6aa0c66082d1494f23e260bb8bdd9fe19c1daf58ee0ed40dc984aa8d7377b095

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2023, 17:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.6f03ee460b8eba1c58e605d447e9be60.exe
Size

59KB
MD5

6f03ee460b8eba1c58e605d447e9be60
SHA1

df235b0c237281b700c5d11a13d80dc020ea6e1b
SHA256

6aa0c66082d1494f23e260bb8bdd9fe19c1daf58ee0ed40dc984aa8d7377b095
SHA512

9110e2f01d08d1379589c2be4c8467cf6eda530d2e1435ea0c8bc077a4f0536059426cd376dfe8e112961f3cdf82b120bd835ccc703f1731378af7455a9c3948
SSDEEP

1536:t4RESldcFYRo7KvZjB4yKfVhW+5N+mLh12LpO:AE0/o3XkpO

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncpeaoih.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cifdjg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iojbpo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afpjel32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fqbliicp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahenokjf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnfpinmi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Oljoen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Amcehdod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Njgqhicg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jnhidk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ngndaccj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nncccnol.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hfhgkmpj.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbpeghpe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfmpob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dpbdopck.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hpofii32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lehhqg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Qghlmbae.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ficlmf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lmmolepp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Enjfli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Afbgkl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlicflic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mcifkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Noaeqjpe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oobfob32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfqlfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jiglnf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eidlnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mchppmij.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bkafmd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lajokiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mokmdh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Npepkf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gicgpelg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Himgjbii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Lcnmin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nndjndbh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flmonbbp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nclbpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nmdgikhi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cogddd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bheffh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ejfeng32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Modpib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Plbfdekd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ebfign32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lajokiaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mfeeabda.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Koajmepf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ahkkhnpg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jpnakk32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dnljkk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bqbohocd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hpnoncim.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dnonkq32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cioilg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mkdiog32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hhlnjpdi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cggimh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fhdocc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gghdaa32.exe

Executes dropped EXE 64 IoCs

pid	Process
4408	Laqhhi32.exe
4552	Lbpdblmo.exe
832	Ljkifn32.exe
4848	Mhoipb32.exe
1524	Mahnhhod.exe
2792	Meefofek.exe
1884	Micoed32.exe
2524	Mldhfpib.exe
1792	Nhkikq32.exe
2632	Neoieenp.exe
4472	Nafjjf32.exe
2948	Nbefdijg.exe
1228	Nkqkhk32.exe
5032	Okchnk32.exe
4860	Oampjeml.exe
400	Okedcjcm.exe
3980	Oldamm32.exe
4940	Oemefcap.exe
3120	Ooejohhq.exe
2320	Pedlgbkh.exe
2572	Pakllc32.exe
4852	Plpqil32.exe
4396	Pidabppl.exe
2256	Pcmeke32.exe
4228	Pabblb32.exe
1072	Akoqpg32.exe
1888	Alnmjjdb.exe
1900	Ahenokjf.exe
1396	Aanbhp32.exe
3540	Ahgjejhd.exe
3972	Afkknogn.exe
3464	Bfngdn32.exe
3788	Bkkple32.exe
4772	Bjlpjm32.exe
4824	Bohibc32.exe
4808	Bhamkipi.exe
4488	Bokehc32.exe
884	Bkafmd32.exe
4036	Bblnindg.exe
2892	Bheffh32.exe
396	Bbnkonbd.exe
540	Cmcolgbj.exe
2480	Cfldelik.exe
4128	Codhnb32.exe
5048	Ckkiccep.exe
3524	Cioilg32.exe
5040	Ckmehb32.exe
4728	Ciafbg32.exe
4864	Ccgjopal.exe
3868	Dkbocbog.exe
3048	Dcigeooj.exe
5068	Dmalne32.exe
2388	Dbndfl32.exe
2436	Dpbdopck.exe
4944	Dmfeidbe.exe
4684	Dfoiaj32.exe
2868	Ecbjkngo.exe
1636	Eiobceef.exe
1092	Epikpo32.exe
4908	Efccmidp.exe
4368	Eplgeokq.exe
4648	Eidlnd32.exe
4400	Eblpgjha.exe
1632	Eifhdd32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Bcodim32.dll	Nafjjf32.exe
File created	C:\Windows\SysWOW64\Aefjii32.exe	Anobgl32.exe
File opened for modification	C:\Windows\SysWOW64\Iajdgcab.exe	Ipihpkkd.exe
File opened for modification	C:\Windows\SysWOW64\Padnaq32.exe	Pbcncibp.exe
File opened for modification	C:\Windows\SysWOW64\Ajohfcpj.exe	Apjdikqd.exe
File opened for modification	C:\Windows\SysWOW64\Lmlpjdgo.exe	Lhogamih.exe
File created	C:\Windows\SysWOW64\Ebimgcfi.exe	Ekodjiol.exe
File created	C:\Windows\SysWOW64\Ofkgcobj.exe	Oclkgccf.exe
File created	C:\Windows\SysWOW64\Klgqabib.exe	Kaaldjil.exe
File opened for modification	C:\Windows\SysWOW64\Bkamdi32.exe	Bdgehobe.exe
File opened for modification	C:\Windows\SysWOW64\Ngjkfd32.exe	Nmdgikhi.exe
File created	C:\Windows\SysWOW64\Ipaooi32.dll	Dhgonidg.exe
File created	C:\Windows\SysWOW64\Baampdgc.dll	Finnef32.exe
File created	C:\Windows\SysWOW64\Iajdgcab.exe	Ipihpkkd.exe
File created	C:\Windows\SysWOW64\Lhnhajba.exe	Kadpdp32.exe
File created	C:\Windows\SysWOW64\Bflaeggi.dll	Dpkehi32.exe
File opened for modification	C:\Windows\SysWOW64\Bogkmgba.exe	Bhmbqm32.exe
File opened for modification	C:\Windows\SysWOW64\Geldkfpi.exe	Gbnhoj32.exe
File created	C:\Windows\SysWOW64\Ajaqjfbp.exe	Ahpdcn32.exe
File opened for modification	C:\Windows\SysWOW64\Kgiiiidd.exe	Kjeiodek.exe
File opened for modification	C:\Windows\SysWOW64\Kncaec32.exe	Kgiiiidd.exe
File created	C:\Windows\SysWOW64\Jhhodg32.exe	Janghmia.exe
File created	C:\Windows\SysWOW64\Gmdoel32.exe	Glabolja.exe
File created	C:\Windows\SysWOW64\Mglcla32.dll	Bpdfpmoo.exe
File created	C:\Windows\SysWOW64\Jdokpl32.dll	Micoed32.exe
File created	C:\Windows\SysWOW64\Dfdpad32.exe	Dmlkhofd.exe
File opened for modification	C:\Windows\SysWOW64\Qdoacabq.exe	Qobhkjdi.exe
File created	C:\Windows\SysWOW64\Cmdmpe32.exe	Cifdjg32.exe
File opened for modification	C:\Windows\SysWOW64\Ijigfaol.exe	Ijgjpaao.exe
File created	C:\Windows\SysWOW64\Meefofek.exe	Mahnhhod.exe
File created	C:\Windows\SysWOW64\Bhkmec32.exe	Bemqih32.exe
File created	C:\Windows\SysWOW64\Pddlig32.dll	Hkohchko.exe
File created	C:\Windows\SysWOW64\Mnpkiqbe.dll	Jlanpfkj.exe
File opened for modification	C:\Windows\SysWOW64\Ebimgcfi.exe	Ekodjiol.exe
File created	C:\Windows\SysWOW64\Dmcnoekk.dll	Ieidhh32.exe
File opened for modification	C:\Windows\SysWOW64\Jhkbdmbg.exe	Jaajhb32.exe
File created	C:\Windows\SysWOW64\Khlaie32.dll	Mfnhfm32.exe
File opened for modification	C:\Windows\SysWOW64\Jjpmfpid.exe	Jhqqlmba.exe
File created	C:\Windows\SysWOW64\Mfeccm32.exe	Liabjh32.exe
File created	C:\Windows\SysWOW64\Enhodk32.dll	Bqbohocd.exe
File created	C:\Windows\SysWOW64\Egljbmnm.dll	Dooaoj32.exe
File created	C:\Windows\SysWOW64\Gmophg32.dll	Ibaeen32.exe
File opened for modification	C:\Windows\SysWOW64\Pdjgha32.exe	Pmpolgoi.exe
File created	C:\Windows\SysWOW64\Mnknop32.dll	Jpbjfjci.exe
File created	C:\Windows\SysWOW64\Ndpjnq32.exe	Nkhfek32.exe
File opened for modification	C:\Windows\SysWOW64\Jjbjlpga.exe	Jchaoe32.exe
File opened for modification	C:\Windows\SysWOW64\Anclbkbp.exe	Akepfpcl.exe
File created	C:\Windows\SysWOW64\Gncchb32.exe	Gejopl32.exe
File created	C:\Windows\SysWOW64\Cogddd32.exe	Chnlgjlb.exe
File opened for modification	C:\Windows\SysWOW64\Cogddd32.exe	Chnlgjlb.exe
File created	C:\Windows\SysWOW64\Kihgqfld.dll	Geldkfpi.exe
File opened for modification	C:\Windows\SysWOW64\Qjhbfd32.exe	Qiiflaoo.exe
File created	C:\Windows\SysWOW64\Eblpgjha.exe	Eidlnd32.exe
File created	C:\Windows\SysWOW64\Hpqldc32.exe	Hmbphg32.exe
File created	C:\Windows\SysWOW64\Pplobcpp.exe	Pnkbkk32.exe
File created	C:\Windows\SysWOW64\Cpmapodj.exe	Boldhf32.exe
File opened for modification	C:\Windows\SysWOW64\Gbmingjo.exe	Fmpqfq32.exe
File opened for modification	C:\Windows\SysWOW64\Ehpadhll.exe	Ebfign32.exe
File opened for modification	C:\Windows\SysWOW64\Hkaqgjme.exe	Himgjbii.exe
File opened for modification	C:\Windows\SysWOW64\Bacjdbch.exe	Bkibgh32.exe
File created	C:\Windows\SysWOW64\Bddcenpi.exe	Bogkmgba.exe
File created	C:\Windows\SysWOW64\Lelgfl32.dll	Cnaaib32.exe
File created	C:\Windows\SysWOW64\Balfdi32.dll	Janghmia.exe
File created	C:\Windows\SysWOW64\Gpejnp32.dll	Jlidpe32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10156	9948	WerFault.exe	972

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Adndoe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Njbgmjgl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjjaci32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ikjcmi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbjbac32.dll"	Enjfli32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmifkecb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmnpfd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jlmfeg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Enpfan32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Finnef32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lhgkgijg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nqoloc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dmokdgeg.dll"	Lljklo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Cogddd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hladlc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ajmgof32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Meefofek.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pakllc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mkohaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Dpglbfpm.dll"	Mkohaj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Baampdgc.dll"	Finnef32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Khdoqefq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cmdmpe32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fncbha32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fhefmjlp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aobbbd32.dll"	Igpdfb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mmacdg32.dll"	Kegpifod.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Apjfbb32.dll"	Lchfib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gpeipb32.dll"	Apjdikqd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ohobebig.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Eaceghcg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dpefaq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Aapkgh32.dll"	Jcaeea32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fdepgkgj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mglfplgk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mmhgmmbf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flhkmbmp.dll"	Omnjojpo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clmmco32.dll"	Ihmfco32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fhdocc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hqimlihn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ooejohhq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bheffh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Omnjojpo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Modpib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Objkmkjj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbicmh32.dll"	Fmndpq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kgipcogp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qffkpn32.dll"	Gknkkmmj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kbblcj32.dll"	Ekaapi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aokkahlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbjnhape.dll"	Haodle32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nofoki32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oemefcap.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gfkbde32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oajpfn32.dll"	Hkfglb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Lmmolepp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ljhefhha.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dmkcpdao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Clffalkf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oenmdg32.dll"	Dhbqalle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bohibc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Cocjiehd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lajokiaa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Maoakaip.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 4408	1668	NEAS.6f03ee460b8eba1c58e605d447e9be60.exe	84
PID 1668 wrote to memory of 4408	1668	NEAS.6f03ee460b8eba1c58e605d447e9be60.exe	84
PID 1668 wrote to memory of 4408	1668	NEAS.6f03ee460b8eba1c58e605d447e9be60.exe	84
PID 4408 wrote to memory of 4552	4408	Laqhhi32.exe	85
PID 4408 wrote to memory of 4552	4408	Laqhhi32.exe	85
PID 4408 wrote to memory of 4552	4408	Laqhhi32.exe	85
PID 4552 wrote to memory of 832	4552	Lbpdblmo.exe	86
PID 4552 wrote to memory of 832	4552	Lbpdblmo.exe	86
PID 4552 wrote to memory of 832	4552	Lbpdblmo.exe	86
PID 832 wrote to memory of 4848	832	Ljkifn32.exe	87
PID 832 wrote to memory of 4848	832	Ljkifn32.exe	87
PID 832 wrote to memory of 4848	832	Ljkifn32.exe	87
PID 4848 wrote to memory of 1524	4848	Mhoipb32.exe	88
PID 4848 wrote to memory of 1524	4848	Mhoipb32.exe	88
PID 4848 wrote to memory of 1524	4848	Mhoipb32.exe	88
PID 1524 wrote to memory of 2792	1524	Mahnhhod.exe	89
PID 1524 wrote to memory of 2792	1524	Mahnhhod.exe	89
PID 1524 wrote to memory of 2792	1524	Mahnhhod.exe	89
PID 2792 wrote to memory of 1884	2792	Meefofek.exe	90
PID 2792 wrote to memory of 1884	2792	Meefofek.exe	90
PID 2792 wrote to memory of 1884	2792	Meefofek.exe	90
PID 1884 wrote to memory of 2524	1884	Micoed32.exe	92
PID 1884 wrote to memory of 2524	1884	Micoed32.exe	92
PID 1884 wrote to memory of 2524	1884	Micoed32.exe	92
PID 2524 wrote to memory of 1792	2524	Mldhfpib.exe	93
PID 2524 wrote to memory of 1792	2524	Mldhfpib.exe	93
PID 2524 wrote to memory of 1792	2524	Mldhfpib.exe	93
PID 1792 wrote to memory of 2632	1792	Nhkikq32.exe	94
PID 1792 wrote to memory of 2632	1792	Nhkikq32.exe	94
PID 1792 wrote to memory of 2632	1792	Nhkikq32.exe	94
PID 2632 wrote to memory of 4472	2632	Neoieenp.exe	95
PID 2632 wrote to memory of 4472	2632	Neoieenp.exe	95
PID 2632 wrote to memory of 4472	2632	Neoieenp.exe	95
PID 4472 wrote to memory of 2948	4472	Nafjjf32.exe	96
PID 4472 wrote to memory of 2948	4472	Nafjjf32.exe	96
PID 4472 wrote to memory of 2948	4472	Nafjjf32.exe	96
PID 2948 wrote to memory of 1228	2948	Nbefdijg.exe	97
PID 2948 wrote to memory of 1228	2948	Nbefdijg.exe	97
PID 2948 wrote to memory of 1228	2948	Nbefdijg.exe	97
PID 1228 wrote to memory of 5032	1228	Nkqkhk32.exe	98
PID 1228 wrote to memory of 5032	1228	Nkqkhk32.exe	98
PID 1228 wrote to memory of 5032	1228	Nkqkhk32.exe	98
PID 5032 wrote to memory of 4860	5032	Okchnk32.exe	99
PID 5032 wrote to memory of 4860	5032	Okchnk32.exe	99
PID 5032 wrote to memory of 4860	5032	Okchnk32.exe	99
PID 4860 wrote to memory of 400	4860	Oampjeml.exe	100
PID 4860 wrote to memory of 400	4860	Oampjeml.exe	100
PID 4860 wrote to memory of 400	4860	Oampjeml.exe	100
PID 400 wrote to memory of 3980	400	Okedcjcm.exe	101
PID 400 wrote to memory of 3980	400	Okedcjcm.exe	101
PID 400 wrote to memory of 3980	400	Okedcjcm.exe	101
PID 3980 wrote to memory of 4940	3980	Oldamm32.exe	102
PID 3980 wrote to memory of 4940	3980	Oldamm32.exe	102
PID 3980 wrote to memory of 4940	3980	Oldamm32.exe	102
PID 4940 wrote to memory of 3120	4940	Oemefcap.exe	103
PID 4940 wrote to memory of 3120	4940	Oemefcap.exe	103
PID 4940 wrote to memory of 3120	4940	Oemefcap.exe	103
PID 3120 wrote to memory of 2320	3120	Ooejohhq.exe	104
PID 3120 wrote to memory of 2320	3120	Ooejohhq.exe	104
PID 3120 wrote to memory of 2320	3120	Ooejohhq.exe	104
PID 2320 wrote to memory of 2572	2320	Pedlgbkh.exe	106
PID 2320 wrote to memory of 2572	2320	Pedlgbkh.exe	106
PID 2320 wrote to memory of 2572	2320	Pedlgbkh.exe	106
PID 2572 wrote to memory of 4852	2572	Pakllc32.exe	107

C:\Users\Admin\AppData\Local\Temp\NEAS.6f03ee460b8eba1c58e605d447e9be60.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.6f03ee460b8eba1c58e605d447e9be60.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Windows\SysWOW64\Laqhhi32.exe
  C:\Windows\system32\Laqhhi32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\SysWOW64\Lbpdblmo.exe
    C:\Windows\system32\Lbpdblmo.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4552
  - - C:\Windows\SysWOW64\Ljkifn32.exe
      C:\Windows\system32\Ljkifn32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:832
    - - C:\Windows\SysWOW64\Mhoipb32.exe
        
        C:\Windows\system32\Mhoipb32.exe
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4848
      - C:\Windows\SysWOW64\Mahnhhod.exe
        
        C:\Windows\system32\Mahnhhod.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1524
        
        C:\Windows\SysWOW64\Meefofek.exe
        
        C:\Windows\system32\Meefofek.exe
        7⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2792
        
        C:\Windows\SysWOW64\Micoed32.exe
        
        C:\Windows\system32\Micoed32.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:1884
        
        C:\Windows\SysWOW64\Mldhfpib.exe
        
        C:\Windows\system32\Mldhfpib.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2524
        
        C:\Windows\SysWOW64\Nhkikq32.exe
        
        C:\Windows\system32\Nhkikq32.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1792
        
        C:\Windows\SysWOW64\Neoieenp.exe
        
        C:\Windows\system32\Neoieenp.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2632
        
        C:\Windows\SysWOW64\Nafjjf32.exe
        
        C:\Windows\system32\Nafjjf32.exe
        12⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4472
        
        C:\Windows\SysWOW64\Nbefdijg.exe
        
        C:\Windows\system32\Nbefdijg.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2948
        
        C:\Windows\SysWOW64\Nkqkhk32.exe
        
        C:\Windows\system32\Nkqkhk32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1228
        
        C:\Windows\SysWOW64\Okchnk32.exe
        
        C:\Windows\system32\Okchnk32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5032
        
        C:\Windows\SysWOW64\Oampjeml.exe
        
        C:\Windows\system32\Oampjeml.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4860
        
        C:\Windows\SysWOW64\Okedcjcm.exe
        
        C:\Windows\system32\Okedcjcm.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:400
        
        C:\Windows\SysWOW64\Oldamm32.exe
        
        C:\Windows\system32\Oldamm32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3980
        
        C:\Windows\SysWOW64\Oemefcap.exe
        
        C:\Windows\system32\Oemefcap.exe
        19⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4940
        
        C:\Windows\SysWOW64\Ooejohhq.exe
        
        C:\Windows\system32\Ooejohhq.exe
        20⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3120
        
        C:\Windows\SysWOW64\Pedlgbkh.exe
        
        C:\Windows\system32\Pedlgbkh.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2320
        
        C:\Windows\SysWOW64\Pakllc32.exe
        
        C:\Windows\system32\Pakllc32.exe
        22⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2572
        
        C:\Windows\SysWOW64\Plpqil32.exe
        
        C:\Windows\system32\Plpqil32.exe
        23⤵
        Executes dropped EXE
        
        PID:4852
        
        C:\Windows\SysWOW64\Pidabppl.exe
        
        C:\Windows\system32\Pidabppl.exe
        24⤵
        Executes dropped EXE
        
        PID:4396
        
        C:\Windows\SysWOW64\Pcmeke32.exe
        
        C:\Windows\system32\Pcmeke32.exe
        25⤵
        Executes dropped EXE
        
        PID:2256
        
        C:\Windows\SysWOW64\Pabblb32.exe
        
        C:\Windows\system32\Pabblb32.exe
        26⤵
        Executes dropped EXE
        
        PID:4228
        
        C:\Windows\SysWOW64\Akoqpg32.exe
        
        C:\Windows\system32\Akoqpg32.exe
        27⤵
        Executes dropped EXE
        
        PID:1072
        
        C:\Windows\SysWOW64\Alnmjjdb.exe
        
        C:\Windows\system32\Alnmjjdb.exe
        28⤵
        Executes dropped EXE
        
        PID:1888
        
        C:\Windows\SysWOW64\Ahenokjf.exe
        
        C:\Windows\system32\Ahenokjf.exe
        29⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1900
        
        C:\Windows\SysWOW64\Aanbhp32.exe
        
        C:\Windows\system32\Aanbhp32.exe
        30⤵
        Executes dropped EXE
        
        PID:1396
        
        C:\Windows\SysWOW64\Ahgjejhd.exe
        
        C:\Windows\system32\Ahgjejhd.exe
        31⤵
        Executes dropped EXE
        
        PID:3540
        
        C:\Windows\SysWOW64\Afkknogn.exe
        
        C:\Windows\system32\Afkknogn.exe
        32⤵
        Executes dropped EXE
        
        PID:3972
        
        C:\Windows\SysWOW64\Bfngdn32.exe
        
        C:\Windows\system32\Bfngdn32.exe
        33⤵
        Executes dropped EXE
        
        PID:3464
        
        C:\Windows\SysWOW64\Bkkple32.exe
        
        C:\Windows\system32\Bkkple32.exe
        34⤵
        Executes dropped EXE
        
        PID:3788
        
        C:\Windows\SysWOW64\Bjlpjm32.exe
        
        C:\Windows\system32\Bjlpjm32.exe
        35⤵
        Executes dropped EXE
        
        PID:4772
        
        C:\Windows\SysWOW64\Bohibc32.exe
        
        C:\Windows\system32\Bohibc32.exe
        36⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4824
        
        C:\Windows\SysWOW64\Bhamkipi.exe
        
        C:\Windows\system32\Bhamkipi.exe
        37⤵
        Executes dropped EXE
        
        PID:4808
        
        C:\Windows\SysWOW64\Bokehc32.exe
        
        C:\Windows\system32\Bokehc32.exe
        38⤵
        Executes dropped EXE
        
        PID:4488
        
        C:\Windows\SysWOW64\Bkafmd32.exe
        
        C:\Windows\system32\Bkafmd32.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:884
        
        C:\Windows\SysWOW64\Bblnindg.exe
        
        C:\Windows\system32\Bblnindg.exe
        40⤵
        Executes dropped EXE
        
        PID:4036
        
        C:\Windows\SysWOW64\Bheffh32.exe
        
        C:\Windows\system32\Bheffh32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Modifies registry class
        
        PID:2892
        
        C:\Windows\SysWOW64\Bbnkonbd.exe
        
        C:\Windows\system32\Bbnkonbd.exe
        42⤵
        Executes dropped EXE
        
        PID:396
        
        C:\Windows\SysWOW64\Cmcolgbj.exe
        
        C:\Windows\system32\Cmcolgbj.exe
        43⤵
        Executes dropped EXE
        
        PID:540
        
        C:\Windows\SysWOW64\Cfldelik.exe
        
        C:\Windows\system32\Cfldelik.exe
        44⤵
        Executes dropped EXE
        
        PID:2480
        
        C:\Windows\SysWOW64\Codhnb32.exe
        
        C:\Windows\system32\Codhnb32.exe
        45⤵
        Executes dropped EXE
        
        PID:4128
        
        C:\Windows\SysWOW64\Ckkiccep.exe
        
        C:\Windows\system32\Ckkiccep.exe
        46⤵
        Executes dropped EXE
        
        PID:5048
        
        C:\Windows\SysWOW64\Cioilg32.exe
        
        C:\Windows\system32\Cioilg32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3524
        
        C:\Windows\SysWOW64\Ckmehb32.exe
        
        C:\Windows\system32\Ckmehb32.exe
        48⤵
        Executes dropped EXE
        
        PID:5040
        
        C:\Windows\SysWOW64\Ciafbg32.exe
        
        C:\Windows\system32\Ciafbg32.exe
        49⤵
        Executes dropped EXE
        
        PID:4728
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        50⤵
        Executes dropped EXE
        
        PID:4864
        
        C:\Windows\SysWOW64\Dkbocbog.exe
        
        C:\Windows\system32\Dkbocbog.exe
        51⤵
        Executes dropped EXE
        
        PID:3868
        
        C:\Windows\SysWOW64\Dcigeooj.exe
        
        C:\Windows\system32\Dcigeooj.exe
        52⤵
        Executes dropped EXE
        
        PID:3048
        
        C:\Windows\SysWOW64\Dmalne32.exe
        
        C:\Windows\system32\Dmalne32.exe
        53⤵
        Executes dropped EXE
        
        PID:5068
        
        C:\Windows\SysWOW64\Dbndfl32.exe
        
        C:\Windows\system32\Dbndfl32.exe
        54⤵
        Executes dropped EXE
        
        PID:2388
        
        C:\Windows\SysWOW64\Dpbdopck.exe
        
        C:\Windows\system32\Dpbdopck.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:2436
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        56⤵
        Executes dropped EXE
        
        PID:4944
        
        C:\Windows\SysWOW64\Dfoiaj32.exe
        
        C:\Windows\system32\Dfoiaj32.exe
        57⤵
        Executes dropped EXE
        
        PID:4684
        
        C:\Windows\SysWOW64\Ecbjkngo.exe
        
        C:\Windows\system32\Ecbjkngo.exe
        58⤵
        Executes dropped EXE
        
        PID:2868
        
        C:\Windows\SysWOW64\Eiobceef.exe
        
        C:\Windows\system32\Eiobceef.exe
        59⤵
        Executes dropped EXE
        
        PID:1636
        
        C:\Windows\SysWOW64\Epikpo32.exe
        
        C:\Windows\system32\Epikpo32.exe
        60⤵
        Executes dropped EXE
        
        PID:1092
        
        C:\Windows\SysWOW64\Efccmidp.exe
        
        C:\Windows\system32\Efccmidp.exe
        61⤵
        Executes dropped EXE
        
        PID:4908
        
        C:\Windows\SysWOW64\Eplgeokq.exe
        
        C:\Windows\system32\Eplgeokq.exe
        62⤵
        Executes dropped EXE
        
        PID:4368
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        63⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4648
        
        C:\Windows\SysWOW64\Eblpgjha.exe
        
        C:\Windows\system32\Eblpgjha.exe
        64⤵
        Executes dropped EXE
        
        PID:4400
        
        C:\Windows\SysWOW64\Eifhdd32.exe
        
        C:\Windows\system32\Eifhdd32.exe
        65⤵
        Executes dropped EXE
        
        PID:1632
        
        C:\Windows\SysWOW64\Eppqqn32.exe
        
        C:\Windows\system32\Eppqqn32.exe
        66⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\Ejfeng32.exe
        
        C:\Windows\system32\Ejfeng32.exe
        67⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:440
        
        C:\Windows\SysWOW64\Fpbmfn32.exe
        
        C:\Windows\system32\Fpbmfn32.exe
        68⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\Ffmfchle.exe
        
        C:\Windows\system32\Ffmfchle.exe
        69⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\Fmfnpa32.exe
        
        C:\Windows\system32\Fmfnpa32.exe
        70⤵
        
        PID:804
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        71⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\Fmikeaap.exe
        
        C:\Windows\system32\Fmikeaap.exe
        72⤵
        
        PID:2416
        
        C:\Windows\SysWOW64\Fbfcmhpg.exe
        
        C:\Windows\system32\Fbfcmhpg.exe
        73⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\Fipkjb32.exe
        
        C:\Windows\system32\Fipkjb32.exe
        74⤵
        
        PID:4588
        
        C:\Windows\SysWOW64\Flngfn32.exe
        
        C:\Windows\system32\Flngfn32.exe
        75⤵
        
        PID:4444
        
        C:\Windows\SysWOW64\Fdepgkgj.exe
        
        C:\Windows\system32\Fdepgkgj.exe
        76⤵
        Modifies registry class
        
        PID:2808
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        77⤵
        Modifies registry class
        
        PID:5052
        
        C:\Windows\SysWOW64\Fplpll32.exe
        
        C:\Windows\system32\Fplpll32.exe
        78⤵
        
        PID:3996
        
        C:\Windows\SysWOW64\Fjadje32.exe
        
        C:\Windows\system32\Fjadje32.exe
        79⤵
        
        PID:752
        
        C:\Windows\SysWOW64\Fmpqfq32.exe
        
        C:\Windows\system32\Fmpqfq32.exe
        80⤵
        Drops file in System32 directory
        
        PID:4528
        
        C:\Windows\SysWOW64\Gbmingjo.exe
        
        C:\Windows\system32\Gbmingjo.exe
        81⤵
        
        PID:3224
        
        C:\Windows\SysWOW64\Gigaka32.exe
        
        C:\Windows\system32\Gigaka32.exe
        82⤵
        
        PID:392
        
        C:\Windows\SysWOW64\Glengm32.exe
        
        C:\Windows\system32\Glengm32.exe
        83⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\Gfkbde32.exe
        
        C:\Windows\system32\Gfkbde32.exe
        84⤵
        Modifies registry class
        
        PID:3228
        
        C:\Windows\SysWOW64\Glgjlm32.exe
        
        C:\Windows\system32\Glgjlm32.exe
        85⤵
        
        PID:1016
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        86⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Gikkfqmf.exe
        
        C:\Windows\system32\Gikkfqmf.exe
        87⤵
        
        PID:4428
        
        C:\Windows\SysWOW64\Gdaociml.exe
        
        C:\Windows\system32\Gdaociml.exe
        88⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\Gkkgpc32.exe
        
        C:\Windows\system32\Gkkgpc32.exe
        89⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\Glldgljg.exe
        
        C:\Windows\system32\Glldgljg.exe
        90⤵
        
        PID:2720
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        91⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\Hmlpaoaj.exe
        
        C:\Windows\system32\Hmlpaoaj.exe
        92⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\Hbhijepa.exe
        
        C:\Windows\system32\Hbhijepa.exe
        93⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\Hibafp32.exe
        
        C:\Windows\system32\Hibafp32.exe
        94⤵
        
        PID:3892
        
        C:\Windows\SysWOW64\Hplicjok.exe
        
        C:\Windows\system32\Hplicjok.exe
        95⤵
        
        PID:452
        
        C:\Windows\SysWOW64\Hgfapd32.exe
        
        C:\Windows\system32\Hgfapd32.exe
        96⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\Hmpjmn32.exe
        
        C:\Windows\system32\Hmpjmn32.exe
        97⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\Hpofii32.exe
        
        C:\Windows\system32\Hpofii32.exe
        98⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3812
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        99⤵
        
        PID:4812
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        100⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        101⤵
        
        PID:1280
        
        C:\Windows\SysWOW64\Hkfglb32.exe
        
        C:\Windows\system32\Hkfglb32.exe
        102⤵
        Modifies registry class
        
        PID:4856
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        103⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\Hcblpdgg.exe
        
        C:\Windows\system32\Hcblpdgg.exe
        104⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Hildmn32.exe
        
        C:\Windows\system32\Hildmn32.exe
        105⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Ipflihfq.exe
        
        C:\Windows\system32\Ipflihfq.exe
        106⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        107⤵
        Modifies registry class
        
        PID:5260
        
        C:\Windows\SysWOW64\Iinqbn32.exe
        
        C:\Windows\system32\Iinqbn32.exe
        108⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Jgnqgqan.exe
        
        C:\Windows\system32\Jgnqgqan.exe
        109⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Jnhidk32.exe
        
        C:\Windows\system32\Jnhidk32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5392
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        111⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Jklinohd.exe
        
        C:\Windows\system32\Jklinohd.exe
        112⤵
        
        PID:5480
        
        C:\Windows\SysWOW64\Jlmfeg32.exe
        
        C:\Windows\system32\Jlmfeg32.exe
        113⤵
        Modifies registry class
        
        PID:5524
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        114⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Jnlbojee.exe
        
        C:\Windows\system32\Jnlbojee.exe
        115⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Jdfjld32.exe
        
        C:\Windows\system32\Jdfjld32.exe
        116⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Kkpbin32.exe
        
        C:\Windows\system32\Kkpbin32.exe
        117⤵
        
        PID:5700
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        118⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Kclgmq32.exe
        
        C:\Windows\system32\Kclgmq32.exe
        119⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Kjepjkhf.exe
        
        C:\Windows\system32\Kjepjkhf.exe
        120⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Kmdlffhj.exe
        
        C:\Windows\system32\Kmdlffhj.exe
        121⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        122⤵
        Modifies registry class
        
        PID:5920
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        123⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        124⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Kdpmbc32.exe
        
        C:\Windows\system32\Kdpmbc32.exe
        125⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Kgninn32.exe
        
        C:\Windows\system32\Kgninn32.exe
        126⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Knhakh32.exe
        
        C:\Windows\system32\Knhakh32.exe
        127⤵
        
        PID:4964
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        128⤵
        
        PID:5152
        
        C:\Windows\SysWOW64\Lklbdm32.exe
        
        C:\Windows\system32\Lklbdm32.exe
        129⤵
        
        PID:5252
        
        C:\Windows\SysWOW64\Lmmolepp.exe
        
        C:\Windows\system32\Lmmolepp.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5312
        
        C:\Windows\SysWOW64\Lgccinoe.exe
        
        C:\Windows\system32\Lgccinoe.exe
        131⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Ljaoeini.exe
        
        C:\Windows\system32\Ljaoeini.exe
        132⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Ldgccb32.exe
        
        C:\Windows\system32\Ldgccb32.exe
        133⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        134⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Lnohlgep.exe
        
        C:\Windows\system32\Lnohlgep.exe
        135⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\Ldipha32.exe
        
        C:\Windows\system32\Ldipha32.exe
        136⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\Lkchelci.exe
        
        C:\Windows\system32\Lkchelci.exe
        137⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        138⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Lcnmin32.exe
        
        C:\Windows\system32\Lcnmin32.exe
        139⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5932
        
        C:\Windows\SysWOW64\Ljhefhha.exe
        
        C:\Windows\system32\Ljhefhha.exe
        140⤵
        Modifies registry class
        
        PID:6000
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        141⤵
        
        PID:6092
        
        C:\Windows\SysWOW64\Mglfplgk.exe
        
        C:\Windows\system32\Mglfplgk.exe
        142⤵
        Modifies registry class
        
        PID:6132
        
        C:\Windows\SysWOW64\Mjkblhfo.exe
        
        C:\Windows\system32\Mjkblhfo.exe
        143⤵
        
        PID:5200
        
        C:\Windows\SysWOW64\Mminhceb.exe
        
        C:\Windows\system32\Mminhceb.exe
        144⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Mccfdmmo.exe
        
        C:\Windows\system32\Mccfdmmo.exe
        145⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        146⤵
        
        PID:5504
        
        C:\Windows\SysWOW64\Mmkkmc32.exe
        
        C:\Windows\system32\Mmkkmc32.exe
        147⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Mcecjmkl.exe
        
        C:\Windows\system32\Mcecjmkl.exe
        148⤵
        
        PID:5780
        
        C:\Windows\SysWOW64\Mjokgg32.exe
        
        C:\Windows\system32\Mjokgg32.exe
        149⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Mmnhcb32.exe
        
        C:\Windows\system32\Mmnhcb32.exe
        150⤵
        
        PID:5948
        
        C:\Windows\SysWOW64\Mchppmij.exe
        
        C:\Windows\system32\Mchppmij.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6064
        
        C:\Windows\SysWOW64\Mkohaj32.exe
        
        C:\Windows\system32\Mkohaj32.exe
        152⤵
        Modifies registry class
        
        PID:5140
        
        C:\Windows\SysWOW64\Mmpdhboj.exe
        
        C:\Windows\system32\Mmpdhboj.exe
        153⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\Mcjmel32.exe
        
        C:\Windows\system32\Mcjmel32.exe
        154⤵
        
        PID:5512
        
        C:\Windows\SysWOW64\Mkadfj32.exe
        
        C:\Windows\system32\Mkadfj32.exe
        155⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Mmbanbmg.exe
        
        C:\Windows\system32\Mmbanbmg.exe
        156⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Nclikl32.exe
        
        C:\Windows\system32\Nclikl32.exe
        157⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Njfagf32.exe
        
        C:\Windows\system32\Njfagf32.exe
        158⤵
        
        PID:5156
        
        C:\Windows\SysWOW64\Napjdpcn.exe
        
        C:\Windows\system32\Napjdpcn.exe
        159⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Nlfnaicd.exe
        
        C:\Windows\system32\Nlfnaicd.exe
        160⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Nndjndbh.exe
        
        C:\Windows\system32\Nndjndbh.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5992
        
        C:\Windows\SysWOW64\Neclenfo.exe
        
        C:\Windows\system32\Neclenfo.exe
        162⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        163⤵
        
        PID:5844
        
        C:\Windows\SysWOW64\Najmjokc.exe
        
        C:\Windows\system32\Najmjokc.exe
        164⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Ohcegi32.exe
        
        C:\Windows\system32\Ohcegi32.exe
        165⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        166⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Oalipoiq.exe
        
        C:\Windows\system32\Oalipoiq.exe
        167⤵
        
        PID:5196
        
        C:\Windows\SysWOW64\Odjeljhd.exe
        
        C:\Windows\system32\Odjeljhd.exe
        168⤵
        
        PID:6176
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        169⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        170⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\Ohhnbhok.exe
        
        C:\Windows\system32\Ohhnbhok.exe
        171⤵
        
        PID:6328
        
        C:\Windows\SysWOW64\Oobfob32.exe
        
        C:\Windows\system32\Oobfob32.exe
        172⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6368
        
        C:\Windows\SysWOW64\Oelolmnd.exe
        
        C:\Windows\system32\Oelolmnd.exe
        173⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        174⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Oodcdb32.exe
        
        C:\Windows\system32\Oodcdb32.exe
        175⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Odalmibl.exe
        
        C:\Windows\system32\Odalmibl.exe
        176⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Oogpjbbb.exe
        
        C:\Windows\system32\Oogpjbbb.exe
        177⤵
        
        PID:6576
        
        C:\Windows\SysWOW64\Pddhbipj.exe
        
        C:\Windows\system32\Pddhbipj.exe
        178⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Poimpapp.exe
        
        C:\Windows\system32\Poimpapp.exe
        179⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Pecellgl.exe
        
        C:\Windows\system32\Pecellgl.exe
        180⤵
        
        PID:6708
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        181⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Poliea32.exe
        
        C:\Windows\system32\Poliea32.exe
        182⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Pefabkej.exe
        
        C:\Windows\system32\Pefabkej.exe
        183⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Plpjoe32.exe
        
        C:\Windows\system32\Plpjoe32.exe
        184⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        185⤵
        
        PID:6932
        
        C:\Windows\SysWOW64\Pdkoch32.exe
        
        C:\Windows\system32\Pdkoch32.exe
        186⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7020
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        188⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        189⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Pkgcea32.exe
        
        C:\Windows\system32\Pkgcea32.exe
        190⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Qmepam32.exe
        
        C:\Windows\system32\Qmepam32.exe
        191⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\Qlgpod32.exe
        
        C:\Windows\system32\Qlgpod32.exe
        192⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Qmhlgmmm.exe
        
        C:\Windows\system32\Qmhlgmmm.exe
        193⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        194⤵
        
        PID:6356
        
        C:\Windows\SysWOW64\Qlimed32.exe
        
        C:\Windows\system32\Qlimed32.exe
        195⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Aogiap32.exe
        
        C:\Windows\system32\Aogiap32.exe
        196⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Aafemk32.exe
        
        C:\Windows\system32\Aafemk32.exe
        197⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Addaif32.exe
        
        C:\Windows\system32\Addaif32.exe
        198⤵
        
        PID:6604
        
        C:\Windows\SysWOW64\Aknifq32.exe
        
        C:\Windows\system32\Aknifq32.exe
        199⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Anmfbl32.exe
        
        C:\Windows\system32\Anmfbl32.exe
        200⤵
        
        PID:6756
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        201⤵
        
        PID:6816
        
        C:\Windows\SysWOW64\Alnfpcag.exe
        
        C:\Windows\system32\Alnfpcag.exe
        202⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Anobgl32.exe
        
        C:\Windows\system32\Anobgl32.exe
        203⤵
        Drops file in System32 directory
        
        PID:6952
        
        C:\Windows\SysWOW64\Aefjii32.exe
        
        C:\Windows\system32\Aefjii32.exe
        204⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Alpbecod.exe
        
        C:\Windows\system32\Alpbecod.exe
        205⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Anaomkdb.exe
        
        C:\Windows\system32\Anaomkdb.exe
        206⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Aehgnied.exe
        
        C:\Windows\system32\Aehgnied.exe
        207⤵
        
        PID:6228
        
        C:\Windows\SysWOW64\Akepfpcl.exe
        
        C:\Windows\system32\Akepfpcl.exe
        208⤵
        Drops file in System32 directory
        
        PID:6320
        
        C:\Windows\SysWOW64\Anclbkbp.exe
        
        C:\Windows\system32\Anclbkbp.exe
        209⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Adndoe32.exe
        
        C:\Windows\system32\Adndoe32.exe
        210⤵
        Modifies registry class
        
        PID:6560
        
        C:\Windows\SysWOW64\Akglloai.exe
        
        C:\Windows\system32\Akglloai.exe
        211⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Bemqih32.exe
        
        C:\Windows\system32\Bemqih32.exe
        212⤵
        Drops file in System32 directory
        
        PID:6776
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        213⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Bkjiao32.exe
        
        C:\Windows\system32\Bkjiao32.exe
        214⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        215⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Bklfgo32.exe
        
        C:\Windows\system32\Bklfgo32.exe
        216⤵
        
        PID:6152
        
        C:\Windows\SysWOW64\Bafndi32.exe
        
        C:\Windows\system32\Bafndi32.exe
        217⤵
        
        PID:6376
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        218⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Bnmoijje.exe
        
        C:\Windows\system32\Bnmoijje.exe
        219⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Bdgged32.exe
        
        C:\Windows\system32\Bdgged32.exe
        220⤵
        
        PID:6796
        
        C:\Windows\SysWOW64\Bkaobnio.exe
        
        C:\Windows\system32\Bkaobnio.exe
        221⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Bffcpg32.exe
        
        C:\Windows\system32\Bffcpg32.exe
        222⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        223⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        224⤵
        Drops file in System32 directory
        
        PID:6672
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        225⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Domdjj32.exe
        
        C:\Windows\system32\Domdjj32.exe
        226⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Dheibpje.exe
        
        C:\Windows\system32\Dheibpje.exe
        227⤵
        
        PID:3276
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        228⤵
        Drops file in System32 directory
        
        PID:544
        
        C:\Windows\SysWOW64\Dfiildio.exe
        
        C:\Windows\system32\Dfiildio.exe
        229⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\Dmcain32.exe
        
        C:\Windows\system32\Dmcain32.exe
        230⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        231⤵
        
        PID:4008
        
        C:\Windows\SysWOW64\Dflfac32.exe
        
        C:\Windows\system32\Dflfac32.exe
        232⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\Dijbno32.exe
        
        C:\Windows\system32\Dijbno32.exe
        233⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Dodjjimm.exe
        
        C:\Windows\system32\Dodjjimm.exe
        234⤵
        
        PID:1472
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        235⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Enigke32.exe
        
        C:\Windows\system32\Enigke32.exe
        236⤵
        
        PID:3160
        
        C:\Windows\SysWOW64\Enkdaepb.exe
        
        C:\Windows\system32\Enkdaepb.exe
        237⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Ekodjiol.exe
        
        C:\Windows\system32\Ekodjiol.exe
        238⤵
        Drops file in System32 directory
        
        PID:7184
        
        C:\Windows\SysWOW64\Ebimgcfi.exe
        
        C:\Windows\system32\Ebimgcfi.exe
        239⤵
        
        PID:7224
        
        C:\Windows\SysWOW64\Eehicoel.exe
        
        C:\Windows\system32\Eehicoel.exe
        240⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Ekaapi32.exe
        
        C:\Windows\system32\Ekaapi32.exe
        241⤵
        Modifies registry class
        
        PID:7308
        
        C:\Windows\SysWOW64\Eblimcdf.exe
        
        C:\Windows\system32\Eblimcdf.exe
        242⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        243⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Enbjad32.exe
        
        C:\Windows\system32\Enbjad32.exe
        244⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Flfkkhid.exe
        
        C:\Windows\system32\Flfkkhid.exe
        245⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Fbpchb32.exe
        
        C:\Windows\system32\Fbpchb32.exe
        246⤵
        
        PID:7516
        
        C:\Windows\SysWOW64\Fligqhga.exe
        
        C:\Windows\system32\Fligqhga.exe
        247⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Ffnknafg.exe
        
        C:\Windows\system32\Ffnknafg.exe
        248⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Fimhjl32.exe
        
        C:\Windows\system32\Fimhjl32.exe
        249⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Fmkqpkla.exe
        
        C:\Windows\system32\Fmkqpkla.exe
        250⤵
        
        PID:7684
        
        C:\Windows\SysWOW64\Fnlmhc32.exe
        
        C:\Windows\system32\Fnlmhc32.exe
        251⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Fefedmil.exe
        
        C:\Windows\system32\Fefedmil.exe
        252⤵
        
        PID:7764
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        253⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Gfeaopqo.exe
        
        C:\Windows\system32\Gfeaopqo.exe
        254⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Gpnfge32.exe
        
        C:\Windows\system32\Gpnfge32.exe
        255⤵
        
        PID:7888
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        256⤵
        Drops file in System32 directory
        
        PID:7932
        
        C:\Windows\SysWOW64\Gncchb32.exe
        
        C:\Windows\system32\Gncchb32.exe
        257⤵
        
        PID:7976
        
        C:\Windows\SysWOW64\Gojiiafp.exe
        
        C:\Windows\system32\Gojiiafp.exe
        258⤵
        
        PID:8016
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        259⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Holfoqcm.exe
        
        C:\Windows\system32\Holfoqcm.exe
        260⤵
        
        PID:8104
        
        C:\Windows\SysWOW64\Hlpfhe32.exe
        
        C:\Windows\system32\Hlpfhe32.exe
        261⤵
        
        PID:8144
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        262⤵
        
        PID:8188
        
        C:\Windows\SysWOW64\Hpnoncim.exe
        
        C:\Windows\system32\Hpnoncim.exe
        263⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7216
        
        C:\Windows\SysWOW64\Hfhgkmpj.exe
        
        C:\Windows\system32\Hfhgkmpj.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7288
        
        C:\Windows\SysWOW64\Hmbphg32.exe
        
        C:\Windows\system32\Hmbphg32.exe
        265⤵
        Drops file in System32 directory
        
        PID:7344
        
        C:\Windows\SysWOW64\Hpqldc32.exe
        
        C:\Windows\system32\Hpqldc32.exe
        266⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Hfjdqmng.exe
        
        C:\Windows\system32\Hfjdqmng.exe
        267⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Hiipmhmk.exe
        
        C:\Windows\system32\Hiipmhmk.exe
        268⤵
        
        PID:7580
        
        C:\Windows\SysWOW64\Hlglidlo.exe
        
        C:\Windows\system32\Hlglidlo.exe
        269⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        270⤵
        Drops file in System32 directory
        
        PID:7716
        
        C:\Windows\SysWOW64\Iliinc32.exe
        
        C:\Windows\system32\Iliinc32.exe
        271⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Iebngial.exe
        
        C:\Windows\system32\Iebngial.exe
        272⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Iojbpo32.exe
        
        C:\Windows\system32\Iojbpo32.exe
        273⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7916
        
        C:\Windows\SysWOW64\Iedjmioj.exe
        
        C:\Windows\system32\Iedjmioj.exe
        274⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Ipjoja32.exe
        
        C:\Windows\system32\Ipjoja32.exe
        275⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        276⤵
        
        PID:8128
        
        C:\Windows\SysWOW64\Imnocf32.exe
        
        C:\Windows\system32\Imnocf32.exe
        277⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\Ioolkncg.exe
        
        C:\Windows\system32\Ioolkncg.exe
        278⤵
        
        PID:7252
        
        C:\Windows\SysWOW64\Ieidhh32.exe
        
        C:\Windows\system32\Ieidhh32.exe
        279⤵
        Drops file in System32 directory
        
        PID:7388
        
        C:\Windows\SysWOW64\Joahqn32.exe
        
        C:\Windows\system32\Joahqn32.exe
        280⤵
        
        PID:7484
        
        C:\Windows\SysWOW64\Jiglnf32.exe
        
        C:\Windows\system32\Jiglnf32.exe
        281⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7588
        
        C:\Windows\SysWOW64\Jgkmgk32.exe
        
        C:\Windows\system32\Jgkmgk32.exe
        282⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Jmeede32.exe
        
        C:\Windows\system32\Jmeede32.exe
        283⤵
        
        PID:7788
        
        C:\Windows\SysWOW64\Jcanll32.exe
        
        C:\Windows\system32\Jcanll32.exe
        284⤵
        
        PID:7904
        
        C:\Windows\SysWOW64\Jilfifme.exe
        
        C:\Windows\system32\Jilfifme.exe
        285⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Jpenfp32.exe
        
        C:\Windows\system32\Jpenfp32.exe
        286⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Jcdjbk32.exe
        
        C:\Windows\system32\Jcdjbk32.exe
        287⤵
        
        PID:7212
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        288⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Jcfggkac.exe
        
        C:\Windows\system32\Jcfggkac.exe
        289⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Jnlkedai.exe
        
        C:\Windows\system32\Jnlkedai.exe
        290⤵
        
        PID:7772
        
        C:\Windows\SysWOW64\Komhll32.exe
        
        C:\Windows\system32\Komhll32.exe
        291⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Kegpifod.exe
        
        C:\Windows\system32\Kegpifod.exe
        292⤵
        Modifies registry class
        
        PID:8092
        
        C:\Windows\SysWOW64\Kpmdfonj.exe
        
        C:\Windows\system32\Kpmdfonj.exe
        293⤵
        
        PID:7348
        
        C:\Windows\SysWOW64\Kgflcifg.exe
        
        C:\Windows\system32\Kgflcifg.exe
        294⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Kjeiodek.exe
        
        C:\Windows\system32\Kjeiodek.exe
        295⤵
        Drops file in System32 directory
        
        PID:7884
        
        C:\Windows\SysWOW64\Kgiiiidd.exe
        
        C:\Windows\system32\Kgiiiidd.exe
        296⤵
        Drops file in System32 directory
        
        PID:7180
        
        C:\Windows\SysWOW64\Kncaec32.exe
        
        C:\Windows\system32\Kncaec32.exe
        297⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Kodnmkap.exe
        
        C:\Windows\system32\Kodnmkap.exe
        298⤵
        
        PID:8012
        
        C:\Windows\SysWOW64\Kjjbjd32.exe
        
        C:\Windows\system32\Kjjbjd32.exe
        299⤵
        
        PID:7800
        
        C:\Windows\SysWOW64\Kcbfcigf.exe
        
        C:\Windows\system32\Kcbfcigf.exe
        300⤵
        
        PID:4220
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        301⤵
        
        PID:8200
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        302⤵
        Modifies registry class
        
        PID:8248
        
        C:\Windows\SysWOW64\Lgpoihnl.exe
        
        C:\Windows\system32\Lgpoihnl.exe
        303⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        304⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Llmhaold.exe
        
        C:\Windows\system32\Llmhaold.exe
        305⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Lobjni32.exe
        
        C:\Windows\system32\Lobjni32.exe
        306⤵
        
        PID:8428
        
        C:\Windows\SysWOW64\Lflbkcll.exe
        
        C:\Windows\system32\Lflbkcll.exe
        307⤵
        
        PID:8472
        
        C:\Windows\SysWOW64\Mmfkhmdi.exe
        
        C:\Windows\system32\Mmfkhmdi.exe
        308⤵
        
        PID:8520
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        309⤵
        
        PID:8564
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        310⤵
        
        PID:8600
        
        C:\Windows\SysWOW64\Mmhgmmbf.exe
        
        C:\Windows\system32\Mmhgmmbf.exe
        311⤵
        Modifies registry class
        
        PID:8644
        
        C:\Windows\SysWOW64\Mcbpjg32.exe
        
        C:\Windows\system32\Mcbpjg32.exe
        312⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Mfqlfb32.exe
        
        C:\Windows\system32\Mfqlfb32.exe
        313⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8732
        
        C:\Windows\SysWOW64\Mmkdcm32.exe
        
        C:\Windows\system32\Mmkdcm32.exe
        314⤵
        
        PID:8776
        
        C:\Windows\SysWOW64\Mjodla32.exe
        
        C:\Windows\system32\Mjodla32.exe
        315⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        316⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8860
        
        C:\Windows\SysWOW64\Mfeeabda.exe
        
        C:\Windows\system32\Mfeeabda.exe
        317⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8904
        
        C:\Windows\SysWOW64\Mmpmnl32.exe
        
        C:\Windows\system32\Mmpmnl32.exe
        318⤵
        
        PID:8944
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        319⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8984
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        320⤵
        
        PID:9028
        
        C:\Windows\SysWOW64\Nqmfdj32.exe
        
        C:\Windows\system32\Nqmfdj32.exe
        321⤵
        
        PID:9080
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        322⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9120
        
        C:\Windows\SysWOW64\Nfjola32.exe
        
        C:\Windows\system32\Nfjola32.exe
        323⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Nmdgikhi.exe
        
        C:\Windows\system32\Nmdgikhi.exe
        324⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9200
        
        C:\Windows\SysWOW64\Ngjkfd32.exe
        
        C:\Windows\system32\Ngjkfd32.exe
        325⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Nncccnol.exe
        
        C:\Windows\system32\Nncccnol.exe
        326⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8336
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        327⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8376
        
        C:\Windows\SysWOW64\Nglhld32.exe
        
        C:\Windows\system32\Nglhld32.exe
        328⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Nnfpinmi.exe
        
        C:\Windows\system32\Nnfpinmi.exe
        329⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8508
        
        C:\Windows\SysWOW64\Nadleilm.exe
        
        C:\Windows\system32\Nadleilm.exe
        330⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Ngndaccj.exe
        
        C:\Windows\system32\Ngndaccj.exe
        331⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8636
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        332⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Npiiffqe.exe
        
        C:\Windows\system32\Npiiffqe.exe
        333⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Ojomcopk.exe
        
        C:\Windows\system32\Ojomcopk.exe
        334⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Omnjojpo.exe
        
        C:\Windows\system32\Omnjojpo.exe
        335⤵
        Modifies registry class
        
        PID:8936
        
        C:\Windows\SysWOW64\Ogcnmc32.exe
        
        C:\Windows\system32\Ogcnmc32.exe
        336⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Ompfej32.exe
        
        C:\Windows\system32\Ompfej32.exe
        337⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Ocjoadei.exe
        
        C:\Windows\system32\Ocjoadei.exe
        338⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Ojdgnn32.exe
        
        C:\Windows\system32\Ojdgnn32.exe
        339⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Ombcji32.exe
        
        C:\Windows\system32\Ombcji32.exe
        340⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Oclkgccf.exe
        
        C:\Windows\system32\Oclkgccf.exe
        341⤵
        Drops file in System32 directory
        
        PID:8420
        
        C:\Windows\SysWOW64\Ofkgcobj.exe
        
        C:\Windows\system32\Ofkgcobj.exe
        342⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Omdppiif.exe
        
        C:\Windows\system32\Omdppiif.exe
        343⤵
        
        PID:8652
        
        C:\Windows\SysWOW64\Ojhpimhp.exe
        
        C:\Windows\system32\Ojhpimhp.exe
        344⤵
        
        PID:8700
        
        C:\Windows\SysWOW64\Oabhfg32.exe
        
        C:\Windows\system32\Oabhfg32.exe
        345⤵
        
        PID:8832
        
        C:\Windows\SysWOW64\Pnkbkk32.exe
        
        C:\Windows\system32\Pnkbkk32.exe
        346⤵
        Drops file in System32 directory
        
        PID:8916
        
        C:\Windows\SysWOW64\Pplobcpp.exe
        
        C:\Windows\system32\Pplobcpp.exe
        347⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Pjbcplpe.exe
        
        C:\Windows\system32\Pjbcplpe.exe
        348⤵
        
        PID:9148
        
        C:\Windows\SysWOW64\Pmpolgoi.exe
        
        C:\Windows\system32\Pmpolgoi.exe
        349⤵
        Drops file in System32 directory
        
        PID:9212
        
        C:\Windows\SysWOW64\Pdjgha32.exe
        
        C:\Windows\system32\Pdjgha32.exe
        350⤵
        
        PID:8320
        
        C:\Windows\SysWOW64\Pfiddm32.exe
        
        C:\Windows\system32\Pfiddm32.exe
        351⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Panhbfep.exe
        
        C:\Windows\system32\Panhbfep.exe
        352⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Qhhpop32.exe
        
        C:\Windows\system32\Qhhpop32.exe
        353⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Qobhkjdi.exe
        
        C:\Windows\system32\Qobhkjdi.exe
        354⤵
        Drops file in System32 directory
        
        PID:9092
        
        C:\Windows\SysWOW64\Qdoacabq.exe
        
        C:\Windows\system32\Qdoacabq.exe
        355⤵
        
        PID:8256
        
        C:\Windows\SysWOW64\Qfmmplad.exe
        
        C:\Windows\system32\Qfmmplad.exe
        356⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Qmgelf32.exe
        
        C:\Windows\system32\Qmgelf32.exe
        357⤵
        
        PID:8808
        
        C:\Windows\SysWOW64\Qdaniq32.exe
        
        C:\Windows\system32\Qdaniq32.exe
        358⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Afpjel32.exe
        
        C:\Windows\system32\Afpjel32.exe
        359⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8268
        
        C:\Windows\SysWOW64\Aogbfi32.exe
        
        C:\Windows\system32\Aogbfi32.exe
        360⤵
        
        PID:8672
        
        C:\Windows\SysWOW64\Aphnnafb.exe
        
        C:\Windows\system32\Aphnnafb.exe
        361⤵
        
        PID:9072
        
        C:\Windows\SysWOW64\Afbgkl32.exe
        
        C:\Windows\system32\Afbgkl32.exe
        362⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8840
        
        C:\Windows\SysWOW64\Amlogfel.exe
        
        C:\Windows\system32\Amlogfel.exe
        363⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Iqdfmajd.exe
        
        C:\Windows\system32\Iqdfmajd.exe
        331⤵
        
        PID:8952
        
        C:\Windows\SysWOW64\Icdoolge.exe
        
        C:\Windows\system32\Icdoolge.exe
        332⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Jmffnq32.exe
        
        C:\Windows\system32\Jmffnq32.exe
        333⤵
        
        PID:9068
        
        C:\Windows\SysWOW64\Kmmmnp32.exe
        
        C:\Windows\system32\Kmmmnp32.exe
        334⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Kmpido32.exe
        
        C:\Windows\system32\Kmpido32.exe
        335⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Dbehienn.exe
        
        C:\Windows\system32\Dbehienn.exe
        237⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Dhbqalle.exe
        
        C:\Windows\system32\Dhbqalle.exe
        238⤵
        Modifies registry class
        
        PID:8488
        
        C:\Windows\SysWOW64\Dpkehi32.exe
        
        C:\Windows\system32\Dpkehi32.exe
        239⤵
        Drops file in System32 directory
        
        PID:7780
        
        C:\Windows\SysWOW64\Dhgjll32.exe
        
        C:\Windows\system32\Dhgjll32.exe
        240⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Eflceb32.exe
        
        C:\Windows\system32\Eflceb32.exe
        241⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Eipilmgh.exe
        
        C:\Windows\system32\Eipilmgh.exe
        242⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Epiaig32.exe
        
        C:\Windows\system32\Epiaig32.exe
        243⤵
        
        PID:7644
        
        C:\Windows\SysWOW64\Fhefmjlp.exe
        
        C:\Windows\system32\Fhefmjlp.exe
        244⤵
        Modifies registry class
        
        PID:8604

C:\Windows\SysWOW64\Apjkcadp.exe
C:\Windows\system32\Apjkcadp.exe
1⤵
PID:9012
- C:\Windows\SysWOW64\Ahaceo32.exe
  C:\Windows\system32\Ahaceo32.exe
  2⤵
  PID:9256
- - C:\Windows\SysWOW64\Aokkahlo.exe
    C:\Windows\system32\Aokkahlo.exe
    3⤵
    - Modifies registry class
    PID:9296
  - - C:\Windows\SysWOW64\Apmhiq32.exe
      C:\Windows\system32\Apmhiq32.exe
      4⤵
      PID:9348
    - - C:\Windows\SysWOW64\Aggpfkjj.exe
        
        C:\Windows\system32\Aggpfkjj.exe
        5⤵
        
        PID:9392
      - C:\Windows\SysWOW64\Amqhbe32.exe
        
        C:\Windows\system32\Amqhbe32.exe
        6⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Agimkk32.exe
        
        C:\Windows\system32\Agimkk32.exe
        7⤵
        
        PID:9484
        
        C:\Windows\SysWOW64\Amcehdod.exe
        
        C:\Windows\system32\Amcehdod.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9532
        
        C:\Windows\SysWOW64\Apaadpng.exe
        
        C:\Windows\system32\Apaadpng.exe
        9⤵
        
        PID:9576
        
        C:\Windows\SysWOW64\Baannc32.exe
        
        C:\Windows\system32\Baannc32.exe
        10⤵
        
        PID:9616
        
        C:\Windows\SysWOW64\Bdojjo32.exe
        
        C:\Windows\system32\Bdojjo32.exe
        11⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Bkibgh32.exe
        
        C:\Windows\system32\Bkibgh32.exe
        12⤵
        Drops file in System32 directory
        
        PID:9696
        
        C:\Windows\SysWOW64\Bacjdbch.exe
        
        C:\Windows\system32\Bacjdbch.exe
        13⤵
        
        PID:9748
        
        C:\Windows\SysWOW64\Bhmbqm32.exe
        
        C:\Windows\system32\Bhmbqm32.exe
        14⤵
        Drops file in System32 directory
        
        PID:9788
        
        C:\Windows\SysWOW64\Bogkmgba.exe
        
        C:\Windows\system32\Bogkmgba.exe
        15⤵
        Drops file in System32 directory
        
        PID:9832
        
        C:\Windows\SysWOW64\Bddcenpi.exe
        
        C:\Windows\system32\Bddcenpi.exe
        16⤵
        
        PID:9880
        
        C:\Windows\SysWOW64\Bgbpaipl.exe
        
        C:\Windows\system32\Bgbpaipl.exe
        17⤵
        
        PID:9924
        
        C:\Windows\SysWOW64\Bnlhncgi.exe
        
        C:\Windows\system32\Bnlhncgi.exe
        18⤵
        
        PID:9968
        
        C:\Windows\SysWOW64\Bdfpkm32.exe
        
        C:\Windows\system32\Bdfpkm32.exe
        19⤵
        
        PID:10008
        
        C:\Windows\SysWOW64\Bgelgi32.exe
        
        C:\Windows\system32\Bgelgi32.exe
        20⤵
        
        PID:10052
        
        C:\Windows\SysWOW64\Boldhf32.exe
        
        C:\Windows\system32\Boldhf32.exe
        21⤵
        Drops file in System32 directory
        
        PID:10096
        
        C:\Windows\SysWOW64\Cpmapodj.exe
        
        C:\Windows\system32\Cpmapodj.exe
        22⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Cggimh32.exe
        
        C:\Windows\system32\Cggimh32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10180
        
        C:\Windows\SysWOW64\Cnaaib32.exe
        
        C:\Windows\system32\Cnaaib32.exe
        24⤵
        Drops file in System32 directory
        
        PID:10228
        
        C:\Windows\SysWOW64\Cdkifmjq.exe
        
        C:\Windows\system32\Cdkifmjq.exe
        25⤵
        
        PID:9224
        
        C:\Windows\SysWOW64\Cgifbhid.exe
        
        C:\Windows\system32\Cgifbhid.exe
        26⤵
        
        PID:9312
        
        C:\Windows\SysWOW64\Cncnob32.exe
        
        C:\Windows\system32\Cncnob32.exe
        27⤵
        
        PID:9388
        
        C:\Windows\SysWOW64\Chiblk32.exe
        
        C:\Windows\system32\Chiblk32.exe
        28⤵
        
        PID:9436
        
        C:\Windows\SysWOW64\Cocjiehd.exe
        
        C:\Windows\system32\Cocjiehd.exe
        29⤵
        Modifies registry class
        
        PID:9496
        
        C:\Windows\SysWOW64\Cpdgqmnb.exe
        
        C:\Windows\system32\Cpdgqmnb.exe
        30⤵
        
        PID:9556
        
        C:\Windows\SysWOW64\Cgnomg32.exe
        
        C:\Windows\system32\Cgnomg32.exe
        31⤵
        
        PID:9628
        
        C:\Windows\SysWOW64\Coegoe32.exe
        
        C:\Windows\system32\Coegoe32.exe
        32⤵
        
        PID:9692
        
        C:\Windows\SysWOW64\Cpfcfmlp.exe
        
        C:\Windows\system32\Cpfcfmlp.exe
        33⤵
        
        PID:9760
        
        C:\Windows\SysWOW64\Chnlgjlb.exe
        
        C:\Windows\system32\Chnlgjlb.exe
        34⤵
        Drops file in System32 directory
        
        PID:9820
        
        C:\Windows\SysWOW64\Cogddd32.exe
        
        C:\Windows\system32\Cogddd32.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:9892
        
        C:\Windows\SysWOW64\Dddllkbf.exe
        
        C:\Windows\system32\Dddllkbf.exe
        36⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\Dgcihgaj.exe
        
        C:\Windows\system32\Dgcihgaj.exe
        37⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Dnmaea32.exe
        
        C:\Windows\system32\Dnmaea32.exe
        38⤵
        
        PID:10088
        
        C:\Windows\SysWOW64\Dpkmal32.exe
        
        C:\Windows\system32\Dpkmal32.exe
        39⤵
        
        PID:10160
        
        C:\Windows\SysWOW64\Dgeenfog.exe
        
        C:\Windows\system32\Dgeenfog.exe
        40⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Dnonkq32.exe
        
        C:\Windows\system32\Dnonkq32.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9240
        
        C:\Windows\SysWOW64\Dqnjgl32.exe
        
        C:\Windows\system32\Dqnjgl32.exe
        42⤵
        
        PID:9360
        
        C:\Windows\SysWOW64\Dggbcf32.exe
        
        C:\Windows\system32\Dggbcf32.exe
        43⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Doojec32.exe
        
        C:\Windows\system32\Doojec32.exe
        44⤵
        
        PID:9544
        
        C:\Windows\SysWOW64\Dqpfmlce.exe
        
        C:\Windows\system32\Dqpfmlce.exe
        45⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Dhgonidg.exe
        
        C:\Windows\system32\Dhgonidg.exe
        46⤵
        Drops file in System32 directory
        
        PID:9824
        
        C:\Windows\SysWOW64\Doagjc32.exe
        
        C:\Windows\system32\Doagjc32.exe
        47⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Dhikci32.exe
        
        C:\Windows\system32\Dhikci32.exe
        48⤵
        
        PID:9996
        
        C:\Windows\SysWOW64\Dkhgod32.exe
        
        C:\Windows\system32\Dkhgod32.exe
        49⤵
        
        PID:10108
        
        C:\Windows\SysWOW64\Enfckp32.exe
        
        C:\Windows\system32\Enfckp32.exe
        50⤵
        
        PID:10204
        
        C:\Windows\SysWOW64\Eklajcmc.exe
        
        C:\Windows\system32\Eklajcmc.exe
        51⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Ebfign32.exe
        
        C:\Windows\system32\Ebfign32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9468
        
        C:\Windows\SysWOW64\Ehpadhll.exe
        
        C:\Windows\system32\Ehpadhll.exe
        53⤵
        
        PID:9684
        
        C:\Windows\SysWOW64\Ekonpckp.exe
        
        C:\Windows\system32\Ekonpckp.exe
        54⤵
        
        PID:9728
        
        C:\Windows\SysWOW64\Ebifmm32.exe
        
        C:\Windows\system32\Ebifmm32.exe
        55⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Edgbii32.exe
        
        C:\Windows\system32\Edgbii32.exe
        56⤵
        
        PID:10176
        
        C:\Windows\SysWOW64\Ekajec32.exe
        
        C:\Windows\system32\Ekajec32.exe
        57⤵
        
        PID:9244
        
        C:\Windows\SysWOW64\Enpfan32.exe
        
        C:\Windows\system32\Enpfan32.exe
        58⤵
        Modifies registry class
        
        PID:9600
        
        C:\Windows\SysWOW64\Eqncnj32.exe
        
        C:\Windows\system32\Eqncnj32.exe
        59⤵
        
        PID:9872
        
        C:\Windows\SysWOW64\Eghkjdoa.exe
        
        C:\Windows\system32\Eghkjdoa.exe
        60⤵
        
        PID:10164
        
        C:\Windows\SysWOW64\Fnbcgn32.exe
        
        C:\Windows\system32\Fnbcgn32.exe
        61⤵
        
        PID:9688
        
        C:\Windows\SysWOW64\Fdlkdhnk.exe
        
        C:\Windows\system32\Fdlkdhnk.exe
        62⤵
        
        PID:10064
        
        C:\Windows\SysWOW64\Fkfcqb32.exe
        
        C:\Windows\system32\Fkfcqb32.exe
        63⤵
        
        PID:9284
        
        C:\Windows\SysWOW64\Fqbliicp.exe
        
        C:\Windows\system32\Fqbliicp.exe
        64⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9060
        
        C:\Windows\SysWOW64\Fgmdec32.exe
        
        C:\Windows\system32\Fgmdec32.exe
        65⤵
        
        PID:10248
        
        C:\Windows\SysWOW64\Fnfmbmbi.exe
        
        C:\Windows\system32\Fnfmbmbi.exe
        66⤵
        
        PID:10292
        
        C:\Windows\SysWOW64\Fqeioiam.exe
        
        C:\Windows\system32\Fqeioiam.exe
        67⤵
        
        PID:10336
        
        C:\Windows\SysWOW64\Fgoakc32.exe
        
        C:\Windows\system32\Fgoakc32.exe
        68⤵
        
        PID:10376
        
        C:\Windows\SysWOW64\Fbdehlip.exe
        
        C:\Windows\system32\Fbdehlip.exe
        69⤵
        
        PID:10416
        
        C:\Windows\SysWOW64\Finnef32.exe
        
        C:\Windows\system32\Finnef32.exe
        70⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:10456
        
        C:\Windows\SysWOW64\Fkmjaa32.exe
        
        C:\Windows\system32\Fkmjaa32.exe
        71⤵
        
        PID:10500
        
        C:\Windows\SysWOW64\Fnkfmm32.exe
        
        C:\Windows\system32\Fnkfmm32.exe
        72⤵
        
        PID:10544
        
        C:\Windows\SysWOW64\Feenjgfq.exe
        
        C:\Windows\system32\Feenjgfq.exe
        73⤵
        
        PID:10588
        
        C:\Windows\SysWOW64\Fgcjfbed.exe
        
        C:\Windows\system32\Fgcjfbed.exe
        74⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Gnnccl32.exe
        
        C:\Windows\system32\Gnnccl32.exe
        75⤵
        
        PID:10676
        
        C:\Windows\SysWOW64\Galoohke.exe
        
        C:\Windows\system32\Galoohke.exe
        76⤵
        
        PID:10716
        
        C:\Windows\SysWOW64\Gicgpelg.exe
        
        C:\Windows\system32\Gicgpelg.exe
        77⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10760
        
        C:\Windows\SysWOW64\Gpmomo32.exe
        
        C:\Windows\system32\Gpmomo32.exe
        78⤵
        
        PID:10804
        
        C:\Windows\SysWOW64\Ganldgib.exe
        
        C:\Windows\system32\Ganldgib.exe
        79⤵
        
        PID:10856
        
        C:\Windows\SysWOW64\Gghdaa32.exe
        
        C:\Windows\system32\Gghdaa32.exe
        80⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10900
        
        C:\Windows\SysWOW64\Gbnhoj32.exe
        
        C:\Windows\system32\Gbnhoj32.exe
        81⤵
        Drops file in System32 directory
        
        PID:10940
        
        C:\Windows\SysWOW64\Geldkfpi.exe
        
        C:\Windows\system32\Geldkfpi.exe
        82⤵
        Drops file in System32 directory
        
        PID:10984
        
        C:\Windows\SysWOW64\Glfmgp32.exe
        
        C:\Windows\system32\Glfmgp32.exe
        83⤵
        
        PID:11024
        
        C:\Windows\SysWOW64\Gbpedjnb.exe
        
        C:\Windows\system32\Gbpedjnb.exe
        84⤵
        
        PID:11060
        
        C:\Windows\SysWOW64\Gijmad32.exe
        
        C:\Windows\system32\Gijmad32.exe
        85⤵
        
        PID:11104
        
        C:\Windows\SysWOW64\Gngeik32.exe
        
        C:\Windows\system32\Gngeik32.exe
        86⤵
        
        PID:11144
        
        C:\Windows\SysWOW64\Geanfelc.exe
        
        C:\Windows\system32\Geanfelc.exe
        87⤵
        
        PID:11184
        
        C:\Windows\SysWOW64\Hlkfbocp.exe
        
        C:\Windows\system32\Hlkfbocp.exe
        88⤵
        
        PID:11228
        
        C:\Windows\SysWOW64\Hbenoi32.exe
        
        C:\Windows\system32\Hbenoi32.exe
        89⤵
        
        PID:10256
        
        C:\Windows\SysWOW64\Hlmchoan.exe
        
        C:\Windows\system32\Hlmchoan.exe
        90⤵
        
        PID:10284
        
        C:\Windows\SysWOW64\Hbgkei32.exe
        
        C:\Windows\system32\Hbgkei32.exe
        91⤵
        
        PID:10344
        
        C:\Windows\SysWOW64\Hiacacpg.exe
        
        C:\Windows\system32\Hiacacpg.exe
        92⤵
        
        PID:10424
        
        C:\Windows\SysWOW64\Hlppno32.exe
        
        C:\Windows\system32\Hlppno32.exe
        93⤵
        
        PID:10484
        
        C:\Windows\SysWOW64\Hhfpbpdo.exe
        
        C:\Windows\system32\Hhfpbpdo.exe
        94⤵
        
        PID:10556
        
        C:\Windows\SysWOW64\Haodle32.exe
        
        C:\Windows\system32\Haodle32.exe
        95⤵
        Modifies registry class
        
        PID:10612
        
        C:\Windows\SysWOW64\Hldiinke.exe
        
        C:\Windows\system32\Hldiinke.exe
        96⤵
        
        PID:10684
        
        C:\Windows\SysWOW64\Haaaaeim.exe
        
        C:\Windows\system32\Haaaaeim.exe
        97⤵
        
        PID:10756
        
        C:\Windows\SysWOW64\Ihkjno32.exe
        
        C:\Windows\system32\Ihkjno32.exe
        98⤵
        
        PID:10848
        
        C:\Windows\SysWOW64\Iacngdgj.exe
        
        C:\Windows\system32\Iacngdgj.exe
        99⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Ihmfco32.exe
        
        C:\Windows\system32\Ihmfco32.exe
        100⤵
        Modifies registry class
        
        PID:10972
        
        C:\Windows\SysWOW64\Ipdndloi.exe
        
        C:\Windows\system32\Ipdndloi.exe
        101⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\Iimcma32.exe
        
        C:\Windows\system32\Iimcma32.exe
        102⤵
        
        PID:11096
        
        C:\Windows\SysWOW64\Ipgkjlmg.exe
        
        C:\Windows\system32\Ipgkjlmg.exe
        103⤵
        
        PID:11164
        
        C:\Windows\SysWOW64\Iahgad32.exe
        
        C:\Windows\system32\Iahgad32.exe
        104⤵
        
        PID:11236
        
        C:\Windows\SysWOW64\Iiopca32.exe
        
        C:\Windows\system32\Iiopca32.exe
        105⤵
        
        PID:9864
        
        C:\Windows\SysWOW64\Ipihpkkd.exe
        
        C:\Windows\system32\Ipihpkkd.exe
        106⤵
        Drops file in System32 directory
        
        PID:10384
        
        C:\Windows\SysWOW64\Iajdgcab.exe
        
        C:\Windows\system32\Iajdgcab.exe
        107⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Ihdldn32.exe
        
        C:\Windows\system32\Ihdldn32.exe
        108⤵
        
        PID:10600
        
        C:\Windows\SysWOW64\Iondqhpl.exe
        
        C:\Windows\system32\Iondqhpl.exe
        109⤵
        
        PID:10688
        
        C:\Windows\SysWOW64\Jidinqpb.exe
        
        C:\Windows\system32\Jidinqpb.exe
        110⤵
        
        PID:10852
        
        C:\Windows\SysWOW64\Jpnakk32.exe
        
        C:\Windows\system32\Jpnakk32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:10980
        
        C:\Windows\SysWOW64\Jaonbc32.exe
        
        C:\Windows\system32\Jaonbc32.exe
        112⤵
        
        PID:11100
        
        C:\Windows\SysWOW64\Jhifomdj.exe
        
        C:\Windows\system32\Jhifomdj.exe
        113⤵
        
        PID:11252
        
        C:\Windows\SysWOW64\Jocnlg32.exe
        
        C:\Windows\system32\Jocnlg32.exe
        114⤵
        
        PID:10320
        
        C:\Windows\SysWOW64\Jaajhb32.exe
        
        C:\Windows\system32\Jaajhb32.exe
        115⤵
        Drops file in System32 directory
        
        PID:10572
        
        C:\Windows\SysWOW64\Jhkbdmbg.exe
        
        C:\Windows\system32\Jhkbdmbg.exe
        116⤵
        
        PID:10644
        
        C:\Windows\SysWOW64\Jpbjfjci.exe
        
        C:\Windows\system32\Jpbjfjci.exe
        117⤵
        Drops file in System32 directory
        
        PID:10812
        
        C:\Windows\SysWOW64\Jeocna32.exe
        
        C:\Windows\system32\Jeocna32.exe
        118⤵
        
        PID:1132
        
        C:\Windows\SysWOW64\Jlikkkhn.exe
        
        C:\Windows\system32\Jlikkkhn.exe
        119⤵
        
        PID:10408
        
        C:\Windows\SysWOW64\Jbccge32.exe
        
        C:\Windows\system32\Jbccge32.exe
        120⤵
        
        PID:10668
        
        C:\Windows\SysWOW64\Jimldogg.exe
        
        C:\Windows\system32\Jimldogg.exe
        121⤵
        
        PID:11088
        
        C:\Windows\SysWOW64\Jojdlfeo.exe
        
        C:\Windows\system32\Jojdlfeo.exe
        122⤵
        
        PID:10632
        
        C:\Windows\SysWOW64\Kedlip32.exe
        
        C:\Windows\system32\Kedlip32.exe
        123⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\Khbiello.exe
        
        C:\Windows\system32\Khbiello.exe
        124⤵
        
        PID:11268
        
        C:\Windows\SysWOW64\Kolabf32.exe
        
        C:\Windows\system32\Kolabf32.exe
        125⤵
        
        PID:11320
        
        C:\Windows\SysWOW64\Kefiopki.exe
        
        C:\Windows\system32\Kefiopki.exe
        126⤵
        
        PID:11360
        
        C:\Windows\SysWOW64\Klpakj32.exe
        
        C:\Windows\system32\Klpakj32.exe
        127⤵
        
        PID:11416
        
        C:\Windows\SysWOW64\Kcjjhdjb.exe
        
        C:\Windows\system32\Kcjjhdjb.exe
        128⤵
        
        PID:11456
        
        C:\Windows\SysWOW64\Kidben32.exe
        
        C:\Windows\system32\Kidben32.exe
        129⤵
        
        PID:11500
        
        C:\Windows\SysWOW64\Koajmepf.exe
        
        C:\Windows\system32\Koajmepf.exe
        130⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:11548
        
        C:\Windows\SysWOW64\Kifojnol.exe
        
        C:\Windows\system32\Kifojnol.exe
        131⤵
        
        PID:11592
        
        C:\Windows\SysWOW64\Klekfinp.exe
        
        C:\Windows\system32\Klekfinp.exe
        132⤵
        
        PID:11632
        
        C:\Windows\SysWOW64\Kcoccc32.exe
        
        C:\Windows\system32\Kcoccc32.exe
        133⤵
        
        PID:11676
        
        C:\Windows\SysWOW64\Kpccmhdg.exe
        
        C:\Windows\system32\Kpccmhdg.exe
        134⤵
        
        PID:11736
        
        C:\Windows\SysWOW64\Kadpdp32.exe
        
        C:\Windows\system32\Kadpdp32.exe
        135⤵
        Drops file in System32 directory
        
        PID:11772
        
        C:\Windows\SysWOW64\Lhnhajba.exe
        
        C:\Windows\system32\Lhnhajba.exe
        136⤵
        
        PID:11816
        
        C:\Windows\SysWOW64\Lebijnak.exe
        
        C:\Windows\system32\Lebijnak.exe
        137⤵
        
        PID:11868
        
        C:\Windows\SysWOW64\Lllagh32.exe
        
        C:\Windows\system32\Lllagh32.exe
        138⤵
        
        PID:11908
        
        C:\Windows\SysWOW64\Lojmcdgl.exe
        
        C:\Windows\system32\Lojmcdgl.exe
        139⤵
        
        PID:11952
        
        C:\Windows\SysWOW64\Ledepn32.exe
        
        C:\Windows\system32\Ledepn32.exe
        140⤵
        
        PID:11996
        
        C:\Windows\SysWOW64\Lpjjmg32.exe
        
        C:\Windows\system32\Lpjjmg32.exe
        141⤵
        
        PID:12040
        
        C:\Windows\SysWOW64\Lchfib32.exe
        
        C:\Windows\system32\Lchfib32.exe
        142⤵
        Modifies registry class
        
        PID:12084
        
        C:\Windows\SysWOW64\Ljbnfleo.exe
        
        C:\Windows\system32\Ljbnfleo.exe
        143⤵
        
        PID:12124
        
        C:\Windows\SysWOW64\Lplfcf32.exe
        
        C:\Windows\system32\Lplfcf32.exe
        144⤵
        
        PID:12168
        
        C:\Windows\SysWOW64\Lancko32.exe
        
        C:\Windows\system32\Lancko32.exe
        145⤵
        
        PID:12216
        
        C:\Windows\SysWOW64\Lhgkgijg.exe
        
        C:\Windows\system32\Lhgkgijg.exe
        146⤵
        Modifies registry class
        
        PID:12260
        
        C:\Windows\SysWOW64\Loacdc32.exe
        
        C:\Windows\system32\Loacdc32.exe
        147⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Mapppn32.exe
        
        C:\Windows\system32\Mapppn32.exe
        148⤵
        
        PID:3184
        
        C:\Windows\SysWOW64\Mhjhmhhd.exe
        
        C:\Windows\system32\Mhjhmhhd.exe
        149⤵
        
        PID:11428
        
        C:\Windows\SysWOW64\Modpib32.exe
        
        C:\Windows\system32\Modpib32.exe
        150⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:11520
        
        C:\Windows\SysWOW64\Mfnhfm32.exe
        
        C:\Windows\system32\Mfnhfm32.exe
        151⤵
        Drops file in System32 directory
        
        PID:11580
        
        C:\Windows\SysWOW64\Mcaipa32.exe
        
        C:\Windows\system32\Mcaipa32.exe
        152⤵
        
        PID:11660

C:\Windows\SysWOW64\Mfenglqf.exe
C:\Windows\system32\Mfenglqf.exe
1⤵
PID:11720
- C:\Windows\SysWOW64\Mqjbddpl.exe
  C:\Windows\system32\Mqjbddpl.exe
  2⤵
  PID:11800
- - C:\Windows\SysWOW64\Njbgmjgl.exe
    C:\Windows\system32\Njbgmjgl.exe
    3⤵
    - Modifies registry class
    PID:11876
  - - C:\Windows\SysWOW64\Nqmojd32.exe
      C:\Windows\system32\Nqmojd32.exe
      4⤵
      PID:11964
    - - C:\Windows\SysWOW64\Nqoloc32.exe
        
        C:\Windows\system32\Nqoloc32.exe
        5⤵
        Modifies registry class
        
        PID:12032
      - C:\Windows\SysWOW64\Njgqhicg.exe
        
        C:\Windows\system32\Njgqhicg.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12092
        
        C:\Windows\SysWOW64\Nmfmde32.exe
        
        C:\Windows\system32\Nmfmde32.exe
        7⤵
        
        PID:12156
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:12212
        
        C:\Windows\SysWOW64\Njjmni32.exe
        
        C:\Windows\system32\Njjmni32.exe
        9⤵
        
        PID:2984
        
        C:\Windows\SysWOW64\Njljch32.exe
        
        C:\Windows\system32\Njljch32.exe
        10⤵
        
        PID:11316
        
        C:\Windows\SysWOW64\Oiagde32.exe
        
        C:\Windows\system32\Oiagde32.exe
        11⤵
        
        PID:11496
        
        C:\Windows\SysWOW64\Oqhoeb32.exe
        
        C:\Windows\system32\Oqhoeb32.exe
        12⤵
        
        PID:11600
        
        C:\Windows\SysWOW64\Objkmkjj.exe
        
        C:\Windows\system32\Objkmkjj.exe
        13⤵
        Modifies registry class
        
        PID:11724
        
        C:\Windows\SysWOW64\Omopjcjp.exe
        
        C:\Windows\system32\Omopjcjp.exe
        14⤵
        
        PID:4552
        
        C:\Windows\SysWOW64\Ofgdcipq.exe
        
        C:\Windows\system32\Ofgdcipq.exe
        15⤵
        
        PID:11808
        
        C:\Windows\SysWOW64\Omalpc32.exe
        
        C:\Windows\system32\Omalpc32.exe
        16⤵
        
        PID:11852
        
        C:\Windows\SysWOW64\Ojemig32.exe
        
        C:\Windows\system32\Ojemig32.exe
        17⤵
        
        PID:12020
        
        C:\Windows\SysWOW64\Oqoefand.exe
        
        C:\Windows\system32\Oqoefand.exe
        18⤵
        
        PID:12072

C:\Windows\SysWOW64\Pbcncibp.exe
C:\Windows\system32\Pbcncibp.exe
1⤵
- Drops file in System32 directory
PID:1000
- C:\Windows\SysWOW64\Padnaq32.exe
  C:\Windows\system32\Padnaq32.exe
  2⤵
  PID:12256
- - C:\Windows\SysWOW64\Pmkofa32.exe
    C:\Windows\system32\Pmkofa32.exe
    3⤵
    PID:2212
  - - C:\Windows\SysWOW64\Pfccogfc.exe
      C:\Windows\system32\Pfccogfc.exe
      4⤵
      PID:4748
    - - C:\Windows\SysWOW64\Pplhhm32.exe
        
        C:\Windows\system32\Pplhhm32.exe
        5⤵
        
        PID:11404
      - C:\Windows\SysWOW64\Pidlqb32.exe
        
        C:\Windows\system32\Pidlqb32.exe
        6⤵
        
        PID:11572
        
        C:\Windows\SysWOW64\Pciqnk32.exe
        
        C:\Windows\system32\Pciqnk32.exe
        7⤵
        
        PID:11700
        
        C:\Windows\SysWOW64\Pjcikejg.exe
        
        C:\Windows\system32\Pjcikejg.exe
        8⤵
        
        PID:316
        
        C:\Windows\SysWOW64\Qiiflaoo.exe
        
        C:\Windows\system32\Qiiflaoo.exe
        9⤵
        Drops file in System32 directory
        
        PID:11896
        
        C:\Windows\SysWOW64\Qjhbfd32.exe
        
        C:\Windows\system32\Qjhbfd32.exe
        10⤵
        
        PID:11948
        
        C:\Windows\SysWOW64\Acqgojmb.exe
        
        C:\Windows\system32\Acqgojmb.exe
        11⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\Ajjokd32.exe
        
        C:\Windows\system32\Ajjokd32.exe
        12⤵
        
        PID:5032
        
        C:\Windows\SysWOW64\Acccdj32.exe
        
        C:\Windows\system32\Acccdj32.exe
        13⤵
        
        PID:312
        
        C:\Windows\SysWOW64\Ajmladbl.exe
        
        C:\Windows\system32\Ajmladbl.exe
        14⤵
        
        PID:12244
        
        C:\Windows\SysWOW64\Apjdikqd.exe
        
        C:\Windows\system32\Apjdikqd.exe
        15⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:4876
        
        C:\Windows\SysWOW64\Ajohfcpj.exe
        
        C:\Windows\system32\Ajohfcpj.exe
        16⤵
        
        PID:11492
        
        C:\Windows\SysWOW64\Amnebo32.exe
        
        C:\Windows\system32\Amnebo32.exe
        17⤵
        
        PID:952
        
        C:\Windows\SysWOW64\Adgmoigj.exe
        
        C:\Windows\system32\Adgmoigj.exe
        18⤵
        
        PID:11668
        
        C:\Windows\SysWOW64\Aidehpea.exe
        
        C:\Windows\system32\Aidehpea.exe
        19⤵
        
        PID:11892
        
        C:\Windows\SysWOW64\Afhfaddk.exe
        
        C:\Windows\system32\Afhfaddk.exe
        20⤵
        
        PID:11944
        
        C:\Windows\SysWOW64\Bdlfjh32.exe
        
        C:\Windows\system32\Bdlfjh32.exe
        21⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\Bjfogbjb.exe
        
        C:\Windows\system32\Bjfogbjb.exe
        22⤵
        
        PID:3164
        
        C:\Windows\SysWOW64\Bapgdm32.exe
        
        C:\Windows\system32\Bapgdm32.exe
        23⤵
        
        PID:10800
        
        C:\Windows\SysWOW64\Bfmolc32.exe
        
        C:\Windows\system32\Bfmolc32.exe
        24⤵
        
        PID:10892
        
        C:\Windows\SysWOW64\Bmggingc.exe
        
        C:\Windows\system32\Bmggingc.exe
        25⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Binhnomg.exe
        
        C:\Windows\system32\Binhnomg.exe
        26⤵
        
        PID:11444
        
        C:\Windows\SysWOW64\Bfaigclq.exe
        
        C:\Windows\system32\Bfaigclq.exe
        27⤵
        
        PID:1604
        
        C:\Windows\SysWOW64\Ckpamabg.exe
        
        C:\Windows\system32\Ckpamabg.exe
        28⤵
        
        PID:3876
        
        C:\Windows\SysWOW64\Cdhffg32.exe
        
        C:\Windows\system32\Cdhffg32.exe
        29⤵
        
        PID:2320
        
        C:\Windows\SysWOW64\Cdjblf32.exe
        
        C:\Windows\system32\Cdjblf32.exe
        30⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\Cigkdmel.exe
        
        C:\Windows\system32\Cigkdmel.exe
        31⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\Ccppmc32.exe
        
        C:\Windows\system32\Ccppmc32.exe
        32⤵
        
        PID:1888
        
        C:\Windows\SysWOW64\Cpcpfg32.exe
        
        C:\Windows\system32\Cpcpfg32.exe
        33⤵
        
        PID:4020
        
        C:\Windows\SysWOW64\Cildom32.exe
        
        C:\Windows\system32\Cildom32.exe
        34⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\Dgpeha32.exe
        
        C:\Windows\system32\Dgpeha32.exe
        35⤵
        
        PID:11352
        
        C:\Windows\SysWOW64\Dmjmekgn.exe
        
        C:\Windows\system32\Dmjmekgn.exe
        36⤵
        
        PID:3252
        
        C:\Windows\SysWOW64\Dnljkk32.exe
        
        C:\Windows\system32\Dnljkk32.exe
        37⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3544
        
        C:\Windows\SysWOW64\Dcibca32.exe
        
        C:\Windows\system32\Dcibca32.exe
        38⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\Dckoia32.exe
        
        C:\Windows\system32\Dckoia32.exe
        39⤵
        
        PID:11936
        
        C:\Windows\SysWOW64\Dnqcfjae.exe
        
        C:\Windows\system32\Dnqcfjae.exe
        40⤵
        
        PID:3412
        
        C:\Windows\SysWOW64\Ddklbd32.exe
        
        C:\Windows\system32\Ddklbd32.exe
        41⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\Ddmhhd32.exe
        
        C:\Windows\system32\Ddmhhd32.exe
        42⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Ejjaqk32.exe
        
        C:\Windows\system32\Ejjaqk32.exe
        43⤵
        
        PID:1204
        
        C:\Windows\SysWOW64\Eaaiahei.exe
        
        C:\Windows\system32\Eaaiahei.exe
        44⤵
        
        PID:2496
        
        C:\Windows\SysWOW64\Ecbeip32.exe
        
        C:\Windows\system32\Ecbeip32.exe
        45⤵
        
        PID:11524
        
        C:\Windows\SysWOW64\Eaceghcg.exe
        
        C:\Windows\system32\Eaceghcg.exe
        46⤵
        Modifies registry class
        
        PID:11448
        
        C:\Windows\SysWOW64\Enjfli32.exe
        
        C:\Windows\system32\Enjfli32.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2704
        
        C:\Windows\SysWOW64\Eddnic32.exe
        
        C:\Windows\system32\Eddnic32.exe
        48⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\Ejagaj32.exe
        
        C:\Windows\system32\Ejagaj32.exe
        49⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Enopghee.exe
        
        C:\Windows\system32\Enopghee.exe
        50⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\Fnalmh32.exe
        
        C:\Windows\system32\Fnalmh32.exe
        51⤵
        
        PID:4808
        
        C:\Windows\SysWOW64\Fcneeo32.exe
        
        C:\Windows\system32\Fcneeo32.exe
        52⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\Fboecfii.exe
        
        C:\Windows\system32\Fboecfii.exe
        53⤵
        
        PID:2016
        
        C:\Windows\SysWOW64\Fjjjgh32.exe
        
        C:\Windows\system32\Fjjjgh32.exe
        54⤵
        
        PID:2608
        
        C:\Windows\SysWOW64\Fcbnpnme.exe
        
        C:\Windows\system32\Fcbnpnme.exe
        55⤵
        
        PID:11312
        
        C:\Windows\SysWOW64\Fdbkja32.exe
        
        C:\Windows\system32\Fdbkja32.exe
        56⤵
        
        PID:1600
        
        C:\Windows\SysWOW64\Fqikob32.exe
        
        C:\Windows\system32\Fqikob32.exe
        57⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\Gnaecedp.exe
        
        C:\Windows\system32\Gnaecedp.exe
        58⤵
        
        PID:4188
        
        C:\Windows\SysWOW64\Gqbneq32.exe
        
        C:\Windows\system32\Gqbneq32.exe
        59⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Gglfbkin.exe
        
        C:\Windows\system32\Gglfbkin.exe
        60⤵
        
        PID:2888

C:\Windows\SysWOW64\Hqdkkp32.exe
C:\Windows\system32\Hqdkkp32.exe
1⤵
PID:4028
- C:\Windows\SysWOW64\Hbdgec32.exe
  C:\Windows\system32\Hbdgec32.exe
  2⤵
  PID:1524
- - C:\Windows\SysWOW64\Haidfpki.exe
    C:\Windows\system32\Haidfpki.exe
    3⤵
    PID:1076
  - - C:\Windows\SysWOW64\Hkohchko.exe
      C:\Windows\system32\Hkohchko.exe
      4⤵
      Drops file in System32 directory
      PID:4800

C:\Windows\SysWOW64\Hkaeih32.exe
C:\Windows\system32\Hkaeih32.exe
1⤵
PID:2256
- C:\Windows\SysWOW64\Igjbci32.exe
  C:\Windows\system32\Igjbci32.exe
  2⤵
  PID:4324
- - C:\Windows\SysWOW64\Indkpcdk.exe
    C:\Windows\system32\Indkpcdk.exe
    3⤵
    PID:388
  - - C:\Windows\SysWOW64\Igmoih32.exe
      C:\Windows\system32\Igmoih32.exe
      4⤵
      PID:4360

C:\Windows\SysWOW64\Halaloif.exe
C:\Windows\system32\Halaloif.exe
1⤵
PID:456

C:\Windows\SysWOW64\Iagqgn32.exe
C:\Windows\system32\Iagqgn32.exe
1⤵
PID:1964
- C:\Windows\SysWOW64\Ihceigec.exe
  C:\Windows\system32\Ihceigec.exe
  2⤵
  PID:2028
- - C:\Windows\SysWOW64\Jlanpfkj.exe
    C:\Windows\system32\Jlanpfkj.exe
    3⤵
    - Drops file in System32 directory
    PID:1684
  - - C:\Windows\SysWOW64\Janghmia.exe
      C:\Windows\system32\Janghmia.exe
      4⤵
      Drops file in System32 directory
      PID:4184
    - - C:\Windows\SysWOW64\Jhhodg32.exe
        
        C:\Windows\system32\Jhhodg32.exe
        5⤵
        
        PID:1696
      - C:\Windows\SysWOW64\Jjgkab32.exe
        
        C:\Windows\system32\Jjgkab32.exe
        6⤵
        
        PID:2868
        
        C:\Windows\SysWOW64\Jdopjh32.exe
        
        C:\Windows\system32\Jdopjh32.exe
        7⤵
        
        PID:2316
        
        C:\Windows\SysWOW64\Jlfhke32.exe
        
        C:\Windows\system32\Jlfhke32.exe
        8⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\Jbppgona.exe
        
        C:\Windows\system32\Jbppgona.exe
        9⤵
        
        PID:4236
        
        C:\Windows\SysWOW64\Jdalog32.exe
        
        C:\Windows\system32\Jdalog32.exe
        10⤵
        
        PID:716
        
        C:\Windows\SysWOW64\Jlidpe32.exe
        
        C:\Windows\system32\Jlidpe32.exe
        11⤵
        Drops file in System32 directory
        
        PID:884
        
        C:\Windows\SysWOW64\Jbbmmo32.exe
        
        C:\Windows\system32\Jbbmmo32.exe
        12⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\Jhoeef32.exe
        
        C:\Windows\system32\Jhoeef32.exe
        13⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\Jjnaaa32.exe
        
        C:\Windows\system32\Jjnaaa32.exe
        14⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Kbeibo32.exe
        
        C:\Windows\system32\Kbeibo32.exe
        15⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\Khdoqefq.exe
        
        C:\Windows\system32\Khdoqefq.exe
        16⤵
        Modifies registry class
        
        PID:3240
        
        C:\Windows\SysWOW64\Kalcik32.exe
        
        C:\Windows\system32\Kalcik32.exe
        17⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\Kejloi32.exe
        
        C:\Windows\system32\Kejloi32.exe
        18⤵
        
        PID:2388
        
        C:\Windows\SysWOW64\Kaaldjil.exe
        
        C:\Windows\system32\Kaaldjil.exe
        19⤵
        Drops file in System32 directory
        
        PID:4588
        
        C:\Windows\SysWOW64\Klgqabib.exe
        
        C:\Windows\system32\Klgqabib.exe
        20⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Lddble32.exe
        
        C:\Windows\system32\Lddble32.exe
        21⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\Lajokiaa.exe
        
        C:\Windows\system32\Lajokiaa.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2136
        
        C:\Windows\SysWOW64\Lehhqg32.exe
        
        C:\Windows\system32\Lehhqg32.exe
        23⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2140
        
        C:\Windows\SysWOW64\Mlbpma32.exe
        
        C:\Windows\system32\Mlbpma32.exe
        24⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Mociol32.exe
        
        C:\Windows\system32\Mociol32.exe
        25⤵
        
        PID:2572
        
        C:\Windows\SysWOW64\Mhknhabf.exe
        
        C:\Windows\system32\Mhknhabf.exe
        26⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Mhnjna32.exe
        
        C:\Windows\system32\Mhnjna32.exe
        27⤵
        
        PID:3992
        
        C:\Windows\SysWOW64\Nlnpio32.exe
        
        C:\Windows\system32\Nlnpio32.exe
        28⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\Namegfql.exe
        
        C:\Windows\system32\Namegfql.exe
        29⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Noaeqjpe.exe
        
        C:\Windows\system32\Noaeqjpe.exe
        30⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5940
        
        C:\Windows\SysWOW64\Nkhfek32.exe
        
        C:\Windows\system32\Nkhfek32.exe
        31⤵
        Drops file in System32 directory
        
        PID:5396
        
        C:\Windows\SysWOW64\Ndpjnq32.exe
        
        C:\Windows\system32\Ndpjnq32.exe
        32⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Nofoki32.exe
        
        C:\Windows\system32\Nofoki32.exe
        33⤵
        Modifies registry class
        
        PID:6120
        
        C:\Windows\SysWOW64\Oljoen32.exe
        
        C:\Windows\system32\Oljoen32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1340
        
        C:\Windows\SysWOW64\Obfhmd32.exe
        
        C:\Windows\system32\Obfhmd32.exe
        35⤵
        
        PID:3512
        
        C:\Windows\SysWOW64\Ocfdgg32.exe
        
        C:\Windows\system32\Ocfdgg32.exe
        36⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Ofdqcc32.exe
        
        C:\Windows\system32\Ofdqcc32.exe
        37⤵
        
        PID:5548
        
        C:\Windows\SysWOW64\Oloipmfd.exe
        
        C:\Windows\system32\Oloipmfd.exe
        38⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Oooaah32.exe
        
        C:\Windows\system32\Oooaah32.exe
        39⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Ofijnbkb.exe
        
        C:\Windows\system32\Ofijnbkb.exe
        40⤵
        
        PID:5180

C:\Windows\SysWOW64\Pdqcenmg.exe
C:\Windows\system32\Pdqcenmg.exe
1⤵
PID:5256
- C:\Windows\SysWOW64\Piaiqlak.exe
  C:\Windows\system32\Piaiqlak.exe
  2⤵
  PID:3140

C:\Windows\SysWOW64\Oflfdbip.exe
C:\Windows\system32\Oflfdbip.exe
1⤵
PID:3532

C:\Windows\SysWOW64\Pbimjb32.exe
C:\Windows\system32\Pbimjb32.exe
1⤵
PID:5532
- C:\Windows\SysWOW64\Piceflpi.exe
  C:\Windows\system32\Piceflpi.exe
  2⤵
  PID:5516
- - C:\Windows\SysWOW64\Pbljoafi.exe
    C:\Windows\system32\Pbljoafi.exe
    3⤵
    PID:4904
  - - C:\Windows\SysWOW64\Qelcamcj.exe
      C:\Windows\system32\Qelcamcj.exe
      4⤵
      PID:5328
    - - C:\Windows\SysWOW64\Qcncodki.exe
        
        C:\Windows\system32\Qcncodki.exe
        5⤵
        
        PID:5724
      - C:\Windows\SysWOW64\Apddce32.exe
        
        C:\Windows\system32\Apddce32.exe
        6⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Amkabind.exe
        
        C:\Windows\system32\Amkabind.exe
        7⤵
        
        PID:5272
        
        C:\Windows\SysWOW64\Aiabhj32.exe
        
        C:\Windows\system32\Aiabhj32.exe
        8⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\Aidomjaf.exe
        
        C:\Windows\system32\Aidomjaf.exe
        9⤵
        
        PID:5476

C:\Windows\SysWOW64\Bmagch32.exe
C:\Windows\system32\Bmagch32.exe
1⤵
PID:5868
- C:\Windows\SysWOW64\Bmddihfj.exe
  C:\Windows\system32\Bmddihfj.exe
  2⤵
  PID:5676
- - C:\Windows\SysWOW64\Bikeni32.exe
    C:\Windows\system32\Bikeni32.exe
    3⤵
    PID:5440
  - - C:\Windows\SysWOW64\Bbcignbo.exe
      C:\Windows\system32\Bbcignbo.exe
      4⤵
      PID:5480
    - - C:\Windows\SysWOW64\Bcbeqaia.exe
        
        C:\Windows\system32\Bcbeqaia.exe
        5⤵
        
        PID:5568
      - C:\Windows\SysWOW64\Cifdjg32.exe
        
        C:\Windows\system32\Cifdjg32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:5444
        
        C:\Windows\SysWOW64\Cmdmpe32.exe
        
        C:\Windows\system32\Cmdmpe32.exe
        7⤵
        Modifies registry class
        
        PID:5268
        
        C:\Windows\SysWOW64\Cepadh32.exe
        
        C:\Windows\system32\Cepadh32.exe
        8⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\Dpefaq32.exe
        
        C:\Windows\system32\Dpefaq32.exe
        9⤵
        Modifies registry class
        
        PID:3936
        
        C:\Windows\SysWOW64\Dfonnk32.exe
        
        C:\Windows\system32\Dfonnk32.exe
        10⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Dmifkecb.exe
        
        C:\Windows\system32\Dmifkecb.exe
        11⤵
        Modifies registry class
        
        PID:6036
        
        C:\Windows\SysWOW64\Ddcogo32.exe
        
        C:\Windows\system32\Ddcogo32.exe
        12⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Dedkogqm.exe
        
        C:\Windows\system32\Dedkogqm.exe
        13⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Dmkcpdao.exe
        
        C:\Windows\system32\Dmkcpdao.exe
        14⤵
        Modifies registry class
        
        PID:3536
        
        C:\Windows\SysWOW64\Ddekmo32.exe
        
        C:\Windows\system32\Ddekmo32.exe
        15⤵
        
        PID:6180
        
        C:\Windows\SysWOW64\Defheg32.exe
        
        C:\Windows\system32\Defheg32.exe
        16⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Dmnpfd32.exe
        
        C:\Windows\system32\Dmnpfd32.exe
        17⤵
        Modifies registry class
        
        PID:6284
        
        C:\Windows\SysWOW64\Ddhhbngi.exe
        
        C:\Windows\system32\Ddhhbngi.exe
        18⤵
        
        PID:556
        
        C:\Windows\SysWOW64\Dcmedk32.exe
        
        C:\Windows\system32\Dcmedk32.exe
        19⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\Digmqe32.exe
        
        C:\Windows\system32\Digmqe32.exe
        20⤵
        
        PID:5540
        
        C:\Windows\SysWOW64\Egknji32.exe
        
        C:\Windows\system32\Egknji32.exe
        21⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Elhfbp32.exe
        
        C:\Windows\system32\Elhfbp32.exe
        22⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Epeohn32.exe
        
        C:\Windows\system32\Epeohn32.exe
        23⤵
        
        PID:11716
        
        C:\Windows\SysWOW64\Emioab32.exe
        
        C:\Windows\system32\Emioab32.exe
        24⤵
        
        PID:6936
        
        C:\Windows\SysWOW64\Epjhcnbp.exe
        
        C:\Windows\system32\Epjhcnbp.exe
        25⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Fpmeimpn.exe
        
        C:\Windows\system32\Fpmeimpn.exe
        26⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Feimadoe.exe
        
        C:\Windows\system32\Feimadoe.exe
        27⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Fdjnolfd.exe
        
        C:\Windows\system32\Fdjnolfd.exe
        28⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Fncbha32.exe
        
        C:\Windows\system32\Fncbha32.exe
        29⤵
        Modifies registry class
        
        PID:5736

C:\Windows\SysWOW64\Flhoinbl.exe
C:\Windows\system32\Flhoinbl.exe
1⤵
PID:5804
- C:\Windows\SysWOW64\Gphddlfp.exe
  C:\Windows\system32\Gphddlfp.exe
  2⤵
  PID:6784
- - C:\Windows\SysWOW64\Gfemmb32.exe
    C:\Windows\system32\Gfemmb32.exe
    3⤵
    PID:6456
  - - C:\Windows\SysWOW64\Gloejmld.exe
      C:\Windows\system32\Gloejmld.exe
      4⤵
      PID:3884
    - - C:\Windows\SysWOW64\Gfgjbb32.exe
        
        C:\Windows\system32\Gfgjbb32.exe
        5⤵
        
        PID:6832
      - C:\Windows\SysWOW64\Glabolja.exe
        
        C:\Windows\system32\Glabolja.exe
        6⤵
        Drops file in System32 directory
        
        PID:5936
        
        C:\Windows\SysWOW64\Gmdoel32.exe
        
        C:\Windows\system32\Gmdoel32.exe
        7⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Hjjldpdf.exe
        
        C:\Windows\system32\Hjjldpdf.exe
        8⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Hgnlmdcp.exe
        
        C:\Windows\system32\Hgnlmdcp.exe
        9⤵
        
        PID:7164
        
        C:\Windows\SysWOW64\Hnhdjn32.exe
        
        C:\Windows\system32\Hnhdjn32.exe
        10⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Hdbmfhbi.exe
        
        C:\Windows\system32\Hdbmfhbi.exe
        11⤵
        
        PID:7016
        
        C:\Windows\SysWOW64\Hfcinq32.exe
        
        C:\Windows\system32\Hfcinq32.exe
        12⤵
        
        PID:3244
        
        C:\Windows\SysWOW64\Hqimlihn.exe
        
        C:\Windows\system32\Hqimlihn.exe
        13⤵
        Modifies registry class
        
        PID:4828
        
        C:\Windows\SysWOW64\Hgbfhc32.exe
        
        C:\Windows\system32\Hgbfhc32.exe
        14⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\Hnmnengg.exe
        
        C:\Windows\system32\Hnmnengg.exe
        15⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Hdffah32.exe
        
        C:\Windows\system32\Hdffah32.exe
        16⤵
        
        PID:5424
        
        C:\Windows\SysWOW64\Hdicggla.exe
        
        C:\Windows\system32\Hdicggla.exe
        17⤵
        
        PID:2132
        
        C:\Windows\SysWOW64\Ijhhenhf.exe
        
        C:\Windows\system32\Ijhhenhf.exe
        18⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Inhmqlmj.exe
        
        C:\Windows\system32\Inhmqlmj.exe
        19⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\Iaifbg32.exe
        
        C:\Windows\system32\Iaifbg32.exe
        20⤵
        
        PID:808
        
        C:\Windows\SysWOW64\Jjakkmpk.exe
        
        C:\Windows\system32\Jjakkmpk.exe
        21⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Jegohe32.exe
        
        C:\Windows\system32\Jegohe32.exe
        22⤵
        
        PID:752
        
        C:\Windows\SysWOW64\Jclljaei.exe
        
        C:\Windows\system32\Jclljaei.exe
        23⤵
        
        PID:2648

C:\Windows\SysWOW64\Jnapgjdo.exe
C:\Windows\system32\Jnapgjdo.exe
1⤵
PID:2644
- C:\Windows\SysWOW64\Jjhalkjc.exe
  C:\Windows\system32\Jjhalkjc.exe
  2⤵
  PID:2768
- - C:\Windows\SysWOW64\Jcaeea32.exe
    C:\Windows\system32\Jcaeea32.exe
    3⤵
    - Modifies registry class
    PID:5404
  - - C:\Windows\SysWOW64\Jmijnfgd.exe
      C:\Windows\system32\Jmijnfgd.exe
      4⤵
      PID:888
    - - C:\Windows\SysWOW64\Khonkogj.exe
        
        C:\Windows\system32\Khonkogj.exe
        5⤵
        
        PID:6108
      - C:\Windows\SysWOW64\Kfdklllb.exe
        
        C:\Windows\system32\Kfdklllb.exe
        6⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\Kffhakjp.exe
        
        C:\Windows\system32\Kffhakjp.exe
        7⤵
        
        PID:3088
        
        C:\Windows\SysWOW64\Knpmhh32.exe
        
        C:\Windows\system32\Knpmhh32.exe
        8⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\Ldoafodd.exe
        
        C:\Windows\system32\Ldoafodd.exe
        9⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Lacbpccn.exe
        
        C:\Windows\system32\Lacbpccn.exe
        10⤵
        
        PID:5556
        
        C:\Windows\SysWOW64\Lmjcdd32.exe
        
        C:\Windows\system32\Lmjcdd32.exe
        11⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Lhogamih.exe
        
        C:\Windows\system32\Lhogamih.exe
        12⤵
        Drops file in System32 directory
        
        PID:6224
        
        C:\Windows\SysWOW64\Lmlpjdgo.exe
        
        C:\Windows\system32\Lmlpjdgo.exe
        13⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Ldhdlnli.exe
        
        C:\Windows\system32\Ldhdlnli.exe
        14⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Mkdiog32.exe
        
        C:\Windows\system32\Mkdiog32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7264
        
        C:\Windows\SysWOW64\Maoakaip.exe
        
        C:\Windows\system32\Maoakaip.exe
        16⤵
        Modifies registry class
        
        PID:7480
        
        C:\Windows\SysWOW64\Mhhjhlqm.exe
        
        C:\Windows\system32\Mhhjhlqm.exe
        17⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Mkgfdgpq.exe
        
        C:\Windows\system32\Mkgfdgpq.exe
        18⤵
        
        PID:5684
        
        C:\Windows\SysWOW64\Mdokmm32.exe
        
        C:\Windows\system32\Mdokmm32.exe
        19⤵
        
        PID:1376
        
        C:\Windows\SysWOW64\Moeoje32.exe
        
        C:\Windows\system32\Moeoje32.exe
        20⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Mdagbl32.exe
        
        C:\Windows\system32\Mdagbl32.exe
        21⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Meadlo32.exe
        
        C:\Windows\system32\Meadlo32.exe
        22⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Nkpijfgf.exe
        
        C:\Windows\system32\Nkpijfgf.exe
        23⤵
        
        PID:7840
        
        C:\Windows\SysWOW64\Nggjog32.exe
        
        C:\Windows\system32\Nggjog32.exe
        24⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Nnabladg.exe
        
        C:\Windows\system32\Nnabladg.exe
        25⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\Naokbokn.exe
        
        C:\Windows\system32\Naokbokn.exe
        26⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\Nhicoi32.exe
        
        C:\Windows\system32\Nhicoi32.exe
        27⤵
        
        PID:856
        
        C:\Windows\SysWOW64\Ndpcdjho.exe
        
        C:\Windows\system32\Ndpcdjho.exe
        28⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Oeopnmoa.exe
        
        C:\Windows\system32\Oeopnmoa.exe
        29⤵
        
        PID:5840
        
        C:\Windows\SysWOW64\Oklifdmi.exe
        
        C:\Windows\system32\Oklifdmi.exe
        30⤵
        
        PID:7996
        
        C:\Windows\SysWOW64\Oediim32.exe
        
        C:\Windows\system32\Oediim32.exe
        31⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Ohdbkh32.exe
        
        C:\Windows\system32\Ohdbkh32.exe
        32⤵
        
        PID:924

C:\Windows\SysWOW64\Odkcpi32.exe
C:\Windows\system32\Odkcpi32.exe
1⤵
PID:6992
- C:\Windows\SysWOW64\Pfkpiled.exe
  C:\Windows\system32\Pfkpiled.exe
  2⤵
  PID:8096
- - C:\Windows\SysWOW64\Pfmlok32.exe
    C:\Windows\system32\Pfmlok32.exe
    3⤵
    PID:6424
  - - C:\Windows\SysWOW64\Pnhacn32.exe
      C:\Windows\system32\Pnhacn32.exe
      4⤵
      PID:5876
    - - C:\Windows\SysWOW64\Pbifol32.exe
        
        C:\Windows\system32\Pbifol32.exe
        5⤵
        
        PID:7540
      - C:\Windows\SysWOW64\Pgeogb32.exe
        
        C:\Windows\system32\Pgeogb32.exe
        6⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Qnpgdmjd.exe
        
        C:\Windows\system32\Qnpgdmjd.exe
        7⤵
        
        PID:7832
        
        C:\Windows\SysWOW64\Qghlmbae.exe
        
        C:\Windows\system32\Qghlmbae.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6416
        
        C:\Windows\SysWOW64\Qbmpjkqk.exe
        
        C:\Windows\system32\Qbmpjkqk.exe
        9⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Akfdcq32.exe
        
        C:\Windows\system32\Akfdcq32.exe
        10⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Anijjkbj.exe
        
        C:\Windows\system32\Anijjkbj.exe
        11⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Akmjdpac.exe
        
        C:\Windows\system32\Akmjdpac.exe
        12⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Bbpeghpe.exe
        
        C:\Windows\system32\Bbpeghpe.exe
        13⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8164
        
        C:\Windows\SysWOW64\Bpdfpmoo.exe
        
        C:\Windows\system32\Bpdfpmoo.exe
        14⤵
        Drops file in System32 directory
        
        PID:7740
        
        C:\Windows\SysWOW64\Bgokdomj.exe
        
        C:\Windows\system32\Bgokdomj.exe
        15⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Bbeobhlp.exe
        
        C:\Windows\system32\Bbeobhlp.exe
        16⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Ciogobcm.exe
        
        C:\Windows\system32\Ciogobcm.exe
        17⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Cifmoa32.exe
        
        C:\Windows\system32\Cifmoa32.exe
        18⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Cfjnhe32.exe
        
        C:\Windows\system32\Cfjnhe32.exe
        19⤵
        
        PID:7528
        
        C:\Windows\SysWOW64\Clffalkf.exe
        
        C:\Windows\system32\Clffalkf.exe
        20⤵
        Modifies registry class
        
        PID:5296
        
        C:\Windows\SysWOW64\Dlicflic.exe
        
        C:\Windows\system32\Dlicflic.exe
        21⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6092
        
        C:\Windows\SysWOW64\Dimcppgm.exe
        
        C:\Windows\system32\Dimcppgm.exe
        22⤵
        
        PID:3160

C:\Windows\SysWOW64\Fbjjkble.exe
C:\Windows\system32\Fbjjkble.exe
1⤵
PID:8564
- C:\Windows\SysWOW64\Fpnkdfko.exe
  C:\Windows\system32\Fpnkdfko.exe
  2⤵
  PID:8600
- - C:\Windows\SysWOW64\Fpqgjf32.exe
    C:\Windows\system32\Fpqgjf32.exe
    3⤵
    PID:8712

C:\Windows\SysWOW64\Fcaqka32.exe
C:\Windows\system32\Fcaqka32.exe
1⤵
PID:6976
- C:\Windows\SysWOW64\Gohapb32.exe
  C:\Windows\system32\Gohapb32.exe
  2⤵
  PID:8464
- - C:\Windows\SysWOW64\Gojnfb32.exe
    C:\Windows\system32\Gojnfb32.exe
    3⤵
    PID:8596
  - - C:\Windows\SysWOW64\Ghcbohpp.exe
      C:\Windows\system32\Ghcbohpp.exe
      4⤵
      PID:8752
    - - C:\Windows\SysWOW64\Googaaej.exe
        
        C:\Windows\system32\Googaaej.exe
        5⤵
        
        PID:8976
      - C:\Windows\SysWOW64\Hgmebnpd.exe
        
        C:\Windows\system32\Hgmebnpd.exe
        6⤵
        
        PID:9164

C:\Windows\SysWOW64\Iobmmoed.exe
C:\Windows\system32\Iobmmoed.exe
1⤵
PID:8572

C:\Windows\SysWOW64\Hladlc32.exe
C:\Windows\system32\Hladlc32.exe
1⤵
- Modifies registry class
PID:8380

C:\Windows\SysWOW64\Lfodmdni.exe
C:\Windows\system32\Lfodmdni.exe
1⤵
PID:8608
- C:\Windows\SysWOW64\Mfmpob32.exe
  C:\Windows\system32\Mfmpob32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:5408
- - C:\Windows\SysWOW64\Nmnnlk32.exe
    C:\Windows\system32\Nmnnlk32.exe
    3⤵
    PID:9276
  - - C:\Windows\SysWOW64\Nhcbidcd.exe
      C:\Windows\system32\Nhcbidcd.exe
      4⤵
      PID:7660
    - - C:\Windows\SysWOW64\Nieoal32.exe
        
        C:\Windows\system32\Nieoal32.exe
        5⤵
        
        PID:8928
      - C:\Windows\SysWOW64\Npognfpo.exe
        
        C:\Windows\system32\Npognfpo.exe
        6⤵
        
        PID:9456
        
        C:\Windows\SysWOW64\Nkdlkope.exe
        
        C:\Windows\system32\Nkdlkope.exe
        7⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Nhhldc32.exe
        
        C:\Windows\system32\Nhhldc32.exe
        8⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Ohkijc32.exe
        
        C:\Windows\system32\Ohkijc32.exe
        9⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Okiefn32.exe
        
        C:\Windows\system32\Okiefn32.exe
        10⤵
        
        PID:3612
        
        C:\Windows\SysWOW64\Oacmchcl.exe
        
        C:\Windows\system32\Oacmchcl.exe
        11⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Oinbgk32.exe
        
        C:\Windows\system32\Oinbgk32.exe
        12⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Ohobebig.exe
        
        C:\Windows\system32\Ohobebig.exe
        13⤵
        Modifies registry class
        
        PID:9416
        
        C:\Windows\SysWOW64\Odfcjc32.exe
        
        C:\Windows\system32\Odfcjc32.exe
        14⤵
        
        PID:9440
        
        C:\Windows\SysWOW64\Onngci32.exe
        
        C:\Windows\system32\Onngci32.exe
        15⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Ohdlpa32.exe
        
        C:\Windows\system32\Ohdlpa32.exe
        16⤵
        
        PID:10192
        
        C:\Windows\SysWOW64\Oiehhjjp.exe
        
        C:\Windows\system32\Oiehhjjp.exe
        17⤵
        
        PID:10200
        
        C:\Windows\SysWOW64\Pgihanii.exe
        
        C:\Windows\system32\Pgihanii.exe
        18⤵
        
        PID:9252
        
        C:\Windows\SysWOW64\Pdmikb32.exe
        
        C:\Windows\system32\Pdmikb32.exe
        19⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Pjjaci32.exe
        
        C:\Windows\system32\Pjjaci32.exe
        20⤵
        Modifies registry class
        
        PID:8264
        
        C:\Windows\SysWOW64\Phkaqqoi.exe
        
        C:\Windows\system32\Phkaqqoi.exe
        21⤵
        
        PID:9668

C:\Windows\SysWOW64\Pjlnhi32.exe
C:\Windows\system32\Pjlnhi32.exe
1⤵
PID:9972
- C:\Windows\SysWOW64\Phmnfp32.exe
  C:\Windows\system32\Phmnfp32.exe
  2⤵
  PID:6828
- - C:\Windows\SysWOW64\Pnjgog32.exe
    C:\Windows\system32\Pnjgog32.exe
    3⤵
    PID:6972
  - - C:\Windows\SysWOW64\Pphckb32.exe
      C:\Windows\system32\Pphckb32.exe
      4⤵
      PID:7564
    - - C:\Windows\SysWOW64\Qhbhapha.exe
        
        C:\Windows\system32\Qhbhapha.exe
        5⤵
        
        PID:10184
      - C:\Windows\SysWOW64\Qjcdih32.exe
        
        C:\Windows\system32\Qjcdih32.exe
        6⤵
        
        PID:10140
        
        C:\Windows\SysWOW64\Qhddgofo.exe
        
        C:\Windows\system32\Qhddgofo.exe
        7⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Adkelplc.exe
        
        C:\Windows\system32\Adkelplc.exe
        8⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Ajhndgjj.exe
        
        C:\Windows\system32\Ajhndgjj.exe
        9⤵
        
        PID:9476
        
        C:\Windows\SysWOW64\Ababkdij.exe
        
        C:\Windows\system32\Ababkdij.exe
        10⤵
        
        PID:8612
        
        C:\Windows\SysWOW64\Ahkkhnpg.exe
        
        C:\Windows\system32\Ahkkhnpg.exe
        11⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:9692
        
        C:\Windows\SysWOW64\Ajmgof32.exe
        
        C:\Windows\system32\Ajmgof32.exe
        12⤵
        Modifies registry class
        
        PID:10104
        
        C:\Windows\SysWOW64\Ahngmnnd.exe
        
        C:\Windows\system32\Ahngmnnd.exe
        13⤵
        
        PID:10040
        
        C:\Windows\SysWOW64\Ahpdcn32.exe
        
        C:\Windows\system32\Ahpdcn32.exe
        14⤵
        Drops file in System32 directory
        
        PID:5640
        
        C:\Windows\SysWOW64\Ajaqjfbp.exe
        
        C:\Windows\system32\Ajaqjfbp.exe
        15⤵
        
        PID:10216
        
        C:\Windows\SysWOW64\Bdgehobe.exe
        
        C:\Windows\system32\Bdgehobe.exe
        16⤵
        Drops file in System32 directory
        
        PID:7488
        
        C:\Windows\SysWOW64\Bkamdi32.exe
        
        C:\Windows\system32\Bkamdi32.exe
        17⤵
        
        PID:9672
        
        C:\Windows\SysWOW64\Bbkeacqo.exe
        
        C:\Windows\system32\Bbkeacqo.exe
        18⤵
        
        PID:9912
        
        C:\Windows\SysWOW64\Bbmbgb32.exe
        
        C:\Windows\system32\Bbmbgb32.exe
        19⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Bqbohocd.exe
        
        C:\Windows\system32\Bqbohocd.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6816
        
        C:\Windows\SysWOW64\Bnfoac32.exe
        
        C:\Windows\system32\Bnfoac32.exe
        21⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Bdphnmjk.exe
        
        C:\Windows\system32\Bdphnmjk.exe
        22⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Cqghcn32.exe
        
        C:\Windows\system32\Cqghcn32.exe
        23⤵
        
        PID:10208
        
        C:\Windows\SysWOW64\Cbiabq32.exe
        
        C:\Windows\system32\Cbiabq32.exe
        24⤵
        
        PID:9992
        
        C:\Windows\SysWOW64\Cbknhqbl.exe
        
        C:\Windows\system32\Cbknhqbl.exe
        25⤵
        
        PID:8748
        
        C:\Windows\SysWOW64\Dendok32.exe
        
        C:\Windows\system32\Dendok32.exe
        26⤵
        
        PID:10748
        
        C:\Windows\SysWOW64\Dnghhqdk.exe
        
        C:\Windows\system32\Dnghhqdk.exe
        27⤵
        
        PID:9568

C:\Windows\SysWOW64\Dgomaf32.exe
C:\Windows\system32\Dgomaf32.exe
1⤵
PID:5572
- C:\Windows\SysWOW64\Dbdano32.exe
  C:\Windows\system32\Dbdano32.exe
  2⤵
  PID:6040
- - C:\Windows\SysWOW64\Dioiki32.exe
    C:\Windows\system32\Dioiki32.exe
    3⤵
    PID:9284
  - - C:\Windows\SysWOW64\Dhfcae32.exe
      C:\Windows\system32\Dhfcae32.exe
      4⤵
      PID:7936
    - - C:\Windows\SysWOW64\Eblgon32.exe
        
        C:\Windows\system32\Eblgon32.exe
        5⤵
        
        PID:11180
      - C:\Windows\SysWOW64\Ehhpge32.exe
        
        C:\Windows\system32\Ehhpge32.exe
        6⤵
        
        PID:11248
        
        C:\Windows\SysWOW64\Eaqdpjia.exe
        
        C:\Windows\system32\Eaqdpjia.exe
        7⤵
        
        PID:10624
        
        C:\Windows\SysWOW64\Eacaej32.exe
        
        C:\Windows\system32\Eacaej32.exe
        8⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Ebbmpmnb.exe
        
        C:\Windows\system32\Ebbmpmnb.exe
        9⤵
        
        PID:9112
        
        C:\Windows\SysWOW64\Ehofhdli.exe
        
        C:\Windows\system32\Ehofhdli.exe
        10⤵
        
        PID:10708
        
        C:\Windows\SysWOW64\Ebejem32.exe
        
        C:\Windows\system32\Ebejem32.exe
        11⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Flmonbbp.exe
        
        C:\Windows\system32\Flmonbbp.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8300

C:\Windows\SysWOW64\Fhdocc32.exe
C:\Windows\system32\Fhdocc32.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies registry class
PID:10268
- C:\Windows\SysWOW64\Ficlmf32.exe
  C:\Windows\system32\Ficlmf32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  PID:3880
- - C:\Windows\SysWOW64\Fkgejncb.exe
    C:\Windows\system32\Fkgejncb.exe
    3⤵
    PID:11148
  - - C:\Windows\SysWOW64\Foenplji.exe
      C:\Windows\system32\Foenplji.exe
      4⤵
      PID:10256
    - - C:\Windows\SysWOW64\Gknkkmmj.exe
        
        C:\Windows\system32\Gknkkmmj.exe
        5⤵
        Modifies registry class
        
        PID:6928
      - C:\Windows\SysWOW64\Goamlkpk.exe
        
        C:\Windows\system32\Goamlkpk.exe
        6⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Gekeie32.exe
        
        C:\Windows\system32\Gekeie32.exe
        7⤵
        
        PID:10740
        
        C:\Windows\SysWOW64\Hleneo32.exe
        
        C:\Windows\system32\Hleneo32.exe
        8⤵
        
        PID:10768
        
        C:\Windows\SysWOW64\Haafnf32.exe
        
        C:\Windows\system32\Haafnf32.exe
        9⤵
        
        PID:11056
        
        C:\Windows\SysWOW64\Hhlnjpdi.exe
        
        C:\Windows\system32\Hhlnjpdi.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8152
        
        C:\Windows\SysWOW64\Hoefgj32.exe
        
        C:\Windows\system32\Hoefgj32.exe
        11⤵
        
        PID:10884
        
        C:\Windows\SysWOW64\Hligqnjp.exe
        
        C:\Windows\system32\Hligqnjp.exe
        12⤵
        
        PID:10480
        
        C:\Windows\SysWOW64\Hccomh32.exe
        
        C:\Windows\system32\Hccomh32.exe
        13⤵
        
        PID:11392
        
        C:\Windows\SysWOW64\Himgjbii.exe
        
        C:\Windows\system32\Himgjbii.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:11476
        
        C:\Windows\SysWOW64\Hkaqgjme.exe
        
        C:\Windows\system32\Hkaqgjme.exe
        15⤵
        
        PID:11532
        
        C:\Windows\SysWOW64\Hakidd32.exe
        
        C:\Windows\system32\Hakidd32.exe
        16⤵
        
        PID:7652

C:\Windows\SysWOW64\Ikcmmjkb.exe
C:\Windows\system32\Ikcmmjkb.exe
1⤵
PID:11688
- C:\Windows\SysWOW64\Ikejbjip.exe
  C:\Windows\system32\Ikejbjip.exe
  2⤵
  PID:4688
- - C:\Windows\SysWOW64\Ijgjpaao.exe
    C:\Windows\system32\Ijgjpaao.exe
    3⤵
    - Drops file in System32 directory
    PID:10596
  - - C:\Windows\SysWOW64\Ijigfaol.exe
      C:\Windows\system32\Ijigfaol.exe
      4⤵
      PID:11848
    - - C:\Windows\SysWOW64\Ikjcmi32.exe
        
        C:\Windows\system32\Ikjcmi32.exe
        5⤵
        Modifies registry class
        
        PID:7756
      - C:\Windows\SysWOW64\Iadljc32.exe
        
        C:\Windows\system32\Iadljc32.exe
        6⤵
        
        PID:12012
        
        C:\Windows\SysWOW64\Ikmpcicg.exe
        
        C:\Windows\system32\Ikmpcicg.exe
        7⤵
        
        PID:7868
        
        C:\Windows\SysWOW64\Jhqqlmba.exe
        
        C:\Windows\system32\Jhqqlmba.exe
        8⤵
        Drops file in System32 directory
        
        PID:11456
        
        C:\Windows\SysWOW64\Jjpmfpid.exe
        
        C:\Windows\system32\Jjpmfpid.exe
        9⤵
        
        PID:11328
        
        C:\Windows\SysWOW64\Jloibkhh.exe
        
        C:\Windows\system32\Jloibkhh.exe
        10⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Jchaoe32.exe
        
        C:\Windows\system32\Jchaoe32.exe
        11⤵
        Drops file in System32 directory
        
        PID:11676
        
        C:\Windows\SysWOW64\Jjbjlpga.exe
        
        C:\Windows\system32\Jjbjlpga.exe
        12⤵
        
        PID:11908
        
        C:\Windows\SysWOW64\Joobdfei.exe
        
        C:\Windows\system32\Joobdfei.exe
        13⤵
        
        PID:8168
        
        C:\Windows\SysWOW64\Jhhgmlli.exe
        
        C:\Windows\system32\Jhhgmlli.exe
        14⤵
        
        PID:12044
        
        C:\Windows\SysWOW64\Joaojf32.exe
        
        C:\Windows\system32\Joaojf32.exe
        15⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\Jmepcj32.exe
        
        C:\Windows\system32\Jmepcj32.exe
        16⤵
        
        PID:11304
        
        C:\Windows\SysWOW64\Kjipmoai.exe
        
        C:\Windows\system32\Kjipmoai.exe
        17⤵
        
        PID:9228
        
        C:\Windows\SysWOW64\Kiomnk32.exe
        
        C:\Windows\system32\Kiomnk32.exe
        18⤵
        
        PID:12120
        
        C:\Windows\SysWOW64\Kcfnqccd.exe
        
        C:\Windows\system32\Kcfnqccd.exe
        19⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Lkflpe32.exe
        
        C:\Windows\system32\Lkflpe32.exe
        20⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\Lfnmcnjn.exe
        
        C:\Windows\system32\Lfnmcnjn.exe
        21⤵
        
        PID:9592
        
        C:\Windows\SysWOW64\Lpgalc32.exe
        
        C:\Windows\system32\Lpgalc32.exe
        22⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Liabjh32.exe
        
        C:\Windows\system32\Liabjh32.exe
        23⤵
        Drops file in System32 directory
        
        PID:9300
        
        C:\Windows\SysWOW64\Mfeccm32.exe
        
        C:\Windows\system32\Mfeccm32.exe
        24⤵
        
        PID:7816
        
        C:\Windows\SysWOW64\Mbldhn32.exe
        
        C:\Windows\system32\Mbldhn32.exe
        25⤵
        
        PID:9948
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9948 -s 400
        26⤵
        Program crash
        
        PID:10156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 9948 -ip 9948
1⤵
PID:7056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aanbhp32.exe

Filesize
59KB

MD5
0de42e35e1f7803a23ab4eae10ef1837

SHA1
655be347ca9371d2e36c06f126833b4179823b3f

SHA256
e9ac1ad309c13fb2c6377b8504db174fc769392300c48ac630d4c7e395267a38

SHA512
173b4f4b44c3243d5e2c3426291293c8826ef285f27853c6e6c6af2c771215d256012774376d56e68de922a4070306860829fc36138e21304845663b2cc8999a

Download Submit
C:\Windows\SysWOW64\Aanbhp32.exe

Filesize
59KB

MD5
0de42e35e1f7803a23ab4eae10ef1837

SHA1
655be347ca9371d2e36c06f126833b4179823b3f

SHA256
e9ac1ad309c13fb2c6377b8504db174fc769392300c48ac630d4c7e395267a38

SHA512
173b4f4b44c3243d5e2c3426291293c8826ef285f27853c6e6c6af2c771215d256012774376d56e68de922a4070306860829fc36138e21304845663b2cc8999a

Download Submit
C:\Windows\SysWOW64\Afkknogn.exe

Filesize
59KB

MD5
a1dbf4bbc0ddd45c44bfcbd4937e0fa1

SHA1
653594727774c2b3059eb47427b80dfcfd63fc0f

SHA256
aa7c78d357970e3cbeb61f0a974a6d2f102c843871e85e9d7f9d83abed0ba1c2

SHA512
a11e97ff56b86675109582bb95ee2dfa21f2d7acf9817fbf060159817075e8816992c6360374d3702c9cba29dcd46d8570ddcd0a9378493ca942a7cd67af2201

Download Submit
C:\Windows\SysWOW64\Afkknogn.exe

Filesize
59KB

MD5
a1dbf4bbc0ddd45c44bfcbd4937e0fa1

SHA1
653594727774c2b3059eb47427b80dfcfd63fc0f

SHA256
aa7c78d357970e3cbeb61f0a974a6d2f102c843871e85e9d7f9d83abed0ba1c2

SHA512
a11e97ff56b86675109582bb95ee2dfa21f2d7acf9817fbf060159817075e8816992c6360374d3702c9cba29dcd46d8570ddcd0a9378493ca942a7cd67af2201

Download Submit
C:\Windows\SysWOW64\Ahenokjf.exe

Filesize
59KB

MD5
32a16a294e8ddccf407a368c59b69e8f

SHA1
f0b503b8d2fdae37c9e38503c23305c430119f80

SHA256
7d6cb61b45afd00c1210076889229c6f9b328c4eeef9f571a23894d5cc719004

SHA512
db75c85fe45fa427041590574d209932da30a97cbd3fec51b40f4f6b80ac33da4b5706897f5db593d1c5d4589bea4ebfbcee7a18c4f0346926c5c645d9f71e03

Download Submit
C:\Windows\SysWOW64\Ahenokjf.exe

Filesize
59KB

MD5
32a16a294e8ddccf407a368c59b69e8f

SHA1
f0b503b8d2fdae37c9e38503c23305c430119f80

SHA256
7d6cb61b45afd00c1210076889229c6f9b328c4eeef9f571a23894d5cc719004

SHA512
db75c85fe45fa427041590574d209932da30a97cbd3fec51b40f4f6b80ac33da4b5706897f5db593d1c5d4589bea4ebfbcee7a18c4f0346926c5c645d9f71e03

Download Submit
C:\Windows\SysWOW64\Ahgjejhd.exe

Filesize
59KB

MD5
901e6734de96603339a19baf84ac7eef

SHA1
da87cf2964de5155d687d78d11cdbeb23a278652

SHA256
38df2acdea33ed9ab9ea80ef107bd6ef8d754bd82e3f9bee5f954b115897364f

SHA512
706398cb0851a93835aa89117cde5c0c9a917ca10769d849d4a4802752f5880e331d2ecb84fed7cb8251e7e10df049a4231fc8c661331303a7f33516f53b6c3f

Download Submit
C:\Windows\SysWOW64\Ahgjejhd.exe

Filesize
59KB

MD5
901e6734de96603339a19baf84ac7eef

SHA1
da87cf2964de5155d687d78d11cdbeb23a278652

SHA256
38df2acdea33ed9ab9ea80ef107bd6ef8d754bd82e3f9bee5f954b115897364f

SHA512
706398cb0851a93835aa89117cde5c0c9a917ca10769d849d4a4802752f5880e331d2ecb84fed7cb8251e7e10df049a4231fc8c661331303a7f33516f53b6c3f

Download Submit
C:\Windows\SysWOW64\Akoqpg32.exe

Filesize
59KB

MD5
18b568c57deaec9615c8fb76c9513421

SHA1
2bff69d442ec1da44bb9c822e59a4962aa7a2d08

SHA256
6360e142a067ded33a310ec2cc681d475d33f15c68bbd5aa459935205462b21b

SHA512
16cd08965f3132d39814fb3dff7274a760f1420f3a78e0f341a030afd4c6848e8a95cc60cf90639fc75080cd1ef8fa8908bff13939e35c3c337676e456e2dab3

Download Submit
C:\Windows\SysWOW64\Akoqpg32.exe

Filesize
59KB

MD5
18b568c57deaec9615c8fb76c9513421

SHA1
2bff69d442ec1da44bb9c822e59a4962aa7a2d08

SHA256
6360e142a067ded33a310ec2cc681d475d33f15c68bbd5aa459935205462b21b

SHA512
16cd08965f3132d39814fb3dff7274a760f1420f3a78e0f341a030afd4c6848e8a95cc60cf90639fc75080cd1ef8fa8908bff13939e35c3c337676e456e2dab3

Download Submit
C:\Windows\SysWOW64\Alnmjjdb.exe

Filesize
59KB

MD5
b17606b8bd213fdf2944e65468f19882

SHA1
69cfc0a4e94ae0cf7df7267de493db20ee74a1b7

SHA256
8d841881836af736bd8d58547c85f7968748809d65e3fded57f9d00c37631b12

SHA512
25e46c14d94547f46ff264407ad031adad4f685bdb68212fac95cd5e7de644c6fee19363523a55f44da19fdfa261984ac36dbf83ad5ba7e04dbe0c01ba2a17e1

Download Submit
C:\Windows\SysWOW64\Alnmjjdb.exe

Filesize
59KB

MD5
b17606b8bd213fdf2944e65468f19882

SHA1
69cfc0a4e94ae0cf7df7267de493db20ee74a1b7

SHA256
8d841881836af736bd8d58547c85f7968748809d65e3fded57f9d00c37631b12

SHA512
25e46c14d94547f46ff264407ad031adad4f685bdb68212fac95cd5e7de644c6fee19363523a55f44da19fdfa261984ac36dbf83ad5ba7e04dbe0c01ba2a17e1

Download Submit
C:\Windows\SysWOW64\Bfngdn32.exe

Filesize
59KB

MD5
9717fc34ac7b4bc18731838098ced1c6

SHA1
79ef591d6bda9045d849e59692d37a5bd193767b

SHA256
667caf9416cc69a2865baee615b6e142948a683e99e20d6f348f347d7d526f06

SHA512
f6b710259481235766a87811c02ab8d085aab7b846e7ca21a8b871ae26a04be2f1b31c9c4a8ca3de32cfe14571a559a80d0d1a7931d617200e8b99e59309f46d

Download Submit
C:\Windows\SysWOW64\Bfngdn32.exe

Filesize
59KB

MD5
9717fc34ac7b4bc18731838098ced1c6

SHA1
79ef591d6bda9045d849e59692d37a5bd193767b

SHA256
667caf9416cc69a2865baee615b6e142948a683e99e20d6f348f347d7d526f06

SHA512
f6b710259481235766a87811c02ab8d085aab7b846e7ca21a8b871ae26a04be2f1b31c9c4a8ca3de32cfe14571a559a80d0d1a7931d617200e8b99e59309f46d

Download Submit
C:\Windows\SysWOW64\Cmcolgbj.exe

Filesize
59KB

MD5
3952becfb39fd641daba6c39b07a62ce

SHA1
8ae33639a3bae4606df4d2a04e1daa64fee0db89

SHA256
00ed198bd2a73e321f7b9a3b29590ad11f4e1349521aa1a27142c43baaf76aac

SHA512
d0240d581826d15570d1a63d3eeb2bc741517b07915dc689dc0d1ddc549ceb58b0db1ba101cb19fa7bd44e6298db327dc89cec187dea55968dcd048a9e8d72fc

Download Submit
C:\Windows\SysWOW64\Cncnob32.exe

Filesize
59KB

MD5
024cebe776aa79ffdbfd279662076445

SHA1
5a70a4950ed95d2994a0763b1cbc9e5f2d6bc2ae

SHA256
703709d27addebd1f34faceda5418177109594beecbc4c503ac40faf5731c156

SHA512
22469659b8d0afb4641ec72431378116062ed78ef90a8f8454c0a1113781b5fc42ee7f64adb3f59de817f7a22fb4532827aa9418e6f50c4e5e97aab632e21abb

Download Submit
C:\Windows\SysWOW64\Dfiildio.exe

Filesize
59KB

MD5
f6b25705ab68f21a552bd2e869107f9e

SHA1
f0fbd2791759916239181ea2e7a0e7dcb6af5f1a

SHA256
8780ef13953198ab0bf26ea5a5f1e9cfa6626138a2da52f4cf6da2d81730e8ef

SHA512
978cfa19cf38602e855898249283007653c7243d1c28ca16c0c800e6ce071f9ee964965fbc87e6c901f0b8bbc82e82203c6237e2699c20c92a5e1b3d16e7b0f8

Download Submit
C:\Windows\SysWOW64\Dmalne32.exe

Filesize
59KB

MD5
2447c40d85a8037b6532319ef98a944d

SHA1
3fbc35e2e65cf81edaf207d130329cb08c39f53a

SHA256
6cfdec72d3592dbc155d8326bcf08fe8e6b4edfe84fa2cf2e32ac0a4502bb72f

SHA512
2483abef6a33cf28fc772cadf539186dc5331775b76dea322122f3f18460afe09a73f8f76b39897799f571ef1ff6632ae4e5488ddaff9d28efd9cabf5d55ae0e

Download Submit
C:\Windows\SysWOW64\Dmfeidbe.exe

Filesize
59KB

MD5
6876f994800635f990487028c36b01ce

SHA1
03512a4502f25bcd233a021cf022ef2b14dc5057

SHA256
cff8b9968a48617310a505e2d05b5ed0965f5bb1b3dc6636fefa1c559f9574b3

SHA512
5565eebce6b6dfa2a3e12e610636571f82e7f6799b55315120268008499fdd2c241f861de10d2ea9780815434ea90866f902dabc577b24ac33e332c65246eda3

Download Submit
C:\Windows\SysWOW64\Doagjc32.exe

Filesize
59KB

MD5
b2ecd3312cd0182f0a7db81d1c530013

SHA1
57fd6fed50969d477c3576c13db48678e9ff0971

SHA256
ff93029c1072c2b395384e40ef6fcd2299dbd82c63bdbf457da8cc74cd5c8591

SHA512
ebc8cd2e45eb820093f655efd7a5c55b34dc9fa9f0e7f9670b932b6d99d4a5926fdf6c50b9e23a2ccdb3c91e14272ea3f3cfed9cd16b0dfcbf1ad658ae91d05c

Download Submit
C:\Windows\SysWOW64\Eifhdd32.exe

Filesize
59KB

MD5
9e8d455d1c7244186beff1b819ab934a

SHA1
bf8bd5b42dbd387bef559ea7f6eadad029460bf4

SHA256
a1357f09165601516037e27e2b4df6e07188bcacf702ebdd781435af1c8172bd

SHA512
4ac7c5b5fcdaab8f3a56ad7061e38257aea28d75f33061ff0085c84401654ad042557b77b044998873a2079548314482433c596c86805dd285c52ab673610bc9

Download Submit
C:\Windows\SysWOW64\Enbjad32.exe

Filesize
59KB

MD5
035b709dd3be86a9007f92c8c278a2bc

SHA1
c188a7f4aac1ad062807f027d99a1413fa79ac40

SHA256
26f76446c042ae28da872ddd6f6aff21589e64d439c4b165a17f192c43156e2f

SHA512
898bbe43ddbbaed75317da18ae16b3b2814859e305eeb2a566f680eab2b9cada27545c0fea78c195e61c6b5bdb8507060a11f9c071b4884909a8cc722a48ea7d

Download Submit
C:\Windows\SysWOW64\Enigke32.exe

Filesize
59KB

MD5
dd48af26acce4aed3630c5e22a6a3b21

SHA1
6874395a6dcc74fa7d002513cc637bfb2bd54479

SHA256
e3b310740dfdf73974e76699952113d9cbf1dabd9d70d1ad1141fa6f3c1e7a56

SHA512
ecc01c41f6a85c01f3c31941cffad62a8a3b9c8ac80af4575f5b0857a2bd0b5f93e30495de32e43394b4ef1a26e1e65be98305e1e117eeb5e97315b0cf175d85

Download Submit
C:\Windows\SysWOW64\Eplgeokq.exe

Filesize
59KB

MD5
0790e1489591595e627c977daa119ddc

SHA1
7b6193c26bb87d91b574e865e67cab8cc8746d4c

SHA256
f442aafe0b6047d3d883bcaa42f8e26e5ee950f676d45de5631ad9b0d2e80b72

SHA512
9d80880c746dce41a67b5627fc18c7fd790a726b66604d7168af947d6d30c9d34d5eba2d36b3e621201534c2441bdc4ad8d3b5dd554adae7d815a7ba2099d327

Download Submit
C:\Windows\SysWOW64\Fdlkdhnk.exe

Filesize
59KB

MD5
9414d207c7639ca55f36274f09f72a7b

SHA1
5f0d82813951caacfec75698001890d03618c821

SHA256
2d192fc740353c2d1042c4c5a87f6ad337b8db9d9d6ae9c218c47c5b0239ad6d

SHA512
f305e9aed57477649559403bb2c64acfd064c27d241acf9d496f1e1deff295b40a8fa5832586a803159dc5c36aa1fc3cafc223f0efa94827758b94a75279f364

Download Submit
C:\Windows\SysWOW64\Fligqhga.exe

Filesize
59KB

MD5
39cc1814d6e497bb2237fe9c2d62a31d

SHA1
8128d20d249ce3a76bbdfaaed3130e42d3d77552

SHA256
ada5b00410f3e05527b4cc0017cb2336911ef829eafb0d46c26ba5a0e3796eee

SHA512
eec1597f7ca87442ebd3815d8e4272d4357617da5253eebeeb9e95b9f3b4d7786ba870ac220154183302965132f2c4685f6aa8016590b1d904edbd79b2bb535a

Download Submit
C:\Windows\SysWOW64\Fpkibf32.exe

Filesize
59KB

MD5
75d6337f76a02098b378dc4568927e12

SHA1
91b70b4636b23ad67cbe1c00a639878cb928f5f3

SHA256
0de08ecfd2123f02871d02c23d3860934a9bcd7337d7f6ff7913791d87f451d1

SHA512
ea0e89ab513edc7698a2a68a184d22f881ecf99d31c972578a53d3344000f7aeac8b14973389c2fb8353552bf7bcedd702e990f71f779f04447434e0d5a527f0

Download Submit
C:\Windows\SysWOW64\Gejopl32.exe

Filesize
59KB

MD5
0c02cdf79f19a912303381dff249d5f3

SHA1
e515783fa9a3f89ae0ff18c88edc12bd35e13b5c

SHA256
a19b3153850ccc57148e610deb4bee02ac86817c72e08f7ea49d89c706363885

SHA512
35bd47e460ce1678abc32492c473cc10903f144468bc1dd5f207b871ff7bbb10ef5c96bec1acb77ab249c07c232619a9df65dcf313fb2655c415d731c9692ccd

Download Submit
C:\Windows\SysWOW64\Gghdaa32.exe

Filesize
59KB

MD5
8079cf15c0ea842876bebd009b4455a4

SHA1
c98fad2a634660847630078bd72b795d7ec843fb

SHA256
b5b58d6c80aea382092d7fc9151fe6d9f429c9c28cd6cd386d07a92fe8ed5d0f

SHA512
ba78c422466f29ab7aef3cec1e617713bf15011769bb77da47c57ee6cb52373614cd8d96af1fb6842d9f45dda3c3d839e07729cbc9f6a6fadebc4dfe865d996b

Download Submit
C:\Windows\SysWOW64\Gngeik32.exe

Filesize
59KB

MD5
f294961e7fec367394b01b9b1c78f2dc

SHA1
f602ecca8d8a13cd4766d04df255c0fb5b2af1df

SHA256
5b8965f854cf78b5d3a697236dcde61d245d7c02e985c63141c7c324213f3f76

SHA512
0d37047c9b205416e2786902c6c34b09c2c073f37934dff227b6bff75044e3a4841d073b147007c193f8595b20cb1ab12b6f764762e577b8c91d2b2b9ddca863

Download Submit
C:\Windows\SysWOW64\Gojiiafp.exe

Filesize
59KB

MD5
422f2fcdfa2fc661e4c2990c03ae27f2

SHA1
e3b9c5463e9e1613b509a9160b0bfde37b452dac

SHA256
d1c4e013eb858a74b606670b92c09aa4bcdba5971763875e8ae8e90265f43fe8

SHA512
13727e900412244184c7b7950a5a248aacf1d3f48bcf49abb44cf6f36d7809afa74b7bf716d26c6c84d3da38dd1bba124be6807f46f2bd305a6b30b4cfaf491b

Download Submit
C:\Windows\SysWOW64\Haodle32.exe

Filesize
59KB

MD5
7a9c72842336cc6105e5644b75637c0e

SHA1
d25f13478d7c2579f0c31cb4fff244e495fe2ba7

SHA256
2f4a3406bc8ca6f4f73cdb3b81330b8a77853bcad7e476bc104ef29dd85abc39

SHA512
da23611afaa675f87ac9284ccd196ae337cf6a1386b581d520cfc50f3396c30c70825fddfa5593fffdba121744e0f7215959af4171790fe0f44e3e9c2c09c6f1

Download Submit
C:\Windows\SysWOW64\Hmlpaoaj.exe

Filesize
59KB

MD5
419434625df50505c185f4f7954bb85c

SHA1
8fe5b229299a21c1e2931e62c58a1c1f1c084f8e

SHA256
e7238f7810153230e70a3050171a82d538097ff2937b667cbb1ff9c3ecd993b0

SHA512
a077c67ff3b8c48650fa3288115d71dece3054a484422db2d151814e8eaa254dcc2185675571a834b78ed4a19bda3f582b2d6f4785ef2f86d481ab6f6d6bf026

Download Submit
C:\Windows\SysWOW64\Ibaeen32.exe

Filesize
59KB

MD5
bbfe5cb1bae5f0d7082c83202ea38945

SHA1
e087f725d397be324b353e32e4857c0083c711a9

SHA256
9dcaf3ee6c43e590784a89cd9e61fd5081baf4f7e8caf74069395dd4545e25f6

SHA512
c8f990a94af14f97caf4f58be6aa31e075aca9134cfcf7c43e042ac2bc526b8a64b469faea5910d4f092e1f450b69bb7c4e9d7427bd150c5fd8bf673a7e86fcf

Download Submit
C:\Windows\SysWOW64\Iebngial.exe

Filesize
59KB

MD5
3f1502d23123ae3cb4044af11fe04854

SHA1
57b9a1cd60b3a257fe4804a1b759e5eb0e1d161d

SHA256
6fba15308b89e47f509f594b12213ad36a9c4ca541fb233be7f5a73bb72561cc

SHA512
94e4a81944360d867cbbe13a14fff199dca72c718f20676bee6dd0e3ed6e4d4ecca556574a82254a9b2bd2a55c9cd0a2720b2bfb5200277b4f706b59411084f5

Download Submit
C:\Windows\SysWOW64\Ihkjno32.exe

Filesize
59KB

MD5
65be417ed423d2204b3b1c61dc0c1beb

SHA1
71122c7bbc6d08b801d96e0c126606cf8f00d50a

SHA256
03c52f1b81dc297965212e05ab832fef928317ff7d49529a4eb977a951a2e14c

SHA512
5b34c9850bba069ff9ddafb48829e8000450ed4a473e11e0b823fd52156c0a986489a5b6f3c3389a083de5126fcf8b64713e0bc62f88c7af416e263e844acd09

Download Submit
C:\Windows\SysWOW64\Jnlbojee.exe

Filesize
59KB

MD5
7ea23e5a650a2ccd85fe30bc0d44413c

SHA1
5141e63266f368b9be83cab8f6481f447cc75f94

SHA256
ff33b24a15c9d60f69210dd637392426e58d0f590ec5e761270df672d388ded4

SHA512
db2f627285a38c5b7aed8262fec3279a3f8ed97c2e022e428bbf682a71aef8749a70aa2372b17fcaf7e3a442b192c3c523abc5e1307b99e4726a5720c94970ee

Download Submit
C:\Windows\SysWOW64\Jocnlg32.exe

Filesize
59KB

MD5
dcbe5beed96288352b5b9d2ddc167415

SHA1
f4494a28db4db836677e2f7e1656704a0362dc20

SHA256
bd155522d77eb537c0f2f430e9d5f81a8327b8ba7be1c64eee5d723f8a660a09

SHA512
93071dcb7ce9ed5ce68fe833df69514c5fcd1eb8d6ad1ba1403f5a9e3e3eb98c75e9983e99a58c28df8c809ad06c37c2266b430fd33f349f289e41dd278d9190

Download Submit
C:\Windows\SysWOW64\Kdbjhbbd.exe

Filesize
59KB

MD5
74b048689131a59e0d8c4059520ecfdb

SHA1
0882b6475398676ecb528bc5d3cc77757235c9b4

SHA256
6298d322041c94a7c68ac313079b98e53e5799793d76a8766b6d7292961ee01b

SHA512
b8724af7c62048a06c6d52341846c40f6f9e0f21272f968e27f6ca09125d504e80f2c5d68c841c61cb603455d854149524d3ba8e6bb614d9d0ab0921871f96c0

Download Submit
C:\Windows\SysWOW64\Kdpmbc32.exe

Filesize
59KB

MD5
82f5d677923e114a318ac93aa3b45102

SHA1
4dba6ae4f9aac461ded2cbadebaaea8a513d2072

SHA256
b985906d5373545ad762c264f66b54c64943fa878e63dd9dcca445ccf506971a

SHA512
13df5dbc2b0b30c039695e89ea280e105b1e8c6e8a3c29a15e3e1c52236e0d9c72c4f8124f4edfab15b65589895f61932ee7d4eafabe2a465b35f5bbdced3cda

Download Submit
C:\Windows\SysWOW64\Kjjiej32.exe

Filesize
59KB

MD5
131d94d65f7475020add27011d6bc4c0

SHA1
7dd6556399b35975d7e92dff4d60c6f4352b62b1

SHA256
352a35b6c822a3bc226783d271ccacedd7cedb76f2be6b173cbc41696188619f

SHA512
e1dd9e8ab9b2b8ece0d827d85f26b1cfd8581e9826b0e4eb97157bf34be94b28d6e8cb4e09c818b4592ae420c968d17b399e2e274223b693f7bce6c4f653d07b

Download Submit
C:\Windows\SysWOW64\Laqhhi32.exe

Filesize
59KB

MD5
331604a77f7736708ac768425b26e6e3

SHA1
53c7b5d3719a5e3d722e3547ee865b00b7fe980c

SHA256
763e0c010edcf07abe8c5f215332f9d3c909402652bb1e0fb9c14e4ee66e0a5e

SHA512
11928c0005c6c0a9facf22c5559a3907ccce16d368319a77b7b4fc74fa2948f6a137549bcd9a32aa29b525918808ddc3aab8a0fbc451e6ebe56d40db533c18b8

Download Submit
C:\Windows\SysWOW64\Laqhhi32.exe

Filesize
59KB

MD5
331604a77f7736708ac768425b26e6e3

SHA1
53c7b5d3719a5e3d722e3547ee865b00b7fe980c

SHA256
763e0c010edcf07abe8c5f215332f9d3c909402652bb1e0fb9c14e4ee66e0a5e

SHA512
11928c0005c6c0a9facf22c5559a3907ccce16d368319a77b7b4fc74fa2948f6a137549bcd9a32aa29b525918808ddc3aab8a0fbc451e6ebe56d40db533c18b8

Download Submit
C:\Windows\SysWOW64\Lbpdblmo.exe

Filesize
59KB

MD5
d9410ca632d7cf5d4ec9a5df0cb6c5f5

SHA1
47e352014378b7046198c762d3c611a344ab6940

SHA256
cb289b33c92ca3a9d6128e0c679479ddae8641419daca76e23793a0febcd5fc9

SHA512
16efb24895cad477bbe5a218119a8e9804d70db56dd02bf035740a67bba4351d8d2fceb973ed9f418cefb32d9f01ad8cb3d93a2ff0f06276ca8b7734dcddef23

Download Submit
C:\Windows\SysWOW64\Lbpdblmo.exe

Filesize
59KB

MD5
d9410ca632d7cf5d4ec9a5df0cb6c5f5

SHA1
47e352014378b7046198c762d3c611a344ab6940

SHA256
cb289b33c92ca3a9d6128e0c679479ddae8641419daca76e23793a0febcd5fc9

SHA512
16efb24895cad477bbe5a218119a8e9804d70db56dd02bf035740a67bba4351d8d2fceb973ed9f418cefb32d9f01ad8cb3d93a2ff0f06276ca8b7734dcddef23

Download Submit
C:\Windows\SysWOW64\Ljkifn32.exe

Filesize
59KB

MD5
67d05851f9dc7375cce86da0251b9dc7

SHA1
e0be007a4d2e078f47d35c69c3ee5cfdf5457273

SHA256
be884993a502430cd34c40dd7496be81720cb8a4e7be8430824e6c5405a41046

SHA512
3915c9d0c13f248f13c9c01d3c1fd9fa4457f15ed3a53e633bbd00426204654d39559bdf7212e1b97849cbc3e901d17e4c89efe140fab78927ee2d19127105ec

Download Submit
C:\Windows\SysWOW64\Ljkifn32.exe

Filesize
59KB

MD5
67d05851f9dc7375cce86da0251b9dc7

SHA1
e0be007a4d2e078f47d35c69c3ee5cfdf5457273

SHA256
be884993a502430cd34c40dd7496be81720cb8a4e7be8430824e6c5405a41046

SHA512
3915c9d0c13f248f13c9c01d3c1fd9fa4457f15ed3a53e633bbd00426204654d39559bdf7212e1b97849cbc3e901d17e4c89efe140fab78927ee2d19127105ec

Download Submit
C:\Windows\SysWOW64\Mahnhhod.exe

Filesize
59KB

MD5
feeeb11c3fd92244c110a5998e7fcec5

SHA1
25bd01206b1045892fb043c1f9a9c79671ebb984

SHA256
95aac71c12a68b8e8e7860023761e5ca5ca4a3d6c2410404c7b3843723dec83e

SHA512
750281c6973516187662814ee875bc322a3f3ece52b0062f128d7454216396e361fb0bedfc42dbc44d7f53ca8d609fd752ab7e82e967fc07bcc6036683eb1397

Download Submit
C:\Windows\SysWOW64\Mahnhhod.exe

Filesize
59KB

MD5
feeeb11c3fd92244c110a5998e7fcec5

SHA1
25bd01206b1045892fb043c1f9a9c79671ebb984

SHA256
95aac71c12a68b8e8e7860023761e5ca5ca4a3d6c2410404c7b3843723dec83e

SHA512
750281c6973516187662814ee875bc322a3f3ece52b0062f128d7454216396e361fb0bedfc42dbc44d7f53ca8d609fd752ab7e82e967fc07bcc6036683eb1397

Download Submit
C:\Windows\SysWOW64\Meefofek.exe

Filesize
59KB

MD5
b2d6e4e6bd66cfc9104c6dd300f23d6b

SHA1
215275dcaedcab667bb81eb1ddf668fc833d4c20

SHA256
18d515246d8f84dabf38ec877675385963af151459940b5efa6ad09067c1d8ae

SHA512
65caaf52c86f0f25e3b1791a887296b28c806165c3463d143395972f8455d5a042bdfb2812445af92399beaaeece109a959814a16c7028bfac4a16353d77f4d3

Download Submit
C:\Windows\SysWOW64\Meefofek.exe

Filesize
59KB

MD5
b2d6e4e6bd66cfc9104c6dd300f23d6b

SHA1
215275dcaedcab667bb81eb1ddf668fc833d4c20

SHA256
18d515246d8f84dabf38ec877675385963af151459940b5efa6ad09067c1d8ae

SHA512
65caaf52c86f0f25e3b1791a887296b28c806165c3463d143395972f8455d5a042bdfb2812445af92399beaaeece109a959814a16c7028bfac4a16353d77f4d3

Download Submit
C:\Windows\SysWOW64\Mhoipb32.exe

Filesize
59KB

MD5
cf484b59c72ddf3d90d3747d2559fbdf

SHA1
c69e80d01b161f28e0dffab27a8a3d1d2d8c58ec

SHA256
473484d64ae432ac9c3c4e49c81862bd2b8952837a9da312a732934047ccea4f

SHA512
d1003b0b023bd4de6c92dc7e36ebc63e97f638630f91a14b187e5e53932b2318051626017335ea5d78956eef1e741c6ac42ab0e323cfc7400fd24306985fae57

Download Submit
C:\Windows\SysWOW64\Mhoipb32.exe

Filesize
59KB

MD5
cf484b59c72ddf3d90d3747d2559fbdf

SHA1
c69e80d01b161f28e0dffab27a8a3d1d2d8c58ec

SHA256
473484d64ae432ac9c3c4e49c81862bd2b8952837a9da312a732934047ccea4f

SHA512
d1003b0b023bd4de6c92dc7e36ebc63e97f638630f91a14b187e5e53932b2318051626017335ea5d78956eef1e741c6ac42ab0e323cfc7400fd24306985fae57

Download Submit
C:\Windows\SysWOW64\Micoed32.exe

Filesize
59KB

MD5
bdd6c268faf5a3a2e1d38a4a25f08cdb

SHA1
9aa91e040653ab8fbeeb3df34088fd572880016f

SHA256
c1d3d66c8a9063cb6bd0b30a3ceef6ef9dfa39a61fd067dab589c6cbd06b171c

SHA512
2b61a240e5939b5204fc18e2506a1f125ccba6ca4023bc52f8860ca4d8333e593f30e1a806bbb7423040974f0cca083868aef85e0e0ba62aac3c32169214aa5b

Download Submit
C:\Windows\SysWOW64\Micoed32.exe

Filesize
59KB

MD5
bdd6c268faf5a3a2e1d38a4a25f08cdb

SHA1
9aa91e040653ab8fbeeb3df34088fd572880016f

SHA256
c1d3d66c8a9063cb6bd0b30a3ceef6ef9dfa39a61fd067dab589c6cbd06b171c

SHA512
2b61a240e5939b5204fc18e2506a1f125ccba6ca4023bc52f8860ca4d8333e593f30e1a806bbb7423040974f0cca083868aef85e0e0ba62aac3c32169214aa5b

Download Submit
C:\Windows\SysWOW64\Mldhfpib.exe

Filesize
59KB

MD5
2c1efbd9420a70f58956279b0cbb3975

SHA1
4b5bf465e856ab62707b591a3db5181176f362b0

SHA256
e15c865ae27bff868770e85049748c887e54e3e855539ecd4de58f553628f745

SHA512
58c02a055b38e902ab480d817b1f029f5bf911e54c4ad7ccc96afa75f4b19da747ecddbdae156cab7f340da736eeb73d0c60f07ba38461446d98c89735ceb6f0

Download Submit
C:\Windows\SysWOW64\Mldhfpib.exe

Filesize
59KB

MD5
2c1efbd9420a70f58956279b0cbb3975

SHA1
4b5bf465e856ab62707b591a3db5181176f362b0

SHA256
e15c865ae27bff868770e85049748c887e54e3e855539ecd4de58f553628f745

SHA512
58c02a055b38e902ab480d817b1f029f5bf911e54c4ad7ccc96afa75f4b19da747ecddbdae156cab7f340da736eeb73d0c60f07ba38461446d98c89735ceb6f0

Download Submit
C:\Windows\SysWOW64\Nafjjf32.exe

Filesize
59KB

MD5
2965d55c7e011d4c594ae8d6dd591450

SHA1
de8d7079a840cb5de40256b2640a5c4e9c5cb834

SHA256
a9e4079d770c97b228dd325d1c57ea42ee48c08db8d9c795b4327c7d0aeb9146

SHA512
5870a70ddbe50211fa83d6712c856745856ce9c20bf12fc8e59872e9ce0757074f44afd6ceca0aedd61a5fc8b09227e3e50918b7e3ad6bd0c8b0ec09af7750b1

Download Submit
C:\Windows\SysWOW64\Nafjjf32.exe

Filesize
59KB

MD5
2965d55c7e011d4c594ae8d6dd591450

SHA1
de8d7079a840cb5de40256b2640a5c4e9c5cb834

SHA256
a9e4079d770c97b228dd325d1c57ea42ee48c08db8d9c795b4327c7d0aeb9146

SHA512
5870a70ddbe50211fa83d6712c856745856ce9c20bf12fc8e59872e9ce0757074f44afd6ceca0aedd61a5fc8b09227e3e50918b7e3ad6bd0c8b0ec09af7750b1

Download Submit
C:\Windows\SysWOW64\Nbefdijg.exe

Filesize
59KB

MD5
b83544b374fce7a5a4c0cd1989b4198a

SHA1
f7e5b73d33f4c67f786de45d100dbeeb69217a28

SHA256
a4d77b789ed2de9a2b2de5ef11c8b16f246b6d07e767e3be6cbcae931a36fb43

SHA512
40d5b482a1c0627f8f7df3871c4a1fc3d8f839d6299eeb1912d3f054b19f9a94b40357929d3911ded8748ad3852eae62da0423c107d13afa3782b31812b7e809

Download Submit
C:\Windows\SysWOW64\Nbefdijg.exe

Filesize
59KB

MD5
b83544b374fce7a5a4c0cd1989b4198a

SHA1
f7e5b73d33f4c67f786de45d100dbeeb69217a28

SHA256
a4d77b789ed2de9a2b2de5ef11c8b16f246b6d07e767e3be6cbcae931a36fb43

SHA512
40d5b482a1c0627f8f7df3871c4a1fc3d8f839d6299eeb1912d3f054b19f9a94b40357929d3911ded8748ad3852eae62da0423c107d13afa3782b31812b7e809

Download Submit
C:\Windows\SysWOW64\Neoieenp.exe

Filesize
59KB

MD5
5c7306e4eaf87963c7ee63da95b70e40

SHA1
a16f9dd7077fc2fe27367abcde134ea27b78464a

SHA256
47f13a9a6e19aa636348d1626976f0869c6c950ffa3ffeb49b0a6b1723479e0c

SHA512
0e54331fd527e7fc2ce01c3c27e9d10fe70480536ea0eb5cf3e6ff20a0dbc206c1e57ea34267e6dbbcc3176ad20374940fe9757b857dfdf001d58cc1f6a3e236

Download Submit
C:\Windows\SysWOW64\Neoieenp.exe

Filesize
59KB

MD5
5c7306e4eaf87963c7ee63da95b70e40

SHA1
a16f9dd7077fc2fe27367abcde134ea27b78464a

SHA256
47f13a9a6e19aa636348d1626976f0869c6c950ffa3ffeb49b0a6b1723479e0c

SHA512
0e54331fd527e7fc2ce01c3c27e9d10fe70480536ea0eb5cf3e6ff20a0dbc206c1e57ea34267e6dbbcc3176ad20374940fe9757b857dfdf001d58cc1f6a3e236

Download Submit
C:\Windows\SysWOW64\Nhkikq32.exe

Filesize
59KB

MD5
c80537a22aed059df9cc92c7dc27e45a

SHA1
4154e897897de6b23b92e1590dd02345160ebd4e

SHA256
780d14b3dd05865caeb753a729e662a96c5074c6dd3f664616adaa49a2ad5a7e

SHA512
39f6dd40b9cf0c45ccd50c15a83a4a963d83f265467c6e008a1ba40ac1a18337e84545c020a4defcb7da20bf16969f4920ba5683027059763a560d6e246397dd

Download Submit
C:\Windows\SysWOW64\Nhkikq32.exe

Filesize
59KB

MD5
c80537a22aed059df9cc92c7dc27e45a

SHA1
4154e897897de6b23b92e1590dd02345160ebd4e

SHA256
780d14b3dd05865caeb753a729e662a96c5074c6dd3f664616adaa49a2ad5a7e

SHA512
39f6dd40b9cf0c45ccd50c15a83a4a963d83f265467c6e008a1ba40ac1a18337e84545c020a4defcb7da20bf16969f4920ba5683027059763a560d6e246397dd

Download Submit
C:\Windows\SysWOW64\Nkqkhk32.exe

Filesize
59KB

MD5
180cc836413954592cc8079bb81dd1b8

SHA1
9482d46679ea56d255b48d01568fc7f96457ab48

SHA256
41ff31275d6a102fcff24eb4ef23ba7ca01d7334e1b7f2916bd36341dc72cd46

SHA512
a9a761c56e9dece32fff124b992a734fddfbfe10a2fa24782e88833d6a71fd1520133d3a53b0d47b69ea206f36adedb31d6aec49b28fc47736a3bfa968bf9966

Download Submit
C:\Windows\SysWOW64\Nkqkhk32.exe

Filesize
59KB

MD5
180cc836413954592cc8079bb81dd1b8

SHA1
9482d46679ea56d255b48d01568fc7f96457ab48

SHA256
41ff31275d6a102fcff24eb4ef23ba7ca01d7334e1b7f2916bd36341dc72cd46

SHA512
a9a761c56e9dece32fff124b992a734fddfbfe10a2fa24782e88833d6a71fd1520133d3a53b0d47b69ea206f36adedb31d6aec49b28fc47736a3bfa968bf9966

Download Submit
C:\Windows\SysWOW64\Oampjeml.exe

Filesize
59KB

MD5
c416c122caadeb1d8aa01994f14ec567

SHA1
0d0bf7fd06107fc6520ceb17ca3d0150028296da

SHA256
97bebd609e8807eceda3ec897214efdf235b1f4877629e5065b6d3f98467807a

SHA512
b5a841ab39028b0c79e5bc52983cfb46e94578f81764ddb4152c5e7f1acdeecdeaf01113a4484debeb003e961f630d2a75e76c05012266423ee41e3b59d28609

Download Submit
C:\Windows\SysWOW64\Oampjeml.exe

Filesize
59KB

MD5
c416c122caadeb1d8aa01994f14ec567

SHA1
0d0bf7fd06107fc6520ceb17ca3d0150028296da

SHA256
97bebd609e8807eceda3ec897214efdf235b1f4877629e5065b6d3f98467807a

SHA512
b5a841ab39028b0c79e5bc52983cfb46e94578f81764ddb4152c5e7f1acdeecdeaf01113a4484debeb003e961f630d2a75e76c05012266423ee41e3b59d28609

Download Submit
C:\Windows\SysWOW64\Oemefcap.exe

Filesize
59KB

MD5
147ba57562621ca8e48def9f8e270357

SHA1
26a4e65e2c80f11eb106e5112037d8585517e232

SHA256
28bb7f980541731f7a39325bf6bf365c4ee9582d96d3078952efc6ed9be71f8e

SHA512
c95bd3394cb9a2fecc9e07292211140fd4f4ea03e939e345e912308cd705100d7f6f1138a8aa49379bb180aabd0ca27f7c8e6243d17c947ed06fed052d1c5342

Download Submit
C:\Windows\SysWOW64\Oemefcap.exe

Filesize
59KB

MD5
147ba57562621ca8e48def9f8e270357

SHA1
26a4e65e2c80f11eb106e5112037d8585517e232

SHA256
28bb7f980541731f7a39325bf6bf365c4ee9582d96d3078952efc6ed9be71f8e

SHA512
c95bd3394cb9a2fecc9e07292211140fd4f4ea03e939e345e912308cd705100d7f6f1138a8aa49379bb180aabd0ca27f7c8e6243d17c947ed06fed052d1c5342

Download Submit
C:\Windows\SysWOW64\Okchnk32.exe

Filesize
59KB

MD5
2c3d358cb89af022c9c62636f53f8059

SHA1
133084173391d2658dab1e950010daa1e4405942

SHA256
352bc9a9a1daea900178df62f486d6277202d47d49cc54fd1ab322ea2696f138

SHA512
589a20c123f13e3258f790ba657e04ec0c55ed45d7f73c22153ccf006b9cb4e80e6da881f78e511f5a87d2442810ad5f1e08e3f8670ed96c2c4f3384ab411150

Download Submit
C:\Windows\SysWOW64\Okchnk32.exe

Filesize
59KB

MD5
2c3d358cb89af022c9c62636f53f8059

SHA1
133084173391d2658dab1e950010daa1e4405942

SHA256
352bc9a9a1daea900178df62f486d6277202d47d49cc54fd1ab322ea2696f138

SHA512
589a20c123f13e3258f790ba657e04ec0c55ed45d7f73c22153ccf006b9cb4e80e6da881f78e511f5a87d2442810ad5f1e08e3f8670ed96c2c4f3384ab411150

Download Submit
C:\Windows\SysWOW64\Okedcjcm.exe

Filesize
59KB

MD5
b5832c9b541742f2ea7bd0ef6ae49983

SHA1
0fefe4675e385b123ffe3e925155b795151fea28

SHA256
04e6e749413f8dfbc26e2e58bf901d4aee548bc4768b85d26c75e00fd1ba7df1

SHA512
960293a6c845ec5c9f64e23181e8c98a52d620d7477138d7b6dd9ee271934beb489e5d84424e63d16529a5d61af8969bbafd27c727924ba3e25f483f2082e810

Download Submit
C:\Windows\SysWOW64\Okedcjcm.exe

Filesize
59KB

MD5
b5832c9b541742f2ea7bd0ef6ae49983

SHA1
0fefe4675e385b123ffe3e925155b795151fea28

SHA256
04e6e749413f8dfbc26e2e58bf901d4aee548bc4768b85d26c75e00fd1ba7df1

SHA512
960293a6c845ec5c9f64e23181e8c98a52d620d7477138d7b6dd9ee271934beb489e5d84424e63d16529a5d61af8969bbafd27c727924ba3e25f483f2082e810

Download Submit
C:\Windows\SysWOW64\Oldamm32.exe

Filesize
59KB

MD5
619ad516974d24ee8a33b373914884ab

SHA1
bd9fe316e241bcb550cb7943f060a0c65318de2e

SHA256
a3cb5ea7ed0d07af5175586cdefb0d518fac8bd8e23edaad907239aa56493ab0

SHA512
b933827f47c2140708d21a679c40eb2e8fb7ba46b2a8f659fb27b2498e562be343376e59fe02698b880a3d9a058a4eac216af92f7a5b1548e750a04ff9babb7c

Download Submit
C:\Windows\SysWOW64\Oldamm32.exe

Filesize
59KB

MD5
619ad516974d24ee8a33b373914884ab

SHA1
bd9fe316e241bcb550cb7943f060a0c65318de2e

SHA256
a3cb5ea7ed0d07af5175586cdefb0d518fac8bd8e23edaad907239aa56493ab0

SHA512
b933827f47c2140708d21a679c40eb2e8fb7ba46b2a8f659fb27b2498e562be343376e59fe02698b880a3d9a058a4eac216af92f7a5b1548e750a04ff9babb7c

Download Submit
C:\Windows\SysWOW64\Ooejohhq.exe

Filesize
59KB

MD5
d0535f86e711793e30b8e7a557ea81d7

SHA1
ccf52f2feb4acc9d95c1d26ff0bd94fb8cd13571

SHA256
d4787e9fcf9b1c98dedeb3324a75bb6de6bd45a02e7b4907231ded4b792985ad

SHA512
8292071c0fa2a0e67d2ab56acc38d2776805a5ec4a8e03b14bcf926a4b25b43946d02a6c8447ef9a4646d3fda635a66df0c50ec6c80c8b6dcaeb375cfe3cc981

Download Submit
C:\Windows\SysWOW64\Ooejohhq.exe

Filesize
59KB

MD5
d0535f86e711793e30b8e7a557ea81d7

SHA1
ccf52f2feb4acc9d95c1d26ff0bd94fb8cd13571

SHA256
d4787e9fcf9b1c98dedeb3324a75bb6de6bd45a02e7b4907231ded4b792985ad

SHA512
8292071c0fa2a0e67d2ab56acc38d2776805a5ec4a8e03b14bcf926a4b25b43946d02a6c8447ef9a4646d3fda635a66df0c50ec6c80c8b6dcaeb375cfe3cc981

Download Submit
C:\Windows\SysWOW64\Oogpjbbb.exe

Filesize
59KB

MD5
fd519c1743297b0c7c5a43082098ed7c

SHA1
2b715a301ecaedc305a9f7795cf2c959bb730f51

SHA256
80d7c8b309d9c6c0c2a5bb710773035ff4757a0778017913595d06090ded5e9c

SHA512
6fde0849586e20a3ef088878d1b1544f19a2c8ec549383f13128501cedfc439eef9b3ec82e05258336cbd0244c68de0e917763744b1daa149d8eeff94247decf

Download Submit
C:\Windows\SysWOW64\Pabblb32.exe

Filesize
59KB

MD5
7cf11e7fcffb9efe9d07695f7d429ed6

SHA1
5c0f2e767f4b5ac07afe044edd9f9818ffd6fe0a

SHA256
4eb4cf8e4958bf60047b0f5d730cd3cc4055faaf0afff56b3a5ed3b89b93ef4d

SHA512
0c04949106d3de89ca15543090323f01f4075346ed560ce998f0bc3e05e9424c26d6e5cd414a9196c7ba039cecaf80041f089cbc01027dba0e61b7aed761f492

Download Submit
C:\Windows\SysWOW64\Pabblb32.exe

Filesize
59KB

MD5
7cf11e7fcffb9efe9d07695f7d429ed6

SHA1
5c0f2e767f4b5ac07afe044edd9f9818ffd6fe0a

SHA256
4eb4cf8e4958bf60047b0f5d730cd3cc4055faaf0afff56b3a5ed3b89b93ef4d

SHA512
0c04949106d3de89ca15543090323f01f4075346ed560ce998f0bc3e05e9424c26d6e5cd414a9196c7ba039cecaf80041f089cbc01027dba0e61b7aed761f492

Download Submit
C:\Windows\SysWOW64\Pakllc32.exe

Filesize
59KB

MD5
c562711797c5fa89f17f9d82e2eecd40

SHA1
e7f5c7b1c6ea9a1c4aaeb96d11703ccf769a4cee

SHA256
469c1916f3ba03eff7ed629f16a1ec1e00f32a79034ad8d5fa980bd74293e78e

SHA512
bcd28651a9ccdb6798df185ea3dbbb907fddf23acb45cd52b5b960ce64b40b713f74aa4e55bbfa7ba707447603e2436dad75b5a465ce94e860fce2959776ca1b

Download Submit
C:\Windows\SysWOW64\Pakllc32.exe

Filesize
59KB

MD5
c562711797c5fa89f17f9d82e2eecd40

SHA1
e7f5c7b1c6ea9a1c4aaeb96d11703ccf769a4cee

SHA256
469c1916f3ba03eff7ed629f16a1ec1e00f32a79034ad8d5fa980bd74293e78e

SHA512
bcd28651a9ccdb6798df185ea3dbbb907fddf23acb45cd52b5b960ce64b40b713f74aa4e55bbfa7ba707447603e2436dad75b5a465ce94e860fce2959776ca1b

Download Submit
C:\Windows\SysWOW64\Pcmeke32.exe

Filesize
59KB

MD5
acfe99b207db5d374f0a771c51e04ccc

SHA1
3a4827c35ca09fe3a9a93368eb4f1bd4d26d0438

SHA256
de97757e2885e527e6d7ceb630d6c7c9959d4f1c1aeb90dc84c837519575e2b9

SHA512
29e4a9bcee330fd9795d9bbf66f58f040f59e4d82cc5d3f6e36c4d30b0c5bbb10a72f87e9920d1cc8c924c8d035d340b4354885d9c1b72cfcdb169b34268e49e

Download Submit
C:\Windows\SysWOW64\Pcmeke32.exe

Filesize
59KB

MD5
acfe99b207db5d374f0a771c51e04ccc

SHA1
3a4827c35ca09fe3a9a93368eb4f1bd4d26d0438

SHA256
de97757e2885e527e6d7ceb630d6c7c9959d4f1c1aeb90dc84c837519575e2b9

SHA512
29e4a9bcee330fd9795d9bbf66f58f040f59e4d82cc5d3f6e36c4d30b0c5bbb10a72f87e9920d1cc8c924c8d035d340b4354885d9c1b72cfcdb169b34268e49e

Download Submit
C:\Windows\SysWOW64\Pedlgbkh.exe

Filesize
59KB

MD5
11a29fe659fa6ecf4ea280f5412b3417

SHA1
f49baba21bdd9cd9092b3420584da439ca2592c7

SHA256
676becdbf96e143a27e5756746cf3f77c8c703f9ef808bed91e40bb94412a00f

SHA512
d7f6fc9ba661fe6f38bfbc0e5c10c7aba71e3802b5c301069b786900ec26737c623a447b79a8a5831b5f90587dc72d05d2e223e935fb3510137089bf1edb4589

Download Submit
C:\Windows\SysWOW64\Pedlgbkh.exe

Filesize
59KB

MD5
11a29fe659fa6ecf4ea280f5412b3417

SHA1
f49baba21bdd9cd9092b3420584da439ca2592c7

SHA256
676becdbf96e143a27e5756746cf3f77c8c703f9ef808bed91e40bb94412a00f

SHA512
d7f6fc9ba661fe6f38bfbc0e5c10c7aba71e3802b5c301069b786900ec26737c623a447b79a8a5831b5f90587dc72d05d2e223e935fb3510137089bf1edb4589

Download Submit
C:\Windows\SysWOW64\Pidabppl.exe

Filesize
59KB

MD5
9cde082e0fc80ecb30dad77cea0702c3

SHA1
f4f3c6fea20b34926fb729806cfc383baac935b9

SHA256
4d65536bffcebf6dc453ea84b2b2550538242d02ba2c1898417cad2e2b963c57

SHA512
b95562424988cd3257244efcf795369b101fba604f426f9f41941aac022bdf90c0ce6442ce97730ff2eddec9d09103f88a6fc1900a19ff1dfc501679e4b1cf5c

Download Submit
C:\Windows\SysWOW64\Pidabppl.exe

Filesize
59KB

MD5
9cde082e0fc80ecb30dad77cea0702c3

SHA1
f4f3c6fea20b34926fb729806cfc383baac935b9

SHA256
4d65536bffcebf6dc453ea84b2b2550538242d02ba2c1898417cad2e2b963c57

SHA512
b95562424988cd3257244efcf795369b101fba604f426f9f41941aac022bdf90c0ce6442ce97730ff2eddec9d09103f88a6fc1900a19ff1dfc501679e4b1cf5c

Download Submit
C:\Windows\SysWOW64\Plpqil32.exe

Filesize
59KB

MD5
7d2c72f6dd7f25755b8270078dfdd8ce

SHA1
fe1ea5b42653025a9c3a921d1d327112e8d36f41

SHA256
99a62135877bcc352c51dbd751d006fef943373f545f7aa00c9deccf0dc89955

SHA512
a77a807542fd8e55b65a4707bfc2a598677ce65085b7769a06bcaa971cb2af109c3ce2ba06891261cf5599564595389bedec980b19c19eea1e43190e13d0ea28

Download Submit
C:\Windows\SysWOW64\Plpqil32.exe

Filesize
59KB

MD5
7d2c72f6dd7f25755b8270078dfdd8ce

SHA1
fe1ea5b42653025a9c3a921d1d327112e8d36f41

SHA256
99a62135877bcc352c51dbd751d006fef943373f545f7aa00c9deccf0dc89955

SHA512
a77a807542fd8e55b65a4707bfc2a598677ce65085b7769a06bcaa971cb2af109c3ce2ba06891261cf5599564595389bedec980b19c19eea1e43190e13d0ea28

Download Submit
C:\Windows\SysWOW64\Qlgpod32.exe

Filesize
59KB

MD5
871834fd5b67f5d3ac72ca2673ddd095

SHA1
fdf212840e6b97f8e6955ba086f82b5d666e0232

SHA256
95d1a71a5c844ca050ed8918639cfadbb6deb055a9d863fa1ecfaeb6a783bd29

SHA512
6ba10c215596dbd5a7d621254896728a058116e718dd3ab3e6db2bb4dc488df99e1e700ede5d4e05f740aa379b2090a3efce9b3f07495496c679442455a12e67

Download Submit
memory/396-312-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/400-129-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/540-318-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/832-24-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/884-294-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1072-209-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1092-420-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1228-106-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1396-234-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1524-40-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1636-414-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1668-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1668-80-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1668-5-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1792-72-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1884-57-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1888-217-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1900-226-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2256-193-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2320-162-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2388-384-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2436-390-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2480-324-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2524-64-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2572-170-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2632-82-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2792-48-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2868-408-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2892-306-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/2948-98-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3048-372-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3120-153-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3464-258-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3524-342-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3540-242-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3788-264-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3868-366-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3972-250-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/3980-137-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4036-300-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4128-330-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4228-201-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4368-432-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4396-185-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4408-8-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4472-90-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4488-288-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4552-16-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4684-402-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4728-354-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4772-270-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4808-282-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4824-276-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4848-32-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4852-177-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4860-122-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4864-360-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4908-426-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4940-145-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/4944-396-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5032-114-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5040-348-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5048-336-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/5068-378-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads