA256
eb1b56dd1aeed46b00a8caad0c820f5acd96d326c0cbb5b5c3f7616eb9de7b66

SHA512
2c5a3352ff56047764cf224a81b4b79375a7882a79b8f85703d54a65f7d77a48c8b8264a8bb5438f324ac059e0966980a7ce09cb8f0047296f1a2a680552c85d

Download Submit
C:\Windows\SysWOW64\Bqpbboeg.exe

Filesize
325KB

MD5
d72b553012c0d72a5b7c138b573e674d

SHA1
497b0323e0d6dba3ef651b9a447b12d971ac4c11

SHA256
5596ea224e6efc67f5602c6e9ebbac9a4ca95066d0cb2405c63e8caf8e20e148

SHA512
a3cb3e7cf0971caa387172ac8670efcd47a778687e318dec1f08e66b871163ce50dfb0252ef8bc19b2a701aed3965de8faef7e5d88dae78394d129998a91a5eb

Download Submit
C:\Windows\SysWOW64\Cbglgg32.exe

Filesize
325KB

MD5
a316b9eddd7ba3262cd64f6edd489cb9

SHA1
c5406197261fa392a220d2bcef39a973b325e986

SHA256
55a3d13a672df3a40895e546ddbb2542696642280bea7818d505d7852f30e38a

SHA512
80eeb91c3e7ad5f57e7527f9e4938e7ecad2eaeb875ee6fcb4455983a7919e1e9dd2af22a55f5cf1eac76d09ed2847e26eec951b3d25c1d3e4b083c56778c77c

Download Submit
C:\Windows\SysWOW64\Cbihmg32.exe

Filesize
325KB

MD5
62a103cc25083ff8295a095789a4fb1e

SHA1
674d6864d5f57603bcb6e8d66df58b2709e6aea0

SHA256
6af5525ac062a73f2e159eb0fc1f24ebf8963d120edf471a252beda9ba3b8cd8

SHA512
6dffcad592cb748d7cec8200340c88cc527ef582189ee6330ea8388156c19d18c4b33f3b159fab407bd5d9815cdcf1db898a7dae709b1ed3c921724acc1edc1d

Download Submit
C:\Windows\SysWOW64\Ddekmo32.exe

Filesize
325KB

MD5
70cb013414c3d422975c91c58ef3b9b9

SHA1
c32be7f3f7fd9195703893d1cfa5bbf37b4545a6

SHA256
f34e0c2955f410dfdf47b35eb138f3d57ac02bb0c6aa589cfef6c99d0f17bba0

SHA512
3384dd6ca92b7d277757f59dbfd8f77da1213cdc4e46ad88c4bee1c5c0cbc75cf5319c22d4019bb05f9ac0f2197fa1b39e5b8f05eab173f231bfbd0f1f049245

Download Submit
C:\Windows\SysWOW64\Ddekmo32.exe

Filesize
325KB

MD5
70cb013414c3d422975c91c58ef3b9b9

SHA1
c32be7f3f7fd9195703893d1cfa5bbf37b4545a6

SHA256
f34e0c2955f410dfdf47b35eb138f3d57ac02bb0c6aa589cfef6c99d0f17bba0

SHA512
3384dd6ca92b7d277757f59dbfd8f77da1213cdc4e46ad88c4bee1c5c0cbc75cf5319c22d4019bb05f9ac0f2197fa1b39e5b8f05eab173f231bfbd0f1f049245

Download Submit
C:\Windows\SysWOW64\Dlqpaafg.exe

Filesize
325KB

MD5
5e016df29338ac64ef43e5746b475c6d

SHA1
acc020948e07a52b6f81c3312233539ef19cf2ab

SHA256
a2cc505e0860daa809473daec2bb6a54d72584d093e5e10a3e03a1765378d918

SHA512
fbb7e4b9bfb8e779cca76764302b7194aa017aebafc4d2aa8f3d77b136eb3937d6b3061cb8cc486402d60d73f92d126457a7650288c54aeaff4cdca517cb293d

Download Submit
C:\Windows\SysWOW64\Dlqpaafg.exe

Filesize
325KB

MD5
5e016df29338ac64ef43e5746b475c6d

SHA1
acc020948e07a52b6f81c3312233539ef19cf2ab

SHA256
a2cc505e0860daa809473daec2bb6a54d72584d093e5e10a3e03a1765378d918

SHA512
fbb7e4b9bfb8e779cca76764302b7194aa017aebafc4d2aa8f3d77b136eb3937d6b3061cb8cc486402d60d73f92d126457a7650288c54aeaff4cdca517cb293d

Download Submit
C:\Windows\SysWOW64\Dlqpaafg.exe

Filesize
325KB

MD5
5e016df29338ac64ef43e5746b475c6d

SHA1
acc020948e07a52b6f81c3312233539ef19cf2ab

SHA256
a2cc505e0860daa809473daec2bb6a54d72584d093e5e10a3e03a1765378d918

SHA512
fbb7e4b9bfb8e779cca76764302b7194aa017aebafc4d2aa8f3d77b136eb3937d6b3061cb8cc486402d60d73f92d126457a7650288c54aeaff4cdca517cb293d

Download Submit
C:\Windows\SysWOW64\Fbhnec32.exe

Filesize
325KB

MD5
c39dec8d474c7bc873acd860fbf0bced

SHA1
06dbb5912f19de8b0f7f2fcde2d3af54bbc94c6d

SHA256
6192ae6d1880acc29b0595c4e78f9122f15013957c0337e4d251cfafa70f5d6c

SHA512
9fe00cc3fb8cd31311d665873629b83e9269e88f405567e0cc70c58796a2478da51e747d0785f53acca952c6a7050fd38ed972015bef6872d6fbc579936cb739

Download Submit
C:\Windows\SysWOW64\Fgkfqgce.exe

Filesize
325KB

MD5
2f7ea26d0380e3d24189c80feaef1ba8

SHA1
0c6bbe3650cd3421536c1a14b61ead9ba0ec487e

SHA256
8eada35fd4c75e7b166ecab928f98d4633f0a8fc9b13806b80b4909dfa0907f6

SHA512
fb74543d6612fb565905d127ded6d70a15552398999a07d1e456005fde7d1866969002f19e3f178a475a769dc01d14a0f8b77e9d77b09972b295ce13559c683e

Download Submit
C:\Windows\SysWOW64\Fgkfqgce.exe

Filesize
325KB

MD5
2f7ea26d0380e3d24189c80feaef1ba8

SHA1
0c6bbe3650cd3421536c1a14b61ead9ba0ec487e

SHA256
8eada35fd4c75e7b166ecab928f98d4633f0a8fc9b13806b80b4909dfa0907f6

SHA512
fb74543d6612fb565905d127ded6d70a15552398999a07d1e456005fde7d1866969002f19e3f178a475a769dc01d14a0f8b77e9d77b09972b295ce13559c683e

Download Submit
C:\Windows\SysWOW64\Flodilma.exe

Filesize
325KB

MD5
73e50d8152a1b5a3dbce6a60668ec9c4

SHA1
cb370838b44af7f5edd41f4323eaa9c9deb55ac4

SHA256
1b44425d8e88c721198a48dfa65885cc2e4b4b749956c04d700a3ba2edcfed4d

SHA512
56b6e698e306c67de9f8e698df0cab906549100ab854d9df9171d61765a7040a68a3a5f2b74ceb335239e136f6c8fe7f97fbaed24fe9209790d3355e79321483

Download Submit
C:\Windows\SysWOW64\Gfgjbb32.exe

Filesize
325KB

MD5
9c40cf469daef9d2486d60b8cc401aae

SHA1
7ed2e1a21c8e9fe5d2a4bd0b7ace490ed8b7eddc

SHA256
6be51f1820d72d1adce729eb879b400bf0fbf8125254512b4266913cd612f96f

SHA512
9d4cfbeda5dd043762177acffd0afcb84dffd00cf4628554837a66063ab7f1e1c5190873ec737b826808c8f533dfb64ffaf2dd77216dedeb43a911dc69746a79

Download Submit
C:\Windows\SysWOW64\Gfgjbb32.exe

Filesize
325KB

MD5
9c40cf469daef9d2486d60b8cc401aae

SHA1
7ed2e1a21c8e9fe5d2a4bd0b7ace490ed8b7eddc

SHA256
6be51f1820d72d1adce729eb879b400bf0fbf8125254512b4266913cd612f96f

SHA512
9d4cfbeda5dd043762177acffd0afcb84dffd00cf4628554837a66063ab7f1e1c5190873ec737b826808c8f533dfb64ffaf2dd77216dedeb43a911dc69746a79

Download Submit
C:\Windows\SysWOW64\Ggicbe32.exe

Filesize
325KB

MD5
05371d27ec6cfba65b4a37f7b54ec7b5

SHA1
ee2d9d557e4dc0fe0104f812b1bccf8b45eb18e3

SHA256
f641fe8dd23cc128a1bc89e7f27e68095145c8eceaf4a683da2fec9f5f48a396

SHA512
41aee71cc2c12f178ba5e1d60cdb7f88a6d06f65b79cf3452673e3f38b598b50d8cf1daad2fc4fd424577f1ddf03c3cbf00545a385963fa77a0be743d00f3a41

Download Submit
C:\Windows\SysWOW64\Ggicbe32.exe

Filesize
325KB

MD5
05371d27ec6cfba65b4a37f7b54ec7b5

SHA1
ee2d9d557e4dc0fe0104f812b1bccf8b45eb18e3

SHA256
f641fe8dd23cc128a1bc89e7f27e68095145c8eceaf4a683da2fec9f5f48a396

SHA512
41aee71cc2c12f178ba5e1d60cdb7f88a6d06f65b79cf3452673e3f38b598b50d8cf1daad2fc4fd424577f1ddf03c3cbf00545a385963fa77a0be743d00f3a41

Download Submit
C:\Windows\SysWOW64\Gjqinamq.exe

Filesize
325KB

MD5
acf34f90627f3beb04710a1d0f045d66

SHA1
193ffab2e17b5bec14527a86f2e6a26bcec16aa6

SHA256
d4918911243e48801fdc28186633287c218f62601e14f0c486c44ef5d5d96aab

SHA512
1c6bf596d59d7b6b1fbdaebb6bb138a8a34bcb4c0d757d456440e6dbba696785b1b149af945d2fedbc0f158544cb2826cc01532a291222b9e5640163a54319e8

Download Submit
C:\Windows\SysWOW64\Gjqinamq.exe

Filesize
325KB

MD5
acf34f90627f3beb04710a1d0f045d66

SHA1
193ffab2e17b5bec14527a86f2e6a26bcec16aa6

SHA256
d4918911243e48801fdc28186633287c218f62601e14f0c486c44ef5d5d96aab

SHA512
1c6bf596d59d7b6b1fbdaebb6bb138a8a34bcb4c0d757d456440e6dbba696785b1b149af945d2fedbc0f158544cb2826cc01532a291222b9e5640163a54319e8

Download Submit
C:\Windows\SysWOW64\Gnjhhpgl.exe

Filesize
325KB

MD5
5233b0423e49b53a4d815295430222eb

SHA1
4a322ac1e3131d3111e0e80160d307c6cd75a0ee

SHA256
827cabeb4faafb660ee1c33ef54c05bec366d3e292f6bcc57ca61e50e6271a69

SHA512
689296f1f809595f58e51683756091b3ef8f8072d4037ee18a732ade05664774d0cbbca264df90d5dd84c7b7144cd57bf16d99239f0fe0f413ac23b189564458

Download Submit
C:\Windows\SysWOW64\Gnjhhpgl.exe

Filesize
325KB

MD5
5233b0423e49b53a4d815295430222eb

SHA1
4a322ac1e3131d3111e0e80160d307c6cd75a0ee

SHA256
827cabeb4faafb660ee1c33ef54c05bec366d3e292f6bcc57ca61e50e6271a69

SHA512
689296f1f809595f58e51683756091b3ef8f8072d4037ee18a732ade05664774d0cbbca264df90d5dd84c7b7144cd57bf16d99239f0fe0f413ac23b189564458

Download Submit
C:\Windows\SysWOW64\Gqokekph.exe

Filesize
325KB

MD5
ff3099ee905c07e7d668693e10b19d22

SHA1
2fec03a031590d832a7c1687ef826f79e87c3b4f

SHA256
b9011cb15530fb4722897005ad358601b0acaf4686e6a99b123bc94d1ea2109b

SHA512
c34b2919cea5f05248d6231eb7e12e9c02406bed782c74bf4c2a3508d1647227da74c8e2143adbebd26d6a45d230cad72bea77b60a974721841389acb04a13ce

Download Submit
C:\Windows\SysWOW64\Gqokekph.exe

Filesize
325KB

MD5
ff3099ee905c07e7d668693e10b19d22

SHA1
2fec03a031590d832a7c1687ef826f79e87c3b4f

SHA256
b9011cb15530fb4722897005ad358601b0acaf4686e6a99b123bc94d1ea2109b

SHA512
c34b2919cea5f05248d6231eb7e12e9c02406bed782c74bf4c2a3508d1647227da74c8e2143adbebd26d6a45d230cad72bea77b60a974721841389acb04a13ce

Download Submit
C:\Windows\SysWOW64\Hcembe32.exe

Filesize
325KB

MD5
cc50d6b2b5c477a534d00b29b1f9013f

SHA1
8e812ff78caf29de13fccc76ab08a5f858796fd7

SHA256
62ed9aed7bafe6ae55ec2f4372475b23f410e298b058b5cff902e3757c0da69a

SHA512
14f2a8407dd3b206ef7ac89feb6f39ec2d3cd073a1aea69ee36a1c8fa461770795e09aacb39f63f68e8d332378c81d44cdcb2deee181819684c6032bb8878a99

Download Submit
C:\Windows\SysWOW64\Hcembe32.exe

Filesize
325KB

MD5
cc50d6b2b5c477a534d00b29b1f9013f

SHA1
8e812ff78caf29de13fccc76ab08a5f858796fd7

SHA256
62ed9aed7bafe6ae55ec2f4372475b23f410e298b058b5cff902e3757c0da69a

SHA512
14f2a8407dd3b206ef7ac89feb6f39ec2d3cd073a1aea69ee36a1c8fa461770795e09aacb39f63f68e8d332378c81d44cdcb2deee181819684c6032bb8878a99

Download Submit
C:\Windows\SysWOW64\Hdffah32.exe

Filesize
325KB

MD5
7c912fe942c4eec42ad3b8f71715e2c3

SHA1
c131a94597d7ab89536633a3116697557559a1ea

SHA256
7f469b310cf377e4a7fbd47c4510290c61c13451507fe39c8c665e032638f258

SHA512
aab268ad864e755476f76218c20785dd69045d11035cdee35dfff28308bf62053363d6083a194fedfa6e0e7b2230c14dcedd0bc79745ebe2051455f4c8f32f06

Download Submit
C:\Windows\SysWOW64\Hdffah32.exe

Filesize
325KB

MD5
7c912fe942c4eec42ad3b8f71715e2c3

SHA1
c131a94597d7ab89536633a3116697557559a1ea

SHA256
7f469b310cf377e4a7fbd47c4510290c61c13451507fe39c8c665e032638f258

SHA512
aab268ad864e755476f76218c20785dd69045d11035cdee35dfff28308bf62053363d6083a194fedfa6e0e7b2230c14dcedd0bc79745ebe2051455f4c8f32f06

Download Submit
C:\Windows\SysWOW64\Hqddqj32.exe

Filesize
325KB

MD5
c16d875849246d5d1330df12669260ea

SHA1
787d9c187d81d9c75ce31dd7b06050d9e1d7d063

SHA256
afe4f1f74f0b895ee46b450654aabae269cd2a01dbc7c7933ae35c85760e4349

SHA512
591919ccb5a1f83f49f86edfffe4e495f50499808c9ec72021f17ee06fd2b79683ffa4f30ca4f2606d08111b579661ed8f01e87fe2fd2deca35df9a51fd1f324

Download Submit
C:\Windows\SysWOW64\Hqddqj32.exe

Filesize
325KB

MD5
c16d875849246d5d1330df12669260ea

SHA1
787d9c187d81d9c75ce31dd7b06050d9e1d7d063

SHA256
afe4f1f74f0b895ee46b450654aabae269cd2a01dbc7c7933ae35c85760e4349

SHA512
591919ccb5a1f83f49f86edfffe4e495f50499808c9ec72021f17ee06fd2b79683ffa4f30ca4f2606d08111b579661ed8f01e87fe2fd2deca35df9a51fd1f324

Download Submit
C:\Windows\SysWOW64\Hqimlihn.exe

Filesize
325KB

MD5
9d2dcc67764f9b59a254773fa04a0997

SHA1
705a143926d02614044f06c540d72f5368880495

SHA256
1f95a9c7f688a62be8bc3973b469986af01424f2fcf3ae6edbb9d95adf9aeb48

SHA512
9d074db4a509c9b6a073d8041479988efb2f3400374d06636d3db611f34016e952337c1984276120b1e8bc9478afdebd87358084056ff644ee4b798ef9e5600f

Download Submit
C:\Windows\SysWOW64\Hqimlihn.exe

Filesize
325KB

MD5
9d2dcc67764f9b59a254773fa04a0997

SHA1
705a143926d02614044f06c540d72f5368880495

SHA256
1f95a9c7f688a62be8bc3973b469986af01424f2fcf3ae6edbb9d95adf9aeb48

SHA512
9d074db4a509c9b6a073d8041479988efb2f3400374d06636d3db611f34016e952337c1984276120b1e8bc9478afdebd87358084056ff644ee4b798ef9e5600f

Download Submit
C:\Windows\SysWOW64\Hqmggi32.exe

Filesize
325KB

MD5
2c637259bd8d44f29f57aaada47c8c42

SHA1
db03e5b228f6ed8bb01d917b7cf93b5d613015c9

SHA256
913d20031bca84efb8a8b9b4359711ece1aa84b8ba7eee812f5d28e4b2a1807f

SHA512
31fef72e0164c7490097b554cd4661a4caca55f1575ff42193a69db666767a58e694814b503abcf8041d1a05d5117de611d8145f4ef88592ca3d5394d33b613a

Download Submit
C:\Windows\SysWOW64\Hqmggi32.exe

Filesize
325KB

MD5
2c637259bd8d44f29f57aaada47c8c42

SHA1
db03e5b228f6ed8bb01d917b7cf93b5d613015c9

SHA256
913d20031bca84efb8a8b9b4359711ece1aa84b8ba7eee812f5d28e4b2a1807f

SHA512
31fef72e0164c7490097b554cd4661a4caca55f1575ff42193a69db666767a58e694814b503abcf8041d1a05d5117de611d8145f4ef88592ca3d5394d33b613a

Download Submit
C:\Windows\SysWOW64\Icqmncof.exe

Filesize
325KB

MD5
fc7733c8069d121f1a91943b67eac421

SHA1
7a29dbe29235dcb00e58730e2068f7120a493889

SHA256
4f2fc608a6465d0e8cfcedb3044563d3f817660ec1b27bb127e55d834c77fba4

SHA512
e167bedc8994474f6fe0b565c657b811c7ce11bb0cba5be78c3ed60310cbc02cf4289a9a8c170c29df0f8ccfbe63f7990e3873da9175c59b6521c6cc5c6b1a88

Download Submit
C:\Windows\SysWOW64\Icqmncof.exe

Filesize
325KB

MD5
fc7733c8069d121f1a91943b67eac421

SHA1
7a29dbe29235dcb00e58730e2068f7120a493889

SHA256
4f2fc608a6465d0e8cfcedb3044563d3f817660ec1b27bb127e55d834c77fba4

SHA512
e167bedc8994474f6fe0b565c657b811c7ce11bb0cba5be78c3ed60310cbc02cf4289a9a8c170c29df0f8ccfbe63f7990e3873da9175c59b6521c6cc5c6b1a88

Download Submit
C:\Windows\SysWOW64\Ijmapm32.exe

Filesize
325KB

MD5
fc7733c8069d121f1a91943b67eac421

SHA1
7a29dbe29235dcb00e58730e2068f7120a493889

SHA256
4f2fc608a6465d0e8cfcedb3044563d3f817660ec1b27bb127e55d834c77fba4

SHA512
e167bedc8994474f6fe0b565c657b811c7ce11bb0cba5be78c3ed60310cbc02cf4289a9a8c170c29df0f8ccfbe63f7990e3873da9175c59b6521c6cc5c6b1a88

Download Submit
C:\Windows\SysWOW64\Ijmapm32.exe

Filesize
325KB

MD5
f586b8318e2882925d480414314a7d50

SHA1
0780b823b4596f9cb73f052d89e9f057045da826

SHA256
7287eb492c16943820803c6a323bd0a34bbebd5c8bce185fd9f46482d166ffc7

SHA512
fafcddbd2cea9394278263cda3dc4a719dacb0a9364430af4747a2fbc53e288b89cb129f55b354b0b488528c8ffe87e830166aa00969585bef2f3394464a0965

Download Submit
C:\Windows\SysWOW64\Ijmapm32.exe

Filesize
325KB

MD5
f586b8318e2882925d480414314a7d50

SHA1
0780b823b4596f9cb73f052d89e9f057045da826

SHA256
7287eb492c16943820803c6a323bd0a34bbebd5c8bce185fd9f46482d166ffc7

SHA512
fafcddbd2cea9394278263cda3dc4a719dacb0a9364430af4747a2fbc53e288b89cb129f55b354b0b488528c8ffe87e830166aa00969585bef2f3394464a0965

Download Submit
C:\Windows\SysWOW64\Inkjfk32.exe

Filesize
325KB

MD5
d596414eb48e03fe8001c380d01a5ac4

SHA1
dd42f5b00da2d890ac7621586bbe8594aace4e40

SHA256
cfebc4d20375ce92b6df7631de9d475dcc3410b9523b791aa7b5d7d7530e2023

SHA512
91a599d0a3348db4f4cc6ade9812123b9a70f6d75e297e9dcfa004e04c796e0777049275a23991c63192dca58972ba9592dd501665e4a81fe919f409d71698a0

Download Submit
C:\Windows\SysWOW64\Inkjfk32.exe

Filesize
325KB

MD5
d596414eb48e03fe8001c380d01a5ac4

SHA1
dd42f5b00da2d890ac7621586bbe8594aace4e40

SHA256
cfebc4d20375ce92b6df7631de9d475dcc3410b9523b791aa7b5d7d7530e2023

SHA512
91a599d0a3348db4f4cc6ade9812123b9a70f6d75e297e9dcfa004e04c796e0777049275a23991c63192dca58972ba9592dd501665e4a81fe919f409d71698a0

Download Submit
C:\Windows\SysWOW64\Jepbodhg.exe

Filesize
325KB

MD5
c380e046931270ed68e06a8fd2c85089

SHA1
c7fb8f1ecd283f98a403aef187897fe02b17ed34

SHA256
03fbce4b1bd06b0406268e222a185edab8ed1c25c784e8bec05b875b4ca2ab19

SHA512
186605eaac13547b79ab2a8da79d3429bef91353e69795c02f7f937f36bb021150c460682014c743b1351e66b29fc93ff97c3437abe85bacd844befddf4ac9e8

Download Submit
C:\Windows\SysWOW64\Jepbodhg.exe

Filesize
325KB

MD5
c380e046931270ed68e06a8fd2c85089

SHA1
c7fb8f1ecd283f98a403aef187897fe02b17ed34

SHA256
03fbce4b1bd06b0406268e222a185edab8ed1c25c784e8bec05b875b4ca2ab19

SHA512
186605eaac13547b79ab2a8da79d3429bef91353e69795c02f7f937f36bb021150c460682014c743b1351e66b29fc93ff97c3437abe85bacd844befddf4ac9e8

Download Submit
C:\Windows\SysWOW64\Jgekdq32.exe

Filesize
325KB

MD5
f17345f2ba86abc0a68272a497520571

SHA1
84f552842fe4a701031d3e96a0d3632d1e91cfe5

SHA256
e717542b1de257db858f55e197264d87965b2acea6af63470732cd879d2360dc

SHA512
5260e1d8c98702fb4f21a7195a2e275063e3708186046499fbb5be91a5787b7a422c1a605404ec8c0c4493ecbdf269508b67ad4d4c4bd953846338f0cc299ae3

Download Submit
C:\Windows\SysWOW64\Jgekdq32.exe

Filesize
325KB

MD5
f17345f2ba86abc0a68272a497520571

SHA1
84f552842fe4a701031d3e96a0d3632d1e91cfe5

SHA256
e717542b1de257db858f55e197264d87965b2acea6af63470732cd879d2360dc

SHA512
5260e1d8c98702fb4f21a7195a2e275063e3708186046499fbb5be91a5787b7a422c1a605404ec8c0c4493ecbdf269508b67ad4d4c4bd953846338f0cc299ae3

Download Submit
C:\Windows\SysWOW64\Jjfdfl32.exe

Filesize
325KB

MD5
f17345f2ba86abc0a68272a497520571

SHA1
84f552842fe4a701031d3e96a0d3632d1e91cfe5

SHA256
e717542b1de257db858f55e197264d87965b2acea6af63470732cd879d2360dc

SHA512
5260e1d8c98702fb4f21a7195a2e275063e3708186046499fbb5be91a5787b7a422c1a605404ec8c0c4493ecbdf269508b67ad4d4c4bd953846338f0cc299ae3

Download Submit
C:\Windows\SysWOW64\Jjfdfl32.exe

Filesize
325KB

MD5
4006d34d168037e12a1cf5957c4b9dad

SHA1
04a213fea8342d5b59cafc7e05324fa3bbd29fa1

SHA256
d2302a544c7235217cc92891cef889fbdaf3d9b57deddd092df954e315e1c7c0

SHA512
c2673c7b3926b7989d4ab6858e96c300af290c184db09561b85256537c4cc823a16578e1059dd348c10cb7f24fac31081b874f7daece1205f36a2872f9371a20

Download Submit
C:\Windows\SysWOW64\Jjfdfl32.exe

Filesize
325KB

MD5
4006d34d168037e12a1cf5957c4b9dad

SHA1
04a213fea8342d5b59cafc7e05324fa3bbd29fa1

SHA256
d2302a544c7235217cc92891cef889fbdaf3d9b57deddd092df954e315e1c7c0

SHA512
c2673c7b3926b7989d4ab6858e96c300af290c184db09561b85256537c4cc823a16578e1059dd348c10cb7f24fac31081b874f7daece1205f36a2872f9371a20

Download Submit
C:\Windows\SysWOW64\Jjhalkjc.exe

Filesize
325KB

MD5
fc9496dfa4ce06ae9af8cb3f57cbe0ae

SHA1
f646f969c2a273db9ac6054af9d6d75a5d133a59

SHA256
293732ece0c03cb85f9a52275e46e32fd16b70ce27c507fe46d605c9ba8e4d0c

SHA512
6c13e414207a08aff840c399aa3226a6a7fbcf01341fb832673130616fd8795b3332ca86792a9fc0d6fd260b2d5fee7f8ba7f5355067d09077c12bb8cc950d5d

Download Submit
C:\Windows\SysWOW64\Jjhalkjc.exe

Filesize
325KB

MD5
fc9496dfa4ce06ae9af8cb3f57cbe0ae

SHA1
f646f969c2a273db9ac6054af9d6d75a5d133a59

SHA256
293732ece0c03cb85f9a52275e46e32fd16b70ce27c507fe46d605c9ba8e4d0c

SHA512
6c13e414207a08aff840c399aa3226a6a7fbcf01341fb832673130616fd8795b3332ca86792a9fc0d6fd260b2d5fee7f8ba7f5355067d09077c12bb8cc950d5d

Download Submit
C:\Windows\SysWOW64\Jjknakhq.exe

Filesize
325KB

MD5
5f00c14977a67d0aa179467b582c2f8c

SHA1
81d78d05ddfd1ecb1395636d6e4b128d464430cf

SHA256
715047600f30f494d446ec3f9c039fe59481453e5f904bb64005e7f515f865b6

SHA512
c2392a28759287562be12d836f8d39119ddc70c806607aff61e57d1ba4eb6f96a530d17aa1be6e4b23caeceee01ed6a74dda2c1db0ee35eaf20258418badef91

Download Submit
C:\Windows\SysWOW64\Jjknakhq.exe

Filesize
325KB

MD5
5f00c14977a67d0aa179467b582c2f8c

SHA1
81d78d05ddfd1ecb1395636d6e4b128d464430cf

SHA256
715047600f30f494d446ec3f9c039fe59481453e5f904bb64005e7f515f865b6

SHA512
c2392a28759287562be12d836f8d39119ddc70c806607aff61e57d1ba4eb6f96a530d17aa1be6e4b23caeceee01ed6a74dda2c1db0ee35eaf20258418badef91

Download Submit
C:\Windows\SysWOW64\Jnmglk32.exe

Filesize
325KB

MD5
af753c29091721352bc7f576da81f2f0

SHA1
e21824e998d63d2e59883e13d97c2730a5558aae

SHA256
9e41a3b1a70228b24f64080bf9c4198abb0b50659c0eb2e45940a90cebf948c5

SHA512
f132b0c489f732ce709bdc3d8304033ca1441030304594ddd0abc1afd803da1cd324d027dddbfc21c372db09671379fc0873cfa4c153c42d6351b804678b4513

Download Submit
C:\Windows\SysWOW64\Jnmglk32.exe

Filesize
325KB

MD5
af753c29091721352bc7f576da81f2f0

SHA1
e21824e998d63d2e59883e13d97c2730a5558aae

SHA256
9e41a3b1a70228b24f64080bf9c4198abb0b50659c0eb2e45940a90cebf948c5

SHA512
f132b0c489f732ce709bdc3d8304033ca1441030304594ddd0abc1afd803da1cd324d027dddbfc21c372db09671379fc0873cfa4c153c42d6351b804678b4513

Download Submit
C:\Windows\SysWOW64\Kagbdenk.exe

Filesize
325KB

MD5
309af791c0f44764c0bc005a10df4d60

SHA1
c21069eedf31e36058c52b4f78208227743d713f

SHA256
62c4a61b03d4bf17084eb890c0c2a5893ede24dc1b369a83e5309038b24f7578

SHA512
0ffde3cec66ae3696d33b407e1e9edf69938c771a0ae5f87c05fa4a7ba9e5a7b802baf5b5f8540eefcff90f62565af4687fd5dac09d55c42079b2f8002cd7f61

Download Submit
C:\Windows\SysWOW64\Kagbdenk.exe

Filesize
325KB

MD5
309af791c0f44764c0bc005a10df4d60

SHA1
c21069eedf31e36058c52b4f78208227743d713f

SHA256
62c4a61b03d4bf17084eb890c0c2a5893ede24dc1b369a83e5309038b24f7578

SHA512
0ffde3cec66ae3696d33b407e1e9edf69938c771a0ae5f87c05fa4a7ba9e5a7b802baf5b5f8540eefcff90f62565af4687fd5dac09d55c42079b2f8002cd7f61

Download Submit
C:\Windows\SysWOW64\Kallod32.exe

Filesize
325KB

MD5
d4eb37cb02db03050e11ae768ad935d3

SHA1
8b661808944d7a8e298f22f7602e50b5cc8a5791

SHA256
ff76e35c7b519cd8172b24c6d867e60057fb8edb882fdaf3a528c1339c72642e

SHA512
3f452784d7a538b5ef903e0e3b49834f2b13bb8112dfe2f1b65106828bbd09ff80c7bdfca11f242e9240ab6f2300369f50cceeaeb846841e725ad68e3e929770

Download Submit
C:\Windows\SysWOW64\Kallod32.exe

Filesize
325KB

MD5
d4eb37cb02db03050e11ae768ad935d3

SHA1
8b661808944d7a8e298f22f7602e50b5cc8a5791

SHA256
ff76e35c7b519cd8172b24c6d867e60057fb8edb882fdaf3a528c1339c72642e

SHA512
3f452784d7a538b5ef903e0e3b49834f2b13bb8112dfe2f1b65106828bbd09ff80c7bdfca11f242e9240ab6f2300369f50cceeaeb846841e725ad68e3e929770

Download Submit
C:\Windows\SysWOW64\Kdhlepkl.exe

Filesize
325KB

MD5
00becd68ffccc22f5fffde456ee77d7b

SHA1
cb783e50176636f89a17235518f3454f5158dd74

SHA256
d8eed7d0748478a681b1359a3d122f7196bc438aaff5fc04811c09c9918d2e6f

SHA512
d417810b726a20a358d2f619cdc3bfd565b2c83a5623f447f5bfba2ce9be5c558c588c310de6b5fbe43ecbf3d24bd9877f20bfa17f6bb54c7106be231e678940

Download Submit
C:\Windows\SysWOW64\Kdhlepkl.exe

Filesize
325KB

MD5
00becd68ffccc22f5fffde456ee77d7b

SHA1
cb783e50176636f89a17235518f3454f5158dd74

SHA256
d8eed7d0748478a681b1359a3d122f7196bc438aaff5fc04811c09c9918d2e6f

SHA512
d417810b726a20a358d2f619cdc3bfd565b2c83a5623f447f5bfba2ce9be5c558c588c310de6b5fbe43ecbf3d24bd9877f20bfa17f6bb54c7106be231e678940

Download Submit
C:\Windows\SysWOW64\Lpfidh32.exe

Filesize
325KB

MD5
30390e997effacba29c651c16b31d28a

SHA1
6860598112241a2dbab260b196ba139b236bf57c

SHA256
f4df6823c847c291c8f5e43e46868ab8a6240245bd7a4381c006cb30810e6d32

SHA512
2b8a7cf928350261020fd1ebb49d34afb7928a696840698b54992e4cba077fead5e7c7884fac7c57d6ca4e9396d693fcf70136331cba1459b08f1a63d44b0037

Download Submit
C:\Windows\SysWOW64\Mcpjnp32.exe

Filesize
325KB

MD5
6366d10ab5b4cced9ae60a844e821ed9

SHA1
53f193180ac877f172ab9664c55cc7e7212a2b12

SHA256
1b9f5251b464d1c4ac47018fdf85484af9fa6bbacedd547c1870eacae2e8925f

SHA512
679680b4232aa411635ab63e37c2a3be44ce96754248741f246712b74c170fa8bb5c6546f90ae74d59456472c16bcff967010b1f5a55590f318cbdb6bc23b535

Download Submit
C:\Windows\SysWOW64\Nbjpjl32.exe

Filesize
325KB

MD5
1cc39bdaee40ddf1500b60829d65f6df

SHA1
d737acfc404ab11ce231f01d7ba65c605e78b1d8

SHA256
68b64b345af56a3f92c573628ecf61f89ee31661f35eb4692f35ce5d0348e446

SHA512
b826c4484d65b813d5fe8da6489d8a908aef6c59071b736810cad4ae7c121cc18ec6fbe1a9e529f8da050cffe880410b03e54b34ce5685e1e472d08b0fd27b7c

Download Submit
C:\Windows\SysWOW64\Nhcbidcd.exe

Filesize
325KB

MD5
1b2998ee1036bb09f5aa14175313878c

SHA1
a660cd57c78dd9d5587d7ac1bcc466e00967b04c

SHA256
08e7e7728d028694c6c8e0e03d30f2583f9d57fb4b8f9e54003b02bff8ea908a

SHA512
66cacc87abd563cb1c42b49d1a24f1fd0d51e02cf8369766b54b913643f0bb0fd67e6d83d1a97b323a05811d3a7b2c0a60e9c9583d289c0dba3f88db43d7fd8b

Download Submit
C:\Windows\SysWOW64\Odkcpi32.exe

Filesize
325KB

MD5
57dbe12afa62dd88456bdfecb04c34f4

SHA1
7e8a59850c3aa6efdbd4b8dc5445de6b75f1a5b2

SHA256
1172f58f53582dc0d054baa20d5f12f44960265a6c5afc465e7ce4fb4bf66fad

SHA512
2d090dd334a2e5cd0856c93dccdf18ff72d55bf5158dae97023b3b094803884b1a71eddc6ec13ab62d2f1289e992e1af56b95e8ace7cca282b84eeb5e7652cde

Download Submit
C:\Windows\SysWOW64\Pgaelcgm.exe

Filesize
325KB

MD5
b89bb9e440e76c0a099f942cde117ad9

SHA1
8acc13a7096e6f6d2827103af9e76cbdd857e7f3

SHA256
dfdc240fbd60686e622d10e1318b8b92d0816dfdff351b8fadd8402254e4483f

SHA512
75b23b3f8c8ea3cfb6c1aaa75caaa6824b5cf44a91e27338c4f3b10d25046076706a79ed8e547543a53625192c66a8f6ba05153b9b63ba46d1c57f26fb21cee5

Download Submit
C:\Windows\SysWOW64\Pkabbgol.exe

Filesize
325KB

MD5
0aec40fc30e2057ad2fcdc7133cd8082

SHA1
2e8a9d4efb73157a6482d96ece84def1bb5ce134

SHA256
6a40998f8f950307d248e1e21451c053a58a49cc5b5852befa6cbf4558327836

SHA512
f72ca9887d9a213430baa29422a2e2067784525c84352ca2f1433a45bc0b872c0d5839cc0c0437bbdbd20720e28509e019aa2f9cfae942c63d6292130c6861cd

Download Submit
C:\Windows\SysWOW64\Pkabbgol.exe

Filesize
325KB

MD5
0aec40fc30e2057ad2fcdc7133cd8082

SHA1
2e8a9d4efb73157a6482d96ece84def1bb5ce134

SHA256
6a40998f8f950307d248e1e21451c053a58a49cc5b5852befa6cbf4558327836

SHA512
f72ca9887d9a213430baa29422a2e2067784525c84352ca2f1433a45bc0b872c0d5839cc0c0437bbdbd20720e28509e019aa2f9cfae942c63d6292130c6861cd

Download Submit
C:\Windows\SysWOW64\Pnfdnnbo.exe

Filesize
325KB

MD5
37b02dc60ecc821758e64814f66657d8

SHA1
ffca6f06828ba4a3a68c1ff3718aac446c292ad0

SHA256
1313520495f78872446a3fb9e6bc9181180a03c73683ade670cacc1902b16924

SHA512
84e68a717812089a9dbe05fe89df8a99e7212d35b18e46b30306a2611edc9574a1f4a2d2a6a24bfcedaa2eac00703ed9d6e578fea8632dfd953ba970872aa765

Download Submit
memory/232-226-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/404-373-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/464-379-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/548-637-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/548-105-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/760-49-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/760-456-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/900-169-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1072-361-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1116-403-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1144-217-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1176-385-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1256-441-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1380-241-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1380-773-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1440-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1440-597-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1512-325-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1532-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1532-566-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1540-435-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1540-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1568-415-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1572-306-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1616-622-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1616-92-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1624-331-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1640-649-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1640-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1652-114-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1652-644-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1948-367-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1988-455-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1988-41-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2000-209-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2148-391-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2176-428-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2212-161-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2448-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2480-264-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2528-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2528-624-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2628-461-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2628-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2816-300-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2888-349-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2936-427-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3060-312-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3176-288-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3224-177-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3228-70-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3228-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3228-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3248-610-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3248-81-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3272-448-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3272-33-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3436-201-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3516-409-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3740-185-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3972-258-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4180-282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4448-397-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4456-13-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4456-421-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4484-234-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4504-355-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4616-434-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4616-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4652-294-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4664-193-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4688-276-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4692-129-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4692-650-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4736-319-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4772-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4776-154-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4872-343-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4960-780-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4960-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5000-337-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5028-665-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5028-137-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads