d984592d89e98ad06ac405a007dba9c80ac35dbc853e2dbcfe3df610097f4683

Analysis

max time kernel
144s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2023, 18:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.85af6c8a2f55f0299ab4d59a0bfbd300.exe
Size

55KB
MD5

85af6c8a2f55f0299ab4d59a0bfbd300
SHA1

6bd2a563692508658a6f0870dd4819996185bcbf
SHA256

d984592d89e98ad06ac405a007dba9c80ac35dbc853e2dbcfe3df610097f4683
SHA512

2e3a794258e80ee4b5521ae463e76b9d3a77acdf8686ebf8055712c5bb626e64866448b5ff7a11303ba139e2fd6facfbe0f05165d107bd5f6a1b982bb09db664
SSDEEP

1536:UygrR+VnVKpqGJX9CwxIkWBTLiMUAvlZ:UySgVnV1GJX93xIkWBTLNvlZ

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oifeab32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pcbmka32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oampjeml.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hipmfjee.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmbdbd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Phbhcmjl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kdmqmc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgjhpcmo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njedbjej.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ghaliknf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kkmioc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Anmjcieo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qhlkilba.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ilmmni32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gkgeoklj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ggahedjn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kageaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ilafiihp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Majjng32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hfhgkmpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fgcjfbed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kiphjo32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcfidb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fhbimf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdhbmh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fechomko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njhgbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fniihmpf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bnhjohkb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ofgdcipq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hcblpdgg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nomncpcg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmfplibd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bmeandma.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbpphi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aagkhd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cdkifmjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fdnjgmle.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fgcjfbed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mcecjmkl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ibnccmbo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mnhdgpii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Igjngh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fbbpmb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjpjel32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Knenkbio.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dgcihgaj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oemefcap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gochjpho.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ikokan32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lkofdbkj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Qkmdkgob.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jcanll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pdmdnadc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kemhff32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gcagkdba.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lbinam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pekbga32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gmbmkpie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fkffog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fonnop32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njciko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bffkij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ggnedlao.exe

Executes dropped EXE 64 IoCs

pid	Process
2560	Fakdpb32.exe
1700	Flqimk32.exe
4696	Fckajehi.exe
4008	Fkffog32.exe
1036	Fdnjgmle.exe
3928	Gcojed32.exe
4004	Gdqgmmjb.exe
3524	Gcagkdba.exe
3544	Ghopckpi.exe
2212	Gcddpdpo.exe
2828	Ghaliknf.exe
660	Gokdeeec.exe
3444	Gdhmnlcj.exe
1796	Gkaejf32.exe
1708	Gcimkc32.exe
4944	Hkdbpe32.exe
4020	Hfifmnij.exe
3296	Hmcojh32.exe
1844	Hflcbngh.exe
3696	Hmfkoh32.exe
5072	Hfnphn32.exe
3112	Hmhhehlb.exe
4280	Hbeqmoji.exe
2024	Ifefimom.exe
2812	Ipnjab32.exe
4336	Ifgbnlmj.exe
1124	Ildkgc32.exe
3680	Ibnccmbo.exe
4208	Iihkpg32.exe
1908	Icnpmp32.exe
2988	Iikhfg32.exe
4128	Icplcpgo.exe
3672	Jeaikh32.exe
3348	Jlkagbej.exe
2472	Jbeidl32.exe
4072	Jioaqfcc.exe
4736	Jlnnmb32.exe
1512	Jbhfjljd.exe
4532	Jmmjgejj.exe
736	Jcgbco32.exe
1640	Jehokgge.exe
5064	Jlbgha32.exe
2176	Jfhlejnh.exe
4660	Jmbdbd32.exe
4172	Kemhff32.exe
1956	Kpbmco32.exe
3828	Kfmepi32.exe
4212	Kmfmmcbo.exe
4132	Kpeiioac.exe
1620	Kbceejpf.exe
4240	Kimnbd32.exe
1572	Klljnp32.exe
4200	Kfankifm.exe
4936	Kmkfhc32.exe
4512	Kibgmdcn.exe
4700	Klqcioba.exe
380	Lffhfh32.exe
1992	Liddbc32.exe
2568	Ldjhpl32.exe
2196	Ligqhc32.exe
436	Llemdo32.exe
1476	Lfkaag32.exe
4520	Neeqea32.exe
3384	Npjebj32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Gokgpogl.dll	Qdbiedpa.exe
File created	C:\Windows\SysWOW64\Bnhjohkb.exe	Agoabn32.exe
File created	C:\Windows\SysWOW64\Jchbom32.dll	Plagcbdn.exe
File opened for modification	C:\Windows\SysWOW64\Olgncmim.exe	Oemefcap.exe
File created	C:\Windows\SysWOW64\Fjdiliki.dll	Abponp32.exe
File opened for modification	C:\Windows\SysWOW64\Lffhfh32.exe	Klqcioba.exe
File created	C:\Windows\SysWOW64\Aoimppcd.dll	Pjbkgfej.exe
File opened for modification	C:\Windows\SysWOW64\Obcceg32.exe	Ohnohn32.exe
File opened for modification	C:\Windows\SysWOW64\Apmhiq32.exe	Amnlme32.exe
File created	C:\Windows\SysWOW64\Khlaie32.dll	Mlhqcgnk.exe
File created	C:\Windows\SysWOW64\Eeanii32.dll	Jlkagbej.exe
File created	C:\Windows\SysWOW64\Cfdhkhjj.exe	Cdfkolkf.exe
File created	C:\Windows\SysWOW64\Dcbknkol.dll	Lflgmqhd.exe
File opened for modification	C:\Windows\SysWOW64\Ohqbhdpj.exe	Oebflhaf.exe
File created	C:\Windows\SysWOW64\Aqmlknnd.exe	Afghneoo.exe
File created	C:\Windows\SysWOW64\Blafme32.dll	Igdnabjh.exe
File opened for modification	C:\Windows\SysWOW64\Kmkfhc32.exe	Kfankifm.exe
File created	C:\Windows\SysWOW64\Hbpphi32.exe	Hkehkocf.exe
File created	C:\Windows\SysWOW64\Lneajdhc.dll	Jbdbjf32.exe
File opened for modification	C:\Windows\SysWOW64\Bhhiemoj.exe	Aaoaic32.exe
File opened for modification	C:\Windows\SysWOW64\Chnlgjlb.exe	Cacckp32.exe
File opened for modification	C:\Windows\SysWOW64\Bagflcje.exe	Bnhjohkb.exe
File created	C:\Windows\SysWOW64\Epjajeqo.exe	Emlenj32.exe
File created	C:\Windows\SysWOW64\Kjmfjj32.exe	Kcbnnpka.exe
File created	C:\Windows\SysWOW64\Kebkgjkg.dll	Njedbjej.exe
File created	C:\Windows\SysWOW64\Jfhlejnh.exe	Jlbgha32.exe
File created	C:\Windows\SysWOW64\Kpdboimg.exe	Keonap32.exe
File created	C:\Windows\SysWOW64\Mbenmk32.exe	Mjneln32.exe
File opened for modification	C:\Windows\SysWOW64\Qhlkilba.exe	Pocfpf32.exe
File created	C:\Windows\SysWOW64\Ckgohf32.exe	Cncnob32.exe
File opened for modification	C:\Windows\SysWOW64\Jioaqfcc.exe	Jbeidl32.exe
File opened for modification	C:\Windows\SysWOW64\Hhihdcbp.exe	Hbpphi32.exe
File created	C:\Windows\SysWOW64\Policp32.dll	Nhbfff32.exe
File created	C:\Windows\SysWOW64\Ikqqlgem.exe	Iqklon32.exe
File created	C:\Windows\SysWOW64\Foniaq32.dll	Kpqggh32.exe
File opened for modification	C:\Windows\SysWOW64\Lnqeqd32.exe	Llbidimc.exe
File created	C:\Windows\SysWOW64\Kjamidgd.dll	Aknbkjfh.exe
File created	C:\Windows\SysWOW64\Bhkfkmmg.exe	Bdojjo32.exe
File created	C:\Windows\SysWOW64\Mqfpckhm.exe	Mnhdgpii.exe
File created	C:\Windows\SysWOW64\Nkmiaf32.dll	Ngdfdmdi.exe
File created	C:\Windows\SysWOW64\Plmmif32.exe	Plkpcfal.exe
File opened for modification	C:\Windows\SysWOW64\Kckqbj32.exe	Knnhjcog.exe
File created	C:\Windows\SysWOW64\Idjlpc32.exe	Inpccihl.exe
File created	C:\Windows\SysWOW64\Ddjmba32.exe	Dnpdegjp.exe
File created	C:\Windows\SysWOW64\Qpeahb32.exe	Qjiipk32.exe
File opened for modification	C:\Windows\SysWOW64\Hiacacpg.exe	Hbgkei32.exe
File created	C:\Windows\SysWOW64\Qhngolpo.exe	Qadoba32.exe
File created	C:\Windows\SysWOW64\Bkkple32.exe	Bhldpj32.exe
File opened for modification	C:\Windows\SysWOW64\Ljeafb32.exe	Lopmii32.exe
File opened for modification	C:\Windows\SysWOW64\Fkcpql32.exe	Fclhpo32.exe
File opened for modification	C:\Windows\SysWOW64\Pmidog32.exe	Pfolbmje.exe
File opened for modification	C:\Windows\SysWOW64\Jkaqnk32.exe	Jehhaaci.exe
File created	C:\Windows\SysWOW64\Haoimcgg.exe	Hkeaqi32.exe
File created	C:\Windows\SysWOW64\Jkgpbp32.exe	Jpaleglc.exe
File opened for modification	C:\Windows\SysWOW64\Mgclpkac.exe	Meepdp32.exe
File created	C:\Windows\SysWOW64\Llcghg32.exe	Lpjjmg32.exe
File created	C:\Windows\SysWOW64\Lbjeaofg.dll	Biadeoce.exe
File created	C:\Windows\SysWOW64\Njmhhefi.exe	Nccokk32.exe
File created	C:\Windows\SysWOW64\Klplbbaq.dll	Ohhnbhok.exe
File opened for modification	C:\Windows\SysWOW64\Gbalopbn.exe	Gemkelcd.exe
File opened for modification	C:\Windows\SysWOW64\Ljnlecmp.exe	Knenkbio.exe
File opened for modification	C:\Windows\SysWOW64\Pblajhje.exe	Padnaq32.exe
File opened for modification	C:\Windows\SysWOW64\Doilmc32.exe	Dgbdlf32.exe
File created	C:\Windows\SysWOW64\Miomdk32.exe	Mbedga32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10336	8920	WerFault.exe	970

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Adgmoigj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jfhlejnh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Djgjlelk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jpaleglc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qkmdkgob.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gmfplibd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ncqlkemc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dleglm32.dll"	Ocffempp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gnjjfegi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaplji32.dll"	Mhfppabl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ecmomj32.dll"	Kageaj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nefped32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dfefkkqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cdbcfp32.dll"	Jknfcofa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ggcfja32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kelalp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cabomkll.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jcgbco32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ligqhc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hlohlk32.dll"	Aaoaic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Meickkqm.dll"	Ekngemhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Glgjlm32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njhgbp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bgpmhl32.dll"	Ifefimom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fddqghpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aplpihjd.dll"	Dakacjdb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lggldm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fhbimf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hocqam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qadoba32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dfefkkqp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nhahaiec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bhblllfo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dqnmlj32.dll"	Ijogmdqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cjkoqgjn.dll"	Glcaambb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lhkdqh32.dll"	Jlbejloe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bfhhoi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jghabl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ipgocj32.dll"	Podmkm32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qkipkani.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dkodcb32.dll"	Mnhdgpii.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aqjpajgi.dll"	Cncnob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Eeiakn32.dll"	Bagflcje.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihidlk32.dll"	Bmngqdpj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdlgcl32.dll"	Qhlkilba.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aqkgpedc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fkmjaa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oifppdpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kgkfnh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pdmdnadc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cnffqf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ijogmdqm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bfbghcbm.dll"	Miaboe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lcjcnoej.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dfbiemdb.dll"	Njpdnedf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ddpapmqq.dll"	Ddjmba32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mhanngbl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gjhilj32.dll"	Gcojed32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Olmeci32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nkiebg32.dll"	Gmeakf32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bpkdjofm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oifppdpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fnmepn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bionkjfo.dll"	Mbenmk32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2560	2416	NEAS.85af6c8a2f55f0299ab4d59a0bfbd300.exe	82
PID 2416 wrote to memory of 2560	2416	NEAS.85af6c8a2f55f0299ab4d59a0bfbd300.exe	82
PID 2416 wrote to memory of 2560	2416	NEAS.85af6c8a2f55f0299ab4d59a0bfbd300.exe	82
PID 2560 wrote to memory of 1700	2560	Fakdpb32.exe	83
PID 2560 wrote to memory of 1700	2560	Fakdpb32.exe	83
PID 2560 wrote to memory of 1700	2560	Fakdpb32.exe	83
PID 1700 wrote to memory of 4696	1700	Flqimk32.exe	84
PID 1700 wrote to memory of 4696	1700	Flqimk32.exe	84
PID 1700 wrote to memory of 4696	1700	Flqimk32.exe	84
PID 4696 wrote to memory of 4008	4696	Fckajehi.exe	86
PID 4696 wrote to memory of 4008	4696	Fckajehi.exe	86
PID 4696 wrote to memory of 4008	4696	Fckajehi.exe	86
PID 4008 wrote to memory of 1036	4008	Fkffog32.exe	87
PID 4008 wrote to memory of 1036	4008	Fkffog32.exe	87
PID 4008 wrote to memory of 1036	4008	Fkffog32.exe	87
PID 1036 wrote to memory of 3928	1036	Fdnjgmle.exe	88
PID 1036 wrote to memory of 3928	1036	Fdnjgmle.exe	88
PID 1036 wrote to memory of 3928	1036	Fdnjgmle.exe	88
PID 3928 wrote to memory of 4004	3928	Gcojed32.exe	89
PID 3928 wrote to memory of 4004	3928	Gcojed32.exe	89
PID 3928 wrote to memory of 4004	3928	Gcojed32.exe	89
PID 4004 wrote to memory of 3524	4004	Gdqgmmjb.exe	90
PID 4004 wrote to memory of 3524	4004	Gdqgmmjb.exe	90
PID 4004 wrote to memory of 3524	4004	Gdqgmmjb.exe	90
PID 3524 wrote to memory of 3544	3524	Gcagkdba.exe	91
PID 3524 wrote to memory of 3544	3524	Gcagkdba.exe	91
PID 3524 wrote to memory of 3544	3524	Gcagkdba.exe	91
PID 3544 wrote to memory of 2212	3544	Ghopckpi.exe	92
PID 3544 wrote to memory of 2212	3544	Ghopckpi.exe	92
PID 3544 wrote to memory of 2212	3544	Ghopckpi.exe	92
PID 2212 wrote to memory of 2828	2212	Gcddpdpo.exe	93
PID 2212 wrote to memory of 2828	2212	Gcddpdpo.exe	93
PID 2212 wrote to memory of 2828	2212	Gcddpdpo.exe	93
PID 2828 wrote to memory of 660	2828	Ghaliknf.exe	94
PID 2828 wrote to memory of 660	2828	Ghaliknf.exe	94
PID 2828 wrote to memory of 660	2828	Ghaliknf.exe	94
PID 660 wrote to memory of 3444	660	Gokdeeec.exe	95
PID 660 wrote to memory of 3444	660	Gokdeeec.exe	95
PID 660 wrote to memory of 3444	660	Gokdeeec.exe	95
PID 3444 wrote to memory of 1796	3444	Gdhmnlcj.exe	96
PID 3444 wrote to memory of 1796	3444	Gdhmnlcj.exe	96
PID 3444 wrote to memory of 1796	3444	Gdhmnlcj.exe	96
PID 1796 wrote to memory of 1708	1796	Gkaejf32.exe	97
PID 1796 wrote to memory of 1708	1796	Gkaejf32.exe	97
PID 1796 wrote to memory of 1708	1796	Gkaejf32.exe	97
PID 1708 wrote to memory of 4944	1708	Gcimkc32.exe	98
PID 1708 wrote to memory of 4944	1708	Gcimkc32.exe	98
PID 1708 wrote to memory of 4944	1708	Gcimkc32.exe	98
PID 4944 wrote to memory of 4020	4944	Hkdbpe32.exe	99
PID 4944 wrote to memory of 4020	4944	Hkdbpe32.exe	99
PID 4944 wrote to memory of 4020	4944	Hkdbpe32.exe	99
PID 4020 wrote to memory of 3296	4020	Hfifmnij.exe	100
PID 4020 wrote to memory of 3296	4020	Hfifmnij.exe	100
PID 4020 wrote to memory of 3296	4020	Hfifmnij.exe	100
PID 3296 wrote to memory of 1844	3296	Hmcojh32.exe	101
PID 3296 wrote to memory of 1844	3296	Hmcojh32.exe	101
PID 3296 wrote to memory of 1844	3296	Hmcojh32.exe	101
PID 1844 wrote to memory of 3696	1844	Hflcbngh.exe	102
PID 1844 wrote to memory of 3696	1844	Hflcbngh.exe	102
PID 1844 wrote to memory of 3696	1844	Hflcbngh.exe	102
PID 3696 wrote to memory of 5072	3696	Hmfkoh32.exe	103
PID 3696 wrote to memory of 5072	3696	Hmfkoh32.exe	103
PID 3696 wrote to memory of 5072	3696	Hmfkoh32.exe	103
PID 5072 wrote to memory of 3112	5072	Hfnphn32.exe	104

C:\Users\Admin\AppData\Local\Temp\NEAS.85af6c8a2f55f0299ab4d59a0bfbd300.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.85af6c8a2f55f0299ab4d59a0bfbd300.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Windows\SysWOW64\Fakdpb32.exe
  C:\Windows\system32\Fakdpb32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\SysWOW64\Flqimk32.exe
    C:\Windows\system32\Flqimk32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1700
  - - C:\Windows\SysWOW64\Fckajehi.exe
      C:\Windows\system32\Fckajehi.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4696
    - - C:\Windows\SysWOW64\Fkffog32.exe
        
        C:\Windows\system32\Fkffog32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4008
      - C:\Windows\SysWOW64\Fdnjgmle.exe
        
        C:\Windows\system32\Fdnjgmle.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1036
        
        C:\Windows\SysWOW64\Gcojed32.exe
        
        C:\Windows\system32\Gcojed32.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\SysWOW64\Gdqgmmjb.exe
        
        C:\Windows\system32\Gdqgmmjb.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4004
        
        C:\Windows\SysWOW64\Gcagkdba.exe
        
        C:\Windows\system32\Gcagkdba.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3524
        
        C:\Windows\SysWOW64\Ghopckpi.exe
        
        C:\Windows\system32\Ghopckpi.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3544
        
        C:\Windows\SysWOW64\Gcddpdpo.exe
        
        C:\Windows\system32\Gcddpdpo.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\SysWOW64\Ghaliknf.exe
        
        C:\Windows\system32\Ghaliknf.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2828
        
        C:\Windows\SysWOW64\Gokdeeec.exe
        
        C:\Windows\system32\Gokdeeec.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:660
        
        C:\Windows\SysWOW64\Gdhmnlcj.exe
        
        C:\Windows\system32\Gdhmnlcj.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3444
        
        C:\Windows\SysWOW64\Gkaejf32.exe
        
        C:\Windows\system32\Gkaejf32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1796
        
        C:\Windows\SysWOW64\Gcimkc32.exe
        
        C:\Windows\system32\Gcimkc32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1708
        
        C:\Windows\SysWOW64\Hkdbpe32.exe
        
        C:\Windows\system32\Hkdbpe32.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4944
        
        C:\Windows\SysWOW64\Hfifmnij.exe
        
        C:\Windows\system32\Hfifmnij.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4020
        
        C:\Windows\SysWOW64\Hmcojh32.exe
        
        C:\Windows\system32\Hmcojh32.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3296
        
        C:\Windows\SysWOW64\Hflcbngh.exe
        
        C:\Windows\system32\Hflcbngh.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1844
        
        C:\Windows\SysWOW64\Hmfkoh32.exe
        
        C:\Windows\system32\Hmfkoh32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3696
        
        C:\Windows\SysWOW64\Hfnphn32.exe
        
        C:\Windows\system32\Hfnphn32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5072
        
        C:\Windows\SysWOW64\Hmhhehlb.exe
        
        C:\Windows\system32\Hmhhehlb.exe
        23⤵
        Executes dropped EXE
        
        PID:3112
        
        C:\Windows\SysWOW64\Hbeqmoji.exe
        
        C:\Windows\system32\Hbeqmoji.exe
        24⤵
        Executes dropped EXE
        
        PID:4280
        
        C:\Windows\SysWOW64\Ifefimom.exe
        
        C:\Windows\system32\Ifefimom.exe
        25⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2024
        
        C:\Windows\SysWOW64\Ipnjab32.exe
        
        C:\Windows\system32\Ipnjab32.exe
        26⤵
        Executes dropped EXE
        
        PID:2812
        
        C:\Windows\SysWOW64\Ifgbnlmj.exe
        
        C:\Windows\system32\Ifgbnlmj.exe
        27⤵
        Executes dropped EXE
        
        PID:4336
        
        C:\Windows\SysWOW64\Ildkgc32.exe
        
        C:\Windows\system32\Ildkgc32.exe
        28⤵
        Executes dropped EXE
        
        PID:1124
        
        C:\Windows\SysWOW64\Ibnccmbo.exe
        
        C:\Windows\system32\Ibnccmbo.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3680
        
        C:\Windows\SysWOW64\Iihkpg32.exe
        
        C:\Windows\system32\Iihkpg32.exe
        30⤵
        Executes dropped EXE
        
        PID:4208
        
        C:\Windows\SysWOW64\Icnpmp32.exe
        
        C:\Windows\system32\Icnpmp32.exe
        31⤵
        Executes dropped EXE
        
        PID:1908
        
        C:\Windows\SysWOW64\Iikhfg32.exe
        
        C:\Windows\system32\Iikhfg32.exe
        32⤵
        Executes dropped EXE
        
        PID:2988
        
        C:\Windows\SysWOW64\Icplcpgo.exe
        
        C:\Windows\system32\Icplcpgo.exe
        33⤵
        Executes dropped EXE
        
        PID:4128
        
        C:\Windows\SysWOW64\Jeaikh32.exe
        
        C:\Windows\system32\Jeaikh32.exe
        34⤵
        Executes dropped EXE
        
        PID:3672
        
        C:\Windows\SysWOW64\Jlkagbej.exe
        
        C:\Windows\system32\Jlkagbej.exe
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3348
        
        C:\Windows\SysWOW64\Jbeidl32.exe
        
        C:\Windows\system32\Jbeidl32.exe
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2472
        
        C:\Windows\SysWOW64\Jioaqfcc.exe
        
        C:\Windows\system32\Jioaqfcc.exe
        37⤵
        Executes dropped EXE
        
        PID:4072
        
        C:\Windows\SysWOW64\Jlnnmb32.exe
        
        C:\Windows\system32\Jlnnmb32.exe
        38⤵
        Executes dropped EXE
        
        PID:4736
        
        C:\Windows\SysWOW64\Jbhfjljd.exe
        
        C:\Windows\system32\Jbhfjljd.exe
        39⤵
        Executes dropped EXE
        
        PID:1512
        
        C:\Windows\SysWOW64\Jmmjgejj.exe
        
        C:\Windows\system32\Jmmjgejj.exe
        40⤵
        Executes dropped EXE
        
        PID:4532
        
        C:\Windows\SysWOW64\Jcgbco32.exe
        
        C:\Windows\system32\Jcgbco32.exe
        41⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:736
        
        C:\Windows\SysWOW64\Jehokgge.exe
        
        C:\Windows\system32\Jehokgge.exe
        42⤵
        Executes dropped EXE
        
        PID:1640
        
        C:\Windows\SysWOW64\Jlbgha32.exe
        
        C:\Windows\system32\Jlbgha32.exe
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:5064
        
        C:\Windows\SysWOW64\Jfhlejnh.exe
        
        C:\Windows\system32\Jfhlejnh.exe
        44⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2176
        
        C:\Windows\SysWOW64\Jmbdbd32.exe
        
        C:\Windows\system32\Jmbdbd32.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4660
        
        C:\Windows\SysWOW64\Kemhff32.exe
        
        C:\Windows\system32\Kemhff32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:4172
        
        C:\Windows\SysWOW64\Kpbmco32.exe
        
        C:\Windows\system32\Kpbmco32.exe
        47⤵
        Executes dropped EXE
        
        PID:1956
        
        C:\Windows\SysWOW64\Kfmepi32.exe
        
        C:\Windows\system32\Kfmepi32.exe
        48⤵
        Executes dropped EXE
        
        PID:3828
        
        C:\Windows\SysWOW64\Kmfmmcbo.exe
        
        C:\Windows\system32\Kmfmmcbo.exe
        49⤵
        Executes dropped EXE
        
        PID:4212
        
        C:\Windows\SysWOW64\Kpeiioac.exe
        
        C:\Windows\system32\Kpeiioac.exe
        50⤵
        Executes dropped EXE
        
        PID:4132
        
        C:\Windows\SysWOW64\Kbceejpf.exe
        
        C:\Windows\system32\Kbceejpf.exe
        51⤵
        Executes dropped EXE
        
        PID:1620
        
        C:\Windows\SysWOW64\Kimnbd32.exe
        
        C:\Windows\system32\Kimnbd32.exe
        52⤵
        Executes dropped EXE
        
        PID:4240
        
        C:\Windows\SysWOW64\Klljnp32.exe
        
        C:\Windows\system32\Klljnp32.exe
        53⤵
        Executes dropped EXE
        
        PID:1572
        
        C:\Windows\SysWOW64\Kfankifm.exe
        
        C:\Windows\system32\Kfankifm.exe
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4200
        
        C:\Windows\SysWOW64\Kmkfhc32.exe
        
        C:\Windows\system32\Kmkfhc32.exe
        55⤵
        Executes dropped EXE
        
        PID:4936
        
        C:\Windows\SysWOW64\Kibgmdcn.exe
        
        C:\Windows\system32\Kibgmdcn.exe
        56⤵
        Executes dropped EXE
        
        PID:4512
        
        C:\Windows\SysWOW64\Klqcioba.exe
        
        C:\Windows\system32\Klqcioba.exe
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4700
        
        C:\Windows\SysWOW64\Lffhfh32.exe
        
        C:\Windows\system32\Lffhfh32.exe
        58⤵
        Executes dropped EXE
        
        PID:380
        
        C:\Windows\SysWOW64\Liddbc32.exe
        
        C:\Windows\system32\Liddbc32.exe
        59⤵
        Executes dropped EXE
        
        PID:1992
        
        C:\Windows\SysWOW64\Ldjhpl32.exe
        
        C:\Windows\system32\Ldjhpl32.exe
        60⤵
        Executes dropped EXE
        
        PID:2568
        
        C:\Windows\SysWOW64\Ligqhc32.exe
        
        C:\Windows\system32\Ligqhc32.exe
        61⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2196
        
        C:\Windows\SysWOW64\Llemdo32.exe
        
        C:\Windows\system32\Llemdo32.exe
        62⤵
        Executes dropped EXE
        
        PID:436
        
        C:\Windows\SysWOW64\Lfkaag32.exe
        
        C:\Windows\system32\Lfkaag32.exe
        63⤵
        Executes dropped EXE
        
        PID:1476
        
        C:\Windows\SysWOW64\Neeqea32.exe
        
        C:\Windows\system32\Neeqea32.exe
        64⤵
        Executes dropped EXE
        
        PID:4520
        
        C:\Windows\SysWOW64\Npjebj32.exe
        
        C:\Windows\system32\Npjebj32.exe
        65⤵
        Executes dropped EXE
        
        PID:3384
        
        C:\Windows\SysWOW64\Ncianepl.exe
        
        C:\Windows\system32\Ncianepl.exe
        66⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\Njciko32.exe
        
        C:\Windows\system32\Njciko32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5060
        
        C:\Windows\SysWOW64\Nlaegk32.exe
        
        C:\Windows\system32\Nlaegk32.exe
        68⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\Ndhmhh32.exe
        
        C:\Windows\system32\Ndhmhh32.exe
        69⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\Nggjdc32.exe
        
        C:\Windows\system32\Nggjdc32.exe
        70⤵
        
        PID:3640
        
        C:\Windows\SysWOW64\Njefqo32.exe
        
        C:\Windows\system32\Njefqo32.exe
        71⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\Odkjng32.exe
        
        C:\Windows\system32\Odkjng32.exe
        72⤵
        
        PID:2292
        
        C:\Windows\SysWOW64\Ogifjcdp.exe
        
        C:\Windows\system32\Ogifjcdp.exe
        73⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Ojgbfocc.exe
        
        C:\Windows\system32\Ojgbfocc.exe
        74⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\Ogkcpbam.exe
        
        C:\Windows\system32\Ogkcpbam.exe
        75⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\Olhlhjpd.exe
        
        C:\Windows\system32\Olhlhjpd.exe
        76⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\Odocigqg.exe
        
        C:\Windows\system32\Odocigqg.exe
        77⤵
        
        PID:2268
        
        C:\Windows\SysWOW64\Onhhamgg.exe
        
        C:\Windows\system32\Onhhamgg.exe
        78⤵
        
        PID:676
        
        C:\Windows\SysWOW64\Oqfdnhfk.exe
        
        C:\Windows\system32\Oqfdnhfk.exe
        79⤵
        
        PID:4996
        
        C:\Windows\SysWOW64\Ojoign32.exe
        
        C:\Windows\system32\Ojoign32.exe
        80⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Olmeci32.exe
        
        C:\Windows\system32\Olmeci32.exe
        81⤵
        Modifies registry class
        
        PID:2852
        
        C:\Windows\SysWOW64\Ocgmpccl.exe
        
        C:\Windows\system32\Ocgmpccl.exe
        82⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\Ojaelm32.exe
        
        C:\Windows\system32\Ojaelm32.exe
        83⤵
        
        PID:3012
        
        C:\Windows\SysWOW64\Pqknig32.exe
        
        C:\Windows\system32\Pqknig32.exe
        84⤵
        
        PID:4120
        
        C:\Windows\SysWOW64\Pcijeb32.exe
        
        C:\Windows\system32\Pcijeb32.exe
        85⤵
        
        PID:1172
        
        C:\Windows\SysWOW64\Pjcbbmif.exe
        
        C:\Windows\system32\Pjcbbmif.exe
        86⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\Pqmjog32.exe
        
        C:\Windows\system32\Pqmjog32.exe
        87⤵
        
        PID:1760
        
        C:\Windows\SysWOW64\Pclgkb32.exe
        
        C:\Windows\system32\Pclgkb32.exe
        88⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\Pfjcgn32.exe
        
        C:\Windows\system32\Pfjcgn32.exe
        89⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\Pmdkch32.exe
        
        C:\Windows\system32\Pmdkch32.exe
        90⤵
        
        PID:4640
        
        C:\Windows\SysWOW64\Pcncpbmd.exe
        
        C:\Windows\system32\Pcncpbmd.exe
        91⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\Pjhlml32.exe
        
        C:\Windows\system32\Pjhlml32.exe
        92⤵
        
        PID:812
        
        C:\Windows\SysWOW64\Pmfhig32.exe
        
        C:\Windows\system32\Pmfhig32.exe
        93⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\Pcppfaka.exe
        
        C:\Windows\system32\Pcppfaka.exe
        94⤵
        
        PID:2916
        
        C:\Windows\SysWOW64\Pfolbmje.exe
        
        C:\Windows\system32\Pfolbmje.exe
        95⤵
        Drops file in System32 directory
        
        PID:3824
        
        C:\Windows\SysWOW64\Pmidog32.exe
        
        C:\Windows\system32\Pmidog32.exe
        96⤵
        
        PID:1712
        
        C:\Windows\SysWOW64\Pcbmka32.exe
        
        C:\Windows\system32\Pcbmka32.exe
        97⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4368
        
        C:\Windows\SysWOW64\Qnhahj32.exe
        
        C:\Windows\system32\Qnhahj32.exe
        98⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\Qdbiedpa.exe
        
        C:\Windows\system32\Qdbiedpa.exe
        99⤵
        Drops file in System32 directory
        
        PID:5184
        
        C:\Windows\SysWOW64\Qfcfml32.exe
        
        C:\Windows\system32\Qfcfml32.exe
        100⤵
        
        PID:5224
        
        C:\Windows\SysWOW64\Qnjnnj32.exe
        
        C:\Windows\system32\Qnjnnj32.exe
        101⤵
        
        PID:5276
        
        C:\Windows\SysWOW64\Qqijje32.exe
        
        C:\Windows\system32\Qqijje32.exe
        102⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Qgcbgo32.exe
        
        C:\Windows\system32\Qgcbgo32.exe
        103⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Anmjcieo.exe
        
        C:\Windows\system32\Anmjcieo.exe
        104⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5444
        
        C:\Windows\SysWOW64\Aqkgpedc.exe
        
        C:\Windows\system32\Aqkgpedc.exe
        105⤵
        Modifies registry class
        
        PID:5504
        
        C:\Windows\SysWOW64\Ageolo32.exe
        
        C:\Windows\system32\Ageolo32.exe
        106⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Ajckij32.exe
        
        C:\Windows\system32\Ajckij32.exe
        107⤵
        
        PID:5596
        
        C:\Windows\SysWOW64\Ambgef32.exe
        
        C:\Windows\system32\Ambgef32.exe
        108⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Aclpap32.exe
        
        C:\Windows\system32\Aclpap32.exe
        109⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Ajfhnjhq.exe
        
        C:\Windows\system32\Ajfhnjhq.exe
        110⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Aqppkd32.exe
        
        C:\Windows\system32\Aqppkd32.exe
        111⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Agjhgngj.exe
        
        C:\Windows\system32\Agjhgngj.exe
        112⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Andqdh32.exe
        
        C:\Windows\system32\Andqdh32.exe
        113⤵
        
        PID:5928
        
        C:\Windows\SysWOW64\Aabmqd32.exe
        
        C:\Windows\system32\Aabmqd32.exe
        114⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Afoeiklb.exe
        
        C:\Windows\system32\Afoeiklb.exe
        115⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Aminee32.exe
        
        C:\Windows\system32\Aminee32.exe
        116⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Agoabn32.exe
        
        C:\Windows\system32\Agoabn32.exe
        117⤵
        Drops file in System32 directory
        
        PID:6116
        
        C:\Windows\SysWOW64\Bnhjohkb.exe
        
        C:\Windows\system32\Bnhjohkb.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2544
        
        C:\Windows\SysWOW64\Bagflcje.exe
        
        C:\Windows\system32\Bagflcje.exe
        119⤵
        Modifies registry class
        
        PID:5204
        
        C:\Windows\SysWOW64\Bcebhoii.exe
        
        C:\Windows\system32\Bcebhoii.exe
        120⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\Bfdodjhm.exe
        
        C:\Windows\system32\Bfdodjhm.exe
        121⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Bmngqdpj.exe
        
        C:\Windows\system32\Bmngqdpj.exe
        122⤵
        Modifies registry class
        
        PID:5484
        
        C:\Windows\SysWOW64\Beeoaapl.exe
        
        C:\Windows\system32\Beeoaapl.exe
        123⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Bffkij32.exe
        
        C:\Windows\system32\Bffkij32.exe
        124⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5656
        
        C:\Windows\SysWOW64\Balpgb32.exe
        
        C:\Windows\system32\Balpgb32.exe
        125⤵
        
        PID:5740
        
        C:\Windows\SysWOW64\Bfhhoi32.exe
        
        C:\Windows\system32\Bfhhoi32.exe
        126⤵
        Modifies registry class
        
        PID:5868
        
        C:\Windows\SysWOW64\Bmbplc32.exe
        
        C:\Windows\system32\Bmbplc32.exe
        127⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Bclhhnca.exe
        
        C:\Windows\system32\Bclhhnca.exe
        128⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Bfkedibe.exe
        
        C:\Windows\system32\Bfkedibe.exe
        129⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Belebq32.exe
        
        C:\Windows\system32\Belebq32.exe
        130⤵
        
        PID:5148
        
        C:\Windows\SysWOW64\Chjaol32.exe
        
        C:\Windows\system32\Chjaol32.exe
        131⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Cndikf32.exe
        
        C:\Windows\system32\Cndikf32.exe
        132⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Cenahpha.exe
        
        C:\Windows\system32\Cenahpha.exe
        133⤵
        
        PID:5532
        
        C:\Windows\SysWOW64\Cfpnph32.exe
        
        C:\Windows\system32\Cfpnph32.exe
        134⤵
        
        PID:5680
        
        C:\Windows\SysWOW64\Cnffqf32.exe
        
        C:\Windows\system32\Cnffqf32.exe
        135⤵
        Modifies registry class
        
        PID:5892
        
        C:\Windows\SysWOW64\Ceqnmpfo.exe
        
        C:\Windows\system32\Ceqnmpfo.exe
        136⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Chokikeb.exe
        
        C:\Windows\system32\Chokikeb.exe
        137⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Cnicfe32.exe
        
        C:\Windows\system32\Cnicfe32.exe
        138⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Cagobalc.exe
        
        C:\Windows\system32\Cagobalc.exe
        139⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Cdfkolkf.exe
        
        C:\Windows\system32\Cdfkolkf.exe
        140⤵
        Drops file in System32 directory
        
        PID:5744
        
        C:\Windows\SysWOW64\Cfdhkhjj.exe
        
        C:\Windows\system32\Cfdhkhjj.exe
        141⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Cmnpgb32.exe
        
        C:\Windows\system32\Cmnpgb32.exe
        142⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Chcddk32.exe
        
        C:\Windows\system32\Chcddk32.exe
        143⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Cnnlaehj.exe
        
        C:\Windows\system32\Cnnlaehj.exe
        144⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Ddjejl32.exe
        
        C:\Windows\system32\Ddjejl32.exe
        145⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Djdmffnn.exe
        
        C:\Windows\system32\Djdmffnn.exe
        146⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Dejacond.exe
        
        C:\Windows\system32\Dejacond.exe
        147⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Dhhnpjmh.exe
        
        C:\Windows\system32\Dhhnpjmh.exe
        148⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Djgjlelk.exe
        
        C:\Windows\system32\Djgjlelk.exe
        149⤵
        Modifies registry class
        
        PID:6100
        
        C:\Windows\SysWOW64\Delnin32.exe
        
        C:\Windows\system32\Delnin32.exe
        150⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Dhkjej32.exe
        
        C:\Windows\system32\Dhkjej32.exe
        151⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Dkifae32.exe
        
        C:\Windows\system32\Dkifae32.exe
        152⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Daconoae.exe
        
        C:\Windows\system32\Daconoae.exe
        153⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Dhmgki32.exe
        
        C:\Windows\system32\Dhmgki32.exe
        154⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Dkkcge32.exe
        
        C:\Windows\system32\Dkkcge32.exe
        155⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Daekdooc.exe
        
        C:\Windows\system32\Daekdooc.exe
        156⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Dddhpjof.exe
        
        C:\Windows\system32\Dddhpjof.exe
        157⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\Dgbdlf32.exe
        
        C:\Windows\system32\Dgbdlf32.exe
        158⤵
        Drops file in System32 directory
        
        PID:6520
        
        C:\Windows\SysWOW64\Doilmc32.exe
        
        C:\Windows\system32\Doilmc32.exe
        159⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Eecdjmfi.exe
        
        C:\Windows\system32\Eecdjmfi.exe
        160⤵
        
        PID:6620
        
        C:\Windows\SysWOW64\Ehapfiem.exe
        
        C:\Windows\system32\Ehapfiem.exe
        161⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Ekpmbddq.exe
        
        C:\Windows\system32\Ekpmbddq.exe
        162⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Eajeon32.exe
        
        C:\Windows\system32\Eajeon32.exe
        163⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Ehdmlhcj.exe
        
        C:\Windows\system32\Ehdmlhcj.exe
        164⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Eonehbjg.exe
        
        C:\Windows\system32\Eonehbjg.exe
        165⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Foghnabl.exe
        
        C:\Windows\system32\Foghnabl.exe
        166⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Fafdkmap.exe
        
        C:\Windows\system32\Fafdkmap.exe
        167⤵
        
        PID:6948
        
        C:\Windows\SysWOW64\Fddqghpd.exe
        
        C:\Windows\system32\Fddqghpd.exe
        168⤵
        Modifies registry class
        
        PID:7000
        
        C:\Windows\SysWOW64\Fgbmccpg.exe
        
        C:\Windows\system32\Fgbmccpg.exe
        169⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Fnmepn32.exe
        
        C:\Windows\system32\Fnmepn32.exe
        170⤵
        Modifies registry class
        
        PID:7096
        
        C:\Windows\SysWOW64\Fedmqk32.exe
        
        C:\Windows\system32\Fedmqk32.exe
        171⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Fhbimf32.exe
        
        C:\Windows\system32\Fhbimf32.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6080
        
        C:\Windows\SysWOW64\Folaiqng.exe
        
        C:\Windows\system32\Folaiqng.exe
        173⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Fajnfl32.exe
        
        C:\Windows\system32\Fajnfl32.exe
        174⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\Fdijbg32.exe
        
        C:\Windows\system32\Fdijbg32.exe
        175⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Fonnop32.exe
        
        C:\Windows\system32\Fonnop32.exe
        176⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6388
        
        C:\Windows\SysWOW64\Fehfljca.exe
        
        C:\Windows\system32\Fehfljca.exe
        177⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Fhgbhfbe.exe
        
        C:\Windows\system32\Fhgbhfbe.exe
        178⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\Fnckpmql.exe
        
        C:\Windows\system32\Fnckpmql.exe
        179⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Gekcaj32.exe
        
        C:\Windows\system32\Gekcaj32.exe
        180⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Gglpibgm.exe
        
        C:\Windows\system32\Gglpibgm.exe
        181⤵
        
        PID:6744
        
        C:\Windows\SysWOW64\Gochjpho.exe
        
        C:\Windows\system32\Gochjpho.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6816
        
        C:\Windows\SysWOW64\Gaadfkgc.exe
        
        C:\Windows\system32\Gaadfkgc.exe
        183⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Gdppbfff.exe
        
        C:\Windows\system32\Gdppbfff.exe
        184⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\Goedpofl.exe
        
        C:\Windows\system32\Goedpofl.exe
        185⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Gepmlimi.exe
        
        C:\Windows\system32\Gepmlimi.exe
        186⤵
        
        PID:7132
        
        C:\Windows\SysWOW64\Ggqida32.exe
        
        C:\Windows\system32\Ggqida32.exe
        187⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Gnkaalkd.exe
        
        C:\Windows\system32\Gnkaalkd.exe
        188⤵
        
        PID:464
        
        C:\Windows\SysWOW64\Gfbibikg.exe
        
        C:\Windows\system32\Gfbibikg.exe
        189⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Ggcfja32.exe
        
        C:\Windows\system32\Ggcfja32.exe
        190⤵
        Modifies registry class
        
        PID:6460
        
        C:\Windows\SysWOW64\Hakgmjoh.exe
        
        C:\Windows\system32\Hakgmjoh.exe
        191⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Hdicienl.exe
        
        C:\Windows\system32\Hdicienl.exe
        192⤵
        
        PID:6696
        
        C:\Windows\SysWOW64\Hkckeo32.exe
        
        C:\Windows\system32\Hkckeo32.exe
        193⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Hbmcbime.exe
        
        C:\Windows\system32\Hbmcbime.exe
        194⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Hdlpneli.exe
        
        C:\Windows\system32\Hdlpneli.exe
        195⤵
        
        PID:7012
        
        C:\Windows\SysWOW64\Hkehkocf.exe
        
        C:\Windows\system32\Hkehkocf.exe
        196⤵
        Drops file in System32 directory
        
        PID:7108
        
        C:\Windows\SysWOW64\Hbpphi32.exe
        
        C:\Windows\system32\Hbpphi32.exe
        197⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6176
        
        C:\Windows\SysWOW64\Hhihdcbp.exe
        
        C:\Windows\system32\Hhihdcbp.exe
        198⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Hocqam32.exe
        
        C:\Windows\system32\Hocqam32.exe
        199⤵
        Modifies registry class
        
        PID:6408
        
        C:\Windows\SysWOW64\Hfningai.exe
        
        C:\Windows\system32\Hfningai.exe
        200⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Hfpecg32.exe
        
        C:\Windows\system32\Hfpecg32.exe
        201⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Inkjhi32.exe
        
        C:\Windows\system32\Inkjhi32.exe
        202⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Ikokan32.exe
        
        C:\Windows\system32\Ikokan32.exe
        203⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7036
        
        C:\Windows\SysWOW64\Inmgmijo.exe
        
        C:\Windows\system32\Inmgmijo.exe
        204⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Ifdonfka.exe
        
        C:\Windows\system32\Ifdonfka.exe
        205⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Iickkbje.exe
        
        C:\Windows\system32\Iickkbje.exe
        206⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Ikaggmii.exe
        
        C:\Windows\system32\Ikaggmii.exe
        207⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\Inpccihl.exe
        
        C:\Windows\system32\Inpccihl.exe
        208⤵
        Drops file in System32 directory
        
        PID:4444
        
        C:\Windows\SysWOW64\Idjlpc32.exe
        
        C:\Windows\system32\Idjlpc32.exe
        209⤵
        
        PID:7076
        
        C:\Windows\SysWOW64\Ighhln32.exe
        
        C:\Windows\system32\Ighhln32.exe
        210⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Inbqhhfj.exe
        
        C:\Windows\system32\Inbqhhfj.exe
        211⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\Ieliebnf.exe
        
        C:\Windows\system32\Ieliebnf.exe
        212⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Igjeanmj.exe
        
        C:\Windows\system32\Igjeanmj.exe
        213⤵
        
        PID:6644
        
        C:\Windows\SysWOW64\Ibpiogmp.exe
        
        C:\Windows\system32\Ibpiogmp.exe
        214⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Ienekbld.exe
        
        C:\Windows\system32\Ienekbld.exe
        215⤵
        
        PID:6964
        
        C:\Windows\SysWOW64\Jkhngl32.exe
        
        C:\Windows\system32\Jkhngl32.exe
        216⤵
        
        PID:2412
        
        C:\Windows\SysWOW64\Jngjch32.exe
        
        C:\Windows\system32\Jngjch32.exe
        217⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Jeqbpb32.exe
        
        C:\Windows\system32\Jeqbpb32.exe
        218⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Jgonlm32.exe
        
        C:\Windows\system32\Jgonlm32.exe
        219⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Jbdbjf32.exe
        
        C:\Windows\system32\Jbdbjf32.exe
        220⤵
        Drops file in System32 directory
        
        PID:7308
        
        C:\Windows\SysWOW64\Joiccj32.exe
        
        C:\Windows\system32\Joiccj32.exe
        221⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Jnkcogno.exe
        
        C:\Windows\system32\Jnkcogno.exe
        222⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Jfbkpd32.exe
        
        C:\Windows\system32\Jfbkpd32.exe
        223⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Jiaglp32.exe
        
        C:\Windows\system32\Jiaglp32.exe
        224⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Jpkphjeb.exe
        
        C:\Windows\system32\Jpkphjeb.exe
        225⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\Jehhaaci.exe
        
        C:\Windows\system32\Jehhaaci.exe
        226⤵
        Drops file in System32 directory
        
        PID:7564
        
        C:\Windows\SysWOW64\Jkaqnk32.exe
        
        C:\Windows\system32\Jkaqnk32.exe
        227⤵
        
        PID:7608
        
        C:\Windows\SysWOW64\Jghabl32.exe
        
        C:\Windows\system32\Jghabl32.exe
        228⤵
        Modifies registry class
        
        PID:7648
        
        C:\Windows\SysWOW64\Knbiofhg.exe
        
        C:\Windows\system32\Knbiofhg.exe
        229⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Kelalp32.exe
        
        C:\Windows\system32\Kelalp32.exe
        230⤵
        Modifies registry class
        
        PID:7752
        
        C:\Windows\SysWOW64\Kgknhl32.exe
        
        C:\Windows\system32\Kgknhl32.exe
        231⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Knefeffd.exe
        
        C:\Windows\system32\Knefeffd.exe
        232⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Keonap32.exe
        
        C:\Windows\system32\Keonap32.exe
        233⤵
        Drops file in System32 directory
        
        PID:7924
        
        C:\Windows\SysWOW64\Kpdboimg.exe
        
        C:\Windows\system32\Kpdboimg.exe
        234⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Kbbokdlk.exe
        
        C:\Windows\system32\Kbbokdlk.exe
        235⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Khpgckkb.exe
        
        C:\Windows\system32\Khpgckkb.exe
        236⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Kpgodhkd.exe
        
        C:\Windows\system32\Kpgodhkd.exe
        237⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Kiodmn32.exe
        
        C:\Windows\system32\Kiodmn32.exe
        238⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\Klmpiiai.exe
        
        C:\Windows\system32\Klmpiiai.exe
        239⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Kbghfc32.exe
        
        C:\Windows\system32\Kbghfc32.exe
        240⤵
        
        PID:7300
        
        C:\Windows\SysWOW64\Lpkiph32.exe
        
        C:\Windows\system32\Lpkiph32.exe
        241⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Lfealaol.exe
        
        C:\Windows\system32\Lfealaol.exe
        242⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Lidmhmnp.exe
        
        C:\Windows\system32\Lidmhmnp.exe
        243⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Llbidimc.exe
        
        C:\Windows\system32\Llbidimc.exe
        244⤵
        Drops file in System32 directory
        
        PID:7592
        
        C:\Windows\SysWOW64\Lnqeqd32.exe
        
        C:\Windows\system32\Lnqeqd32.exe
        245⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Lfhnaa32.exe
        
        C:\Windows\system32\Lfhnaa32.exe
        246⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Lifjnm32.exe
        
        C:\Windows\system32\Lifjnm32.exe
        247⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Lppbkgcj.exe
        
        C:\Windows\system32\Lppbkgcj.exe
        248⤵
        
        PID:7880
        
        C:\Windows\SysWOW64\Llgcph32.exe
        
        C:\Windows\system32\Llgcph32.exe
        249⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Lflgmqhd.exe
        
        C:\Windows\system32\Lflgmqhd.exe
        250⤵
        Drops file in System32 directory
        
        PID:8008
        
        C:\Windows\SysWOW64\Lpekef32.exe
        
        C:\Windows\system32\Lpekef32.exe
        251⤵
        
        PID:8140
        
        C:\Windows\SysWOW64\Lfodbqfa.exe
        
        C:\Windows\system32\Lfodbqfa.exe
        252⤵
        
        PID:8180
        
        C:\Windows\SysWOW64\Mlklkgei.exe
        
        C:\Windows\system32\Mlklkgei.exe
        253⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Mbedga32.exe
        
        C:\Windows\system32\Mbedga32.exe
        254⤵
        Drops file in System32 directory
        
        PID:7384
        
        C:\Windows\SysWOW64\Miomdk32.exe
        
        C:\Windows\system32\Miomdk32.exe
        255⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\Molelb32.exe
        
        C:\Windows\system32\Molelb32.exe
        256⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Mfcmmp32.exe
        
        C:\Windows\system32\Mfcmmp32.exe
        257⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Mibijk32.exe
        
        C:\Windows\system32\Mibijk32.exe
        258⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Mplafeil.exe
        
        C:\Windows\system32\Mplafeil.exe
        259⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Mbjnbqhp.exe
        
        C:\Windows\system32\Mbjnbqhp.exe
        260⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Midfokpm.exe
        
        C:\Windows\system32\Midfokpm.exe
        261⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Mlbbkfoq.exe
        
        C:\Windows\system32\Mlbbkfoq.exe
        262⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Mblkhq32.exe
        
        C:\Windows\system32\Mblkhq32.exe
        263⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Mekgdl32.exe
        
        C:\Windows\system32\Mekgdl32.exe
        264⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Mleoafmn.exe
        
        C:\Windows\system32\Mleoafmn.exe
        265⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Mbognp32.exe
        
        C:\Windows\system32\Mbognp32.exe
        266⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Nemcjk32.exe
        
        C:\Windows\system32\Nemcjk32.exe
        267⤵
        
        PID:7464
        
        C:\Windows\SysWOW64\Nhlpfgbb.exe
        
        C:\Windows\system32\Nhlpfgbb.exe
        268⤵
        
        PID:4088
        
        C:\Windows\SysWOW64\Nbadcpbh.exe
        
        C:\Windows\system32\Nbadcpbh.exe
        269⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Niklpj32.exe
        
        C:\Windows\system32\Niklpj32.exe
        270⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Nohehq32.exe
        
        C:\Windows\system32\Nohehq32.exe
        271⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Nebmekoi.exe
        
        C:\Windows\system32\Nebmekoi.exe
        272⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Nojanpej.exe
        
        C:\Windows\system32\Nojanpej.exe
        273⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Nhbfff32.exe
        
        C:\Windows\system32\Nhbfff32.exe
        274⤵
        Drops file in System32 directory
        
        PID:7640
        
        C:\Windows\SysWOW64\Nomncpcg.exe
        
        C:\Windows\system32\Nomncpcg.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8232
        
        C:\Windows\SysWOW64\Ngdfdmdi.exe
        
        C:\Windows\system32\Ngdfdmdi.exe
        276⤵
        Drops file in System32 directory
        
        PID:8276
        
        C:\Windows\SysWOW64\Nplkmckj.exe
        
        C:\Windows\system32\Nplkmckj.exe
        277⤵
        
        PID:8316
        
        C:\Windows\SysWOW64\Oeicejia.exe
        
        C:\Windows\system32\Oeicejia.exe
        278⤵
        
        PID:8356
        
        C:\Windows\SysWOW64\Oiihahme.exe
        
        C:\Windows\system32\Oiihahme.exe
        279⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Ogmijllo.exe
        
        C:\Windows\system32\Ogmijllo.exe
        280⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Ohnebd32.exe
        
        C:\Windows\system32\Ohnebd32.exe
        281⤵
        
        PID:8484
        
        C:\Windows\SysWOW64\Opemca32.exe
        
        C:\Windows\system32\Opemca32.exe
        282⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Ocdjpmac.exe
        
        C:\Windows\system32\Ocdjpmac.exe
        283⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Oebflhaf.exe
        
        C:\Windows\system32\Oebflhaf.exe
        284⤵
        Drops file in System32 directory
        
        PID:8608
        
        C:\Windows\SysWOW64\Ohqbhdpj.exe
        
        C:\Windows\system32\Ohqbhdpj.exe
        285⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Ophjiaql.exe
        
        C:\Windows\system32\Ophjiaql.exe
        286⤵
        
        PID:8692
        
        C:\Windows\SysWOW64\Ocffempp.exe
        
        C:\Windows\system32\Ocffempp.exe
        287⤵
        Modifies registry class
        
        PID:8728
        
        C:\Windows\SysWOW64\Pjpobg32.exe
        
        C:\Windows\system32\Pjpobg32.exe
        288⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Ploknb32.exe
        
        C:\Windows\system32\Ploknb32.exe
        289⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Pomgjn32.exe
        
        C:\Windows\system32\Pomgjn32.exe
        290⤵
        
        PID:8860
        
        C:\Windows\SysWOW64\Pjbkgfej.exe
        
        C:\Windows\system32\Pjbkgfej.exe
        291⤵
        Drops file in System32 directory
        
        PID:8904
        
        C:\Windows\SysWOW64\Plagcbdn.exe
        
        C:\Windows\system32\Plagcbdn.exe
        292⤵
        Drops file in System32 directory
        
        PID:8948
        
        C:\Windows\SysWOW64\Pgflqkdd.exe
        
        C:\Windows\system32\Pgflqkdd.exe
        293⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Poaqemao.exe
        
        C:\Windows\system32\Poaqemao.exe
        294⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Phjenbhp.exe
        
        C:\Windows\system32\Phjenbhp.exe
        295⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Podmkm32.exe
        
        C:\Windows\system32\Podmkm32.exe
        296⤵
        Modifies registry class
        
        PID:9112
        
        C:\Windows\SysWOW64\Qqhcpo32.exe
        
        C:\Windows\system32\Qqhcpo32.exe
        297⤵
        
        PID:9152
        
        C:\Windows\SysWOW64\Amodep32.exe
        
        C:\Windows\system32\Amodep32.exe
        298⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Afghneoo.exe
        
        C:\Windows\system32\Afghneoo.exe
        299⤵
        Drops file in System32 directory
        
        PID:8240
        
        C:\Windows\SysWOW64\Aqmlknnd.exe
        
        C:\Windows\system32\Aqmlknnd.exe
        300⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Ajeadd32.exe
        
        C:\Windows\system32\Ajeadd32.exe
        301⤵
        
        PID:8380
        
        C:\Windows\SysWOW64\Agiamhdo.exe
        
        C:\Windows\system32\Agiamhdo.exe
        302⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Aijnep32.exe
        
        C:\Windows\system32\Aijnep32.exe
        303⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Bgnkhg32.exe
        
        C:\Windows\system32\Bgnkhg32.exe
        304⤵
        
        PID:8596
        
        C:\Windows\SysWOW64\Biadeoce.exe
        
        C:\Windows\system32\Biadeoce.exe
        305⤵
        Drops file in System32 directory
        
        PID:8656
        
        C:\Windows\SysWOW64\Bcghch32.exe
        
        C:\Windows\system32\Bcghch32.exe
        306⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\Bidqko32.exe
        
        C:\Windows\system32\Bidqko32.exe
        307⤵
        
        PID:8764
        
        C:\Windows\SysWOW64\Bgeaifia.exe
        
        C:\Windows\system32\Bgeaifia.exe
        308⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Bifmqo32.exe
        
        C:\Windows\system32\Bifmqo32.exe
        309⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Bfjnjcni.exe
        
        C:\Windows\system32\Bfjnjcni.exe
        310⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Bihjfnmm.exe
        
        C:\Windows\system32\Bihjfnmm.exe
        311⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Cgjjdf32.exe
        
        C:\Windows\system32\Cgjjdf32.exe
        312⤵
        
        PID:4792
        
        C:\Windows\SysWOW64\Cabomkll.exe
        
        C:\Windows\system32\Cabomkll.exe
        313⤵
        Modifies registry class
        
        PID:9096
        
        C:\Windows\SysWOW64\Cgndoeag.exe
        
        C:\Windows\system32\Cgndoeag.exe
        314⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Cjmpkqqj.exe
        
        C:\Windows\system32\Cjmpkqqj.exe
        315⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Cpihcgoa.exe
        
        C:\Windows\system32\Cpihcgoa.exe
        316⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Cjomap32.exe
        
        C:\Windows\system32\Cjomap32.exe
        317⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Caienjfd.exe
        
        C:\Windows\system32\Caienjfd.exe
        318⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Cffmfadl.exe
        
        C:\Windows\system32\Cffmfadl.exe
        319⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Dakacjdb.exe
        
        C:\Windows\system32\Dakacjdb.exe
        320⤵
        Modifies registry class
        
        PID:8744
        
        C:\Windows\SysWOW64\Dgejpd32.exe
        
        C:\Windows\system32\Dgejpd32.exe
        321⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Dannij32.exe
        
        C:\Windows\system32\Dannij32.exe
        322⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Dhhfedil.exe
        
        C:\Windows\system32\Dhhfedil.exe
        323⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Dmdonkgc.exe
        
        C:\Windows\system32\Dmdonkgc.exe
        324⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Djhpgofm.exe
        
        C:\Windows\system32\Djhpgofm.exe
        325⤵
        
        PID:9136
        
        C:\Windows\SysWOW64\Dmglcj32.exe
        
        C:\Windows\system32\Dmglcj32.exe
        326⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Dpehof32.exe
        
        C:\Windows\system32\Dpehof32.exe
        327⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Dfoplpla.exe
        
        C:\Windows\system32\Dfoplpla.exe
        328⤵
        
        PID:8712
        
        C:\Windows\SysWOW64\Dhomfc32.exe
        
        C:\Windows\system32\Dhomfc32.exe
        329⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Djmibn32.exe
        
        C:\Windows\system32\Djmibn32.exe
        330⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\Emlenj32.exe
        
        C:\Windows\system32\Emlenj32.exe
        331⤵
        Drops file in System32 directory
        
        PID:8936
        
        C:\Windows\SysWOW64\Epjajeqo.exe
        
        C:\Windows\system32\Epjajeqo.exe
        332⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\Efffmo32.exe
        
        C:\Windows\system32\Efffmo32.exe
        333⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Eidbij32.exe
        
        C:\Windows\system32\Eidbij32.exe
        334⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Efhcbodf.exe
        
        C:\Windows\system32\Efhcbodf.exe
        335⤵
        
        PID:8624
        
        C:\Windows\SysWOW64\Eigonjcj.exe
        
        C:\Windows\system32\Eigonjcj.exe
        336⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\Edmclccp.exe
        
        C:\Windows\system32\Edmclccp.exe
        337⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Eiildjag.exe
        
        C:\Windows\system32\Eiildjag.exe
        338⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\Epcdqd32.exe
        
        C:\Windows\system32\Epcdqd32.exe
        339⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Efmmmn32.exe
        
        C:\Windows\system32\Efmmmn32.exe
        340⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Fkihnmhj.exe
        
        C:\Windows\system32\Fkihnmhj.exe
        341⤵
        
        PID:5696
        
        C:\Windows\SysWOW64\Fkkeclfh.exe
        
        C:\Windows\system32\Fkkeclfh.exe
        342⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Fmjaphek.exe
        
        C:\Windows\system32\Fmjaphek.exe
        343⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Fdcjlb32.exe
        
        C:\Windows\system32\Fdcjlb32.exe
        344⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Fagjfflb.exe
        
        C:\Windows\system32\Fagjfflb.exe
        345⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Fkpool32.exe
        
        C:\Windows\system32\Fkpool32.exe
        346⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Fmnkkg32.exe
        
        C:\Windows\system32\Fmnkkg32.exe
        347⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Fdhcgaic.exe
        
        C:\Windows\system32\Fdhcgaic.exe
        348⤵
        
        PID:9264
        
        C:\Windows\SysWOW64\Fkbkdkpp.exe
        
        C:\Windows\system32\Fkbkdkpp.exe
        349⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Falcae32.exe
        
        C:\Windows\system32\Falcae32.exe
        350⤵
        
        PID:9356
        
        C:\Windows\SysWOW64\Fhflnpoi.exe
        
        C:\Windows\system32\Fhflnpoi.exe
        351⤵
        
        PID:9400
        
        C:\Windows\SysWOW64\Gmcdffmq.exe
        
        C:\Windows\system32\Gmcdffmq.exe
        352⤵
        
        PID:9444
        
        C:\Windows\SysWOW64\Gdmmbq32.exe
        
        C:\Windows\system32\Gdmmbq32.exe
        353⤵
        
        PID:9496
        
        C:\Windows\SysWOW64\Gkgeoklj.exe
        
        C:\Windows\system32\Gkgeoklj.exe
        354⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9540
        
        C:\Windows\SysWOW64\Gmeakf32.exe
        
        C:\Windows\system32\Gmeakf32.exe
        355⤵
        Modifies registry class
        
        PID:9588
        
        C:\Windows\SysWOW64\Gdoihpbk.exe
        
        C:\Windows\system32\Gdoihpbk.exe
        356⤵
        
        PID:9632
        
        C:\Windows\SysWOW64\Ggnedlao.exe
        
        C:\Windows\system32\Ggnedlao.exe
        357⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9672
        
        C:\Windows\SysWOW64\Gnhnaf32.exe
        
        C:\Windows\system32\Gnhnaf32.exe
        358⤵
        
        PID:9720
        
        C:\Windows\SysWOW64\Gpfjma32.exe
        
        C:\Windows\system32\Gpfjma32.exe
        359⤵
        
        PID:9764
        
        C:\Windows\SysWOW64\Ghmbno32.exe
        
        C:\Windows\system32\Ghmbno32.exe
        360⤵
        
        PID:9812
        
        C:\Windows\SysWOW64\Gnjjfegi.exe
        
        C:\Windows\system32\Gnjjfegi.exe
        361⤵
        Modifies registry class
        
        PID:9856
        
        C:\Windows\SysWOW64\Gaefgd32.exe
        
        C:\Windows\system32\Gaefgd32.exe
        362⤵
        
        PID:9900
        
        C:\Windows\SysWOW64\Ggbook32.exe
        
        C:\Windows\system32\Ggbook32.exe
        363⤵
        
        PID:9940
        
        C:\Windows\SysWOW64\Gahcmd32.exe
        
        C:\Windows\system32\Gahcmd32.exe
        364⤵
        
        PID:9976
        
        C:\Windows\SysWOW64\Gdfoio32.exe
        
        C:\Windows\system32\Gdfoio32.exe
        365⤵
        
        PID:10020
        
        C:\Windows\SysWOW64\Hgelek32.exe
        
        C:\Windows\system32\Hgelek32.exe
        366⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Hjchaf32.exe
        
        C:\Windows\system32\Hjchaf32.exe
        367⤵
        
        PID:10100
        
        C:\Windows\SysWOW64\Hajpbckl.exe
        
        C:\Windows\system32\Hajpbckl.exe
        368⤵
        
        PID:10144
        
        C:\Windows\SysWOW64\Hhdhon32.exe
        
        C:\Windows\system32\Hhdhon32.exe
        369⤵
        
        PID:10188
        
        C:\Windows\SysWOW64\Hdkidohn.exe
        
        C:\Windows\system32\Hdkidohn.exe
        370⤵
        
        PID:10236
        
        C:\Windows\SysWOW64\Hkeaqi32.exe
        
        C:\Windows\system32\Hkeaqi32.exe
        371⤵
        Drops file in System32 directory
        
        PID:9244
        
        C:\Windows\SysWOW64\Haoimcgg.exe
        
        C:\Windows\system32\Haoimcgg.exe
        372⤵
        
        PID:9348
        
        C:\Windows\SysWOW64\Hdmein32.exe
        
        C:\Windows\system32\Hdmein32.exe
        373⤵
        
        PID:9392
        
        C:\Windows\SysWOW64\Hkgnfhnh.exe
        
        C:\Windows\system32\Hkgnfhnh.exe
        374⤵
        
        PID:9468
        
        C:\Windows\SysWOW64\Haafcb32.exe
        
        C:\Windows\system32\Haafcb32.exe
        375⤵
        
        PID:9532
        
        C:\Windows\SysWOW64\Hgnoki32.exe
        
        C:\Windows\system32\Hgnoki32.exe
        376⤵
        
        PID:9600
        
        C:\Windows\SysWOW64\Hnhghcki.exe
        
        C:\Windows\system32\Hnhghcki.exe
        377⤵
        
        PID:9664
        
        C:\Windows\SysWOW64\Ijogmdqm.exe
        
        C:\Windows\system32\Ijogmdqm.exe
        378⤵
        Modifies registry class
        
        PID:9744
        
        C:\Windows\SysWOW64\Iafonaao.exe
        
        C:\Windows\system32\Iafonaao.exe
        379⤵
        
        PID:9800
        
        C:\Windows\SysWOW64\Iddljmpc.exe
        
        C:\Windows\system32\Iddljmpc.exe
        380⤵
        
        PID:9868
        
        C:\Windows\SysWOW64\Ikndgg32.exe
        
        C:\Windows\system32\Ikndgg32.exe
        381⤵
        
        PID:9972
        
        C:\Windows\SysWOW64\Inmpcc32.exe
        
        C:\Windows\system32\Inmpcc32.exe
        382⤵
        
        PID:10016
        
        C:\Windows\SysWOW64\Iqklon32.exe
        
        C:\Windows\system32\Iqklon32.exe
        383⤵
        Drops file in System32 directory
        
        PID:10092
        
        C:\Windows\SysWOW64\Ikqqlgem.exe
        
        C:\Windows\system32\Ikqqlgem.exe
        384⤵
        
        PID:10152
        
        C:\Windows\SysWOW64\Inomhbeq.exe
        
        C:\Windows\system32\Inomhbeq.exe
        385⤵
        
        PID:10224
        
        C:\Windows\SysWOW64\Iqmidndd.exe
        
        C:\Windows\system32\Iqmidndd.exe
        386⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Ihdafkdg.exe
        
        C:\Windows\system32\Ihdafkdg.exe
        387⤵
        
        PID:9380
        
        C:\Windows\SysWOW64\Ikcmbfcj.exe
        
        C:\Windows\system32\Ikcmbfcj.exe
        388⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Inainbcn.exe
        
        C:\Windows\system32\Inainbcn.exe
        389⤵
        
        PID:9620
        
        C:\Windows\SysWOW64\Iqpfjnba.exe
        
        C:\Windows\system32\Iqpfjnba.exe
        390⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Igjngh32.exe
        
        C:\Windows\system32\Igjngh32.exe
        391⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9844
        
        C:\Windows\SysWOW64\Indfca32.exe
        
        C:\Windows\system32\Indfca32.exe
        392⤵
        
        PID:9932
        
        C:\Windows\SysWOW64\Iqbbpm32.exe
        
        C:\Windows\system32\Iqbbpm32.exe
        393⤵
        
        PID:10060
        
        C:\Windows\SysWOW64\Jhijqj32.exe
        
        C:\Windows\system32\Jhijqj32.exe
        394⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Jbaojpgb.exe
        
        C:\Windows\system32\Jbaojpgb.exe
        395⤵
        
        PID:9296
        
        C:\Windows\SysWOW64\Jjmcnbdm.exe
        
        C:\Windows\system32\Jjmcnbdm.exe
        396⤵
        
        PID:9376
        
        C:\Windows\SysWOW64\Jbdlop32.exe
        
        C:\Windows\system32\Jbdlop32.exe
        397⤵
        
        PID:9536
        
        C:\Windows\SysWOW64\Jhndljll.exe
        
        C:\Windows\system32\Jhndljll.exe
        398⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Jjopcb32.exe
        
        C:\Windows\system32\Jjopcb32.exe
        399⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\Jbfheo32.exe
        
        C:\Windows\system32\Jbfheo32.exe
        400⤵
        
        PID:10056
        
        C:\Windows\SysWOW64\Jhpqaiji.exe
        
        C:\Windows\system32\Jhpqaiji.exe
        401⤵
        
        PID:9276
        
        C:\Windows\SysWOW64\Jkomneim.exe
        
        C:\Windows\system32\Jkomneim.exe
        402⤵
        
        PID:9460
        
        C:\Windows\SysWOW64\Jqlefl32.exe
        
        C:\Windows\system32\Jqlefl32.exe
        403⤵
        
        PID:9652
        
        C:\Windows\SysWOW64\Jgenbfoa.exe
        
        C:\Windows\system32\Jgenbfoa.exe
        404⤵
        
        PID:9960
        
        C:\Windows\SysWOW64\Jnpfop32.exe
        
        C:\Windows\system32\Jnpfop32.exe
        405⤵
        
        PID:10212
        
        C:\Windows\SysWOW64\Jbkbpoog.exe
        
        C:\Windows\system32\Jbkbpoog.exe
        406⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Kiejmi32.exe
        
        C:\Windows\system32\Kiejmi32.exe
        407⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Kkcfid32.exe
        
        C:\Windows\system32\Kkcfid32.exe
        408⤵
        
        PID:9324
        
        C:\Windows\SysWOW64\Knbbep32.exe
        
        C:\Windows\system32\Knbbep32.exe
        409⤵
        
        PID:10084
        
        C:\Windows\SysWOW64\Kqpoakco.exe
        
        C:\Windows\system32\Kqpoakco.exe
        410⤵
        
        PID:9892
        
        C:\Windows\SysWOW64\Kqbkfkal.exe
        
        C:\Windows\system32\Kqbkfkal.exe
        411⤵
        
        PID:10244
        
        C:\Windows\SysWOW64\Kijchhbo.exe
        
        C:\Windows\system32\Kijchhbo.exe
        412⤵
        
        PID:10288
        
        C:\Windows\SysWOW64\Keqdmihc.exe
        
        C:\Windows\system32\Keqdmihc.exe
        413⤵
        
        PID:10332
        
        C:\Windows\SysWOW64\Kjmmepfj.exe
        
        C:\Windows\system32\Kjmmepfj.exe
        414⤵
        
        PID:10372
        
        C:\Windows\SysWOW64\Kageaj32.exe
        
        C:\Windows\system32\Kageaj32.exe
        415⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:10416
        
        C:\Windows\SysWOW64\Kecabifp.exe
        
        C:\Windows\system32\Kecabifp.exe
        416⤵
        
        PID:10460
        
        C:\Windows\SysWOW64\Kkmioc32.exe
        
        C:\Windows\system32\Kkmioc32.exe
        417⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10504
        
        C:\Windows\SysWOW64\Lbgalmej.exe
        
        C:\Windows\system32\Lbgalmej.exe
        418⤵
        
        PID:10548
        
        C:\Windows\SysWOW64\Lkofdbkj.exe
        
        C:\Windows\system32\Lkofdbkj.exe
        419⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10596
        
        C:\Windows\SysWOW64\Lbinam32.exe
        
        C:\Windows\system32\Lbinam32.exe
        420⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10640
        
        C:\Windows\SysWOW64\Licfngjd.exe
        
        C:\Windows\system32\Licfngjd.exe
        421⤵
        
        PID:10680
        
        C:\Windows\SysWOW64\Lkabjbih.exe
        
        C:\Windows\system32\Lkabjbih.exe
        422⤵
        
        PID:10724
        
        C:\Windows\SysWOW64\Lldopb32.exe
        
        C:\Windows\system32\Lldopb32.exe
        423⤵
        
        PID:10760
        
        C:\Windows\SysWOW64\Lbngllob.exe
        
        C:\Windows\system32\Lbngllob.exe
        424⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Lihpif32.exe
        
        C:\Windows\system32\Lihpif32.exe
        425⤵
        
        PID:10844
        
        C:\Windows\SysWOW64\Lacdmh32.exe
        
        C:\Windows\system32\Lacdmh32.exe
        426⤵
        
        PID:10888
        
        C:\Windows\SysWOW64\Lhmmjbkf.exe
        
        C:\Windows\system32\Lhmmjbkf.exe
        427⤵
        
        PID:10936
        
        C:\Windows\SysWOW64\Ljkifn32.exe
        
        C:\Windows\system32\Ljkifn32.exe
        428⤵
        
        PID:10992
        
        C:\Windows\SysWOW64\Maeachag.exe
        
        C:\Windows\system32\Maeachag.exe
        429⤵
        
        PID:11036
        
        C:\Windows\SysWOW64\Milidebi.exe
        
        C:\Windows\system32\Milidebi.exe
        430⤵
        
        PID:11080
        
        C:\Windows\SysWOW64\Mjneln32.exe
        
        C:\Windows\system32\Mjneln32.exe
        431⤵
        Drops file in System32 directory
        
        PID:11116
        
        C:\Windows\SysWOW64\Mbenmk32.exe
        
        C:\Windows\system32\Mbenmk32.exe
        432⤵
        Modifies registry class
        
        PID:11164
        
        C:\Windows\SysWOW64\Miofjepg.exe
        
        C:\Windows\system32\Miofjepg.exe
        433⤵
        
        PID:11208
        
        C:\Windows\SysWOW64\Mlmbfqoj.exe
        
        C:\Windows\system32\Mlmbfqoj.exe
        434⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Majjng32.exe
        
        C:\Windows\system32\Majjng32.exe
        435⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10256
        
        C:\Windows\SysWOW64\Miaboe32.exe
        
        C:\Windows\system32\Miaboe32.exe
        436⤵
        Modifies registry class
        
        PID:10328
        
        C:\Windows\SysWOW64\Mlpokp32.exe
        
        C:\Windows\system32\Mlpokp32.exe
        437⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Mbighjdd.exe
        
        C:\Windows\system32\Mbighjdd.exe
        438⤵
        
        PID:10468
        
        C:\Windows\SysWOW64\Mhfppabl.exe
        
        C:\Windows\system32\Mhfppabl.exe
        439⤵
        Modifies registry class
        
        PID:10540
        
        C:\Windows\SysWOW64\Mjellmbp.exe
        
        C:\Windows\system32\Mjellmbp.exe
        440⤵
        
        PID:10604
        
        C:\Windows\SysWOW64\Mblcnj32.exe
        
        C:\Windows\system32\Mblcnj32.exe
        441⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Mifljdjo.exe
        
        C:\Windows\system32\Mifljdjo.exe
        442⤵
        
        PID:10736
        
        C:\Windows\SysWOW64\Mldhfpib.exe
        
        C:\Windows\system32\Mldhfpib.exe
        443⤵
        
        PID:10820
        
        C:\Windows\SysWOW64\Nobdbkhf.exe
        
        C:\Windows\system32\Nobdbkhf.exe
        444⤵
        
        PID:10876
        
        C:\Windows\SysWOW64\Nihipdhl.exe
        
        C:\Windows\system32\Nihipdhl.exe
        445⤵
        
        PID:10956
        
        C:\Windows\SysWOW64\Nlfelogp.exe
        
        C:\Windows\system32\Nlfelogp.exe
        446⤵
        
        PID:11032
        
        C:\Windows\SysWOW64\Neoieenp.exe
        
        C:\Windows\system32\Neoieenp.exe
        447⤵
        
        PID:11076
        
        C:\Windows\SysWOW64\Nliaao32.exe
        
        C:\Windows\system32\Nliaao32.exe
        448⤵
        
        PID:11156
        
        C:\Windows\SysWOW64\Najceeoo.exe
        
        C:\Windows\system32\Najceeoo.exe
        449⤵
        
        PID:11216
        
        C:\Windows\SysWOW64\Nefped32.exe
        
        C:\Windows\system32\Nefped32.exe
        450⤵
        Modifies registry class
        
        PID:11256
        
        C:\Windows\SysWOW64\Nhdlao32.exe
        
        C:\Windows\system32\Nhdlao32.exe
        451⤵
        
        PID:10316
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        452⤵
        
        PID:10400
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        453⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10492
        
        C:\Windows\SysWOW64\Oidhlb32.exe
        
        C:\Windows\system32\Oidhlb32.exe
        454⤵
        
        PID:10576
        
        C:\Windows\SysWOW64\Olbdhn32.exe
        
        C:\Windows\system32\Olbdhn32.exe
        455⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\Qiiflaoo.exe
        
        C:\Windows\system32\Qiiflaoo.exe
        251⤵
        
        PID:1196
        
        C:\Windows\SysWOW64\Ajjokd32.exe
        
        C:\Windows\system32\Ajjokd32.exe
        252⤵
        
        PID:9864

C:\Windows\SysWOW64\Ooqqdi32.exe
C:\Windows\system32\Ooqqdi32.exe
1⤵
PID:10812
- C:\Windows\SysWOW64\Oaompd32.exe
  C:\Windows\system32\Oaompd32.exe
  2⤵
  PID:10932
- - C:\Windows\SysWOW64\Oifeab32.exe
    C:\Windows\system32\Oifeab32.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    PID:11064
  - - C:\Windows\SysWOW64\Oldamm32.exe
      C:\Windows\system32\Oldamm32.exe
      4⤵
      PID:11104

C:\Windows\SysWOW64\Oboijgbl.exe
C:\Windows\system32\Oboijgbl.exe
1⤵
PID:10908
- C:\Windows\SysWOW64\Oemefcap.exe
  C:\Windows\system32\Oemefcap.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Drops file in System32 directory
  PID:10348
- - C:\Windows\SysWOW64\Olgncmim.exe
    C:\Windows\system32\Olgncmim.exe
    3⤵
    PID:10592
  - - C:\Windows\SysWOW64\Ooejohhq.exe
      C:\Windows\system32\Ooejohhq.exe
      4⤵
      PID:10664
    - - C:\Windows\SysWOW64\Ohnohn32.exe
        
        C:\Windows\system32\Ohnohn32.exe
        5⤵
        Drops file in System32 directory
        
        PID:10864
      - C:\Windows\SysWOW64\Obcceg32.exe
        
        C:\Windows\system32\Obcceg32.exe
        6⤵
        
        PID:11000
        
        C:\Windows\SysWOW64\Oeaoab32.exe
        
        C:\Windows\system32\Oeaoab32.exe
        7⤵
        
        PID:11196
        
        C:\Windows\SysWOW64\Pllgnl32.exe
        
        C:\Windows\system32\Pllgnl32.exe
        8⤵
        
        PID:10404
        
        C:\Windows\SysWOW64\Pcepkfld.exe
        
        C:\Windows\system32\Pcepkfld.exe
        9⤵
        
        PID:10648
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        10⤵
        
        PID:10912

C:\Windows\SysWOW64\Phbhcmjl.exe
C:\Windows\system32\Phbhcmjl.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:11192
- C:\Windows\SysWOW64\Polppg32.exe
  C:\Windows\system32\Polppg32.exe
  2⤵
  PID:10584
- - C:\Windows\SysWOW64\Pakllc32.exe
    C:\Windows\system32\Pakllc32.exe
    3⤵
    PID:11028
  - - C:\Windows\SysWOW64\Pibdmp32.exe
      C:\Windows\system32\Pibdmp32.exe
      4⤵
      PID:10580
    - - C:\Windows\SysWOW64\Pkcadhgm.exe
        
        C:\Windows\system32\Pkcadhgm.exe
        5⤵
        
        PID:10252
      - C:\Windows\SysWOW64\Plbmokop.exe
        
        C:\Windows\system32\Plbmokop.exe
        6⤵
        
        PID:10692
        
        C:\Windows\SysWOW64\Pcmeke32.exe
        
        C:\Windows\system32\Pcmeke32.exe
        7⤵
        
        PID:10300
        
        C:\Windows\SysWOW64\Pekbga32.exe
        
        C:\Windows\system32\Pekbga32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11304

C:\Windows\SysWOW64\Plejdkmm.exe
C:\Windows\system32\Plejdkmm.exe
1⤵
PID:11340
- C:\Windows\SysWOW64\Pocfpf32.exe
  C:\Windows\system32\Pocfpf32.exe
  2⤵
  - Drops file in System32 directory
  PID:11384
- - C:\Windows\SysWOW64\Qhlkilba.exe
    C:\Windows\system32\Qhlkilba.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Modifies registry class
    PID:11424
  - - C:\Windows\SysWOW64\Qadoba32.exe
      C:\Windows\system32\Qadoba32.exe
      4⤵
      Drops file in System32 directory
      Modifies registry class
      PID:11464
    - - C:\Windows\SysWOW64\Qhngolpo.exe
        
        C:\Windows\system32\Qhngolpo.exe
        5⤵
        
        PID:11504
      - C:\Windows\SysWOW64\Qkmdkgob.exe
        
        C:\Windows\system32\Qkmdkgob.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11544
        
        C:\Windows\SysWOW64\Qaflgago.exe
        
        C:\Windows\system32\Qaflgago.exe
        7⤵
        
        PID:11584
        
        C:\Windows\SysWOW64\Ajndioga.exe
        
        C:\Windows\system32\Ajndioga.exe
        8⤵
        
        PID:11624
        
        C:\Windows\SysWOW64\Allpejfe.exe
        
        C:\Windows\system32\Allpejfe.exe
        9⤵
        
        PID:11664
        
        C:\Windows\SysWOW64\Acfhad32.exe
        
        C:\Windows\system32\Acfhad32.exe
        10⤵
        
        PID:11708

C:\Windows\SysWOW64\Aeddnp32.exe
C:\Windows\system32\Aeddnp32.exe
1⤵
PID:11744
- C:\Windows\SysWOW64\Ahcajk32.exe
  C:\Windows\system32\Ahcajk32.exe
  2⤵
  PID:11792
- - C:\Windows\SysWOW64\Akamff32.exe
    C:\Windows\system32\Akamff32.exe
    3⤵
    PID:11836
  - - C:\Windows\SysWOW64\Achegd32.exe
      C:\Windows\system32\Achegd32.exe
      4⤵
      PID:11876
    - - C:\Windows\SysWOW64\Afgacokc.exe
        
        C:\Windows\system32\Afgacokc.exe
        5⤵
        
        PID:11920
      - C:\Windows\SysWOW64\Alqjpi32.exe
        
        C:\Windows\system32\Alqjpi32.exe
        6⤵
        
        PID:11964
        
        C:\Windows\SysWOW64\Aoofle32.exe
        
        C:\Windows\system32\Aoofle32.exe
        7⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        8⤵
        
        PID:12052

C:\Windows\SysWOW64\Ahgjejhd.exe
C:\Windows\system32\Ahgjejhd.exe
1⤵
PID:12092
- C:\Windows\SysWOW64\Akffafgg.exe
  C:\Windows\system32\Akffafgg.exe
  2⤵
  PID:12136

C:\Windows\SysWOW64\Abponp32.exe
C:\Windows\system32\Abponp32.exe
1⤵
- Drops file in System32 directory
PID:12176
- C:\Windows\SysWOW64\Ajggomog.exe
  C:\Windows\system32\Ajggomog.exe
  2⤵
  PID:12224
- - C:\Windows\SysWOW64\Aleckinj.exe
    C:\Windows\system32\Aleckinj.exe
    3⤵
    PID:12264
  - - C:\Windows\SysWOW64\Aodogdmn.exe
      C:\Windows\system32\Aodogdmn.exe
      4⤵
      PID:11296
    - - C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        5⤵
        
        PID:11380
      - C:\Windows\SysWOW64\Bhldpj32.exe
        
        C:\Windows\system32\Bhldpj32.exe
        6⤵
        Drops file in System32 directory
        
        PID:11448
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        7⤵
        
        PID:11512
        
        C:\Windows\SysWOW64\Bfpdin32.exe
        
        C:\Windows\system32\Bfpdin32.exe
        8⤵
        
        PID:11568
        
        C:\Windows\SysWOW64\Bhoqeibl.exe
        
        C:\Windows\system32\Bhoqeibl.exe
        9⤵
        
        PID:11652
        
        C:\Windows\SysWOW64\Bkmmaeap.exe
        
        C:\Windows\system32\Bkmmaeap.exe
        10⤵
        
        PID:11720
        
        C:\Windows\SysWOW64\Bcddcbab.exe
        
        C:\Windows\system32\Bcddcbab.exe
        11⤵
        
        PID:11780
        
        C:\Windows\SysWOW64\Bokehc32.exe
        
        C:\Windows\system32\Bokehc32.exe
        12⤵
        
        PID:11856
        
        C:\Windows\SysWOW64\Bjpjel32.exe
        
        C:\Windows\system32\Bjpjel32.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11904
        
        C:\Windows\SysWOW64\Bcinna32.exe
        
        C:\Windows\system32\Bcinna32.exe
        14⤵
        
        PID:11980
        
        C:\Windows\SysWOW64\Bjbfklei.exe
        
        C:\Windows\system32\Bjbfklei.exe
        15⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\Cjecpkcg.exe
        
        C:\Windows\system32\Cjecpkcg.exe
        16⤵
        
        PID:12036
        
        C:\Windows\SysWOW64\Cobkhb32.exe
        
        C:\Windows\system32\Cobkhb32.exe
        17⤵
        
        PID:12184
        
        C:\Windows\SysWOW64\Ckilmcgb.exe
        
        C:\Windows\system32\Ckilmcgb.exe
        18⤵
        
        PID:12212
        
        C:\Windows\SysWOW64\Cmjemflb.exe
        
        C:\Windows\system32\Cmjemflb.exe
        19⤵
        
        PID:12276
        
        C:\Windows\SysWOW64\Dfefkkqp.exe
        
        C:\Windows\system32\Dfefkkqp.exe
        20⤵
        Modifies registry class
        
        PID:11332
        
        C:\Windows\SysWOW64\Dmalne32.exe
        
        C:\Windows\system32\Dmalne32.exe
        21⤵
        
        PID:11432
        
        C:\Windows\SysWOW64\Dfjpfj32.exe
        
        C:\Windows\system32\Dfjpfj32.exe
        22⤵
        
        PID:11556
        
        C:\Windows\SysWOW64\Ejoomhmi.exe
        
        C:\Windows\system32\Ejoomhmi.exe
        23⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        24⤵
        
        PID:11848
        
        C:\Windows\SysWOW64\Embddb32.exe
        
        C:\Windows\system32\Embddb32.exe
        25⤵
        
        PID:11956
        
        C:\Windows\SysWOW64\Eclmamod.exe
        
        C:\Windows\system32\Eclmamod.exe
        26⤵
        
        PID:12068
        
        C:\Windows\SysWOW64\Elgaeolp.exe
        
        C:\Windows\system32\Elgaeolp.exe
        27⤵
        
        PID:12232
        
        C:\Windows\SysWOW64\Flinkojm.exe
        
        C:\Windows\system32\Flinkojm.exe
        28⤵
        
        PID:11336
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        29⤵
        
        PID:1408
        
        C:\Windows\SysWOW64\Fpggamqc.exe
        
        C:\Windows\system32\Fpggamqc.exe
        30⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\Fjmkoeqi.exe
        
        C:\Windows\system32\Fjmkoeqi.exe
        31⤵
        
        PID:11804
        
        C:\Windows\SysWOW64\Fmkgkapm.exe
        
        C:\Windows\system32\Fmkgkapm.exe
        32⤵
        
        PID:12024
        
        C:\Windows\SysWOW64\Glcaambb.exe
        
        C:\Windows\system32\Glcaambb.exe
        33⤵
        Modifies registry class
        
        PID:11272
        
        C:\Windows\SysWOW64\Gmbmkpie.exe
        
        C:\Windows\system32\Gmbmkpie.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11412
        
        C:\Windows\SysWOW64\Gdlfhj32.exe
        
        C:\Windows\system32\Gdlfhj32.exe
        35⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\Gjfnedho.exe
        
        C:\Windows\system32\Gjfnedho.exe
        36⤵
        
        PID:11912
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        37⤵
        Modifies registry class
        
        PID:11316
        
        C:\Windows\SysWOW64\Gljgbllj.exe
        
        C:\Windows\system32\Gljgbllj.exe
        38⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\Gphphj32.exe
        
        C:\Windows\system32\Gphphj32.exe
        39⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4504
        
        C:\Windows\SysWOW64\Gipdap32.exe
        
        C:\Windows\system32\Gipdap32.exe
        41⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\Hdehni32.exe
        
        C:\Windows\system32\Hdehni32.exe
        42⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\Hkpqkcpd.exe
        
        C:\Windows\system32\Hkpqkcpd.exe
        43⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\Hdhedh32.exe
        
        C:\Windows\system32\Hdhedh32.exe
        44⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        45⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\Hkdjfb32.exe
        
        C:\Windows\system32\Hkdjfb32.exe
        46⤵
        
        PID:11972
        
        C:\Windows\SysWOW64\Hmechmip.exe
        
        C:\Windows\system32\Hmechmip.exe
        47⤵
        
        PID:12260

C:\Windows\SysWOW64\Hcblpdgg.exe
C:\Windows\system32\Hcblpdgg.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:2136
- C:\Windows\SysWOW64\Hkicaahi.exe
  C:\Windows\system32\Hkicaahi.exe
  2⤵
  PID:2828
- - C:\Windows\SysWOW64\Ipflihfq.exe
    C:\Windows\system32\Ipflihfq.exe
    3⤵
    PID:3444
  - - C:\Windows\SysWOW64\Igpdfb32.exe
      C:\Windows\system32\Igpdfb32.exe
      4⤵
      PID:12148
    - - C:\Windows\SysWOW64\Ilmmni32.exe
        
        C:\Windows\system32\Ilmmni32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4476
      - C:\Windows\SysWOW64\Icfekc32.exe
        
        C:\Windows\system32\Icfekc32.exe
        6⤵
        
        PID:1804
        
        C:\Windows\SysWOW64\Inlihl32.exe
        
        C:\Windows\system32\Inlihl32.exe
        7⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\Idfaefkd.exe
        
        C:\Windows\system32\Idfaefkd.exe
        8⤵
        
        PID:2020
        
        C:\Windows\SysWOW64\Igdnabjh.exe
        
        C:\Windows\system32\Igdnabjh.exe
        9⤵
        Drops file in System32 directory
        
        PID:4644
        
        C:\Windows\SysWOW64\Innfnl32.exe
        
        C:\Windows\system32\Innfnl32.exe
        10⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Ilafiihp.exe
        
        C:\Windows\system32\Ilafiihp.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3296
        
        C:\Windows\SysWOW64\Iggjga32.exe
        
        C:\Windows\system32\Iggjga32.exe
        12⤵
        
        PID:1844
        
        C:\Windows\SysWOW64\Icnklbmj.exe
        
        C:\Windows\system32\Icnklbmj.exe
        13⤵
        
        PID:1488
        
        C:\Windows\SysWOW64\Jncoikmp.exe
        
        C:\Windows\system32\Jncoikmp.exe
        14⤵
        
        PID:2972
        
        C:\Windows\SysWOW64\Jpaleglc.exe
        
        C:\Windows\system32\Jpaleglc.exe
        15⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3696
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        16⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\Jlhljhbg.exe
        
        C:\Windows\system32\Jlhljhbg.exe
        17⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\Jcbdgb32.exe
        
        C:\Windows\system32\Jcbdgb32.exe
        18⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\Jpfepf32.exe
        
        C:\Windows\system32\Jpfepf32.exe
        19⤵
        
        PID:2604
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        20⤵
        
        PID:4252
        
        C:\Windows\SysWOW64\Jknfcofa.exe
        
        C:\Windows\system32\Jknfcofa.exe
        21⤵
        Modifies registry class
        
        PID:1904
        
        C:\Windows\SysWOW64\Jlobkg32.exe
        
        C:\Windows\system32\Jlobkg32.exe
        22⤵
        
        PID:4848
        
        C:\Windows\SysWOW64\Jgeghp32.exe
        
        C:\Windows\system32\Jgeghp32.exe
        23⤵
        
        PID:3172
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        24⤵
        
        PID:3200
        
        C:\Windows\SysWOW64\Kdkdgchl.exe
        
        C:\Windows\system32\Kdkdgchl.exe
        25⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\Kjhloj32.exe
        
        C:\Windows\system32\Kjhloj32.exe
        26⤵
        
        PID:5072
        
        C:\Windows\SysWOW64\Kdmqmc32.exe
        
        C:\Windows\system32\Kdmqmc32.exe
        27⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2800
        
        C:\Windows\SysWOW64\Kcbnnpka.exe
        
        C:\Windows\system32\Kcbnnpka.exe
        28⤵
        Drops file in System32 directory
        
        PID:4100
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        29⤵
        
        PID:4616
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        30⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\Lcjcnoej.exe
        
        C:\Windows\system32\Lcjcnoej.exe
        31⤵
        Modifies registry class
        
        PID:1784
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        32⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\Lqndhcdc.exe
        
        C:\Windows\system32\Lqndhcdc.exe
        33⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        34⤵
        Modifies registry class
        
        PID:4172
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        35⤵
        
        PID:244
        
        C:\Windows\SysWOW64\Lndagg32.exe
        
        C:\Windows\system32\Lndagg32.exe
        36⤵
        
        PID:1104
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        37⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        38⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\Maggnali.exe
        
        C:\Windows\system32\Maggnali.exe
        39⤵
        
        PID:2244
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        40⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4576
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        41⤵
        
        PID:3400
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        42⤵
        
        PID:380
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        43⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\Meepdp32.exe
        
        C:\Windows\system32\Meepdp32.exe
        44⤵
        Drops file in System32 directory
        
        PID:4240
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        45⤵
        
        PID:916
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        46⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\Mgehfkop.exe
        
        C:\Windows\system32\Mgehfkop.exe
        47⤵
        
        PID:4208
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        48⤵
        
        PID:1216
        
        C:\Windows\SysWOW64\Mnpabe32.exe
        
        C:\Windows\system32\Mnpabe32.exe
        49⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        50⤵
        
        PID:2140
        
        C:\Windows\SysWOW64\Nghekkmn.exe
        
        C:\Windows\system32\Nghekkmn.exe
        51⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        52⤵
        
        PID:2988
        
        C:\Windows\SysWOW64\Ncofplba.exe
        
        C:\Windows\system32\Ncofplba.exe
        53⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        54⤵
        
        PID:2440
        
        C:\Windows\SysWOW64\Nmgjia32.exe
        
        C:\Windows\system32\Nmgjia32.exe
        55⤵
        
        PID:12320
        
        C:\Windows\SysWOW64\Nenbjo32.exe
        
        C:\Windows\system32\Nenbjo32.exe
        56⤵
        
        PID:12360
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        57⤵
        
        PID:12404
        
        C:\Windows\SysWOW64\Nmigoagp.exe
        
        C:\Windows\system32\Nmigoagp.exe
        58⤵
        
        PID:12460
        
        C:\Windows\SysWOW64\Nccokk32.exe
        
        C:\Windows\system32\Nccokk32.exe
        59⤵
        Drops file in System32 directory
        
        PID:12508
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        60⤵
        
        PID:12556
        
        C:\Windows\SysWOW64\Nmlddqem.exe
        
        C:\Windows\system32\Nmlddqem.exe
        61⤵
        
        PID:12600
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        62⤵
        
        PID:12652
        
        C:\Windows\SysWOW64\Nhahaiec.exe
        
        C:\Windows\system32\Nhahaiec.exe
        63⤵
        Modifies registry class
        
        PID:12696
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        64⤵
        Modifies registry class
        
        PID:12740
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        65⤵
        
        PID:12784
        
        C:\Windows\SysWOW64\Oeehkn32.exe
        
        C:\Windows\system32\Oeehkn32.exe
        66⤵
        
        PID:12832
        
        C:\Windows\SysWOW64\Oloahhki.exe
        
        C:\Windows\system32\Oloahhki.exe
        67⤵
        
        PID:12868
        
        C:\Windows\SysWOW64\Onnmdcjm.exe
        
        C:\Windows\system32\Onnmdcjm.exe
        68⤵
        
        PID:12920
        
        C:\Windows\SysWOW64\Olanmgig.exe
        
        C:\Windows\system32\Olanmgig.exe
        69⤵
        
        PID:12976
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        70⤵
        Drops file in System32 directory
        
        PID:13036
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        71⤵
        
        PID:13084
        
        C:\Windows\SysWOW64\Omgcpokp.exe
        
        C:\Windows\system32\Omgcpokp.exe
        72⤵
        
        PID:13132
        
        C:\Windows\SysWOW64\Plkpcfal.exe
        
        C:\Windows\system32\Plkpcfal.exe
        73⤵
        Drops file in System32 directory
        
        PID:13196
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        74⤵
        
        PID:13300
        
        C:\Windows\SysWOW64\Pdhbmh32.exe
        
        C:\Windows\system32\Pdhbmh32.exe
        75⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1692
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        76⤵
        
        PID:12344
        
        C:\Windows\SysWOW64\Palbgl32.exe
        
        C:\Windows\system32\Palbgl32.exe
        77⤵
        
        PID:12392

C:\Windows\SysWOW64\Pdkoch32.exe
C:\Windows\system32\Pdkoch32.exe
1⤵
PID:11696
- C:\Windows\SysWOW64\Phigif32.exe
  C:\Windows\system32\Phigif32.exe
  2⤵
  PID:11996
- - C:\Windows\SysWOW64\Pocpfphe.exe
    C:\Windows\system32\Pocpfphe.exe
    3⤵
    PID:3324

C:\Windows\SysWOW64\Qkipkani.exe
C:\Windows\system32\Qkipkani.exe
1⤵
- Modifies registry class
PID:12592
- C:\Windows\SysWOW64\Qhmqdemc.exe
  C:\Windows\system32\Qhmqdemc.exe
  2⤵
  PID:2848
- - C:\Windows\SysWOW64\Aknifq32.exe
    C:\Windows\system32\Aknifq32.exe
    3⤵
    PID:3124
  - - C:\Windows\SysWOW64\Aahbbkaq.exe
      C:\Windows\system32\Aahbbkaq.exe
      4⤵
      PID:12768
    - - C:\Windows\SysWOW64\Ahbjoe32.exe
        
        C:\Windows\system32\Ahbjoe32.exe
        5⤵
        
        PID:12844
      - C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        6⤵
        
        PID:12916
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        7⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\Aoalgn32.exe
        
        C:\Windows\system32\Aoalgn32.exe
        8⤵
        
        PID:12992
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        9⤵
        
        PID:13024
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        10⤵
        
        PID:13076
        
        C:\Windows\SysWOW64\Bojomm32.exe
        
        C:\Windows\system32\Bojomm32.exe
        11⤵
        
        PID:13128
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        12⤵
        
        PID:3716
        
        C:\Windows\SysWOW64\Blqllqqa.exe
        
        C:\Windows\system32\Blqllqqa.exe
        13⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        14⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\Clgbmp32.exe
        
        C:\Windows\system32\Clgbmp32.exe
        15⤵
        
        PID:13288
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        16⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        17⤵
        
        PID:644
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        18⤵
        
        PID:12380
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        19⤵
        Drops file in System32 directory
        
        PID:12432
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        20⤵
        Modifies registry class
        
        PID:4120
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        21⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Dbbffdlq.exe
        
        C:\Windows\system32\Dbbffdlq.exe
        22⤵
        
        PID:12568
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        23⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        24⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        25⤵
        
        PID:812
        
        C:\Windows\SysWOW64\Eifaim32.exe
        
        C:\Windows\system32\Eifaim32.exe
        26⤵
        
        PID:12728

C:\Windows\SysWOW64\Fmcjpl32.exe
C:\Windows\system32\Fmcjpl32.exe
1⤵
PID:2916
- C:\Windows\SysWOW64\Feoodn32.exe
  C:\Windows\system32\Feoodn32.exe
  2⤵
  PID:5188
- - C:\Windows\SysWOW64\Fijkdmhn.exe
    C:\Windows\system32\Fijkdmhn.exe
    3⤵
    PID:12908
  - - C:\Windows\SysWOW64\Fpdcag32.exe
      C:\Windows\system32\Fpdcag32.exe
      4⤵
      PID:12956
    - - C:\Windows\SysWOW64\Fbbpmb32.exe
        
        C:\Windows\system32\Fbbpmb32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5152
      - C:\Windows\SysWOW64\Fealin32.exe
        
        C:\Windows\system32\Fealin32.exe
        6⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Fmhdkknd.exe
        
        C:\Windows\system32\Fmhdkknd.exe
        7⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Flkdfh32.exe
        
        C:\Windows\system32\Flkdfh32.exe
        8⤵
        
        PID:13020
        
        C:\Windows\SysWOW64\Fnipbc32.exe
        
        C:\Windows\system32\Fnipbc32.exe
        9⤵
        
        PID:5712
        
        C:\Windows\SysWOW64\Fechomko.exe
        
        C:\Windows\system32\Fechomko.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1836
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        11⤵
        
        PID:13096
        
        C:\Windows\SysWOW64\Fpimlfke.exe
        
        C:\Windows\system32\Fpimlfke.exe
        12⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        13⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Ffceip32.exe
        
        C:\Windows\system32\Ffceip32.exe
        14⤵
        
        PID:4904
        
        C:\Windows\SysWOW64\Fbjena32.exe
        
        C:\Windows\system32\Fbjena32.exe
        15⤵
        
        PID:13168
        
        C:\Windows\SysWOW64\Gldglf32.exe
        
        C:\Windows\system32\Gldglf32.exe
        16⤵
        
        PID:6032
        
        C:\Windows\SysWOW64\Gemkelcd.exe
        
        C:\Windows\system32\Gemkelcd.exe
        17⤵
        Drops file in System32 directory
        
        PID:5300
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        18⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5968

C:\Windows\SysWOW64\Gfodeohd.exe
C:\Windows\system32\Gfodeohd.exe
1⤵
PID:4500
- C:\Windows\SysWOW64\Hipmfjee.exe
  C:\Windows\system32\Hipmfjee.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:776
- - C:\Windows\SysWOW64\Hbhboolf.exe
    C:\Windows\system32\Hbhboolf.exe
    3⤵
    PID:4524
  - - C:\Windows\SysWOW64\Hoobdp32.exe
      C:\Windows\system32\Hoobdp32.exe
      4⤵
      PID:4344
    - - C:\Windows\SysWOW64\Hffken32.exe
        
        C:\Windows\system32\Hffken32.exe
        5⤵
        
        PID:5536
      - C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        6⤵
        
        PID:12436
        
        C:\Windows\SysWOW64\Hblkjo32.exe
        
        C:\Windows\system32\Hblkjo32.exe
        7⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4752
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        9⤵
        
        PID:11616
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        10⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        11⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        12⤵
        
        PID:12524
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        13⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        14⤵
        
        PID:3280
        
        C:\Windows\SysWOW64\Iipfmggc.exe
        
        C:\Windows\system32\Iipfmggc.exe
        15⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        16⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Iefgbh32.exe
        
        C:\Windows\system32\Iefgbh32.exe
        17⤵
        
        PID:3016
        
        C:\Windows\SysWOW64\Ickglm32.exe
        
        C:\Windows\system32\Ickglm32.exe
        18⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Igfclkdj.exe
        
        C:\Windows\system32\Igfclkdj.exe
        19⤵
        
        PID:12736
        
        C:\Windows\SysWOW64\Jghpbk32.exe
        
        C:\Windows\system32\Jghpbk32.exe
        20⤵
        
        PID:448

C:\Windows\SysWOW64\Jcanll32.exe
C:\Windows\system32\Jcanll32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4496
- C:\Windows\SysWOW64\Jljbeali.exe
  C:\Windows\system32\Jljbeali.exe
  2⤵
  PID:12944
- - C:\Windows\SysWOW64\Jgpfbjlo.exe
    C:\Windows\system32\Jgpfbjlo.exe
    3⤵
    PID:6164
  - - C:\Windows\SysWOW64\Jniood32.exe
      C:\Windows\system32\Jniood32.exe
      4⤵
      PID:5444
    - - C:\Windows\SysWOW64\Knnhjcog.exe
        
        C:\Windows\system32\Knnhjcog.exe
        5⤵
        Drops file in System32 directory
        
        PID:5648
      - C:\Windows\SysWOW64\Kckqbj32.exe
        
        C:\Windows\system32\Kckqbj32.exe
        6⤵
        
        PID:13068
        
        C:\Windows\SysWOW64\Kflide32.exe
        
        C:\Windows\system32\Kflide32.exe
        7⤵
        
        PID:13116
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        8⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        9⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Kgkfnh32.exe
        
        C:\Windows\system32\Kgkfnh32.exe
        10⤵
        Modifies registry class
        
        PID:7004
        
        C:\Windows\SysWOW64\Kfnfjehl.exe
        
        C:\Windows\system32\Kfnfjehl.exe
        11⤵
        
        PID:7000
        
        C:\Windows\SysWOW64\Knenkbio.exe
        
        C:\Windows\system32\Knenkbio.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7052
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        13⤵
        
        PID:5160

C:\Windows\SysWOW64\Jocefm32.exe
C:\Windows\system32\Jocefm32.exe
1⤵
PID:5900

C:\Windows\SysWOW64\Lqkqhm32.exe
C:\Windows\system32\Lqkqhm32.exe
1⤵
PID:6304
- C:\Windows\SysWOW64\Lcimdh32.exe
  C:\Windows\system32\Lcimdh32.exe
  2⤵
  PID:6388
- - C:\Windows\SysWOW64\Lopmii32.exe
    C:\Windows\system32\Lopmii32.exe
    3⤵
    - Drops file in System32 directory
    PID:13220
  - - C:\Windows\SysWOW64\Ljeafb32.exe
      C:\Windows\system32\Ljeafb32.exe
      4⤵
      PID:13256
    - - C:\Windows\SysWOW64\Lcnfohmi.exe
        
        C:\Windows\system32\Lcnfohmi.exe
        5⤵
        
        PID:6740
      - C:\Windows\SysWOW64\Mnegbp32.exe
        
        C:\Windows\system32\Mnegbp32.exe
        6⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        7⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Mnhdgpii.exe
        
        C:\Windows\system32\Mnhdgpii.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        Modifies registry class
        
        PID:12312
        
        C:\Windows\SysWOW64\Mqfpckhm.exe
        
        C:\Windows\system32\Mqfpckhm.exe
        9⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Mgphpe32.exe
        
        C:\Windows\system32\Mgphpe32.exe
        10⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\Mqimikfj.exe
        
        C:\Windows\system32\Mqimikfj.exe
        11⤵
        
        PID:11692
        
        C:\Windows\SysWOW64\Mcgiefen.exe
        
        C:\Windows\system32\Mcgiefen.exe
        12⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Mnmmboed.exe
        
        C:\Windows\system32\Mnmmboed.exe
        13⤵
        
        PID:6460
        
        C:\Windows\SysWOW64\Njfkmphe.exe
        
        C:\Windows\system32\Njfkmphe.exe
        14⤵
        
        PID:11832
        
        C:\Windows\SysWOW64\Npbceggm.exe
        
        C:\Windows\system32\Npbceggm.exe
        15⤵
        
        PID:6248

C:\Windows\SysWOW64\Njhgbp32.exe
C:\Windows\system32\Njhgbp32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:3772
- C:\Windows\SysWOW64\Ncqlkemc.exe
  C:\Windows\system32\Ncqlkemc.exe
  2⤵
  - Modifies registry class
  PID:12520
- - C:\Windows\SysWOW64\Ngndaccj.exe
    C:\Windows\system32\Ngndaccj.exe
    3⤵
    PID:2580
  - - C:\Windows\SysWOW64\Ojomcopk.exe
      C:\Windows\system32\Ojomcopk.exe
      4⤵
      PID:6008
    - - C:\Windows\SysWOW64\Oaifpi32.exe
        
        C:\Windows\system32\Oaifpi32.exe
        5⤵
        
        PID:12692
      - C:\Windows\SysWOW64\Ojajin32.exe
        
        C:\Windows\system32\Ojajin32.exe
        6⤵
        
        PID:12636
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        7⤵
        
        PID:12676
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        8⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Onocomdo.exe
        
        C:\Windows\system32\Onocomdo.exe
        9⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Opqofe32.exe
        
        C:\Windows\system32\Opqofe32.exe
        10⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        11⤵
        
        PID:376
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        12⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Pffgom32.exe
        
        C:\Windows\system32\Pffgom32.exe
        13⤵
        
        PID:7708
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        14⤵
        
        PID:5496

C:\Windows\SysWOW64\Pfiddm32.exe
C:\Windows\system32\Pfiddm32.exe
1⤵
PID:4508
- C:\Windows\SysWOW64\Pdmdnadc.exe
  C:\Windows\system32\Pdmdnadc.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Modifies registry class
  PID:2168
- - C:\Windows\SysWOW64\Qaqegecm.exe
    C:\Windows\system32\Qaqegecm.exe
    3⤵
    PID:7392
  - - C:\Windows\SysWOW64\Qjiipk32.exe
      C:\Windows\system32\Qjiipk32.exe
      4⤵
      Drops file in System32 directory
      PID:6060
    - - C:\Windows\SysWOW64\Qpeahb32.exe
        
        C:\Windows\system32\Qpeahb32.exe
        5⤵
        
        PID:6120
      - C:\Windows\SysWOW64\Ahmjjoig.exe
        
        C:\Windows\system32\Ahmjjoig.exe
        6⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        7⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Ahofoogd.exe
        
        C:\Windows\system32\Ahofoogd.exe
        8⤵
        
        PID:3564
        
        C:\Windows\SysWOW64\Aknbkjfh.exe
        
        C:\Windows\system32\Aknbkjfh.exe
        9⤵
        Drops file in System32 directory
        
        PID:7476
        
        C:\Windows\SysWOW64\Aoioli32.exe
        
        C:\Windows\system32\Aoioli32.exe
        10⤵
        
        PID:1420
        
        C:\Windows\SysWOW64\Aagkhd32.exe
        
        C:\Windows\system32\Aagkhd32.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7152
        
        C:\Windows\SysWOW64\Ahaceo32.exe
        
        C:\Windows\system32\Ahaceo32.exe
        12⤵
        
        PID:6276

C:\Windows\SysWOW64\Akpoaj32.exe
C:\Windows\system32\Akpoaj32.exe
1⤵
PID:5384
- C:\Windows\SysWOW64\Amnlme32.exe
  C:\Windows\system32\Amnlme32.exe
  2⤵
  - Drops file in System32 directory
  PID:6264
- - C:\Windows\SysWOW64\Apmhiq32.exe
    C:\Windows\system32\Apmhiq32.exe
    3⤵
    PID:7996
  - - C:\Windows\SysWOW64\Aggpfkjj.exe
      C:\Windows\system32\Aggpfkjj.exe
      4⤵
      PID:13248
    - - C:\Windows\SysWOW64\Akblfj32.exe
        
        C:\Windows\system32\Akblfj32.exe
        5⤵
        
        PID:8096
      - C:\Windows\SysWOW64\Apodoq32.exe
        
        C:\Windows\system32\Apodoq32.exe
        6⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\Akdilipp.exe
        
        C:\Windows\system32\Akdilipp.exe
        7⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Aaoaic32.exe
        
        C:\Windows\system32\Aaoaic32.exe
        8⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7588
        
        C:\Windows\SysWOW64\Bhhiemoj.exe
        
        C:\Windows\system32\Bhhiemoj.exe
        9⤵
        
        PID:4844
        
        C:\Windows\SysWOW64\Bmeandma.exe
        
        C:\Windows\system32\Bmeandma.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6908
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        11⤵
        Drops file in System32 directory
        
        PID:7136
        
        C:\Windows\SysWOW64\Bhkfkmmg.exe
        
        C:\Windows\system32\Bhkfkmmg.exe
        12⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        13⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Bmhocd32.exe
        
        C:\Windows\system32\Bmhocd32.exe
        14⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        15⤵
        
        PID:3692
        
        C:\Windows\SysWOW64\Bphgeo32.exe
        
        C:\Windows\system32\Bphgeo32.exe
        16⤵
        
        PID:2860
        
        C:\Windows\SysWOW64\Bhpofl32.exe
        
        C:\Windows\system32\Bhpofl32.exe
        17⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Boihcf32.exe
        
        C:\Windows\system32\Boihcf32.exe
        18⤵
        
        PID:6536
        
        C:\Windows\SysWOW64\Bpkdjofm.exe
        
        C:\Windows\system32\Bpkdjofm.exe
        19⤵
        Modifies registry class
        
        PID:3540
        
        C:\Windows\SysWOW64\Bhblllfo.exe
        
        C:\Windows\system32\Bhblllfo.exe
        20⤵
        Modifies registry class
        
        PID:7040
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        21⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Bajqda32.exe
        
        C:\Windows\system32\Bajqda32.exe
        22⤵
        
        PID:7964
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8248
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        24⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7676
        
        C:\Windows\SysWOW64\Ckgohf32.exe
        
        C:\Windows\system32\Ckgohf32.exe
        25⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\Caageq32.exe
        
        C:\Windows\system32\Caageq32.exe
        26⤵
        
        PID:6604

C:\Windows\SysWOW64\Ckjknfnh.exe
C:\Windows\system32\Ckjknfnh.exe
1⤵
PID:5572
- C:\Windows\SysWOW64\Cacckp32.exe
  C:\Windows\system32\Cacckp32.exe
  2⤵
  - Drops file in System32 directory
  PID:6292
- - C:\Windows\SysWOW64\Chnlgjlb.exe
    C:\Windows\system32\Chnlgjlb.exe
    3⤵
    PID:6572
  - - C:\Windows\SysWOW64\Dddllkbf.exe
      C:\Windows\system32\Dddllkbf.exe
      4⤵
      PID:7200
    - - C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6576
      - C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        6⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Ddgibkpc.exe
        
        C:\Windows\system32\Ddgibkpc.exe
        7⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Dolmodpi.exe
        
        C:\Windows\system32\Dolmodpi.exe
        8⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Dakikoom.exe
        
        C:\Windows\system32\Dakikoom.exe
        9⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Dhdbhifj.exe
        
        C:\Windows\system32\Dhdbhifj.exe
        10⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Dkekjdck.exe
        
        C:\Windows\system32\Dkekjdck.exe
        11⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Eojiqb32.exe
        
        C:\Windows\system32\Eojiqb32.exe
        12⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Enmjlojd.exe
        
        C:\Windows\system32\Enmjlojd.exe
        13⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\Egened32.exe
        
        C:\Windows\system32\Egened32.exe
        14⤵
        
        PID:3384
        
        C:\Windows\SysWOW64\Fbmohmoh.exe
        
        C:\Windows\system32\Fbmohmoh.exe
        15⤵
        
        PID:4124
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        16⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Fgjhpcmo.exe
        
        C:\Windows\system32\Fgjhpcmo.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7264
        
        C:\Windows\SysWOW64\Fbplml32.exe
        
        C:\Windows\system32\Fbplml32.exe
        18⤵
        
        PID:8812
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        19⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Feqeog32.exe
        
        C:\Windows\system32\Feqeog32.exe
        20⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Fniihmpf.exe
        
        C:\Windows\system32\Fniihmpf.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8172
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        22⤵
        Modifies registry class
        
        PID:6700
        
        C:\Windows\SysWOW64\Fbgbnkfm.exe
        
        C:\Windows\system32\Fbgbnkfm.exe
        23⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Fajbjh32.exe
        
        C:\Windows\system32\Fajbjh32.exe
        24⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7620
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        26⤵
        
        PID:3272
        
        C:\Windows\SysWOW64\Gkaclqkk.exe
        
        C:\Windows\system32\Gkaclqkk.exe
        27⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Gkdpbpih.exe
        
        C:\Windows\system32\Gkdpbpih.exe
        28⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        29⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Gacepg32.exe
        
        C:\Windows\system32\Gacepg32.exe
        30⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Giljfddl.exe
        
        C:\Windows\system32\Giljfddl.exe
        31⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Hahokfag.exe
        
        C:\Windows\system32\Hahokfag.exe
        32⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        33⤵
        Drops file in System32 directory
        
        PID:6884
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        34⤵
        
        PID:12388
        
        C:\Windows\SysWOW64\Hbihjifh.exe
        
        C:\Windows\system32\Hbihjifh.exe
        35⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Hppeim32.exe
        
        C:\Windows\system32\Hppeim32.exe
        36⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Inebjihf.exe
        
        C:\Windows\system32\Inebjihf.exe
        37⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        38⤵
        
        PID:12488
        
        C:\Windows\SysWOW64\Ilibdmgp.exe
        
        C:\Windows\system32\Ilibdmgp.exe
        39⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Iafkld32.exe
        
        C:\Windows\system32\Iafkld32.exe
        40⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Ieccbbkn.exe
        
        C:\Windows\system32\Ieccbbkn.exe
        41⤵
        
        PID:8560
        
        C:\Windows\SysWOW64\Ihbponja.exe
        
        C:\Windows\system32\Ihbponja.exe
        42⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Iialhaad.exe
        
        C:\Windows\system32\Iialhaad.exe
        43⤵
        
        PID:7292
        
        C:\Windows\SysWOW64\Ibjqaf32.exe
        
        C:\Windows\system32\Ibjqaf32.exe
        44⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Jlbejloe.exe
        
        C:\Windows\system32\Jlbejloe.exe
        45⤵
        Modifies registry class
        
        PID:4808
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        46⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Jldbpl32.exe
        
        C:\Windows\system32\Jldbpl32.exe
        47⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        48⤵
        
        PID:8972
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        49⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Jllhpkfk.exe
        
        C:\Windows\system32\Jllhpkfk.exe
        50⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Kiphjo32.exe
        
        C:\Windows\system32\Kiphjo32.exe
        51⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8236
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        52⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Kplmliko.exe
        
        C:\Windows\system32\Kplmliko.exe
        53⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        54⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Kekbjo32.exe
        
        C:\Windows\system32\Kekbjo32.exe
        55⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Kpqggh32.exe
        
        C:\Windows\system32\Kpqggh32.exe
        56⤵
        Drops file in System32 directory
        
        PID:8576
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        57⤵
        
        PID:8984
        
        C:\Windows\SysWOW64\Lpepbgbd.exe
        
        C:\Windows\system32\Lpepbgbd.exe
        58⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        59⤵
        
        PID:960
        
        C:\Windows\SysWOW64\Lcfidb32.exe
        
        C:\Windows\system32\Lcfidb32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2940
        
        C:\Windows\SysWOW64\Ledepn32.exe
        
        C:\Windows\system32\Ledepn32.exe
        61⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Lhcali32.exe
        
        C:\Windows\system32\Lhcali32.exe
        62⤵
        
        PID:9044
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        63⤵
        Drops file in System32 directory
        
        PID:2716
        
        C:\Windows\SysWOW64\Llcghg32.exe
        
        C:\Windows\system32\Llcghg32.exe
        64⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        65⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\Mjggal32.exe
        
        C:\Windows\system32\Mjggal32.exe
        66⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        67⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Mablfnne.exe
        
        C:\Windows\system32\Mablfnne.exe
        68⤵
        
        PID:2500
        
        C:\Windows\SysWOW64\Mlhqcgnk.exe
        
        C:\Windows\system32\Mlhqcgnk.exe
        69⤵
        Drops file in System32 directory
        
        PID:6412
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        70⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Mjlalkmd.exe
        
        C:\Windows\system32\Mjlalkmd.exe
        71⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Mohidbkl.exe
        
        C:\Windows\system32\Mohidbkl.exe
        72⤵
        
        PID:8300
        
        C:\Windows\SysWOW64\Mfbaalbi.exe
        
        C:\Windows\system32\Mfbaalbi.exe
        73⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Mhanngbl.exe
        
        C:\Windows\system32\Mhanngbl.exe
        74⤵
        Modifies registry class
        
        PID:5172
        
        C:\Windows\SysWOW64\Mbibfm32.exe
        
        C:\Windows\system32\Mbibfm32.exe
        75⤵
        
        PID:7696
        
        C:\Windows\SysWOW64\Nblolm32.exe
        
        C:\Windows\system32\Nblolm32.exe
        76⤵
        
        PID:8420
        
        C:\Windows\SysWOW64\Njedbjej.exe
        
        C:\Windows\system32\Njedbjej.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6420
        
        C:\Windows\SysWOW64\Ncbafoge.exe
        
        C:\Windows\system32\Ncbafoge.exe
        78⤵
        
        PID:9784

C:\Windows\SysWOW64\Oiagde32.exe
C:\Windows\system32\Oiagde32.exe
1⤵
PID:6516
- C:\Windows\SysWOW64\Ofgdcipq.exe
  C:\Windows\system32\Ofgdcipq.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:10040
- - C:\Windows\SysWOW64\Oifppdpd.exe
    C:\Windows\system32\Oifppdpd.exe
    3⤵
    - Modifies registry class
    PID:9356
  - - C:\Windows\SysWOW64\Omalpc32.exe
      C:\Windows\system32\Omalpc32.exe
      4⤵
      PID:9592
    - - C:\Windows\SysWOW64\Oophlo32.exe
        
        C:\Windows\system32\Oophlo32.exe
        5⤵
        
        PID:9176
      - C:\Windows\SysWOW64\Obnehj32.exe
        
        C:\Windows\system32\Obnehj32.exe
        6⤵
        
        PID:9588
        
        C:\Windows\SysWOW64\Ofjqihnn.exe
        
        C:\Windows\system32\Ofjqihnn.exe
        7⤵
        
        PID:7904

C:\Windows\SysWOW64\Padnaq32.exe
C:\Windows\system32\Padnaq32.exe
1⤵
- Drops file in System32 directory
PID:9428
- C:\Windows\SysWOW64\Pblajhje.exe
  C:\Windows\system32\Pblajhje.exe
  2⤵
  PID:8008

C:\Windows\SysWOW64\Cbkfbcpb.exe
C:\Windows\system32\Cbkfbcpb.exe
1⤵
PID:9392
- C:\Windows\SysWOW64\Ccblbb32.exe
  C:\Windows\system32\Ccblbb32.exe
  2⤵
  PID:9552
- - C:\Windows\SysWOW64\Ekimjn32.exe
    C:\Windows\system32\Ekimjn32.exe
    3⤵
    PID:7464
  - - C:\Windows\SysWOW64\Eddnic32.exe
      C:\Windows\system32\Eddnic32.exe
      4⤵
      PID:10048
    - - C:\Windows\SysWOW64\Ekngemhd.exe
        
        C:\Windows\system32\Ekngemhd.exe
        5⤵
        Modifies registry class
        
        PID:10016
      - C:\Windows\SysWOW64\Eahobg32.exe
        
        C:\Windows\system32\Eahobg32.exe
        6⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Edfknb32.exe
        
        C:\Windows\system32\Edfknb32.exe
        7⤵
        
        PID:9048
        
        C:\Windows\SysWOW64\Fclhpo32.exe
        
        C:\Windows\system32\Fclhpo32.exe
        8⤵
        Drops file in System32 directory
        
        PID:4792
        
        C:\Windows\SysWOW64\Fkcpql32.exe
        
        C:\Windows\system32\Fkcpql32.exe
        9⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\Fqphic32.exe
        
        C:\Windows\system32\Fqphic32.exe
        10⤵
        
        PID:9796
        
        C:\Windows\SysWOW64\Fgiaemic.exe
        
        C:\Windows\system32\Fgiaemic.exe
        11⤵
        
        PID:8956
        
        C:\Windows\SysWOW64\Fjhmbihg.exe
        
        C:\Windows\system32\Fjhmbihg.exe
        12⤵
        
        PID:9568
        
        C:\Windows\SysWOW64\Fboecfii.exe
        
        C:\Windows\system32\Fboecfii.exe
        13⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Fcpakn32.exe
        
        C:\Windows\system32\Fcpakn32.exe
        14⤵
        
        PID:9640
        
        C:\Windows\SysWOW64\Fqdbdbna.exe
        
        C:\Windows\system32\Fqdbdbna.exe
        15⤵
        
        PID:9716
        
        C:\Windows\SysWOW64\Gjcmngnj.exe
        
        C:\Windows\system32\Gjcmngnj.exe
        16⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Gqnejaff.exe
        
        C:\Windows\system32\Gqnejaff.exe
        17⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Gclafmej.exe
        
        C:\Windows\system32\Gclafmej.exe
        18⤵
        
        PID:10568
        
        C:\Windows\SysWOW64\Gkcigjel.exe
        
        C:\Windows\system32\Gkcigjel.exe
        19⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Gbmadd32.exe
        
        C:\Windows\system32\Gbmadd32.exe
        20⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8920 -s 408
        21⤵
        Program crash
        
        PID:10336

C:\Windows\SysWOW64\Adgmoigj.exe
C:\Windows\system32\Adgmoigj.exe
1⤵
- Modifies registry class
PID:8940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 8920 -ip 8920
1⤵
PID:8356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aanbhp32.exe

Filesize
55KB

MD5
e9e1b396a629c43cd04d9542c569bbf1

SHA1
14160de79f11a908c8900b051f342185c9745830

SHA256
da8c2c8df7dc0a9a721ad138179ace388985fb70ce21446847240550a0eabad3

SHA512
73d632897134cf00f41163e4d091321a4c0758b9ff25f652234b521116d94d45bbb86996d19fdcb84a07429c1b335c52ca6d2c1e7c3432c75ca35f5cf77aff6a

Download Submit
C:\Windows\SysWOW64\Akffafgg.exe

Filesize
55KB

MD5
918385a1903a76d472d19c0c79c89278

SHA1
f4eaa7d97ca2fd5488cd0a4e2900b44a90a6be53

SHA256
dee504c2e1ee0c23ae960c8b0e06cd732343d612f8c38601a717e4754da4ada5

SHA512
5043b25f9764054ef6fab95d2e54abc6bbf2bcd154617bc5452741f85c0d01a8cfd0d5e985a8672e1f670aa7b4edcd9ae298aaa83461dbe71d4c96f8a1566ae7

Download Submit
C:\Windows\SysWOW64\Allpejfe.exe

Filesize
55KB

MD5
3db07d06e015d0424e5d3dac85faaf45

SHA1
f8c0075361a38951c7d7c49d520d40a49548c627

SHA256
7d5f6e7e356831450a01d2dfe2f92d1c4c3dc792f6861aeceef835db5fc89896

SHA512
df677aaa1687d242d7a671d93c1e150b6026620d2f474a04417243d3f7b39790af7b6e969c35b94ee778ec22048389e9586339fde167575c86201f1f582bd833

Download Submit
C:\Windows\SysWOW64\Bcghch32.exe

Filesize
55KB

MD5
6a5d2cb79f8ea80eb6f975d3bd99972f

SHA1
c7790fbedb46bdda5dc497058f0594789780e092

SHA256
68f4ae6a6075fb27bb3d039733c136995abda6adc33581acce96e693b6424736

SHA512
463d36d76d53761727777b82b58e8f7a7656639ff783cac48baf5d14b3279a76f320acbe44c53cb7e3c37ac0a452b133c65d4251c9abfc79f321b78b1a17d598

Download Submit
C:\Windows\SysWOW64\Bfhhoi32.exe

Filesize
55KB

MD5
e407ae88fc4a039316d86dfba2b81266

SHA1
55e6f496cf10a6f72d16d93aa97c160e738765e6

SHA256
73bfeb3783e4fe0b65baead0d012c1089424288942bad43473cb20772297bb77

SHA512
fa771b380a9455bd1a07b9848ffdee1c3384955d8129ee897ce76aaa55ba1a4e425b5d8aced3b32016568ee712455080cb1dadde850b0e05937b58c1b52dd7e5

Download Submit
C:\Windows\SysWOW64\Bkkple32.exe

Filesize
55KB

MD5
56e778574fbcacfe11edb9fb0600bfd9

SHA1
a2198d3c83dbccd26ee7e3a4ef0fc146b808eba0

SHA256
aaf800c567d9756aa7327fddf61c478d39b62cf902cf0d4c1755ed593f4c4df4

SHA512
c1042d724acb74a1b6bf28dcdd2cdc43f3b92f0b1ef578b6dc55b5571d4fc26f14259351ec01e159a72a880e36e3e61b42faff65349c19ba90a676506379c05c

Download Submit
C:\Windows\SysWOW64\Cgndoeag.exe

Filesize
55KB

MD5
43f005689fdd3b7d1529cd9a8f3b0d8f

SHA1
bd7cb5c50305b77b98a2151c9c00f1190a2dc831

SHA256
9f2b282346b0de422048d5aac35f606507e65c77a361486d98a0c046ee16ee18

SHA512
6b673af3085286acd586dfa9c09254b6072bfcec58ce4dc631b2154ba7dbb65645083f418f9b1c201d689f9ad793e525ad16e391f0b87613a2117c57e7a3ba4c

Download Submit
C:\Windows\SysWOW64\Cjecpkcg.exe

Filesize
55KB

MD5
278498635a3263396da69d5936d63668

SHA1
03a7f464d46e5a428603fa99f83ac4574ad6efb3

SHA256
d06429ffa9a7ef024eef83a294c1cfb94703c5b5fa4dc16a5544b12abbdad2d0

SHA512
95081d937909e5f308441bd1bb00fba27c00b49c69bddb2ecb3c0c770295e82b8a81143629568f18a008ceda90a5942689af0079dc16386068feeb71d2711957

Download Submit
C:\Windows\SysWOW64\Ckilmcgb.exe

Filesize
55KB

MD5
daf92539a891857418020b1d5c6fe038

SHA1
6a6c2d040f3bdf95854173d7ab67111b50f3335d

SHA256
e2900d3e39c3260b637c1406088b8332622de9d3a4f94cc44cc5f2788482d335

SHA512
701400712115110ad4bd15a302e98ccd449f18bcbf9af82b379be93b42ba59e33215b49deb96573ec1f00c6d0dce628809202b7f957c9d03029ed49c1a26bc00

Download Submit
C:\Windows\SysWOW64\Ddjejl32.exe

Filesize
55KB

MD5
4a09ba170a56196515de3940f56e7e1c

SHA1
92bc5d9202e422940211080af7101ccdaa11e851

SHA256
1dc32f58de7e4de200a5219200e2c9ef5ea06cd58dd740ee33425daad6b60666

SHA512
4ed210c828690f426214ab30f2cadbe806367960bf00f80b2e690d3846e8539093922e2736d98828c7e240a2d70600c874c4b934b211338149d9139e5f783d58

Download Submit
C:\Windows\SysWOW64\Dmdonkgc.exe

Filesize
55KB

MD5
deebcf53dd41c68d2f1c0a619fc8d74f

SHA1
1d7b719815413135740f8aa631d2e8a66e7bfa82

SHA256
f1b3da8ce39c3ef719800f677acc7fc8a8c1f77fe13ba261bc0013d73d1d8a3d

SHA512
e3b43f4c7c3a5cf99f7c38f53f7fb7c65328b93d7e013f781d6744c9b043d34182bd7bf68d8f91b23e6f26fd706db8ee84711ca627a4d4e8b5b4d5b410ee9330

Download Submit
C:\Windows\SysWOW64\Efffmo32.exe

Filesize
55KB

MD5
17acfee37b89dab6434686edf06c9eda

SHA1
e33e28929256a241ec00b4694a355630a7c9cc64

SHA256
a31dc2bbcb8cacd07e846bcd5b49d3fcc2496d9844c4da0f4242e5ed0f8bd2fe

SHA512
4fdfee1a5ebfba626366057ab6b0fc1a00c68f8cb96fd822f63929d5a3f923f3f72c578b3087df8abdf5e13623bb808fb4e756bd31b4c6684e9ab30e7623b229

Download Submit
C:\Windows\SysWOW64\Eidlnd32.exe

Filesize
55KB

MD5
be1a6073f01f6636ffe200b4c17dbd02

SHA1
1ed5b046c02ff25b2c18c34848c2c87da8820690

SHA256
c51054c121ceedc3967394b41acd5424fc52f2ef6549f895df880e31d52a192d

SHA512
1d60ca3e79e5dd9937fa619cfb9ce55648f8020600a0c7f9d62c02ec0d34c8e13eee4e2215183277eb3e6dbb91e5f800962a2eeda5c44e8fb0b0bced605c6a5c

Download Submit
C:\Windows\SysWOW64\Ekpmbddq.exe

Filesize
55KB

MD5
43c5b2c940f78236c863983e459aecba

SHA1
d29c2a7eaefce9e5b0c17ceb284827489bc6f1c2

SHA256
2ae144f25b58cc8a6d904c6d0f14bf337b8ebafa77f70804329325a3f34dd50e

SHA512
000f4e607198f83d351eb9a32ec80a8ec915c11bc5c353c71bc5f8a8fa92e984970926ea0019b964017b2e6b027cdf3315eb1b4a4269970baddf9b41c85ac389

Download Submit
C:\Windows\SysWOW64\Fagjfflb.exe

Filesize
55KB

MD5
147fedf34e456cb0c0adcb6bf4508350

SHA1
d7ba8aa3447a7cf1f2c241cba4cde932bcfaf280

SHA256
f42718de757825e2457abbc60100c72484c7242d6ce995b8d876eac263e91a09

SHA512
f320def16a299b10fdd631f8928f973e1d6a0be156663fd365ab00cd29cf7b75804f3b47b78e597ec7a90baba165ea01d8006c75e75dcb3c67375d44be8b2257

Download Submit
C:\Windows\SysWOW64\Fakdpb32.exe

Filesize
55KB

MD5
1a7341ede6ebb6bf00e4170ee67c48e3

SHA1
279d101dbb70cf7b4be11487d0677c10b98063cd

SHA256
376d12749ec47dd9c5602a94a5fab540d7e4854cc30d071764bebc0ae26f8213

SHA512
b7328830ad9152dcabdd010247939eb751efc3acbfad2e419a35008cc1e02405d4713844181debb177c0ef7f2d3f96e0831b618b552ee94a42e009d598476e1d

Download Submit
C:\Windows\SysWOW64\Fakdpb32.exe

Filesize
55KB

MD5
1a7341ede6ebb6bf00e4170ee67c48e3

SHA1
279d101dbb70cf7b4be11487d0677c10b98063cd

SHA256
376d12749ec47dd9c5602a94a5fab540d7e4854cc30d071764bebc0ae26f8213

SHA512
b7328830ad9152dcabdd010247939eb751efc3acbfad2e419a35008cc1e02405d4713844181debb177c0ef7f2d3f96e0831b618b552ee94a42e009d598476e1d

Download Submit
C:\Windows\SysWOW64\Fckajehi.exe

Filesize
55KB

MD5
9d35f249ba1146f25492cdfa97014e38

SHA1
c0ab5ee9eb26d51c6fa57bd43393bfff8eba8e11

SHA256
d9b71626618d112ccfea184a336d6a0a36233332853a973a8b0e292bea307e27

SHA512
f9265dfe8759b8553a81e2757cb9e6f514d56e1cafa48f2841d092fd74790e87e439451a422686058c833601bd78041f6a808003c4d87bd1a000f8c68090e6bd

Download Submit
C:\Windows\SysWOW64\Fckajehi.exe

Filesize
55KB

MD5
9d35f249ba1146f25492cdfa97014e38

SHA1
c0ab5ee9eb26d51c6fa57bd43393bfff8eba8e11

SHA256
d9b71626618d112ccfea184a336d6a0a36233332853a973a8b0e292bea307e27

SHA512
f9265dfe8759b8553a81e2757cb9e6f514d56e1cafa48f2841d092fd74790e87e439451a422686058c833601bd78041f6a808003c4d87bd1a000f8c68090e6bd

Download Submit
C:\Windows\SysWOW64\Fdnjgmle.exe

Filesize
55KB

MD5
ae89d0297580382e1f5c3c847d01a93c

SHA1
b689f7fbb0b4a3fa94ecd21f978beb376ee43410

SHA256
cbb63182904b907f91c6128243ae31a35e3273607c79c6ae90c3671ea664cfa1

SHA512
4321798a80d91cf1dc3de282c1fd965fb30a0b38f7b9b68642ef57a753aba8755e6f8e6be4b65b6ce92679c945794514491152e41c21e31cf62df677ebc72a86

Download Submit
C:\Windows\SysWOW64\Fdnjgmle.exe

Filesize
55KB

MD5
ae89d0297580382e1f5c3c847d01a93c

SHA1
b689f7fbb0b4a3fa94ecd21f978beb376ee43410

SHA256
cbb63182904b907f91c6128243ae31a35e3273607c79c6ae90c3671ea664cfa1

SHA512
4321798a80d91cf1dc3de282c1fd965fb30a0b38f7b9b68642ef57a753aba8755e6f8e6be4b65b6ce92679c945794514491152e41c21e31cf62df677ebc72a86

Download Submit
C:\Windows\SysWOW64\Fkffog32.exe

Filesize
55KB

MD5
8d1f9cf67e9da1b5e0c5b4c69ef41b77

SHA1
a33e874169364925c7e25f29ab85d83093e15967

SHA256
7f9e65f6459f93debbe4012a679233a106381e1675e6cae2ac5bbf9670ffd94d

SHA512
5d6ab4f43ca27a24434f7212a0ce38ea1963ff5d7327eae2fcbbf4eee36541f4966a8b85f2a806b5224608450e1600fd51652e44f6e699ea75aaf2cd43e5ef0e

Download Submit
C:\Windows\SysWOW64\Fkffog32.exe

Filesize
55KB

MD5
8d1f9cf67e9da1b5e0c5b4c69ef41b77

SHA1
a33e874169364925c7e25f29ab85d83093e15967

SHA256
7f9e65f6459f93debbe4012a679233a106381e1675e6cae2ac5bbf9670ffd94d

SHA512
5d6ab4f43ca27a24434f7212a0ce38ea1963ff5d7327eae2fcbbf4eee36541f4966a8b85f2a806b5224608450e1600fd51652e44f6e699ea75aaf2cd43e5ef0e

Download Submit
C:\Windows\SysWOW64\Fkffog32.exe

Filesize
55KB

MD5
8d1f9cf67e9da1b5e0c5b4c69ef41b77

SHA1
a33e874169364925c7e25f29ab85d83093e15967

SHA256
7f9e65f6459f93debbe4012a679233a106381e1675e6cae2ac5bbf9670ffd94d

SHA512
5d6ab4f43ca27a24434f7212a0ce38ea1963ff5d7327eae2fcbbf4eee36541f4966a8b85f2a806b5224608450e1600fd51652e44f6e699ea75aaf2cd43e5ef0e

Download Submit
C:\Windows\SysWOW64\Flqimk32.exe

Filesize
55KB

MD5
faab5b524987cea7f532c6a379c2bf74

SHA1
1f8232f241fd1165b8eb36a0e79a6cccf70d7d32

SHA256
3d0735371b1825869473c9c7cb1866eabfd9658074f5c450e318d08dd7830f01

SHA512
16baf692bf37da50dcf9d906d1e7b36cdad811db7a7f32530f4adbd30316d73092f850c9182cfd84534b36380355c5031b15f9b350a25b77b86eb0092340a5dd

Download Submit
C:\Windows\SysWOW64\Flqimk32.exe

Filesize
55KB

MD5
faab5b524987cea7f532c6a379c2bf74

SHA1
1f8232f241fd1165b8eb36a0e79a6cccf70d7d32

SHA256
3d0735371b1825869473c9c7cb1866eabfd9658074f5c450e318d08dd7830f01

SHA512
16baf692bf37da50dcf9d906d1e7b36cdad811db7a7f32530f4adbd30316d73092f850c9182cfd84534b36380355c5031b15f9b350a25b77b86eb0092340a5dd

Download Submit
C:\Windows\SysWOW64\Fpggamqc.exe

Filesize
55KB

MD5
c7b6266845a50dc0604f6bb696d606f2

SHA1
2109b733ca60cccbb2cd3796a4a7b4c69cc83885

SHA256
a7ab7a9a6124da2c7583597eb733e4bf05e13a68c75cf802bfc0a7bcfc743d60

SHA512
a67dac4f4bb0cb260a6f49693787b04b0d1e6d5596648d3065d13849884279bf003d6e034b0be3228be80a182db4e1b9b9c8a68710bdfa0f655402203e5d590d

Download Submit
C:\Windows\SysWOW64\Gcagkdba.exe

Filesize
55KB

MD5
7d11be3be8826ea8c851ae222bde7c70

SHA1
46a1544da45fe6c5254c38268d04b4ae3e2146dd

SHA256
76878deafb349e70a8f6e436b247356ccf270034e2fe3a62893b16fa13b4634d

SHA512
360acdbe175368da0e7883da70b58ff05dd6c6583419920db1828b1c8927ad8258802449633656d5e86eda1981ee333b16215fcc964d2f1e1c8e9d7b751b4b61

Download Submit
C:\Windows\SysWOW64\Gcagkdba.exe

Filesize
55KB

MD5
7d11be3be8826ea8c851ae222bde7c70

SHA1
46a1544da45fe6c5254c38268d04b4ae3e2146dd

SHA256
76878deafb349e70a8f6e436b247356ccf270034e2fe3a62893b16fa13b4634d

SHA512
360acdbe175368da0e7883da70b58ff05dd6c6583419920db1828b1c8927ad8258802449633656d5e86eda1981ee333b16215fcc964d2f1e1c8e9d7b751b4b61

Download Submit
C:\Windows\SysWOW64\Gcddpdpo.exe

Filesize
55KB

MD5
629b81fd42cd277129f859a93bfcae70

SHA1
932796ab4666a9da7dbaf4692df40ddf59c5881a

SHA256
a9f4adb16091b62c53afbe84fd73a4fc0146879750f64cb44e6dc6c3043de2bf

SHA512
631101ebf817c5dea892cdd4d6ee2ba9c87454606755c840a651caeccc099b739fbf2fa6525f6756d019bee3a1fbcdbb5c362a73a2c77acaec51d3501e44ff15

Download Submit
C:\Windows\SysWOW64\Gcddpdpo.exe

Filesize
55KB

MD5
629b81fd42cd277129f859a93bfcae70

SHA1
932796ab4666a9da7dbaf4692df40ddf59c5881a

SHA256
a9f4adb16091b62c53afbe84fd73a4fc0146879750f64cb44e6dc6c3043de2bf

SHA512
631101ebf817c5dea892cdd4d6ee2ba9c87454606755c840a651caeccc099b739fbf2fa6525f6756d019bee3a1fbcdbb5c362a73a2c77acaec51d3501e44ff15

Download Submit
C:\Windows\SysWOW64\Gcimkc32.exe

Filesize
55KB

MD5
72884513485bf1cff55d65323d9d0a3e

SHA1
f08f4e1c833ecf5c463d3a58d83eadbc60e1c995

SHA256
cf2c24678c519085753b046e7b6999e4990b15f878dd194277356ac95f046e22

SHA512
2245e5bc633d827b7a0e45f3aad9825ec9a0a9e959f72a0abebc9e257d589b6ad792e7582928b5277277e5d89f772ae1ad04af58520314e32b8eb5d77fecb6a5

Download Submit
C:\Windows\SysWOW64\Gcimkc32.exe

Filesize
55KB

MD5
72884513485bf1cff55d65323d9d0a3e

SHA1
f08f4e1c833ecf5c463d3a58d83eadbc60e1c995

SHA256
cf2c24678c519085753b046e7b6999e4990b15f878dd194277356ac95f046e22

SHA512
2245e5bc633d827b7a0e45f3aad9825ec9a0a9e959f72a0abebc9e257d589b6ad792e7582928b5277277e5d89f772ae1ad04af58520314e32b8eb5d77fecb6a5

Download Submit
C:\Windows\SysWOW64\Gcojed32.exe

Filesize
55KB

MD5
5611e2041bac16ffd9ffe15193e196d2

SHA1
3c53fdee42984abf78299f9c57cdcc2a5dbaa21e

SHA256
663582b625992da38aaf488b8414451c7d551bb496e5e2ae120bdfdd9bb2c911

SHA512
ca6c89233b89dba90db61662a19d3aedf289e8937b084473ac9d567167a4cb79c32b5fbd53a56912349c489f9f691d1b2b9a0406891816d467cb7daa97f9f7ac

Download Submit
C:\Windows\SysWOW64\Gcojed32.exe

Filesize
55KB

MD5
5611e2041bac16ffd9ffe15193e196d2

SHA1
3c53fdee42984abf78299f9c57cdcc2a5dbaa21e

SHA256
663582b625992da38aaf488b8414451c7d551bb496e5e2ae120bdfdd9bb2c911

SHA512
ca6c89233b89dba90db61662a19d3aedf289e8937b084473ac9d567167a4cb79c32b5fbd53a56912349c489f9f691d1b2b9a0406891816d467cb7daa97f9f7ac

Download Submit
C:\Windows\SysWOW64\Gdhmnlcj.exe

Filesize
55KB

MD5
d6aadf1ea76fd613ff317b1d4922f0fc

SHA1
8235613ce1a49d7f069b614012be10a5d9dfe15f

SHA256
573c671fb5cdb5148b429562d499726999fbc73ed351cd2a522856278a1ab134

SHA512
8e27d83fefc32598e09ed2823b7a77f207098b9b2a557c63cdbad3a48763ef04b90aef4ae1f483f4b2d7874c1e5b52a0afc99bb02442d29fc3cf69bddcd2f00f

Download Submit
C:\Windows\SysWOW64\Gdhmnlcj.exe

Filesize
55KB

MD5
d6aadf1ea76fd613ff317b1d4922f0fc

SHA1
8235613ce1a49d7f069b614012be10a5d9dfe15f

SHA256
573c671fb5cdb5148b429562d499726999fbc73ed351cd2a522856278a1ab134

SHA512
8e27d83fefc32598e09ed2823b7a77f207098b9b2a557c63cdbad3a48763ef04b90aef4ae1f483f4b2d7874c1e5b52a0afc99bb02442d29fc3cf69bddcd2f00f

Download Submit
C:\Windows\SysWOW64\Gdqgmmjb.exe

Filesize
55KB

MD5
234ee2313945e7359e7d8e51d95a3f0d

SHA1
45db96c9f7eacebea4b30c47578e295edc6bcb20

SHA256
dfac088da3d25c8e9eb2fd07b2f08b20a8cb05d8ac6c9c25bdfa50d56d1f7b41

SHA512
4a11aa0877d81d60df726c8330f75c8d8278bfe31deda14706725bf81949a261ff6b604789c17b835dbca31111701a3b7c0221444541318c1467f5a1065a6ced

Download Submit
C:\Windows\SysWOW64\Gdqgmmjb.exe

Filesize
55KB

MD5
234ee2313945e7359e7d8e51d95a3f0d

SHA1
45db96c9f7eacebea4b30c47578e295edc6bcb20

SHA256
dfac088da3d25c8e9eb2fd07b2f08b20a8cb05d8ac6c9c25bdfa50d56d1f7b41

SHA512
4a11aa0877d81d60df726c8330f75c8d8278bfe31deda14706725bf81949a261ff6b604789c17b835dbca31111701a3b7c0221444541318c1467f5a1065a6ced

Download Submit
C:\Windows\SysWOW64\Gglpibgm.exe

Filesize
55KB

MD5
175c1a3f8cf118b598266751bc52ddc9

SHA1
a958acf4d5379dce117d8ba637216b5a9ab3fc2d

SHA256
be892b30736ed21025a5181876d6cd3b7eb07d2f5c73851ea4c6b1620a32f5a8

SHA512
4cc2425288c0987f592dc6179abd989feedb6a8e6ba065d7f29fb8c2b2725896857273134e2a5cc65f19a4e43f47abf2c2a10f4f7cb7723c2070598ae4555764

Download Submit
C:\Windows\SysWOW64\Ghaliknf.exe

Filesize
55KB

MD5
d7257bd6253df615b4ecc81371b9ce58

SHA1
a409b2926736b627f4f6b1ed85ee32a097a89555

SHA256
ac348b1174daae58b02e994e04c55be9e68978a49e87be0d3e949eeeae6aa013

SHA512
63cd8f9b47ab51d2b69f3fb333f2174c62de9ec441279031195d37c5b49509a94f06bb7355ad722462cda708e41320ec8fde986faa1b56ab99b3cb5d0c6ccab1

Download Submit
C:\Windows\SysWOW64\Ghaliknf.exe

Filesize
55KB

MD5
d7257bd6253df615b4ecc81371b9ce58

SHA1
a409b2926736b627f4f6b1ed85ee32a097a89555

SHA256
ac348b1174daae58b02e994e04c55be9e68978a49e87be0d3e949eeeae6aa013

SHA512
63cd8f9b47ab51d2b69f3fb333f2174c62de9ec441279031195d37c5b49509a94f06bb7355ad722462cda708e41320ec8fde986faa1b56ab99b3cb5d0c6ccab1

Download Submit
C:\Windows\SysWOW64\Ghopckpi.exe

Filesize
55KB

MD5
cf5dfa4749f9bdbabbac82b0ccaecdab

SHA1
bbd4a03433db00886788bf3a644b72a936e21486

SHA256
1f994f570a8ee0cd2c0d46315c772702c3f13ca122d56587ed7c70987585e0a6

SHA512
21614fdb5bd52842245c8b56cd4b953ca47a8d8e095578bf47867cf44a7bc2ab861cbe0402e4c2fe82a44c0a2d48e951724493eee5b33a46a12dd791acb1ace9

Download Submit
C:\Windows\SysWOW64\Ghopckpi.exe

Filesize
55KB

MD5
cf5dfa4749f9bdbabbac82b0ccaecdab

SHA1
bbd4a03433db00886788bf3a644b72a936e21486

SHA256
1f994f570a8ee0cd2c0d46315c772702c3f13ca122d56587ed7c70987585e0a6

SHA512
21614fdb5bd52842245c8b56cd4b953ca47a8d8e095578bf47867cf44a7bc2ab861cbe0402e4c2fe82a44c0a2d48e951724493eee5b33a46a12dd791acb1ace9

Download Submit
C:\Windows\SysWOW64\Gkaejf32.exe

Filesize
55KB

MD5
9d6ec749dc5c2401136cb8bb42ed7c9c

SHA1
320b489c4e0495f8c564a4cb4391b23ca34dd1d9

SHA256
b2de87d009f0a2b3333c11dd65ce261db37901332cd5e9dec360fd7b4c8f7a90

SHA512
48e4c4354760bf05952cbb5d8c927a319d9898768f2e88c3134ab8e07f9070058b77b9966cdf3937fdafe381738f46516468a7ac2d33b5c69651b6d52566df57

Download Submit
C:\Windows\SysWOW64\Gkaejf32.exe

Filesize
55KB

MD5
9d6ec749dc5c2401136cb8bb42ed7c9c

SHA1
320b489c4e0495f8c564a4cb4391b23ca34dd1d9

SHA256
b2de87d009f0a2b3333c11dd65ce261db37901332cd5e9dec360fd7b4c8f7a90

SHA512
48e4c4354760bf05952cbb5d8c927a319d9898768f2e88c3134ab8e07f9070058b77b9966cdf3937fdafe381738f46516468a7ac2d33b5c69651b6d52566df57

Download Submit
C:\Windows\SysWOW64\Gmbmkpie.exe

Filesize
55KB

MD5
6cad7bd59516d7108bc31dcbaa0fea53

SHA1
9f2da64d5e18c613ffd3108bc0e11d5dca576a21

SHA256
1962239f01136845486ffe3d231cbc125f1c1cbec6a749ea2d5825de9fa339c0

SHA512
3d599c935174562ce0adbac0edec5e7566a5790647ebb9cb30896791b9f6f3515ad9b52c33628fecbc9a619e20f87d60be8ad40bceaee0ed07b1df4851cba7a5

Download Submit
C:\Windows\SysWOW64\Gokdeeec.exe

Filesize
55KB

MD5
06f257d82c9b1bb7d9bc284747e9176b

SHA1
da27ef2d94f43b7a9ff3e19e96b3218a334a3626

SHA256
4cd06f37b62259cc61dde9aa9efa520fce6ea4cbfb70f6f0b5fb623438fce88b

SHA512
3b89ca9bccc88a2beae571c69999532155ef1c197c86620efe15fb43182aa10477d95c55ed499262a1a860164b1b5c4e9049d2d9abff68d1bc355bb24db2ccc4

Download Submit
C:\Windows\SysWOW64\Gokdeeec.exe

Filesize
55KB

MD5
06f257d82c9b1bb7d9bc284747e9176b

SHA1
da27ef2d94f43b7a9ff3e19e96b3218a334a3626

SHA256
4cd06f37b62259cc61dde9aa9efa520fce6ea4cbfb70f6f0b5fb623438fce88b

SHA512
3b89ca9bccc88a2beae571c69999532155ef1c197c86620efe15fb43182aa10477d95c55ed499262a1a860164b1b5c4e9049d2d9abff68d1bc355bb24db2ccc4

Download Submit
C:\Windows\SysWOW64\Hbeqmoji.exe

Filesize
55KB

MD5
b25d95952ee8a0e8987961100e103ff7

SHA1
c2baf3a0a7937c64fbd0103a6d65d54d4a6eb58a

SHA256
72c861e954e7ce40d451147650cb1ae26c5ac5adab53d986fdcf92dea95c86e3

SHA512
e392fdaf4a5e3c23d9119150dae1d80e54bf69affefdbc0090e9440d27a2fa80dddc7edb7adcbd69c18e83c2b3095be2ce06ad54af4f66a994294506d1682201

Download Submit
C:\Windows\SysWOW64\Hbeqmoji.exe

Filesize
55KB

MD5
b25d95952ee8a0e8987961100e103ff7

SHA1
c2baf3a0a7937c64fbd0103a6d65d54d4a6eb58a

SHA256
72c861e954e7ce40d451147650cb1ae26c5ac5adab53d986fdcf92dea95c86e3

SHA512
e392fdaf4a5e3c23d9119150dae1d80e54bf69affefdbc0090e9440d27a2fa80dddc7edb7adcbd69c18e83c2b3095be2ce06ad54af4f66a994294506d1682201

Download Submit
C:\Windows\SysWOW64\Hfifmnij.exe

Filesize
55KB

MD5
de85c1afe20e72634309cae4d3933a4a

SHA1
079c6d748b4f266283d585d409be5069e1bf8cb7

SHA256
9a99e5278334650205a947d4d9ce7c823e8f471f1f8bf1868de142668255a3cf

SHA512
88ce449c19c8a928caaf98c40f37dcbea32acccb216c3c559ecd10729597fc2b28b68fe1d437792bab24395727e7a3af6b91926e2fd7e09c7f7a8d664dccb98d

Download Submit
C:\Windows\SysWOW64\Hfifmnij.exe

Filesize
55KB

MD5
de85c1afe20e72634309cae4d3933a4a

SHA1
079c6d748b4f266283d585d409be5069e1bf8cb7

SHA256
9a99e5278334650205a947d4d9ce7c823e8f471f1f8bf1868de142668255a3cf

SHA512
88ce449c19c8a928caaf98c40f37dcbea32acccb216c3c559ecd10729597fc2b28b68fe1d437792bab24395727e7a3af6b91926e2fd7e09c7f7a8d664dccb98d

Download Submit
C:\Windows\SysWOW64\Hflcbngh.exe

Filesize
55KB

MD5
2215f25a64e425184300b637dcf86e0e

SHA1
9ce8f897039cac4d3aa1cae581bd3ce7d171de06

SHA256
504db794ff4b60fcbde40e6db1c05c319ea98c7fca8bf8b9af8e57151c8c722a

SHA512
4eaf9d10826c5df48af3bbda9f4316c31bcd0231f9b70e66307c61bab815975fe068574f92db0e415932f3ed7634f48c64d0f607297a74bb351c124cfbf3041b

Download Submit
C:\Windows\SysWOW64\Hflcbngh.exe

Filesize
55KB

MD5
2215f25a64e425184300b637dcf86e0e

SHA1
9ce8f897039cac4d3aa1cae581bd3ce7d171de06

SHA256
504db794ff4b60fcbde40e6db1c05c319ea98c7fca8bf8b9af8e57151c8c722a

SHA512
4eaf9d10826c5df48af3bbda9f4316c31bcd0231f9b70e66307c61bab815975fe068574f92db0e415932f3ed7634f48c64d0f607297a74bb351c124cfbf3041b

Download Submit
C:\Windows\SysWOW64\Hfnphn32.exe

Filesize
55KB

MD5
7935e70b711b9ddeb5e00accf65adb7e

SHA1
a24e1b4320214a83d964a7024a986675d5c64ca4

SHA256
3dd802871692ba826d3a20e729619f7032f92e51d7150e58190b9ce3bc7b119c

SHA512
9ebbf74eb0dc8012a64a5c95be2497e2e3e7ab95ddc36e29f36c9a75a469e0e2daa4834e1c0d9dff0812fbafcb6752a042493a8e62123e5dc658ad49703af110

Download Submit
C:\Windows\SysWOW64\Hfnphn32.exe

Filesize
55KB

MD5
7935e70b711b9ddeb5e00accf65adb7e

SHA1
a24e1b4320214a83d964a7024a986675d5c64ca4

SHA256
3dd802871692ba826d3a20e729619f7032f92e51d7150e58190b9ce3bc7b119c

SHA512
9ebbf74eb0dc8012a64a5c95be2497e2e3e7ab95ddc36e29f36c9a75a469e0e2daa4834e1c0d9dff0812fbafcb6752a042493a8e62123e5dc658ad49703af110

Download Submit
C:\Windows\SysWOW64\Hfpecg32.exe

Filesize
55KB

MD5
3c782d37d53ec882dd10a707b39522e7

SHA1
5f566e23b7d4a4bf18bb64361dab0ac0db2d8df7

SHA256
8aafe313b6508f36df4b08e626537749167219cb000044c8528789c7e3c4074a

SHA512
9a1b5d3b64e14f88832eabd998d4ee65d7cbc1a3d52b1d615b2231001efc97df79ec2dc7aace304d626eaa558b0aad25e5b76157a37172191f4828bc757d80a6

Download Submit
C:\Windows\SysWOW64\Hgnoki32.exe

Filesize
55KB

MD5
213028ada90016be9c30c42d8dc6896d

SHA1
2f0b59440702944a787b9294f4cc370ca7b31152

SHA256
65ddad56976f90ac7de4063c469f92b8020c013cfb8e349b49587aa3dee11595

SHA512
0fd55b0a86e0c62812196cbce65968c6ced70a64e5fbb0977c5b6655ea6eed446b9915e40761f24198143c6b99e97ed9f293c630befcd28764ed3b3937a5e6a3

Download Submit
C:\Windows\SysWOW64\Hkdbpe32.exe

Filesize
55KB

MD5
ac059c7df89fdb0994a12dc14db9a7a4

SHA1
94812308c83bdf357fcd915755b5fb9d60c5793f

SHA256
7ecbeb8bdb9885b29c6c10dae001c7919c344fc3d478fc3195d563e77d85c067

SHA512
be0eea6fa3ac9fb2cf2f46884d6a39f2f2c269aecf56e64eb05fad2e73e9667c254f245875c914b873283823abd250fedde3cf580577847e91caeb4d49987cf8

Download Submit
C:\Windows\SysWOW64\Hkdbpe32.exe

Filesize
55KB

MD5
ac059c7df89fdb0994a12dc14db9a7a4

SHA1
94812308c83bdf357fcd915755b5fb9d60c5793f

SHA256
7ecbeb8bdb9885b29c6c10dae001c7919c344fc3d478fc3195d563e77d85c067

SHA512
be0eea6fa3ac9fb2cf2f46884d6a39f2f2c269aecf56e64eb05fad2e73e9667c254f245875c914b873283823abd250fedde3cf580577847e91caeb4d49987cf8

Download Submit
C:\Windows\SysWOW64\Hkdbpe32.exe

Filesize
55KB

MD5
ac059c7df89fdb0994a12dc14db9a7a4

SHA1
94812308c83bdf357fcd915755b5fb9d60c5793f

SHA256
7ecbeb8bdb9885b29c6c10dae001c7919c344fc3d478fc3195d563e77d85c067

SHA512
be0eea6fa3ac9fb2cf2f46884d6a39f2f2c269aecf56e64eb05fad2e73e9667c254f245875c914b873283823abd250fedde3cf580577847e91caeb4d49987cf8

Download Submit
C:\Windows\SysWOW64\Hmcojh32.exe

Filesize
55KB

MD5
11e0044046419456482ffb1289070f8c

SHA1
16ee9971b4729672ac90e5cf9ca4426feb8963a1

SHA256
d6bd1684b63a6a2a3f04d07c3c4c25c62acbed12c6588ab645a24b3caa1758d4

SHA512
a57020184615971fa81895e389891f43824df6e83282b0b2268727f098d0307722c02354d80321d6b1edf108c944d1b143163b8d18fff858c15d909349dd52d1

Download Submit
C:\Windows\SysWOW64\Hmcojh32.exe

Filesize
55KB

MD5
11e0044046419456482ffb1289070f8c

SHA1
16ee9971b4729672ac90e5cf9ca4426feb8963a1

SHA256
d6bd1684b63a6a2a3f04d07c3c4c25c62acbed12c6588ab645a24b3caa1758d4

SHA512
a57020184615971fa81895e389891f43824df6e83282b0b2268727f098d0307722c02354d80321d6b1edf108c944d1b143163b8d18fff858c15d909349dd52d1

Download Submit
C:\Windows\SysWOW64\Hmfkoh32.exe

Filesize
55KB

MD5
697f6e536f79878343987ffd56d7daf1

SHA1
8a171759e35074fa04a6cc284260bd9e1329276d

SHA256
ad44ee3c162fb8fd835da76ceed14e3ebd46d8e905ad681cd02d1bc7d241f3d8

SHA512
b1b4f088c49d89c1af5fd2a6bfa0ab78b7a7355da8a349546f1b77c971e9c9d2f7b4d11d8d8c4f4b058283ff0366dc32799e11803be34ddd76bb4590fb121a1a

Download Submit
C:\Windows\SysWOW64\Hmfkoh32.exe

Filesize
55KB

MD5
697f6e536f79878343987ffd56d7daf1

SHA1
8a171759e35074fa04a6cc284260bd9e1329276d

SHA256
ad44ee3c162fb8fd835da76ceed14e3ebd46d8e905ad681cd02d1bc7d241f3d8

SHA512
b1b4f088c49d89c1af5fd2a6bfa0ab78b7a7355da8a349546f1b77c971e9c9d2f7b4d11d8d8c4f4b058283ff0366dc32799e11803be34ddd76bb4590fb121a1a

Download Submit
C:\Windows\SysWOW64\Hmhhehlb.exe

Filesize
55KB

MD5
544d28759fc1b26041f8ffc2f31cacda

SHA1
509c1a1aa894a522fe4567fbb11fe4cb86daa00d

SHA256
e01627b052a4a07658b0ea89839a179fb27273162a9f869bfe175ea2598db59c

SHA512
79749204567a5df75dd6b0a465d311d07008c812aeb70d29baed8096b7ce7361b1a89f966269e09108c20375745276760d41a2bc3e0b6c8005bbfd1e496bb4aa

Download Submit
C:\Windows\SysWOW64\Hmhhehlb.exe

Filesize
55KB

MD5
544d28759fc1b26041f8ffc2f31cacda

SHA1
509c1a1aa894a522fe4567fbb11fe4cb86daa00d

SHA256
e01627b052a4a07658b0ea89839a179fb27273162a9f869bfe175ea2598db59c

SHA512
79749204567a5df75dd6b0a465d311d07008c812aeb70d29baed8096b7ce7361b1a89f966269e09108c20375745276760d41a2bc3e0b6c8005bbfd1e496bb4aa

Download Submit
C:\Windows\SysWOW64\Ibnccmbo.exe

Filesize
55KB

MD5
3455736463f76009ca81a879de204db7

SHA1
0f914270ec55105a847585117073f07529d1406a

SHA256
49b2fbec27cde18a9347294f8d1cd51181d8f20189711c722bbce2cb1e585b82

SHA512
f80ef1705a1f0717138a1bbbdc622e770a1e655fa5bb6721aa8e9929bb5df37f1e517e7470b3076a53aab020ea26b38924358581fe12ee0ac5f0a1c629365e39

Download Submit
C:\Windows\SysWOW64\Ibnccmbo.exe

Filesize
55KB

MD5
3455736463f76009ca81a879de204db7

SHA1
0f914270ec55105a847585117073f07529d1406a

SHA256
49b2fbec27cde18a9347294f8d1cd51181d8f20189711c722bbce2cb1e585b82

SHA512
f80ef1705a1f0717138a1bbbdc622e770a1e655fa5bb6721aa8e9929bb5df37f1e517e7470b3076a53aab020ea26b38924358581fe12ee0ac5f0a1c629365e39

Download Submit
C:\Windows\SysWOW64\Icnpmp32.exe

Filesize
55KB

MD5
b16437d37926e949a8d2bdd44531a5c2

SHA1
310291f461da71427615d68ecc476d39c0ab165b

SHA256
2e1cff187ca11002546238ae7b7b2e1c726351662b447f0e7f668f3ee6e12c52

SHA512
d8f704adeb6249d4df8bc04939dd001c2fa425328ea32c793609b5fb37df8ebc95edcc0334715397ada4261f08cb6d576a10f33c85ae5d25add20aa678a3c0f4

Download Submit
C:\Windows\SysWOW64\Icnpmp32.exe

Filesize
55KB

MD5
b16437d37926e949a8d2bdd44531a5c2

SHA1
310291f461da71427615d68ecc476d39c0ab165b

SHA256
2e1cff187ca11002546238ae7b7b2e1c726351662b447f0e7f668f3ee6e12c52

SHA512
d8f704adeb6249d4df8bc04939dd001c2fa425328ea32c793609b5fb37df8ebc95edcc0334715397ada4261f08cb6d576a10f33c85ae5d25add20aa678a3c0f4

Download Submit
C:\Windows\SysWOW64\Icplcpgo.exe

Filesize
55KB

MD5
4e13c8166d03a3624c2ce4a1f01f3989

SHA1
dbb70e6f565464c0b65a61f4fb57a908b76a7343

SHA256
af0f8ad9245252e255c575f07444d2966352e740743c56e508c76ed52d6b02e9

SHA512
ccc86e7e8de68f412632fb1bf9aec706234a88ecaa2f154cf205a3bec7ccd0817fed10158dbcc607644b59910a3b9862e048e51be452663d7766ec390eeefd2d

Download Submit
C:\Windows\SysWOW64\Icplcpgo.exe

Filesize
55KB

MD5
4e13c8166d03a3624c2ce4a1f01f3989

SHA1
dbb70e6f565464c0b65a61f4fb57a908b76a7343

SHA256
af0f8ad9245252e255c575f07444d2966352e740743c56e508c76ed52d6b02e9

SHA512
ccc86e7e8de68f412632fb1bf9aec706234a88ecaa2f154cf205a3bec7ccd0817fed10158dbcc607644b59910a3b9862e048e51be452663d7766ec390eeefd2d

Download Submit
C:\Windows\SysWOW64\Ifefimom.exe

Filesize
55KB

MD5
331f0ca516ced40f632a3af25455e95a

SHA1
0d20574c162ef5f919c64f3f013cc8a44e8c324c

SHA256
c521cb2d5a0b5d7343e27a856ff7b42f0e8e0acdd4985adf968662fbbb9451dd

SHA512
49f6ff71cadb7a1cbbc057d26f860ff16ef45dc7bbf0022aacaedfcc0581109eff0fca5ee4f0a48f286133a3e54bc2afe6993869a88c17febb69acce1c5e1027

Download Submit
C:\Windows\SysWOW64\Ifefimom.exe

Filesize
55KB

MD5
331f0ca516ced40f632a3af25455e95a

SHA1
0d20574c162ef5f919c64f3f013cc8a44e8c324c

SHA256
c521cb2d5a0b5d7343e27a856ff7b42f0e8e0acdd4985adf968662fbbb9451dd

SHA512
49f6ff71cadb7a1cbbc057d26f860ff16ef45dc7bbf0022aacaedfcc0581109eff0fca5ee4f0a48f286133a3e54bc2afe6993869a88c17febb69acce1c5e1027

Download Submit
C:\Windows\SysWOW64\Ifgbnlmj.exe

Filesize
55KB

MD5
811fea3d041772086597cdffc65ff317

SHA1
461e21ada000beecc5585326a0eee7952663fb2b

SHA256
47552ea974c89ea417884f0f755fd81bbf054c5f6a3870cb309270fa6d74a54c

SHA512
5c284740d70bab3c6a5899b2f7b659d277287b2a24c87689d679d6da46f5c53e4f9803ab46c7b49dda381a24957aab7980d2426205e0aa624e9499ab4891b001

Download Submit
C:\Windows\SysWOW64\Ifgbnlmj.exe

Filesize
55KB

MD5
811fea3d041772086597cdffc65ff317

SHA1
461e21ada000beecc5585326a0eee7952663fb2b

SHA256
47552ea974c89ea417884f0f755fd81bbf054c5f6a3870cb309270fa6d74a54c

SHA512
5c284740d70bab3c6a5899b2f7b659d277287b2a24c87689d679d6da46f5c53e4f9803ab46c7b49dda381a24957aab7980d2426205e0aa624e9499ab4891b001

Download Submit
C:\Windows\SysWOW64\Iihkpg32.exe

Filesize
55KB

MD5
0249e96f71d48adb3d102e5e075f6aac

SHA1
ef274457ad3883cb5f818c7eb17a956b499b1d00

SHA256
d7528b1fb035a59caff67da352ba61300f770293eb32364a2233ced003984cd7

SHA512
95b677cc5775911e36ea1d3f627e3df7e33dcedb02fb851172b3b580a4e535ce77c24003c9409d523552c93b5399e640b53e64833e5cf7cad2b046c7d2af5364

Download Submit
C:\Windows\SysWOW64\Iihkpg32.exe

Filesize
55KB

MD5
0249e96f71d48adb3d102e5e075f6aac

SHA1
ef274457ad3883cb5f818c7eb17a956b499b1d00

SHA256
d7528b1fb035a59caff67da352ba61300f770293eb32364a2233ced003984cd7

SHA512
95b677cc5775911e36ea1d3f627e3df7e33dcedb02fb851172b3b580a4e535ce77c24003c9409d523552c93b5399e640b53e64833e5cf7cad2b046c7d2af5364

Download Submit
C:\Windows\SysWOW64\Iikhfg32.exe

Filesize
55KB

MD5
08235e1d20a717506e3653d0358eea0b

SHA1
cc872074fe6b788e420b6b4bd36ad6b33ed72523

SHA256
80f2d55346b03f3dbe312e8950d46f656f9af6fdcba8483339d3ecf4789899b0

SHA512
bc5e7d2e3e0d91a77d0085281aa73189da594e1995fa1aeb010328fe907d3b8c483f36d56cb2ba2849063303e3f1830f5cdc8ae69df2db650a8778dcfeed8cfb

Download Submit
C:\Windows\SysWOW64\Iikhfg32.exe

Filesize
55KB

MD5
08235e1d20a717506e3653d0358eea0b

SHA1
cc872074fe6b788e420b6b4bd36ad6b33ed72523

SHA256
80f2d55346b03f3dbe312e8950d46f656f9af6fdcba8483339d3ecf4789899b0

SHA512
bc5e7d2e3e0d91a77d0085281aa73189da594e1995fa1aeb010328fe907d3b8c483f36d56cb2ba2849063303e3f1830f5cdc8ae69df2db650a8778dcfeed8cfb

Download Submit
C:\Windows\SysWOW64\Ildkgc32.exe

Filesize
55KB

MD5
01e66f011f808b11d4562fe537cf879a

SHA1
4d6196e6de259a68c3f6c6fa2dea1afdf2dbbc4b

SHA256
62d7785c1f11fed3c225d5a2d7da2763e2041a69bd80bc080385a921ce8876e5

SHA512
3ade3bc62ae4f3c0000a782549d71cc2b7438162ca10071b5c48b0c4d10e3c8b4644191ddd3e656c759c3ac4a89211b1dbb1bb5cf79995ebe9328320b646486f

Download Submit
C:\Windows\SysWOW64\Ildkgc32.exe

Filesize
55KB

MD5
01e66f011f808b11d4562fe537cf879a

SHA1
4d6196e6de259a68c3f6c6fa2dea1afdf2dbbc4b

SHA256
62d7785c1f11fed3c225d5a2d7da2763e2041a69bd80bc080385a921ce8876e5

SHA512
3ade3bc62ae4f3c0000a782549d71cc2b7438162ca10071b5c48b0c4d10e3c8b4644191ddd3e656c759c3ac4a89211b1dbb1bb5cf79995ebe9328320b646486f

Download Submit
C:\Windows\SysWOW64\Ipnjab32.exe

Filesize
55KB

MD5
0cc721013bb8dc05df24a6cbcf7804ba

SHA1
889082f4ca8406ddd4ee7c4a4e82a244d164fd92

SHA256
d8c777660d09c0670df304b3a4366b0399b255b3c362df39a490e5373ab10a49

SHA512
aa6b31f64faea651d0b8bbbaa2df4a98c2f3eb59a41e08eb388952baad394427d7033686ca3965587c0629aa139272efca0d63b219330c12cd9bd994697d0c6c

Download Submit
C:\Windows\SysWOW64\Ipnjab32.exe

Filesize
55KB

MD5
0cc721013bb8dc05df24a6cbcf7804ba

SHA1
889082f4ca8406ddd4ee7c4a4e82a244d164fd92

SHA256
d8c777660d09c0670df304b3a4366b0399b255b3c362df39a490e5373ab10a49

SHA512
aa6b31f64faea651d0b8bbbaa2df4a98c2f3eb59a41e08eb388952baad394427d7033686ca3965587c0629aa139272efca0d63b219330c12cd9bd994697d0c6c

Download Submit
C:\Windows\SysWOW64\Jbaojpgb.exe

Filesize
55KB

MD5
42ed8eefcf211cd01dc279b9d5eaf906

SHA1
6194060fbfd2cba104b8d23602aa410eae523070

SHA256
e1c34cbdccb9f39869dcd3e8016d7f539d2d0c0efb82ce7b49a9d20f0611ca49

SHA512
c71c345ba55d1b9e03d606a9f0e0c656cf740a472ec0b8b4c6826ecc5f98afec3cb6297bef93941e5e49739ff35b31f25779b91be279fa50323c6fb1432dd210

Download Submit
C:\Windows\SysWOW64\Jeqbpb32.exe

Filesize
55KB

MD5
fe4bf07d169c82346111343cb4697e23

SHA1
8b3b5510a7edf9058ce1bf573192acf80200fa54

SHA256
991bc8575ad01b362253168cc1d443258a3b0ad2f87201cecb2acdbac0ef81f6

SHA512
ccfe463e5459bb0bac2843316fedfd71624ce264891067d8e7a6afd69eab1c075bcde19cd40a17319ff7e56dfd17194a10665a1ee8084ad72dab2fc66f6f1fab

Download Submit
C:\Windows\SysWOW64\Lbinam32.exe

Filesize
55KB

MD5
5d41e3c73f689e8c62c4c5abd9ace7f8

SHA1
dbf02d0ac33483e26fca51236498966f7043685f

SHA256
110105cf0b5e08133d3227d856b68096aa87550b4c67cd6d92c78b59d33fa237

SHA512
edab2f1a693915748c18a953843fd909ae690f094fcc575bdc831913bdf816c6532cfbcb78a640aa4f17bc7d30ec9cdc129d75e80df2ef4b8a08bbb0419d2b0b

Download Submit
C:\Windows\SysWOW64\Mlmbfqoj.exe

Filesize
55KB

MD5
9baef87bea8db30ef2c4b22c87589b04

SHA1
1c25c2de7698ba0b7e4873a3c2ae058062574b91

SHA256
6d2a5316b083c4f50f72be4699a6b8ce4a4199d3dab2af64d88e30c9e9d9150e

SHA512
df4aa0cc79c6980b9570865891f2423477827795d48941a1a242c99aa06638b28cf4de0765ba6ebc517acee1aada5686471fbbb7fb9730b422ab7dc3ed9928cb

Download Submit
C:\Windows\SysWOW64\Nlfelogp.exe

Filesize
55KB

MD5
9265ccf5f90181a7fd4e264b573c48b3

SHA1
828e9a4156cd7117c0c34044f8b2eb925baefed0

SHA256
795f4e79a2f40ec59b511383953063ec1ee70b289f5a1de5da15cfafce9b6480

SHA512
4f090724594edafa4de670d8e31df7a576e0f68c3c70b7c97c00fb3565177115937d91479830bece24289f3c26ab71a07c8d28b5340d47e13c2d78de596e9482

Download Submit
C:\Windows\SysWOW64\Nliaao32.exe

Filesize
55KB

MD5
449fc52007ee0a50606a4e3d900304c6

SHA1
470f132018e00eb22dd6187ac25a531be0a2cfad

SHA256
5e5edf228f2020533914456f64f27b1e117a0b5a4143190942a62b6af77675c8

SHA512
7c473f4ea69d316d9d01c21614a4fc97441fc4297a9bb217bef5b9b1efa18571f8a063d7c8edf9711a28557d1874f6ce31e2a8be05d2eda927a3c12c27b1cdc0

Download Submit
C:\Windows\SysWOW64\Npjebj32.exe

Filesize
55KB

MD5
cd36f3206f6693b3b1a1491eeff96eaf

SHA1
730473ced8f0549535dfaf07f613c734216cc6a2

SHA256
9b7acc774e299710572f1adb83402b0529c1be9c13c06d0532866d94d8cbeacd

SHA512
6fb08425723bd701fb1d60e34c2250f35d15dae2deeac3640e940768c91c0cde6d504afefbda496cd8a9a5b9a23124f45dfd0528aa10a5c37c0e2b8f587bbdf8

Download Submit
C:\Windows\SysWOW64\Oampjeml.exe

Filesize
55KB

MD5
3a59bbcc3b332bcc02910856c260064e

SHA1
e0df48af8cbfa3c79e9c3eb64f010a8b6f5c1301

SHA256
47cb81955693aa4e035b45d32df1f330693ce5bf3621796e95240615fc7fc951

SHA512
90806162eed70e6a4a3a5c3f620f052e89d816914bdebc981f353c6deb1fc1e94de786947e0d0baeb61869e16d1952fad101af05892e485c5460d84a7daeb202

Download Submit
C:\Windows\SysWOW64\Oemefcap.exe

Filesize
55KB

MD5
d97e58a288535d7a95cd1f6192dcec1c

SHA1
209fecebe2ffb08d3714ab1630ac8b5e162b1e7f

SHA256
6b51baabc07ccb67ff3f1a33116f56f996c962a2d931aaae2e510228e05bd354

SHA512
8c75b6a0885374601c60b565b12cf90c91f6e09e06412536e57f399dfaf88e661a6e2a93512d0c177b7979a850e72f0be410d9bd7b6162fd81fd0e48d95edb38

Download Submit
C:\Windows\SysWOW64\Ogkcpbam.exe

Filesize
55KB

MD5
b0394a8cf924b18feb71b7272a7a8625

SHA1
58436e0de63d9ed7a4a3ce39441170dd5abe7b12

SHA256
1398a9ad4e589128638ec1950b45d9aa4245e000e5d1bf1f085fb6335906c21a

SHA512
0ee6808ef01e98560de32315326fa3e9da3730650055d45f219a14a09661a8d355b2709184467e75dfeafe0f1d7e3b2ae2519aab5f6fccfd3aa0c229e47ce4ff

Download Submit
C:\Windows\SysWOW64\Ooejohhq.exe

Filesize
55KB

MD5
0c7ebee1105d1eb267e8e82d136aeec8

SHA1
1d6602c7164c90ed9daefc7dc9b6e6344839921a

SHA256
4f90fb8cdaf05298736dff6f216e006c88dc2a77cf16d79f49aaa99b9b88c238

SHA512
626e74425df3d1c9f2e9b3041faca918fe154e7062a6f103d9e2d2f305477e3acfcb11440012744f63651f76c11241d82f625800dab31979d89c8e7ee638ee5b

Download Submit
C:\Windows\SysWOW64\Pakllc32.exe

Filesize
55KB

MD5
d9ba185b26b139096331511f344802eb

SHA1
c091b92408deb2c5a765b5f5e4c32d4b4222a71b

SHA256
b6df5ed10ca3663ff87ba60a9ae3f8471e4dbe9b95f8a4ff69ea48e93e91ba96

SHA512
68d4d4294aac2adf485e0a537017f206b95a4d538e92e69e2de5d19df52b3bfebb0a09b0f1e4117061e05c0be698d3c0a0d92348db513b7422b7002568f2ebd3

Download Submit
C:\Windows\SysWOW64\Pcmeke32.exe

Filesize
55KB

MD5
6224cd479b114b791602a3354b4a3cf6

SHA1
6b2be615894e563cd3512dbc50bdcd083fcb9968

SHA256
79bf796622fdf42142913003f91ec55a8f56fe23fda4cc9a6feb969f8b8bcabd

SHA512
4fff9e8b8c3c2eb2b46b58f9102870dabf52e49bf547dd41204f18eb86112df91906ad205da1fe003bcb340861ad16cd7cee8e59ba7394b9efdcc04d8093e89d

Download Submit
C:\Windows\SysWOW64\Pkcadhgm.exe

Filesize
55KB

MD5
2b60323b1d94e717b922e0edc7b22e10

SHA1
986cfa91ebd4e5bfe966da759212b0883948d4c0

SHA256
3e01b513eeb0c27b9883dce2cf20a74247ba89b940c373768b58724cb4ff5dc9

SHA512
82a989b6dc05e3a862f6ed40d1307d3daf631f867b4238f418eada77673c0cc741e090913f10931e58ef3027c106f865f10b7fcc422b6a93f8fd80a033900b6f

Download Submit
C:\Windows\SysWOW64\Qhlkilba.exe

Filesize
55KB

MD5
bda7adf05eedd13ee18e741a3ff963bb

SHA1
09fb1333c7080fb74fc84cf5b204c55cafe932d2

SHA256
62a2e9b0a55af8685549c4ca01bf8cbf9b4f41953850158618457325bc8e311d

SHA512
fd878bf31e904ee996bead127fc48fc4789e956f555d4721fcab8b09db1a6f4ed54b778fe7f23b98597ea977325d94a56818456b7e2c070baabc6bb84a5d9954

Download Submit
memory/380-408-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/436-432-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/660-97-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/736-306-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1036-40-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1124-217-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1512-298-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1572-378-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1620-366-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1640-312-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1700-17-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1708-121-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1796-113-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1844-154-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1908-241-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1956-342-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1992-414-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2024-194-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2176-328-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2196-426-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2212-82-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2416-5-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2416-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2416-80-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2472-276-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2560-8-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2568-420-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2812-202-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2828-90-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2988-254-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3112-177-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3296-145-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3348-270-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3444-105-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3524-64-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3544-73-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3672-264-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3680-226-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3696-161-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3828-348-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3928-48-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4004-56-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4008-32-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4020-138-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4072-282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4128-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4132-360-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4172-340-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4200-384-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4208-234-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4212-354-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4240-376-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4280-186-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4336-209-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4512-396-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4532-300-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4660-330-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4696-24-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4700-402-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4736-288-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4936-390-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4944-129-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5064-318-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5072-169-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads