3655a0d59d3622c0fe4b46b0a39155440512841b91f42c2475138e4ff388e3b2

Analysis

max time kernel
49s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 11:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f7140ee6b4fd32176cb85eb9d9eb1ff8_JC.exe
Size

177KB
MD5

f7140ee6b4fd32176cb85eb9d9eb1ff8
SHA1

f1e695e534f99c32f325bce2178426415eea6544
SHA256

3655a0d59d3622c0fe4b46b0a39155440512841b91f42c2475138e4ff388e3b2
SHA512

589955c25dc05db6d99a8e95b3ee2851df42095e76c47036c3f3e62190b38d652bf8d8e6e13d45e0a6c61156231c36b46038ad9960b47f41f7c0743b9948755f
SSDEEP

3072:h5Izp8JYnvIffyvg3q/haR5sS+vfvLHhjh8g1eGFyOsa:hYpTwfavga/harSvLHh98gwG0ON

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lflbkcll.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pnplfj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Doojec32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cmpcdfll.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dmbiackg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jjhalkjc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgcjfbed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lohqnd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lpgmhg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Khcgfo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aohfdnil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eklajcmc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnljkk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fkcpql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbqdmodg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngifef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iccpniqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nbdkhe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hblkjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcbfcigf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kjlopc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Onapdl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kpqggh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lchfib32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bblcfo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gjhonp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iqgjmg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcidmkpq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nggjog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Napameoi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lobjni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jocnlg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lahbei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mlgjhp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfbhhfbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Inlihl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjidgkog.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mjlalkmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bpcgpihi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iljpgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ejlnfjbd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfeeabda.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddifgk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Egcaod32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pakdbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdppaidl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Andqol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gihpkd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iehmmb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	WerFault.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ollljmhg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dghadidj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Edfddl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oqhoeb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jchaoe32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nkpijfgf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bgokdomj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kcndbp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Geaepk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mhckcgpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Indkpcdk.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aaoaic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Foclgq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jafdcbge.exe

Executes dropped EXE 64 IoCs

pid	Process
1456	Iljpij32.exe
2388	Iphioh32.exe
2496	Inlihl32.exe
3236	Igdnabjh.exe
3804	Ipmbjgpi.exe
392	Ijegcm32.exe
4936	Ikdcmpnl.exe
3364	Jpaleglc.exe
2188	Jlmfeg32.exe
1856	Jjafok32.exe
4676	Jgeghp32.exe
5008	Kggcnoic.exe
2072	Kcndbp32.exe
468	Kdmqmc32.exe
3676	Kjjiej32.exe
5116	Knhakh32.exe
1960	Kcejco32.exe
1560	Lmmolepp.exe
3516	Lnmkfh32.exe
3528	Ldgccb32.exe
3828	Lclpdncg.exe
1644	Lmdemd32.exe
4304	Lqbncb32.exe
1420	Madjhb32.exe
3320	Mjmoag32.exe
1332	Mebcop32.exe
1148	Mnkggfkb.exe
2876	Malpia32.exe
2376	Pdkoch32.exe
4340	Blqllqqa.exe
2768	Coadnlnb.exe
844	Cbbnpg32.exe
1200	Cnindhpg.exe
2728	Chnbbqpn.exe
2252	Cbfgkffn.exe
2892	Dmlkhofd.exe
1512	Dbicpfdk.exe
880	Domdjj32.exe
3936	Dmadco32.exe
2308	Dbnmke32.exe
3108	Dbpjaeoc.exe
1436	Dmennnni.exe
4644	Dbbffdlq.exe
5044	Emhkdmlg.exe
3776	Ebdcld32.exe
3440	Enkdaepb.exe
2372	Eeelnp32.exe
4796	Eehicoel.exe
4428	Epmmqheb.exe
4804	Emanjldl.exe
232	Fmcjpl32.exe
3012	Fneggdhg.exe
1444	Fmfgek32.exe
408	Fngcmcfe.exe
2864	Fiodpl32.exe
4792	Gemkelcd.exe
2764	Gnepna32.exe
2168	Gikdkj32.exe
2148	Goglcahb.exe
4716	Geaepk32.exe
4220	Gpgind32.exe
1848	Hedafk32.exe
3360	Hmkigh32.exe
4236	Hbhboolf.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Cpqlfa32.exe	Cmpcdfll.exe
File opened for modification	C:\Windows\SysWOW64\Hcembe32.exe	Hnhdjn32.exe
File opened for modification	C:\Windows\SysWOW64\Lkiamp32.exe	Kdpiqehp.exe
File opened for modification	C:\Windows\SysWOW64\Lkbmih32.exe	Ldhdlnli.exe
File created	C:\Windows\SysWOW64\Mopeofjl.exe	Mehafq32.exe
File created	C:\Windows\SysWOW64\Paifdeda.dll	Gcjdam32.exe
File created	C:\Windows\SysWOW64\Mioaanec.dll	Aaoaic32.exe
File opened for modification	C:\Windows\SysWOW64\Icachjbb.exe	Indkpcdk.exe
File created	C:\Windows\SysWOW64\Jooeqo32.dll	Indkpcdk.exe
File created	C:\Windows\SysWOW64\Gpdkpe32.dll	Ldkhlcnb.exe
File opened for modification	C:\Windows\SysWOW64\Nbdkhe32.exe	Nkjckkcg.exe
File opened for modification	C:\Windows\SysWOW64\Cepadh32.exe	Cpqlfa32.exe
File opened for modification	C:\Windows\SysWOW64\Oaifpi32.exe	Ojomcopk.exe
File created	C:\Windows\SysWOW64\Chbfoaba.dll	Hnibokbd.exe
File created	C:\Windows\SysWOW64\Pfgbakef.dll	Pjoppf32.exe
File created	C:\Windows\SysWOW64\Aiaeig32.dll	Obfhmd32.exe
File created	C:\Windows\SysWOW64\Gfjmfj32.dll	Lfmnbjcg.exe
File opened for modification	C:\Windows\SysWOW64\Ddifgk32.exe	Dolmodpi.exe
File opened for modification	C:\Windows\SysWOW64\Bmfqngcg.exe	Bmddihfj.exe
File opened for modification	C:\Windows\SysWOW64\Hdppaidl.exe	Hnehdo32.exe
File created	C:\Windows\SysWOW64\Hpaoan32.dll	Fajbjh32.exe
File created	C:\Windows\SysWOW64\Cepjip32.dll	Chdialdl.exe
File created	C:\Windows\SysWOW64\Pkpbai32.dll	Halhfe32.exe
File created	C:\Windows\SysWOW64\Dojpmiij.dll	Jllhpkfk.exe
File created	C:\Windows\SysWOW64\Bmgjnl32.dll	Ikcmmjkb.exe
File created	C:\Windows\SysWOW64\Pciqnk32.exe	Pakdbp32.exe
File created	C:\Windows\SysWOW64\Mckfmq32.dll	Dibdeegc.exe
File created	C:\Windows\SysWOW64\Ngifef32.exe	Nehjmnei.exe
File created	C:\Windows\SysWOW64\Enkdaepb.exe	Ebdcld32.exe
File opened for modification	C:\Windows\SysWOW64\Piocecgj.exe	Bhennm32.exe
File created	C:\Windows\SysWOW64\Clpppmqn.exe	Cfbhhfbg.exe
File opened for modification	C:\Windows\SysWOW64\Clffalkf.exe	Cihjeq32.exe
File opened for modification	C:\Windows\SysWOW64\Eqiibjlj.exe	Eklajcmc.exe
File created	C:\Windows\SysWOW64\Eqiibjlj.exe	Eklajcmc.exe
File created	C:\Windows\SysWOW64\Jjihfbno.exe	Jdopjh32.exe
File created	C:\Windows\SysWOW64\Ookhfigk.exe	Ollljmhg.exe
File opened for modification	C:\Windows\SysWOW64\Gikdkj32.exe	Gnepna32.exe
File created	C:\Windows\SysWOW64\Hghfnioq.exe	Hbknebqi.exe
File created	C:\Windows\SysWOW64\Igcnla32.dll	Hemdlj32.exe
File created	C:\Windows\SysWOW64\Pjpbba32.dll	Eehicoel.exe
File created	C:\Windows\SysWOW64\Ldkhlcnb.exe	Nbmmoklg.exe
File created	C:\Windows\SysWOW64\Kikdcj32.dll	Mnkggfkb.exe
File created	C:\Windows\SysWOW64\Kpmmljnd.dll	Jhkbdmbg.exe
File created	C:\Windows\SysWOW64\Lbfecjhc.dll	Gndick32.exe
File created	C:\Windows\SysWOW64\Kcidmkpq.exe	Jnlkedai.exe
File opened for modification	C:\Windows\SysWOW64\Llimgb32.exe	Lbqinm32.exe
File created	C:\Windows\SysWOW64\Igdnabjh.exe	Inlihl32.exe
File created	C:\Windows\SysWOW64\Hmjbog32.dll	Jikoopij.exe
File created	C:\Windows\SysWOW64\Opepqban.dll	Qppkhfec.exe
File created	C:\Windows\SysWOW64\Mglpdp32.dll	Kcidmkpq.exe
File created	C:\Windows\SysWOW64\Phcgcqab.exe	Paiogf32.exe
File created	C:\Windows\SysWOW64\Kjmejc32.dll	Ddkbmj32.exe
File created	C:\Windows\SysWOW64\Ljpaqmgb.exe	Lpgmhg32.exe
File opened for modification	C:\Windows\SysWOW64\Fncibg32.exe	Fgiaemic.exe
File created	C:\Windows\SysWOW64\Gilkbqmk.dll	Fdadpk32.exe
File created	C:\Windows\SysWOW64\Epanfaei.dll	Mehafq32.exe
File created	C:\Windows\SysWOW64\Ombcji32.exe	Ogekbb32.exe
File created	C:\Windows\SysWOW64\Agdcpkll.exe	Amlogfel.exe
File created	C:\Windows\SysWOW64\Eiebmbnn.dll	Nocbfjmc.exe
File created	C:\Windows\SysWOW64\Jmeede32.exe	Jgkmgk32.exe
File opened for modification	C:\Windows\SysWOW64\Qpcecb32.exe	Qfkqjmdg.exe
File created	C:\Windows\SysWOW64\Nfldgk32.exe	Nmcpoedn.exe
File created	C:\Windows\SysWOW64\Hgpchp32.dll	Hghfnioq.exe
File created	C:\Windows\SysWOW64\Foeeml32.dll	Ggdigekj.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3796	5016	WerFault.exe	1035

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bppgif32.dll"	Klfaapbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihjoke32.dll"	Ihdldn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mjcngpjh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fdlkdhnk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dibdeegc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohnljine.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pnmopk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Afboah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hccdbf32.dll"	Ogekbb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fcbnpnme.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Beobcdoi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Njmqnobn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmlfqh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dndgfpbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aqfolqna.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gqpbcn32.dll"	Jhfbog32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hqmggi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jahqiaeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Icnphd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Blknpdho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lekldqpd.dll"	Cpipkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qfkqjmdg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iljpgl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hqghqpnl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jcoioabf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cnpibh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hifcgion.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgnlkfal.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhennm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lelajb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bknlbhhe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Libmeq32.dll"	Gghdaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Imdgljil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hqimlihn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Offnhpfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pdenmbkk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ollljmhg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fjemge32.dll"	Okcogc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgnagk32.dll"	Knhakh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Koajmepf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cdmoafdb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dnljkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Iffahdpm.dll"	Fkcpql32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pokanf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hjcojo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ijjekn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jkmjlphl.dll"	Amlogfel.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Geoapenf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nofefp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hgocgjgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kkklkejm.dll"	Ldhdlnli.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mnkggfkb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bomkcm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bpcgpihi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gqbneq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dbnefjjd.dll"	Jbncbpqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dihmeahp.dll"	Ddqbbo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jebdkl32.dll"	Bgokdomj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gfkcaoef.dll"	Nfjola32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kggcnoic.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hibjli32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hblkjo32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpegkj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Maoifh32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 1456	4004	f7140ee6b4fd32176cb85eb9d9eb1ff8_JC.exe	83
PID 4004 wrote to memory of 1456	4004	f7140ee6b4fd32176cb85eb9d9eb1ff8_JC.exe	83
PID 4004 wrote to memory of 1456	4004	f7140ee6b4fd32176cb85eb9d9eb1ff8_JC.exe	83
PID 1456 wrote to memory of 2388	1456	Iljpij32.exe	84
PID 1456 wrote to memory of 2388	1456	Iljpij32.exe	84
PID 1456 wrote to memory of 2388	1456	Iljpij32.exe	84
PID 2388 wrote to memory of 2496	2388	Iphioh32.exe	85
PID 2388 wrote to memory of 2496	2388	Iphioh32.exe	85
PID 2388 wrote to memory of 2496	2388	Iphioh32.exe	85
PID 2496 wrote to memory of 3236	2496	Inlihl32.exe	86
PID 2496 wrote to memory of 3236	2496	Inlihl32.exe	86
PID 2496 wrote to memory of 3236	2496	Inlihl32.exe	86
PID 3236 wrote to memory of 3804	3236	Igdnabjh.exe	87
PID 3236 wrote to memory of 3804	3236	Igdnabjh.exe	87
PID 3236 wrote to memory of 3804	3236	Igdnabjh.exe	87
PID 3804 wrote to memory of 392	3804	Ipmbjgpi.exe	88
PID 3804 wrote to memory of 392	3804	Ipmbjgpi.exe	88
PID 3804 wrote to memory of 392	3804	Ipmbjgpi.exe	88
PID 392 wrote to memory of 4936	392	Ijegcm32.exe	89
PID 392 wrote to memory of 4936	392	Ijegcm32.exe	89
PID 392 wrote to memory of 4936	392	Ijegcm32.exe	89
PID 4936 wrote to memory of 3364	4936	Ikdcmpnl.exe	90
PID 4936 wrote to memory of 3364	4936	Ikdcmpnl.exe	90
PID 4936 wrote to memory of 3364	4936	Ikdcmpnl.exe	90
PID 3364 wrote to memory of 2188	3364	Jpaleglc.exe	91
PID 3364 wrote to memory of 2188	3364	Jpaleglc.exe	91
PID 3364 wrote to memory of 2188	3364	Jpaleglc.exe	91
PID 2188 wrote to memory of 1856	2188	Jlmfeg32.exe	92
PID 2188 wrote to memory of 1856	2188	Jlmfeg32.exe	92
PID 2188 wrote to memory of 1856	2188	Jlmfeg32.exe	92
PID 1856 wrote to memory of 4676	1856	Jjafok32.exe	93
PID 1856 wrote to memory of 4676	1856	Jjafok32.exe	93
PID 1856 wrote to memory of 4676	1856	Jjafok32.exe	93
PID 4676 wrote to memory of 5008	4676	Jgeghp32.exe	94
PID 4676 wrote to memory of 5008	4676	Jgeghp32.exe	94
PID 4676 wrote to memory of 5008	4676	Jgeghp32.exe	94
PID 5008 wrote to memory of 2072	5008	Kggcnoic.exe	96
PID 5008 wrote to memory of 2072	5008	Kggcnoic.exe	96
PID 5008 wrote to memory of 2072	5008	Kggcnoic.exe	96
PID 2072 wrote to memory of 468	2072	Kcndbp32.exe	95
PID 2072 wrote to memory of 468	2072	Kcndbp32.exe	95
PID 2072 wrote to memory of 468	2072	Kcndbp32.exe	95
PID 468 wrote to memory of 3676	468	Kdmqmc32.exe	97
PID 468 wrote to memory of 3676	468	Kdmqmc32.exe	97
PID 468 wrote to memory of 3676	468	Kdmqmc32.exe	97
PID 3676 wrote to memory of 5116	3676	Kjjiej32.exe	99
PID 3676 wrote to memory of 5116	3676	Kjjiej32.exe	99
PID 3676 wrote to memory of 5116	3676	Kjjiej32.exe	99
PID 5116 wrote to memory of 1960	5116	Knhakh32.exe	100
PID 5116 wrote to memory of 1960	5116	Knhakh32.exe	100
PID 5116 wrote to memory of 1960	5116	Knhakh32.exe	100
PID 1960 wrote to memory of 1560	1960	Kcejco32.exe	110
PID 1960 wrote to memory of 1560	1960	Kcejco32.exe	110
PID 1960 wrote to memory of 1560	1960	Kcejco32.exe	110
PID 1560 wrote to memory of 3516	1560	Lmmolepp.exe	109
PID 1560 wrote to memory of 3516	1560	Lmmolepp.exe	109
PID 1560 wrote to memory of 3516	1560	Lmmolepp.exe	109
PID 3516 wrote to memory of 3528	3516	Lnmkfh32.exe	108
PID 3516 wrote to memory of 3528	3516	Lnmkfh32.exe	108
PID 3516 wrote to memory of 3528	3516	Lnmkfh32.exe	108
PID 3528 wrote to memory of 3828	3528	Ldgccb32.exe	101
PID 3528 wrote to memory of 3828	3528	Ldgccb32.exe	101
PID 3528 wrote to memory of 3828	3528	Ldgccb32.exe	101
PID 3828 wrote to memory of 1644	3828	Lclpdncg.exe	102

C:\Users\Admin\AppData\Local\Temp\f7140ee6b4fd32176cb85eb9d9eb1ff8_JC.exe
"C:\Users\Admin\AppData\Local\Temp\f7140ee6b4fd32176cb85eb9d9eb1ff8_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\SysWOW64\Iljpij32.exe
  C:\Windows\system32\Iljpij32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\SysWOW64\Iphioh32.exe
    C:\Windows\system32\Iphioh32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2388
  - - C:\Windows\SysWOW64\Inlihl32.exe
      C:\Windows\system32\Inlihl32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:2496
    - - C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3236
      - C:\Windows\SysWOW64\Ipmbjgpi.exe
        
        C:\Windows\system32\Ipmbjgpi.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3804
        
        C:\Windows\SysWOW64\Ijegcm32.exe
        
        C:\Windows\system32\Ijegcm32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:392
        
        C:\Windows\SysWOW64\Ikdcmpnl.exe
        
        C:\Windows\system32\Ikdcmpnl.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4936
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3364
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2188
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1856
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4676
        
        C:\Windows\SysWOW64\Kggcnoic.exe
        
        C:\Windows\system32\Kggcnoic.exe
        13⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:5008
        
        C:\Windows\SysWOW64\Kcndbp32.exe
        
        C:\Windows\system32\Kcndbp32.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2072

C:\Windows\SysWOW64\Kdmqmc32.exe
C:\Windows\system32\Kdmqmc32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468
- C:\Windows\SysWOW64\Kjjiej32.exe
  C:\Windows\system32\Kjjiej32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Windows\SysWOW64\Knhakh32.exe
    C:\Windows\system32\Knhakh32.exe
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\Windows\SysWOW64\Kcejco32.exe
      C:\Windows\system32\Kcejco32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1960
    - - C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1560

C:\Windows\SysWOW64\Lclpdncg.exe
C:\Windows\system32\Lclpdncg.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\SysWOW64\Lmdemd32.exe
  C:\Windows\system32\Lmdemd32.exe
  2⤵
  - Executes dropped EXE
  PID:1644
- - C:\Windows\SysWOW64\Lqbncb32.exe
    C:\Windows\system32\Lqbncb32.exe
    3⤵
    - Executes dropped EXE
    PID:4304
  - - C:\Windows\SysWOW64\Madjhb32.exe
      C:\Windows\system32\Madjhb32.exe
      4⤵
      Executes dropped EXE
      PID:1420
    - - C:\Windows\SysWOW64\Mjmoag32.exe
        
        C:\Windows\system32\Mjmoag32.exe
        5⤵
        Executes dropped EXE
        
        PID:3320

C:\Windows\SysWOW64\Mebcop32.exe
C:\Windows\system32\Mebcop32.exe
1⤵
- Executes dropped EXE
PID:1332
- C:\Windows\SysWOW64\Mnkggfkb.exe
  C:\Windows\system32\Mnkggfkb.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  PID:1148
- - C:\Windows\SysWOW64\Malpia32.exe
    C:\Windows\system32\Malpia32.exe
    3⤵
    - Executes dropped EXE
    PID:2876
  - - C:\Windows\SysWOW64\Pdkoch32.exe
      C:\Windows\system32\Pdkoch32.exe
      4⤵
      Executes dropped EXE
      PID:2376
    - - C:\Windows\SysWOW64\Bomkcm32.exe
        
        C:\Windows\system32\Bomkcm32.exe
        5⤵
        Modifies registry class
        
        PID:760
      - C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        6⤵
        Executes dropped EXE
        
        PID:4340
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        7⤵
        Executes dropped EXE
        
        PID:2768
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        8⤵
        Executes dropped EXE
        
        PID:844
        
        C:\Windows\SysWOW64\Cnindhpg.exe
        
        C:\Windows\system32\Cnindhpg.exe
        9⤵
        Executes dropped EXE
        
        PID:1200
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        10⤵
        Executes dropped EXE
        
        PID:2728
        
        C:\Windows\SysWOW64\Cbfgkffn.exe
        
        C:\Windows\system32\Cbfgkffn.exe
        11⤵
        Executes dropped EXE
        
        PID:2252
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        12⤵
        Executes dropped EXE
        
        PID:2892
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        13⤵
        Executes dropped EXE
        
        PID:1512
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        14⤵
        Executes dropped EXE
        
        PID:880
        
        C:\Windows\SysWOW64\Dmadco32.exe
        
        C:\Windows\system32\Dmadco32.exe
        15⤵
        Executes dropped EXE
        
        PID:3936
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        16⤵
        Executes dropped EXE
        
        PID:2308
        
        C:\Windows\SysWOW64\Dbpjaeoc.exe
        
        C:\Windows\system32\Dbpjaeoc.exe
        17⤵
        Executes dropped EXE
        
        PID:3108
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        18⤵
        Executes dropped EXE
        
        PID:1436
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        19⤵
        Executes dropped EXE
        
        PID:4644
        
        C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        20⤵
        Executes dropped EXE
        
        PID:5044
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3776
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        22⤵
        Executes dropped EXE
        
        PID:3440
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        23⤵
        Executes dropped EXE
        
        PID:2372
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4796
        
        C:\Windows\SysWOW64\Epmmqheb.exe
        
        C:\Windows\system32\Epmmqheb.exe
        25⤵
        Executes dropped EXE
        
        PID:4428
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        26⤵
        Executes dropped EXE
        
        PID:4804
        
        C:\Windows\SysWOW64\Fmcjpl32.exe
        
        C:\Windows\system32\Fmcjpl32.exe
        27⤵
        Executes dropped EXE
        
        PID:232
        
        C:\Windows\SysWOW64\Fneggdhg.exe
        
        C:\Windows\system32\Fneggdhg.exe
        28⤵
        Executes dropped EXE
        
        PID:3012
        
        C:\Windows\SysWOW64\Fmfgek32.exe
        
        C:\Windows\system32\Fmfgek32.exe
        29⤵
        Executes dropped EXE
        
        PID:1444
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        30⤵
        Executes dropped EXE
        
        PID:408
        
        C:\Windows\SysWOW64\Fiodpl32.exe
        
        C:\Windows\system32\Fiodpl32.exe
        31⤵
        Executes dropped EXE
        
        PID:2864
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        32⤵
        Executes dropped EXE
        
        PID:4792
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2764
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        34⤵
        Executes dropped EXE
        
        PID:2168
        
        C:\Windows\SysWOW64\Goglcahb.exe
        
        C:\Windows\system32\Goglcahb.exe
        35⤵
        Executes dropped EXE
        
        PID:2148
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4716
        
        C:\Windows\SysWOW64\Gpgind32.exe
        
        C:\Windows\system32\Gpgind32.exe
        37⤵
        Executes dropped EXE
        
        PID:4220
        
        C:\Windows\SysWOW64\Hedafk32.exe
        
        C:\Windows\system32\Hedafk32.exe
        38⤵
        Executes dropped EXE
        
        PID:1848
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        39⤵
        Executes dropped EXE
        
        PID:3360
        
        C:\Windows\SysWOW64\Hbhboolf.exe
        
        C:\Windows\system32\Hbhboolf.exe
        40⤵
        Executes dropped EXE
        
        PID:4236
        
        C:\Windows\SysWOW64\Hibjli32.exe
        
        C:\Windows\system32\Hibjli32.exe
        41⤵
        Modifies registry class
        
        PID:4648
        
        C:\Windows\SysWOW64\Hbjoeojc.exe
        
        C:\Windows\system32\Hbjoeojc.exe
        42⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        43⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        44⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2328
        
        C:\Windows\SysWOW64\Hifcgion.exe
        
        C:\Windows\system32\Hifcgion.exe
        45⤵
        Modifies registry class
        
        PID:1768
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        46⤵
        
        PID:1340
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        47⤵
        Drops file in System32 directory
        
        PID:4656
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        48⤵
        
        PID:60
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        49⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\Imgicgca.exe
        
        C:\Windows\system32\Imgicgca.exe
        50⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\Iinjhh32.exe
        
        C:\Windows\system32\Iinjhh32.exe
        51⤵
        
        PID:3616
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        52⤵
        
        PID:368
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        53⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        54⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\Ibhkfm32.exe
        
        C:\Windows\system32\Ibhkfm32.exe
        55⤵
        
        PID:3036
        
        C:\Windows\SysWOW64\Iplkpa32.exe
        
        C:\Windows\system32\Iplkpa32.exe
        56⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        57⤵
        Drops file in System32 directory
        
        PID:5192
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        58⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        59⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        60⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        61⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Jebfng32.exe
        
        C:\Windows\system32\Jebfng32.exe
        62⤵
        
        PID:5412
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        63⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Jedccfqg.exe
        
        C:\Windows\system32\Jedccfqg.exe
        64⤵
        
        PID:5496
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        65⤵
        Drops file in System32 directory
        
        PID:5544
        
        C:\Windows\SysWOW64\Kcidmkpq.exe
        
        C:\Windows\system32\Kcidmkpq.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5588
        
        C:\Windows\SysWOW64\Kjblje32.exe
        
        C:\Windows\system32\Kjblje32.exe
        67⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        68⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Kpoalo32.exe
        
        C:\Windows\system32\Kpoalo32.exe
        69⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Klfaapbl.exe
        
        C:\Windows\system32\Klfaapbl.exe
        70⤵
        Modifies registry class
        
        PID:5756
        
        C:\Windows\SysWOW64\Kcpjnjii.exe
        
        C:\Windows\system32\Kcpjnjii.exe
        71⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        72⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5896
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5940
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        75⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        76⤵
        
        PID:6028
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        77⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        78⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Lqkqhm32.exe
        
        C:\Windows\system32\Lqkqhm32.exe
        79⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Lgdidgjg.exe
        
        C:\Windows\system32\Lgdidgjg.exe
        80⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Lnoaaaad.exe
        
        C:\Windows\system32\Lnoaaaad.exe
        81⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\Lggejg32.exe
        
        C:\Windows\system32\Lggejg32.exe
        82⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Lnangaoa.exe
        
        C:\Windows\system32\Lnangaoa.exe
        83⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        84⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5512
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        85⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5596
        
        C:\Windows\SysWOW64\Mqafhl32.exe
        
        C:\Windows\system32\Mqafhl32.exe
        86⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        87⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        88⤵
        Modifies registry class
        
        PID:5788
        
        C:\Windows\SysWOW64\Mjlhgaqp.exe
        
        C:\Windows\system32\Mjlhgaqp.exe
        89⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Moipoh32.exe
        
        C:\Windows\system32\Moipoh32.exe
        90⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        91⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        92⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        93⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6096
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        94⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Monjjgkb.exe
        
        C:\Windows\system32\Monjjgkb.exe
        95⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Mjcngpjh.exe
        
        C:\Windows\system32\Mjcngpjh.exe
        96⤵
        Modifies registry class
        
        PID:5444
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        97⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        98⤵
        Modifies registry class
        
        PID:5672
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        99⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Njmqnobn.exe
        
        C:\Windows\system32\Njmqnobn.exe
        100⤵
        Modifies registry class
        
        PID:5892
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        101⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        102⤵
        Drops file in System32 directory
        
        PID:6120
        
        C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        103⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Offnhpfo.exe
        
        C:\Windows\system32\Offnhpfo.exe
        104⤵
        Modifies registry class
        
        PID:5436
        
        C:\Windows\SysWOW64\Oakbehfe.exe
        
        C:\Windows\system32\Oakbehfe.exe
        105⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Ogekbb32.exe
        
        C:\Windows\system32\Ogekbb32.exe
        106⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1204
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        107⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        108⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\Onapdl32.exe
        
        C:\Windows\system32\Onapdl32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5840
        
        C:\Windows\SysWOW64\Oaplqh32.exe
        
        C:\Windows\system32\Oaplqh32.exe
        110⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Pfoann32.exe
        
        C:\Windows\system32\Pfoann32.exe
        111⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        112⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Phonha32.exe
        
        C:\Windows\system32\Phonha32.exe
        113⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Pmlfqh32.exe
        
        C:\Windows\system32\Pmlfqh32.exe
        114⤵
        Modifies registry class
        
        PID:2360
        
        C:\Windows\SysWOW64\Pdenmbkk.exe
        
        C:\Windows\system32\Pdenmbkk.exe
        115⤵
        Modifies registry class
        
        PID:5800
        
        C:\Windows\SysWOW64\Paiogf32.exe
        
        C:\Windows\system32\Paiogf32.exe
        116⤵
        Drops file in System32 directory
        
        PID:2428
        
        C:\Windows\SysWOW64\Phcgcqab.exe
        
        C:\Windows\system32\Phcgcqab.exe
        117⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Pnmopk32.exe
        
        C:\Windows\system32\Pnmopk32.exe
        118⤵
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Ppolhcnm.exe
        
        C:\Windows\system32\Ppolhcnm.exe
        119⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Pnplfj32.exe
        
        C:\Windows\system32\Pnplfj32.exe
        120⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4524
        
        C:\Windows\SysWOW64\Ppahmb32.exe
        
        C:\Windows\system32\Ppahmb32.exe
        121⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Qfkqjmdg.exe
        
        C:\Windows\system32\Qfkqjmdg.exe
        122⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5932
        
        C:\Windows\SysWOW64\Qpcecb32.exe
        
        C:\Windows\system32\Qpcecb32.exe
        123⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Qjiipk32.exe
        
        C:\Windows\system32\Qjiipk32.exe
        124⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        125⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        126⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Amjbbfgo.exe
        
        C:\Windows\system32\Amjbbfgo.exe
        127⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        128⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        129⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6344
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        130⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Amnlme32.exe
        
        C:\Windows\system32\Amnlme32.exe
        131⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Adhdjpjf.exe
        
        C:\Windows\system32\Adhdjpjf.exe
        132⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        133⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        134⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        135⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6720
        
        C:\Windows\SysWOW64\Bgkiaj32.exe
        
        C:\Windows\system32\Bgkiaj32.exe
        137⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        138⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        139⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Bgpcliao.exe
        
        C:\Windows\system32\Bgpcliao.exe
        140⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        141⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Bknlbhhe.exe
        
        C:\Windows\system32\Bknlbhhe.exe
        142⤵
        Modifies registry class
        
        PID:7012
        
        C:\Windows\SysWOW64\Bahdob32.exe
        
        C:\Windows\system32\Bahdob32.exe
        143⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        144⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        145⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Chdialdl.exe
        
        C:\Windows\system32\Chdialdl.exe
        146⤵
        Drops file in System32 directory
        
        PID:6148
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        147⤵
        Drops file in System32 directory
        
        PID:6220
        
        C:\Windows\SysWOW64\Ddifgk32.exe
        
        C:\Windows\system32\Ddifgk32.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6328
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6396
        
        C:\Windows\SysWOW64\Ddkbmj32.exe
        
        C:\Windows\system32\Ddkbmj32.exe
        150⤵
        Drops file in System32 directory
        
        PID:6484
        
        C:\Windows\SysWOW64\Dndgfpbo.exe
        
        C:\Windows\system32\Dndgfpbo.exe
        151⤵
        Modifies registry class
        
        PID:6528
        
        C:\Windows\SysWOW64\Dglkoeio.exe
        
        C:\Windows\system32\Dglkoeio.exe
        152⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        153⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Ehlhih32.exe
        
        C:\Windows\system32\Ehlhih32.exe
        154⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Enhpao32.exe
        
        C:\Windows\system32\Enhpao32.exe
        155⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Edbiniff.exe
        
        C:\Windows\system32\Edbiniff.exe
        156⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        157⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7020
        
        C:\Windows\SysWOW64\Eqiibjlj.exe
        
        C:\Windows\system32\Eqiibjlj.exe
        158⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3984
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        160⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        161⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Eomffaag.exe
        
        C:\Windows\system32\Eomffaag.exe
        162⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        163⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Ekcgkb32.exe
        
        C:\Windows\system32\Ekcgkb32.exe
        164⤵
        
        PID:6684
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        165⤵
        Modifies registry class
        
        PID:6856
        
        C:\Windows\SysWOW64\Fndpmndl.exe
        
        C:\Windows\system32\Fndpmndl.exe
        166⤵
        
        PID:6992
        
        C:\Windows\SysWOW64\Fdnhih32.exe
        
        C:\Windows\system32\Fdnhih32.exe
        167⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        168⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6164
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        169⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        170⤵
        Drops file in System32 directory
        
        PID:6524
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6788
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        172⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Gegkpf32.exe
        
        C:\Windows\system32\Gegkpf32.exe
        173⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        174⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        175⤵
        
        PID:4024
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        176⤵
        Modifies registry class
        
        PID:6940
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        177⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Gihpkd32.exe
        
        C:\Windows\system32\Gihpkd32.exe
        178⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6852
        
        C:\Windows\SysWOW64\Gndick32.exe
        
        C:\Windows\system32\Gndick32.exe
        179⤵
        Drops file in System32 directory
        
        PID:7120
        
        C:\Windows\SysWOW64\Geoapenf.exe
        
        C:\Windows\system32\Geoapenf.exe
        180⤵
        Modifies registry class
        
        PID:4144
        
        C:\Windows\SysWOW64\Glhimp32.exe
        
        C:\Windows\system32\Glhimp32.exe
        181⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        182⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Hnibokbd.exe
        
        C:\Windows\system32\Hnibokbd.exe
        183⤵
        Drops file in System32 directory
        
        PID:7232
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        184⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        185⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Hnlodjpa.exe
        
        C:\Windows\system32\Hnlodjpa.exe
        186⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Hhdcmp32.exe
        
        C:\Windows\system32\Hhdcmp32.exe
        187⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Halhfe32.exe
        
        C:\Windows\system32\Halhfe32.exe
        188⤵
        Drops file in System32 directory
        
        PID:7436
        
        C:\Windows\SysWOW64\Hnbeeiji.exe
        
        C:\Windows\system32\Hnbeeiji.exe
        189⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        190⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        191⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Ieagmcmq.exe
        
        C:\Windows\system32\Ieagmcmq.exe
        192⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Ilkoim32.exe
        
        C:\Windows\system32\Ilkoim32.exe
        193⤵
        
        PID:7648
        
        C:\Windows\SysWOW64\Ibegfglj.exe
        
        C:\Windows\system32\Ibegfglj.exe
        194⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        195⤵
        
        PID:7740
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        196⤵
        Modifies registry class
        
        PID:7780
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        197⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        198⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7864
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        199⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\Jekjcaef.exe
        
        C:\Windows\system32\Jekjcaef.exe
        200⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        201⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        202⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8048
        
        C:\Windows\SysWOW64\Jemfhacc.exe
        
        C:\Windows\system32\Jemfhacc.exe
        203⤵
        
        PID:8092
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        204⤵
        Drops file in System32 directory
        
        PID:8132
        
        C:\Windows\SysWOW64\Jbagbebm.exe
        
        C:\Windows\system32\Jbagbebm.exe
        205⤵
        
        PID:8172
        
        C:\Windows\SysWOW64\Jikoopij.exe
        
        C:\Windows\system32\Jikoopij.exe
        206⤵
        Drops file in System32 directory
        
        PID:7228
        
        C:\Windows\SysWOW64\Jpegkj32.exe
        
        C:\Windows\system32\Jpegkj32.exe
        207⤵
        Modifies registry class
        
        PID:7264
        
        C:\Windows\SysWOW64\Jafdcbge.exe
        
        C:\Windows\system32\Jafdcbge.exe
        208⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7384
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        209⤵
        Drops file in System32 directory
        
        PID:7460
        
        C:\Windows\SysWOW64\Jahqiaeb.exe
        
        C:\Windows\system32\Jahqiaeb.exe
        210⤵
        Modifies registry class
        
        PID:7536
        
        C:\Windows\SysWOW64\Klndfj32.exe
        
        C:\Windows\system32\Klndfj32.exe
        211⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        212⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        213⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Kheekkjl.exe
        
        C:\Windows\system32\Kheekkjl.exe
        214⤵
        
        PID:7808
        
        C:\Windows\SysWOW64\Koonge32.exe
        
        C:\Windows\system32\Koonge32.exe
        215⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Keifdpif.exe
        
        C:\Windows\system32\Keifdpif.exe
        216⤵
        
        PID:7932
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        217⤵
        Modifies registry class
        
        PID:7996
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        218⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        219⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8144
        
        C:\Windows\SysWOW64\Kemooo32.exe
        
        C:\Windows\system32\Kemooo32.exe
        220⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Klggli32.exe
        
        C:\Windows\system32\Klggli32.exe
        221⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        222⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        223⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7636
        
        C:\Windows\SysWOW64\Lhqefjpo.exe
        
        C:\Windows\system32\Lhqefjpo.exe
        224⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Lpgmhg32.exe
        
        C:\Windows\system32\Lpgmhg32.exe
        225⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7876
        
        C:\Windows\SysWOW64\Ljpaqmgb.exe
        
        C:\Windows\system32\Ljpaqmgb.exe
        226⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7432
        
        C:\Windows\SysWOW64\Lckboblp.exe
        
        C:\Windows\system32\Lckboblp.exe
        228⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        229⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Mjidgkog.exe
        
        C:\Windows\system32\Mjidgkog.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7364
        
        C:\Windows\SysWOW64\Mpclce32.exe
        
        C:\Windows\system32\Mpclce32.exe
        231⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        232⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7708
        
        C:\Windows\SysWOW64\Mpeiie32.exe
        
        C:\Windows\system32\Mpeiie32.exe
        233⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        234⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Mjnnbk32.exe
        
        C:\Windows\system32\Mjnnbk32.exe
        235⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Mokfja32.exe
        
        C:\Windows\system32\Mokfja32.exe
        236⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        237⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Mhckcgpj.exe
        
        C:\Windows\system32\Mhckcgpj.exe
        238⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7244
        
        C:\Windows\SysWOW64\Mqjbddpl.exe
        
        C:\Windows\system32\Mqjbddpl.exe
        239⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        240⤵
        
        PID:3020
        
        C:\Windows\SysWOW64\Nqmojd32.exe
        
        C:\Windows\system32\Nqmojd32.exe
        241⤵
        
        PID:3424
        
        C:\Windows\SysWOW64\Nbnlaldg.exe
        
        C:\Windows\system32\Nbnlaldg.exe
        242⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Nmcpoedn.exe
        
        C:\Windows\system32\Nmcpoedn.exe
        243⤵
        Drops file in System32 directory
        
        PID:7464
        
        C:\Windows\SysWOW64\Nfldgk32.exe
        
        C:\Windows\system32\Nfldgk32.exe
        244⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Nijqcf32.exe
        
        C:\Windows\system32\Nijqcf32.exe
        245⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        246⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        247⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\Nofefp32.exe
        
        C:\Windows\system32\Nofefp32.exe
        248⤵
        Modifies registry class
        
        PID:7472
        
        C:\Windows\SysWOW64\Niojoeel.exe
        
        C:\Windows\system32\Niojoeel.exe
        249⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        250⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Ofckhj32.exe
        
        C:\Windows\system32\Ofckhj32.exe
        251⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        252⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8332
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        253⤵
        
        PID:8368
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        254⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Ocihgnam.exe
        
        C:\Windows\system32\Ocihgnam.exe
        255⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        256⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        257⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        258⤵
        
        PID:8588
        
        C:\Windows\SysWOW64\Ocnabm32.exe
        
        C:\Windows\system32\Ocnabm32.exe
        259⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Omfekbdh.exe
        
        C:\Windows\system32\Omfekbdh.exe
        260⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Pbcncibp.exe
        
        C:\Windows\system32\Pbcncibp.exe
        261⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Padnaq32.exe
        
        C:\Windows\system32\Padnaq32.exe
        262⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Pfagighf.exe
        
        C:\Windows\system32\Pfagighf.exe
        263⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Piocecgj.exe
        
        C:\Windows\system32\Piocecgj.exe
        264⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Ppikbm32.exe
        
        C:\Windows\system32\Ppikbm32.exe
        265⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Pjoppf32.exe
        
        C:\Windows\system32\Pjoppf32.exe
        266⤵
        Drops file in System32 directory
        
        PID:8924
        
        C:\Windows\SysWOW64\Pmmlla32.exe
        
        C:\Windows\system32\Pmmlla32.exe
        267⤵
        
        PID:8964
        
        C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        268⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Pfepdg32.exe
        
        C:\Windows\system32\Pfepdg32.exe
        269⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Pakdbp32.exe
        
        C:\Windows\system32\Pakdbp32.exe
        270⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9100
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        271⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        272⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Qamago32.exe
        
        C:\Windows\system32\Qamago32.exe
        273⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Qbonoghb.exe
        
        C:\Windows\system32\Qbonoghb.exe
        274⤵
        
        PID:8268
        
        C:\Windows\SysWOW64\Afhfaddk.exe
        
        C:\Windows\system32\Afhfaddk.exe
        275⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Banjnm32.exe
        
        C:\Windows\system32\Banjnm32.exe
        276⤵
        
        PID:8440
        
        C:\Windows\SysWOW64\Bpcgpihi.exe
        
        C:\Windows\system32\Bpcgpihi.exe
        277⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8508
        
        C:\Windows\SysWOW64\Bpedeiff.exe
        
        C:\Windows\system32\Bpedeiff.exe
        278⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Binhnomg.exe
        
        C:\Windows\system32\Binhnomg.exe
        279⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Bphqji32.exe
        
        C:\Windows\system32\Bphqji32.exe
        280⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Cdhffg32.exe
        
        C:\Windows\system32\Cdhffg32.exe
        281⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Cgiohbfi.exe
        
        C:\Windows\system32\Cgiohbfi.exe
        282⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Cdmoafdb.exe
        
        C:\Windows\system32\Cdmoafdb.exe
        283⤵
        Modifies registry class
        
        PID:8912
        
        C:\Windows\SysWOW64\Ckggnp32.exe
        
        C:\Windows\system32\Ckggnp32.exe
        284⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Cmedjl32.exe
        
        C:\Windows\system32\Cmedjl32.exe
        285⤵
        
        PID:9084
        
        C:\Windows\SysWOW64\Cdolgfbp.exe
        
        C:\Windows\system32\Cdolgfbp.exe
        286⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Cgmhcaac.exe
        
        C:\Windows\system32\Cgmhcaac.exe
        287⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Cildom32.exe
        
        C:\Windows\system32\Cildom32.exe
        288⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Cacmpj32.exe
        
        C:\Windows\system32\Cacmpj32.exe
        289⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Ccdihbgg.exe
        
        C:\Windows\system32\Ccdihbgg.exe
        290⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Dinael32.exe
        
        C:\Windows\system32\Dinael32.exe
        291⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Daeifj32.exe
        
        C:\Windows\system32\Daeifj32.exe
        292⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Dgbanq32.exe
        
        C:\Windows\system32\Dgbanq32.exe
        293⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Dnljkk32.exe
        
        C:\Windows\system32\Dnljkk32.exe
        294⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8916
        
        C:\Windows\SysWOW64\Ddfbgelh.exe
        
        C:\Windows\system32\Ddfbgelh.exe
        295⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Dkpjdo32.exe
        
        C:\Windows\system32\Dkpjdo32.exe
        296⤵
        
        PID:9120
        
        C:\Windows\SysWOW64\Dajbaika.exe
        
        C:\Windows\system32\Dajbaika.exe
        297⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Dggkipii.exe
        
        C:\Windows\system32\Dggkipii.exe
        298⤵
        
        PID:8324
        
        C:\Windows\SysWOW64\Dnqcfjae.exe
        
        C:\Windows\system32\Dnqcfjae.exe
        299⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Ddklbd32.exe
        
        C:\Windows\system32\Ddklbd32.exe
        300⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Dkedonpo.exe
        
        C:\Windows\system32\Dkedonpo.exe
        301⤵
        
        PID:8872
        
        C:\Windows\SysWOW64\Daollh32.exe
        
        C:\Windows\system32\Daollh32.exe
        302⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Dcphdqmj.exe
        
        C:\Windows\system32\Dcphdqmj.exe
        303⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Enemaimp.exe
        
        C:\Windows\system32\Enemaimp.exe
        304⤵
        
        PID:8360
        
        C:\Windows\SysWOW64\Egnajocq.exe
        
        C:\Windows\system32\Egnajocq.exe
        305⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Ejlnfjbd.exe
        
        C:\Windows\system32\Ejlnfjbd.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8892
        
        C:\Windows\SysWOW64\Edaaccbj.exe
        
        C:\Windows\system32\Edaaccbj.exe
        307⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Enjfli32.exe
        
        C:\Windows\system32\Enjfli32.exe
        308⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Eddnic32.exe
        
        C:\Windows\system32\Eddnic32.exe
        309⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Enlcahgh.exe
        
        C:\Windows\system32\Enlcahgh.exe
        310⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Egegjn32.exe
        
        C:\Windows\system32\Egegjn32.exe
        311⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Enopghee.exe
        
        C:\Windows\system32\Enopghee.exe
        312⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Edihdb32.exe
        
        C:\Windows\system32\Edihdb32.exe
        313⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Fkcpql32.exe
        
        C:\Windows\system32\Fkcpql32.exe
        314⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9328
        
        C:\Windows\SysWOW64\Fqphic32.exe
        
        C:\Windows\system32\Fqphic32.exe
        315⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Fgiaemic.exe
        
        C:\Windows\system32\Fgiaemic.exe
        316⤵
        Drops file in System32 directory
        
        PID:9428
        
        C:\Windows\SysWOW64\Fncibg32.exe
        
        C:\Windows\system32\Fncibg32.exe
        317⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Fdmaoahm.exe
        
        C:\Windows\system32\Fdmaoahm.exe
        318⤵
        
        PID:9516
        
        C:\Windows\SysWOW64\Fkgillpj.exe
        
        C:\Windows\system32\Fkgillpj.exe
        319⤵
        
        PID:9560
        
        C:\Windows\SysWOW64\Fnffhgon.exe
        
        C:\Windows\system32\Fnffhgon.exe
        320⤵
        
        PID:9604
        
        C:\Windows\SysWOW64\Fcbnpnme.exe
        
        C:\Windows\system32\Fcbnpnme.exe
        321⤵
        Modifies registry class
        
        PID:9660
        
        C:\Windows\SysWOW64\Fjmfmh32.exe
        
        C:\Windows\system32\Fjmfmh32.exe
        322⤵
        
        PID:9700
        
        C:\Windows\SysWOW64\Fdbkja32.exe
        
        C:\Windows\system32\Fdbkja32.exe
        323⤵
        
        PID:9744
        
        C:\Windows\SysWOW64\Fjocbhbo.exe
        
        C:\Windows\system32\Fjocbhbo.exe
        324⤵
        
        PID:9788
        
        C:\Windows\SysWOW64\Gcghkm32.exe
        
        C:\Windows\system32\Gcghkm32.exe
        325⤵
        
        PID:9828
        
        C:\Windows\SysWOW64\Gnmlhf32.exe
        
        C:\Windows\system32\Gnmlhf32.exe
        326⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Gcjdam32.exe
        
        C:\Windows\system32\Gcjdam32.exe
        327⤵
        Drops file in System32 directory
        
        PID:9908
        
        C:\Windows\SysWOW64\Gjcmngnj.exe
        
        C:\Windows\system32\Gjcmngnj.exe
        328⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Gbkdod32.exe
        
        C:\Windows\system32\Gbkdod32.exe
        329⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Gclafmej.exe
        
        C:\Windows\system32\Gclafmej.exe
        330⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Gnaecedp.exe
        
        C:\Windows\system32\Gnaecedp.exe
        331⤵
        
        PID:10076
        
        C:\Windows\SysWOW64\Gdknpp32.exe
        
        C:\Windows\system32\Gdknpp32.exe
        332⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Gqbneq32.exe
        
        C:\Windows\system32\Gqbneq32.exe
        333⤵
        Modifies registry class
        
        PID:10156
        
        C:\Windows\SysWOW64\Gkhbbi32.exe
        
        C:\Windows\system32\Gkhbbi32.exe
        334⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Gbbkocid.exe
        
        C:\Windows\system32\Gbbkocid.exe
        335⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Hgocgjgk.exe
        
        C:\Windows\system32\Hgocgjgk.exe
        336⤵
        Modifies registry class
        
        PID:9260
        
        C:\Windows\SysWOW64\Hqghqpnl.exe
        
        C:\Windows\system32\Hqghqpnl.exe
        337⤵
        Modifies registry class
        
        PID:3896
        
        C:\Windows\SysWOW64\Hcedmkmp.exe
        
        C:\Windows\system32\Hcedmkmp.exe
        338⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Hjolie32.exe
        
        C:\Windows\system32\Hjolie32.exe
        339⤵
        
        PID:9452
        
        C:\Windows\SysWOW64\Haidfpki.exe
        
        C:\Windows\system32\Haidfpki.exe
        340⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Hjaioe32.exe
        
        C:\Windows\system32\Hjaioe32.exe
        341⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Halaloif.exe
        
        C:\Windows\system32\Halaloif.exe
        342⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Hkaeih32.exe
        
        C:\Windows\system32\Hkaeih32.exe
        343⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Hbknebqi.exe
        
        C:\Windows\system32\Hbknebqi.exe
        344⤵
        Drops file in System32 directory
        
        PID:9812
        
        C:\Windows\SysWOW64\Hghfnioq.exe
        
        C:\Windows\system32\Hghfnioq.exe
        345⤵
        Drops file in System32 directory
        
        PID:9892
        
        C:\Windows\SysWOW64\Ibnjkbog.exe
        
        C:\Windows\system32\Ibnjkbog.exe
        346⤵
        
        PID:9980
        
        C:\Windows\SysWOW64\Igjbci32.exe
        
        C:\Windows\system32\Igjbci32.exe
        347⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Indkpcdk.exe
        
        C:\Windows\system32\Indkpcdk.exe
        348⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10108
        
        C:\Windows\SysWOW64\Icachjbb.exe
        
        C:\Windows\system32\Icachjbb.exe
        349⤵
        
        PID:10168
        
        C:\Windows\SysWOW64\Infhebbh.exe
        
        C:\Windows\system32\Infhebbh.exe
        350⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Iccpniqp.exe
        
        C:\Windows\system32\Iccpniqp.exe
        351⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3980
        
        C:\Windows\SysWOW64\Ilkhog32.exe
        
        C:\Windows\system32\Ilkhog32.exe
        352⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Iagqgn32.exe
        
        C:\Windows\system32\Iagqgn32.exe
        353⤵
        
        PID:9508
        
        C:\Windows\SysWOW64\Icfmci32.exe
        
        C:\Windows\system32\Icfmci32.exe
        354⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Inkaqb32.exe
        
        C:\Windows\system32\Inkaqb32.exe
        355⤵
        
        PID:9732
        
        C:\Windows\SysWOW64\Idhiii32.exe
        
        C:\Windows\system32\Idhiii32.exe
        356⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Ijbbfc32.exe
        
        C:\Windows\system32\Ijbbfc32.exe
        357⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Jaljbmkd.exe
        
        C:\Windows\system32\Jaljbmkd.exe
        358⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Jhfbog32.exe
        
        C:\Windows\system32\Jhfbog32.exe
        359⤵
        Modifies registry class
        
        PID:10152
        
        C:\Windows\SysWOW64\Jblflp32.exe
        
        C:\Windows\system32\Jblflp32.exe
        360⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Jhhodg32.exe
        
        C:\Windows\system32\Jhhodg32.exe
        361⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Jjgkab32.exe
        
        C:\Windows\system32\Jjgkab32.exe
        362⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Jbncbpqd.exe
        
        C:\Windows\system32\Jbncbpqd.exe
        363⤵
        Modifies registry class
        
        PID:4696

C:\Windows\SysWOW64\Ldgccb32.exe
C:\Windows\system32\Ldgccb32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528

C:\Windows\SysWOW64\Lnmkfh32.exe
C:\Windows\system32\Lnmkfh32.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516

C:\Windows\SysWOW64\Jdopjh32.exe
C:\Windows\system32\Jdopjh32.exe
1⤵
- Drops file in System32 directory
PID:9808
- C:\Windows\SysWOW64\Jjihfbno.exe
  C:\Windows\system32\Jjihfbno.exe
  2⤵
  PID:9968
- - C:\Windows\SysWOW64\Jacpcl32.exe
    C:\Windows\system32\Jacpcl32.exe
    3⤵
    PID:10140
  - - C:\Windows\SysWOW64\Kkbkmqed.exe
      C:\Windows\system32\Kkbkmqed.exe
      4⤵
      PID:10228
    - - C:\Windows\SysWOW64\Kehojiej.exe
        
        C:\Windows\system32\Kehojiej.exe
        5⤵
        
        PID:4356
      - C:\Windows\SysWOW64\Klbgfc32.exe
        
        C:\Windows\system32\Klbgfc32.exe
        6⤵
        
        PID:9548
        
        C:\Windows\SysWOW64\Kaopoj32.exe
        
        C:\Windows\system32\Kaopoj32.exe
        7⤵
        
        PID:9736
        
        C:\Windows\SysWOW64\Khihld32.exe
        
        C:\Windows\system32\Khihld32.exe
        8⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Kbnlim32.exe
        
        C:\Windows\system32\Kbnlim32.exe
        9⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\Kdpiqehp.exe
        
        C:\Windows\system32\Kdpiqehp.exe
        10⤵
        Drops file in System32 directory
        
        PID:3416
        
        C:\Windows\SysWOW64\Lkiamp32.exe
        
        C:\Windows\system32\Lkiamp32.exe
        11⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Lbqinm32.exe
        
        C:\Windows\system32\Lbqinm32.exe
        12⤵
        Drops file in System32 directory
        
        PID:4712
        
        C:\Windows\SysWOW64\Llimgb32.exe
        
        C:\Windows\system32\Llimgb32.exe
        13⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\Laffpi32.exe
        
        C:\Windows\system32\Laffpi32.exe
        14⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Lhpnlclc.exe
        
        C:\Windows\system32\Lhpnlclc.exe
        15⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Lknjhokg.exe
        
        C:\Windows\system32\Lknjhokg.exe
        16⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\Lahbei32.exe
        
        C:\Windows\system32\Lahbei32.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9460
        
        C:\Windows\SysWOW64\Lhbkac32.exe
        
        C:\Windows\system32\Lhbkac32.exe
        18⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\Lajokiaa.exe
        
        C:\Windows\system32\Lajokiaa.exe
        19⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\Llpchaqg.exe
        
        C:\Windows\system32\Llpchaqg.exe
        20⤵
        
        PID:10104
        
        C:\Windows\SysWOW64\Lamlphoo.exe
        
        C:\Windows\system32\Lamlphoo.exe
        21⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\Ldkhlcnb.exe
        
        C:\Windows\system32\Ldkhlcnb.exe
        22⤵
        Drops file in System32 directory
        
        PID:9740
        
        C:\Windows\SysWOW64\Mkepineo.exe
        
        C:\Windows\system32\Mkepineo.exe
        23⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\Maoifh32.exe
        
        C:\Windows\system32\Maoifh32.exe
        24⤵
        Modifies registry class
        
        PID:4152
        
        C:\Windows\SysWOW64\Mhiabbdi.exe
        
        C:\Windows\system32\Mhiabbdi.exe
        25⤵
        
        PID:5092
        
        C:\Windows\SysWOW64\Mociol32.exe
        
        C:\Windows\system32\Mociol32.exe
        26⤵
        
        PID:9776
        
        C:\Windows\SysWOW64\Mlgjhp32.exe
        
        C:\Windows\system32\Mlgjhp32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5116
        
        C:\Windows\SysWOW64\Madbagif.exe
        
        C:\Windows\system32\Madbagif.exe
        28⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\Mafofggd.exe
        
        C:\Windows\system32\Mafofggd.exe
        29⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\Mllccpfj.exe
        
        C:\Windows\system32\Mllccpfj.exe
        30⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Mahklf32.exe
        
        C:\Windows\system32\Mahklf32.exe
        31⤵
        
        PID:3676
        
        C:\Windows\SysWOW64\Nchhfild.exe
        
        C:\Windows\system32\Nchhfild.exe
        32⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\Ndidna32.exe
        
        C:\Windows\system32\Ndidna32.exe
        33⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\Ncjdki32.exe
        
        C:\Windows\system32\Ncjdki32.exe
        34⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\Ndlacapp.exe
        
        C:\Windows\system32\Ndlacapp.exe
        35⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\Napameoi.exe
        
        C:\Windows\system32\Napameoi.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2188
        
        C:\Windows\SysWOW64\Nocbfjmc.exe
        
        C:\Windows\system32\Nocbfjmc.exe
        37⤵
        Drops file in System32 directory
        
        PID:4548
        
        C:\Windows\SysWOW64\Nbbnbemf.exe
        
        C:\Windows\system32\Nbbnbemf.exe
        38⤵
        
        PID:9784
        
        C:\Windows\SysWOW64\Nkjckkcg.exe
        
        C:\Windows\system32\Nkjckkcg.exe
        39⤵
        Drops file in System32 directory
        
        PID:9348
        
        C:\Windows\SysWOW64\Nbdkhe32.exe
        
        C:\Windows\system32\Nbdkhe32.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3252
        
        C:\Windows\SysWOW64\Okmpqjad.exe
        
        C:\Windows\system32\Okmpqjad.exe
        41⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Obfhmd32.exe
        
        C:\Windows\system32\Obfhmd32.exe
        42⤵
        Drops file in System32 directory
        
        PID:10300
        
        C:\Windows\SysWOW64\Ollljmhg.exe
        
        C:\Windows\system32\Ollljmhg.exe
        43⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:10336
        
        C:\Windows\SysWOW64\Ookhfigk.exe
        
        C:\Windows\system32\Ookhfigk.exe
        44⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Odgqopeb.exe
        
        C:\Windows\system32\Odgqopeb.exe
        45⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Okailj32.exe
        
        C:\Windows\system32\Okailj32.exe
        46⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Pokanf32.exe
        
        C:\Windows\system32\Pokanf32.exe
        47⤵
        Modifies registry class
        
        PID:10512
        
        C:\Windows\SysWOW64\Pfeijqqe.exe
        
        C:\Windows\system32\Pfeijqqe.exe
        48⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\Pkabbgol.exe
        
        C:\Windows\system32\Pkabbgol.exe
        49⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Qppkhfec.exe
        
        C:\Windows\system32\Qppkhfec.exe
        50⤵
        Drops file in System32 directory
        
        PID:10644
        
        C:\Windows\SysWOW64\Aflpkpjm.exe
        
        C:\Windows\system32\Aflpkpjm.exe
        51⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Amfhgj32.exe
        
        C:\Windows\system32\Amfhgj32.exe
        52⤵
        
        PID:10728
        
        C:\Windows\SysWOW64\Apddce32.exe
        
        C:\Windows\system32\Apddce32.exe
        53⤵
        
        PID:10776
        
        C:\Windows\SysWOW64\Apgqie32.exe
        
        C:\Windows\system32\Apgqie32.exe
        54⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Aecialmb.exe
        
        C:\Windows\system32\Aecialmb.exe
        55⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Amkabind.exe
        
        C:\Windows\system32\Amkabind.exe
        56⤵
        
        PID:10900
        
        C:\Windows\SysWOW64\Abgjkpll.exe
        
        C:\Windows\system32\Abgjkpll.exe
        57⤵
        
        PID:10944
        
        C:\Windows\SysWOW64\Acgfec32.exe
        
        C:\Windows\system32\Acgfec32.exe
        58⤵
        
        PID:10984
        
        C:\Windows\SysWOW64\Apngjd32.exe
        
        C:\Windows\system32\Apngjd32.exe
        59⤵
        
        PID:11028
        
        C:\Windows\SysWOW64\Bblcfo32.exe
        
        C:\Windows\system32\Bblcfo32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11072
        
        C:\Windows\SysWOW64\Bmagch32.exe
        
        C:\Windows\system32\Bmagch32.exe
        61⤵
        
        PID:11112
        
        C:\Windows\SysWOW64\Bmddihfj.exe
        
        C:\Windows\system32\Bmddihfj.exe
        62⤵
        Drops file in System32 directory
        
        PID:11152
        
        C:\Windows\SysWOW64\Bmfqngcg.exe
        
        C:\Windows\system32\Bmfqngcg.exe
        63⤵
        
        PID:11192
        
        C:\Windows\SysWOW64\Bpemkcck.exe
        
        C:\Windows\system32\Bpemkcck.exe
        64⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Bfoegm32.exe
        
        C:\Windows\system32\Bfoegm32.exe
        65⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\Blknpdho.exe
        
        C:\Windows\system32\Blknpdho.exe
        66⤵
        Modifies registry class
        
        PID:10332
        
        C:\Windows\SysWOW64\Bbefln32.exe
        
        C:\Windows\system32\Bbefln32.exe
        67⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Bipnihgi.exe
        
        C:\Windows\system32\Bipnihgi.exe
        68⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\Cpifeb32.exe
        
        C:\Windows\system32\Cpifeb32.exe
        69⤵
        
        PID:10492
        
        C:\Windows\SysWOW64\Cefoni32.exe
        
        C:\Windows\system32\Cefoni32.exe
        70⤵
        
        PID:10564
        
        C:\Windows\SysWOW64\Cplckbmc.exe
        
        C:\Windows\system32\Cplckbmc.exe
        71⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Cehlcikj.exe
        
        C:\Windows\system32\Cehlcikj.exe
        72⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Cmpcdfll.exe
        
        C:\Windows\system32\Cmpcdfll.exe
        73⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:10764
        
        C:\Windows\SysWOW64\Cpqlfa32.exe
        
        C:\Windows\system32\Cpqlfa32.exe
        74⤵
        Drops file in System32 directory
        
        PID:10808
        
        C:\Windows\SysWOW64\Cepadh32.exe
        
        C:\Windows\system32\Cepadh32.exe
        75⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Ddqbbo32.exe
        
        C:\Windows\system32\Ddqbbo32.exe
        76⤵
        Modifies registry class
        
        PID:10952
        
        C:\Windows\SysWOW64\Dinjjf32.exe
        
        C:\Windows\system32\Dinjjf32.exe
        77⤵
        
        PID:11020
        
        C:\Windows\SysWOW64\Dpgbgpbe.exe
        
        C:\Windows\system32\Dpgbgpbe.exe
        78⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Dfakcj32.exe
        
        C:\Windows\system32\Dfakcj32.exe
        79⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Dmkcpdao.exe
        
        C:\Windows\system32\Dmkcpdao.exe
        80⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Ddekmo32.exe
        
        C:\Windows\system32\Ddekmo32.exe
        81⤵
        
        PID:10296
        
        C:\Windows\SysWOW64\Dibdeegc.exe
        
        C:\Windows\system32\Dibdeegc.exe
        82⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10368
        
        C:\Windows\SysWOW64\Dpllbp32.exe
        
        C:\Windows\system32\Dpllbp32.exe
        83⤵
        
        PID:10504
        
        C:\Windows\SysWOW64\Dgfdojfm.exe
        
        C:\Windows\system32\Dgfdojfm.exe
        84⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Dlcmgqdd.exe
        
        C:\Windows\system32\Dlcmgqdd.exe
        85⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\Dghadidj.exe
        
        C:\Windows\system32\Dghadidj.exe
        86⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4380
        
        C:\Windows\SysWOW64\Dmbiackg.exe
        
        C:\Windows\system32\Dmbiackg.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10804
        
        C:\Windows\SysWOW64\Ecoaijio.exe
        
        C:\Windows\system32\Ecoaijio.exe
        88⤵
        
        PID:2172
        
        C:\Windows\SysWOW64\Elhfbp32.exe
        
        C:\Windows\system32\Elhfbp32.exe
        89⤵
        
        PID:10932
        
        C:\Windows\SysWOW64\Eepkkefp.exe
        
        C:\Windows\system32\Eepkkefp.exe
        90⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Eljchpnl.exe
        
        C:\Windows\system32\Eljchpnl.exe
        91⤵
        
        PID:11092
        
        C:\Windows\SysWOW64\Egpgehnb.exe
        
        C:\Windows\system32\Egpgehnb.exe
        92⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Emioab32.exe
        
        C:\Windows\system32\Emioab32.exe
        93⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Edcgnmml.exe
        
        C:\Windows\system32\Edcgnmml.exe
        94⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Eeddfe32.exe
        
        C:\Windows\system32\Eeddfe32.exe
        95⤵
        
        PID:10420
        
        C:\Windows\SysWOW64\Elolco32.exe
        
        C:\Windows\system32\Elolco32.exe
        96⤵
        
        PID:9300
        
        C:\Windows\SysWOW64\Edfddl32.exe
        
        C:\Windows\system32\Edfddl32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4600
        
        C:\Windows\SysWOW64\Eegqldqg.exe
        
        C:\Windows\system32\Eegqldqg.exe
        98⤵
        
        PID:10640
        
        C:\Windows\SysWOW64\Fckaeioa.exe
        
        C:\Windows\system32\Fckaeioa.exe
        99⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Fdadpk32.exe
        
        C:\Windows\system32\Fdadpk32.exe
        100⤵
        Drops file in System32 directory
        
        PID:4836
        
        C:\Windows\SysWOW64\Ffcpgcfj.exe
        
        C:\Windows\system32\Ffcpgcfj.exe
        101⤵
        
        PID:880
        
        C:\Windows\SysWOW64\Glmhdm32.exe
        
        C:\Windows\system32\Glmhdm32.exe
        102⤵
        
        PID:3952
        
        C:\Windows\SysWOW64\Gcgqag32.exe
        
        C:\Windows\system32\Gcgqag32.exe
        103⤵
        
        PID:3256
        
        C:\Windows\SysWOW64\Gfemmb32.exe
        
        C:\Windows\system32\Gfemmb32.exe
        104⤵
        
        PID:11120
        
        C:\Windows\SysWOW64\Ggdigekj.exe
        
        C:\Windows\system32\Ggdigekj.exe
        105⤵
        Drops file in System32 directory
        
        PID:11208
        
        C:\Windows\SysWOW64\Gnoacp32.exe
        
        C:\Windows\system32\Gnoacp32.exe
        106⤵
        
        PID:10264
        
        C:\Windows\SysWOW64\Gckjlf32.exe
        
        C:\Windows\system32\Gckjlf32.exe
        107⤵
        
        PID:916
        
        C:\Windows\SysWOW64\Gcngafol.exe
        
        C:\Windows\system32\Gcngafol.exe
        108⤵
        
        PID:1228
        
        C:\Windows\SysWOW64\Gjhonp32.exe
        
        C:\Windows\system32\Gjhonp32.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10540
        
        C:\Windows\SysWOW64\Gdmcki32.exe
        
        C:\Windows\system32\Gdmcki32.exe
        110⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\Hfnpca32.exe
        
        C:\Windows\system32\Hfnpca32.exe
        111⤵
        
        PID:804
        
        C:\Windows\SysWOW64\Hnehdo32.exe
        
        C:\Windows\system32\Hnehdo32.exe
        112⤵
        Drops file in System32 directory
        
        PID:4428
        
        C:\Windows\SysWOW64\Hdppaidl.exe
        
        C:\Windows\system32\Hdppaidl.exe
        113⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2376
        
        C:\Windows\SysWOW64\Hnhdjn32.exe
        
        C:\Windows\system32\Hnhdjn32.exe
        114⤵
        Drops file in System32 directory
        
        PID:4748
        
        C:\Windows\SysWOW64\Hcembe32.exe
        
        C:\Windows\system32\Hcembe32.exe
        115⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Hfcinq32.exe
        
        C:\Windows\system32\Hfcinq32.exe
        116⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Hqimlihn.exe
        
        C:\Windows\system32\Hqimlihn.exe
        117⤵
        Modifies registry class
        
        PID:2768
        
        C:\Windows\SysWOW64\Hnmnengg.exe
        
        C:\Windows\system32\Hnmnengg.exe
        118⤵
        
        PID:10280
        
        C:\Windows\SysWOW64\Hdffah32.exe
        
        C:\Windows\system32\Hdffah32.exe
        119⤵
        
        PID:10360
        
        C:\Windows\SysWOW64\Hjcojo32.exe
        
        C:\Windows\system32\Hjcojo32.exe
        120⤵
        Modifies registry class
        
        PID:4176
        
        C:\Windows\SysWOW64\Hqmggi32.exe
        
        C:\Windows\system32\Hqmggi32.exe
        121⤵
        Modifies registry class
        
        PID:10696
        
        C:\Windows\SysWOW64\Ifjoop32.exe
        
        C:\Windows\system32\Ifjoop32.exe
        122⤵
        
        PID:408
        
        C:\Windows\SysWOW64\Imdgljil.exe
        
        C:\Windows\system32\Imdgljil.exe
        123⤵
        Modifies registry class
        
        PID:1080
        
        C:\Windows\SysWOW64\Icnphd32.exe
        
        C:\Windows\system32\Icnphd32.exe
        124⤵
        Modifies registry class
        
        PID:4632
        
        C:\Windows\SysWOW64\Imfdaigj.exe
        
        C:\Windows\system32\Imfdaigj.exe
        125⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\Icqmncof.exe
        
        C:\Windows\system32\Icqmncof.exe
        126⤵
        
        PID:924
        
        C:\Windows\SysWOW64\Ijjekn32.exe
        
        C:\Windows\system32\Ijjekn32.exe
        127⤵
        Modifies registry class
        
        PID:1444
        
        C:\Windows\SysWOW64\Iqdmghnp.exe
        
        C:\Windows\system32\Iqdmghnp.exe
        128⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\Ifaepolg.exe
        
        C:\Windows\system32\Ifaepolg.exe
        129⤵
        
        PID:1580
        
        C:\Windows\SysWOW64\Iqgjmg32.exe
        
        C:\Windows\system32\Iqgjmg32.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2728
        
        C:\Windows\SysWOW64\Icefib32.exe
        
        C:\Windows\system32\Icefib32.exe
        131⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\Inkjfk32.exe
        
        C:\Windows\system32\Inkjfk32.exe
        132⤵
        
        PID:3968
        
        C:\Windows\SysWOW64\Icgbob32.exe
        
        C:\Windows\system32\Icgbob32.exe
        133⤵
        
        PID:2488
        
        C:\Windows\SysWOW64\Jnmglk32.exe
        
        C:\Windows\system32\Jnmglk32.exe
        134⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\Jakchf32.exe
        
        C:\Windows\system32\Jakchf32.exe
        135⤵
        
        PID:2944
        
        C:\Windows\SysWOW64\Jcjodbgl.exe
        
        C:\Windows\system32\Jcjodbgl.exe
        136⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Jnocakfb.exe
        
        C:\Windows\system32\Jnocakfb.exe
        137⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\Janpnfee.exe
        
        C:\Windows\system32\Janpnfee.exe
        138⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\Jghhjq32.exe
        
        C:\Windows\system32\Jghhjq32.exe
        139⤵
        
        PID:11180
        
        C:\Windows\SysWOW64\Jnapgjdo.exe
        
        C:\Windows\system32\Jnapgjdo.exe
        140⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\Japmcfcc.exe
        
        C:\Windows\system32\Japmcfcc.exe
        141⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\Jcoioabf.exe
        
        C:\Windows\system32\Jcoioabf.exe
        142⤵
        Modifies registry class
        
        PID:3636
        
        C:\Windows\SysWOW64\Jjhalkjc.exe
        
        C:\Windows\system32\Jjhalkjc.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4804
        
        C:\Windows\SysWOW64\Jmgmhgig.exe
        
        C:\Windows\system32\Jmgmhgig.exe
        144⤵
        
        PID:3328
        
        C:\Windows\SysWOW64\Jcaeea32.exe
        
        C:\Windows\system32\Jcaeea32.exe
        145⤵
        
        PID:968
        
        C:\Windows\SysWOW64\Jjknakhq.exe
        
        C:\Windows\system32\Jjknakhq.exe
        146⤵
        
        PID:668
        
        C:\Windows\SysWOW64\Jmijnfgd.exe
        
        C:\Windows\system32\Jmijnfgd.exe
        147⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Kccbjq32.exe
        
        C:\Windows\system32\Kccbjq32.exe
        148⤵
        
        PID:1864
        
        C:\Windows\SysWOW64\Kfanflne.exe
        
        C:\Windows\system32\Kfanflne.exe
        149⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Kagbdenk.exe
        
        C:\Windows\system32\Kagbdenk.exe
        150⤵
        
        PID:5048
        
        C:\Windows\SysWOW64\Kjpgmj32.exe
        
        C:\Windows\system32\Kjpgmj32.exe
        151⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\Kmncif32.exe
        
        C:\Windows\system32\Kmncif32.exe
        152⤵
        
        PID:3336
        
        C:\Windows\SysWOW64\Khcgfo32.exe
        
        C:\Windows\system32\Khcgfo32.exe
        153⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3036
        
        C:\Windows\SysWOW64\Knmpbi32.exe
        
        C:\Windows\system32\Knmpbi32.exe
        154⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Kdjhkp32.exe
        
        C:\Windows\system32\Kdjhkp32.exe
        155⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Kfidgk32.exe
        
        C:\Windows\system32\Kfidgk32.exe
        156⤵
        
        PID:2556
        
        C:\Windows\SysWOW64\Kmbmdeoj.exe
        
        C:\Windows\system32\Kmbmdeoj.exe
        157⤵
        
        PID:700
        
        C:\Windows\SysWOW64\Kdmeqo32.exe
        
        C:\Windows\system32\Kdmeqo32.exe
        158⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Kfkamk32.exe
        
        C:\Windows\system32\Kfkamk32.exe
        159⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\Kmeiie32.exe
        
        C:\Windows\system32\Kmeiie32.exe
        160⤵
        
        PID:3616
        
        C:\Windows\SysWOW64\Lelajb32.exe
        
        C:\Windows\system32\Lelajb32.exe
        161⤵
        Modifies registry class
        
        PID:5828
        
        C:\Windows\SysWOW64\Lfmnbjcg.exe
        
        C:\Windows\system32\Lfmnbjcg.exe
        162⤵
        Drops file in System32 directory
        
        PID:2268
        
        C:\Windows\SysWOW64\Ldanloba.exe
        
        C:\Windows\system32\Ldanloba.exe
        163⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Lfpkhjae.exe
        
        C:\Windows\system32\Lfpkhjae.exe
        164⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Lfbgmj32.exe
        
        C:\Windows\system32\Lfbgmj32.exe
        165⤵
        
        PID:5592
        
        C:\Windows\SysWOW64\Loiong32.exe
        
        C:\Windows\system32\Loiong32.exe
        166⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Lechkaga.exe
        
        C:\Windows\system32\Lechkaga.exe
        167⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Lmnlpcel.exe
        
        C:\Windows\system32\Lmnlpcel.exe
        168⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Ldhdlnli.exe
        
        C:\Windows\system32\Ldhdlnli.exe
        169⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1592
        
        C:\Windows\SysWOW64\Lkbmih32.exe
        
        C:\Windows\system32\Lkbmih32.exe
        170⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\Mehafq32.exe
        
        C:\Windows\system32\Mehafq32.exe
        171⤵
        Drops file in System32 directory
        
        PID:5956
        
        C:\Windows\SysWOW64\Mopeofjl.exe
        
        C:\Windows\system32\Mopeofjl.exe
        172⤵
        
        PID:3864
        
        C:\Windows\SysWOW64\Nahdapae.exe
        
        C:\Windows\system32\Nahdapae.exe
        173⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Nhbmnj32.exe
        
        C:\Windows\system32\Nhbmnj32.exe
        174⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Nkpijfgf.exe
        
        C:\Windows\system32\Nkpijfgf.exe
        175⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1340
        
        C:\Windows\SysWOW64\Najagp32.exe
        
        C:\Windows\system32\Najagp32.exe
        176⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Nggjog32.exe
        
        C:\Windows\system32\Nggjog32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6060
        
        C:\Windows\SysWOW64\Nnabladg.exe
        
        C:\Windows\system32\Nnabladg.exe
        178⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Nehjmnei.exe
        
        C:\Windows\system32\Nehjmnei.exe
        179⤵
        Drops file in System32 directory
        
        PID:5132
        
        C:\Windows\SysWOW64\Ngifef32.exe
        
        C:\Windows\system32\Ngifef32.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5268
        
        C:\Windows\SysWOW64\Nncoaq32.exe
        
        C:\Windows\system32\Nncoaq32.exe
        181⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Ndmgnkja.exe
        
        C:\Windows\system32\Ndmgnkja.exe
        182⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Nkgoke32.exe
        
        C:\Windows\system32\Nkgoke32.exe
        183⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Naaghoik.exe
        
        C:\Windows\system32\Naaghoik.exe
        184⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Ndpcdjho.exe
        
        C:\Windows\system32\Ndpcdjho.exe
        185⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\Oacdmo32.exe
        
        C:\Windows\system32\Oacdmo32.exe
        186⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Ohnljine.exe
        
        C:\Windows\system32\Ohnljine.exe
        187⤵
        Modifies registry class
        
        PID:4700
        
        C:\Windows\SysWOW64\Oklifdmi.exe
        
        C:\Windows\system32\Oklifdmi.exe
        188⤵
        
        PID:904
        
        C:\Windows\SysWOW64\Oafacn32.exe
        
        C:\Windows\system32\Oafacn32.exe
        189⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\Ohpiphlb.exe
        
        C:\Windows\system32\Ohpiphlb.exe
        190⤵
        
        PID:5176
        
        C:\Windows\SysWOW64\Oojalb32.exe
        
        C:\Windows\system32\Oojalb32.exe
        191⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Oediim32.exe
        
        C:\Windows\system32\Oediim32.exe
        192⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Ohbfeh32.exe
        
        C:\Windows\system32\Ohbfeh32.exe
        193⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\Oolnabal.exe
        
        C:\Windows\system32\Oolnabal.exe
        194⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Oakjnnap.exe
        
        C:\Windows\system32\Oakjnnap.exe
        195⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Odifjipd.exe
        
        C:\Windows\system32\Odifjipd.exe
        196⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Okcogc32.exe
        
        C:\Windows\system32\Okcogc32.exe
        197⤵
        Modifies registry class
        
        PID:6020
        
        C:\Windows\SysWOW64\Ohgopgfj.exe
        
        C:\Windows\system32\Ohgopgfj.exe
        198⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Poagma32.exe
        
        C:\Windows\system32\Poagma32.exe
        199⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Paocim32.exe
        
        C:\Windows\system32\Paocim32.exe
        200⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Pgllad32.exe
        
        C:\Windows\system32\Pgllad32.exe
        201⤵
        
        PID:32
        
        C:\Windows\SysWOW64\Pbdmdlie.exe
        
        C:\Windows\system32\Pbdmdlie.exe
        202⤵
        
        PID:2896
        
        C:\Windows\SysWOW64\Pnknim32.exe
        
        C:\Windows\system32\Pnknim32.exe
        203⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Phpbffnp.exe
        
        C:\Windows\system32\Phpbffnp.exe
        204⤵
        
        PID:2644
        
        C:\Windows\SysWOW64\Pkonbamc.exe
        
        C:\Windows\system32\Pkonbamc.exe
        205⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Pbifol32.exe
        
        C:\Windows\system32\Pbifol32.exe
        206⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Pgeogb32.exe
        
        C:\Windows\system32\Pgeogb32.exe
        207⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Qnpgdmjd.exe
        
        C:\Windows\system32\Qnpgdmjd.exe
        208⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Qdipag32.exe
        
        C:\Windows\system32\Qdipag32.exe
        209⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\Qoocnpag.exe
        
        C:\Windows\system32\Qoocnpag.exe
        210⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Qfilkj32.exe
        
        C:\Windows\system32\Qfilkj32.exe
        211⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\Agjhbbob.exe
        
        C:\Windows\system32\Agjhbbob.exe
        212⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Andqol32.exe
        
        C:\Windows\system32\Andqol32.exe
        213⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6036
        
        C:\Windows\SysWOW64\Aijeme32.exe
        
        C:\Windows\system32\Aijeme32.exe
        214⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Anfmeldl.exe
        
        C:\Windows\system32\Anfmeldl.exe
        215⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Adqeaf32.exe
        
        C:\Windows\system32\Adqeaf32.exe
        216⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Agobna32.exe
        
        C:\Windows\system32\Agobna32.exe
        217⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Anijjkbj.exe
        
        C:\Windows\system32\Anijjkbj.exe
        218⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\Agaoca32.exe
        
        C:\Windows\system32\Agaoca32.exe
        219⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Aohfdnil.exe
        
        C:\Windows\system32\Aohfdnil.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6104
        
        C:\Windows\SysWOW64\Afboah32.exe
        
        C:\Windows\system32\Afboah32.exe
        221⤵
        Modifies registry class
        
        PID:6304
        
        C:\Windows\SysWOW64\Agckiqgg.exe
        
        C:\Windows\system32\Agckiqgg.exe
        222⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\Abipfifn.exe
        
        C:\Windows\system32\Abipfifn.exe
        223⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Bgfhnpde.exe
        
        C:\Windows\system32\Bgfhnpde.exe
        224⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Bnppkj32.exe
        
        C:\Windows\system32\Bnppkj32.exe
        225⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Bejhhd32.exe
        
        C:\Windows\system32\Bejhhd32.exe
        226⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\Bghddp32.exe
        
        C:\Windows\system32\Bghddp32.exe
        227⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Bbniai32.exe
        
        C:\Windows\system32\Bbniai32.exe
        228⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Bihancje.exe
        
        C:\Windows\system32\Bihancje.exe
        229⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Bkfmjnii.exe
        
        C:\Windows\system32\Bkfmjnii.exe
        230⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Bbpeghpe.exe
        
        C:\Windows\system32\Bbpeghpe.exe
        231⤵
        
        PID:3704
        
        C:\Windows\SysWOW64\Beobcdoi.exe
        
        C:\Windows\system32\Beobcdoi.exe
        232⤵
        Modifies registry class
        
        PID:5552
        
        C:\Windows\SysWOW64\Bpdfpmoo.exe
        
        C:\Windows\system32\Bpdfpmoo.exe
        233⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Bfnnmg32.exe
        
        C:\Windows\system32\Bfnnmg32.exe
        234⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Bgokdomj.exe
        
        C:\Windows\system32\Bgokdomj.exe
        235⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5204
        
        C:\Windows\SysWOW64\Bpfcelml.exe
        
        C:\Windows\system32\Bpfcelml.exe
        236⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Becknc32.exe
        
        C:\Windows\system32\Becknc32.exe
        237⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Cpipkl32.exe
        
        C:\Windows\system32\Cpipkl32.exe
        238⤵
        Modifies registry class
        
        PID:6668
        
        C:\Windows\SysWOW64\Cfbhhfbg.exe
        
        C:\Windows\system32\Cfbhhfbg.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2428
        
        C:\Windows\SysWOW64\Clpppmqn.exe
        
        C:\Windows\system32\Clpppmqn.exe
        240⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Cfedmfqd.exe
        
        C:\Windows\system32\Cfedmfqd.exe
        241⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\Cnpibh32.exe
        
        C:\Windows\system32\Cnpibh32.exe
        242⤵
        Modifies registry class
        
        PID:6948
        
        C:\Windows\SysWOW64\Cifmoa32.exe
        
        C:\Windows\system32\Cifmoa32.exe
        243⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Cldjkl32.exe
        
        C:\Windows\system32\Cldjkl32.exe
        244⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\Cbnbhfde.exe
        
        C:\Windows\system32\Cbnbhfde.exe
        245⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Cihjeq32.exe
        
        C:\Windows\system32\Cihjeq32.exe
        246⤵
        Drops file in System32 directory
        
        PID:6744
        
        C:\Windows\SysWOW64\Clffalkf.exe
        
        C:\Windows\system32\Clffalkf.exe
        247⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Cbqonf32.exe
        
        C:\Windows\system32\Cbqonf32.exe
        248⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Dijgjpip.exe
        
        C:\Windows\system32\Dijgjpip.exe
        249⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Dpdogj32.exe
        
        C:\Windows\system32\Dpdogj32.exe
        250⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Dpglmjoj.exe
        
        C:\Windows\system32\Dpglmjoj.exe
        251⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Dbehienn.exe
        
        C:\Windows\system32\Dbehienn.exe
        252⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Dolinf32.exe
        
        C:\Windows\system32\Dolinf32.exe
        253⤵
        
        PID:6456
        
        C:\Windows\SysWOW64\Defajqko.exe
        
        C:\Windows\system32\Defajqko.exe
        254⤵
        
        PID:5528
        
        C:\Windows\SysWOW64\Dlpigk32.exe
        
        C:\Windows\system32\Dlpigk32.exe
        255⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Dfemdcba.exe
        
        C:\Windows\system32\Dfemdcba.exe
        256⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Dhgjll32.exe
        
        C:\Windows\system32\Dhgjll32.exe
        257⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Dpnbmi32.exe
        
        C:\Windows\system32\Dpnbmi32.exe
        258⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Efhjjcpo.exe
        
        C:\Windows\system32\Efhjjcpo.exe
        259⤵
        
        PID:11300
        
        C:\Windows\SysWOW64\Ehifak32.exe
        
        C:\Windows\system32\Ehifak32.exe
        260⤵
        
        PID:11344
        
        C:\Windows\SysWOW64\Eppobi32.exe
        
        C:\Windows\system32\Eppobi32.exe
        261⤵
        
        PID:11384
        
        C:\Windows\SysWOW64\Efjgpc32.exe
        
        C:\Windows\system32\Efjgpc32.exe
        262⤵
        
        PID:11428
        
        C:\Windows\SysWOW64\Elgohj32.exe
        
        C:\Windows\system32\Elgohj32.exe
        263⤵
        
        PID:11464
        
        C:\Windows\SysWOW64\Eeodqocd.exe
        
        C:\Windows\system32\Eeodqocd.exe
        264⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\Epgdch32.exe
        
        C:\Windows\system32\Epgdch32.exe
        265⤵
        
        PID:11548
        
        C:\Windows\SysWOW64\Ehbihj32.exe
        
        C:\Windows\system32\Ehbihj32.exe
        266⤵
        
        PID:11588
        
        C:\Windows\SysWOW64\Fbhnec32.exe
        
        C:\Windows\system32\Fbhnec32.exe
        267⤵
        
        PID:11624
        
        C:\Windows\SysWOW64\Fibfbm32.exe
        
        C:\Windows\system32\Fibfbm32.exe
        268⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Fplnogmb.exe
        
        C:\Windows\system32\Fplnogmb.exe
        269⤵
        
        PID:11704
        
        C:\Windows\SysWOW64\Fgffka32.exe
        
        C:\Windows\system32\Fgffka32.exe
        270⤵
        
        PID:11744
        
        C:\Windows\SysWOW64\Fhgccijm.exe
        
        C:\Windows\system32\Fhgccijm.exe
        271⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\Foakpc32.exe
        
        C:\Windows\system32\Foakpc32.exe
        272⤵
        
        PID:11828
        
        C:\Windows\SysWOW64\Fekclnif.exe
        
        C:\Windows\system32\Fekclnif.exe
        273⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\Flekihpc.exe
        
        C:\Windows\system32\Flekihpc.exe
        274⤵
        
        PID:11904
        
        C:\Windows\SysWOW64\Fcodfa32.exe
        
        C:\Windows\system32\Fcodfa32.exe
        275⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\Fiilblom.exe
        
        C:\Windows\system32\Fiilblom.exe
        276⤵
        
        PID:11988
        
        C:\Windows\SysWOW64\Fofdkcmd.exe
        
        C:\Windows\system32\Fofdkcmd.exe
        277⤵
        
        PID:12028
        
        C:\Windows\SysWOW64\Fgmllpng.exe
        
        C:\Windows\system32\Fgmllpng.exe
        278⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Fljedg32.exe
        
        C:\Windows\system32\Fljedg32.exe
        279⤵
        
        PID:12116
        
        C:\Windows\SysWOW64\Gccmaack.exe
        
        C:\Windows\system32\Gccmaack.exe
        280⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\Gebimmco.exe
        
        C:\Windows\system32\Gebimmco.exe
        281⤵
        
        PID:12196
        
        C:\Windows\SysWOW64\Gllajf32.exe
        
        C:\Windows\system32\Gllajf32.exe
        282⤵
        
        PID:12236
        
        C:\Windows\SysWOW64\Gojnfb32.exe
        
        C:\Windows\system32\Gojnfb32.exe
        283⤵
        
        PID:12276
        
        C:\Windows\SysWOW64\Gedfblql.exe
        
        C:\Windows\system32\Gedfblql.exe
        284⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Glnnofhi.exe
        
        C:\Windows\system32\Glnnofhi.exe
        285⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Gchflq32.exe
        
        C:\Windows\system32\Gchflq32.exe
        286⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Giboijgb.exe
        
        C:\Windows\system32\Giboijgb.exe
        287⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Gplged32.exe
        
        C:\Windows\system32\Gplged32.exe
        288⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Ggfobofl.exe
        
        C:\Windows\system32\Ggfobofl.exe
        289⤵
        
        PID:11480
        
        C:\Windows\SysWOW64\Ghgljg32.exe
        
        C:\Windows\system32\Ghgljg32.exe
        290⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Gcmpgpkp.exe
        
        C:\Windows\system32\Gcmpgpkp.exe
        291⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Gjghdj32.exe
        
        C:\Windows\system32\Gjghdj32.exe
        292⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Gledpe32.exe
        
        C:\Windows\system32\Gledpe32.exe
        293⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Hgkimn32.exe
        
        C:\Windows\system32\Hgkimn32.exe
        294⤵
        
        PID:11620
        
        C:\Windows\SysWOW64\Hhleefhe.exe
        
        C:\Windows\system32\Hhleefhe.exe
        295⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\Hgmebnpd.exe
        
        C:\Windows\system32\Hgmebnpd.exe
        296⤵
        
        PID:11736
        
        C:\Windows\SysWOW64\Hhobjf32.exe
        
        C:\Windows\system32\Hhobjf32.exe
        297⤵
        
        PID:11764
        
        C:\Windows\SysWOW64\Hgpbhmna.exe
        
        C:\Windows\system32\Hgpbhmna.exe
        298⤵
        
        PID:11840
        
        C:\Windows\SysWOW64\Hjnndime.exe
        
        C:\Windows\system32\Hjnndime.exe
        299⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Hokgmpkl.exe
        
        C:\Windows\system32\Hokgmpkl.exe
        300⤵
        
        PID:11936
        
        C:\Windows\SysWOW64\Hfeoijbi.exe
        
        C:\Windows\system32\Hfeoijbi.exe
        301⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Hlogfd32.exe
        
        C:\Windows\system32\Hlogfd32.exe
        302⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Hcipcnac.exe
        
        C:\Windows\system32\Hcipcnac.exe
        303⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Hhehkepj.exe
        
        C:\Windows\system32\Hhehkepj.exe
        304⤵
        
        PID:12104
        
        C:\Windows\SysWOW64\Icklhnop.exe
        
        C:\Windows\system32\Icklhnop.exe
        305⤵
        
        PID:12188
        
        C:\Windows\SysWOW64\Ijedehgm.exe
        
        C:\Windows\system32\Ijedehgm.exe
        306⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Iqombb32.exe
        
        C:\Windows\system32\Iqombb32.exe
        307⤵
        
        PID:12248
        
        C:\Windows\SysWOW64\Igieoleg.exe
        
        C:\Windows\system32\Igieoleg.exe
        308⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Imfmgcdn.exe
        
        C:\Windows\system32\Imfmgcdn.exe
        309⤵
        
        PID:11336
        
        C:\Windows\SysWOW64\Iodjcnca.exe
        
        C:\Windows\system32\Iodjcnca.exe
        310⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Ijjnpg32.exe
        
        C:\Windows\system32\Ijjnpg32.exe
        311⤵
        
        PID:11408
        
        C:\Windows\SysWOW64\Imhjlb32.exe
        
        C:\Windows\system32\Imhjlb32.exe
        312⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Ifqoehhl.exe
        
        C:\Windows\system32\Ifqoehhl.exe
        313⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Imjgbb32.exe
        
        C:\Windows\system32\Imjgbb32.exe
        314⤵
        
        PID:11520
        
        C:\Windows\SysWOW64\Icdoolge.exe
        
        C:\Windows\system32\Icdoolge.exe
        315⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Ifckkhfi.exe
        
        C:\Windows\system32\Ifckkhfi.exe
        316⤵
        
        PID:6464
        
        C:\Windows\SysWOW64\Jqhphq32.exe
        
        C:\Windows\system32\Jqhphq32.exe
        317⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Jfehpg32.exe
        
        C:\Windows\system32\Jfehpg32.exe
        318⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Jmopmalc.exe
        
        C:\Windows\system32\Jmopmalc.exe
        319⤵
        
        PID:7044
        
        C:\Windows\SysWOW64\Jfgefg32.exe
        
        C:\Windows\system32\Jfgefg32.exe
        320⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Jifabb32.exe
        
        C:\Windows\system32\Jifabb32.exe
        321⤵
        
        PID:11824
        
        C:\Windows\SysWOW64\Jfjakgpa.exe
        
        C:\Windows\system32\Jfjakgpa.exe
        322⤵
        
        PID:11888

C:\Windows\SysWOW64\Jmdjha32.exe
C:\Windows\system32\Jmdjha32.exe
1⤵
PID:7476
- C:\Windows\SysWOW64\Jobfdl32.exe
  C:\Windows\system32\Jobfdl32.exe
  2⤵
  PID:11980
- - C:\Windows\SysWOW64\Jflnafno.exe
    C:\Windows\system32\Jflnafno.exe
    3⤵
    PID:6684
  - - C:\Windows\SysWOW64\Jikjmbmb.exe
      C:\Windows\system32\Jikjmbmb.exe
      4⤵
      PID:6920
    - - C:\Windows\SysWOW64\Jpdbjleo.exe
        
        C:\Windows\system32\Jpdbjleo.exe
        5⤵
        
        PID:7316
      - C:\Windows\SysWOW64\Jfokff32.exe
        
        C:\Windows\system32\Jfokff32.exe
        6⤵
        
        PID:7588
        
        C:\Windows\SysWOW64\Kmhccpci.exe
        
        C:\Windows\system32\Kmhccpci.exe
        7⤵
        
        PID:12268
        
        C:\Windows\SysWOW64\Kcbkpj32.exe
        
        C:\Windows\system32\Kcbkpj32.exe
        8⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Kmkpipaf.exe
        
        C:\Windows\system32\Kmkpipaf.exe
        9⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Kcehejic.exe
        
        C:\Windows\system32\Kcehejic.exe
        10⤵
        
        PID:11452
        
        C:\Windows\SysWOW64\Kjopbd32.exe
        
        C:\Windows\system32\Kjopbd32.exe
        11⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Kplijk32.exe
        
        C:\Windows\system32\Kplijk32.exe
        12⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Kidmcqeg.exe
        
        C:\Windows\system32\Kidmcqeg.exe
        13⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Kpnepk32.exe
        
        C:\Windows\system32\Kpnepk32.exe
        14⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Kfhnme32.exe
        
        C:\Windows\system32\Kfhnme32.exe
        15⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Kanbjn32.exe
        
        C:\Windows\system32\Kanbjn32.exe
        16⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Kfjjbd32.exe
        
        C:\Windows\system32\Kfjjbd32.exe
        17⤵
        
        PID:11696
        
        C:\Windows\SysWOW64\Lmdbooik.exe
        
        C:\Windows\system32\Lmdbooik.exe
        18⤵
        
        PID:11752
        
        C:\Windows\SysWOW64\Lgjglg32.exe
        
        C:\Windows\system32\Lgjglg32.exe
        19⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Likcdpop.exe
        
        C:\Windows\system32\Likcdpop.exe
        20⤵
        
        PID:11836
        
        C:\Windows\SysWOW64\Lpelqj32.exe
        
        C:\Windows\system32\Lpelqj32.exe
        21⤵
        
        PID:208
        
        C:\Windows\SysWOW64\Ladhkmno.exe
        
        C:\Windows\system32\Ladhkmno.exe
        22⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Lccdghmc.exe
        
        C:\Windows\system32\Lccdghmc.exe
        23⤵
        
        PID:12000
        
        C:\Windows\SysWOW64\Lipmoo32.exe
        
        C:\Windows\system32\Lipmoo32.exe
        24⤵
        
        PID:12092
        
        C:\Windows\SysWOW64\Lagepl32.exe
        
        C:\Windows\system32\Lagepl32.exe
        25⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Lfcmhc32.exe
        
        C:\Windows\system32\Lfcmhc32.exe
        26⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Lplaaiqd.exe
        
        C:\Windows\system32\Lplaaiqd.exe
        27⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Mffjnc32.exe
        
        C:\Windows\system32\Mffjnc32.exe
        28⤵
        
        PID:11328
        
        C:\Windows\SysWOW64\Mdjjgggk.exe
        
        C:\Windows\system32\Mdjjgggk.exe
        29⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\Mjdbda32.exe
        
        C:\Windows\system32\Mjdbda32.exe
        30⤵
        
        PID:11412
        
        C:\Windows\SysWOW64\Mmbopm32.exe
        
        C:\Windows\system32\Mmbopm32.exe
        31⤵
        
        PID:6164
        
        C:\Windows\SysWOW64\Mdlgmgdh.exe
        
        C:\Windows\system32\Mdlgmgdh.exe
        32⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Mfkcibdl.exe
        
        C:\Windows\system32\Mfkcibdl.exe
        33⤵
        
        PID:6952
        
        C:\Windows\SysWOW64\Mapgfk32.exe
        
        C:\Windows\system32\Mapgfk32.exe
        34⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Mfmpob32.exe
        
        C:\Windows\system32\Mfmpob32.exe
        35⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Miklkm32.exe
        
        C:\Windows\system32\Miklkm32.exe
        36⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Mdaqhf32.exe
        
        C:\Windows\system32\Mdaqhf32.exe
        37⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Maeaajpl.exe
        
        C:\Windows\system32\Maeaajpl.exe
        38⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\Nfaijand.exe
        
        C:\Windows\system32\Nfaijand.exe
        39⤵
        
        PID:11772
        
        C:\Windows\SysWOW64\Nmlafk32.exe
        
        C:\Windows\system32\Nmlafk32.exe
        40⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Ndejcemn.exe
        
        C:\Windows\system32\Ndejcemn.exe
        41⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Nibbklke.exe
        
        C:\Windows\system32\Nibbklke.exe
        42⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Nffceq32.exe
        
        C:\Windows\system32\Nffceq32.exe
        43⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Npognfpo.exe
        
        C:\Windows\system32\Npognfpo.exe
        44⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Nmbhgjoi.exe
        
        C:\Windows\system32\Nmbhgjoi.exe
        45⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Naqqmieo.exe
        
        C:\Windows\system32\Naqqmieo.exe
        46⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Ndomiddc.exe
        
        C:\Windows\system32\Ndomiddc.exe
        47⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Oileakbj.exe
        
        C:\Windows\system32\Oileakbj.exe
        48⤵
        
        PID:8048
        
        C:\Windows\SysWOW64\Odaiodbp.exe
        
        C:\Windows\system32\Odaiodbp.exe
        49⤵
        
        PID:7860
        
        C:\Windows\SysWOW64\Ogpfko32.exe
        
        C:\Windows\system32\Ogpfko32.exe
        50⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Oaejhh32.exe
        
        C:\Windows\system32\Oaejhh32.exe
        51⤵
        
        PID:7928
        
        C:\Windows\SysWOW64\Ogbbqo32.exe
        
        C:\Windows\system32\Ogbbqo32.exe
        52⤵
        
        PID:7908
        
        C:\Windows\SysWOW64\Omlkmign.exe
        
        C:\Windows\system32\Omlkmign.exe
        53⤵
        
        PID:11540
        
        C:\Windows\SysWOW64\Odfcjc32.exe
        
        C:\Windows\system32\Odfcjc32.exe
        54⤵
        
        PID:11636
        
        C:\Windows\SysWOW64\Okpkgm32.exe
        
        C:\Windows\system32\Okpkgm32.exe
        55⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Oajccgmd.exe
        
        C:\Windows\system32\Oajccgmd.exe
        56⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Ohdlpa32.exe
        
        C:\Windows\system32\Ohdlpa32.exe
        57⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Onqdhh32.exe
        
        C:\Windows\system32\Onqdhh32.exe
        58⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Pgihanii.exe
        
        C:\Windows\system32\Pgihanii.exe
        59⤵
        
        PID:7896
        
        C:\Windows\SysWOW64\Pncanhaf.exe
        
        C:\Windows\system32\Pncanhaf.exe
        60⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Phiekaql.exe
        
        C:\Windows\system32\Phiekaql.exe
        61⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Pjjaci32.exe
        
        C:\Windows\system32\Pjjaci32.exe
        62⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\Ppdjpcng.exe
        
        C:\Windows\system32\Ppdjpcng.exe
        63⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Pgnblm32.exe
        
        C:\Windows\system32\Pgnblm32.exe
        64⤵
        
        PID:12128
        
        C:\Windows\SysWOW64\Pacfjfej.exe
        
        C:\Windows\system32\Pacfjfej.exe
        65⤵
        
        PID:7916
        
        C:\Windows\SysWOW64\Pdbbfadn.exe
        
        C:\Windows\system32\Pdbbfadn.exe
        66⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Pklkbl32.exe
        
        C:\Windows\system32\Pklkbl32.exe
        67⤵
        
        PID:12252
        
        C:\Windows\SysWOW64\Pnjgog32.exe
        
        C:\Windows\system32\Pnjgog32.exe
        68⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Pddokabk.exe
        
        C:\Windows\system32\Pddokabk.exe
        69⤵
        
        PID:11292
        
        C:\Windows\SysWOW64\Pgbkgmao.exe
        
        C:\Windows\system32\Pgbkgmao.exe
        70⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\Pnlcdg32.exe
        
        C:\Windows\system32\Pnlcdg32.exe
        71⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Qdflaa32.exe
        
        C:\Windows\system32\Qdflaa32.exe
        72⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Qjcdih32.exe
        
        C:\Windows\system32\Qjcdih32.exe
        73⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Qdihfq32.exe
        
        C:\Windows\system32\Qdihfq32.exe
        74⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Qkcackeb.exe
        
        C:\Windows\system32\Qkcackeb.exe
        75⤵
        
        PID:7596
        
        C:\Windows\SysWOW64\Qnamofdf.exe
        
        C:\Windows\system32\Qnamofdf.exe
        76⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Ahgamo32.exe
        
        C:\Windows\system32\Ahgamo32.exe
        77⤵
        
        PID:8276
        
        C:\Windows\SysWOW64\Ajhndgjj.exe
        
        C:\Windows\system32\Ajhndgjj.exe
        78⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Aqbfaa32.exe
        
        C:\Windows\system32\Aqbfaa32.exe
        79⤵
        
        PID:11876
        
        C:\Windows\SysWOW64\Akgjnj32.exe
        
        C:\Windows\system32\Akgjnj32.exe
        80⤵
        
        PID:11916
        
        C:\Windows\SysWOW64\Anffje32.exe
        
        C:\Windows\system32\Anffje32.exe
        81⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Adpogp32.exe
        
        C:\Windows\system32\Adpogp32.exe
        82⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Agnkck32.exe
        
        C:\Windows\system32\Agnkck32.exe
        83⤵
        
        PID:8980
        
        C:\Windows\SysWOW64\Aqfolqna.exe
        
        C:\Windows\system32\Aqfolqna.exe
        84⤵
        Modifies registry class
        
        PID:8588
        
        C:\Windows\SysWOW64\Agqhik32.exe
        
        C:\Windows\system32\Agqhik32.exe
        85⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Anjpeelk.exe
        
        C:\Windows\system32\Anjpeelk.exe
        86⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Addhbo32.exe
        
        C:\Windows\system32\Addhbo32.exe
        87⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Agcdnjcl.exe
        
        C:\Windows\system32\Agcdnjcl.exe
        88⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Bbhhlccb.exe
        
        C:\Windows\system32\Bbhhlccb.exe
        89⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Bbkeacqo.exe
        
        C:\Windows\system32\Bbkeacqo.exe
        90⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Bhennm32.exe
        
        C:\Windows\system32\Bhennm32.exe
        91⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8796
        
        C:\Windows\SysWOW64\Bnaffdfc.exe
        
        C:\Windows\system32\Bnaffdfc.exe
        92⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Bqpbboeg.exe
        
        C:\Windows\system32\Bqpbboeg.exe
        93⤵
        
        PID:3420
        
        C:\Windows\SysWOW64\Bkefphem.exe
        
        C:\Windows\system32\Bkefphem.exe
        94⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Bqbohocd.exe
        
        C:\Windows\system32\Bqbohocd.exe
        95⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Biigildg.exe
        
        C:\Windows\system32\Biigildg.exe
        96⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Bjkcqdje.exe
        
        C:\Windows\system32\Bjkcqdje.exe
        97⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Bqdlmo32.exe
        
        C:\Windows\system32\Bqdlmo32.exe
        98⤵
        
        PID:9144
        
        C:\Windows\SysWOW64\Bgodjiio.exe
        
        C:\Windows\system32\Bgodjiio.exe
        99⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Bjmpfdhb.exe
        
        C:\Windows\system32\Bjmpfdhb.exe
        100⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Cebdcmhh.exe
        
        C:\Windows\system32\Cebdcmhh.exe
        101⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Cqiehnml.exe
        
        C:\Windows\system32\Cqiehnml.exe
        102⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Cgcmeh32.exe
        
        C:\Windows\system32\Cgcmeh32.exe
        103⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Cjaiac32.exe
        
        C:\Windows\system32\Cjaiac32.exe
        104⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Cegnol32.exe
        
        C:\Windows\system32\Cegnol32.exe
        105⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Ckafkfkp.exe
        
        C:\Windows\system32\Ckafkfkp.exe
        106⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Cnpbgajc.exe
        
        C:\Windows\system32\Cnpbgajc.exe
        107⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Cejjdlap.exe
        
        C:\Windows\system32\Cejjdlap.exe
        108⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Cghgpgqd.exe
        
        C:\Windows\system32\Cghgpgqd.exe
        109⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Cjfclcpg.exe
        
        C:\Windows\system32\Cjfclcpg.exe
        110⤵
        
        PID:8288
        
        C:\Windows\SysWOW64\Cgjcfgoa.exe
        
        C:\Windows\system32\Cgjcfgoa.exe
        111⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Dbphcpog.exe
        
        C:\Windows\system32\Dbphcpog.exe
        112⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Dgmpkg32.exe
        
        C:\Windows\system32\Dgmpkg32.exe
        113⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Djklgb32.exe
        
        C:\Windows\system32\Djklgb32.exe
        114⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Dilmeida.exe
        
        C:\Windows\system32\Dilmeida.exe
        115⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Djmima32.exe
        
        C:\Windows\system32\Djmima32.exe
        116⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Dagajlal.exe
        
        C:\Windows\system32\Dagajlal.exe
        117⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Dgaiffii.exe
        
        C:\Windows\system32\Dgaiffii.exe
        118⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Djpfbahm.exe
        
        C:\Windows\system32\Djpfbahm.exe
        119⤵
        
        PID:8836
        
        C:\Windows\SysWOW64\Dajnol32.exe
        
        C:\Windows\system32\Dajnol32.exe
        120⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Dhcfleff.exe
        
        C:\Windows\system32\Dhcfleff.exe
        121⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Djbbhafj.exe
        
        C:\Windows\system32\Djbbhafj.exe
        122⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Dalkek32.exe
        
        C:\Windows\system32\Dalkek32.exe
        123⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Enpknplq.exe
        
        C:\Windows\system32\Enpknplq.exe
        124⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Fbggkl32.exe
        
        C:\Windows\system32\Fbggkl32.exe
        125⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Fefcgh32.exe
        
        C:\Windows\system32\Fefcgh32.exe
        126⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Flpkcbqm.exe
        
        C:\Windows\system32\Flpkcbqm.exe
        127⤵
        
        PID:12228
        
        C:\Windows\SysWOW64\Fongpm32.exe
        
        C:\Windows\system32\Fongpm32.exe
        128⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Fehplggn.exe
        
        C:\Windows\system32\Fehplggn.exe
        129⤵
        
        PID:8388
        
        C:\Windows\SysWOW64\Fkehdnee.exe
        
        C:\Windows\system32\Fkehdnee.exe
        130⤵
        
        PID:8264
        
        C:\Windows\SysWOW64\Fejlbgek.exe
        
        C:\Windows\system32\Fejlbgek.exe
        131⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Flddoa32.exe
        
        C:\Windows\system32\Flddoa32.exe
        132⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Fbnmkk32.exe
        
        C:\Windows\system32\Fbnmkk32.exe
        133⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Flgadake.exe
        
        C:\Windows\system32\Flgadake.exe
        134⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Facjlhil.exe
        
        C:\Windows\system32\Facjlhil.exe
        135⤵
        
        PID:3492
        
        C:\Windows\SysWOW64\Glinjqhb.exe
        
        C:\Windows\system32\Glinjqhb.exe
        136⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Gogjflhf.exe
        
        C:\Windows\system32\Gogjflhf.exe
        137⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Geabbfoc.exe
        
        C:\Windows\system32\Geabbfoc.exe
        138⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Glkkop32.exe
        
        C:\Windows\system32\Glkkop32.exe
        139⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Gahcgg32.exe
        
        C:\Windows\system32\Gahcgg32.exe
        140⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Golcak32.exe
        
        C:\Windows\system32\Golcak32.exe
        141⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Geflne32.exe
        
        C:\Windows\system32\Geflne32.exe
        142⤵
        
        PID:9096
        
        C:\Windows\SysWOW64\Gkcdfl32.exe
        
        C:\Windows\system32\Gkcdfl32.exe
        143⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Gbjlgj32.exe
        
        C:\Windows\system32\Gbjlgj32.exe
        144⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Ghgeoq32.exe
        
        C:\Windows\system32\Ghgeoq32.exe
        145⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Gaoihfoo.exe
        
        C:\Windows\system32\Gaoihfoo.exe
        146⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Hifaic32.exe
        
        C:\Windows\system32\Hifaic32.exe
        147⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Hleneo32.exe
        
        C:\Windows\system32\Hleneo32.exe
        148⤵
        
        PID:4168
        
        C:\Windows\SysWOW64\Haafnf32.exe
        
        C:\Windows\system32\Haafnf32.exe
        149⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Hhlnjpdi.exe
        
        C:\Windows\system32\Hhlnjpdi.exe
        150⤵
        
        PID:8416
        
        C:\Windows\SysWOW64\Hoefgj32.exe
        
        C:\Windows\system32\Hoefgj32.exe
        151⤵
        
        PID:8740
        
        C:\Windows\SysWOW64\Hadcce32.exe
        
        C:\Windows\system32\Hadcce32.exe
        152⤵
        
        PID:3352
        
        C:\Windows\SysWOW64\Hhnkppbf.exe
        
        C:\Windows\system32\Hhnkppbf.exe
        153⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\Hohcmjic.exe
        
        C:\Windows\system32\Hohcmjic.exe
        154⤵
        
        PID:4264
        
        C:\Windows\SysWOW64\Himgjbii.exe
        
        C:\Windows\system32\Himgjbii.exe
        155⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Hkodak32.exe
        
        C:\Windows\system32\Hkodak32.exe
        156⤵
        
        PID:10048
        
        C:\Windows\SysWOW64\Hahlnefd.exe
        
        C:\Windows\system32\Hahlnefd.exe
        157⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Hipdpbgf.exe
        
        C:\Windows\system32\Hipdpbgf.exe
        158⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Hkaqgjme.exe
        
        C:\Windows\system32\Hkaqgjme.exe
        159⤵
        
        PID:8224
        
        C:\Windows\SysWOW64\Ikcmmjkb.exe
        
        C:\Windows\system32\Ikcmmjkb.exe
        160⤵
        Drops file in System32 directory
        
        PID:8672
        
        C:\Windows\SysWOW64\Iameid32.exe
        
        C:\Windows\system32\Iameid32.exe
        161⤵
        
        PID:9636
        
        C:\Windows\SysWOW64\Ijdnka32.exe
        
        C:\Windows\system32\Ijdnka32.exe
        162⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Ioafchai.exe
        
        C:\Windows\system32\Ioafchai.exe
        163⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Ieknpb32.exe
        
        C:\Windows\system32\Ieknpb32.exe
        164⤵
        
        PID:9340
        
        C:\Windows\SysWOW64\Ileflmpb.exe
        
        C:\Windows\system32\Ileflmpb.exe
        165⤵
        
        PID:9012
        
        C:\Windows\SysWOW64\Icooig32.exe
        
        C:\Windows\system32\Icooig32.exe
        166⤵
        
        PID:10028
        
        C:\Windows\SysWOW64\Ifnkeb32.exe
        
        C:\Windows\system32\Ifnkeb32.exe
        167⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Ihlgan32.exe
        
        C:\Windows\system32\Ihlgan32.exe
        168⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Icakofel.exe
        
        C:\Windows\system32\Icakofel.exe
        169⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Ifphkbep.exe
        
        C:\Windows\system32\Ifphkbep.exe
        170⤵
        
        PID:10120
        
        C:\Windows\SysWOW64\Iljpgl32.exe
        
        C:\Windows\system32\Iljpgl32.exe
        171⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8872
        
        C:\Windows\SysWOW64\Iohlcg32.exe
        
        C:\Windows\system32\Iohlcg32.exe
        172⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Jfbdpabn.exe
        
        C:\Windows\system32\Jfbdpabn.exe
        173⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Jllmml32.exe
        
        C:\Windows\system32\Jllmml32.exe
        174⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Jcfejfag.exe
        
        C:\Windows\system32\Jcfejfag.exe
        175⤵
        
        PID:9308
        
        C:\Windows\SysWOW64\Jhcmbm32.exe
        
        C:\Windows\system32\Jhcmbm32.exe
        176⤵
        
        PID:8936
        
        C:\Windows\SysWOW64\Jchaoe32.exe
        
        C:\Windows\system32\Jchaoe32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9452
        
        C:\Windows\SysWOW64\Jjbjlpga.exe
        
        C:\Windows\system32\Jjbjlpga.exe
        178⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Jkcfch32.exe
        
        C:\Windows\system32\Jkcfch32.exe
        179⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Jbnopbdl.exe
        
        C:\Windows\system32\Jbnopbdl.exe
        180⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Jhhgmlli.exe
        
        C:\Windows\system32\Jhhgmlli.exe
        181⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Joaojf32.exe
        
        C:\Windows\system32\Joaojf32.exe
        182⤵
        
        PID:9752
        
        C:\Windows\SysWOW64\Jflgfpkc.exe
        
        C:\Windows\system32\Jflgfpkc.exe
        183⤵
        
        PID:9384
        
        C:\Windows\SysWOW64\Jmepcj32.exe
        
        C:\Windows\system32\Jmepcj32.exe
        184⤵
        
        PID:9184
        
        C:\Windows\SysWOW64\Jodlof32.exe
        
        C:\Windows\system32\Jodlof32.exe
        185⤵
        
        PID:9564
        
        C:\Windows\SysWOW64\Kbbhka32.exe
        
        C:\Windows\system32\Kbbhka32.exe
        186⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Kilphk32.exe
        
        C:\Windows\system32\Kilphk32.exe
        187⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Kcbded32.exe
        
        C:\Windows\system32\Kcbded32.exe
        188⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Kfpqap32.exe
        
        C:\Windows\system32\Kfpqap32.exe
        189⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Kkmijf32.exe
        
        C:\Windows\system32\Kkmijf32.exe
        190⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Kcdakd32.exe
        
        C:\Windows\system32\Kcdakd32.exe
        191⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\Kjnihnmd.exe
        
        C:\Windows\system32\Kjnihnmd.exe
        192⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Kmmedi32.exe
        
        C:\Windows\system32\Kmmedi32.exe
        193⤵
        
        PID:9124
        
        C:\Windows\SysWOW64\Kcfnqccd.exe
        
        C:\Windows\system32\Kcfnqccd.exe
        194⤵
        
        PID:9856
        
        C:\Windows\SysWOW64\Kfejmobh.exe
        
        C:\Windows\system32\Kfejmobh.exe
        195⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\Kicfijal.exe
        
        C:\Windows\system32\Kicfijal.exe
        196⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\Komoed32.exe
        
        C:\Windows\system32\Komoed32.exe
        197⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Kifcnjpi.exe
        
        C:\Windows\system32\Kifcnjpi.exe
        198⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Lihpdj32.exe
        
        C:\Windows\system32\Lihpdj32.exe
        199⤵
        
        PID:9248
        
        C:\Windows\SysWOW64\Lkflpe32.exe
        
        C:\Windows\system32\Lkflpe32.exe
        200⤵
        
        PID:9420
        
        C:\Windows\SysWOW64\Lbqdmodg.exe
        
        C:\Windows\system32\Lbqdmodg.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9612
        
        C:\Windows\SysWOW64\Lmfhjhdm.exe
        
        C:\Windows\system32\Lmfhjhdm.exe
        202⤵
        
        PID:9860
        
        C:\Windows\SysWOW64\Lbcabo32.exe
        
        C:\Windows\system32\Lbcabo32.exe
        203⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\Ljjicl32.exe
        
        C:\Windows\system32\Ljjicl32.exe
        204⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Lpgalc32.exe
        
        C:\Windows\system32\Lpgalc32.exe
        205⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Lfqjhmhk.exe
        
        C:\Windows\system32\Lfqjhmhk.exe
        206⤵
        
        PID:1456
        
        C:\Windows\SysWOW64\Lmkbeg32.exe
        
        C:\Windows\system32\Lmkbeg32.exe
        207⤵
        
        PID:9372
        
        C:\Windows\SysWOW64\Lcdjba32.exe
        
        C:\Windows\system32\Lcdjba32.exe
        208⤵
        
        PID:9876
        
        C:\Windows\SysWOW64\Lfcfnm32.exe
        
        C:\Windows\system32\Lfcfnm32.exe
        209⤵
        
        PID:9756
        
        C:\Windows\SysWOW64\Lmmokgne.exe
        
        C:\Windows\system32\Lmmokgne.exe
        210⤵
        
        PID:2156
        
        C:\Windows\SysWOW64\Mcggga32.exe
        
        C:\Windows\system32\Mcggga32.exe
        211⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Mfeccm32.exe
        
        C:\Windows\system32\Mfeccm32.exe
        212⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Midoph32.exe
        
        C:\Windows\system32\Midoph32.exe
        213⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Mpnglbkf.exe
        
        C:\Windows\system32\Mpnglbkf.exe
        214⤵
        
        PID:9928
        
        C:\Windows\SysWOW64\Mfhpilbc.exe
        
        C:\Windows\system32\Mfhpilbc.exe
        215⤵
        
        PID:9804
        
        C:\Windows\SysWOW64\Mmahff32.exe
        
        C:\Windows\system32\Mmahff32.exe
        216⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Mclpbqal.exe
        
        C:\Windows\system32\Mclpbqal.exe
        217⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Mjehok32.exe
        
        C:\Windows\system32\Mjehok32.exe
        218⤵
        
        PID:4676
        
        C:\Windows\SysWOW64\Mmdekf32.exe
        
        C:\Windows\system32\Mmdekf32.exe
        219⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\Mbamcm32.exe
        
        C:\Windows\system32\Mbamcm32.exe
        220⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Mjheejff.exe
        
        C:\Windows\system32\Mjheejff.exe
        221⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Mlialb32.exe
        
        C:\Windows\system32\Mlialb32.exe
        222⤵
        
        PID:9432
        
        C:\Windows\SysWOW64\Mcpjnp32.exe
        
        C:\Windows\system32\Mcpjnp32.exe
        223⤵
        
        PID:9896
        
        C:\Windows\SysWOW64\Mjjbjjdd.exe
        
        C:\Windows\system32\Mjjbjjdd.exe
        224⤵
        
        PID:10024
        
        C:\Windows\SysWOW64\Nlknbb32.exe
        
        C:\Windows\system32\Nlknbb32.exe
        225⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\Nbefolao.exe
        
        C:\Windows\system32\Nbefolao.exe
        226⤵
        
        PID:4004
        
        C:\Windows\SysWOW64\Nmkkle32.exe
        
        C:\Windows\system32\Nmkkle32.exe
        227⤵
        
        PID:2536
        
        C:\Windows\SysWOW64\Niblafgi.exe
        
        C:\Windows\system32\Niblafgi.exe
        228⤵
        
        PID:3580
        
        C:\Windows\SysWOW64\Nidhffef.exe
        
        C:\Windows\system32\Nidhffef.exe
        229⤵
        
        PID:2456
        
        C:\Windows\SysWOW64\Nlbdba32.exe
        
        C:\Windows\system32\Nlbdba32.exe
        230⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Nbmmoklg.exe
        
        C:\Windows\system32\Nbmmoklg.exe
        231⤵
        Drops file in System32 directory
        
        PID:1568
        
        C:\Windows\SysWOW64\Nifele32.exe
        
        C:\Windows\system32\Nifele32.exe
        232⤵
        
        PID:2672
        
        C:\Windows\SysWOW64\Nleaha32.exe
        
        C:\Windows\system32\Nleaha32.exe
        233⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 404
        234⤵
        Program crash
        
        PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5016 -ip 5016
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:10228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Abgjkpll.exe

Filesize
177KB

MD5
45cd6b12ae777c9d49ef7b196bf3a499

SHA1
bd1530efd72b08364db9b57670150024cb86f513

SHA256
bb09572b35761563ead223518846f85937826de6e8e427f6e9c53b501cc2e798

SHA512
8efe2448d2b5d9ed45fb1a75ac91b9a22e9fa8211fe565bf3ccb21e050ac94f3587fa56cffd34c89546c5e68da0a2c9491f8054054b41f129a82eb7714b4922a

Download Submit
C:\Windows\SysWOW64\Blqllqqa.exe

Filesize
177KB

MD5
caafb23539675f24d1dc9ea4d22bad23

SHA1
70018756c845bc731b54169dc24630047aa3aed8

SHA256
6957a4cb0eddb5fdb148727fa634d53d904e2b3a21fdc2046007441fec9371d4

SHA512
bbc107c758dbeca9c2b8505ba54b33b7c9d3e6aaa0993b809a9a10a09d26ca11e9111fc329f2b86f482724bfab9bfa952c822056d9b39379b7d19600eab37172

Download Submit
C:\Windows\SysWOW64\Blqllqqa.exe

Filesize
177KB

MD5
caafb23539675f24d1dc9ea4d22bad23

SHA1
70018756c845bc731b54169dc24630047aa3aed8

SHA256
6957a4cb0eddb5fdb148727fa634d53d904e2b3a21fdc2046007441fec9371d4

SHA512
bbc107c758dbeca9c2b8505ba54b33b7c9d3e6aaa0993b809a9a10a09d26ca11e9111fc329f2b86f482724bfab9bfa952c822056d9b39379b7d19600eab37172

Download Submit
C:\Windows\SysWOW64\Bpedeiff.exe

Filesize
177KB

MD5
555bbf8b8084337d544c1490494981ed

SHA1
45def7c6ca48815e8be4bb4807d6ba569162dab3

SHA256
e007f030a9f7ecbd1a64dcbe8cc312d12f0e62c152bc560c8e1a0716b986b6d9

SHA512
5955927544f866d6250073fca9dd254b0d2b13c6776e02b2a55b95326dfcd8259c0d2f2aaaa6550a32fad28039df58ca42e29d5ee1b5a490ba7f9f5e895191bb

Download Submit
C:\Windows\SysWOW64\Bqpbboeg.exe

Filesize
177KB

MD5
9d867d6e9f36f39b6e47437c1c361a29

SHA1
b94a01e709eade1f378de79f6935f009d40efec0

SHA256
4db136e1cc3b283ccc1b54440e3c9f05927e1a4b9b1902e1a75d94c5544639aa

SHA512
766bf4fb36b22a84a88090276994f5af74cdf9b33afeafbde40a01e8167d0734ef88e59f6f27d124966af5b87edc991f0b4e3ab180344eb19a711de85cdf223f

Download Submit
C:\Windows\SysWOW64\Cbbnpg32.exe

Filesize
177KB

MD5
e9608f3b0f2bbdec93c0e1dd633bd8b4

SHA1
3c00b2223280ae974c5a7f3d53e48cabc8576567

SHA256
56c8a9c38ae292cc87369bb7da8fd1a1a3d94b0d52923b72e400c5a83e45a2e1

SHA512
29a88fe07b74829af0ee2d574e3799948365603df7245c7d3aaebcd23cd740f791d6242d469add7290430e52b39749059ca5f1f16b37b68813d3a6cbdd7d0546

Download Submit
C:\Windows\SysWOW64\Cbbnpg32.exe

Filesize
177KB

MD5
e9608f3b0f2bbdec93c0e1dd633bd8b4

SHA1
3c00b2223280ae974c5a7f3d53e48cabc8576567

SHA256
56c8a9c38ae292cc87369bb7da8fd1a1a3d94b0d52923b72e400c5a83e45a2e1

SHA512
29a88fe07b74829af0ee2d574e3799948365603df7245c7d3aaebcd23cd740f791d6242d469add7290430e52b39749059ca5f1f16b37b68813d3a6cbdd7d0546

Download Submit
C:\Windows\SysWOW64\Cnindhpg.exe

Filesize
177KB

MD5
5236c4361dbe0a014fbefebf0eec75d3

SHA1
57cb7c58da27c7891d7ab88ea48939664d21172e

SHA256
66123b6ace491e2c211db050c5d8da4b8e2524e20b2348d7b74c9c2afe15ed42

SHA512
3bc7ddcdab647ce9847782751653162243140ab00daf4d7d2d5d324c19f435c6ce045d236cc5ab66feb145914aed91afbaf1179fe30414abf9064dd969dd77ad

Download Submit
C:\Windows\SysWOW64\Coadnlnb.exe

Filesize
177KB

MD5
e257159eb5e80351b85139ae2f706c38

SHA1
c0d6818fcbda2f4c54b953c29aaf378335c0a69c

SHA256
1d5f8e03c59e510e5147cb0c6b9ac3c92e5739ab75a2d85132e808c8b3a3e5bd

SHA512
e6e0c86c6395827895dabb825d94502aa92535dbe2c0e495b3e0fdf3870070d857cf6b503d64a13c5fda94c32f3cabfe825e20b4459a8cd34766bbb62928e408

Download Submit
C:\Windows\SysWOW64\Coadnlnb.exe

Filesize
177KB

MD5
e257159eb5e80351b85139ae2f706c38

SHA1
c0d6818fcbda2f4c54b953c29aaf378335c0a69c

SHA256
1d5f8e03c59e510e5147cb0c6b9ac3c92e5739ab75a2d85132e808c8b3a3e5bd

SHA512
e6e0c86c6395827895dabb825d94502aa92535dbe2c0e495b3e0fdf3870070d857cf6b503d64a13c5fda94c32f3cabfe825e20b4459a8cd34766bbb62928e408

Download Submit
C:\Windows\SysWOW64\Dbehienn.exe

Filesize
177KB

MD5
29e03eca1979afd0919eb81d38122e07

SHA1
95eaecb3286dbd7f480fcc9127704a07ae9b235b

SHA256
aa5bae5daf19876d3cfe9a9d6b0038b84917c1d28a0badc06b925036d2043fb8

SHA512
6128ff9034cd1d305ffb5d29c3c98ba8ef03d8efe4bec1a413a8b9468369aea89baddb6461c6fedc057d61f7a79e6ee1fabe1ca10b4d1cdd90bafcf8dc61ad76

Download Submit
C:\Windows\SysWOW64\Ddkbmj32.exe

Filesize
177KB

MD5
3650052d29d4231d12a9b4853423da47

SHA1
a13fc2471b2020f72b4eb9d85f858c97825a6794

SHA256
a25343e4970df993649b09f5e3891a05e77b48947b69c5d00cfa1e88adc8f7dd

SHA512
123df63f714569ba2cac8d712f9a721a2282235972447680b0ee7b8882e9f82667bda84ddd664d149039880e529cee2260527be11d99e87b28a6a4e804d8fbdf

Download Submit
C:\Windows\SysWOW64\Ehbnigjj.exe

Filesize
177KB

MD5
920b4ef1a44f7891889e52264c55d177

SHA1
ef402f57f7308d635d61783f4f07cbe00d397d1d

SHA256
c1cd270bf06aeb11f37fbd67ad986f10fb5e6b0b376414610935245f154da4aa

SHA512
3640521a4e2f642fa494f829eecb8074887c6c4e5752f08f3c8d33a222a854159f8eecebf90079cb367ed6deafb1871f8dee62bff39622240ecb1b6212f47db2

Download Submit
C:\Windows\SysWOW64\Fdlkdhnk.exe

Filesize
177KB

MD5
ffdbc4be74094f9142c69dfb492bd530

SHA1
8140ce97ec34a3726643458f52e27b41c2b65502

SHA256
dc9ec1fdb40a6eaf71239b32ddf33ed69fbf7b8ab2ba4da749186c8dd45bace9

SHA512
56c27841e39f0c9545b57fab946ab91b26b9ab966d5c081e4b7cbc54969c7ad1328cefba16c84afb687f3802044860c91755635e1e9844225823afc32af8a971

Download Submit
C:\Windows\SysWOW64\Hdppaidl.exe

Filesize
177KB

MD5
c92a5dab2cec6f8c75c77a01a36480ff

SHA1
286dd8281175675b00acdebb48c490546d29c970

SHA256
5f9fdd5e6d3f288bb2a4ceaf2592569cdf9be6a527ffb8f1a2bf77c97875c4bc

SHA512
2ba9850407345e1388e0af690bbd1bb7eff3cd1975bdad0db62b6dc9ea76d6593a4eb13ed49e0c70283073cbff0c28eaec9b8b2fdb9cbe5c057b09186d568475

Download Submit
C:\Windows\SysWOW64\Hhdcmp32.exe

Filesize
177KB

MD5
07a9067ae6df5fd116defbe1adaf502f

SHA1
905964a300082eb0308508941100619cd779c78b

SHA256
0d55e57f1776abc3ed94974de85b20413a68daf5ceec0bba9c3200294f7a853b

SHA512
88a486e8a5bdc657efe9315bcad9935c85b851f50e31f34e1537a8d7ec0e144ae740e9cdf42cc342d01d8dae30c88a8d229a42e1e69d0e526cddd84a3873cbe3

Download Submit
C:\Windows\SysWOW64\Igdnabjh.exe

Filesize
177KB

MD5
26111c3bb1a8655987dde7f76a085b19

SHA1
701d96233dc86d6483b2a9e4c0aad2165c2fda9b

SHA256
0a79b07a27fdb5500a712215ae51842d0d52554543a61674590cdb379335981d

SHA512
00cd1dbde714beead37014ce0a633e175be9bd217e37af6d72bc7e191e48e2bb664f9c3a61282e3774638425e4128aacd9796457b5de8118e2485f51fb0f8164

Download Submit
C:\Windows\SysWOW64\Igdnabjh.exe

Filesize
177KB

MD5
26111c3bb1a8655987dde7f76a085b19

SHA1
701d96233dc86d6483b2a9e4c0aad2165c2fda9b

SHA256
0a79b07a27fdb5500a712215ae51842d0d52554543a61674590cdb379335981d

SHA512
00cd1dbde714beead37014ce0a633e175be9bd217e37af6d72bc7e191e48e2bb664f9c3a61282e3774638425e4128aacd9796457b5de8118e2485f51fb0f8164

Download Submit
C:\Windows\SysWOW64\Ihbponja.exe

Filesize
64KB

MD5
7301062481d8a2a08ff1d2a3187df290

SHA1
6426eb580f7ff808f2351315575cc8df2143a1c1

SHA256
1b8fc8767279b6471497328a046689980c08078e41fd4baa27e8202316cffd88

SHA512
69970d7210c79479fc1d8f5d24a02f818110f567ab55a07eff9dfb8f80d7243f07d8b5f864c21f4c2a0257b1513fe5bc329430ec04c37adfab7f9c756c8c7363

Download Submit
C:\Windows\SysWOW64\Ihmfco32.exe

Filesize
177KB

MD5
99b138bcd7ffc7e5af3aabece26cb44b

SHA1
4cb99a61af788886802e9147fdd422cb74b5316c

SHA256
415c35c37451a8c4b507748c006ffb5a3da2ea98eb8a03f5a75e3729ca3bc6be

SHA512
b95619934514e639cf3c0e9d5d10d4c401bfd037553f0b0203ff855a6e17fbce8904367f255663bea2e3d2465ee97a0ab4b6849971aabaf93290eb4c9567c451

Download Submit
C:\Windows\SysWOW64\Ijegcm32.exe

Filesize
177KB

MD5
c0ca1c6bc311d1577568075001563369

SHA1
4e84caa80217fe5e4202d8e3a5a645011f648938

SHA256
dddbcce56930b6b51dbcde1e162c7553cd3a0ac5fe518c08afa94dbe9b7a5be2

SHA512
5bf9a923c37794cf73979505c3039a1be1169eea7e9147a13f9299845427c778c3325232b849a0d3b6f6babc4efbe40d8eb886f4768f44f356420f33a737f629

Download Submit
C:\Windows\SysWOW64\Ijegcm32.exe

Filesize
177KB

MD5
c0ca1c6bc311d1577568075001563369

SHA1
4e84caa80217fe5e4202d8e3a5a645011f648938

SHA256
dddbcce56930b6b51dbcde1e162c7553cd3a0ac5fe518c08afa94dbe9b7a5be2

SHA512
5bf9a923c37794cf73979505c3039a1be1169eea7e9147a13f9299845427c778c3325232b849a0d3b6f6babc4efbe40d8eb886f4768f44f356420f33a737f629

Download Submit
C:\Windows\SysWOW64\Ikcmmjkb.exe

Filesize
177KB

MD5
49c776a27cc794b009f2d25778b05630

SHA1
535f62442a9a1f1d72608e506a233b1ceb02affe

SHA256
40449b7b042bf644738b8774b9c836523a98a17dc8e889691c565a3e2e72f9ed

SHA512
ebfb349b3e2f26d34512f02bc0100cbb9e20d3720fc9a0fc9d8c0b8f114b9e7851637029a117742d506e519b061446a92cb7f819b8f96f005d9bc9fed3590d22

Download Submit
C:\Windows\SysWOW64\Ikdcmpnl.exe

Filesize
177KB

MD5
567d40a0531665a3e052136da83c688c

SHA1
1ae022eed5a80e16b02039f6c88ab3b63355a551

SHA256
a0c6da8874bada08ca8fd9ea6966bf64db40c2ae7f269a32a8c7e430e42a9d99

SHA512
99e0edb5fa5026e34315e4f42c440a6f955ac920441bdc13ba8e20fb61577a5035715f26e39d7ae861cfb2c64b2fb751be3087ee8c871882589d3b0272e5cab2

Download Submit
C:\Windows\SysWOW64\Ikdcmpnl.exe

Filesize
177KB

MD5
567d40a0531665a3e052136da83c688c

SHA1
1ae022eed5a80e16b02039f6c88ab3b63355a551

SHA256
a0c6da8874bada08ca8fd9ea6966bf64db40c2ae7f269a32a8c7e430e42a9d99

SHA512
99e0edb5fa5026e34315e4f42c440a6f955ac920441bdc13ba8e20fb61577a5035715f26e39d7ae861cfb2c64b2fb751be3087ee8c871882589d3b0272e5cab2

Download Submit
C:\Windows\SysWOW64\Iljpij32.exe

Filesize
177KB

MD5
21e870762477cb53d4db1ee072287cf4

SHA1
0e17b141688ba7c4a7dcbe5a8b14561ac0399593

SHA256
647f773053f73127a73ac059e7773d2bb927631975cb98328aacc432e3039409

SHA512
5618d0091e0296530ef0a3044959875ae567b17f5697dceff5c5ce10e1551946d5ac047d7bc666ee761d22aeaa13c28e60d0a472ea7cdb19a1cff8dbd4c29037

Download Submit
C:\Windows\SysWOW64\Iljpij32.exe

Filesize
177KB

MD5
21e870762477cb53d4db1ee072287cf4

SHA1
0e17b141688ba7c4a7dcbe5a8b14561ac0399593

SHA256
647f773053f73127a73ac059e7773d2bb927631975cb98328aacc432e3039409

SHA512
5618d0091e0296530ef0a3044959875ae567b17f5697dceff5c5ce10e1551946d5ac047d7bc666ee761d22aeaa13c28e60d0a472ea7cdb19a1cff8dbd4c29037

Download Submit
C:\Windows\SysWOW64\Inkjfk32.exe

Filesize
177KB

MD5
698f4f38fc51d857da26751bc98b360f

SHA1
4616500fea01dd69d7d022d6972821f67f80b972

SHA256
c36a2e9f11346ad6c87af5240270f2d5b0216dd84e26a0e103bbdf3c1b0f8329

SHA512
61ec316c64f8552e5400ab3b09ff921f7b63185536bce5b39471efa61476f336472ee3a3f2e9895eabbff38db73cbbd150e92e1218aa2eda6345cd49bb8d7172

Download Submit
C:\Windows\SysWOW64\Inlihl32.exe

Filesize
177KB

MD5
474d4235901f800c4b856bbbff812c20

SHA1
73ce9356809b084941b060846c7aa565a1c5d00e

SHA256
bba0d334ce54baf5112100cdf3038dcd0828d88d0911635d1f0d2ddf33ae85ee

SHA512
9cd6b816245c61100d2b00f21e8130586b0d87a3c8d569b6510041be497d17e5351b1783cf83d886111c6db4ac59daf652cf2abd71c37bc7cafe340667550a4f

Download Submit
C:\Windows\SysWOW64\Inlihl32.exe

Filesize
177KB

MD5
474d4235901f800c4b856bbbff812c20

SHA1
73ce9356809b084941b060846c7aa565a1c5d00e

SHA256
bba0d334ce54baf5112100cdf3038dcd0828d88d0911635d1f0d2ddf33ae85ee

SHA512
9cd6b816245c61100d2b00f21e8130586b0d87a3c8d569b6510041be497d17e5351b1783cf83d886111c6db4ac59daf652cf2abd71c37bc7cafe340667550a4f

Download Submit
C:\Windows\SysWOW64\Iphioh32.exe

Filesize
177KB

MD5
270f0cfdbb32f560743e039a6061e14f

SHA1
3560cdabe255f19faae7d04cb0b5698b55aecfb2

SHA256
3e4f24a0e10d343d212302e60bee6abfa87e2905cc7471f26c4142fa20a1d061

SHA512
b51d3dac89f6d5a28062eb4ca8624e8552ad2fe9ef049cab340b137d2fcb4d56807c73aadd5d4076e2613ea444cca010ba57b0485cd3a1a4532a5ef314174fc4

Download Submit
C:\Windows\SysWOW64\Iphioh32.exe

Filesize
177KB

MD5
270f0cfdbb32f560743e039a6061e14f

SHA1
3560cdabe255f19faae7d04cb0b5698b55aecfb2

SHA256
3e4f24a0e10d343d212302e60bee6abfa87e2905cc7471f26c4142fa20a1d061

SHA512
b51d3dac89f6d5a28062eb4ca8624e8552ad2fe9ef049cab340b137d2fcb4d56807c73aadd5d4076e2613ea444cca010ba57b0485cd3a1a4532a5ef314174fc4

Download Submit
C:\Windows\SysWOW64\Ipmbjgpi.exe

Filesize
177KB

MD5
a40e4a927a7196abc5f872fa038db2b4

SHA1
10f87110ad47c79336ce8394946783c721fcce42

SHA256
acfec32ed4a43fbfada79d5a752af1ea65b70a82047856eda4de521cf33613f2

SHA512
01882a022c27b124bf4eb299fb52bfac0076df19d53bc6ded7b70b5c0bf741791256f3db79ec6a36117d909a31fe3ab9b1edae55ddd6fd27cc2a694f9f67bfec

Download Submit
C:\Windows\SysWOW64\Ipmbjgpi.exe

Filesize
177KB

MD5
a40e4a927a7196abc5f872fa038db2b4

SHA1
10f87110ad47c79336ce8394946783c721fcce42

SHA256
acfec32ed4a43fbfada79d5a752af1ea65b70a82047856eda4de521cf33613f2

SHA512
01882a022c27b124bf4eb299fb52bfac0076df19d53bc6ded7b70b5c0bf741791256f3db79ec6a36117d909a31fe3ab9b1edae55ddd6fd27cc2a694f9f67bfec

Download Submit
C:\Windows\SysWOW64\Jgeghp32.exe

Filesize
177KB

MD5
0993d7288ddabcd19c94067f24b1283c

SHA1
d37c90861895282f6a0e826e99fb461e3eb8764f

SHA256
e7860ec0b2ab1bf74f5c8d4c4c29a99d4ac60f70b8910b3d909597215f232b3e

SHA512
a8c64394a84b2740fdddba586cc8083b0b3a05ad94e7f11903ce568c9693ad96eab862646f83a95f9939d10eb09b49bcdda9a7281a20903e71778a4392f37f94

Download Submit
C:\Windows\SysWOW64\Jgeghp32.exe

Filesize
177KB

MD5
0993d7288ddabcd19c94067f24b1283c

SHA1
d37c90861895282f6a0e826e99fb461e3eb8764f

SHA256
e7860ec0b2ab1bf74f5c8d4c4c29a99d4ac60f70b8910b3d909597215f232b3e

SHA512
a8c64394a84b2740fdddba586cc8083b0b3a05ad94e7f11903ce568c9693ad96eab862646f83a95f9939d10eb09b49bcdda9a7281a20903e71778a4392f37f94

Download Submit
C:\Windows\SysWOW64\Jgkmgk32.exe

Filesize
177KB

MD5
a1dc0b99c265a584bb78af8ecb8a7fa7

SHA1
e4e5bffa12d48ea2d715e72d618e14e07b43b88e

SHA256
ff8f8cf5fd5f0cbcb9a005f53458f4897845d0d4af388ccb6c8cc39f6cd31cb9

SHA512
4f706bead91bd2953d8649709dad8310daae15ed83be847fa7d3d8fb1947e928f0f8f1e21ccb36d728c6a3ffa082aacbbec833b1503c140e3845cd46fddc0783

Download Submit
C:\Windows\SysWOW64\Jjafok32.exe

Filesize
177KB

MD5
48457ec9724c426af71e24492eca567a

SHA1
856ec659a073296f1e1d4a63e12998983f33d1fc

SHA256
69761eba60bfc0d4f5a7c77d07f6bce7dd317eca35afa16cab66bc128fab6eaf

SHA512
22a906cbcf0a9a543bb5e815f20824dd00eb2b068fe1ffd9304659359bf680ff095c3c8d8ac9b22f490aa08e6d450a60316653443b957d563a6494cf2972f41a

Download Submit
C:\Windows\SysWOW64\Jjafok32.exe

Filesize
177KB

MD5
48457ec9724c426af71e24492eca567a

SHA1
856ec659a073296f1e1d4a63e12998983f33d1fc

SHA256
69761eba60bfc0d4f5a7c77d07f6bce7dd317eca35afa16cab66bc128fab6eaf

SHA512
22a906cbcf0a9a543bb5e815f20824dd00eb2b068fe1ffd9304659359bf680ff095c3c8d8ac9b22f490aa08e6d450a60316653443b957d563a6494cf2972f41a

Download Submit
C:\Windows\SysWOW64\Jlmfeg32.exe

Filesize
177KB

MD5
bf164f836b4072cec4f127d6149162d8

SHA1
9429ed94c1f515ec61f8eb5043993b39da6c6e76

SHA256
6e099fe93ade77ec38d8926031d27b6b351f1aa4f2e998fe3e015c00621b5662

SHA512
4b56c55bf9de2d6929958866a27b5a7cdbce23d2e00d68fe75a54964517d6731cc641df2bbef675e58f838e6f046a3b42a495c6f48209b16b9a521a94dff2fc6

Download Submit
C:\Windows\SysWOW64\Jlmfeg32.exe

Filesize
177KB

MD5
bf164f836b4072cec4f127d6149162d8

SHA1
9429ed94c1f515ec61f8eb5043993b39da6c6e76

SHA256
6e099fe93ade77ec38d8926031d27b6b351f1aa4f2e998fe3e015c00621b5662

SHA512
4b56c55bf9de2d6929958866a27b5a7cdbce23d2e00d68fe75a54964517d6731cc641df2bbef675e58f838e6f046a3b42a495c6f48209b16b9a521a94dff2fc6

Download Submit
C:\Windows\SysWOW64\Jpaleglc.exe

Filesize
177KB

MD5
d07fc35b51ef7d5e5f4a8f7c9df23391

SHA1
b67db04479822d595b83bebfd44b543ee5dde161

SHA256
c85300734d384600b8ee5cdabf2ac0444079c980484a10e597be09c1544a2871

SHA512
4bcb2d1729623d2e78d03f980c3b28bd3ed749583a4459937ddeabd1985a96202bffb4421aeaf662ceb569d21ff3a1a271c47f8a6b3cdd10d956c4182c48bd50

Download Submit
C:\Windows\SysWOW64\Jpaleglc.exe

Filesize
177KB

MD5
d07fc35b51ef7d5e5f4a8f7c9df23391

SHA1
b67db04479822d595b83bebfd44b543ee5dde161

SHA256
c85300734d384600b8ee5cdabf2ac0444079c980484a10e597be09c1544a2871

SHA512
4bcb2d1729623d2e78d03f980c3b28bd3ed749583a4459937ddeabd1985a96202bffb4421aeaf662ceb569d21ff3a1a271c47f8a6b3cdd10d956c4182c48bd50

Download Submit
C:\Windows\SysWOW64\Kcejco32.exe

Filesize
177KB

MD5
bcd2dc34999e65f94475b46bad526f30

SHA1
8a071c3231c2dbb0faae2a888afc1682306d31d9

SHA256
0cf3f110e3b409bc1758827def0b61516a9de1bf859729d60a9e1d4c70d51bbe

SHA512
84e1786e7e165c96d1687b9f9477c64135e3b6011758cf0b3d145c6cd177749e1ef4c4e3cd6a5e554461f5ffd9779c74e6a81b7e5b2b1f4f239ab2a5681e85b6

Download Submit
C:\Windows\SysWOW64\Kcejco32.exe

Filesize
177KB

MD5
bcd2dc34999e65f94475b46bad526f30

SHA1
8a071c3231c2dbb0faae2a888afc1682306d31d9

SHA256
0cf3f110e3b409bc1758827def0b61516a9de1bf859729d60a9e1d4c70d51bbe

SHA512
84e1786e7e165c96d1687b9f9477c64135e3b6011758cf0b3d145c6cd177749e1ef4c4e3cd6a5e554461f5ffd9779c74e6a81b7e5b2b1f4f239ab2a5681e85b6

Download Submit
C:\Windows\SysWOW64\Kcndbp32.exe

Filesize
177KB

MD5
012d0557b9c037c84c5803e92a67a078

SHA1
6a1c27988bb5ca48f10702fe751d7a65bcbf0e38

SHA256
1cfcbda12e596e8ace7d4103c1b4e7a2be2ede752b436524675d3bb4f12e80e4

SHA512
3ff61a94cee95eb83b54802b731714f193b73df59f8cad5b8e2a1852336e7e3056d6f6918d4071a01a0314120ab8ab7d41f7b99fafc73aa7e1043540ad13138d

Download Submit
C:\Windows\SysWOW64\Kcndbp32.exe

Filesize
177KB

MD5
012d0557b9c037c84c5803e92a67a078

SHA1
6a1c27988bb5ca48f10702fe751d7a65bcbf0e38

SHA256
1cfcbda12e596e8ace7d4103c1b4e7a2be2ede752b436524675d3bb4f12e80e4

SHA512
3ff61a94cee95eb83b54802b731714f193b73df59f8cad5b8e2a1852336e7e3056d6f6918d4071a01a0314120ab8ab7d41f7b99fafc73aa7e1043540ad13138d

Download Submit
C:\Windows\SysWOW64\Kdmqmc32.exe

Filesize
177KB

MD5
78ec333f4449e91ad57dc43c3c413e4c

SHA1
8e9ea5c46464773f1e7096040f1f023711dfef77

SHA256
5135130c68373fb4dc42deece9dff3aafda961529e38303a9bf3391ec5edd6e3

SHA512
8582c93c9b6e1f9af1d53d2e25d3d357163bed7ff5edaae2a46838440ad8868b9cbfa3d456d4e6789630dfe6de0b8dd5c8a00f13853601acf9eb6281c60c5611

Download Submit
C:\Windows\SysWOW64\Kdmqmc32.exe

Filesize
177KB

MD5
78ec333f4449e91ad57dc43c3c413e4c

SHA1
8e9ea5c46464773f1e7096040f1f023711dfef77

SHA256
5135130c68373fb4dc42deece9dff3aafda961529e38303a9bf3391ec5edd6e3

SHA512
8582c93c9b6e1f9af1d53d2e25d3d357163bed7ff5edaae2a46838440ad8868b9cbfa3d456d4e6789630dfe6de0b8dd5c8a00f13853601acf9eb6281c60c5611

Download Submit
C:\Windows\SysWOW64\Kfpqap32.exe

Filesize
177KB

MD5
221820da745beb5db5ea4284e7c7556d

SHA1
a41c95c12df47e7cb421238c2427a90de4c100d5

SHA256
04e23ec34aec8c695053cdcc3e2496aa8e54bba9fb3700af22d949c9cf27bb86

SHA512
43ac870304ba18c6e12325dc05ed48c5ee976337d914e55288c17eee7c24be017423ce2a4b162719b110107cd865fae7823bb7878ddf8f74a22ed244eb23197d

Download Submit
C:\Windows\SysWOW64\Kgflcifg.exe

Filesize
177KB

MD5
55457eef1f3a86fb8b67e54e57e65f5d

SHA1
71bb128eb9c724835bd91e59df41de6648dfdfd8

SHA256
44861379af0f37743e6f3d6a008fd06c0f241196ded914ccadbd3cda075037a9

SHA512
790bd7cd5fde7bf0a84b1962b2f98e3e63fef754e54590b3d2cd61acefe6d49f20402551b1ee4f390b69a3a7f5db556f0fa16ecd83f5a084a846a1f53bd69add

Download Submit
C:\Windows\SysWOW64\Kggcnoic.exe

Filesize
177KB

MD5
0993d7288ddabcd19c94067f24b1283c

SHA1
d37c90861895282f6a0e826e99fb461e3eb8764f

SHA256
e7860ec0b2ab1bf74f5c8d4c4c29a99d4ac60f70b8910b3d909597215f232b3e

SHA512
a8c64394a84b2740fdddba586cc8083b0b3a05ad94e7f11903ce568c9693ad96eab862646f83a95f9939d10eb09b49bcdda9a7281a20903e71778a4392f37f94

Download Submit
C:\Windows\SysWOW64\Kggcnoic.exe

Filesize
177KB

MD5
79a33ed51877d60887ad6ca46af45f64

SHA1
1b8b4258f557907fab9e7c33ca0024552c8db5ed

SHA256
85e92cb03f0a792f745c6d799b714a696378df1b5a9957a7de59cc926dd6d0c8

SHA512
efbd6889798433171a8271df3e645db7aeb884b9cb08ad5491a342eb97803b50f3edf74b4d3bad760c0cd82c869d1c650beda77cb96db2ea773bcdf0ba2f3e91

Download Submit
C:\Windows\SysWOW64\Kggcnoic.exe

Filesize
177KB

MD5
79a33ed51877d60887ad6ca46af45f64

SHA1
1b8b4258f557907fab9e7c33ca0024552c8db5ed

SHA256
85e92cb03f0a792f745c6d799b714a696378df1b5a9957a7de59cc926dd6d0c8

SHA512
efbd6889798433171a8271df3e645db7aeb884b9cb08ad5491a342eb97803b50f3edf74b4d3bad760c0cd82c869d1c650beda77cb96db2ea773bcdf0ba2f3e91

Download Submit
C:\Windows\SysWOW64\Kjjiej32.exe

Filesize
177KB

MD5
78ec333f4449e91ad57dc43c3c413e4c

SHA1
8e9ea5c46464773f1e7096040f1f023711dfef77

SHA256
5135130c68373fb4dc42deece9dff3aafda961529e38303a9bf3391ec5edd6e3

SHA512
8582c93c9b6e1f9af1d53d2e25d3d357163bed7ff5edaae2a46838440ad8868b9cbfa3d456d4e6789630dfe6de0b8dd5c8a00f13853601acf9eb6281c60c5611

Download Submit
C:\Windows\SysWOW64\Kjjiej32.exe

Filesize
177KB

MD5
d7df008b9df4dcc50a21c45e62284618

SHA1
1e4d8e59f65aed05b1882c9c45e4dd044238e3e4

SHA256
0a6a87f70a5ded2f6a4828c54947bf343559b8b04fa84b1754aef05ad3f3a157

SHA512
cd78f516cebdc1d06704ceb6e13b5fd349f60197821324314717f2a9cbd2cc9ec933703274c4acd8b3fdb4c23130f527c7f5e4cb88d822ceb7e7f8c839aa2ce1

Download Submit
C:\Windows\SysWOW64\Kjjiej32.exe

Filesize
177KB

MD5
d7df008b9df4dcc50a21c45e62284618

SHA1
1e4d8e59f65aed05b1882c9c45e4dd044238e3e4

SHA256
0a6a87f70a5ded2f6a4828c54947bf343559b8b04fa84b1754aef05ad3f3a157

SHA512
cd78f516cebdc1d06704ceb6e13b5fd349f60197821324314717f2a9cbd2cc9ec933703274c4acd8b3fdb4c23130f527c7f5e4cb88d822ceb7e7f8c839aa2ce1

Download Submit
C:\Windows\SysWOW64\Kjlopc32.exe

Filesize
177KB

MD5
1a4168236e1cb7e6061dad39daa732be

SHA1
45a2e2bdecbb1a1c883eec9a19215a468afdea46

SHA256
d99a7b293afb69e26ddfaa3a25bcfc176d2e9bab10cc7d0e26b950e6c704f93e

SHA512
efe19b7880985dc78b59d8bf347b6f9fa53f3da04b5bf9dc78052086306a64e106efbd106269fef31151dd774fecd0675279e3e7a12bba36207eede4501de59a

Download Submit
C:\Windows\SysWOW64\Knhakh32.exe

Filesize
177KB

MD5
5e1fa9221d5bd54a09198169e5cb8a06

SHA1
fc80d9c13d1b4356869887f6366bee22d49c4461

SHA256
5eec2d1f7a68c6b77974faa12ed4581a9a5895eb6d279cfc725fc89cd5b3ea2d

SHA512
d0f1ddd07e4c8b047f73af0fedfa48bb4cba1d216671635d2695f41106c0543d3408da797f628b57d70636abe3c11f640e0c09f0d5904119ad3cdbbeef5a4dab

Download Submit
C:\Windows\SysWOW64\Knhakh32.exe

Filesize
177KB

MD5
5e1fa9221d5bd54a09198169e5cb8a06

SHA1
fc80d9c13d1b4356869887f6366bee22d49c4461

SHA256
5eec2d1f7a68c6b77974faa12ed4581a9a5895eb6d279cfc725fc89cd5b3ea2d

SHA512
d0f1ddd07e4c8b047f73af0fedfa48bb4cba1d216671635d2695f41106c0543d3408da797f628b57d70636abe3c11f640e0c09f0d5904119ad3cdbbeef5a4dab

Download Submit
C:\Windows\SysWOW64\Lclpdncg.exe

Filesize
177KB

MD5
10b9bd6db2e641505a366adbfcbcd79e

SHA1
728c0afa9f757a27f4f48a68b1a85e400f507cf0

SHA256
16ef7daa6f694c3d41a87b906b208eb4cca2391493faa4d54fd84be24223f22b

SHA512
ff67016d87310b947fafc06022de8b4bb14a2300166548e7820ed2df1c8806a73373856abed4a340270853e1511c02d53cfb97867cc2d3d35acb25b7d3800255

Download Submit
C:\Windows\SysWOW64\Lclpdncg.exe

Filesize
177KB

MD5
10b9bd6db2e641505a366adbfcbcd79e

SHA1
728c0afa9f757a27f4f48a68b1a85e400f507cf0

SHA256
16ef7daa6f694c3d41a87b906b208eb4cca2391493faa4d54fd84be24223f22b

SHA512
ff67016d87310b947fafc06022de8b4bb14a2300166548e7820ed2df1c8806a73373856abed4a340270853e1511c02d53cfb97867cc2d3d35acb25b7d3800255

Download Submit
C:\Windows\SysWOW64\Ldgccb32.exe

Filesize
177KB

MD5
d3c43a990f56afb6dc4a787da12a6f1b

SHA1
93af646b91a8cffc5e7a6560c62b7f4eb4e3fecc

SHA256
f68105f752273c46a45056d662781e627484a9df212425347658a18b589adb5a

SHA512
6c3c1404e1c1ebef69933a9d59da45aa350863c20918cfe8125b032975cafc807d3ddcd717274deb15a1394d6c2d8d842703d27b7dce55d4aa149844f7203824

Download Submit
C:\Windows\SysWOW64\Ldgccb32.exe

Filesize
177KB

MD5
d3c43a990f56afb6dc4a787da12a6f1b

SHA1
93af646b91a8cffc5e7a6560c62b7f4eb4e3fecc

SHA256
f68105f752273c46a45056d662781e627484a9df212425347658a18b589adb5a

SHA512
6c3c1404e1c1ebef69933a9d59da45aa350863c20918cfe8125b032975cafc807d3ddcd717274deb15a1394d6c2d8d842703d27b7dce55d4aa149844f7203824

Download Submit
C:\Windows\SysWOW64\Lmdemd32.exe

Filesize
177KB

MD5
61f3bbd08bdbd8e6ca56070c4956f74f

SHA1
5a6c294d679ac1b3d505b7f876a9bac0c444abba

SHA256
7397c6bcd3d03b038dad6600fadeb56d5fcb38ab0b1fc8bc0df4f16c87cb942a

SHA512
fc9af7aa0f8a40499694e3780d01c74383030216d9b5b31e0f0684c648f10582c87832e4765d039a4105fdcab8ee1f8942b564cf0cd23de42063fe1808d5f49d

Download Submit
C:\Windows\SysWOW64\Lmdemd32.exe

Filesize
177KB

MD5
61f3bbd08bdbd8e6ca56070c4956f74f

SHA1
5a6c294d679ac1b3d505b7f876a9bac0c444abba

SHA256
7397c6bcd3d03b038dad6600fadeb56d5fcb38ab0b1fc8bc0df4f16c87cb942a

SHA512
fc9af7aa0f8a40499694e3780d01c74383030216d9b5b31e0f0684c648f10582c87832e4765d039a4105fdcab8ee1f8942b564cf0cd23de42063fe1808d5f49d

Download Submit
C:\Windows\SysWOW64\Lmmolepp.exe

Filesize
177KB

MD5
3c28c78f7ce28a7d0e329161e72977c4

SHA1
3b4816508be8735e15ae2dfdfd95a4a279927318

SHA256
4b178e2f10884ecacb39ee921e721cf0de75faad727b868e86fa0881a3371e74

SHA512
8109460796903ff328d04b708ea79931c2cbfbc58226317ff7141d2459330e67c9c35103a7379dfcfbe6e081363c4832f7869714873e6ce9ed4e150626180b0a

Download Submit
C:\Windows\SysWOW64\Lmmolepp.exe

Filesize
177KB

MD5
3c28c78f7ce28a7d0e329161e72977c4

SHA1
3b4816508be8735e15ae2dfdfd95a4a279927318

SHA256
4b178e2f10884ecacb39ee921e721cf0de75faad727b868e86fa0881a3371e74

SHA512
8109460796903ff328d04b708ea79931c2cbfbc58226317ff7141d2459330e67c9c35103a7379dfcfbe6e081363c4832f7869714873e6ce9ed4e150626180b0a

Download Submit
C:\Windows\SysWOW64\Lnmkfh32.exe

Filesize
177KB

MD5
bdb8e82ba173434f893536f9e0ffc19f

SHA1
023e00df51122fcd92418505cd2b621a8ca54cdc

SHA256
0a06763e8469ea0100ed9e6dee4410dc87af6cec9667b81a8c6d59a49229daa6

SHA512
da4537592a96fabbffb65d4de4b15ecd729da6011edd3bc6246c17019542f141e6eb7d4f02830318415dccc309c225263e2693a38d71ff40a91db6444c1ef032

Download Submit
C:\Windows\SysWOW64\Lnmkfh32.exe

Filesize
177KB

MD5
bdb8e82ba173434f893536f9e0ffc19f

SHA1
023e00df51122fcd92418505cd2b621a8ca54cdc

SHA256
0a06763e8469ea0100ed9e6dee4410dc87af6cec9667b81a8c6d59a49229daa6

SHA512
da4537592a96fabbffb65d4de4b15ecd729da6011edd3bc6246c17019542f141e6eb7d4f02830318415dccc309c225263e2693a38d71ff40a91db6444c1ef032

Download Submit
C:\Windows\SysWOW64\Lpelqj32.exe

Filesize
177KB

MD5
f3b76be51fa9cb877228e00dc2a21490

SHA1
dc3364e82284d1e182df70b11f30f6cac963e6c2

SHA256
519d9d38ec66caa94025be759d8b900d86ca8329ec12b0fb53b8ff8148794ce5

SHA512
13262b1e52793d2da9c06d8d50c47077c9004ee76fe02908e2efd48011bee6a2dfaa34e649d475f5a28e287fa466f97567a82106e1cceb4f55f74aa06b687f46

Download Submit
C:\Windows\SysWOW64\Lqbncb32.exe

Filesize
177KB

MD5
2a91b7155be51d28b33a06ea041703a4

SHA1
305170b39067a9dfbf1cba4609005ec19f9fa016

SHA256
47f34318b8d5ce6a77b7f70b3724497ddaf8466a7841d3544559cf95dbfb3413

SHA512
4296da64d7b2b1ce607359a11e6729f6c91d37030cc094985ff0d6d54a0498f7e9a353a25584343f348e7e5751199ea76defcf000dbdbd23b877b83c1ed1d7d8

Download Submit
C:\Windows\SysWOW64\Lqbncb32.exe

Filesize
177KB

MD5
2a91b7155be51d28b33a06ea041703a4

SHA1
305170b39067a9dfbf1cba4609005ec19f9fa016

SHA256
47f34318b8d5ce6a77b7f70b3724497ddaf8466a7841d3544559cf95dbfb3413

SHA512
4296da64d7b2b1ce607359a11e6729f6c91d37030cc094985ff0d6d54a0498f7e9a353a25584343f348e7e5751199ea76defcf000dbdbd23b877b83c1ed1d7d8

Download Submit
C:\Windows\SysWOW64\Madjhb32.exe

Filesize
177KB

MD5
2a91b7155be51d28b33a06ea041703a4

SHA1
305170b39067a9dfbf1cba4609005ec19f9fa016

SHA256
47f34318b8d5ce6a77b7f70b3724497ddaf8466a7841d3544559cf95dbfb3413

SHA512
4296da64d7b2b1ce607359a11e6729f6c91d37030cc094985ff0d6d54a0498f7e9a353a25584343f348e7e5751199ea76defcf000dbdbd23b877b83c1ed1d7d8

Download Submit
C:\Windows\SysWOW64\Madjhb32.exe

Filesize
177KB

MD5
499a90eaaa9f8207400732017bb1ffd3

SHA1
0a4d9c608c32c3ba7562f36e30b7d5c72df7eb82

SHA256
1fc939545817e1c7217a16e87221072f28743671646b35b5ffc62c6e984846ea

SHA512
84e5e9412e17f1e1a04764b152f8cdfb3df13322a095c03ff60cf99332b5f8ca2fc5bf7514a1fd687b82a492d1965efd865497968a68a47a621cfdd5aef1b8b6

Download Submit
C:\Windows\SysWOW64\Madjhb32.exe

Filesize
177KB

MD5
499a90eaaa9f8207400732017bb1ffd3

SHA1
0a4d9c608c32c3ba7562f36e30b7d5c72df7eb82

SHA256
1fc939545817e1c7217a16e87221072f28743671646b35b5ffc62c6e984846ea

SHA512
84e5e9412e17f1e1a04764b152f8cdfb3df13322a095c03ff60cf99332b5f8ca2fc5bf7514a1fd687b82a492d1965efd865497968a68a47a621cfdd5aef1b8b6

Download Submit
C:\Windows\SysWOW64\Malpia32.exe

Filesize
177KB

MD5
1d40cc192e53eb63896badeb2e3d1afc

SHA1
ff9cd1c53aee1b045afb95a3c0b6761d5efe4af6

SHA256
4120980eb78512d6f6ee379c6dec831cfcc58a5a16c5fac1e1e949c092f94d57

SHA512
704d7884e905c2f861d0d207022c702c6a7e7fbe8e87495ff3ac23b0559baf0fe08feb8a8b86dbbd6e4778092f19b05249fd030c54726a604c0e39e8712de705

Download Submit
C:\Windows\SysWOW64\Malpia32.exe

Filesize
177KB

MD5
396ab4269e789fc573d1b2421a590ab3

SHA1
9e269a7608394bed5e702617869b0a589c6808e4

SHA256
97a8991bf735e598e4c2dfe50fb52f9ca3f6f81e3edd86add291b19373072d23

SHA512
38d668ebedb662135ec84e5ffd8f3f9e73b9ee8196d24b84389527cb0cdf35fe857683bbb22049a7ccb509839d2cf84030cccf63b3134c31012ceedef53bb4da

Download Submit
C:\Windows\SysWOW64\Malpia32.exe

Filesize
177KB

MD5
396ab4269e789fc573d1b2421a590ab3

SHA1
9e269a7608394bed5e702617869b0a589c6808e4

SHA256
97a8991bf735e598e4c2dfe50fb52f9ca3f6f81e3edd86add291b19373072d23

SHA512
38d668ebedb662135ec84e5ffd8f3f9e73b9ee8196d24b84389527cb0cdf35fe857683bbb22049a7ccb509839d2cf84030cccf63b3134c31012ceedef53bb4da

Download Submit
C:\Windows\SysWOW64\Mebcop32.exe

Filesize
177KB

MD5
05f78ea90333349641f2486d8cdd9494

SHA1
5fc376a22459b588d67d2e11f866914dd7a3479b

SHA256
c5623bd28816d0dd60239908c0ad027b5a5d829a849bb08150fadfbfbedbf31b

SHA512
2a988206b967bfc252b0fe9dba35e20d9231eada8a50be67a4e8f2aa0f9711c6ab77934bdfffe2b4a39314e6cba2d8cae9af0debb4934aabd2efb27e911e1429

Download Submit
C:\Windows\SysWOW64\Mebcop32.exe

Filesize
177KB

MD5
05f78ea90333349641f2486d8cdd9494

SHA1
5fc376a22459b588d67d2e11f866914dd7a3479b

SHA256
c5623bd28816d0dd60239908c0ad027b5a5d829a849bb08150fadfbfbedbf31b

SHA512
2a988206b967bfc252b0fe9dba35e20d9231eada8a50be67a4e8f2aa0f9711c6ab77934bdfffe2b4a39314e6cba2d8cae9af0debb4934aabd2efb27e911e1429

Download Submit
C:\Windows\SysWOW64\Mjmoag32.exe

Filesize
177KB

MD5
c3f55f516cfc910a3a8aab1a52e265e1

SHA1
3a099fcc8f6964156f15f44cc0bd6138123d6b8c

SHA256
580ff6d8b05e32c88c5dc8dadea5d18c64f909ded6fbc570152a2d4ea3d174a2

SHA512
2fceaa72b48ef83de52394e9b8f9f9e152b7c567d08dfc2df2ee07ce07d108d2dce113ee1bfaff4922a19607ef4f08a7183958968a4ed12f5eaba1832496e184

Download Submit
C:\Windows\SysWOW64\Mjmoag32.exe

Filesize
177KB

MD5
c3f55f516cfc910a3a8aab1a52e265e1

SHA1
3a099fcc8f6964156f15f44cc0bd6138123d6b8c

SHA256
580ff6d8b05e32c88c5dc8dadea5d18c64f909ded6fbc570152a2d4ea3d174a2

SHA512
2fceaa72b48ef83de52394e9b8f9f9e152b7c567d08dfc2df2ee07ce07d108d2dce113ee1bfaff4922a19607ef4f08a7183958968a4ed12f5eaba1832496e184

Download Submit
C:\Windows\SysWOW64\Mnkggfkb.exe

Filesize
177KB

MD5
1d40cc192e53eb63896badeb2e3d1afc

SHA1
ff9cd1c53aee1b045afb95a3c0b6761d5efe4af6

SHA256
4120980eb78512d6f6ee379c6dec831cfcc58a5a16c5fac1e1e949c092f94d57

SHA512
704d7884e905c2f861d0d207022c702c6a7e7fbe8e87495ff3ac23b0559baf0fe08feb8a8b86dbbd6e4778092f19b05249fd030c54726a604c0e39e8712de705

Download Submit
C:\Windows\SysWOW64\Mnkggfkb.exe

Filesize
177KB

MD5
1d40cc192e53eb63896badeb2e3d1afc

SHA1
ff9cd1c53aee1b045afb95a3c0b6761d5efe4af6

SHA256
4120980eb78512d6f6ee379c6dec831cfcc58a5a16c5fac1e1e949c092f94d57

SHA512
704d7884e905c2f861d0d207022c702c6a7e7fbe8e87495ff3ac23b0559baf0fe08feb8a8b86dbbd6e4778092f19b05249fd030c54726a604c0e39e8712de705

Download Submit
C:\Windows\SysWOW64\Mqafhl32.exe

Filesize
177KB

MD5
c37c5e57687c6df514c4747bb79d456a

SHA1
885c08745fb20707825f8868220597d0c1d61297

SHA256
2d0a46ed5f15558348bfc21ab2014304f19ec76e91be498da82bbb1feef960bb

SHA512
7a924214fc636e910bc9e59206b791e1a4acb9b8907a92ef09ac2c9264cc0aefef07fc78bbbc0cc27e404f629e148715f34f785b16a15708d361272d04835b79

Download Submit
C:\Windows\SysWOW64\Nmkkle32.exe

Filesize
177KB

MD5
dc45b7b1d0dbeaa412eefc38676503ba

SHA1
e67794a986226562f6c5532d02722c151448ecfe

SHA256
07537a57ccb1e002214578dd8c48ec609d0898ba01b97a733da2d210807b197e

SHA512
e723a3ee01404b5b125136a8e524412e712ef7190b719ccf5f4a0e42e4e8925b64045ac67fc2792e71064e460ab7e2be10649a2bc1a3a0c4f6809ff08b5718ae

Download Submit
C:\Windows\SysWOW64\Pdkoch32.exe

Filesize
177KB

MD5
108e3e75323921b17052bd6a10cfc1a7

SHA1
75731e29cb4f8d900aacee8658ec1e984be06ed9

SHA256
c5ddbc74f3ef2a104f8f069c34dc9ab3b96c4595caa4088625a910c90f2508f9

SHA512
1062ef11f5adacd41c652dca5057d64df022bf5bd0d936daea19ae8f4e485c551b7dbd472a0e2dd31455f8baaa1f5a55724df0712c9ede34ab67a2a73ae46046

Download Submit
C:\Windows\SysWOW64\Pnfiplog.exe

Filesize
177KB

MD5
1c072ce9da3b4701c9bc36de5766e177

SHA1
f5640dc1af4d271136e2ad0b818c82c403910302

SHA256
9a908ce71619fee70513156a1973b1e40561365b296cf9ee2fff09c1c00aa172

SHA512
dcf8a351037fc7a54bfcd0b3398fcbddf108aa0dd15418819fa49cbf4ea67fe9ea1b3df6fcaacd0d6c0d7c42d9deae347ee7a5b615e6783431c595d19aefa2c7

Download Submit
memory/232-373-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/392-49-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/408-391-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/468-113-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/760-234-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/844-257-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/880-295-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1148-217-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1200-265-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1332-210-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1420-193-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1436-319-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1444-385-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1456-8-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1512-289-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1560-145-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1644-177-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1856-81-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/1960-138-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2072-105-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2148-421-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2168-415-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2188-78-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2252-277-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2308-307-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2372-349-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2376-233-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2388-16-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2496-29-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2728-271-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2764-409-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2768-249-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2864-397-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2876-226-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2892-283-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3012-379-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3108-313-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3236-33-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3320-206-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3364-64-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3440-343-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3516-153-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3528-161-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3676-121-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3776-337-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3804-41-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3828-169-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/3936-305-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4004-72-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4004-0-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4004-5-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4304-185-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4340-241-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4428-361-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4644-325-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4676-89-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4716-427-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4792-403-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4796-355-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4804-367-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/4936-57-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5008-98-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5044-331-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/5116-130-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads