df5ccc6de94bdfadbdcbf39066ad3d7fc592b8d91b7b8478ec26ac018697d6b2

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2023, 19:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e54c0732ae86522843110d7750ba1160_exe32.exe
Size

97KB
MD5

e54c0732ae86522843110d7750ba1160
SHA1

9db7df6ff4ba5fd5f0b125687ec2d999a711deed
SHA256

df5ccc6de94bdfadbdcbf39066ad3d7fc592b8d91b7b8478ec26ac018697d6b2
SHA512

62e48f606cec48e5010dd8988c033937744de25c74ef2a626fe37c4a890d7ad91667409bc24fbb2d70a19bf9606e7ec71c7877418a372a6b1dfc84d9a4b2c1cd
SSDEEP

1536:xVnL3TqGbngMSwmeE39xLd23MfGE1jNhr7fMRFVCBIiWKiGvJXeYZ6:xRbgKbEE5E1OYI5XuJXeK6

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eifhdd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Inlihl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gppcmeem.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jjpode32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Jfnbdecg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lldfjh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nomncpcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kjkpoq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Eaceghcg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqbpojnp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dqbcbkab.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Mcaipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ekgqennl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lbjlfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hnfamjqg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Niniei32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cggimh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gnfhfl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jleijb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Egohdegl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Pmphaaln.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Acfhad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kkconn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anmfbl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Anaomkdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ldjhpl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Llbidimc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mlklkgei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Kqnbkl32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nfgklkoc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ioolkncg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agdcpkll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Agdcpkll.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcoljagj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Niniei32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Amhfkopc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bboffejp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hpcodihc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nfcabp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpbjfjci.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hdmein32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Idhnkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckpamabg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gaogak32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fielph32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdkidohn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hdmein32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Nlfelogp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hgmgqc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kcejco32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bhkmec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Lqhdbm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dggkipii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Oocmii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Codhnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Fjmkoeqi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gnepna32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Ekaapi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Gfjkjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohqbhdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Cgjjdf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fhofmq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FAA099-1BAE-816E-D711-115290CEE717}"	Hdpbon32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lfgipd32.exe

Executes dropped EXE 64 IoCs

pid	Process
1412	Kbfbkj32.exe
2772	Klngdpdd.exe
1060	Kefkme32.exe
5112	Lbjlfi32.exe
4468	Liddbc32.exe
4308	Ldjhpl32.exe
3724	Lfkaag32.exe
3712	Lbabgh32.exe
3876	Ldanqkki.exe
4188	Lingibiq.exe
1924	Mdckfk32.exe
1812	Mmlpoqpg.exe
3344	Mgddhf32.exe
4852	Mplhql32.exe
2364	Mlcifmbl.exe
5100	Melnob32.exe
5080	Mdmnlj32.exe
1320	Mlhbal32.exe
2160	Nepgjaeg.exe
3540	Ncdgcf32.exe
1708	Njnpppkn.exe
3908	Nphhmj32.exe
5048	Nnlhfn32.exe
4192	Ndfqbhia.exe
3760	Nfgmjqop.exe
1208	Nlaegk32.exe
3208	Nggjdc32.exe
1096	Odkjng32.exe
3356	Ojgbfocc.exe
4624	Odmgcgbi.exe
3032	Oneklm32.exe
3256	Ocbddc32.exe
1424	Oqfdnhfk.exe
3616	Ofcmfodb.exe
3940	Olmeci32.exe
4100	Ogbipa32.exe
4072	Pnlaml32.exe
1260	Pgefeajb.exe
1396	Pmannhhj.exe
5052	Pdifoehl.exe
1332	Pmdkch32.exe
3152	Pgioqq32.exe
3792	Pqbdjfln.exe
4216	Bgehcmmm.exe
3780	Bmbplc32.exe
2320	Bhhdil32.exe
1552	Belebq32.exe
4768	Cndikf32.exe
4776	Cnffqf32.exe
3468	Ceqnmpfo.exe
4052	Cfbkeh32.exe
4344	Cmlcbbcj.exe
4644	Chagok32.exe
2604	Cnkplejl.exe
2108	Chcddk32.exe
4532	Cmqmma32.exe
3164	Cegdnopg.exe
5044	Djdmffnn.exe
4900	Dejacond.exe
488	Dkkcge32.exe
3664	Deagdn32.exe
4908	Doilmc32.exe
1692	Ehapfiem.exe
492	Emoinpcd.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Gpcpel32.dll	Jjpode32.exe
File created	C:\Windows\SysWOW64\Enjgeopm.dll	Nqbpojnp.exe
File opened for modification	C:\Windows\SysWOW64\Eaceghcg.exe	Eaaiahei.exe
File opened for modification	C:\Windows\SysWOW64\Belebq32.exe	Bhhdil32.exe
File opened for modification	C:\Windows\SysWOW64\Edhakj32.exe	Emoinpcd.exe
File opened for modification	C:\Windows\SysWOW64\Jkodhk32.exe	Jiaglp32.exe
File created	C:\Windows\SysWOW64\Jngbjd32.exe	Jlgepanl.exe
File created	C:\Windows\SysWOW64\Nggjdc32.exe	Nlaegk32.exe
File created	C:\Windows\SysWOW64\Fmlneg32.exe	Fknbil32.exe
File created	C:\Windows\SysWOW64\Flhkmbmp.dll	Nfcabp32.exe
File created	C:\Windows\SysWOW64\Cmqmma32.exe	Chcddk32.exe
File opened for modification	C:\Windows\SysWOW64\Ncmhko32.exe	Nhhdnf32.exe
File created	C:\Windows\SysWOW64\Chbfoaba.dll	Hbenoi32.exe
File opened for modification	C:\Windows\SysWOW64\Pjbkgfej.exe	Pomgjn32.exe
File opened for modification	C:\Windows\SysWOW64\Gpkchqdj.exe	Gaopfe32.exe
File created	C:\Windows\SysWOW64\Igjngh32.exe	Inainbcn.exe
File opened for modification	C:\Windows\SysWOW64\Bklfgo32.exe	Bdbnjdfg.exe
File opened for modification	C:\Windows\SysWOW64\Ghniielm.exe	Gnhdkl32.exe
File created	C:\Windows\SysWOW64\Jdmmkl32.dll	Mlnipg32.exe
File created	C:\Windows\SysWOW64\Nbcqiope.exe	Nlihle32.exe
File created	C:\Windows\SysWOW64\Kffonkgk.dll	Komhll32.exe
File created	C:\Windows\SysWOW64\Hlkfbocp.exe	Ghojbq32.exe
File created	C:\Windows\SysWOW64\Nlihle32.exe	Neppokal.exe
File created	C:\Windows\SysWOW64\Ajhniccb.exe	Acnemi32.exe
File created	C:\Windows\SysWOW64\Cffpglpg.dll	Lgffic32.exe
File opened for modification	C:\Windows\SysWOW64\Jnjejjgh.exe	Jklinohd.exe
File created	C:\Windows\SysWOW64\Mcaipa32.exe	Mcoljagj.exe
File created	C:\Windows\SysWOW64\Ogbipa32.exe	Olmeci32.exe
File created	C:\Windows\SysWOW64\Ggnlobej.exe	Gdppbfff.exe
File opened for modification	C:\Windows\SysWOW64\Oondnini.exe	Nlphbnoe.exe
File created	C:\Windows\SysWOW64\Jklliiom.dll	Iojkeh32.exe
File created	C:\Windows\SysWOW64\Bopnkd32.dll	Dajbaika.exe
File created	C:\Windows\SysWOW64\Folaiqng.exe	Fdfmlhna.exe
File opened for modification	C:\Windows\SysWOW64\Cimcan32.exe	Cglgjeci.exe
File created	C:\Windows\SysWOW64\Acfhad32.exe	Qebhhp32.exe
File opened for modification	C:\Windows\SysWOW64\Gfjkjo32.exe	Gppcmeem.exe
File created	C:\Windows\SysWOW64\Ndlapjeg.dll	Jklphekp.exe
File created	C:\Windows\SysWOW64\Eifhdd32.exe	Eciplm32.exe
File created	C:\Windows\SysWOW64\Joqafgni.exe	Iehmmb32.exe
File created	C:\Windows\SysWOW64\Flpbbbdk.dll	Eaaiahei.exe
File created	C:\Windows\SysWOW64\Liddbc32.exe	Lbjlfi32.exe
File created	C:\Windows\SysWOW64\Mmjcbkij.dll	Emoinpcd.exe
File opened for modification	C:\Windows\SysWOW64\Gppcmeem.exe	Gejopl32.exe
File created	C:\Windows\SysWOW64\Jlgepanl.exe	Jenmcggo.exe
File created	C:\Windows\SysWOW64\Ombmjmoh.dll	Hkmnln32.exe
File opened for modification	C:\Windows\SysWOW64\Nlkngo32.exe	Nimbkc32.exe
File created	C:\Windows\SysWOW64\Nefped32.exe	Nbgcih32.exe
File created	C:\Windows\SysWOW64\Fmfnpa32.exe	Efjimhnh.exe
File opened for modification	C:\Windows\SysWOW64\Alpbecod.exe	Aefjii32.exe
File created	C:\Windows\SysWOW64\Pdggmekl.dll	Hfningai.exe
File created	C:\Windows\SysWOW64\Ibajgf32.dll	Cgjjdf32.exe
File opened for modification	C:\Windows\SysWOW64\Cmmbbejp.exe	Ccdnjp32.exe
File created	C:\Windows\SysWOW64\Jjgchm32.exe	Icnklbmj.exe
File created	C:\Windows\SysWOW64\Bdkfmkdc.dll	Kefkme32.exe
File opened for modification	C:\Windows\SysWOW64\Komhll32.exe	Jjpode32.exe
File opened for modification	C:\Windows\SysWOW64\Qfmfefni.exe	Qmdblp32.exe
File opened for modification	C:\Windows\SysWOW64\Kbmoen32.exe	Kkcfid32.exe
File created	C:\Windows\SysWOW64\Hknkchkd.dll	Gihgfk32.exe
File created	C:\Windows\SysWOW64\Kldjcoje.dll	Fnbcgn32.exe
File created	C:\Windows\SysWOW64\Hkhcdb32.dll	Hlppno32.exe
File opened for modification	C:\Windows\SysWOW64\Doilmc32.exe	Deagdn32.exe
File opened for modification	C:\Windows\SysWOW64\Hgjljpkm.exe	Hbmcbime.exe
File created	C:\Windows\SysWOW64\Hgoeep32.exe	Hfningai.exe
File created	C:\Windows\SysWOW64\Hdmein32.exe	Hgiepjga.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7808	952	WerFault.exe	847

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Papdfone.dll"	Mhilfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apoigbgj.dll"	Iphioh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hlkfbocp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgmdfppj.dll"	Fnaokmco.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fkeodaai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gmnagpbq.dll"	Jkodhk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fkhfob32.dll"	Moaogand.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Leopnglc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Gpkchqdj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Mcaipa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nciopppp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Afelhf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fdffbake.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hqdkac32.dll"	Aaohcj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kjmgil32.dll"	Opbean32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Emoinpcd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Nlihle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nahffe32.dll"	Jhpqaiji.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Bkdcbd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fanmld32.dll"	Nhhdnf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cipqnf32.dll"	Fknicb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Oocmii32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Gkmdecbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Npgmpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ogklelna.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Hdmein32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Lqmmmmph.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Djqblj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgplfcko.dll"	Amhfkopc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Edogedqq.dll"	Bjaqpbkh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Bqmeal32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Daediilg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Cbphdn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fajgkfio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fnihje32.dll"	Banjnm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pacmhc32.dll"	Folaiqng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pqnalj32.dll"	Jfnbdecg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dgooajdl.dll"	Nheble32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Phhhhc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Alpbecod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eaecci32.dll"	Eaceghcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lfkaag32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cihdpk32.dll"	Nomncpcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Jnkldqkc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Niooqcad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dolqpa32.dll"	Lfjfecno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lncmdghm.dll"	Caqpkjcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ofpnmakg.dll"	Ekaapi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Pmdkch32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Fknicb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Ggnlobej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmokmkpo.dll"	Kcndbp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Akepfpcl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jlobem32.dll"	Bnlhncgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Nfgklkoc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Eiildjag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Hnfjbdmk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Agbgbe32.dll"	Kgjgne32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Ckeimm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Lcgpni32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32	Anaomkdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ThreadingModel = "Apartment"	Akglloai.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mfbhmo32.dll"	Bhkmec32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FAA099-1BAE-816E-D711-115290CEE717}\InProcServer32\ = "C:\\Windows\\SysWow64\\Okgoadbf.dll"	Chcddk32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1412	1388	e54c0732ae86522843110d7750ba1160_exe32.exe	82
PID 1388 wrote to memory of 1412	1388	e54c0732ae86522843110d7750ba1160_exe32.exe	82
PID 1388 wrote to memory of 1412	1388	e54c0732ae86522843110d7750ba1160_exe32.exe	82
PID 1412 wrote to memory of 2772	1412	Kbfbkj32.exe	84
PID 1412 wrote to memory of 2772	1412	Kbfbkj32.exe	84
PID 1412 wrote to memory of 2772	1412	Kbfbkj32.exe	84
PID 2772 wrote to memory of 1060	2772	Klngdpdd.exe	85
PID 2772 wrote to memory of 1060	2772	Klngdpdd.exe	85
PID 2772 wrote to memory of 1060	2772	Klngdpdd.exe	85
PID 1060 wrote to memory of 5112	1060	Kefkme32.exe	86
PID 1060 wrote to memory of 5112	1060	Kefkme32.exe	86
PID 1060 wrote to memory of 5112	1060	Kefkme32.exe	86
PID 5112 wrote to memory of 4468	5112	Lbjlfi32.exe	87
PID 5112 wrote to memory of 4468	5112	Lbjlfi32.exe	87
PID 5112 wrote to memory of 4468	5112	Lbjlfi32.exe	87
PID 4468 wrote to memory of 4308	4468	Liddbc32.exe	88
PID 4468 wrote to memory of 4308	4468	Liddbc32.exe	88
PID 4468 wrote to memory of 4308	4468	Liddbc32.exe	88
PID 4308 wrote to memory of 3724	4308	Ldjhpl32.exe	89
PID 4308 wrote to memory of 3724	4308	Ldjhpl32.exe	89
PID 4308 wrote to memory of 3724	4308	Ldjhpl32.exe	89
PID 3724 wrote to memory of 3712	3724	Lfkaag32.exe	90
PID 3724 wrote to memory of 3712	3724	Lfkaag32.exe	90
PID 3724 wrote to memory of 3712	3724	Lfkaag32.exe	90
PID 3712 wrote to memory of 3876	3712	Lbabgh32.exe	91
PID 3712 wrote to memory of 3876	3712	Lbabgh32.exe	91
PID 3712 wrote to memory of 3876	3712	Lbabgh32.exe	91
PID 3876 wrote to memory of 4188	3876	Ldanqkki.exe	92
PID 3876 wrote to memory of 4188	3876	Ldanqkki.exe	92
PID 3876 wrote to memory of 4188	3876	Ldanqkki.exe	92
PID 4188 wrote to memory of 1924	4188	Lingibiq.exe	93
PID 4188 wrote to memory of 1924	4188	Lingibiq.exe	93
PID 4188 wrote to memory of 1924	4188	Lingibiq.exe	93
PID 1924 wrote to memory of 1812	1924	Mdckfk32.exe	94
PID 1924 wrote to memory of 1812	1924	Mdckfk32.exe	94
PID 1924 wrote to memory of 1812	1924	Mdckfk32.exe	94
PID 1812 wrote to memory of 3344	1812	Mmlpoqpg.exe	95
PID 1812 wrote to memory of 3344	1812	Mmlpoqpg.exe	95
PID 1812 wrote to memory of 3344	1812	Mmlpoqpg.exe	95
PID 3344 wrote to memory of 4852	3344	Mgddhf32.exe	96
PID 3344 wrote to memory of 4852	3344	Mgddhf32.exe	96
PID 3344 wrote to memory of 4852	3344	Mgddhf32.exe	96
PID 4852 wrote to memory of 2364	4852	Mplhql32.exe	97
PID 4852 wrote to memory of 2364	4852	Mplhql32.exe	97
PID 4852 wrote to memory of 2364	4852	Mplhql32.exe	97
PID 2364 wrote to memory of 5100	2364	Mlcifmbl.exe	98
PID 2364 wrote to memory of 5100	2364	Mlcifmbl.exe	98
PID 2364 wrote to memory of 5100	2364	Mlcifmbl.exe	98
PID 5100 wrote to memory of 5080	5100	Melnob32.exe	99
PID 5100 wrote to memory of 5080	5100	Melnob32.exe	99
PID 5100 wrote to memory of 5080	5100	Melnob32.exe	99
PID 5080 wrote to memory of 1320	5080	Mdmnlj32.exe	100
PID 5080 wrote to memory of 1320	5080	Mdmnlj32.exe	100
PID 5080 wrote to memory of 1320	5080	Mdmnlj32.exe	100
PID 1320 wrote to memory of 2160	1320	Mlhbal32.exe	101
PID 1320 wrote to memory of 2160	1320	Mlhbal32.exe	101
PID 1320 wrote to memory of 2160	1320	Mlhbal32.exe	101
PID 2160 wrote to memory of 3540	2160	Nepgjaeg.exe	102
PID 2160 wrote to memory of 3540	2160	Nepgjaeg.exe	102
PID 2160 wrote to memory of 3540	2160	Nepgjaeg.exe	102
PID 3540 wrote to memory of 1708	3540	Ncdgcf32.exe	103
PID 3540 wrote to memory of 1708	3540	Ncdgcf32.exe	103
PID 3540 wrote to memory of 1708	3540	Ncdgcf32.exe	103
PID 1708 wrote to memory of 3908	1708	Njnpppkn.exe	104

C:\Users\Admin\AppData\Local\Temp\e54c0732ae86522843110d7750ba1160_exe32.exe
"C:\Users\Admin\AppData\Local\Temp\e54c0732ae86522843110d7750ba1160_exe32.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Windows\SysWOW64\Kbfbkj32.exe
  C:\Windows\system32\Kbfbkj32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1412
- - C:\Windows\SysWOW64\Klngdpdd.exe
    C:\Windows\system32\Klngdpdd.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2772
  - - C:\Windows\SysWOW64\Kefkme32.exe
      C:\Windows\system32\Kefkme32.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Suspicious use of WriteProcessMemory
      PID:1060
    - - C:\Windows\SysWOW64\Lbjlfi32.exe
        
        C:\Windows\system32\Lbjlfi32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5112
      - C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4468
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        8⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3724
        
        C:\Windows\SysWOW64\Lbabgh32.exe
        
        C:\Windows\system32\Lbabgh32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3712
        
        C:\Windows\SysWOW64\Ldanqkki.exe
        
        C:\Windows\system32\Ldanqkki.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3876
        
        C:\Windows\SysWOW64\Lingibiq.exe
        
        C:\Windows\system32\Lingibiq.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4188
        
        C:\Windows\SysWOW64\Mdckfk32.exe
        
        C:\Windows\system32\Mdckfk32.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1924
        
        C:\Windows\SysWOW64\Mmlpoqpg.exe
        
        C:\Windows\system32\Mmlpoqpg.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1812
        
        C:\Windows\SysWOW64\Mgddhf32.exe
        
        C:\Windows\system32\Mgddhf32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3344
        
        C:\Windows\SysWOW64\Mplhql32.exe
        
        C:\Windows\system32\Mplhql32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4852
        
        C:\Windows\SysWOW64\Mlcifmbl.exe
        
        C:\Windows\system32\Mlcifmbl.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2364
        
        C:\Windows\SysWOW64\Melnob32.exe
        
        C:\Windows\system32\Melnob32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5100
        
        C:\Windows\SysWOW64\Mdmnlj32.exe
        
        C:\Windows\system32\Mdmnlj32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5080
        
        C:\Windows\SysWOW64\Mlhbal32.exe
        
        C:\Windows\system32\Mlhbal32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1320
        
        C:\Windows\SysWOW64\Nepgjaeg.exe
        
        C:\Windows\system32\Nepgjaeg.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2160
        
        C:\Windows\SysWOW64\Ncdgcf32.exe
        
        C:\Windows\system32\Ncdgcf32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3540
        
        C:\Windows\SysWOW64\Njnpppkn.exe
        
        C:\Windows\system32\Njnpppkn.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\SysWOW64\Nphhmj32.exe
        
        C:\Windows\system32\Nphhmj32.exe
        23⤵
        Executes dropped EXE
        
        PID:3908
        
        C:\Windows\SysWOW64\Nnlhfn32.exe
        
        C:\Windows\system32\Nnlhfn32.exe
        24⤵
        Executes dropped EXE
        
        PID:5048
        
        C:\Windows\SysWOW64\Ndfqbhia.exe
        
        C:\Windows\system32\Ndfqbhia.exe
        25⤵
        Executes dropped EXE
        
        PID:4192
        
        C:\Windows\SysWOW64\Nfgmjqop.exe
        
        C:\Windows\system32\Nfgmjqop.exe
        26⤵
        Executes dropped EXE
        
        PID:3760
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1208
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        28⤵
        Executes dropped EXE
        
        PID:3208
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        29⤵
        Executes dropped EXE
        
        PID:1096
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        30⤵
        Executes dropped EXE
        
        PID:3356
        
        C:\Windows\SysWOW64\Odmgcgbi.exe
        
        C:\Windows\system32\Odmgcgbi.exe
        31⤵
        Executes dropped EXE
        
        PID:4624
        
        C:\Windows\SysWOW64\Oneklm32.exe
        
        C:\Windows\system32\Oneklm32.exe
        32⤵
        Executes dropped EXE
        
        PID:3032
        
        C:\Windows\SysWOW64\Ocbddc32.exe
        
        C:\Windows\system32\Ocbddc32.exe
        33⤵
        Executes dropped EXE
        
        PID:3256
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        34⤵
        Executes dropped EXE
        
        PID:1424
        
        C:\Windows\SysWOW64\Ofcmfodb.exe
        
        C:\Windows\system32\Ofcmfodb.exe
        35⤵
        Executes dropped EXE
        
        PID:3616
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3940
        
        C:\Windows\SysWOW64\Ogbipa32.exe
        
        C:\Windows\system32\Ogbipa32.exe
        37⤵
        Executes dropped EXE
        
        PID:4100
        
        C:\Windows\SysWOW64\Pnlaml32.exe
        
        C:\Windows\system32\Pnlaml32.exe
        38⤵
        Executes dropped EXE
        
        PID:4072
        
        C:\Windows\SysWOW64\Pgefeajb.exe
        
        C:\Windows\system32\Pgefeajb.exe
        39⤵
        Executes dropped EXE
        
        PID:1260
        
        C:\Windows\SysWOW64\Pmannhhj.exe
        
        C:\Windows\system32\Pmannhhj.exe
        40⤵
        Executes dropped EXE
        
        PID:1396
        
        C:\Windows\SysWOW64\Pdifoehl.exe
        
        C:\Windows\system32\Pdifoehl.exe
        41⤵
        Executes dropped EXE
        
        PID:5052
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        42⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1332
        
        C:\Windows\SysWOW64\Pgioqq32.exe
        
        C:\Windows\system32\Pgioqq32.exe
        43⤵
        Executes dropped EXE
        
        PID:3152
        
        C:\Windows\SysWOW64\Pqbdjfln.exe
        
        C:\Windows\system32\Pqbdjfln.exe
        44⤵
        Executes dropped EXE
        
        PID:3792
        
        C:\Windows\SysWOW64\Bgehcmmm.exe
        
        C:\Windows\system32\Bgehcmmm.exe
        45⤵
        Executes dropped EXE
        
        PID:4216
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        46⤵
        Executes dropped EXE
        
        PID:3780
        
        C:\Windows\SysWOW64\Bhhdil32.exe
        
        C:\Windows\system32\Bhhdil32.exe
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2320
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        48⤵
        Executes dropped EXE
        
        PID:1552
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        49⤵
        Executes dropped EXE
        
        PID:4768
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        50⤵
        Executes dropped EXE
        
        PID:4776
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        51⤵
        Executes dropped EXE
        
        PID:3468
        
        C:\Windows\SysWOW64\Cfbkeh32.exe
        
        C:\Windows\system32\Cfbkeh32.exe
        52⤵
        Executes dropped EXE
        
        PID:4052
        
        C:\Windows\SysWOW64\Cmlcbbcj.exe
        
        C:\Windows\system32\Cmlcbbcj.exe
        53⤵
        Executes dropped EXE
        
        PID:4344
        
        C:\Windows\SysWOW64\Chagok32.exe
        
        C:\Windows\system32\Chagok32.exe
        54⤵
        Executes dropped EXE
        
        PID:4644
        
        C:\Windows\SysWOW64\Cnkplejl.exe
        
        C:\Windows\system32\Cnkplejl.exe
        55⤵
        Executes dropped EXE
        
        PID:2604
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:2108
        
        C:\Windows\SysWOW64\Cmqmma32.exe
        
        C:\Windows\system32\Cmqmma32.exe
        57⤵
        Executes dropped EXE
        
        PID:4532
        
        C:\Windows\SysWOW64\Cegdnopg.exe
        
        C:\Windows\system32\Cegdnopg.exe
        58⤵
        Executes dropped EXE
        
        PID:3164
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        59⤵
        Executes dropped EXE
        
        PID:5044
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        60⤵
        Executes dropped EXE
        
        PID:4900
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        61⤵
        Executes dropped EXE
        
        PID:488
        
        C:\Windows\SysWOW64\Deagdn32.exe
        
        C:\Windows\system32\Deagdn32.exe
        62⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3664
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        63⤵
        Executes dropped EXE
        
        PID:4908
        
        C:\Windows\SysWOW64\Ehapfiem.exe
        
        C:\Windows\system32\Ehapfiem.exe
        64⤵
        Executes dropped EXE
        
        PID:1692
        
        C:\Windows\SysWOW64\Emoinpcd.exe
        
        C:\Windows\system32\Emoinpcd.exe
        65⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:492
        
        C:\Windows\SysWOW64\Edhakj32.exe
        
        C:\Windows\system32\Edhakj32.exe
        66⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\Eonehbjg.exe
        
        C:\Windows\system32\Eonehbjg.exe
        67⤵
        
        PID:652
        
        C:\Windows\SysWOW64\Eehnem32.exe
        
        C:\Windows\system32\Eehnem32.exe
        68⤵
        
        PID:3028
        
        C:\Windows\SysWOW64\Ekefmc32.exe
        
        C:\Windows\system32\Ekefmc32.exe
        69⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\Eaonjngh.exe
        
        C:\Windows\system32\Eaonjngh.exe
        70⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\Ehiffh32.exe
        
        C:\Windows\system32\Ehiffh32.exe
        71⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\Ekgbccni.exe
        
        C:\Windows\system32\Ekgbccni.exe
        72⤵
        
        PID:1152
        
        C:\Windows\SysWOW64\Emeoooml.exe
        
        C:\Windows\system32\Emeoooml.exe
        73⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\Edpgli32.exe
        
        C:\Windows\system32\Edpgli32.exe
        74⤵
        
        PID:5056
        
        C:\Windows\SysWOW64\Egnchd32.exe
        
        C:\Windows\system32\Egnchd32.exe
        75⤵
        
        PID:2920
        
        C:\Windows\SysWOW64\Eachem32.exe
        
        C:\Windows\system32\Eachem32.exe
        76⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\Fkllnbjc.exe
        
        C:\Windows\system32\Fkllnbjc.exe
        77⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\Fafdkmap.exe
        
        C:\Windows\system32\Fafdkmap.exe
        78⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\Fhpmgg32.exe
        
        C:\Windows\system32\Fhpmgg32.exe
        79⤵
        
        PID:368
        
        C:\Windows\SysWOW64\Fknicb32.exe
        
        C:\Windows\system32\Fknicb32.exe
        80⤵
        Modifies registry class
        
        PID:5040
        
        C:\Windows\SysWOW64\Fdfmlhna.exe
        
        C:\Windows\system32\Fdfmlhna.exe
        81⤵
        Drops file in System32 directory
        
        PID:2764
        
        C:\Windows\SysWOW64\Folaiqng.exe
        
        C:\Windows\system32\Folaiqng.exe
        82⤵
        Modifies registry class
        
        PID:4652
        
        C:\Windows\SysWOW64\Fefjfked.exe
        
        C:\Windows\system32\Fefjfked.exe
        83⤵
        
        PID:2748
        
        C:\Windows\SysWOW64\Fnaokmco.exe
        
        C:\Windows\system32\Fnaokmco.exe
        84⤵
        Modifies registry class
        
        PID:2744
        
        C:\Windows\SysWOW64\Fdkggg32.exe
        
        C:\Windows\system32\Fdkggg32.exe
        85⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\Fkeodaai.exe
        
        C:\Windows\system32\Fkeodaai.exe
        86⤵
        Modifies registry class
        
        PID:5128
        
        C:\Windows\SysWOW64\Gaogak32.exe
        
        C:\Windows\system32\Gaogak32.exe
        87⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5176
        
        C:\Windows\SysWOW64\Gglpibgm.exe
        
        C:\Windows\system32\Gglpibgm.exe
        88⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Gnfhfl32.exe
        
        C:\Windows\system32\Gnfhfl32.exe
        89⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5264
        
        C:\Windows\SysWOW64\Gdppbfff.exe
        
        C:\Windows\system32\Gdppbfff.exe
        90⤵
        Drops file in System32 directory
        
        PID:5312
        
        C:\Windows\SysWOW64\Ggnlobej.exe
        
        C:\Windows\system32\Ggnlobej.exe
        91⤵
        Modifies registry class
        
        PID:5356
        
        C:\Windows\SysWOW64\Gnhdkl32.exe
        
        C:\Windows\system32\Gnhdkl32.exe
        92⤵
        Drops file in System32 directory
        
        PID:5400
        
        C:\Windows\SysWOW64\Ghniielm.exe
        
        C:\Windows\system32\Ghniielm.exe
        93⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Gkleeplq.exe
        
        C:\Windows\system32\Gkleeplq.exe
        94⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Gfbibikg.exe
        
        C:\Windows\system32\Gfbibikg.exe
        95⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Ghpendjj.exe
        
        C:\Windows\system32\Ghpendjj.exe
        96⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Gkobjpin.exe
        
        C:\Windows\system32\Gkobjpin.exe
        97⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Gfdfgiid.exe
        
        C:\Windows\system32\Gfdfgiid.exe
        98⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Ggeboaob.exe
        
        C:\Windows\system32\Ggeboaob.exe
        99⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Hnoklk32.exe
        
        C:\Windows\system32\Hnoklk32.exe
        100⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Hdicienl.exe
        
        C:\Windows\system32\Hdicienl.exe
        101⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Hkckeo32.exe
        
        C:\Windows\system32\Hkckeo32.exe
        102⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Hbmcbime.exe
        
        C:\Windows\system32\Hbmcbime.exe
        103⤵
        Drops file in System32 directory
        
        PID:5884
        
        C:\Windows\SysWOW64\Hgjljpkm.exe
        
        C:\Windows\system32\Hgjljpkm.exe
        104⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Hoadkn32.exe
        
        C:\Windows\system32\Hoadkn32.exe
        105⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Hdnldd32.exe
        
        C:\Windows\system32\Hdnldd32.exe
        106⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Hnfamjqg.exe
        
        C:\Windows\system32\Hnfamjqg.exe
        107⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6060
        
        C:\Windows\SysWOW64\Hfningai.exe
        
        C:\Windows\system32\Hfningai.exe
        108⤵
        Drops file in System32 directory
        
        PID:6100
        
        C:\Windows\SysWOW64\Hgoeep32.exe
        
        C:\Windows\system32\Hgoeep32.exe
        109⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Hninbj32.exe
        
        C:\Windows\system32\Hninbj32.exe
        110⤵
        
        PID:5168
        
        C:\Windows\SysWOW64\Hdbfodfa.exe
        
        C:\Windows\system32\Hdbfodfa.exe
        111⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Hkmnln32.exe
        
        C:\Windows\system32\Hkmnln32.exe
        112⤵
        Drops file in System32 directory
        
        PID:5304
        
        C:\Windows\SysWOW64\Ibffhhek.exe
        
        C:\Windows\system32\Ibffhhek.exe
        113⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Igcoqocb.exe
        
        C:\Windows\system32\Igcoqocb.exe
        114⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Inmgmijo.exe
        
        C:\Windows\system32\Inmgmijo.exe
        115⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Iomcgl32.exe
        
        C:\Windows\system32\Iomcgl32.exe
        116⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Idjlpc32.exe
        
        C:\Windows\system32\Idjlpc32.exe
        117⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Ibnligoc.exe
        
        C:\Windows\system32\Ibnligoc.exe
        118⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Ikfabm32.exe
        
        C:\Windows\system32\Ikfabm32.exe
        119⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Iijaka32.exe
        
        C:\Windows\system32\Iijaka32.exe
        120⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Jfnbdecg.exe
        
        C:\Windows\system32\Jfnbdecg.exe
        121⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5936
        
        C:\Windows\SysWOW64\Jgonlm32.exe
        
        C:\Windows\system32\Jgonlm32.exe
        122⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Jnifigpa.exe
        
        C:\Windows\system32\Jnifigpa.exe
        123⤵
        
        PID:6112
        
        C:\Windows\SysWOW64\Jecofa32.exe
        
        C:\Windows\system32\Jecofa32.exe
        124⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Jkmgblok.exe
        
        C:\Windows\system32\Jkmgblok.exe
        125⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Jbgoof32.exe
        
        C:\Windows\system32\Jbgoof32.exe
        126⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Jiaglp32.exe
        
        C:\Windows\system32\Jiaglp32.exe
        127⤵
        Drops file in System32 directory
        
        PID:5468
        
        C:\Windows\SysWOW64\Jkodhk32.exe
        
        C:\Windows\system32\Jkodhk32.exe
        128⤵
        Modifies registry class
        
        PID:5568
        
        C:\Windows\SysWOW64\Jfehed32.exe
        
        C:\Windows\system32\Jfehed32.exe
        129⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Jicdap32.exe
        
        C:\Windows\system32\Jicdap32.exe
        130⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Jpmlnjco.exe
        
        C:\Windows\system32\Jpmlnjco.exe
        131⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Jfgdkd32.exe
        
        C:\Windows\system32\Jfgdkd32.exe
        132⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Jghabl32.exe
        
        C:\Windows\system32\Jghabl32.exe
        133⤵
        
        PID:2720
        
        C:\Windows\SysWOW64\Knbiofhg.exe
        
        C:\Windows\system32\Knbiofhg.exe
        134⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Klfjijgq.exe
        
        C:\Windows\system32\Klfjijgq.exe
        135⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Kbpbed32.exe
        
        C:\Windows\system32\Kbpbed32.exe
        136⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Kngcje32.exe
        
        C:\Windows\system32\Kngcje32.exe
        137⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Lidmhmnp.exe
        
        C:\Windows\system32\Lidmhmnp.exe
        138⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Llbidimc.exe
        
        C:\Windows\system32\Llbidimc.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3900
        
        C:\Windows\SysWOW64\Lblaabdp.exe
        
        C:\Windows\system32\Lblaabdp.exe
        140⤵
        
        PID:5160
        
        C:\Windows\SysWOW64\Lejnmncd.exe
        
        C:\Windows\system32\Lejnmncd.exe
        141⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Lldfjh32.exe
        
        C:\Windows\system32\Lldfjh32.exe
        142⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5648
        
        C:\Windows\SysWOW64\Lbnngbbn.exe
        
        C:\Windows\system32\Lbnngbbn.exe
        143⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Lihfcm32.exe
        
        C:\Windows\system32\Lihfcm32.exe
        144⤵
        
        PID:1328
        
        C:\Windows\SysWOW64\Llgcph32.exe
        
        C:\Windows\system32\Llgcph32.exe
        145⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Lbqklb32.exe
        
        C:\Windows\system32\Lbqklb32.exe
        146⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Likcilhh.exe
        
        C:\Windows\system32\Likcilhh.exe
        147⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Lpekef32.exe
        
        C:\Windows\system32\Lpekef32.exe
        148⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Leadnm32.exe
        
        C:\Windows\system32\Leadnm32.exe
        149⤵
        
        PID:6004
        
        C:\Windows\SysWOW64\Mlklkgei.exe
        
        C:\Windows\system32\Mlklkgei.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5272
        
        C:\Windows\SysWOW64\Mojhgbdl.exe
        
        C:\Windows\system32\Mojhgbdl.exe
        151⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Medqcmki.exe
        
        C:\Windows\system32\Medqcmki.exe
        152⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Mlnipg32.exe
        
        C:\Windows\system32\Mlnipg32.exe
        153⤵
        Drops file in System32 directory
        
        PID:6252
        
        C:\Windows\SysWOW64\Mbhamajc.exe
        
        C:\Windows\system32\Mbhamajc.exe
        154⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Mhdjehhj.exe
        
        C:\Windows\system32\Mhdjehhj.exe
        155⤵
        
        PID:6348
        
        C:\Windows\SysWOW64\Moaogand.exe
        
        C:\Windows\system32\Moaogand.exe
        156⤵
        Modifies registry class
        
        PID:6396
        
        C:\Windows\SysWOW64\Mekgdl32.exe
        
        C:\Windows\system32\Mekgdl32.exe
        157⤵
        
        PID:6440
        
        C:\Windows\SysWOW64\Mleoafmn.exe
        
        C:\Windows\system32\Mleoafmn.exe
        158⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Mfjcnold.exe
        
        C:\Windows\system32\Mfjcnold.exe
        159⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Nlglfe32.exe
        
        C:\Windows\system32\Nlglfe32.exe
        160⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Noehba32.exe
        
        C:\Windows\system32\Noehba32.exe
        161⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Neppokal.exe
        
        C:\Windows\system32\Neppokal.exe
        162⤵
        Drops file in System32 directory
        
        PID:6668
        
        C:\Windows\SysWOW64\Nlihle32.exe
        
        C:\Windows\system32\Nlihle32.exe
        163⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6716
        
        C:\Windows\SysWOW64\Nbcqiope.exe
        
        C:\Windows\system32\Nbcqiope.exe
        164⤵
        
        PID:6768
        
        C:\Windows\SysWOW64\Niniei32.exe
        
        C:\Windows\system32\Niniei32.exe
        165⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6816
        
        C:\Windows\SysWOW64\Npgabc32.exe
        
        C:\Windows\system32\Npgabc32.exe
        166⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Nedjjj32.exe
        
        C:\Windows\system32\Nedjjj32.exe
        167⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Nhbfff32.exe
        
        C:\Windows\system32\Nhbfff32.exe
        168⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Nomncpcg.exe
        
        C:\Windows\system32\Nomncpcg.exe
        169⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7004
        
        C:\Windows\SysWOW64\Neffpj32.exe
        
        C:\Windows\system32\Neffpj32.exe
        170⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Nheble32.exe
        
        C:\Windows\system32\Nheble32.exe
        171⤵
        Modifies registry class
        
        PID:7100
        
        C:\Windows\SysWOW64\Nookip32.exe
        
        C:\Windows\system32\Nookip32.exe
        172⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Ogfcjm32.exe
        
        C:\Windows\system32\Ogfcjm32.exe
        173⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Oidofh32.exe
        
        C:\Windows\system32\Oidofh32.exe
        174⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Olckbd32.exe
        
        C:\Windows\system32\Olckbd32.exe
        175⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Ocmconhk.exe
        
        C:\Windows\system32\Ocmconhk.exe
        176⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Ohjlgefb.exe
        
        C:\Windows\system32\Ohjlgefb.exe
        177⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Opadhb32.exe
        
        C:\Windows\system32\Opadhb32.exe
        178⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Ogklelna.exe
        
        C:\Windows\system32\Ogklelna.exe
        179⤵
        Modifies registry class
        
        PID:6604
        
        C:\Windows\SysWOW64\Opcqnb32.exe
        
        C:\Windows\system32\Opcqnb32.exe
        180⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Ogmijllo.exe
        
        C:\Windows\system32\Ogmijllo.exe
        181⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Oljaccjf.exe
        
        C:\Windows\system32\Oljaccjf.exe
        182⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Ogpepl32.exe
        
        C:\Windows\system32\Ogpepl32.exe
        183⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Ohqbhdpj.exe
        
        C:\Windows\system32\Ohqbhdpj.exe
        184⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7040
        
        C:\Windows\SysWOW64\Ookjdn32.exe
        
        C:\Windows\system32\Ookjdn32.exe
        185⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Pgbbek32.exe
        
        C:\Windows\system32\Pgbbek32.exe
        186⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Phcomcng.exe
        
        C:\Windows\system32\Phcomcng.exe
        187⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Pomgjn32.exe
        
        C:\Windows\system32\Pomgjn32.exe
        188⤵
        Drops file in System32 directory
        
        PID:6328
        
        C:\Windows\SysWOW64\Pjbkgfej.exe
        
        C:\Windows\system32\Pjbkgfej.exe
        189⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Poodpmca.exe
        
        C:\Windows\system32\Poodpmca.exe
        190⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Phhhhc32.exe
        
        C:\Windows\system32\Phhhhc32.exe
        191⤵
        Modifies registry class
        
        PID:6752
        
        C:\Windows\SysWOW64\Ppopjp32.exe
        
        C:\Windows\system32\Ppopjp32.exe
        192⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Pcmlfl32.exe
        
        C:\Windows\system32\Pcmlfl32.exe
        193⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Pjgebf32.exe
        
        C:\Windows\system32\Pjgebf32.exe
        194⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Ppamophb.exe
        
        C:\Windows\system32\Ppamophb.exe
        195⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Pjjahe32.exe
        
        C:\Windows\system32\Pjjahe32.exe
        196⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Plhnda32.exe
        
        C:\Windows\system32\Plhnda32.exe
        197⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Qcbfakec.exe
        
        C:\Windows\system32\Qcbfakec.exe
        198⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Qjlnnemp.exe
        
        C:\Windows\system32\Qjlnnemp.exe
        199⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Qqffjo32.exe
        
        C:\Windows\system32\Qqffjo32.exe
        200⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Qgpogili.exe
        
        C:\Windows\system32\Qgpogili.exe
        201⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Qjnkcekm.exe
        
        C:\Windows\system32\Qjnkcekm.exe
        202⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Qqhcpo32.exe
        
        C:\Windows\system32\Qqhcpo32.exe
        203⤵
        
        PID:764
        
        C:\Windows\SysWOW64\Afelhf32.exe
        
        C:\Windows\system32\Afelhf32.exe
        204⤵
        Modifies registry class
        
        PID:6236
        
        C:\Windows\SysWOW64\Aompak32.exe
        
        C:\Windows\system32\Aompak32.exe
        205⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Agdhbi32.exe
        
        C:\Windows\system32\Agdhbi32.exe
        206⤵
        
        PID:6392
        
        C:\Windows\SysWOW64\Aggegh32.exe
        
        C:\Windows\system32\Aggegh32.exe
        207⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Ajeadd32.exe
        
        C:\Windows\system32\Ajeadd32.exe
        208⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Acnemi32.exe
        
        C:\Windows\system32\Acnemi32.exe
        209⤵
        Drops file in System32 directory
        
        PID:7208
        
        C:\Windows\SysWOW64\Ajhniccb.exe
        
        C:\Windows\system32\Ajhniccb.exe
        210⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Amfjeobf.exe
        
        C:\Windows\system32\Amfjeobf.exe
        211⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Acpbbi32.exe
        
        C:\Windows\system32\Acpbbi32.exe
        212⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Afnnnd32.exe
        
        C:\Windows\system32\Afnnnd32.exe
        213⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Amhfkopc.exe
        
        C:\Windows\system32\Amhfkopc.exe
        214⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7440
        
        C:\Windows\SysWOW64\Bgnkhg32.exe
        
        C:\Windows\system32\Bgnkhg32.exe
        215⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Bjlgdc32.exe
        
        C:\Windows\system32\Bjlgdc32.exe
        216⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Bmkcqn32.exe
        
        C:\Windows\system32\Bmkcqn32.exe
        217⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Bcelmhen.exe
        
        C:\Windows\system32\Bcelmhen.exe
        218⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Bfchidda.exe
        
        C:\Windows\system32\Bfchidda.exe
        219⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Bmmpfn32.exe
        
        C:\Windows\system32\Bmmpfn32.exe
        220⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Boklbi32.exe
        
        C:\Windows\system32\Boklbi32.exe
        221⤵
        
        PID:7744
        
        C:\Windows\SysWOW64\Bjaqpbkh.exe
        
        C:\Windows\system32\Bjaqpbkh.exe
        222⤵
        Modifies registry class
        
        PID:7788
        
        C:\Windows\SysWOW64\Bqkill32.exe
        
        C:\Windows\system32\Bqkill32.exe
        223⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Bgeaifia.exe
        
        C:\Windows\system32\Bgeaifia.exe
        224⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Bjcmebie.exe
        
        C:\Windows\system32\Bjcmebie.exe
        225⤵
        
        PID:7920
        
        C:\Windows\SysWOW64\Bqmeal32.exe
        
        C:\Windows\system32\Bqmeal32.exe
        226⤵
        Modifies registry class
        
        PID:7956
        
        C:\Windows\SysWOW64\Bggnof32.exe
        
        C:\Windows\system32\Bggnof32.exe
        227⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Bihjfnmm.exe
        
        C:\Windows\system32\Bihjfnmm.exe
        228⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Cqpbglno.exe
        
        C:\Windows\system32\Cqpbglno.exe
        229⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Cgjjdf32.exe
        
        C:\Windows\system32\Cgjjdf32.exe
        230⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:8136
        
        C:\Windows\SysWOW64\Cikglnkj.exe
        
        C:\Windows\system32\Cikglnkj.exe
        231⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Cabomkll.exe
        
        C:\Windows\system32\Cabomkll.exe
        232⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Cglgjeci.exe
        
        C:\Windows\system32\Cglgjeci.exe
        233⤵
        Drops file in System32 directory
        
        PID:7248
        
        C:\Windows\SysWOW64\Cimcan32.exe
        
        C:\Windows\system32\Cimcan32.exe
        234⤵
        
        PID:7336
        
        C:\Windows\SysWOW64\Cpglnhad.exe
        
        C:\Windows\system32\Cpglnhad.exe
        235⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Cjmpkqqj.exe
        
        C:\Windows\system32\Cjmpkqqj.exe
        236⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Cmklglpn.exe
        
        C:\Windows\system32\Cmklglpn.exe
        237⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Cceddf32.exe
        
        C:\Windows\system32\Cceddf32.exe
        238⤵
        
        PID:7592
        
        C:\Windows\SysWOW64\Cfcqpa32.exe
        
        C:\Windows\system32\Cfcqpa32.exe
        239⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Cmniml32.exe
        
        C:\Windows\system32\Cmniml32.exe
        240⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Dfjgaq32.exe
        
        C:\Windows\system32\Dfjgaq32.exe
        241⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Dmdonkgc.exe
        
        C:\Windows\system32\Dmdonkgc.exe
        242⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Dfmcfp32.exe
        
        C:\Windows\system32\Dfmcfp32.exe
        243⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Djklmo32.exe
        
        C:\Windows\system32\Djklmo32.exe
        244⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Daediilg.exe
        
        C:\Windows\system32\Daediilg.exe
        245⤵
        Modifies registry class
        
        PID:8084
        
        C:\Windows\SysWOW64\Dhomfc32.exe
        
        C:\Windows\system32\Dhomfc32.exe
        246⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Eipinkib.exe
        
        C:\Windows\system32\Eipinkib.exe
        247⤵
        
        PID:7200
        
        C:\Windows\SysWOW64\Epjajeqo.exe
        
        C:\Windows\system32\Epjajeqo.exe
        248⤵
        
        PID:7328
        
        C:\Windows\SysWOW64\Edjgfcec.exe
        
        C:\Windows\system32\Edjgfcec.exe
        249⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Eiildjag.exe
        
        C:\Windows\system32\Eiildjag.exe
        250⤵
        Modifies registry class
        
        PID:7608
        
        C:\Windows\SysWOW64\Epcdqd32.exe
        
        C:\Windows\system32\Epcdqd32.exe
        251⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Fhmigagd.exe
        
        C:\Windows\system32\Fhmigagd.exe
        252⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Fhofmq32.exe
        
        C:\Windows\system32\Fhofmq32.exe
        253⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7860
        
        C:\Windows\SysWOW64\Fknbil32.exe
        
        C:\Windows\system32\Fknbil32.exe
        254⤵
        Drops file in System32 directory
        
        PID:7988
        
        C:\Windows\SysWOW64\Fmlneg32.exe
        
        C:\Windows\system32\Fmlneg32.exe
        255⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Fdffbake.exe
        
        C:\Windows\system32\Fdffbake.exe
        256⤵
        Modifies registry class
        
        PID:7288
        
        C:\Windows\SysWOW64\Fajgkfio.exe
        
        C:\Windows\system32\Fajgkfio.exe
        257⤵
        Modifies registry class
        
        PID:7452
        
        C:\Windows\SysWOW64\Fielph32.exe
        
        C:\Windows\system32\Fielph32.exe
        258⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7636
        
        C:\Windows\SysWOW64\Gaopfe32.exe
        
        C:\Windows\system32\Gaopfe32.exe
        259⤵
        Drops file in System32 directory
        
        PID:7864
        
        C:\Windows\SysWOW64\Gpkchqdj.exe
        
        C:\Windows\system32\Gpkchqdj.exe
        260⤵
        Modifies registry class
        
        PID:8020
        
        C:\Windows\SysWOW64\Hajpbckl.exe
        
        C:\Windows\system32\Hajpbckl.exe
        261⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Hgghjjid.exe
        
        C:\Windows\system32\Hgghjjid.exe
        262⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\Hammhcij.exe
        
        C:\Windows\system32\Hammhcij.exe
        263⤵
        
        PID:7384
        
        C:\Windows\SysWOW64\Hdkidohn.exe
        
        C:\Windows\system32\Hdkidohn.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7652
        
        C:\Windows\SysWOW64\Hgiepjga.exe
        
        C:\Windows\system32\Hgiepjga.exe
        265⤵
        Drops file in System32 directory
        
        PID:888
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        266⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:8052
        
        C:\Windows\SysWOW64\Hglaej32.exe
        
        C:\Windows\system32\Hglaej32.exe
        267⤵
        
        PID:7316
        
        C:\Windows\SysWOW64\Hnfjbdmk.exe
        
        C:\Windows\system32\Hnfjbdmk.exe
        268⤵
        Modifies registry class
        
        PID:7556
        
        C:\Windows\SysWOW64\Hdpbon32.exe
        
        C:\Windows\system32\Hdpbon32.exe
        269⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7740
        
        C:\Windows\SysWOW64\Hkjjlhle.exe
        
        C:\Windows\system32\Hkjjlhle.exe
        270⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Hpfcdojl.exe
        
        C:\Windows\system32\Hpfcdojl.exe
        271⤵
        
        PID:7948
        
        C:\Windows\SysWOW64\Iklgah32.exe
        
        C:\Windows\system32\Iklgah32.exe
        272⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Injcmc32.exe
        
        C:\Windows\system32\Injcmc32.exe
        273⤵
        
        PID:180
        
        C:\Windows\SysWOW64\Ihphkl32.exe
        
        C:\Windows\system32\Ihphkl32.exe
        274⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Ijadbdoj.exe
        
        C:\Windows\system32\Ijadbdoj.exe
        275⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Iahlcaol.exe
        
        C:\Windows\system32\Iahlcaol.exe
        276⤵
        
        PID:8280
        
        C:\Windows\SysWOW64\Idghpmnp.exe
        
        C:\Windows\system32\Idghpmnp.exe
        277⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        278⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Iakiia32.exe
        
        C:\Windows\system32\Iakiia32.exe
        279⤵
        
        PID:8424
        
        C:\Windows\SysWOW64\Ihdafkdg.exe
        
        C:\Windows\system32\Ihdafkdg.exe
        280⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Ikcmbfcj.exe
        
        C:\Windows\system32\Ikcmbfcj.exe
        281⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Inainbcn.exe
        
        C:\Windows\system32\Inainbcn.exe
        282⤵
        Drops file in System32 directory
        
        PID:8560
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        283⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Indfca32.exe
        
        C:\Windows\system32\Indfca32.exe
        284⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Iqbbpm32.exe
        
        C:\Windows\system32\Iqbbpm32.exe
        285⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Jglklggl.exe
        
        C:\Windows\system32\Jglklggl.exe
        286⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Jjjghcfp.exe
        
        C:\Windows\system32\Jjjghcfp.exe
        287⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Jhlgfj32.exe
        
        C:\Windows\system32\Jhlgfj32.exe
        288⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Jbdlop32.exe
        
        C:\Windows\system32\Jbdlop32.exe
        289⤵
        
        PID:8856
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        290⤵
        
        PID:8900
        
        C:\Windows\SysWOW64\Jklphekp.exe
        
        C:\Windows\system32\Jklphekp.exe
        291⤵
        Drops file in System32 directory
        
        PID:8944
        
        C:\Windows\SysWOW64\Jnkldqkc.exe
        
        C:\Windows\system32\Jnkldqkc.exe
        292⤵
        Modifies registry class
        
        PID:8988
        
        C:\Windows\SysWOW64\Jhpqaiji.exe
        
        C:\Windows\system32\Jhpqaiji.exe
        293⤵
        Modifies registry class
        
        PID:9032
        
        C:\Windows\SysWOW64\Jjamia32.exe
        
        C:\Windows\system32\Jjamia32.exe
        294⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Jbiejoaj.exe
        
        C:\Windows\system32\Jbiejoaj.exe
        295⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Jgenbfoa.exe
        
        C:\Windows\system32\Jgenbfoa.exe
        296⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Jjdjoane.exe
        
        C:\Windows\system32\Jjdjoane.exe
        297⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Kqnbkl32.exe
        
        C:\Windows\system32\Kqnbkl32.exe
        298⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1844
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        299⤵
        
        PID:8252
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        300⤵
        Drops file in System32 directory
        
        PID:4788
        
        C:\Windows\SysWOW64\Kbmoen32.exe
        
        C:\Windows\system32\Kbmoen32.exe
        301⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Kgjgne32.exe
        
        C:\Windows\system32\Kgjgne32.exe
        302⤵
        Modifies registry class
        
        PID:8392
        
        C:\Windows\SysWOW64\Kkfcndce.exe
        
        C:\Windows\system32\Kkfcndce.exe
        303⤵
        
        PID:8476
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        304⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        305⤵
        
        PID:8568
        
        C:\Windows\SysWOW64\Kjkpoq32.exe
        
        C:\Windows\system32\Kjkpoq32.exe
        306⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8620
        
        C:\Windows\SysWOW64\Kilpmh32.exe
        
        C:\Windows\system32\Kilpmh32.exe
        307⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Kjmmepfj.exe
        
        C:\Windows\system32\Kjmmepfj.exe
        308⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Kbddfmgl.exe
        
        C:\Windows\system32\Kbddfmgl.exe
        309⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Kecabifp.exe
        
        C:\Windows\system32\Kecabifp.exe
        310⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Kkmioc32.exe
        
        C:\Windows\system32\Kkmioc32.exe
        311⤵
        
        PID:8976
        
        C:\Windows\SysWOW64\Lajagj32.exe
        
        C:\Windows\system32\Lajagj32.exe
        312⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Lkofdbkj.exe
        
        C:\Windows\system32\Lkofdbkj.exe
        313⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Lnnbqnjn.exe
        
        C:\Windows\system32\Lnnbqnjn.exe
        314⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Lgffic32.exe
        
        C:\Windows\system32\Lgffic32.exe
        315⤵
        Drops file in System32 directory
        
        PID:8248
        
        C:\Windows\SysWOW64\Lbkkgl32.exe
        
        C:\Windows\system32\Lbkkgl32.exe
        316⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\Lghcocol.exe
        
        C:\Windows\system32\Lghcocol.exe
        317⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        318⤵
        
        PID:8460
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        319⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Ljilqnlm.exe
        
        C:\Windows\system32\Ljilqnlm.exe
        320⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Leopnglc.exe
        
        C:\Windows\system32\Leopnglc.exe
        321⤵
        Modifies registry class
        
        PID:8824
        
        C:\Windows\SysWOW64\Llhikacp.exe
        
        C:\Windows\system32\Llhikacp.exe
        322⤵
        
        PID:8928
        
        C:\Windows\SysWOW64\Mngegmbc.exe
        
        C:\Windows\system32\Mngegmbc.exe
        323⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Majjng32.exe
        
        C:\Windows\system32\Majjng32.exe
        324⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Miaboe32.exe
        
        C:\Windows\system32\Miaboe32.exe
        325⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Mjbogmdb.exe
        
        C:\Windows\system32\Mjbogmdb.exe
        326⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Mehcdfch.exe
        
        C:\Windows\system32\Mehcdfch.exe
        327⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Mlbkap32.exe
        
        C:\Windows\system32\Mlbkap32.exe
        328⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Mblcnj32.exe
        
        C:\Windows\system32\Mblcnj32.exe
        329⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Mhilfa32.exe
        
        C:\Windows\system32\Mhilfa32.exe
        330⤵
        Modifies registry class
        
        PID:8888
        
        C:\Windows\SysWOW64\Njghbl32.exe
        
        C:\Windows\system32\Njghbl32.exe
        331⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Nbnpcj32.exe
        
        C:\Windows\system32\Nbnpcj32.exe
        332⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Nemmoe32.exe
        
        C:\Windows\system32\Nemmoe32.exe
        333⤵
        
        PID:952
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        334⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8672
        
        C:\Windows\SysWOW64\Nacmdf32.exe
        
        C:\Windows\system32\Nacmdf32.exe
        335⤵
        
        PID:8908
        
        C:\Windows\SysWOW64\Nijeec32.exe
        
        C:\Windows\system32\Nijeec32.exe
        336⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        337⤵
        
        PID:8408
        
        C:\Windows\SysWOW64\Nbcjnilj.exe
        
        C:\Windows\system32\Nbcjnilj.exe
        338⤵
        
        PID:3472
        
        C:\Windows\SysWOW64\Nimbkc32.exe
        
        C:\Windows\system32\Nimbkc32.exe
        339⤵
        Drops file in System32 directory
        
        PID:9024
        
        C:\Windows\SysWOW64\Nlkngo32.exe
        
        C:\Windows\system32\Nlkngo32.exe
        340⤵
        
        PID:600
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        341⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Niooqcad.exe
        
        C:\Windows\system32\Niooqcad.exe
        342⤵
        Modifies registry class
        
        PID:9040
        
        C:\Windows\SysWOW64\Nlnkmnah.exe
        
        C:\Windows\system32\Nlnkmnah.exe
        343⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\Nbgcih32.exe
        
        C:\Windows\system32\Nbgcih32.exe
        344⤵
        Drops file in System32 directory
        
        PID:9228
        
        C:\Windows\SysWOW64\Nefped32.exe
        
        C:\Windows\system32\Nefped32.exe
        345⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Nlphbnoe.exe
        
        C:\Windows\system32\Nlphbnoe.exe
        346⤵
        Drops file in System32 directory
        
        PID:9328
        
        C:\Windows\SysWOW64\Oondnini.exe
        
        C:\Windows\system32\Oondnini.exe
        347⤵
        
        PID:9364
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        348⤵
        
        PID:9412
        
        C:\Windows\SysWOW64\Ohghgodi.exe
        
        C:\Windows\system32\Ohghgodi.exe
        349⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        350⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Oaompd32.exe
        
        C:\Windows\system32\Oaompd32.exe
        351⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        352⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Oocmii32.exe
        
        C:\Windows\system32\Oocmii32.exe
        353⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9632
        
        C:\Windows\SysWOW64\Oemefcap.exe
        
        C:\Windows\system32\Oemefcap.exe
        354⤵
        
        PID:9680
        
        C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        355⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Oeaoab32.exe
        
        C:\Windows\system32\Oeaoab32.exe
        356⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Pkogiikb.exe
        
        C:\Windows\system32\Pkogiikb.exe
        357⤵
        
        PID:9808
        
        C:\Windows\SysWOW64\Phbhcmjl.exe
        
        C:\Windows\system32\Phbhcmjl.exe
        358⤵
        
        PID:9852
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        359⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Pibdmp32.exe
        
        C:\Windows\system32\Pibdmp32.exe
        360⤵
        
        PID:9936
        
        C:\Windows\SysWOW64\Poomegpf.exe
        
        C:\Windows\system32\Poomegpf.exe
        361⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        362⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Qhlkilba.exe
        
        C:\Windows\system32\Qhlkilba.exe
        363⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Qcaofebg.exe
        
        C:\Windows\system32\Qcaofebg.exe
        364⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Qhngolpo.exe
        
        C:\Windows\system32\Qhngolpo.exe
        365⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Qebhhp32.exe
        
        C:\Windows\system32\Qebhhp32.exe
        366⤵
        Drops file in System32 directory
        
        PID:10188
        
        C:\Windows\SysWOW64\Acfhad32.exe
        
        C:\Windows\system32\Acfhad32.exe
        367⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10228
        
        C:\Windows\SysWOW64\Ajpqnneo.exe
        
        C:\Windows\system32\Ajpqnneo.exe
        368⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Aomifecf.exe
        
        C:\Windows\system32\Aomifecf.exe
        369⤵
        
        PID:9316
        
        C:\Windows\SysWOW64\Ajbmdn32.exe
        
        C:\Windows\system32\Ajbmdn32.exe
        370⤵
        
        PID:9396
        
        C:\Windows\SysWOW64\Alcfei32.exe
        
        C:\Windows\system32\Alcfei32.exe
        371⤵
        
        PID:9464
        
        C:\Windows\SysWOW64\Ahjgjj32.exe
        
        C:\Windows\system32\Ahjgjj32.exe
        372⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Abbkcpma.exe
        
        C:\Windows\system32\Abbkcpma.exe
        373⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Bhldpj32.exe
        
        C:\Windows\system32\Bhldpj32.exe
        374⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        375⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Bljlfh32.exe
        
        C:\Windows\system32\Bljlfh32.exe
        376⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Bbgeno32.exe
        
        C:\Windows\system32\Bbgeno32.exe
        377⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Bmlilh32.exe
        
        C:\Windows\system32\Bmlilh32.exe
        378⤵
        
        PID:9916
        
        C:\Windows\SysWOW64\Bokehc32.exe
        
        C:\Windows\system32\Bokehc32.exe
        379⤵
        
        PID:10004
        
        C:\Windows\SysWOW64\Bfendmoc.exe
        
        C:\Windows\system32\Bfendmoc.exe
        380⤵
        
        PID:10080
        
        C:\Windows\SysWOW64\Bhcjqinf.exe
        
        C:\Windows\system32\Bhcjqinf.exe
        381⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Bblnindg.exe
        
        C:\Windows\system32\Bblnindg.exe
        382⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Bheffh32.exe
        
        C:\Windows\system32\Bheffh32.exe
        383⤵
        
        PID:9236
        
        C:\Windows\SysWOW64\Bkdcbd32.exe
        
        C:\Windows\system32\Bkdcbd32.exe
        384⤵
        Modifies registry class
        
        PID:9360
        
        C:\Windows\SysWOW64\Bbnkonbd.exe
        
        C:\Windows\system32\Bbnkonbd.exe
        385⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Cihclh32.exe
        
        C:\Windows\system32\Cihclh32.exe
        386⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Ckfphc32.exe
        
        C:\Windows\system32\Ckfphc32.exe
        387⤵
        
        PID:9696
        
        C:\Windows\SysWOW64\Cbphdn32.exe
        
        C:\Windows\system32\Cbphdn32.exe
        388⤵
        Modifies registry class
        
        PID:9836
        
        C:\Windows\SysWOW64\Cijpahho.exe
        
        C:\Windows\system32\Cijpahho.exe
        389⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        390⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10048
        
        C:\Windows\SysWOW64\Cmhigf32.exe
        
        C:\Windows\system32\Cmhigf32.exe
        391⤵
        
        PID:10132
        
        C:\Windows\SysWOW64\Cjliajmo.exe
        
        C:\Windows\system32\Cjliajmo.exe
        392⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Ccdnjp32.exe
        
        C:\Windows\system32\Ccdnjp32.exe
        393⤵
        Drops file in System32 directory
        
        PID:9340
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        394⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        395⤵
        
        PID:9708
        
        C:\Windows\SysWOW64\Djqblj32.exe
        
        C:\Windows\system32\Djqblj32.exe
        396⤵
        Modifies registry class
        
        PID:9848
        
        C:\Windows\SysWOW64\Difpmfna.exe
        
        C:\Windows\system32\Difpmfna.exe
        397⤵
        
        PID:10068
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        398⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Dfjpfj32.exe
        
        C:\Windows\system32\Dfjpfj32.exe
        399⤵
        
        PID:9488
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        400⤵
        
        PID:9792
        
        C:\Windows\SysWOW64\Dcnqpo32.exe
        
        C:\Windows\system32\Dcnqpo32.exe
        401⤵
        
        PID:10000
        
        C:\Windows\SysWOW64\Dlieda32.exe
        
        C:\Windows\system32\Dlieda32.exe
        402⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Dlkbjqgm.exe
        
        C:\Windows\system32\Dlkbjqgm.exe
        403⤵
        
        PID:9668
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        404⤵
        
        PID:9268
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        405⤵
        
        PID:9888
        
        C:\Windows\SysWOW64\Emmkiclm.exe
        
        C:\Windows\system32\Emmkiclm.exe
        406⤵
        
        PID:9644
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        407⤵
        
        PID:10184
        
        C:\Windows\SysWOW64\Eciplm32.exe
        
        C:\Windows\system32\Eciplm32.exe
        408⤵
        Drops file in System32 directory
        
        PID:10260
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        409⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10300
        
        C:\Windows\SysWOW64\Efjimhnh.exe
        
        C:\Windows\system32\Efjimhnh.exe
        410⤵
        Drops file in System32 directory
        
        PID:10348
        
        C:\Windows\SysWOW64\Fmfnpa32.exe
        
        C:\Windows\system32\Fmfnpa32.exe
        411⤵
        
        PID:10388
        
        C:\Windows\SysWOW64\Fimodc32.exe
        
        C:\Windows\system32\Fimodc32.exe
        412⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Fllkqn32.exe
        
        C:\Windows\system32\Fllkqn32.exe
        413⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Fdccbl32.exe
        
        C:\Windows\system32\Fdccbl32.exe
        414⤵
        
        PID:10512
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        415⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10556
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        416⤵
        
        PID:10596
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        417⤵
        
        PID:10636
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        418⤵
        
        PID:10672
        
        C:\Windows\SysWOW64\Fdglmkeg.exe
        
        C:\Windows\system32\Fdglmkeg.exe
        419⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Fffhifdk.exe
        
        C:\Windows\system32\Fffhifdk.exe
        420⤵
        
        PID:10764
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        421⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Gpnmbl32.exe
        
        C:\Windows\system32\Gpnmbl32.exe
        422⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Gfheof32.exe
        
        C:\Windows\system32\Gfheof32.exe
        423⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Gbofcghl.exe
        
        C:\Windows\system32\Gbofcghl.exe
        424⤵
        
        PID:10928
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        425⤵
        
        PID:10968
        
        C:\Windows\SysWOW64\Gpcfmkff.exe
        
        C:\Windows\system32\Gpcfmkff.exe
        426⤵
        
        PID:11008
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        427⤵
        
        PID:11052
        
        C:\Windows\SysWOW64\Gpecbk32.exe
        
        C:\Windows\system32\Gpecbk32.exe
        428⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Gfokoelp.exe
        
        C:\Windows\system32\Gfokoelp.exe
        429⤵
        
        PID:11140
        
        C:\Windows\SysWOW64\Gbfldf32.exe
        
        C:\Windows\system32\Gbfldf32.exe
        430⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Gkmdecbg.exe
        
        C:\Windows\system32\Gkmdecbg.exe
        431⤵
        Modifies registry class
        
        PID:11224
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        432⤵
        
        PID:10268
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        433⤵
        
        PID:10312
        
        C:\Windows\SysWOW64\Hlambk32.exe
        
        C:\Windows\system32\Hlambk32.exe
        434⤵
        
        PID:10380
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        435⤵
        
        PID:10444
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        436⤵
        
        PID:10524
        
        C:\Windows\SysWOW64\Hdjbiheb.exe
        
        C:\Windows\system32\Hdjbiheb.exe
        437⤵
        
        PID:10592
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        438⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Hlegnjbm.exe
        
        C:\Windows\system32\Hlegnjbm.exe
        439⤵
        
        PID:10732
        
        C:\Windows\SysWOW64\Hcpojd32.exe
        
        C:\Windows\system32\Hcpojd32.exe
        440⤵
        
        PID:10812
        
        C:\Windows\SysWOW64\Hmechmip.exe
        
        C:\Windows\system32\Hmechmip.exe
        441⤵
        
        PID:10880
        
        C:\Windows\SysWOW64\Hpcodihc.exe
        
        C:\Windows\system32\Hpcodihc.exe
        442⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10952
        
        C:\Windows\SysWOW64\Hgmgqc32.exe
        
        C:\Windows\system32\Hgmgqc32.exe
        443⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11028
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        444⤵
        
        PID:11116
        
        C:\Windows\SysWOW64\Icdheded.exe
        
        C:\Windows\system32\Icdheded.exe
        445⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        446⤵
        
        PID:9676
        
        C:\Windows\SysWOW64\Iphioh32.exe
        
        C:\Windows\system32\Iphioh32.exe
        447⤵
        Modifies registry class
        
        PID:10372
        
        C:\Windows\SysWOW64\Igbalblk.exe
        
        C:\Windows\system32\Igbalblk.exe
        448⤵
        
        PID:10508
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        449⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10612
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        450⤵
        
        PID:10752
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        451⤵
        
        PID:10872
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        452⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Idhnkf32.exe
        
        C:\Windows\system32\Idhnkf32.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11016
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        454⤵
        
        PID:11172
        
        C:\Windows\SysWOW64\Inqbclob.exe
        
        C:\Windows\system32\Inqbclob.exe
        455⤵
        
        PID:10272
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        456⤵
        Drops file in System32 directory
        
        PID:10460
        
        C:\Windows\SysWOW64\Jjgchm32.exe
        
        C:\Windows\system32\Jjgchm32.exe
        457⤵
        
        PID:10664
        
        C:\Windows\SysWOW64\Jpdhkf32.exe
        
        C:\Windows\system32\Jpdhkf32.exe
        458⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        459⤵
        
        PID:11064
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        460⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        461⤵
        Drops file in System32 directory
        
        PID:10396
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        462⤵
        
        PID:10700
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        463⤵
        
        PID:10920
        
        C:\Windows\SysWOW64\Jjafok32.exe
        
        C:\Windows\system32\Jjafok32.exe
        464⤵
        
        PID:11240
        
        C:\Windows\SysWOW64\Jcikgacl.exe
        
        C:\Windows\system32\Jcikgacl.exe
        465⤵
        
        PID:10552
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        466⤵
        
        PID:11152
        
        C:\Windows\SysWOW64\Kkconn32.exe
        
        C:\Windows\system32\Kkconn32.exe
        467⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10828
        
        C:\Windows\SysWOW64\Kcndbp32.exe
        
        C:\Windows\system32\Kcndbp32.exe
        468⤵
        Modifies registry class
        
        PID:10884
        
        C:\Windows\SysWOW64\Kmfhkf32.exe
        
        C:\Windows\system32\Kmfhkf32.exe
        469⤵
        
        PID:11276
        
        C:\Windows\SysWOW64\Kglmio32.exe
        
        C:\Windows\system32\Kglmio32.exe
        470⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Knfeeimj.exe
        
        C:\Windows\system32\Knfeeimj.exe
        471⤵
        
        PID:11372
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        472⤵
        
        PID:11420
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        473⤵
        
        PID:11464
        
        C:\Windows\SysWOW64\Kcejco32.exe
        
        C:\Windows\system32\Kcejco32.exe
        474⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11500
        
        C:\Windows\SysWOW64\Ljobpiql.exe
        
        C:\Windows\system32\Ljobpiql.exe
        475⤵
        
        PID:11544
        
        C:\Windows\SysWOW64\Lqikmc32.exe
        
        C:\Windows\system32\Lqikmc32.exe
        476⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\Lknojl32.exe
        
        C:\Windows\system32\Lknojl32.exe
        477⤵
        
        PID:11640
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        478⤵
        
        PID:11680
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        479⤵
        
        PID:11732
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        480⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        481⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Nnkpnclp.exe
        
        C:\Windows\system32\Nnkpnclp.exe
        482⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\Oeokal32.exe
        
        C:\Windows\system32\Oeokal32.exe
        483⤵
        
        PID:12208
        
        C:\Windows\SysWOW64\Okkdic32.exe
        
        C:\Windows\system32\Okkdic32.exe
        484⤵
        
        PID:12256
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        485⤵
        
        PID:2952
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        486⤵
        
        PID:11364
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        487⤵
        
        PID:11400
        
        C:\Windows\SysWOW64\Popbpqjh.exe
        
        C:\Windows\system32\Popbpqjh.exe
        488⤵
        
        PID:11488
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        489⤵
        
        PID:11564
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        490⤵
        
        PID:1408
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        491⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        492⤵
        
        PID:11708
        
        C:\Windows\SysWOW64\Alkijdci.exe
        
        C:\Windows\system32\Alkijdci.exe
        493⤵
        
        PID:11788
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        494⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11808
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        495⤵
        
        PID:11840
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        496⤵
        
        PID:11860
        
        C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        497⤵
        
        PID:4016
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        498⤵
        Drops file in System32 directory
        
        PID:3392
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        499⤵
        Modifies registry class
        
        PID:4904
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        500⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11904
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        501⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        502⤵
        Modifies registry class
        
        PID:3600
        
        C:\Windows\SysWOW64\Aaohcj32.exe
        
        C:\Windows\system32\Aaohcj32.exe
        503⤵
        Modifies registry class
        
        PID:3124
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        504⤵
        
        PID:11932
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        505⤵
        Modifies registry class
        
        PID:12052
        
        C:\Windows\SysWOW64\Baadiiif.exe
        
        C:\Windows\system32\Baadiiif.exe
        506⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        507⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:12100
        
        C:\Windows\SysWOW64\Bnhenj32.exe
        
        C:\Windows\system32\Bnhenj32.exe
        508⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\Bdbnjdfg.exe
        
        C:\Windows\system32\Bdbnjdfg.exe
        509⤵
        Drops file in System32 directory
        
        PID:12032
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        510⤵
        
        PID:12172
        
        C:\Windows\SysWOW64\Bnkbcj32.exe
        
        C:\Windows\system32\Bnkbcj32.exe
        511⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\Bhpfqcln.exe
        
        C:\Windows\system32\Bhpfqcln.exe
        512⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        513⤵
        
        PID:1232
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        514⤵
        
        PID:11288
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        515⤵
        
        PID:2240
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        516⤵
        
        PID:11428
        
        C:\Windows\SysWOW64\Coohhlpe.exe
        
        C:\Windows\system32\Coohhlpe.exe
        517⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\Cdlqqcnl.exe
        
        C:\Windows\system32\Cdlqqcnl.exe
        518⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\Ckeimm32.exe
        
        C:\Windows\system32\Ckeimm32.exe
        519⤵
        Modifies registry class
        
        PID:5036
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        520⤵
        
        PID:11672
        
        C:\Windows\SysWOW64\Chiigadc.exe
        
        C:\Windows\system32\Chiigadc.exe
        521⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        522⤵
        
        PID:11728
        
        C:\Windows\SysWOW64\Chlflabp.exe
        
        C:\Windows\system32\Chlflabp.exe
        523⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\Cljobphg.exe
        
        C:\Windows\system32\Cljobphg.exe
        524⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        525⤵
        
        PID:3712
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        526⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\Dbicpfdk.exe
        
        C:\Windows\system32\Dbicpfdk.exe
        527⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        219⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        220⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Hemmac32.exe
        
        C:\Windows\system32\Hemmac32.exe
        221⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Iojkeh32.exe
        
        C:\Windows\system32\Iojkeh32.exe
        222⤵
        Drops file in System32 directory
        
        PID:6208
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        223⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Iehmmb32.exe
        
        C:\Windows\system32\Iehmmb32.exe
        224⤵
        Drops file in System32 directory
        
        PID:8136
        
        C:\Windows\SysWOW64\Joqafgni.exe
        
        C:\Windows\system32\Joqafgni.exe
        225⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        226⤵
        
        PID:2364
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        227⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7064
        
        C:\Windows\SysWOW64\Johggfha.exe
        
        C:\Windows\system32\Johggfha.exe
        228⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Jhplpl32.exe
        
        C:\Windows\system32\Jhplpl32.exe
        229⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        230⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        231⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Khiofk32.exe
        
        C:\Windows\system32\Khiofk32.exe
        232⤵
        
        PID:6580
        
        C:\Windows\SysWOW64\Kofdhd32.exe
        
        C:\Windows\system32\Kofdhd32.exe
        233⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\Lohqnd32.exe
        
        C:\Windows\system32\Lohqnd32.exe
        234⤵
        
        PID:6232

C:\Windows\SysWOW64\Domdjj32.exe
C:\Windows\system32\Domdjj32.exe
1⤵
PID:11984
- C:\Windows\SysWOW64\Dkceokii.exe
  C:\Windows\system32\Dkceokii.exe
  2⤵
  PID:3304
- - C:\Windows\SysWOW64\Dfiildio.exe
    C:\Windows\system32\Dfiildio.exe
    3⤵
    PID:12080
  - - C:\Windows\SysWOW64\Doaneiop.exe
      C:\Windows\system32\Doaneiop.exe
      4⤵
      PID:12132
    - - C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        5⤵
        
        PID:3404
      - C:\Windows\SysWOW64\Emhkdmlg.exe
        
        C:\Windows\system32\Emhkdmlg.exe
        6⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        7⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Efpomccg.exe
        
        C:\Windows\system32\Efpomccg.exe
        8⤵
        
        PID:12276
        
        C:\Windows\SysWOW64\Emjgim32.exe
        
        C:\Windows\system32\Emjgim32.exe
        9⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        10⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        11⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        12⤵
        
        PID:11540
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3796
        
        C:\Windows\SysWOW64\Eejeiocj.exe
        
        C:\Windows\system32\Eejeiocj.exe
        14⤵
        
        PID:2128
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        15⤵
        
        PID:3268
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        16⤵
        
        PID:11720
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        17⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        18⤵
        
        PID:3948
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        19⤵
        
        PID:5012
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        20⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        21⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        22⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        23⤵
        Drops file in System32 directory
        
        PID:12024
        
        C:\Windows\SysWOW64\Gppcmeem.exe
        
        C:\Windows\system32\Gppcmeem.exe
        24⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4428
        
        C:\Windows\SysWOW64\Gfjkjo32.exe
        
        C:\Windows\system32\Gfjkjo32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3768
        
        C:\Windows\SysWOW64\Gihgfk32.exe
        
        C:\Windows\system32\Gihgfk32.exe
        26⤵
        Drops file in System32 directory
        
        PID:4540
        
        C:\Windows\SysWOW64\Gnepna32.exe
        
        C:\Windows\system32\Gnepna32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4148
        
        C:\Windows\SysWOW64\Gfodeohd.exe
        
        C:\Windows\system32\Gfodeohd.exe
        28⤵
        
        PID:3812
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        29⤵
        
        PID:11296
        
        C:\Windows\SysWOW64\Hmmfmhll.exe
        
        C:\Windows\system32\Hmmfmhll.exe
        30⤵
        
        PID:3484
        
        C:\Windows\SysWOW64\Hbohpn32.exe
        
        C:\Windows\system32\Hbohpn32.exe
        31⤵
        
        PID:2928
        
        C:\Windows\SysWOW64\Hoeieolb.exe
        
        C:\Windows\system32\Hoeieolb.exe
        32⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\Iohejo32.exe
        
        C:\Windows\system32\Iohejo32.exe
        33⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        34⤵
        
        PID:3664
        
        C:\Windows\SysWOW64\Ibfnqmpf.exe
        
        C:\Windows\system32\Ibfnqmpf.exe
        35⤵
        
        PID:1344
        
        C:\Windows\SysWOW64\Imkbnf32.exe
        
        C:\Windows\system32\Imkbnf32.exe
        36⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        37⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11848
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        39⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        40⤵
        
        PID:4312
        
        C:\Windows\SysWOW64\Jleijb32.exe
        
        C:\Windows\system32\Jleijb32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5056
        
        C:\Windows\SysWOW64\Jenmcggo.exe
        
        C:\Windows\system32\Jenmcggo.exe
        42⤵
        Drops file in System32 directory
        
        PID:3880
        
        C:\Windows\SysWOW64\Jlgepanl.exe
        
        C:\Windows\system32\Jlgepanl.exe
        43⤵
        Drops file in System32 directory
        
        PID:2860
        
        C:\Windows\SysWOW64\Jngbjd32.exe
        
        C:\Windows\system32\Jngbjd32.exe
        44⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        45⤵
        
        PID:11960
        
        C:\Windows\SysWOW64\Jinboekc.exe
        
        C:\Windows\system32\Jinboekc.exe
        46⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        47⤵
        
        PID:5028
        
        C:\Windows\SysWOW64\Jjpode32.exe
        
        C:\Windows\system32\Jjpode32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4612
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        49⤵
        Drops file in System32 directory
        
        PID:3756
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        50⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        51⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        52⤵
        
        PID:1572
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        53⤵
        
        PID:12280
        
        C:\Windows\SysWOW64\Lfbped32.exe
        
        C:\Windows\system32\Lfbped32.exe
        54⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\Lqhdbm32.exe
        
        C:\Windows\system32\Lqhdbm32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11452
        
        C:\Windows\SysWOW64\Lcgpni32.exe
        
        C:\Windows\system32\Lcgpni32.exe
        56⤵
        Modifies registry class
        
        PID:5580
        
        C:\Windows\SysWOW64\Lnldla32.exe
        
        C:\Windows\system32\Lnldla32.exe
        57⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        58⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        59⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5848
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        60⤵
        Modifies registry class
        
        PID:5976
        
        C:\Windows\SysWOW64\Lckiihok.exe
        
        C:\Windows\system32\Lckiihok.exe
        61⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        62⤵
        Modifies registry class
        
        PID:5052
        
        C:\Windows\SysWOW64\Lqojclne.exe
        
        C:\Windows\system32\Lqojclne.exe
        63⤵
        
        PID:11740
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        64⤵
        
        PID:4472
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        65⤵
        
        PID:5844

C:\Windows\SysWOW64\Mnhdgpii.exe
C:\Windows\system32\Mnhdgpii.exe
1⤵
PID:1788
- C:\Windows\SysWOW64\Mqkiok32.exe
  C:\Windows\system32\Mqkiok32.exe
  2⤵
  PID:2516
- - C:\Windows\SysWOW64\Mjcngpjh.exe
    C:\Windows\system32\Mjcngpjh.exe
    3⤵
    PID:5384
  - - C:\Windows\SysWOW64\Nnafno32.exe
      C:\Windows\system32\Nnafno32.exe
      4⤵
      PID:2372
    - - C:\Windows\SysWOW64\Ncnofeof.exe
        
        C:\Windows\system32\Ncnofeof.exe
        5⤵
        
        PID:1880
      - C:\Windows\SysWOW64\Nqbpojnp.exe
        
        C:\Windows\system32\Nqbpojnp.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5280
        
        C:\Windows\SysWOW64\Nfohgqlg.exe
        
        C:\Windows\system32\Nfohgqlg.exe
        7⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Npgmpf32.exe
        
        C:\Windows\system32\Npgmpf32.exe
        8⤵
        Modifies registry class
        
        PID:1320
        
        C:\Windows\SysWOW64\Nfaemp32.exe
        
        C:\Windows\system32\Nfaemp32.exe
        9⤵
        
        PID:1856
        
        C:\Windows\SysWOW64\Nfcabp32.exe
        
        C:\Windows\system32\Nfcabp32.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4496
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        11⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Oghghb32.exe
        
        C:\Windows\system32\Oghghb32.exe
        12⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Pnfiplog.exe
        
        C:\Windows\system32\Pnfiplog.exe
        13⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Phajna32.exe
        
        C:\Windows\system32\Phajna32.exe
        14⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        15⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        16⤵
        
        PID:12272
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        17⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Qacameaj.exe
        
        C:\Windows\system32\Qacameaj.exe
        18⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        19⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Adcjop32.exe
        
        C:\Windows\system32\Adcjop32.exe
        20⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Agdcpkll.exe
        
        C:\Windows\system32\Agdcpkll.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5664
        
        C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        22⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        23⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Aopemh32.exe
        
        C:\Windows\system32\Aopemh32.exe
        24⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Bkgeainn.exe
        
        C:\Windows\system32\Bkgeainn.exe
        25⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        26⤵
        
        PID:6276
        
        C:\Windows\SysWOW64\Bpfkpp32.exe
        
        C:\Windows\system32\Bpfkpp32.exe
        27⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\Bklomh32.exe
        
        C:\Windows\system32\Bklomh32.exe
        28⤵
        
        PID:1996
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        29⤵
        Modifies registry class
        
        PID:4336
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3352
        
        C:\Windows\SysWOW64\Cponen32.exe
        
        C:\Windows\system32\Cponen32.exe
        31⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        32⤵
        
        PID:4460
        
        C:\Windows\SysWOW64\Chkobkod.exe
        
        C:\Windows\system32\Chkobkod.exe
        33⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Cdbpgl32.exe
        
        C:\Windows\system32\Cdbpgl32.exe
        34⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Dpiplm32.exe
        
        C:\Windows\system32\Dpiplm32.exe
        35⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Dojqjdbl.exe
        
        C:\Windows\system32\Dojqjdbl.exe
        36⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        37⤵
        
        PID:5080
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        38⤵
        
        PID:5744

C:\Windows\SysWOW64\Dhgonidg.exe
C:\Windows\system32\Dhgonidg.exe
1⤵
PID:11992
- C:\Windows\SysWOW64\Dqbcbkab.exe
  C:\Windows\system32\Dqbcbkab.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:6548
- - C:\Windows\SysWOW64\Dhikci32.exe
    C:\Windows\system32\Dhikci32.exe
    3⤵
    PID:6864
  - - C:\Windows\SysWOW64\Doccpcja.exe
      C:\Windows\system32\Doccpcja.exe
      4⤵
      PID:6836
    - - C:\Windows\SysWOW64\Ebaplnie.exe
        
        C:\Windows\system32\Ebaplnie.exe
        5⤵
        
        PID:6644
      - C:\Windows\SysWOW64\Egohdegl.exe
        
        C:\Windows\system32\Egohdegl.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6956
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        7⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Edeeci32.exe
        
        C:\Windows\system32\Edeeci32.exe
        8⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Egcaod32.exe
        
        C:\Windows\system32\Egcaod32.exe
        9⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Ehbnigjj.exe
        
        C:\Windows\system32\Ehbnigjj.exe
        10⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Eiekog32.exe
        
        C:\Windows\system32\Eiekog32.exe
        11⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        12⤵
        Drops file in System32 directory
        
        PID:6724
        
        C:\Windows\SysWOW64\Fqppci32.exe
        
        C:\Windows\system32\Fqppci32.exe
        13⤵
        
        PID:6500
        
        C:\Windows\SysWOW64\Fkfcqb32.exe
        
        C:\Windows\system32\Fkfcqb32.exe
        14⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        15⤵
        
        PID:5896
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        16⤵
        
        PID:392
        
        C:\Windows\SysWOW64\Foclgq32.exe
        
        C:\Windows\system32\Foclgq32.exe
        17⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Fkjmlaac.exe
        
        C:\Windows\system32\Fkjmlaac.exe
        18⤵
        
        PID:5320
        
        C:\Windows\SysWOW64\Fqgedh32.exe
        
        C:\Windows\system32\Fqgedh32.exe
        19⤵
        
        PID:11316
        
        C:\Windows\SysWOW64\Giecfejd.exe
        
        C:\Windows\system32\Giecfejd.exe
        20⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Gnblnlhl.exe
        
        C:\Windows\system32\Gnblnlhl.exe
        21⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        22⤵
        
        PID:2864
        
        C:\Windows\SysWOW64\Gpaihooo.exe
        
        C:\Windows\system32\Gpaihooo.exe
        23⤵
        
        PID:7372
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        24⤵
        
        PID:11616
        
        C:\Windows\SysWOW64\Gpdennml.exe
        
        C:\Windows\system32\Gpdennml.exe
        25⤵
        
        PID:11712
        
        C:\Windows\SysWOW64\Ghojbq32.exe
        
        C:\Windows\system32\Ghojbq32.exe
        26⤵
        Drops file in System32 directory
        
        PID:4784
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        27⤵
        Modifies registry class
        
        PID:5816
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        28⤵
        Drops file in System32 directory
        
        PID:6632
        
        C:\Windows\SysWOW64\Hecjke32.exe
        
        C:\Windows\system32\Hecjke32.exe
        29⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        30⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        31⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Heegad32.exe
        
        C:\Windows\system32\Heegad32.exe
        32⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        33⤵
        Drops file in System32 directory
        
        PID:5584
        
        C:\Windows\SysWOW64\Hnnljj32.exe
        
        C:\Windows\system32\Hnnljj32.exe
        34⤵
        
        PID:7440
        
        C:\Windows\SysWOW64\Hehdfdek.exe
        
        C:\Windows\system32\Hehdfdek.exe
        35⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Hlblcn32.exe
        
        C:\Windows\system32\Hlblcn32.exe
        36⤵
        
        PID:7612

C:\Windows\SysWOW64\Lhqefjpo.exe
C:\Windows\system32\Lhqefjpo.exe
1⤵
PID:7944
- C:\Windows\SysWOW64\Ledepn32.exe
  C:\Windows\system32\Ledepn32.exe
  2⤵
  PID:6184
- - C:\Windows\SysWOW64\Lchfib32.exe
    C:\Windows\system32\Lchfib32.exe
    3⤵
    PID:4596
  - - C:\Windows\SysWOW64\Lplfcf32.exe
      C:\Windows\system32\Lplfcf32.exe
      4⤵
      PID:5732
    - - C:\Windows\SysWOW64\Lfiokmkc.exe
        
        C:\Windows\system32\Lfiokmkc.exe
        5⤵
        
        PID:5192
      - C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        6⤵
        
        PID:5860
        
        C:\Windows\SysWOW64\Mcoljagj.exe
        
        C:\Windows\system32\Mcoljagj.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7200
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6192
        
        C:\Windows\SysWOW64\Mbgeqmjp.exe
        
        C:\Windows\system32\Mbgeqmjp.exe
        9⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Mqhfoebo.exe
        
        C:\Windows\system32\Mqhfoebo.exe
        10⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\Mlofcf32.exe
        
        C:\Windows\system32\Mlofcf32.exe
        11⤵
        
        PID:4136
        
        C:\Windows\SysWOW64\Nciopppp.exe
        
        C:\Windows\system32\Nciopppp.exe
        12⤵
        Modifies registry class
        
        PID:5780
        
        C:\Windows\SysWOW64\Nfgklkoc.exe
        
        C:\Windows\system32\Nfgklkoc.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7772
        
        C:\Windows\SysWOW64\Nmaciefp.exe
        
        C:\Windows\system32\Nmaciefp.exe
        14⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Nckkfp32.exe
        
        C:\Windows\system32\Nckkfp32.exe
        15⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Nhhdnf32.exe
        
        C:\Windows\system32\Nhhdnf32.exe
        16⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:488
        
        C:\Windows\SysWOW64\Ncmhko32.exe
        
        C:\Windows\system32\Ncmhko32.exe
        17⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Nbbeml32.exe
        
        C:\Windows\system32\Nbbeml32.exe
        18⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Nmhijd32.exe
        
        C:\Windows\system32\Nmhijd32.exe
        19⤵
        
        PID:3604
        
        C:\Windows\SysWOW64\Ooibkpmi.exe
        
        C:\Windows\system32\Ooibkpmi.exe
        20⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Ojqcnhkl.exe
        
        C:\Windows\system32\Ojqcnhkl.exe
        21⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Opbean32.exe
        
        C:\Windows\system32\Opbean32.exe
        22⤵
        Modifies registry class
        
        PID:7848

C:\Windows\SysWOW64\Pfojdh32.exe
C:\Windows\system32\Pfojdh32.exe
1⤵
PID:7400
- C:\Windows\SysWOW64\Padnaq32.exe
  C:\Windows\system32\Padnaq32.exe
  2⤵
  PID:7572
- - C:\Windows\SysWOW64\Pbhgoh32.exe
    C:\Windows\system32\Pbhgoh32.exe
    3⤵
    PID:7480
  - - C:\Windows\SysWOW64\Paihlpfi.exe
      C:\Windows\system32\Paihlpfi.exe
      4⤵
      PID:7748
    - - C:\Windows\SysWOW64\Pjaleemj.exe
        
        C:\Windows\system32\Pjaleemj.exe
        5⤵
        
        PID:8132
      - C:\Windows\SysWOW64\Pmphaaln.exe
        
        C:\Windows\system32\Pmphaaln.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7784
        
        C:\Windows\SysWOW64\Pblajhje.exe
        
        C:\Windows\system32\Pblajhje.exe
        7⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Qmdblp32.exe
        
        C:\Windows\system32\Qmdblp32.exe
        8⤵
        Drops file in System32 directory
        
        PID:7416
        
        C:\Windows\SysWOW64\Qfmfefni.exe
        
        C:\Windows\system32\Qfmfefni.exe
        9⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\Amfobp32.exe
        
        C:\Windows\system32\Amfobp32.exe
        10⤵
        
        PID:8060
        
        C:\Windows\SysWOW64\Apeknk32.exe
        
        C:\Windows\system32\Apeknk32.exe
        11⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Abcgjg32.exe
        
        C:\Windows\system32\Abcgjg32.exe
        12⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Amikgpcc.exe
        
        C:\Windows\system32\Amikgpcc.exe
        13⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Acccdj32.exe
        
        C:\Windows\system32\Acccdj32.exe
        14⤵
        
        PID:8108
        
        C:\Windows\SysWOW64\Apjdikqd.exe
        
        C:\Windows\system32\Apjdikqd.exe
        15⤵
        
        PID:8916
        
        C:\Windows\SysWOW64\Aplaoj32.exe
        
        C:\Windows\system32\Aplaoj32.exe
        16⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\Apnndj32.exe
        
        C:\Windows\system32\Apnndj32.exe
        17⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Banjnm32.exe
        
        C:\Windows\system32\Banjnm32.exe
        18⤵
        Modifies registry class
        
        PID:8516
        
        C:\Windows\SysWOW64\Bboffejp.exe
        
        C:\Windows\system32\Bboffejp.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5980
        
        C:\Windows\SysWOW64\Bdocph32.exe
        
        C:\Windows\system32\Bdocph32.exe
        20⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\Bagmdllg.exe
        
        C:\Windows\system32\Bagmdllg.exe
        21⤵
        
        PID:12140
        
        C:\Windows\SysWOW64\Ckpamabg.exe
        
        C:\Windows\system32\Ckpamabg.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6696
        
        C:\Windows\SysWOW64\Cbkfbcpb.exe
        
        C:\Windows\system32\Cbkfbcpb.exe
        23⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Cgiohbfi.exe
        
        C:\Windows\system32\Cgiohbfi.exe
        24⤵
        
        PID:8868
        
        C:\Windows\SysWOW64\Cmbgdl32.exe
        
        C:\Windows\system32\Cmbgdl32.exe
        25⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Ccppmc32.exe
        
        C:\Windows\system32\Ccppmc32.exe
        26⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Caqpkjcl.exe
        
        C:\Windows\system32\Caqpkjcl.exe
        27⤵
        Modifies registry class
        
        PID:5592

C:\Windows\SysWOW64\Cildom32.exe
C:\Windows\system32\Cildom32.exe
1⤵
PID:1340
- C:\Windows\SysWOW64\Ccdihbgg.exe
  C:\Windows\system32\Ccdihbgg.exe
  2⤵
  PID:5388
- - C:\Windows\SysWOW64\Daeifj32.exe
    C:\Windows\system32\Daeifj32.exe
    3⤵
    PID:6904
  - - C:\Windows\SysWOW64\Dahfkimd.exe
      C:\Windows\system32\Dahfkimd.exe
      4⤵
      PID:8624
    - - C:\Windows\SysWOW64\Dkpjdo32.exe
        
        C:\Windows\system32\Dkpjdo32.exe
        5⤵
        
        PID:8912
      - C:\Windows\SysWOW64\Dajbaika.exe
        
        C:\Windows\system32\Dajbaika.exe
        6⤵
        Drops file in System32 directory
        
        PID:8980
        
        C:\Windows\SysWOW64\Dggkipii.exe
        
        C:\Windows\system32\Dggkipii.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8940
        
        C:\Windows\SysWOW64\Dnqcfjae.exe
        
        C:\Windows\system32\Dnqcfjae.exe
        8⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Dkedonpo.exe
        
        C:\Windows\system32\Dkedonpo.exe
        9⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\Dpalgenf.exe
        
        C:\Windows\system32\Dpalgenf.exe
        10⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Ekgqennl.exe
        
        C:\Windows\system32\Ekgqennl.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5864
        
        C:\Windows\SysWOW64\Eaaiahei.exe
        
        C:\Windows\system32\Eaaiahei.exe
        12⤵
        Drops file in System32 directory
        
        PID:8520
        
        C:\Windows\SysWOW64\Eaceghcg.exe
        
        C:\Windows\system32\Eaceghcg.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6356
        
        C:\Windows\SysWOW64\Ejojljqa.exe
        
        C:\Windows\system32\Ejojljqa.exe
        14⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\Eddnic32.exe
        
        C:\Windows\system32\Eddnic32.exe
        15⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Eqkondfl.exe
        
        C:\Windows\system32\Eqkondfl.exe
        16⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Egegjn32.exe
        
        C:\Windows\system32\Egegjn32.exe
        17⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Eqmlccdi.exe
        
        C:\Windows\system32\Eqmlccdi.exe
        18⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Fjeplijj.exe
        
        C:\Windows\system32\Fjeplijj.exe
        19⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\Fqphic32.exe
        
        C:\Windows\system32\Fqphic32.exe
        20⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Fgiaemic.exe
        
        C:\Windows\system32\Fgiaemic.exe
        21⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Fncibg32.exe
        
        C:\Windows\system32\Fncibg32.exe
        22⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Fglnkm32.exe
        
        C:\Windows\system32\Fglnkm32.exe
        23⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Fkjfakng.exe
        
        C:\Windows\system32\Fkjfakng.exe
        24⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Fqfojblo.exe
        
        C:\Windows\system32\Fqfojblo.exe
        25⤵
        
        PID:9428
        
        C:\Windows\SysWOW64\Fnjocf32.exe
        
        C:\Windows\system32\Fnjocf32.exe
        26⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Gddgpqbe.exe
        
        C:\Windows\system32\Gddgpqbe.exe
        27⤵
        
        PID:952
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 952 -s 412
        28⤵
        Program crash
        
        PID:7808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 952 -ip 952
1⤵
PID:8932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aggegh32.exe

Filesize
97KB

MD5
15b1b1800c942cf2155d6ac3754007f3

SHA1
2eac0b7c6779e0085381b414ffcf8b9f389c0303

SHA256
f262286c9f0f8fe159da25cebf57f48f4469d8f0f0621ec37f31743007669ae1

SHA512
175fc56084db21ea7aafefb025e02f71c44972715eb50129472ce0f2f1fcb7c965debb38f37a6feee5048822ce9d083d1fdec02bee9fc04cd71db3cfc4b3debc

Download Submit
C:\Windows\SysWOW64\Alcfei32.exe

Filesize
97KB

MD5
fedb79084ca82f8198f33693512d6464

SHA1
fbb72feb2906b826c0964275aa68bc4a534f1641

SHA256
0dbc4b8b66cd662421e9236991e95edb2146036dc58750283ed227741b3887ce

SHA512
f826a331229cdd128ed9c75e16d4888437c7449ee018e4dd488534a59c16029078eef3397cb1f8c5bebc900126ec19d490b379a09b23819f529ba4622303fd04

Download Submit
C:\Windows\SysWOW64\Dlkbjqgm.exe

Filesize
97KB

MD5
cadf4ff635b4cb5f0dbf7ec79fa71212

SHA1
8bee75ca838c4d12d647c9fb9249dc09a6b8243a

SHA256
1e44d7a62b62cab631beb6bd82dffce3a65ec091be97a61278b9d58acd206fa9

SHA512
4c1cbe07e082756ad39afec2a00113297e8d13506c4ed90136e6462c8c7cbf30b95bc4c9487e6813deec453c9c1d79ccf77ec3612ae21b11015d918e63146230

Download Submit
C:\Windows\SysWOW64\Doilmc32.exe

Filesize
97KB

MD5
40dc3b8de841bb40d2e518e49c27163c

SHA1
0e8ce9afff3c0c027385d70d15ed43e0241720fa

SHA256
9da63d2ebf0f4c9ea4eb564cfe9a7894759026c441e42f76d33439e1ae53307c

SHA512
f2af2586356ec07fd757596080f7b1ab29c8c56ca1402eca3066849ecfbbce0ab4733cdf0e6a300dd42f83363a4d195ae6b6b32d118f20becc61889c2cb823f2

Download Submit
C:\Windows\SysWOW64\Emmkiclm.exe

Filesize
97KB

MD5
4b1f98717ba4533cf9ae17d2e802696a

SHA1
8dacf44c13dbd21ef0f2f88d9a5ba56ccd361928

SHA256
4436ce125ab5dfd5d94e96a26e033e481d85dcb2bd630b66466bc5f929dc229a

SHA512
b236923f00ec73392a10492459743410f9301630148097c5c83be108c5cb296e604d4cb30401fe021739c66cc46bfca965e7f7ea56dc02cc25d6eda6db3ef7e7

Download Submit
C:\Windows\SysWOW64\Fajgkfio.exe

Filesize
97KB

MD5
f84e1ad207c3dac3d1ac0884abe048cb

SHA1
c37fca1a67e70742f3dabb315d66f0a9bfc6d3c0

SHA256
b32ee408c7abceb059c72d24557ff4a9c4d1a04700840677d00efc9ccfcd8415

SHA512
a67b2360398d1746e718d0f27c5d44835a52a5bfa8a033775be4ee2b62677068b0fa51a856deeac32636cf65c47b231eddf26222fcba6f34697e173374dcc3f7

Download Submit
C:\Windows\SysWOW64\Fdfmlhna.exe

Filesize
97KB

MD5
8954e68dc8fed8cc0680f4713979a280

SHA1
0bd5ef213fa785f179d46626152281208537a6ba

SHA256
21265ba6f79f4e7a2adab37f0e441cd0790858815253cab55876d6eebe801f03

SHA512
196a95ed609119626b9a38cc5ae8ed9adf54a37b90719473647d88a9c04b20b91ebd5d0d0edf54d1d6d26c3577f5d46be7c62fd197f76c7fa3d4cc142cd83b94

Download Submit
C:\Windows\SysWOW64\Gfokoelp.exe

Filesize
97KB

MD5
61fda854edd7b4405740b4a89b53cb84

SHA1
f99bfecc711c77a6b2bcd588358a9f4e8dcc542a

SHA256
30d9e297cf20ca78338088f83ff8a2b263f18e787b68b2ac98d889a161df3404

SHA512
81a306eccda72d6117bae48ff0b3a142bbbebab558632a27121f07c8374b8dd3a6b4e0dfc4f0cc486d8e6aee69e9fde874c566087fd0d2107ff4b582c23e187d

Download Submit
C:\Windows\SysWOW64\Gpcfmkff.exe

Filesize
97KB

MD5
ef810c8eec8a1993e4ea1e44162f18e6

SHA1
915102138fd0c5feeea6cb9331fa954713e41c99

SHA256
c0d46ccf72805ee37065bafda2cf208f288498a2bf30d30573346ddf228c824c

SHA512
9ceedb6a0b1ffc50f2b1f6df388149666c5f35c1aba2bfc18e601ca9c7c453b924a7658f5c7e35cb3f6580fa7a4268c7fcb55d7d7c468f89087f138751d4c8fa

Download Submit
C:\Windows\SysWOW64\Hbhijepa.exe

Filesize
97KB

MD5
87ee0a5703368b7c11872b6517a6da25

SHA1
2f11d8e58ff8889d2a3a7ad3c6d22d4dfc63b24a

SHA256
abb8707da9517a067cde8fafca1cf75f480149d7c6f30c753e5c81f2f401aecd

SHA512
a223db498de3ac400d0622755f9ce3bc62f92b8f332efcfb0038ad29467e065371fad9c578cb06d7d0c0c5fd9c2e11c024d63b905a714fcaa709adee7fcf071a

Download Submit
C:\Windows\SysWOW64\Hpfcdojl.exe

Filesize
97KB

MD5
39fb6ea77813435b314847301aae1c2f

SHA1
bbc48230302cd0100dee9db0043b50243995baa2

SHA256
14156a85e018361450efb8acd16d5df30b5b5a2a1b5a8629eafa21ca013c6b38

SHA512
32dae04e3d084ffaf6a14ab582d4126ed873fd1e14ca0887764b31c7fe8f6b8fcfd59a270dc5fe9ae44426405907dbfd6ce94eddd73d1f39230cba0b73853437

Download Submit
C:\Windows\SysWOW64\Idjlpc32.exe

Filesize
97KB

MD5
54704aca0718ea155d1287512f30ad46

SHA1
1eac9154c334b1ec854c658bd175a9b8a78cdf43

SHA256
12f043e77dcd510652e602c852c6b26251f8a7c02b98ab44e18e0f13e2e7db3f

SHA512
7068bb175a0b416888fbc1cd1dc6c32476ca9e1c0d524e897cbed0a84f73a7d433538a5110eec323e5ac5327b4758716dbf69f635f075d4b1ab8afba9b5f3e75

Download Submit
C:\Windows\SysWOW64\Iijaka32.exe

Filesize
97KB

MD5
0b7accf7ca6292256ddd32dbd7d57400

SHA1
9ebb74888458b7d7d344a0e4a1b26d732d7cc2ee

SHA256
2fd8b2ada2ea29d9eba5370707e1c06f2ee4c126a7ac56f33a104bada3199ab8

SHA512
e7619f3879fdb6a363303661c95193535532dcf4266a6800a4c1b223711859d8ac17627c4fb060c5f2f4d7f66e8fee03ec183f5b1fec2cae5e9dde8bbf05fb42

Download Submit
C:\Windows\SysWOW64\Jlgbon32.dll

Filesize
7KB

MD5
883c5e3c88342be308f21dbf3a6ca0af

SHA1
90e1df777aa3a67f91260c5eae2c1deeedae020f

SHA256
4731689e64137f2bda78dc8aba55de7a1b77ebd10b2211ec6103f37d09e4a524

SHA512
fede96c7b6e4875d42d9c1c68976c25093bcb604bfcbcda3a31834630518f0f66d8672b5249e09eaae8b41dba9ddaf0bc973704182567d418aaea63e90cf929c

Download Submit
C:\Windows\SysWOW64\Kbfbkj32.exe

Filesize
97KB

MD5
d40a733a6c72b9fb44b9bb5eea8930e2

SHA1
2cbee42504d406170fd5224371d0af1a8ece4879

SHA256
6647e3063e5c8466548c9c19283b2fb4e9afc4bdf34ce23da6265e949f86fd1a

SHA512
352e6a4f9bf89b428c3ad28df8b257ede1dab238f3054a4a37ec29b75289f34faf350bdf69d15cc89066e0ee2f5de919aeccf1dfdf72d4d872d687c1f2a5ad7e

Download Submit
C:\Windows\SysWOW64\Kbfbkj32.exe

Filesize
97KB

MD5
d40a733a6c72b9fb44b9bb5eea8930e2

SHA1
2cbee42504d406170fd5224371d0af1a8ece4879

SHA256
6647e3063e5c8466548c9c19283b2fb4e9afc4bdf34ce23da6265e949f86fd1a

SHA512
352e6a4f9bf89b428c3ad28df8b257ede1dab238f3054a4a37ec29b75289f34faf350bdf69d15cc89066e0ee2f5de919aeccf1dfdf72d4d872d687c1f2a5ad7e

Download Submit
C:\Windows\SysWOW64\Kcndbp32.exe

Filesize
97KB

MD5
5eed3ff98d3b04223495780b9933637f

SHA1
e7665773b058361005ce100606756f40a27ddf71

SHA256
34b6262b1a61dfbe169d5a6a10ee4d753f78bce6c2cacb6ce8c4ef6ed1617d78

SHA512
6ed28eb949b17fb51ad6b1ab3602c81ff043bf406953cdc101115157fda92994d834cdfa5a2f10e4fb88f7ed2facbebb658c8e4d97d90ba961cc39c009df59e0

Download Submit
C:\Windows\SysWOW64\Kefkme32.exe

Filesize
97KB

MD5
dc8fd37bcf932b8c7285abb246d6d85a

SHA1
def9bc1a943c4c3c989587482e447dfadedaff1b

SHA256
30d2bf2d0d818259123920789ebb00ab0467d71c23e8725a6a90377cbacdb304

SHA512
ed32e2e8538cb999f2acdb91b298f82dd75f94aacfc675cdb2a9edc957c0a4ce2945feff43a34f6122d0d4a2aab051b0bf3481479016a71385f29b2f806126c3

Download Submit
C:\Windows\SysWOW64\Kefkme32.exe

Filesize
97KB

MD5
dc8fd37bcf932b8c7285abb246d6d85a

SHA1
def9bc1a943c4c3c989587482e447dfadedaff1b

SHA256
30d2bf2d0d818259123920789ebb00ab0467d71c23e8725a6a90377cbacdb304

SHA512
ed32e2e8538cb999f2acdb91b298f82dd75f94aacfc675cdb2a9edc957c0a4ce2945feff43a34f6122d0d4a2aab051b0bf3481479016a71385f29b2f806126c3

Download Submit
C:\Windows\SysWOW64\Klngdpdd.exe

Filesize
97KB

MD5
65bd847dafb51b6d00d04c03ea3baeb7

SHA1
b7ea2340d3e173ec51c65d2a6af092e269b537c2

SHA256
abdfc8651183f0d753a685fa709412b510ca7d8528f718d6572c68eaa2775f4b

SHA512
5349257f9cb8bd95bf979ec3834ab27b3237ed2599bf8b44f60216425da09852c22faa3d5e30bd557a4137ba4b7dfd10c61dfa6cad66a20364df6e51c5e65dd8

Download Submit
C:\Windows\SysWOW64\Klngdpdd.exe

Filesize
97KB

MD5
65bd847dafb51b6d00d04c03ea3baeb7

SHA1
b7ea2340d3e173ec51c65d2a6af092e269b537c2

SHA256
abdfc8651183f0d753a685fa709412b510ca7d8528f718d6572c68eaa2775f4b

SHA512
5349257f9cb8bd95bf979ec3834ab27b3237ed2599bf8b44f60216425da09852c22faa3d5e30bd557a4137ba4b7dfd10c61dfa6cad66a20364df6e51c5e65dd8

Download Submit
C:\Windows\SysWOW64\Kmaopfjm.exe

Filesize
97KB

MD5
448da1b99782af3241b6ef8c09f21000

SHA1
13357c5e13c9ba53678e8a863e2757c0b5e63bfe

SHA256
444a0d9463e96c5433d48a2b9c6b3f36f6ed8d106a8be967ccfa56887f233766

SHA512
2f8a9b63f3ee5646e2aa95f868fd0ab05ef59ac2c8262592942913cdc40044be7c196108e53e7161404b14fa63558cb344175ea0b651026f6955deda7647385e

Download Submit
C:\Windows\SysWOW64\Kngcje32.exe

Filesize
97KB

MD5
a4396d7f63eb5596c9d4321152ea39cf

SHA1
70f56da33395836d98c9712e205a89e8bb7ddd9c

SHA256
86cc5c983eccb76b23a24dae3ab6c24abe590eea304d5e1484c58c17ed690bec

SHA512
b0eab5a98030d5d179eff6525e575b1a2edc46903b71fbe637d16a22f6fff037e41223f0f7eb4178e885a58f0a14d256387db7274dd806bc6488c6f22d93847f

Download Submit
C:\Windows\SysWOW64\Lajagj32.exe

Filesize
97KB

MD5
40afc72792284f260ea67bb59d39350e

SHA1
8f3fbb19c07a20b897fa2a931ff2672e994a420b

SHA256
1c52a1489e01eb0fc2a0cbb36826e3549caed3bf36a586f1df30d6f7009fa504

SHA512
4e84ca9696c559a01ea3ea8eab93e0d344aeb7a811609f684dd1bd462254dc4a8841296f80560dadb6a854a1a00a2d2d7298b840b4c8bd6aeddb46639469b381

Download Submit
C:\Windows\SysWOW64\Lbabgh32.exe

Filesize
97KB

MD5
ff60502125b5765e78629367ded15961

SHA1
6e97fcdd2e52df32d71eb65296d77722fc7fbb7c

SHA256
ee341239331da8b4253d28a353569790fd5fa563dc2623cd27032b5b021531a4

SHA512
a6757a3b8be9d11736a610d793efa287e27cf973a9e768e3efb98a0d7041909d84b4d41d66f3108a9f848b631bae73d4d370e0ed38cfb863f87cfbbf2d20fb2b

Download Submit
C:\Windows\SysWOW64\Lbabgh32.exe

Filesize
97KB

MD5
ff60502125b5765e78629367ded15961

SHA1
6e97fcdd2e52df32d71eb65296d77722fc7fbb7c

SHA256
ee341239331da8b4253d28a353569790fd5fa563dc2623cd27032b5b021531a4

SHA512
a6757a3b8be9d11736a610d793efa287e27cf973a9e768e3efb98a0d7041909d84b4d41d66f3108a9f848b631bae73d4d370e0ed38cfb863f87cfbbf2d20fb2b

Download Submit
C:\Windows\SysWOW64\Lbjlfi32.exe

Filesize
97KB

MD5
a3b2282af9d24f96cc66f5702f27024a

SHA1
9edf3343e2f6f8736516a639d6a54f4bf8178f68

SHA256
47cf587754c5ec1faf0ee112ea0abc2c3aab5ab8e9cb2a1fd1534c0bce34ff28

SHA512
2be5871929d463bdf426ef2ca03d5d1f085b2bca9a8ace1961209c27c51fdca22881c293595e9b045ae2911f3a5014c3f32ad49c30331ecb707b6ccf25f2b1ea

Download Submit
C:\Windows\SysWOW64\Lbjlfi32.exe

Filesize
97KB

MD5
a3b2282af9d24f96cc66f5702f27024a

SHA1
9edf3343e2f6f8736516a639d6a54f4bf8178f68

SHA256
47cf587754c5ec1faf0ee112ea0abc2c3aab5ab8e9cb2a1fd1534c0bce34ff28

SHA512
2be5871929d463bdf426ef2ca03d5d1f085b2bca9a8ace1961209c27c51fdca22881c293595e9b045ae2911f3a5014c3f32ad49c30331ecb707b6ccf25f2b1ea

Download Submit
C:\Windows\SysWOW64\Ldanqkki.exe

Filesize
97KB

MD5
04ab26bfa9192ec48abdf9c9e53f0fdc

SHA1
fd22094a2953592121a57039b30e6335bd8ddd7e

SHA256
dec1b86e5f32f59533e953d8dee67fe213c00493ae93767ce60c48e2e2098433

SHA512
714a846d05a0dc0b7d008b40747e866ecba3eb7cd2f790ab10376af8470dd8d483502c3030847893567c3b0a9b42340752fbc95562b54703cd0cc8324eb94c49

Download Submit
C:\Windows\SysWOW64\Ldanqkki.exe

Filesize
97KB

MD5
04ab26bfa9192ec48abdf9c9e53f0fdc

SHA1
fd22094a2953592121a57039b30e6335bd8ddd7e

SHA256
dec1b86e5f32f59533e953d8dee67fe213c00493ae93767ce60c48e2e2098433

SHA512
714a846d05a0dc0b7d008b40747e866ecba3eb7cd2f790ab10376af8470dd8d483502c3030847893567c3b0a9b42340752fbc95562b54703cd0cc8324eb94c49

Download Submit
C:\Windows\SysWOW64\Ldjhpl32.exe

Filesize
97KB

MD5
d6172e83177521f4e3f056e34961f45a

SHA1
0e43532bfe5306008ecb4901c2cb2b7c918c851f

SHA256
38c32b18ddb59877cd539e9cfe15114258e8fa0b5ac59515dd57665d99b980a6

SHA512
35328cba7e2a7d554c2c1e8de33daf1d1995ea687f49ebc8b33d3463277a1488ced7b42c4d29faa78c2b2523ebc8904016fb976533bd263d536f4f8b0e704b69

Download Submit
C:\Windows\SysWOW64\Ldjhpl32.exe

Filesize
97KB

MD5
d6172e83177521f4e3f056e34961f45a

SHA1
0e43532bfe5306008ecb4901c2cb2b7c918c851f

SHA256
38c32b18ddb59877cd539e9cfe15114258e8fa0b5ac59515dd57665d99b980a6

SHA512
35328cba7e2a7d554c2c1e8de33daf1d1995ea687f49ebc8b33d3463277a1488ced7b42c4d29faa78c2b2523ebc8904016fb976533bd263d536f4f8b0e704b69

Download Submit
C:\Windows\SysWOW64\Lfkaag32.exe

Filesize
97KB

MD5
0cfd6319d02e65805aaae49b8ea4723e

SHA1
00cf094777b1feb935565814e5add2d6145d924b

SHA256
5957f5e2d04bf6185ce172ce2555af1ac7cdcd3932825fa196dd4c8c9556fcb9

SHA512
4dc680620ae89501831f02b54eb560d80234cf4b6dbaba7900dcf4c2f72f0ac2d596142d81d842edc69f99936ec7e25edf310fe15360d868562c8ebe5729283a

Download Submit
C:\Windows\SysWOW64\Lfkaag32.exe

Filesize
97KB

MD5
0cfd6319d02e65805aaae49b8ea4723e

SHA1
00cf094777b1feb935565814e5add2d6145d924b

SHA256
5957f5e2d04bf6185ce172ce2555af1ac7cdcd3932825fa196dd4c8c9556fcb9

SHA512
4dc680620ae89501831f02b54eb560d80234cf4b6dbaba7900dcf4c2f72f0ac2d596142d81d842edc69f99936ec7e25edf310fe15360d868562c8ebe5729283a

Download Submit
C:\Windows\SysWOW64\Liddbc32.exe

Filesize
97KB

MD5
046bc5da183b2cfb9415a1f0d4e1db5a

SHA1
24741b8922caf56b404a0e244e2fe8715861fbdf

SHA256
81cf1dd61a17c443acbcb0ec3d1cbf379d054ddd248e0c6fc6bd1a325cc67c7f

SHA512
bed5f77f45d4ce039869f131794416c9c3d26f715cfa83277e71d28bdd18a112b05572f1d3723cab5440cd73bd047b9987cbe324ba26b91a8cdbd8a0dbef8b68

Download Submit
C:\Windows\SysWOW64\Liddbc32.exe

Filesize
97KB

MD5
046bc5da183b2cfb9415a1f0d4e1db5a

SHA1
24741b8922caf56b404a0e244e2fe8715861fbdf

SHA256
81cf1dd61a17c443acbcb0ec3d1cbf379d054ddd248e0c6fc6bd1a325cc67c7f

SHA512
bed5f77f45d4ce039869f131794416c9c3d26f715cfa83277e71d28bdd18a112b05572f1d3723cab5440cd73bd047b9987cbe324ba26b91a8cdbd8a0dbef8b68

Download Submit
C:\Windows\SysWOW64\Lingibiq.exe

Filesize
97KB

MD5
19bc0106d7070437c2ab4cd623e39106

SHA1
3fb073b43af7ba7a5f86f9356867b460c69f41dc

SHA256
0ed4cdde2a3901c39b965e156e65273556824e0513b7cea49e427ba74e75db37

SHA512
0b77f2477b942507fa92989e8a43547d21727d4272af4fbaa8797b6bb2997e7a1dac18b3aa314de7cc1e83b53762f05ea81ae2128fe50dffd2ab271f2b26d3b3

Download Submit
C:\Windows\SysWOW64\Lingibiq.exe

Filesize
97KB

MD5
19bc0106d7070437c2ab4cd623e39106

SHA1
3fb073b43af7ba7a5f86f9356867b460c69f41dc

SHA256
0ed4cdde2a3901c39b965e156e65273556824e0513b7cea49e427ba74e75db37

SHA512
0b77f2477b942507fa92989e8a43547d21727d4272af4fbaa8797b6bb2997e7a1dac18b3aa314de7cc1e83b53762f05ea81ae2128fe50dffd2ab271f2b26d3b3

Download Submit
C:\Windows\SysWOW64\Mdckfk32.exe

Filesize
97KB

MD5
3e5381421ceda086a8e1ff8af7bf9a05

SHA1
f4fb04e1e87a6225297bc79ef26680d2d6071b14

SHA256
5121ca60e83d73043b7b853d0db34da5b1217bd05472790a670deef063a8d067

SHA512
4ee239ce768d2bf0b936f8f888a8f75213674fe63e3c8996519cc6f2a8a80059fa48ad5a8005577dca07ff1b03ead558839a61f5f73b8f4e3df852f1c58caebc

Download Submit
C:\Windows\SysWOW64\Mdckfk32.exe

Filesize
97KB

MD5
3e5381421ceda086a8e1ff8af7bf9a05

SHA1
f4fb04e1e87a6225297bc79ef26680d2d6071b14

SHA256
5121ca60e83d73043b7b853d0db34da5b1217bd05472790a670deef063a8d067

SHA512
4ee239ce768d2bf0b936f8f888a8f75213674fe63e3c8996519cc6f2a8a80059fa48ad5a8005577dca07ff1b03ead558839a61f5f73b8f4e3df852f1c58caebc

Download Submit
C:\Windows\SysWOW64\Mdmnlj32.exe

Filesize
97KB

MD5
ba38fc7a15b8daefe0baa366285b703d

SHA1
fb9f1de5cbc9e0b00219bd5278afef33e5319533

SHA256
2c8b6a896b06ca016be94a55fb53a6670daafc505a8c11f7b7396918d2a83a00

SHA512
ee548e72af672c157d57c0a1d0a48b49f59b90af60df2ab90e6cf8a87a29079005ed841902aae5e1f880cbb90616adb023778789075418654d04a3cd0f9f04a4

Download Submit
C:\Windows\SysWOW64\Mdmnlj32.exe

Filesize
97KB

MD5
ba38fc7a15b8daefe0baa366285b703d

SHA1
fb9f1de5cbc9e0b00219bd5278afef33e5319533

SHA256
2c8b6a896b06ca016be94a55fb53a6670daafc505a8c11f7b7396918d2a83a00

SHA512
ee548e72af672c157d57c0a1d0a48b49f59b90af60df2ab90e6cf8a87a29079005ed841902aae5e1f880cbb90616adb023778789075418654d04a3cd0f9f04a4

Download Submit
C:\Windows\SysWOW64\Melnob32.exe

Filesize
97KB

MD5
22421325663c0e83d0df2e2df38180dc

SHA1
0a58b4e3d26c0272ddb5d46e3e006814f8abf5e4

SHA256
e25487548eacaf7f1247b07374aab8c00e006540c7b9e0971a883cf80844c9ab

SHA512
efa8af0f98d57b5666e29cd2a4c11f13da76eff8a1186a5238c7639e2784fc29de487ad74075d5528420394ba14740376fdf0a672c3061730c475b1b454e10e5

Download Submit
C:\Windows\SysWOW64\Melnob32.exe

Filesize
97KB

MD5
22421325663c0e83d0df2e2df38180dc

SHA1
0a58b4e3d26c0272ddb5d46e3e006814f8abf5e4

SHA256
e25487548eacaf7f1247b07374aab8c00e006540c7b9e0971a883cf80844c9ab

SHA512
efa8af0f98d57b5666e29cd2a4c11f13da76eff8a1186a5238c7639e2784fc29de487ad74075d5528420394ba14740376fdf0a672c3061730c475b1b454e10e5

Download Submit
C:\Windows\SysWOW64\Mgddhf32.exe

Filesize
97KB

MD5
8068d130f25c7f3019702e1fa13ef810

SHA1
51ffa2813f4bcd4d378492533b1ef055122f3b51

SHA256
113847e27914cd98c4e25c111330c6e92af813e90aef9b3b58492e27fcaa6d49

SHA512
77105b0d73edbd90de569be19a0a315a2650a41fc5b917352e5eaab151ac36293a75e5b48e55700ed032be1143e478d0dd40833cd5c5b96f69e59e981d5e3d12

Download Submit
C:\Windows\SysWOW64\Mgddhf32.exe

Filesize
97KB

MD5
8068d130f25c7f3019702e1fa13ef810

SHA1
51ffa2813f4bcd4d378492533b1ef055122f3b51

SHA256
113847e27914cd98c4e25c111330c6e92af813e90aef9b3b58492e27fcaa6d49

SHA512
77105b0d73edbd90de569be19a0a315a2650a41fc5b917352e5eaab151ac36293a75e5b48e55700ed032be1143e478d0dd40833cd5c5b96f69e59e981d5e3d12

Download Submit
C:\Windows\SysWOW64\Mgddhf32.exe

Filesize
97KB

MD5
ba176b4ee85a15065847be068b4394c3

SHA1
7de24af2e1b4c787b86cea41dea7d66dab2be90e

SHA256
46ad87e0acbd4787dfbe3779b64c3d794c7a8c4129a230755a308bc1bbbac31e

SHA512
362d2f94e63ebaa50671ec19f57bc9fedcce1fa895405326781a82a72a312f4fefe6ce17f3ef2443ffdcda480893dab1f141e9b0863c6f14403a778ef798e682

Download Submit
C:\Windows\SysWOW64\Mlcifmbl.exe

Filesize
97KB

MD5
5c8790299a71f80e140fd868fa5b5325

SHA1
fe1df014d896e9eb31bb902ac693ab7bcf246f15

SHA256
05fd552057b597cdc7da241b7abbae643798413ff3bbfff5798b24509539d5d7

SHA512
fa409b0c486f3861bad4ab9e38077e3f317779f3d6b26ec206f96b5c98b58211cdbd6d1e25a0ae9cc9273e46d75cdb532158279714d1435cd6273dd3f840a3d3

Download Submit
C:\Windows\SysWOW64\Mlcifmbl.exe

Filesize
97KB

MD5
5c8790299a71f80e140fd868fa5b5325

SHA1
fe1df014d896e9eb31bb902ac693ab7bcf246f15

SHA256
05fd552057b597cdc7da241b7abbae643798413ff3bbfff5798b24509539d5d7

SHA512
fa409b0c486f3861bad4ab9e38077e3f317779f3d6b26ec206f96b5c98b58211cdbd6d1e25a0ae9cc9273e46d75cdb532158279714d1435cd6273dd3f840a3d3

Download Submit
C:\Windows\SysWOW64\Mlhbal32.exe

Filesize
97KB

MD5
a23f78e5f6439fee352a7380fa47c4f3

SHA1
22be7c0fe6f5a2560ff9985db679bc0a0ae922c3

SHA256
b053b7c2521654f3fc5287544b3ea5400e1207bf557ea3d792b0bf0d2d493238

SHA512
b19fda57c975ff5640f25ba85caf284426e9bfb479508218771004a6d56be7522f7ffc935ba14542121eb236028149705fb84739464a3c8ae75c430b69510848

Download Submit
C:\Windows\SysWOW64\Mlhbal32.exe

Filesize
97KB

MD5
a23f78e5f6439fee352a7380fa47c4f3

SHA1
22be7c0fe6f5a2560ff9985db679bc0a0ae922c3

SHA256
b053b7c2521654f3fc5287544b3ea5400e1207bf557ea3d792b0bf0d2d493238

SHA512
b19fda57c975ff5640f25ba85caf284426e9bfb479508218771004a6d56be7522f7ffc935ba14542121eb236028149705fb84739464a3c8ae75c430b69510848

Download Submit
C:\Windows\SysWOW64\Mmlpoqpg.exe

Filesize
97KB

MD5
9a235c1de5885f4310eaf629c9eccd55

SHA1
5109db3d60651c541a19db124d492b1516f5b15b

SHA256
22f5f9c2acbe6c73e8d3663a823cc7d6769db6447d3c2560f1fc0e55dda7a679

SHA512
d63be174d0307d5948fe5c81d2edf3fbadd62ecb5965ddf4f1e3c84dc9afae135872806b94f21de356721224be34cf08b0deacd9cfdd24e95bad9372a83a1a9e

Download Submit
C:\Windows\SysWOW64\Mmlpoqpg.exe

Filesize
97KB

MD5
9a235c1de5885f4310eaf629c9eccd55

SHA1
5109db3d60651c541a19db124d492b1516f5b15b

SHA256
22f5f9c2acbe6c73e8d3663a823cc7d6769db6447d3c2560f1fc0e55dda7a679

SHA512
d63be174d0307d5948fe5c81d2edf3fbadd62ecb5965ddf4f1e3c84dc9afae135872806b94f21de356721224be34cf08b0deacd9cfdd24e95bad9372a83a1a9e

Download Submit
C:\Windows\SysWOW64\Mplhql32.exe

Filesize
97KB

MD5
5dd2038cc149a0a115c64d8aae1c7cd1

SHA1
c0c3623c559001a6acec340cfa5b5dd74322de42

SHA256
117a683e827d853c5c8015dfad3076fea9962629d6a0ec76d59ff9c2d3eea13c

SHA512
d490088c578dfe002c46a7b0e2321bc753c9c235db9c4c4783e43b2d72856089ad8743a7be6e83fadcd4cc1f5c392a3be38c1d9c069560f7e1682c3d6213d15e

Download Submit
C:\Windows\SysWOW64\Mplhql32.exe

Filesize
97KB

MD5
5dd2038cc149a0a115c64d8aae1c7cd1

SHA1
c0c3623c559001a6acec340cfa5b5dd74322de42

SHA256
117a683e827d853c5c8015dfad3076fea9962629d6a0ec76d59ff9c2d3eea13c

SHA512
d490088c578dfe002c46a7b0e2321bc753c9c235db9c4c4783e43b2d72856089ad8743a7be6e83fadcd4cc1f5c392a3be38c1d9c069560f7e1682c3d6213d15e

Download Submit
C:\Windows\SysWOW64\Ncdgcf32.exe

Filesize
97KB

MD5
c0a491d9ec9525d4bbdd4b13331339af

SHA1
851c1da2396345876e373028c34ef1728d5bbea9

SHA256
1240a4324a0a7c9c3933a082f4e8bc510e31fb211a506c49a8f594b6fea407fc

SHA512
1ca6fa1f4b857d0162023623345a55f8e103c0b8d7597c93b846f011de6a458298ba128aa5dcf98b249bed90cbaf1105b35fb2cef035aec8f918bcfa4e9e80df

Download Submit
C:\Windows\SysWOW64\Ncdgcf32.exe

Filesize
97KB

MD5
c0a491d9ec9525d4bbdd4b13331339af

SHA1
851c1da2396345876e373028c34ef1728d5bbea9

SHA256
1240a4324a0a7c9c3933a082f4e8bc510e31fb211a506c49a8f594b6fea407fc

SHA512
1ca6fa1f4b857d0162023623345a55f8e103c0b8d7597c93b846f011de6a458298ba128aa5dcf98b249bed90cbaf1105b35fb2cef035aec8f918bcfa4e9e80df

Download Submit
C:\Windows\SysWOW64\Ndfqbhia.exe

Filesize
97KB

MD5
e4ea624a7168e0f55714c6cc653fc2e0

SHA1
71d09ef2ab1b8c47f07e3b2a27d5a70136a42c03

SHA256
8f48314ce8b650a7f3ef94f138efb377ebf9ba7e81eaa1cdc333502a992df363

SHA512
3805f2422095b892e5a2098d12aba6403344a51d3157720f9f4aaa5a5ddc0076d51b61baba1d72d700a0c986ca718bb2fcc13525e621dd7d4eb602b0cad888cf

Download Submit
C:\Windows\SysWOW64\Ndfqbhia.exe

Filesize
97KB

MD5
e4ea624a7168e0f55714c6cc653fc2e0

SHA1
71d09ef2ab1b8c47f07e3b2a27d5a70136a42c03

SHA256
8f48314ce8b650a7f3ef94f138efb377ebf9ba7e81eaa1cdc333502a992df363

SHA512
3805f2422095b892e5a2098d12aba6403344a51d3157720f9f4aaa5a5ddc0076d51b61baba1d72d700a0c986ca718bb2fcc13525e621dd7d4eb602b0cad888cf

Download Submit
C:\Windows\SysWOW64\Nepgjaeg.exe

Filesize
97KB

MD5
afcdd6893273ce987c0c9764f7c7e020

SHA1
4c0e99a134f970f6ac751f14c8c6642e67891236

SHA256
bbfba83054d9ed797d3c30de0f85872563cce4fc657b4f4abbd8395a67d5e6fc

SHA512
e0e45e4a74bb6c64fc28dcb7a10c500b796236c69f66568079160355e13a4def1e800e6502af5ef65ef473d0a38a52dae7e6fabc16c216b4c84e953e0f45a2e6

Download Submit
C:\Windows\SysWOW64\Nepgjaeg.exe

Filesize
97KB

MD5
afcdd6893273ce987c0c9764f7c7e020

SHA1
4c0e99a134f970f6ac751f14c8c6642e67891236

SHA256
bbfba83054d9ed797d3c30de0f85872563cce4fc657b4f4abbd8395a67d5e6fc

SHA512
e0e45e4a74bb6c64fc28dcb7a10c500b796236c69f66568079160355e13a4def1e800e6502af5ef65ef473d0a38a52dae7e6fabc16c216b4c84e953e0f45a2e6

Download Submit
C:\Windows\SysWOW64\Nfgmjqop.exe

Filesize
97KB

MD5
887e6ed4af3f18ac1e7c7b13672b7ead

SHA1
e3dab7e5f0acac953a020f4d6dba780657dc0144

SHA256
19a8679c3625c92fad0c96ef6125c676b81f6aff0c1199d6e39c76cc46fb0234

SHA512
3ced26ba8f5d91b508809a3d2a7d70cee4a1e4f55b96cf6ce07fd9405c60925e2cc9c27ade1cd4c24bb1a038a49482d260d026bdb29bc2ea0112c21f24c135c1

Download Submit
C:\Windows\SysWOW64\Nfgmjqop.exe

Filesize
97KB

MD5
887e6ed4af3f18ac1e7c7b13672b7ead

SHA1
e3dab7e5f0acac953a020f4d6dba780657dc0144

SHA256
19a8679c3625c92fad0c96ef6125c676b81f6aff0c1199d6e39c76cc46fb0234

SHA512
3ced26ba8f5d91b508809a3d2a7d70cee4a1e4f55b96cf6ce07fd9405c60925e2cc9c27ade1cd4c24bb1a038a49482d260d026bdb29bc2ea0112c21f24c135c1

Download Submit
C:\Windows\SysWOW64\Nggjdc32.exe

Filesize
97KB

MD5
86458cfdecf04be9d9649669d8a25659

SHA1
aa462757fcf22469f411d169508bcfbc4a2fe604

SHA256
23d89e69acfba41883e194f3e078888aaa9607f6a60ed231a03c93295c41270d

SHA512
ce68bb2a807b4afe8a9f44a29aa1cb69f721128a518ca5a365baa5f4ed34cc214d1245bf80a246250ddc13ba0f277be680883872e53e7cefd03f32e3e76fb837

Download Submit
C:\Windows\SysWOW64\Nggjdc32.exe

Filesize
97KB

MD5
86458cfdecf04be9d9649669d8a25659

SHA1
aa462757fcf22469f411d169508bcfbc4a2fe604

SHA256
23d89e69acfba41883e194f3e078888aaa9607f6a60ed231a03c93295c41270d

SHA512
ce68bb2a807b4afe8a9f44a29aa1cb69f721128a518ca5a365baa5f4ed34cc214d1245bf80a246250ddc13ba0f277be680883872e53e7cefd03f32e3e76fb837

Download Submit
C:\Windows\SysWOW64\Njnpppkn.exe

Filesize
97KB

MD5
2df28d78c0b226ee4d454782818539dd

SHA1
e402704f463389f96c9e4811408238ff80bd35e4

SHA256
eb091bc794ae7c534cde55a003cd19d29c877d1e17c0ee76833dc54c28f2e7d0

SHA512
0aa030adaadafe7a22753fa7056c0db18eb27b2243e6fb296753d635b4bd667d0271f9e2bf7a64a84838de637aefc1554275273f6f47547943d5dce567083a38

Download Submit
C:\Windows\SysWOW64\Njnpppkn.exe

Filesize
97KB

MD5
2df28d78c0b226ee4d454782818539dd

SHA1
e402704f463389f96c9e4811408238ff80bd35e4

SHA256
eb091bc794ae7c534cde55a003cd19d29c877d1e17c0ee76833dc54c28f2e7d0

SHA512
0aa030adaadafe7a22753fa7056c0db18eb27b2243e6fb296753d635b4bd667d0271f9e2bf7a64a84838de637aefc1554275273f6f47547943d5dce567083a38

Download Submit
C:\Windows\SysWOW64\Nlaegk32.exe

Filesize
97KB

MD5
fdfae22e5a675698ca5411e6bf22e6d2

SHA1
5bd93a3e16f59737e0db881267871838e6413eb0

SHA256
ac974ec03d52934ce9084e85f4e2a4199dfa16c9b85f736a2a737b7e97465a1c

SHA512
1a9d700870706fc5d51d07b018e1b1b1491c3e2bdba5f0b33ac9a8afc306c55aeb24700b6e8c8a0ce6f37fb06cc4a9f231b9411f8028e5297b9819f924a79d90

Download Submit
C:\Windows\SysWOW64\Nlaegk32.exe

Filesize
97KB

MD5
fdfae22e5a675698ca5411e6bf22e6d2

SHA1
5bd93a3e16f59737e0db881267871838e6413eb0

SHA256
ac974ec03d52934ce9084e85f4e2a4199dfa16c9b85f736a2a737b7e97465a1c

SHA512
1a9d700870706fc5d51d07b018e1b1b1491c3e2bdba5f0b33ac9a8afc306c55aeb24700b6e8c8a0ce6f37fb06cc4a9f231b9411f8028e5297b9819f924a79d90

Download Submit
C:\Windows\SysWOW64\Nnlhfn32.exe

Filesize
97KB

MD5
bf62045e693b29b030b423c57d371766

SHA1
0a208299ab3e326516fdde880ef46298dceb89b4

SHA256
262b5ec36e2251a9d58d579621ef21358310c26af6e7646a551518d590cf1685

SHA512
4d6564e4a131364573672288320893120d292a80e9852ec04c8485286ffb9455b698e1f8b2fe614c8191f94aa397cb0651bb25b2f7f51c3f425b4af59a5eb331

Download Submit
C:\Windows\SysWOW64\Nnlhfn32.exe

Filesize
97KB

MD5
bf62045e693b29b030b423c57d371766

SHA1
0a208299ab3e326516fdde880ef46298dceb89b4

SHA256
262b5ec36e2251a9d58d579621ef21358310c26af6e7646a551518d590cf1685

SHA512
4d6564e4a131364573672288320893120d292a80e9852ec04c8485286ffb9455b698e1f8b2fe614c8191f94aa397cb0651bb25b2f7f51c3f425b4af59a5eb331

Download Submit
C:\Windows\SysWOW64\Nphhmj32.exe

Filesize
97KB

MD5
795ab08970fe97b14d3ed6b222b375ef

SHA1
a03bbde777c551ddc6baa3cd8ac33ba23b5b1a02

SHA256
b51b52f41f9031f02be962edbed901442dd6a00a9b478cb39319c63b97647c9c

SHA512
a7f00376d600a66cede52b65d2c02017e4bd7367c7acd82df93dd6cf7dd92826de767173924f841039f91bfd321fab5b177104e384fe6c0d98d5fa767554adc4

Download Submit
C:\Windows\SysWOW64\Nphhmj32.exe

Filesize
97KB

MD5
795ab08970fe97b14d3ed6b222b375ef

SHA1
a03bbde777c551ddc6baa3cd8ac33ba23b5b1a02

SHA256
b51b52f41f9031f02be962edbed901442dd6a00a9b478cb39319c63b97647c9c

SHA512
a7f00376d600a66cede52b65d2c02017e4bd7367c7acd82df93dd6cf7dd92826de767173924f841039f91bfd321fab5b177104e384fe6c0d98d5fa767554adc4

Download Submit
C:\Windows\SysWOW64\Ocbddc32.exe

Filesize
97KB

MD5
875268d5b24fe89b617eaf2690728fca

SHA1
5edff12fcf98811b8e9c6b0b9976c0a6c3d1e5b5

SHA256
773c71e541c1ac2781a4a306079818da6facf139c634704d0cdb54c28ef90fe5

SHA512
ed75aaf539825a20356ef3578b7626f154f14ff63f2c9faeb78c3189099e62a1442f411e86ea96065ffd3047003c4787189a2cb59d2e035ff37d2c2cd36d7944

Download Submit
C:\Windows\SysWOW64\Ocbddc32.exe

Filesize
97KB

MD5
875268d5b24fe89b617eaf2690728fca

SHA1
5edff12fcf98811b8e9c6b0b9976c0a6c3d1e5b5

SHA256
773c71e541c1ac2781a4a306079818da6facf139c634704d0cdb54c28ef90fe5

SHA512
ed75aaf539825a20356ef3578b7626f154f14ff63f2c9faeb78c3189099e62a1442f411e86ea96065ffd3047003c4787189a2cb59d2e035ff37d2c2cd36d7944

Download Submit
C:\Windows\SysWOW64\Odkjng32.exe

Filesize
97KB

MD5
465cd2650d66183eaf4b3a564c7a0b8b

SHA1
4474f9cf6909cbd8c6be9270059cab50db61eeea

SHA256
01edbb9e4bdad18f031dba3f2b5ea3c95719758adfa083ccd041700a17979337

SHA512
4ef13832a4830d0839ccaa48ed848c063788c9953e191a7151a77b998c9e9373e72d2c90e31ad840fc03854652b2e02d00058232ff7d5d22b0d513cf6d146fde

Download Submit
C:\Windows\SysWOW64\Odkjng32.exe

Filesize
97KB

MD5
465cd2650d66183eaf4b3a564c7a0b8b

SHA1
4474f9cf6909cbd8c6be9270059cab50db61eeea

SHA256
01edbb9e4bdad18f031dba3f2b5ea3c95719758adfa083ccd041700a17979337

SHA512
4ef13832a4830d0839ccaa48ed848c063788c9953e191a7151a77b998c9e9373e72d2c90e31ad840fc03854652b2e02d00058232ff7d5d22b0d513cf6d146fde

Download Submit
C:\Windows\SysWOW64\Odmgcgbi.exe

Filesize
97KB

MD5
d593c365db9f888550e01486e0c15b09

SHA1
36be4c51a4106435a946458ae36826813180ccbe

SHA256
668aa50375973a397a7e6cc1eab687ee0484f2127de50ff897757f92b7f880a7

SHA512
92b319eb8f278153db381520717c35e2fbc6472c277074c04716d70424130c4b9e06cd72aae596f806cb7ab8412744f9f863ca8bced0a8f49a50c8bc58b9d22b

Download Submit
C:\Windows\SysWOW64\Odmgcgbi.exe

Filesize
97KB

MD5
d593c365db9f888550e01486e0c15b09

SHA1
36be4c51a4106435a946458ae36826813180ccbe

SHA256
668aa50375973a397a7e6cc1eab687ee0484f2127de50ff897757f92b7f880a7

SHA512
92b319eb8f278153db381520717c35e2fbc6472c277074c04716d70424130c4b9e06cd72aae596f806cb7ab8412744f9f863ca8bced0a8f49a50c8bc58b9d22b

Download Submit
C:\Windows\SysWOW64\Ojgbfocc.exe

Filesize
97KB

MD5
9539f6537f1d43e8c3a4970ad1ec9788

SHA1
23067925c61305529e214bc1728341e22585f949

SHA256
4e04190f2034bcf6713c4ad42091247e1d05b3777fe77228a3987e00c29fb682

SHA512
5dec89c5ce5c4cd820f3dfbfab6ee9d840cc1e53f852c0fae4747ecbaab8c958ad9edfafe9e6c73e912ab84b1e83137f3c33d6e4126fdf354a1ac2334e36413a

Download Submit
C:\Windows\SysWOW64\Ojgbfocc.exe

Filesize
97KB

MD5
9539f6537f1d43e8c3a4970ad1ec9788

SHA1
23067925c61305529e214bc1728341e22585f949

SHA256
4e04190f2034bcf6713c4ad42091247e1d05b3777fe77228a3987e00c29fb682

SHA512
5dec89c5ce5c4cd820f3dfbfab6ee9d840cc1e53f852c0fae4747ecbaab8c958ad9edfafe9e6c73e912ab84b1e83137f3c33d6e4126fdf354a1ac2334e36413a

Download Submit
C:\Windows\SysWOW64\Oneklm32.exe

Filesize
97KB

MD5
b4d8e0de80a7de8c07b3ec7b326f43c2

SHA1
322817b8e1b1b4a29a629799b98a54a698cceec3

SHA256
038d9dcfd134ff6a50367bba4e7b05adf2496de4cea215ad7bccd2730e539505

SHA512
0dbb9592e4974ed69aba7bcae37e00873537833ecf07b30f27ba0a002556f6173cd56f71892526533585c85b6b086c630b90f9b1a9ee3ed01bb6245cf64787fd

Download Submit
C:\Windows\SysWOW64\Oneklm32.exe

Filesize
97KB

MD5
b4d8e0de80a7de8c07b3ec7b326f43c2

SHA1
322817b8e1b1b4a29a629799b98a54a698cceec3

SHA256
038d9dcfd134ff6a50367bba4e7b05adf2496de4cea215ad7bccd2730e539505

SHA512
0dbb9592e4974ed69aba7bcae37e00873537833ecf07b30f27ba0a002556f6173cd56f71892526533585c85b6b086c630b90f9b1a9ee3ed01bb6245cf64787fd

Download Submit
C:\Windows\SysWOW64\Pmdkch32.exe

Filesize
97KB

MD5
d13698f1069bc4d3bbff7e316a839bfc

SHA1
696ac512b1a3de1b3378abbcf42e1e23fad29e4b

SHA256
111b62469a7d9ae6d3d0ac20e85b347e04a5f1034a7c19fb8914322095074d20

SHA512
7ca66ebaab05bd9f1d7055f4760c9d9ba9946de471d0993eaf6100248461c0e09d4c17e38e04e4f21c0eec27b7fcd7e9ae44241bf73582180c0a51c26145872c

Download Submit
C:\Windows\SysWOW64\Poomegpf.exe

Filesize
97KB

MD5
cf587f3c63e33b6ccbfb89021c3c0ec4

SHA1
c7307d68786d660899c6b5595580f29fa03a9c04

SHA256
69848f978ed324142a0987aa85d2b199f7802532f51f9b0ac521b77ba8bb9791

SHA512
0b46a4b253a2843e3010006963274a7ee42ef32c1fb378e34f3fc4f969286ce255ef2db0d07ea2b6d51eeb5599431840a04a74dd2dec6beec132d0cae1bf6fe2

Download Submit
memory/488-424-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1060-23-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1096-224-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1208-208-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1260-292-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1320-143-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1332-314-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1388-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1396-298-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1412-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1424-262-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1552-346-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1692-442-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1708-168-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1812-95-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1924-87-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2108-394-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2160-151-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2320-340-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2364-119-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2604-388-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2772-20-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3032-247-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3152-316-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3164-406-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3208-215-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3256-255-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3344-103-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3356-231-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3468-364-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3540-159-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3616-268-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3664-430-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3712-63-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3724-55-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3760-200-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3780-334-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3792-322-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3876-71-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3908-175-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3940-274-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4052-370-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4072-286-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4100-280-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4188-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4192-196-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4216-328-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4308-47-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4344-376-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4468-39-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4532-400-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4624-239-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4644-382-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4768-352-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4776-358-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4852-111-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4900-418-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4908-436-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5044-412-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5048-184-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5052-304-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5080-136-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5100-128-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5112-31-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads