b40321642413b605f8e477f9b4f353998db5924cb51d8566b376c34185c72972

Analysis

max time kernel
123s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2023, 17:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.3ec4ad939cf944cca245b58c669c44c9.exe
Size

75KB
MD5

3ec4ad939cf944cca245b58c669c44c9
SHA1

61c702f1c38bf23a0a592bc3d49700773fdf9f1b
SHA256

b40321642413b605f8e477f9b4f353998db5924cb51d8566b376c34185c72972
SHA512

4bd6fb8b6ee4c78a340c57038af161210e5c429158aed0a92862b0801f818c39ba2f77d03c4dd10ef4f23ed4089f3543b9f2556c59d82406802c286436c0c796
SSDEEP

1536:hyNQz7QCNNCz7Bdx4S9oLTyuP42L46+lWCWQv:CsvN8dQmux46+bWQv

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Efoiko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjmokmji.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbnknpqj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ndfgfd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iiaein32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ddngdj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lejgln32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obdkfg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hheoci32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Hoadecal.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acnefoac.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmbjcb32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cbqlpabf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dikpla32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pebfen32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Aoifoa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bfchcijo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Obfpejcl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mphfjhjf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bccfleqi.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jkkjfa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mfejme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gnlmai32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nnmmleja.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Admkgifd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Koceep32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmdpok32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Pbahgbfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icbpkg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bogcqpdd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckkilhjm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ohkkanbe.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dlnlkq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Eodclj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlefebfg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cgijnk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hahcfi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eiobmjkd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aoifoa32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iiigqdfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncifdlii.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Flbhia32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dfglpjqo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljhcbhnb.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Icoodj32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kfhkop32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Acgfpf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Iomcqa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Loqejjad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bcfabgel.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cfipol32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dlnlkq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hbmclobc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Iiigqdfd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aoofej32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdfmcobk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Femndhgh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ipiaphop.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gafmkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mjpbkc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eceoanpo.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gmcdolbn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ejaklmpd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jgigfg32.exe

Executes dropped EXE 64 IoCs

pid	Process
2636	Bdlncn32.exe
1508	Ckcbaf32.exe
3992	Cbnknpqj.exe
3832	Dalkek32.exe
472	Eaqdpjia.exe
624	Ehklmd32.exe
2224	Flbhia32.exe
3380	Gklnem32.exe
2744	Glpdjpbj.exe
2336	Hhnkppbf.exe
2936	Icjengld.exe
2100	Ikmpcicg.exe
1196	Jfdafa32.exe
4324	Mfofjk32.exe
3580	Ncecioib.exe
1456	Obfpejcl.exe
5036	Odelpm32.exe
4544	Pmbjcb32.exe
2472	Admkgifd.exe
4396	Bcinie32.exe
3724	Bjeckojo.exe
2116	Blflmj32.exe
372	Cjofambd.exe
4372	Ddnmeejo.exe
1232	Eegpkcbd.exe
1036	Ecoiapdj.exe
1312	Emgnje32.exe
4816	Elhnhm32.exe
3492	Feella32.exe
4340	Fjdajhbi.exe
4912	Fmejlcoj.exe
3320	Ghohdk32.exe
400	Haeino32.exe
2492	Ionbcb32.exe
2724	Iemdkl32.exe
5004	Jlblcdpf.exe
3504	Koceep32.exe
2708	Koeajo32.exe
5056	Mejijcea.exe
4084	Nbepdfnc.exe
1040	Nfeepdbg.exe
1720	Oeahap32.exe
3284	Onjmjegg.exe
408	Obgeqcnn.exe
1200	Pmdpok32.exe
336	Pbahgbfc.exe
1340	Ppeipfdm.exe
1968	Pimmil32.exe
4788	Qmkfoj32.exe
2284	Algiaepd.exe
3760	Bgafin32.exe
4072	Blnoad32.exe
2204	Bckddn32.exe
1724	Boaeioej.exe
2188	Dnqaheai.exe
4824	Dqomdppm.exe
1012	Dfqogfjo.exe
2628	Dgplai32.exe
3384	Eodclj32.exe
4296	Fjanjb32.exe
1212	Gmimll32.exe
3784	Gplbcgbg.exe
1512	Gjagapbn.exe
2788	Hfhgfaha.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nkncno32.exe	Nddkaddm.exe
File opened for modification	C:\Windows\SysWOW64\Lmppmh32.exe	Lplpcc32.exe
File created	C:\Windows\SysWOW64\Bhmllhmp.dll	Gflhie32.exe
File created	C:\Windows\SysWOW64\Iifodmak.exe	Iciflfcd.exe
File opened for modification	C:\Windows\SysWOW64\Oenljoji.exe	Oocdme32.exe
File created	C:\Windows\SysWOW64\Ijlkqj32.exe	Hahcfi32.exe
File created	C:\Windows\SysWOW64\Ddnmeejo.exe	Cjofambd.exe
File created	C:\Windows\SysWOW64\Bigfndlc.dll	Ehddpdlc.exe
File created	C:\Windows\SysWOW64\Gedaobdo.dll	Ppemmg32.exe
File created	C:\Windows\SysWOW64\Cafqkmge.dll	Idfaolpb.exe
File created	C:\Windows\SysWOW64\Ncifdlii.exe	Nnmmleja.exe
File opened for modification	C:\Windows\SysWOW64\Hmhmko32.exe	Hlipal32.exe
File opened for modification	C:\Windows\SysWOW64\Lbmheomi.exe	Lmppmh32.exe
File created	C:\Windows\SysWOW64\Kncmepjq.dll	Pjaefc32.exe
File opened for modification	C:\Windows\SysWOW64\Gkjhif32.exe	Gaadpqmp.exe
File opened for modification	C:\Windows\SysWOW64\Aqhcid32.exe	Aoifoa32.exe
File created	C:\Windows\SysWOW64\Fielal32.dll	Pogpcghp.exe
File created	C:\Windows\SysWOW64\Caachqjp.dll	Gjjjfkdj.exe
File created	C:\Windows\SysWOW64\Kppmgb32.dll	Kgenlldo.exe
File created	C:\Windows\SysWOW64\Inkjao32.exe	Idbfhiko.exe
File created	C:\Windows\SysWOW64\Cmjgba32.dll	Nmipnp32.exe
File created	C:\Windows\SysWOW64\Kmdqai32.exe	Kppphe32.exe
File created	C:\Windows\SysWOW64\Cijpkmml.exe	Cbphncfo.exe
File opened for modification	C:\Windows\SysWOW64\Ioeineap.exe	Imbpam32.exe
File created	C:\Windows\SysWOW64\Ibdpblpk.dll	Ehlpjikd.exe
File created	C:\Windows\SysWOW64\Ciefpn32.exe	Ckaffjbg.exe
File opened for modification	C:\Windows\SysWOW64\Cfipol32.exe	Eennoknp.exe
File created	C:\Windows\SysWOW64\Cdicdi32.exe	Colklb32.exe
File created	C:\Windows\SysWOW64\Dmgdcp32.dll	Ncecioib.exe
File created	C:\Windows\SysWOW64\Omneeicm.dll	Feella32.exe
File created	C:\Windows\SysWOW64\Ihgqiiph.dll	Hoibmmpi.exe
File created	C:\Windows\SysWOW64\Ogbckf32.dll	Pjhbah32.exe
File opened for modification	C:\Windows\SysWOW64\Jofaeb32.exe	Jcoapami.exe
File created	C:\Windows\SysWOW64\Odbkef32.dll	Blhhaigj.exe
File created	C:\Windows\SysWOW64\Bccfleqi.exe	Bnfmcn32.exe
File created	C:\Windows\SysWOW64\Bmfgid32.dll	Gafmkp32.exe
File created	C:\Windows\SysWOW64\Laocpjjj.dll	Ckaffjbg.exe
File created	C:\Windows\SysWOW64\Adjppm32.dll	Nnmmleja.exe
File created	C:\Windows\SysWOW64\Ngehcfci.dll	Ecoiapdj.exe
File created	C:\Windows\SysWOW64\Kbkaiddd.exe	Kgenlldo.exe
File opened for modification	C:\Windows\SysWOW64\Bohbackj.exe	Boeelcmm.exe
File opened for modification	C:\Windows\SysWOW64\Lkgdfb32.exe	Lmnjan32.exe
File created	C:\Windows\SysWOW64\Fljkkgjq.dll	Knioij32.exe
File created	C:\Windows\SysWOW64\Nlhbja32.exe	Niifnf32.exe
File created	C:\Windows\SysWOW64\Bqhlpbjd.exe	Bfchcijo.exe
File created	C:\Windows\SysWOW64\Npckji32.dll	Ppeipfdm.exe
File created	C:\Windows\SysWOW64\Blamdnfl.dll	Aegidp32.exe
File opened for modification	C:\Windows\SysWOW64\Cjjcof32.exe	Cmfcfb32.exe
File opened for modification	C:\Windows\SysWOW64\Djaipe32.exe	Daiegp32.exe
File created	C:\Windows\SysWOW64\Dkokma32.exe	Feddpj32.exe
File created	C:\Windows\SysWOW64\Ccbqeg32.dll	Pmbjcb32.exe
File created	C:\Windows\SysWOW64\Ejngcgpo.dll	Mmgfmg32.exe
File opened for modification	C:\Windows\SysWOW64\Fjmkhkff.exe	Fpggkbfq.exe
File created	C:\Windows\SysWOW64\Gklnem32.exe	Flbhia32.exe
File created	C:\Windows\SysWOW64\Eeagnc32.exe	Dobffj32.exe
File created	C:\Windows\SysWOW64\Gbcohl32.exe	Gmggpekm.exe
File created	C:\Windows\SysWOW64\Lobogqeq.dll	Jdddjq32.exe
File opened for modification	C:\Windows\SysWOW64\Qocfjlan.exe	Pacfdila.exe
File created	C:\Windows\SysWOW64\Gageoman.dll	Fbhplnca.exe
File created	C:\Windows\SysWOW64\Hbmclobc.exe	Hheoci32.exe
File opened for modification	C:\Windows\SysWOW64\Oemephgn.exe	Okgabpgg.exe
File created	C:\Windows\SysWOW64\Cagolf32.exe	Cabfagee.exe
File created	C:\Windows\SysWOW64\Jhpckehm.dll	Gklenf32.exe
File opened for modification	C:\Windows\SysWOW64\Cjecjahd.exe	Cooolhin.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aeiooi32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pgdodq32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dalkek32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Aeiooi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Djcfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ggpbcaei.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Oeclockl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Peljha32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpopnf32.dll"	Ggpbcaei.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Iciflfcd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fmqjplak.dll"	Gpfjfg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Oemephgn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Nnpalk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pmlmdd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jpnkbhef.dll"	Dfcjoa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ehhjekgq.dll"	Mmnglh32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Gflhie32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mfjfoidl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lmqiag32.dll"	Lcbikd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Moiphnde.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flplcjpa.dll"	Gplbcgbg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mdjapphl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gdjpff32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mchpibng.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Acilkp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nbomimbi.dll"	Nliakd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Glpdjpbj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fbbnfjom.dll"	Nnojad32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jejjld32.dll"	Fmejlcoj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Kbpkdd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kiggln32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hlefgphj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Echkgnnl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Enljfc32.dll"	Efoiko32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jihcig32.dll"	Imbpam32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fljkkgjq.dll"	Knioij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pjhbah32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Plcbgiaq.dll"	Dobffj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Knabne32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Qocfjlan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hdehho32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nldhbggg.dll"	Mndapl32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Blnoad32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Mfejme32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bmkcjd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Palbpb32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Algiaepd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Imdgjlgb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Djcfee32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdaiegkj.dll"	Hgboiq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mnaacjha.dll"	Iildfd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Akniofoa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Hbjonepq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gjagapbn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Iifodmak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Emhlefoa.dll"	Nllekk32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Jookdcie.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Ppemmg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ihdhon32.dll"	Cjecjahd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jhpckehm.dll"	Gklenf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bjhndf32.dll"	Mejijcea.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ppeipfdm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pokjnd32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Njonhjlo.dll"	Engjol32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 2636	1536	NEAS.3ec4ad939cf944cca245b58c669c44c9.exe	92
PID 1536 wrote to memory of 2636	1536	NEAS.3ec4ad939cf944cca245b58c669c44c9.exe	92
PID 1536 wrote to memory of 2636	1536	NEAS.3ec4ad939cf944cca245b58c669c44c9.exe	92
PID 2636 wrote to memory of 1508	2636	Bdlncn32.exe	93
PID 2636 wrote to memory of 1508	2636	Bdlncn32.exe	93
PID 2636 wrote to memory of 1508	2636	Bdlncn32.exe	93
PID 1508 wrote to memory of 3992	1508	Ckcbaf32.exe	94
PID 1508 wrote to memory of 3992	1508	Ckcbaf32.exe	94
PID 1508 wrote to memory of 3992	1508	Ckcbaf32.exe	94
PID 3992 wrote to memory of 3832	3992	Cbnknpqj.exe	95
PID 3992 wrote to memory of 3832	3992	Cbnknpqj.exe	95
PID 3992 wrote to memory of 3832	3992	Cbnknpqj.exe	95
PID 3832 wrote to memory of 472	3832	Dalkek32.exe	96
PID 3832 wrote to memory of 472	3832	Dalkek32.exe	96
PID 3832 wrote to memory of 472	3832	Dalkek32.exe	96
PID 472 wrote to memory of 624	472	Eaqdpjia.exe	97
PID 472 wrote to memory of 624	472	Eaqdpjia.exe	97
PID 472 wrote to memory of 624	472	Eaqdpjia.exe	97
PID 624 wrote to memory of 2224	624	Ehklmd32.exe	98
PID 624 wrote to memory of 2224	624	Ehklmd32.exe	98
PID 624 wrote to memory of 2224	624	Ehklmd32.exe	98
PID 2224 wrote to memory of 3380	2224	Flbhia32.exe	99
PID 2224 wrote to memory of 3380	2224	Flbhia32.exe	99
PID 2224 wrote to memory of 3380	2224	Flbhia32.exe	99
PID 3380 wrote to memory of 2744	3380	Gklnem32.exe	100
PID 3380 wrote to memory of 2744	3380	Gklnem32.exe	100
PID 3380 wrote to memory of 2744	3380	Gklnem32.exe	100
PID 2744 wrote to memory of 2336	2744	Glpdjpbj.exe	101
PID 2744 wrote to memory of 2336	2744	Glpdjpbj.exe	101
PID 2744 wrote to memory of 2336	2744	Glpdjpbj.exe	101
PID 2336 wrote to memory of 2936	2336	Hhnkppbf.exe	102
PID 2336 wrote to memory of 2936	2336	Hhnkppbf.exe	102
PID 2336 wrote to memory of 2936	2336	Hhnkppbf.exe	102
PID 2936 wrote to memory of 2100	2936	Icjengld.exe	103
PID 2936 wrote to memory of 2100	2936	Icjengld.exe	103
PID 2936 wrote to memory of 2100	2936	Icjengld.exe	103
PID 2100 wrote to memory of 1196	2100	Ikmpcicg.exe	104
PID 2100 wrote to memory of 1196	2100	Ikmpcicg.exe	104
PID 2100 wrote to memory of 1196	2100	Ikmpcicg.exe	104
PID 1196 wrote to memory of 4324	1196	Jfdafa32.exe	105
PID 1196 wrote to memory of 4324	1196	Jfdafa32.exe	105
PID 1196 wrote to memory of 4324	1196	Jfdafa32.exe	105
PID 4324 wrote to memory of 3580	4324	Mfofjk32.exe	106
PID 4324 wrote to memory of 3580	4324	Mfofjk32.exe	106
PID 4324 wrote to memory of 3580	4324	Mfofjk32.exe	106
PID 3580 wrote to memory of 1456	3580	Ncecioib.exe	107
PID 3580 wrote to memory of 1456	3580	Ncecioib.exe	107
PID 3580 wrote to memory of 1456	3580	Ncecioib.exe	107
PID 1456 wrote to memory of 5036	1456	Obfpejcl.exe	108
PID 1456 wrote to memory of 5036	1456	Obfpejcl.exe	108
PID 1456 wrote to memory of 5036	1456	Obfpejcl.exe	108
PID 5036 wrote to memory of 4544	5036	Odelpm32.exe	109
PID 5036 wrote to memory of 4544	5036	Odelpm32.exe	109
PID 5036 wrote to memory of 4544	5036	Odelpm32.exe	109
PID 4544 wrote to memory of 2472	4544	Pmbjcb32.exe	110
PID 4544 wrote to memory of 2472	4544	Pmbjcb32.exe	110
PID 4544 wrote to memory of 2472	4544	Pmbjcb32.exe	110
PID 2472 wrote to memory of 4396	2472	Admkgifd.exe	111
PID 2472 wrote to memory of 4396	2472	Admkgifd.exe	111
PID 2472 wrote to memory of 4396	2472	Admkgifd.exe	111
PID 4396 wrote to memory of 3724	4396	Bcinie32.exe	112
PID 4396 wrote to memory of 3724	4396	Bcinie32.exe	112
PID 4396 wrote to memory of 3724	4396	Bcinie32.exe	112
PID 3724 wrote to memory of 2116	3724	Bjeckojo.exe	113

C:\Users\Admin\AppData\Local\Temp\NEAS.3ec4ad939cf944cca245b58c669c44c9.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.3ec4ad939cf944cca245b58c669c44c9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\SysWOW64\Bdlncn32.exe
  C:\Windows\system32\Bdlncn32.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\SysWOW64\Ckcbaf32.exe
    C:\Windows\system32\Ckcbaf32.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1508
  - - C:\Windows\SysWOW64\Cbnknpqj.exe
      C:\Windows\system32\Cbnknpqj.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3992
    - - C:\Windows\SysWOW64\Dalkek32.exe
        
        C:\Windows\system32\Dalkek32.exe
        5⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3832
      - C:\Windows\SysWOW64\Eaqdpjia.exe
        
        C:\Windows\system32\Eaqdpjia.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:472
        
        C:\Windows\SysWOW64\Ehklmd32.exe
        
        C:\Windows\system32\Ehklmd32.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:624
        
        C:\Windows\SysWOW64\Flbhia32.exe
        
        C:\Windows\system32\Flbhia32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2224
        
        C:\Windows\SysWOW64\Gklnem32.exe
        
        C:\Windows\system32\Gklnem32.exe
        9⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3380
        
        C:\Windows\SysWOW64\Glpdjpbj.exe
        
        C:\Windows\system32\Glpdjpbj.exe
        10⤵
        Executes dropped EXE
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2744
        
        C:\Windows\SysWOW64\Hhnkppbf.exe
        
        C:\Windows\system32\Hhnkppbf.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2336
        
        C:\Windows\SysWOW64\Icjengld.exe
        
        C:\Windows\system32\Icjengld.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2936
        
        C:\Windows\SysWOW64\Ikmpcicg.exe
        
        C:\Windows\system32\Ikmpcicg.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2100
        
        C:\Windows\SysWOW64\Jfdafa32.exe
        
        C:\Windows\system32\Jfdafa32.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1196
        
        C:\Windows\SysWOW64\Mfofjk32.exe
        
        C:\Windows\system32\Mfofjk32.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4324
        
        C:\Windows\SysWOW64\Ncecioib.exe
        
        C:\Windows\system32\Ncecioib.exe
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3580
        
        C:\Windows\SysWOW64\Obfpejcl.exe
        
        C:\Windows\system32\Obfpejcl.exe
        17⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1456
        
        C:\Windows\SysWOW64\Odelpm32.exe
        
        C:\Windows\system32\Odelpm32.exe
        18⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5036
        
        C:\Windows\SysWOW64\Pmbjcb32.exe
        
        C:\Windows\system32\Pmbjcb32.exe
        19⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4544
        
        C:\Windows\SysWOW64\Admkgifd.exe
        
        C:\Windows\system32\Admkgifd.exe
        20⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2472
        
        C:\Windows\SysWOW64\Bcinie32.exe
        
        C:\Windows\system32\Bcinie32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4396
        
        C:\Windows\SysWOW64\Bjeckojo.exe
        
        C:\Windows\system32\Bjeckojo.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3724
        
        C:\Windows\SysWOW64\Blflmj32.exe
        
        C:\Windows\system32\Blflmj32.exe
        23⤵
        Executes dropped EXE
        
        PID:2116
        
        C:\Windows\SysWOW64\Cjofambd.exe
        
        C:\Windows\system32\Cjofambd.exe
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:372
        
        C:\Windows\SysWOW64\Ddnmeejo.exe
        
        C:\Windows\system32\Ddnmeejo.exe
        25⤵
        Executes dropped EXE
        
        PID:4372
        
        C:\Windows\SysWOW64\Eegpkcbd.exe
        
        C:\Windows\system32\Eegpkcbd.exe
        26⤵
        Executes dropped EXE
        
        PID:1232
        
        C:\Windows\SysWOW64\Ecoiapdj.exe
        
        C:\Windows\system32\Ecoiapdj.exe
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1036
        
        C:\Windows\SysWOW64\Emgnje32.exe
        
        C:\Windows\system32\Emgnje32.exe
        28⤵
        Executes dropped EXE
        
        PID:1312
        
        C:\Windows\SysWOW64\Elhnhm32.exe
        
        C:\Windows\system32\Elhnhm32.exe
        29⤵
        Executes dropped EXE
        
        PID:4816
        
        C:\Windows\SysWOW64\Feella32.exe
        
        C:\Windows\system32\Feella32.exe
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:3492
        
        C:\Windows\SysWOW64\Fjdajhbi.exe
        
        C:\Windows\system32\Fjdajhbi.exe
        31⤵
        Executes dropped EXE
        
        PID:4340
        
        C:\Windows\SysWOW64\Fmejlcoj.exe
        
        C:\Windows\system32\Fmejlcoj.exe
        32⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4912
        
        C:\Windows\SysWOW64\Ghohdk32.exe
        
        C:\Windows\system32\Ghohdk32.exe
        33⤵
        Executes dropped EXE
        
        PID:3320
        
        C:\Windows\SysWOW64\Haeino32.exe
        
        C:\Windows\system32\Haeino32.exe
        34⤵
        Executes dropped EXE
        
        PID:400
        
        C:\Windows\SysWOW64\Ionbcb32.exe
        
        C:\Windows\system32\Ionbcb32.exe
        35⤵
        Executes dropped EXE
        
        PID:2492
        
        C:\Windows\SysWOW64\Iemdkl32.exe
        
        C:\Windows\system32\Iemdkl32.exe
        36⤵
        Executes dropped EXE
        
        PID:2724
        
        C:\Windows\SysWOW64\Jlblcdpf.exe
        
        C:\Windows\system32\Jlblcdpf.exe
        37⤵
        Executes dropped EXE
        
        PID:5004
        
        C:\Windows\SysWOW64\Koceep32.exe
        
        C:\Windows\system32\Koceep32.exe
        38⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3504
        
        C:\Windows\SysWOW64\Koeajo32.exe
        
        C:\Windows\system32\Koeajo32.exe
        39⤵
        Executes dropped EXE
        
        PID:2708
        
        C:\Windows\SysWOW64\Mejijcea.exe
        
        C:\Windows\system32\Mejijcea.exe
        40⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:5056
        
        C:\Windows\SysWOW64\Nbepdfnc.exe
        
        C:\Windows\system32\Nbepdfnc.exe
        41⤵
        Executes dropped EXE
        
        PID:4084
        
        C:\Windows\SysWOW64\Nfeepdbg.exe
        
        C:\Windows\system32\Nfeepdbg.exe
        42⤵
        Executes dropped EXE
        
        PID:1040
        
        C:\Windows\SysWOW64\Oeahap32.exe
        
        C:\Windows\system32\Oeahap32.exe
        43⤵
        Executes dropped EXE
        
        PID:1720
        
        C:\Windows\SysWOW64\Onjmjegg.exe
        
        C:\Windows\system32\Onjmjegg.exe
        44⤵
        Executes dropped EXE
        
        PID:3284
        
        C:\Windows\SysWOW64\Obgeqcnn.exe
        
        C:\Windows\system32\Obgeqcnn.exe
        45⤵
        Executes dropped EXE
        
        PID:408
        
        C:\Windows\SysWOW64\Pmdpok32.exe
        
        C:\Windows\system32\Pmdpok32.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1200
        
        C:\Windows\SysWOW64\Pbahgbfc.exe
        
        C:\Windows\system32\Pbahgbfc.exe
        47⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:336
        
        C:\Windows\SysWOW64\Ppeipfdm.exe
        
        C:\Windows\system32\Ppeipfdm.exe
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        
        PID:1340
        
        C:\Windows\SysWOW64\Pimmil32.exe
        
        C:\Windows\system32\Pimmil32.exe
        49⤵
        Executes dropped EXE
        
        PID:1968
        
        C:\Windows\SysWOW64\Qmkfoj32.exe
        
        C:\Windows\system32\Qmkfoj32.exe
        50⤵
        Executes dropped EXE
        
        PID:4788
        
        C:\Windows\SysWOW64\Algiaepd.exe
        
        C:\Windows\system32\Algiaepd.exe
        51⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:2284
        
        C:\Windows\SysWOW64\Bgafin32.exe
        
        C:\Windows\system32\Bgafin32.exe
        52⤵
        Executes dropped EXE
        
        PID:3760
        
        C:\Windows\SysWOW64\Blnoad32.exe
        
        C:\Windows\system32\Blnoad32.exe
        53⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4072
        
        C:\Windows\SysWOW64\Bckddn32.exe
        
        C:\Windows\system32\Bckddn32.exe
        54⤵
        Executes dropped EXE
        
        PID:2204
        
        C:\Windows\SysWOW64\Boaeioej.exe
        
        C:\Windows\system32\Boaeioej.exe
        55⤵
        Executes dropped EXE
        
        PID:1724
        
        C:\Windows\SysWOW64\Dnqaheai.exe
        
        C:\Windows\system32\Dnqaheai.exe
        56⤵
        Executes dropped EXE
        
        PID:2188
        
        C:\Windows\SysWOW64\Dqomdppm.exe
        
        C:\Windows\system32\Dqomdppm.exe
        57⤵
        Executes dropped EXE
        
        PID:4824
        
        C:\Windows\SysWOW64\Dfqogfjo.exe
        
        C:\Windows\system32\Dfqogfjo.exe
        58⤵
        Executes dropped EXE
        
        PID:1012
        
        C:\Windows\SysWOW64\Dgplai32.exe
        
        C:\Windows\system32\Dgplai32.exe
        59⤵
        Executes dropped EXE
        
        PID:2628
        
        C:\Windows\SysWOW64\Eodclj32.exe
        
        C:\Windows\system32\Eodclj32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:3384
        
        C:\Windows\SysWOW64\Fjanjb32.exe
        
        C:\Windows\system32\Fjanjb32.exe
        61⤵
        Executes dropped EXE
        
        PID:4296
        
        C:\Windows\SysWOW64\Gmimll32.exe
        
        C:\Windows\system32\Gmimll32.exe
        62⤵
        Executes dropped EXE
        
        PID:1212
        
        C:\Windows\SysWOW64\Gplbcgbg.exe
        
        C:\Windows\system32\Gplbcgbg.exe
        63⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:3784
        
        C:\Windows\SysWOW64\Gjagapbn.exe
        
        C:\Windows\system32\Gjagapbn.exe
        64⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:1512
        
        C:\Windows\SysWOW64\Hfhgfaha.exe
        
        C:\Windows\system32\Hfhgfaha.exe
        65⤵
        Executes dropped EXE
        
        PID:2788
        
        C:\Windows\SysWOW64\Hmbpbk32.exe
        
        C:\Windows\system32\Hmbpbk32.exe
        66⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\Hfkdkqeo.exe
        
        C:\Windows\system32\Hfkdkqeo.exe
        67⤵
        
        PID:1784
        
        C:\Windows\SysWOW64\Haeadi32.exe
        
        C:\Windows\system32\Haeadi32.exe
        68⤵
        
        PID:872
        
        C:\Windows\SysWOW64\Hoibmmpi.exe
        
        C:\Windows\system32\Hoibmmpi.exe
        69⤵
        Drops file in System32 directory
        
        PID:1492
        
        C:\Windows\SysWOW64\Ihfpabbd.exe
        
        C:\Windows\system32\Ihfpabbd.exe
        70⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\Igmjhnej.exe
        
        C:\Windows\system32\Igmjhnej.exe
        71⤵
        
        PID:112
        
        C:\Windows\SysWOW64\Jgdphm32.exe
        
        C:\Windows\system32\Jgdphm32.exe
        72⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\Jpmdabfb.exe
        
        C:\Windows\system32\Jpmdabfb.exe
        73⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\Kobnji32.exe
        
        C:\Windows\system32\Kobnji32.exe
        74⤵
        
        PID:4424
        
        C:\Windows\SysWOW64\Kknhjj32.exe
        
        C:\Windows\system32\Kknhjj32.exe
        75⤵
        
        PID:3300
        
        C:\Windows\SysWOW64\Kdfmcobk.exe
        
        C:\Windows\system32\Kdfmcobk.exe
        76⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5096
        
        C:\Windows\SysWOW64\Lnfgmc32.exe
        
        C:\Windows\system32\Lnfgmc32.exe
        77⤵
        
        PID:3444
        
        C:\Windows\SysWOW64\Mohplf32.exe
        
        C:\Windows\system32\Mohplf32.exe
        78⤵
        
        PID:932
        
        C:\Windows\SysWOW64\Mhpeelnd.exe
        
        C:\Windows\system32\Mhpeelnd.exe
        79⤵
        
        PID:1644
        
        C:\Windows\SysWOW64\Bhgeao32.exe
        
        C:\Windows\system32\Bhgeao32.exe
        80⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\Gjjjfkdj.exe
        
        C:\Windows\system32\Gjjjfkdj.exe
        81⤵
        Drops file in System32 directory
        
        PID:3756
        
        C:\Windows\SysWOW64\Gpkliaol.exe
        
        C:\Windows\system32\Gpkliaol.exe
        82⤵
        
        PID:2616
        
        C:\Windows\SysWOW64\Hjcllilo.exe
        
        C:\Windows\system32\Hjcllilo.exe
        83⤵
        
        PID:4532
        
        C:\Windows\SysWOW64\Hbanfk32.exe
        
        C:\Windows\system32\Hbanfk32.exe
        84⤵
        
        PID:404
        
        C:\Windows\SysWOW64\Imklncch.exe
        
        C:\Windows\system32\Imklncch.exe
        85⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\Iiffoc32.exe
        
        C:\Windows\system32\Iiffoc32.exe
        86⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\Ipqnknld.exe
        
        C:\Windows\system32\Ipqnknld.exe
        87⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\Ijfbhflj.exe
        
        C:\Windows\system32\Ijfbhflj.exe
        88⤵
        
        PID:2468
        
        C:\Windows\SysWOW64\Kdophj32.exe
        
        C:\Windows\system32\Kdophj32.exe
        89⤵
        
        PID:624
        
        C:\Windows\SysWOW64\Kpjjhj32.exe
        
        C:\Windows\system32\Kpjjhj32.exe
        90⤵
        
        PID:2704
        
        C:\Windows\SysWOW64\Lgdbedmc.exe
        
        C:\Windows\system32\Lgdbedmc.exe
        91⤵
        
        PID:1148
        
        C:\Windows\SysWOW64\Lmnjan32.exe
        
        C:\Windows\system32\Lmnjan32.exe
        92⤵
        Drops file in System32 directory
        
        PID:2336
        
        C:\Windows\SysWOW64\Lkgdfb32.exe
        
        C:\Windows\system32\Lkgdfb32.exe
        93⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\Lcbikd32.exe
        
        C:\Windows\system32\Lcbikd32.exe
        94⤵
        Modifies registry class
        
        PID:220
        
        C:\Windows\SysWOW64\Mgpaqbcf.exe
        
        C:\Windows\system32\Mgpaqbcf.exe
        95⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\Mphfjhjf.exe
        
        C:\Windows\system32\Mphfjhjf.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1992
        
        C:\Windows\SysWOW64\Mcklac32.exe
        
        C:\Windows\system32\Mcklac32.exe
        97⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\Nglala32.exe
        
        C:\Windows\system32\Nglala32.exe
        98⤵
        
        PID:3988
        
        C:\Windows\SysWOW64\Nddkaddm.exe
        
        C:\Windows\system32\Nddkaddm.exe
        99⤵
        Drops file in System32 directory
        
        PID:1496
        
        C:\Windows\SysWOW64\Nkncno32.exe
        
        C:\Windows\system32\Nkncno32.exe
        100⤵
        
        PID:2400
        
        C:\Windows\SysWOW64\Ndfgfd32.exe
        
        C:\Windows\system32\Ndfgfd32.exe
        101⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5048
        
        C:\Windows\SysWOW64\Okjbimal.exe
        
        C:\Windows\system32\Okjbimal.exe
        102⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Obdkfg32.exe
        
        C:\Windows\system32\Obdkfg32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5196
        
        C:\Windows\SysWOW64\Pcjaio32.exe
        
        C:\Windows\system32\Pcjaio32.exe
        104⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Peljha32.exe
        
        C:\Windows\system32\Peljha32.exe
        105⤵
        Modifies registry class
        
        PID:5296
        
        C:\Windows\SysWOW64\Pjhbah32.exe
        
        C:\Windows\system32\Pjhbah32.exe
        106⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5352
        
        C:\Windows\SysWOW64\Ajphagha.exe
        
        C:\Windows\system32\Ajphagha.exe
        107⤵
        
        PID:5404
        
        C:\Windows\SysWOW64\Aegidp32.exe
        
        C:\Windows\system32\Aegidp32.exe
        108⤵
        Drops file in System32 directory
        
        PID:5440
        
        C:\Windows\SysWOW64\Alaaajmb.exe
        
        C:\Windows\system32\Alaaajmb.exe
        109⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Abkjnd32.exe
        
        C:\Windows\system32\Abkjnd32.exe
        110⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Alcofi32.exe
        
        C:\Windows\system32\Alcofi32.exe
        111⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Blhhaigj.exe
        
        C:\Windows\system32\Blhhaigj.exe
        112⤵
        Drops file in System32 directory
        
        PID:5616
        
        C:\Windows\SysWOW64\Beqljn32.exe
        
        C:\Windows\system32\Beqljn32.exe
        113⤵
        
        PID:5664
        
        C:\Windows\SysWOW64\Bdfilkbb.exe
        
        C:\Windows\system32\Bdfilkbb.exe
        114⤵
        
        PID:5720
        
        C:\Windows\SysWOW64\Clfdcgkj.exe
        
        C:\Windows\system32\Clfdcgkj.exe
        115⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Cbqlpabf.exe
        
        C:\Windows\system32\Cbqlpabf.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5840
        
        C:\Windows\SysWOW64\Cecbgl32.exe
        
        C:\Windows\system32\Cecbgl32.exe
        117⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\Eceoanpo.exe
        
        C:\Windows\system32\Eceoanpo.exe
        118⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5960
        
        C:\Windows\SysWOW64\Edgkif32.exe
        
        C:\Windows\system32\Edgkif32.exe
        119⤵
        
        PID:6012
        
        C:\Windows\SysWOW64\Echkgnnl.exe
        
        C:\Windows\system32\Echkgnnl.exe
        120⤵
        Modifies registry class
        
        PID:6052
        
        C:\Windows\SysWOW64\Ehddpdlc.exe
        
        C:\Windows\system32\Ehddpdlc.exe
        121⤵
        Drops file in System32 directory
        
        PID:6132
        
        C:\Windows\SysWOW64\Femndhgh.exe
        
        C:\Windows\system32\Femndhgh.exe
        122⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5180
        
        C:\Windows\SysWOW64\Ffpjihee.exe
        
        C:\Windows\system32\Ffpjihee.exe
        123⤵
        
        PID:772
        
        C:\Windows\SysWOW64\Fhpckb32.exe
        
        C:\Windows\system32\Fhpckb32.exe
        124⤵
        
        PID:5264
        
        C:\Windows\SysWOW64\Fhbpqb32.exe
        
        C:\Windows\system32\Fhbpqb32.exe
        125⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Gkjocm32.exe
        
        C:\Windows\system32\Gkjocm32.exe
        126⤵
        
        PID:5432
        
        C:\Windows\SysWOW64\Gdcdlb32.exe
        
        C:\Windows\system32\Gdcdlb32.exe
        127⤵
        
        PID:5520
        
        C:\Windows\SysWOW64\Hbiakf32.exe
        
        C:\Windows\system32\Hbiakf32.exe
        128⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\Hmoehojj.exe
        
        C:\Windows\system32\Hmoehojj.exe
        129⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\Hbknqeha.exe
        
        C:\Windows\system32\Hbknqeha.exe
        130⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\Hmcocn32.exe
        
        C:\Windows\system32\Hmcocn32.exe
        131⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Heapmp32.exe
        
        C:\Windows\system32\Heapmp32.exe
        132⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Icbpkg32.exe
        
        C:\Windows\system32\Icbpkg32.exe
        133⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5796
        
        C:\Windows\SysWOW64\Iioicn32.exe
        
        C:\Windows\system32\Iioicn32.exe
        134⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Ipiaphop.exe
        
        C:\Windows\system32\Ipiaphop.exe
        135⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2116
        
        C:\Windows\SysWOW64\Iiaein32.exe
        
        C:\Windows\system32\Iiaein32.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5968
        
        C:\Windows\SysWOW64\Ipkneh32.exe
        
        C:\Windows\system32\Ipkneh32.exe
        137⤵
        
        PID:6024
        
        C:\Windows\SysWOW64\Iehfno32.exe
        
        C:\Windows\system32\Iehfno32.exe
        138⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Iciflfcd.exe
        
        C:\Windows\system32\Iciflfcd.exe
        139⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6140
        
        C:\Windows\SysWOW64\Iifodmak.exe
        
        C:\Windows\system32\Iifodmak.exe
        140⤵
        Modifies registry class
        
        PID:5188
        
        C:\Windows\SysWOW64\Imdgjlgb.exe
        
        C:\Windows\system32\Imdgjlgb.exe
        141⤵
        Modifies registry class
        
        PID:5244
        
        C:\Windows\SysWOW64\Jeolonem.exe
        
        C:\Windows\system32\Jeolonem.exe
        142⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\Jpdqlgdc.exe
        
        C:\Windows\system32\Jpdqlgdc.exe
        143⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Kfhkop32.exe
        
        C:\Windows\system32\Kfhkop32.exe
        144⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4384
        
        C:\Windows\SysWOW64\Kppphe32.exe
        
        C:\Windows\system32\Kppphe32.exe
        145⤵
        Drops file in System32 directory
        
        PID:5372
        
        C:\Windows\SysWOW64\Kmdqai32.exe
        
        C:\Windows\system32\Kmdqai32.exe
        146⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Kbaiip32.exe
        
        C:\Windows\system32\Kbaiip32.exe
        147⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Klimbf32.exe
        
        C:\Windows\system32\Klimbf32.exe
        148⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\Keabkkdg.exe
        
        C:\Windows\system32\Keabkkdg.exe
        149⤵
        
        PID:5608
        
        C:\Windows\SysWOW64\Kpgfhddn.exe
        
        C:\Windows\system32\Kpgfhddn.exe
        150⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\Llngmeja.exe
        
        C:\Windows\system32\Llngmeja.exe
        151⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Lfckjnjh.exe
        
        C:\Windows\system32\Lfckjnjh.exe
        152⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\Lplpcc32.exe
        
        C:\Windows\system32\Lplpcc32.exe
        153⤵
        Drops file in System32 directory
        
        PID:5924
        
        C:\Windows\SysWOW64\Lmppmh32.exe
        
        C:\Windows\system32\Lmppmh32.exe
        154⤵
        Drops file in System32 directory
        
        PID:6000
        
        C:\Windows\SysWOW64\Lbmheomi.exe
        
        C:\Windows\system32\Lbmheomi.exe
        155⤵
        
        PID:1500
        
        C:\Windows\SysWOW64\Mmgfmg32.exe
        
        C:\Windows\system32\Mmgfmg32.exe
        156⤵
        Drops file in System32 directory
        
        PID:1656
        
        C:\Windows\SysWOW64\Mphoob32.exe
        
        C:\Windows\system32\Mphoob32.exe
        157⤵
        
        PID:2820
        
        C:\Windows\SysWOW64\Mmnlnfcb.exe
        
        C:\Windows\system32\Mmnlnfcb.exe
        158⤵
        
        PID:4656
        
        C:\Windows\SysWOW64\Mgfqgkib.exe
        
        C:\Windows\system32\Mgfqgkib.exe
        159⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Mdjapphl.exe
        
        C:\Windows\system32\Mdjapphl.exe
        160⤵
        Modifies registry class
        
        PID:4856
        
        C:\Windows\SysWOW64\Nlefebfg.exe
        
        C:\Windows\system32\Nlefebfg.exe
        161⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2256
        
        C:\Windows\SysWOW64\Niifnf32.exe
        
        C:\Windows\system32\Niifnf32.exe
        162⤵
        Drops file in System32 directory
        
        PID:5420
        
        C:\Windows\SysWOW64\Nlhbja32.exe
        
        C:\Windows\system32\Nlhbja32.exe
        163⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Ncakglka.exe
        
        C:\Windows\system32\Ncakglka.exe
        164⤵
        
        PID:5624
        
        C:\Windows\SysWOW64\Nngoddkg.exe
        
        C:\Windows\system32\Nngoddkg.exe
        165⤵
        
        PID:5708
        
        C:\Windows\SysWOW64\Ndagao32.exe
        
        C:\Windows\system32\Ndagao32.exe
        166⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\Nllleapo.exe
        
        C:\Windows\system32\Nllleapo.exe
        167⤵
        
        PID:2792
        
        C:\Windows\SysWOW64\Nfeqnf32.exe
        
        C:\Windows\system32\Nfeqnf32.exe
        168⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Nloikqnl.exe
        
        C:\Windows\system32\Nloikqnl.exe
        169⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Opmaaodc.exe
        
        C:\Windows\system32\Opmaaodc.exe
        170⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Ojefjd32.exe
        
        C:\Windows\system32\Ojefjd32.exe
        171⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Ogkcihgj.exe
        
        C:\Windows\system32\Ogkcihgj.exe
        172⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\Pgpmdh32.exe
        
        C:\Windows\system32\Pgpmdh32.exe
        173⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Pqhammje.exe
        
        C:\Windows\system32\Pqhammje.exe
        174⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Pjaefc32.exe
        
        C:\Windows\system32\Pjaefc32.exe
        175⤵
        Drops file in System32 directory
        
        PID:3576
        
        C:\Windows\SysWOW64\Pmdkmnkd.exe
        
        C:\Windows\system32\Pmdkmnkd.exe
        176⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Pgiojf32.exe
        
        C:\Windows\system32\Pgiojf32.exe
        177⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\Pmfhbm32.exe
        
        C:\Windows\system32\Pmfhbm32.exe
        178⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\Agqekeeb.exe
        
        C:\Windows\system32\Agqekeeb.exe
        179⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Ammnclcj.exe
        
        C:\Windows\system32\Ammnclcj.exe
        180⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Acgfpf32.exe
        
        C:\Windows\system32\Acgfpf32.exe
        181⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5508
        
        C:\Windows\SysWOW64\Afhoaahg.exe
        
        C:\Windows\system32\Afhoaahg.exe
        182⤵
        
        PID:5800
        
        C:\Windows\SysWOW64\Aeiooi32.exe
        
        C:\Windows\system32\Aeiooi32.exe
        183⤵
        Modifies registry class
        
        PID:5832
        
        C:\Windows\SysWOW64\Afjlgafe.exe
        
        C:\Windows\system32\Afjlgafe.exe
        184⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Aekleind.exe
        
        C:\Windows\system32\Aekleind.exe
        185⤵
        
        PID:2836
        
        C:\Windows\SysWOW64\Ajhdmplk.exe
        
        C:\Windows\system32\Ajhdmplk.exe
        186⤵
        
        PID:2716
        
        C:\Windows\SysWOW64\Bcqife32.exe
        
        C:\Windows\system32\Bcqife32.exe
        187⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\Bnfmcn32.exe
        
        C:\Windows\system32\Bnfmcn32.exe
        188⤵
        Drops file in System32 directory
        
        PID:2968
        
        C:\Windows\SysWOW64\Bccfleqi.exe
        
        C:\Windows\system32\Bccfleqi.exe
        189⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5748
        
        C:\Windows\SysWOW64\Cfkenogb.exe
        
        C:\Windows\system32\Cfkenogb.exe
        190⤵
        
        PID:5788
        
        C:\Windows\SysWOW64\Cabfagee.exe
        
        C:\Windows\system32\Cabfagee.exe
        191⤵
        Drops file in System32 directory
        
        PID:2708
        
        C:\Windows\SysWOW64\Cagolf32.exe
        
        C:\Windows\system32\Cagolf32.exe
        192⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\Dajlafon.exe
        
        C:\Windows\system32\Dajlafon.exe
        193⤵
        
        PID:2772
        
        C:\Windows\SysWOW64\Dkdmpl32.exe
        
        C:\Windows\system32\Dkdmpl32.exe
        194⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\Dobffj32.exe
        
        C:\Windows\system32\Dobffj32.exe
        195⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5176
        
        C:\Windows\SysWOW64\Eeagnc32.exe
        
        C:\Windows\system32\Eeagnc32.exe
        196⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\Egbdekcg.exe
        
        C:\Windows\system32\Egbdekcg.exe
        197⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Edfdop32.exe
        
        C:\Windows\system32\Edfdop32.exe
        198⤵
        
        PID:1040
        
        C:\Windows\SysWOW64\Eolhlh32.exe
        
        C:\Windows\system32\Eolhlh32.exe
        199⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\Fddqpn32.exe
        
        C:\Windows\system32\Fddqpn32.exe
        200⤵
        
        PID:5380
        
        C:\Windows\SysWOW64\Gaadpqmp.exe
        
        C:\Windows\system32\Gaadpqmp.exe
        201⤵
        Drops file in System32 directory
        
        PID:2876
        
        C:\Windows\SysWOW64\Gkjhif32.exe
        
        C:\Windows\system32\Gkjhif32.exe
        202⤵
        
        PID:1724
        
        C:\Windows\SysWOW64\Gfomfo32.exe
        
        C:\Windows\system32\Gfomfo32.exe
        203⤵
        
        PID:4304
        
        C:\Windows\SysWOW64\Gklenf32.exe
        
        C:\Windows\system32\Gklenf32.exe
        204⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:184
        
        C:\Windows\SysWOW64\Gafmkp32.exe
        
        C:\Windows\system32\Gafmkp32.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:2472
        
        C:\Windows\SysWOW64\Hkobdeok.exe
        
        C:\Windows\system32\Hkobdeok.exe
        206⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\Hbhjqp32.exe
        
        C:\Windows\system32\Hbhjqp32.exe
        207⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\Hgebif32.exe
        
        C:\Windows\system32\Hgebif32.exe
        208⤵
        
        PID:3828
        
        C:\Windows\SysWOW64\Hnokeqll.exe
        
        C:\Windows\system32\Hnokeqll.exe
        209⤵
        
        PID:1476
        
        C:\Windows\SysWOW64\Hheoci32.exe
        
        C:\Windows\system32\Hheoci32.exe
        210⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4824
        
        C:\Windows\SysWOW64\Hbmclobc.exe
        
        C:\Windows\system32\Hbmclobc.exe
        211⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1360
        
        C:\Windows\SysWOW64\Hoadecal.exe
        
        C:\Windows\system32\Hoadecal.exe
        212⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3396
        
        C:\Windows\SysWOW64\Hdnlmj32.exe
        
        C:\Windows\system32\Hdnlmj32.exe
        213⤵
        
        PID:5052
        
        C:\Windows\SysWOW64\Ikjapden.exe
        
        C:\Windows\system32\Ikjapden.exe
        214⤵
        
        PID:1260
        
        C:\Windows\SysWOW64\Idbfhiko.exe
        
        C:\Windows\system32\Idbfhiko.exe
        215⤵
        Drops file in System32 directory
        
        PID:548
        
        C:\Windows\SysWOW64\Inkjao32.exe
        
        C:\Windows\system32\Inkjao32.exe
        216⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\Iomcqa32.exe
        
        C:\Windows\system32\Iomcqa32.exe
        217⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3112
        
        C:\Windows\SysWOW64\Jkkjfa32.exe
        
        C:\Windows\system32\Jkkjfa32.exe
        218⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:528
        
        C:\Windows\SysWOW64\Jiageecb.exe
        
        C:\Windows\system32\Jiageecb.exe
        219⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Kbpboj32.exe
        
        C:\Windows\system32\Kbpboj32.exe
        220⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\Kijjldkh.exe
        
        C:\Windows\system32\Kijjldkh.exe
        221⤵
        
        PID:544
        
        C:\Windows\SysWOW64\Kpdbhn32.exe
        
        C:\Windows\system32\Kpdbhn32.exe
        222⤵
        
        PID:2752
        
        C:\Windows\SysWOW64\Lnnidjcg.exe
        
        C:\Windows\system32\Lnnidjcg.exe
        223⤵
        
        PID:2804
        
        C:\Windows\SysWOW64\Lehaad32.exe
        
        C:\Windows\system32\Lehaad32.exe
        224⤵
        
        PID:4612

C:\Windows\SysWOW64\Loqejjad.exe
C:\Windows\system32\Loqejjad.exe
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
PID:4800
- C:\Windows\SysWOW64\Lejngd32.exe
  C:\Windows\system32\Lejngd32.exe
  2⤵
  PID:1784
- - C:\Windows\SysWOW64\Lppbdmig.exe
    C:\Windows\system32\Lppbdmig.exe
    3⤵
    PID:112
  - - C:\Windows\SysWOW64\Lemjlcgo.exe
      C:\Windows\system32\Lemjlcgo.exe
      4⤵
      PID:4268
    - - C:\Windows\SysWOW64\Mfejme32.exe
        
        C:\Windows\system32\Mfejme32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:5064
      - C:\Windows\SysWOW64\Mpnnek32.exe
        
        C:\Windows\system32\Mpnnek32.exe
        6⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\Nllekk32.exe
        
        C:\Windows\system32\Nllekk32.exe
        7⤵
        Modifies registry class
        
        PID:3300
        
        C:\Windows\SysWOW64\Ngaihcli.exe
        
        C:\Windows\system32\Ngaihcli.exe
        8⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Nhbfpl32.exe
        
        C:\Windows\system32\Nhbfpl32.exe
        9⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Ohgokknb.exe
        
        C:\Windows\system32\Ohgokknb.exe
        10⤵
        
        PID:6280
        
        C:\Windows\SysWOW64\Ocmchdmh.exe
        
        C:\Windows\system32\Ocmchdmh.exe
        11⤵
        
        PID:6324
        
        C:\Windows\SysWOW64\Ohjlqklp.exe
        
        C:\Windows\system32\Ohjlqklp.exe
        12⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Oocdme32.exe
        
        C:\Windows\system32\Oocdme32.exe
        13⤵
        Drops file in System32 directory
        
        PID:6412
        
        C:\Windows\SysWOW64\Oenljoji.exe
        
        C:\Windows\system32\Oenljoji.exe
        14⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Opcqgh32.exe
        
        C:\Windows\system32\Opcqgh32.exe
        15⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Oepipo32.exe
        
        C:\Windows\system32\Oepipo32.exe
        16⤵
        
        PID:6544
        
        C:\Windows\SysWOW64\Ppemmg32.exe
        
        C:\Windows\system32\Ppemmg32.exe
        17⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:6588
        
        C:\Windows\SysWOW64\Pebfen32.exe
        
        C:\Windows\system32\Pebfen32.exe
        18⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6624
        
        C:\Windows\SysWOW64\Pokjnd32.exe
        
        C:\Windows\system32\Pokjnd32.exe
        19⤵
        Modifies registry class
        
        PID:6668
        
        C:\Windows\SysWOW64\Pfdbknda.exe
        
        C:\Windows\system32\Pfdbknda.exe
        20⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Plokgh32.exe
        
        C:\Windows\system32\Plokgh32.exe
        21⤵
        
        PID:6760
        
        C:\Windows\SysWOW64\Pgdodq32.exe
        
        C:\Windows\system32\Pgdodq32.exe
        22⤵
        Modifies registry class
        
        PID:6800
        
        C:\Windows\SysWOW64\Plagmh32.exe
        
        C:\Windows\system32\Plagmh32.exe
        23⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Pfilfm32.exe
        
        C:\Windows\system32\Pfilfm32.exe
        24⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Pflikm32.exe
        
        C:\Windows\system32\Pflikm32.exe
        25⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Qfneamlf.exe
        
        C:\Windows\system32\Qfneamlf.exe
        26⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Qfpbfljd.exe
        
        C:\Windows\system32\Qfpbfljd.exe
        27⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Aoifoa32.exe
        
        C:\Windows\system32\Aoifoa32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7064
        
        C:\Windows\SysWOW64\Aqhcid32.exe
        
        C:\Windows\system32\Aqhcid32.exe
        29⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\Aichng32.exe
        
        C:\Windows\system32\Aichng32.exe
        30⤵
        
        PID:7156
        
        C:\Windows\SysWOW64\Acilkp32.exe
        
        C:\Windows\system32\Acilkp32.exe
        31⤵
        Modifies registry class
        
        PID:6172
        
        C:\Windows\SysWOW64\Ajcdhj32.exe
        
        C:\Windows\system32\Ajcdhj32.exe
        32⤵
        
        PID:3972
        
        C:\Windows\SysWOW64\Aqmldddb.exe
        
        C:\Windows\system32\Aqmldddb.exe
        33⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\Aihaifam.exe
        
        C:\Windows\system32\Aihaifam.exe
        34⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Acnefoac.exe
        
        C:\Windows\system32\Acnefoac.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6352
        
        C:\Windows\SysWOW64\Bjgncihp.exe
        
        C:\Windows\system32\Bjgncihp.exe
        36⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Bmfjodgc.exe
        
        C:\Windows\system32\Bmfjodgc.exe
        37⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Bfnnhj32.exe
        
        C:\Windows\system32\Bfnnhj32.exe
        38⤵
        
        PID:6552
        
        C:\Windows\SysWOW64\Bogcqpdd.exe
        
        C:\Windows\system32\Bogcqpdd.exe
        39⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6612
        
        C:\Windows\SysWOW64\Bmkcjd32.exe
        
        C:\Windows\system32\Bmkcjd32.exe
        40⤵
        Modifies registry class
        
        PID:6684
        
        C:\Windows\SysWOW64\Boipfp32.exe
        
        C:\Windows\system32\Boipfp32.exe
        41⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Bfchcijo.exe
        
        C:\Windows\system32\Bfchcijo.exe
        42⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:6808
        
        C:\Windows\SysWOW64\Bqhlpbjd.exe
        
        C:\Windows\system32\Bqhlpbjd.exe
        43⤵
        
        PID:6884
        
        C:\Windows\SysWOW64\Bidqddgp.exe
        
        C:\Windows\system32\Bidqddgp.exe
        44⤵
        
        PID:6960
        
        C:\Windows\SysWOW64\Bpniaool.exe
        
        C:\Windows\system32\Bpniaool.exe
        45⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Cifmjd32.exe
        
        C:\Windows\system32\Cifmjd32.exe
        46⤵
        
        PID:7080
        
        C:\Windows\SysWOW64\Cjejdglp.exe
        
        C:\Windows\system32\Cjejdglp.exe
        47⤵
        
        PID:7140
        
        C:\Windows\SysWOW64\Cgijnk32.exe
        
        C:\Windows\system32\Cgijnk32.exe
        48⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6208
        
        C:\Windows\SysWOW64\Cmfcfb32.exe
        
        C:\Windows\system32\Cmfcfb32.exe
        49⤵
        Drops file in System32 directory
        
        PID:6288
        
        C:\Windows\SysWOW64\Cjjcof32.exe
        
        C:\Windows\system32\Cjjcof32.exe
        50⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Cgndikgd.exe
        
        C:\Windows\system32\Cgndikgd.exe
        51⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Cmklaaek.exe
        
        C:\Windows\system32\Cmklaaek.exe
        52⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\Dgqqnjea.exe
        
        C:\Windows\system32\Dgqqnjea.exe
        53⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Daiegp32.exe
        
        C:\Windows\system32\Daiegp32.exe
        54⤵
        Drops file in System32 directory
        
        PID:6788
        
        C:\Windows\SysWOW64\Djaipe32.exe
        
        C:\Windows\system32\Djaipe32.exe
        55⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\Dpnbhl32.exe
        
        C:\Windows\system32\Dpnbhl32.exe
        56⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\Djcfee32.exe
        
        C:\Windows\system32\Djcfee32.exe
        57⤵
        Modifies registry class
        
        PID:7096
        
        C:\Windows\SysWOW64\Dannbogl.exe
        
        C:\Windows\system32\Dannbogl.exe
        58⤵
        
        PID:6168
        
        C:\Windows\SysWOW64\Diicfa32.exe
        
        C:\Windows\system32\Diicfa32.exe
        59⤵
        
        PID:6272
        
        C:\Windows\SysWOW64\Ddngdj32.exe
        
        C:\Windows\system32\Ddngdj32.exe
        60⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6348
        
        C:\Windows\SysWOW64\Dikpla32.exe
        
        C:\Windows\system32\Dikpla32.exe
        61⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6528
        
        C:\Windows\SysWOW64\Ehlpjikd.exe
        
        C:\Windows\system32\Ehlpjikd.exe
        62⤵
        Drops file in System32 directory
        
        PID:4584
        
        C:\Windows\SysWOW64\Emihbp32.exe
        
        C:\Windows\system32\Emihbp32.exe
        63⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Eagahnob.exe
        
        C:\Windows\system32\Eagahnob.exe
        64⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Efdjqeni.exe
        
        C:\Windows\system32\Efdjqeni.exe
        65⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\Ghdoae32.exe
        
        C:\Windows\system32\Ghdoae32.exe
        66⤵
        
        PID:6436
        
        C:\Windows\SysWOW64\Gielinlg.exe
        
        C:\Windows\system32\Gielinlg.exe
        67⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Gdjpff32.exe
        
        C:\Windows\system32\Gdjpff32.exe
        68⤵
        Modifies registry class
        
        PID:6904
        
        C:\Windows\SysWOW64\Gmcdolbn.exe
        
        C:\Windows\system32\Gmcdolbn.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7164
        
        C:\Windows\SysWOW64\Ghhhmebd.exe
        
        C:\Windows\system32\Ghhhmebd.exe
        70⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Gijedm32.exe
        
        C:\Windows\system32\Gijedm32.exe
        71⤵
        
        PID:3800
        
        C:\Windows\SysWOW64\Ghkebd32.exe
        
        C:\Windows\system32\Ghkebd32.exe
        72⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Gilajmfp.exe
        
        C:\Windows\system32\Gilajmfp.exe
        73⤵
        
        PID:6232
        
        C:\Windows\SysWOW64\Gpfjfg32.exe
        
        C:\Windows\system32\Gpfjfg32.exe
        74⤵
        Modifies registry class
        
        PID:6964
        
        C:\Windows\SysWOW64\Ggpbcaei.exe
        
        C:\Windows\system32\Ggpbcaei.exe
        75⤵
        Modifies registry class
        
        PID:932
        
        C:\Windows\SysWOW64\Hphglf32.exe
        
        C:\Windows\system32\Hphglf32.exe
        76⤵
        
        PID:1092
        
        C:\Windows\SysWOW64\Hgboiq32.exe
        
        C:\Windows\system32\Hgboiq32.exe
        77⤵
        Modifies registry class
        
        PID:7052
        
        C:\Windows\SysWOW64\Hahcfi32.exe
        
        C:\Windows\system32\Hahcfi32.exe
        78⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:7200
        
        C:\Windows\SysWOW64\Ijlkqj32.exe
        
        C:\Windows\system32\Ijlkqj32.exe
        79⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Jglkfmmi.exe
        
        C:\Windows\system32\Jglkfmmi.exe
        80⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Jqdoob32.exe
        
        C:\Windows\system32\Jqdoob32.exe
        81⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Jdbheajp.exe
        
        C:\Windows\system32\Jdbheajp.exe
        82⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Jjopmh32.exe
        
        C:\Windows\system32\Jjopmh32.exe
        83⤵
        
        PID:7460
        
        C:\Windows\SysWOW64\Jdddjq32.exe
        
        C:\Windows\system32\Jdddjq32.exe
        84⤵
        Drops file in System32 directory
        
        PID:7508
        
        C:\Windows\SysWOW64\Kkomgkoj.exe
        
        C:\Windows\system32\Kkomgkoj.exe
        85⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Kqkeoama.exe
        
        C:\Windows\system32\Kqkeoama.exe
        86⤵
        
        PID:7600
        
        C:\Windows\SysWOW64\Kgenlldo.exe
        
        C:\Windows\system32\Kgenlldo.exe
        87⤵
        Drops file in System32 directory
        
        PID:7644
        
        C:\Windows\SysWOW64\Kbkaiddd.exe
        
        C:\Windows\system32\Kbkaiddd.exe
        88⤵
        
        PID:7692
        
        C:\Windows\SysWOW64\Kghjakbl.exe
        
        C:\Windows\system32\Kghjakbl.exe
        89⤵
        
        PID:7732
        
        C:\Windows\SysWOW64\Knabne32.exe
        
        C:\Windows\system32\Knabne32.exe
        90⤵
        Modifies registry class
        
        PID:7768
        
        C:\Windows\SysWOW64\Kiggln32.exe
        
        C:\Windows\system32\Kiggln32.exe
        91⤵
        Modifies registry class
        
        PID:7812
        
        C:\Windows\SysWOW64\Kbpkdd32.exe
        
        C:\Windows\system32\Kbpkdd32.exe
        92⤵
        Modifies registry class
        
        PID:7856
        
        C:\Windows\SysWOW64\Kijcanhl.exe
        
        C:\Windows\system32\Kijcanhl.exe
        93⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Kjkpif32.exe
        
        C:\Windows\system32\Kjkpif32.exe
        94⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Kepdfo32.exe
        
        C:\Windows\system32\Kepdfo32.exe
        95⤵
        
        PID:7988
        
        C:\Windows\SysWOW64\Lkjlciem.exe
        
        C:\Windows\system32\Lkjlciem.exe
        96⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Lbddpclj.exe
        
        C:\Windows\system32\Lbddpclj.exe
        97⤵
        
        PID:8072
        
        C:\Windows\SysWOW64\Lgamhjja.exe
        
        C:\Windows\system32\Lgamhjja.exe
        98⤵
        
        PID:8120
        
        C:\Windows\SysWOW64\Lbgaecjg.exe
        
        C:\Windows\system32\Lbgaecjg.exe
        99⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Lgcjmjho.exe
        
        C:\Windows\system32\Lgcjmjho.exe
        100⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Legjgn32.exe
        
        C:\Windows\system32\Legjgn32.exe
        101⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\Llabchoe.exe
        
        C:\Windows\system32\Llabchoe.exe
        102⤵
        
        PID:348
        
        C:\Windows\SysWOW64\Lejgln32.exe
        
        C:\Windows\system32\Lejgln32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3040
        
        C:\Windows\SysWOW64\Lelcbmcc.exe
        
        C:\Windows\system32\Lelcbmcc.exe
        104⤵
        
        PID:3008
        
        C:\Windows\SysWOW64\Mbpdkabl.exe
        
        C:\Windows\system32\Mbpdkabl.exe
        105⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Mhmmchpd.exe
        
        C:\Windows\system32\Mhmmchpd.exe
        106⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Mngepb32.exe
        
        C:\Windows\system32\Mngepb32.exe
        107⤵
        
        PID:7456
        
        C:\Windows\SysWOW64\Mniafbfn.exe
        
        C:\Windows\system32\Mniafbfn.exe
        108⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Miofcked.exe
        
        C:\Windows\system32\Miofcked.exe
        109⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Mjpbkc32.exe
        
        C:\Windows\system32\Mjpbkc32.exe
        110⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7672
        
        C:\Windows\SysWOW64\Meefhl32.exe
        
        C:\Windows\system32\Meefhl32.exe
        111⤵
        
        PID:7844
        
        C:\Windows\SysWOW64\Nliakd32.exe
        
        C:\Windows\system32\Nliakd32.exe
        112⤵
        Modifies registry class
        
        PID:7876
        
        C:\Windows\SysWOW64\Naejcl32.exe
        
        C:\Windows\system32\Naejcl32.exe
        113⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Nlknqd32.exe
        
        C:\Windows\system32\Nlknqd32.exe
        114⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Oeccijoh.exe
        
        C:\Windows\system32\Oeccijoh.exe
        115⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\Oajcnkdl.exe
        
        C:\Windows\system32\Oajcnkdl.exe
        116⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Okbhgq32.exe
        
        C:\Windows\system32\Okbhgq32.exe
        117⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Ooqqmoac.exe
        
        C:\Windows\system32\Ooqqmoac.exe
        118⤵
        
        PID:7240
        
        C:\Windows\SysWOW64\Oejijiip.exe
        
        C:\Windows\system32\Oejijiip.exe
        119⤵
        
        PID:7272
        
        C:\Windows\SysWOW64\Okgabpgg.exe
        
        C:\Windows\system32\Okgabpgg.exe
        120⤵
        Drops file in System32 directory
        
        PID:7292
        
        C:\Windows\SysWOW64\Oemephgn.exe
        
        C:\Windows\system32\Oemephgn.exe
        121⤵
        Modifies registry class
        
        PID:7408
        
        C:\Windows\SysWOW64\Olgnlb32.exe
        
        C:\Windows\system32\Olgnlb32.exe
        122⤵
        
        PID:7444
        
        C:\Windows\SysWOW64\Pacfdila.exe
        
        C:\Windows\system32\Pacfdila.exe
        123⤵
        Drops file in System32 directory
        
        PID:2936
        
        C:\Windows\SysWOW64\Qocfjlan.exe
        
        C:\Windows\system32\Qocfjlan.exe
        124⤵
        Modifies registry class
        
        PID:7776
        
        C:\Windows\SysWOW64\Aoofej32.exe
        
        C:\Windows\system32\Aoofej32.exe
        125⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:496
        
        C:\Windows\SysWOW64\Akffjkme.exe
        
        C:\Windows\system32\Akffjkme.exe
        126⤵
        
        PID:4852
        
        C:\Windows\SysWOW64\Bjgghc32.exe
        
        C:\Windows\system32\Bjgghc32.exe
        127⤵
        
        PID:3772
        
        C:\Windows\SysWOW64\Bcokah32.exe
        
        C:\Windows\system32\Bcokah32.exe
        128⤵
        
        PID:8056
        
        C:\Windows\SysWOW64\Blhpjnbe.exe
        
        C:\Windows\system32\Blhpjnbe.exe
        129⤵
        
        PID:8148
        
        C:\Windows\SysWOW64\Bbdhbepl.exe
        
        C:\Windows\system32\Bbdhbepl.exe
        130⤵
        
        PID:3348
        
        C:\Windows\SysWOW64\Bmjlpnpb.exe
        
        C:\Windows\system32\Bmjlpnpb.exe
        131⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\Bcfabgel.exe
        
        C:\Windows\system32\Bcfabgel.exe
        132⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4532
        
        C:\Windows\SysWOW64\Ckaffjbg.exe
        
        C:\Windows\system32\Ckaffjbg.exe
        133⤵
        Drops file in System32 directory
        
        PID:7332
        
        C:\Windows\SysWOW64\Ciefpn32.exe
        
        C:\Windows\system32\Ciefpn32.exe
        134⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\Cooolhin.exe
        
        C:\Windows\system32\Cooolhin.exe
        135⤵
        Drops file in System32 directory
        
        PID:2400
        
        C:\Windows\SysWOW64\Cjecjahd.exe
        
        C:\Windows\system32\Cjecjahd.exe
        136⤵
        Modifies registry class
        
        PID:7588
        
        C:\Windows\SysWOW64\Ckfpai32.exe
        
        C:\Windows\system32\Ckfpai32.exe
        137⤵
        
        PID:1808
        
        C:\Windows\SysWOW64\Cbphncfo.exe
        
        C:\Windows\system32\Cbphncfo.exe
        138⤵
        Drops file in System32 directory
        
        PID:5196
        
        C:\Windows\SysWOW64\Cijpkmml.exe
        
        C:\Windows\system32\Cijpkmml.exe
        139⤵
        
        PID:7760
        
        C:\Windows\SysWOW64\Cbbdcc32.exe
        
        C:\Windows\system32\Cbbdcc32.exe
        140⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Ckkilhjm.exe
        
        C:\Windows\system32\Ckkilhjm.exe
        141⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2684
        
        C:\Windows\SysWOW64\Cfqmjajc.exe
        
        C:\Windows\system32\Cfqmjajc.exe
        142⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Dkmebh32.exe
        
        C:\Windows\system32\Dkmebh32.exe
        143⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Dfcjoa32.exe
        
        C:\Windows\system32\Dfcjoa32.exe
        144⤵
        Modifies registry class
        
        PID:8112
        
        C:\Windows\SysWOW64\Dkpbgh32.exe
        
        C:\Windows\system32\Dkpbgh32.exe
        145⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\Dfefeq32.exe
        
        C:\Windows\system32\Dfefeq32.exe
        146⤵
        
        PID:5572
        
        C:\Windows\SysWOW64\Dmooak32.exe
        
        C:\Windows\system32\Dmooak32.exe
        147⤵
        
        PID:4280
        
        C:\Windows\SysWOW64\Dblgja32.exe
        
        C:\Windows\system32\Dblgja32.exe
        148⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Efoiko32.exe
        
        C:\Windows\system32\Efoiko32.exe
        149⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:7476
        
        C:\Windows\SysWOW64\Epgndedc.exe
        
        C:\Windows\system32\Epgndedc.exe
        150⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Eiobmjkd.exe
        
        C:\Windows\system32\Eiobmjkd.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5452
        
        C:\Windows\SysWOW64\Efccfojn.exe
        
        C:\Windows\system32\Efccfojn.exe
        152⤵
        
        PID:5544
        
        C:\Windows\SysWOW64\Emmkci32.exe
        
        C:\Windows\system32\Emmkci32.exe
        153⤵
        
        PID:7852
        
        C:\Windows\SysWOW64\Ecgcpc32.exe
        
        C:\Windows\system32\Ecgcpc32.exe
        154⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Ejaklmpd.exe
        
        C:\Windows\system32\Ejaklmpd.exe
        155⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7924
        
        C:\Windows\SysWOW64\Fifhmi32.exe
        
        C:\Windows\system32\Fifhmi32.exe
        156⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Fpggkbfq.exe
        
        C:\Windows\system32\Fpggkbfq.exe
        157⤵
        Drops file in System32 directory
        
        PID:5764
        
        C:\Windows\SysWOW64\Fjmkhkff.exe
        
        C:\Windows\system32\Fjmkhkff.exe
        158⤵
        
        PID:5736
        
        C:\Windows\SysWOW64\Fbhplnca.exe
        
        C:\Windows\system32\Fbhplnca.exe
        159⤵
        Drops file in System32 directory
        
        PID:5048
        
        C:\Windows\SysWOW64\Gplpfb32.exe
        
        C:\Windows\system32\Gplpfb32.exe
        160⤵
        
        PID:7720
        
        C:\Windows\SysWOW64\Gideogil.exe
        
        C:\Windows\system32\Gideogil.exe
        161⤵
        
        PID:7652
        
        C:\Windows\SysWOW64\Gbmigm32.exe
        
        C:\Windows\system32\Gbmigm32.exe
        162⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\Gdleap32.exe
        
        C:\Windows\system32\Gdleap32.exe
        163⤵
        
        PID:5440
        
        C:\Windows\SysWOW64\Giinjg32.exe
        
        C:\Windows\system32\Giinjg32.exe
        164⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\Gpcffalc.exe
        
        C:\Windows\system32\Gpcffalc.exe
        165⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Ggmock32.exe
        
        C:\Windows\system32\Ggmock32.exe
        166⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Gmggpekm.exe
        
        C:\Windows\system32\Gmggpekm.exe
        167⤵
        Drops file in System32 directory
        
        PID:5144
        
        C:\Windows\SysWOW64\Gbcohl32.exe
        
        C:\Windows\system32\Gbcohl32.exe
        168⤵
        
        PID:7388
        
        C:\Windows\SysWOW64\Hdclbopg.exe
        
        C:\Windows\system32\Hdclbopg.exe
        169⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\Hdehho32.exe
        
        C:\Windows\system32\Hdehho32.exe
        170⤵
        Modifies registry class
        
        PID:3816
        
        C:\Windows\SysWOW64\Hdjbcnjo.exe
        
        C:\Windows\system32\Hdjbcnjo.exe
        171⤵
        
        PID:5240
        
        C:\Windows\SysWOW64\Hlefgphj.exe
        
        C:\Windows\system32\Hlefgphj.exe
        172⤵
        Modifies registry class
        
        PID:5664
        
        C:\Windows\SysWOW64\Icoodj32.exe
        
        C:\Windows\system32\Icoodj32.exe
        173⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6004
        
        C:\Windows\SysWOW64\Iiigqdfd.exe
        
        C:\Windows\system32\Iiigqdfd.exe
        174⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3736
        
        C:\Windows\SysWOW64\Idoknmfj.exe
        
        C:\Windows\system32\Idoknmfj.exe
        175⤵
        
        PID:6052
        
        C:\Windows\SysWOW64\Iildfd32.exe
        
        C:\Windows\system32\Iildfd32.exe
        176⤵
        Modifies registry class
        
        PID:1196
        
        C:\Windows\SysWOW64\Idahcm32.exe
        
        C:\Windows\system32\Idahcm32.exe
        177⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Injmlbkh.exe
        
        C:\Windows\system32\Injmlbkh.exe
        178⤵
        
        PID:2892
        
        C:\Windows\SysWOW64\Igbaeh32.exe
        
        C:\Windows\system32\Igbaeh32.exe
        179⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Idfaolpb.exe
        
        C:\Windows\system32\Idfaolpb.exe
        180⤵
        Drops file in System32 directory
        
        PID:7800
        
        C:\Windows\SysWOW64\Jkbfafel.exe
        
        C:\Windows\system32\Jkbfafel.exe
        181⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Jgigfg32.exe
        
        C:\Windows\system32\Jgigfg32.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7928
        
        C:\Windows\SysWOW64\Mndapl32.exe
        
        C:\Windows\system32\Mndapl32.exe
        183⤵
        Modifies registry class
        
        PID:1748
        
        C:\Windows\SysWOW64\Mcqjhc32.exe
        
        C:\Windows\system32\Mcqjhc32.exe
        184⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Mnfnfl32.exe
        
        C:\Windows\system32\Mnfnfl32.exe
        185⤵
        
        PID:6140
        
        C:\Windows\SysWOW64\Mccfnc32.exe
        
        C:\Windows\system32\Mccfnc32.exe
        186⤵
        
        PID:1076
        
        C:\Windows\SysWOW64\Mjmokmji.exe
        
        C:\Windows\system32\Mjmokmji.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3880
        
        C:\Windows\SysWOW64\Mgaoda32.exe
        
        C:\Windows\system32\Mgaoda32.exe
        188⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\Mmnglh32.exe
        
        C:\Windows\system32\Mmnglh32.exe
        189⤵
        Modifies registry class
        
        PID:5424
        
        C:\Windows\SysWOW64\Mchpibng.exe
        
        C:\Windows\system32\Mchpibng.exe
        190⤵
        Modifies registry class
        
        PID:5816
        
        C:\Windows\SysWOW64\Nnmdfknm.exe
        
        C:\Windows\system32\Nnmdfknm.exe
        191⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Nnpalk32.exe
        
        C:\Windows\system32\Nnpalk32.exe
        192⤵
        Modifies registry class
        
        PID:5892
        
        C:\Windows\SysWOW64\Neiiiecg.exe
        
        C:\Windows\system32\Neiiiecg.exe
        193⤵
        
        PID:5464
        
        C:\Windows\SysWOW64\Nhjbjp32.exe
        
        C:\Windows\system32\Nhjbjp32.exe
        194⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Ndaboafl.exe
        
        C:\Windows\system32\Ndaboafl.exe
        195⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Neqoidmo.exe
        
        C:\Windows\system32\Neqoidmo.exe
        196⤵
        
        PID:1916
        
        C:\Windows\SysWOW64\Oeclockl.exe
        
        C:\Windows\system32\Oeclockl.exe
        197⤵
        Modifies registry class
        
        PID:6100
        
        C:\Windows\SysWOW64\Ojbamj32.exe
        
        C:\Windows\system32\Ojbamj32.exe
        198⤵
        
        PID:2332
        
        C:\Windows\SysWOW64\Ohfafn32.exe
        
        C:\Windows\system32\Ohfafn32.exe
        199⤵
        
        PID:1036
        
        C:\Windows\SysWOW64\Oejbpb32.exe
        
        C:\Windows\system32\Oejbpb32.exe
        200⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\Ohkkanbe.exe
        
        C:\Windows\system32\Ohkkanbe.exe
        201⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2016
        
        C:\Windows\SysWOW64\Pdalfo32.exe
        
        C:\Windows\system32\Pdalfo32.exe
        202⤵
        
        PID:3060
        
        C:\Windows\SysWOW64\Pogpcghp.exe
        
        C:\Windows\system32\Pogpcghp.exe
        203⤵
        Drops file in System32 directory
        
        PID:1632
        
        C:\Windows\SysWOW64\Phodlm32.exe
        
        C:\Windows\system32\Phodlm32.exe
        204⤵
        
        PID:4400
        
        C:\Windows\SysWOW64\Pmlmdd32.exe
        
        C:\Windows\system32\Pmlmdd32.exe
        205⤵
        Modifies registry class
        
        PID:5216
        
        C:\Windows\SysWOW64\Pdfeandd.exe
        
        C:\Windows\system32\Pdfeandd.exe
        206⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Pmoijcje.exe
        
        C:\Windows\system32\Pmoijcje.exe
        207⤵
        
        PID:3820
        
        C:\Windows\SysWOW64\Phdngljk.exe
        
        C:\Windows\system32\Phdngljk.exe
        208⤵
        
        PID:4856
        
        C:\Windows\SysWOW64\Palbpb32.exe
        
        C:\Windows\system32\Palbpb32.exe
        209⤵
        Modifies registry class
        
        PID:5556
        
        C:\Windows\SysWOW64\Aeodapcl.exe
        
        C:\Windows\system32\Aeodapcl.exe
        210⤵
        
        PID:5232
        
        C:\Windows\SysWOW64\Anjifbpg.exe
        
        C:\Windows\system32\Anjifbpg.exe
        211⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Akniofoa.exe
        
        C:\Windows\system32\Akniofoa.exe
        212⤵
        Modifies registry class
        
        PID:7484
        
        C:\Windows\SysWOW64\Ahbjij32.exe
        
        C:\Windows\system32\Ahbjij32.exe
        213⤵
        
        PID:5260
        
        C:\Windows\SysWOW64\Akccje32.exe
        
        C:\Windows\system32\Akccje32.exe
        214⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\Baohmo32.exe
        
        C:\Windows\system32\Baohmo32.exe
        215⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\Bkgleegf.exe
        
        C:\Windows\system32\Bkgleegf.exe
        216⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\Boeelcmm.exe
        
        C:\Windows\system32\Boeelcmm.exe
        217⤵
        Drops file in System32 directory
        
        PID:2356
        
        C:\Windows\SysWOW64\Bohbackj.exe
        
        C:\Windows\system32\Bohbackj.exe
        218⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Bkobfdao.exe
        
        C:\Windows\system32\Bkobfdao.exe
        219⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Colklb32.exe
        
        C:\Windows\system32\Colklb32.exe
        220⤵
        Drops file in System32 directory
        
        PID:4192
        
        C:\Windows\SysWOW64\Cdicdi32.exe
        
        C:\Windows\system32\Cdicdi32.exe
        221⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\Cfipol32.exe
        
        C:\Windows\system32\Cfipol32.exe
        222⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7656
        
        C:\Windows\SysWOW64\Coadgacp.exe
        
        C:\Windows\system32\Coadgacp.exe
        223⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Cfkmdl32.exe
        
        C:\Windows\system32\Cfkmdl32.exe
        224⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\Cbbnim32.exe
        
        C:\Windows\system32\Cbbnim32.exe
        225⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Ckjbbbga.exe
        
        C:\Windows\system32\Ckjbbbga.exe
        226⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Dmjole32.exe
        
        C:\Windows\system32\Dmjole32.exe
        227⤵
        
        PID:3320
        
        C:\Windows\SysWOW64\Dbfgdllk.exe
        
        C:\Windows\system32\Dbfgdllk.exe
        228⤵
        
        PID:5508
        
        C:\Windows\SysWOW64\Dkokma32.exe
        
        C:\Windows\system32\Dkokma32.exe
        229⤵
        
        PID:5672
        
        C:\Windows\SysWOW64\Dkahba32.exe
        
        C:\Windows\system32\Dkahba32.exe
        230⤵
        
        PID:3884
        
        C:\Windows\SysWOW64\Dfglpjqo.exe
        
        C:\Windows\system32\Dfglpjqo.exe
        231⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5516
        
        C:\Windows\SysWOW64\Dbnmek32.exe
        
        C:\Windows\system32\Dbnmek32.exe
        232⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\Dmcabd32.exe
        
        C:\Windows\system32\Dmcabd32.exe
        233⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Ebpjjk32.exe
        
        C:\Windows\system32\Ebpjjk32.exe
        234⤵
        
        PID:1348
        
        C:\Windows\SysWOW64\Emenhcdf.exe
        
        C:\Windows\system32\Emenhcdf.exe
        235⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Engjol32.exe
        
        C:\Windows\system32\Engjol32.exe
        236⤵
        Modifies registry class
        
        PID:3724
        
        C:\Windows\SysWOW64\Fnipliip.exe
        
        C:\Windows\system32\Fnipliip.exe
        237⤵
        
        PID:5476
        
        C:\Windows\SysWOW64\Fmjqjqao.exe
        
        C:\Windows\system32\Fmjqjqao.exe
        238⤵
        
        PID:5852
        
        C:\Windows\SysWOW64\Gnlmai32.exe
        
        C:\Windows\system32\Gnlmai32.exe
        239⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5284
        
        C:\Windows\SysWOW64\Gifjjacn.exe
        
        C:\Windows\system32\Gifjjacn.exe
        240⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\Gppcfk32.exe
        
        C:\Windows\system32\Gppcfk32.exe
        241⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\Gihgoq32.exe
        
        C:\Windows\system32\Gihgoq32.exe
        242⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\Gflhie32.exe
        
        C:\Windows\system32\Gflhie32.exe
        243⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5504
        
        C:\Windows\SysWOW64\Hlipal32.exe
        
        C:\Windows\system32\Hlipal32.exe
        244⤵
        Drops file in System32 directory
        
        PID:5940
        
        C:\Windows\SysWOW64\Hmhmko32.exe
        
        C:\Windows\system32\Hmhmko32.exe
        245⤵
        
        PID:2344
        
        C:\Windows\SysWOW64\Hbeece32.exe
        
        C:\Windows\system32\Hbeece32.exe
        246⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Hbjonepq.exe
        
        C:\Windows\system32\Hbjonepq.exe
        247⤵
        Modifies registry class
        
        PID:2156
        
        C:\Windows\SysWOW64\Hblkddmn.exe
        
        C:\Windows\system32\Hblkddmn.exe
        248⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Imbpam32.exe
        
        C:\Windows\system32\Imbpam32.exe
        249⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1040
        
        C:\Windows\SysWOW64\Ioeineap.exe
        
        C:\Windows\system32\Ioeineap.exe
        250⤵
        
        PID:4024
        
        C:\Windows\SysWOW64\Icfnjcec.exe
        
        C:\Windows\system32\Icfnjcec.exe
        251⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\Ilnbch32.exe
        
        C:\Windows\system32\Ilnbch32.exe
        252⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\Ichkpb32.exe
        
        C:\Windows\system32\Ichkpb32.exe
        253⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\Jookdcie.exe
        
        C:\Windows\system32\Jookdcie.exe
        254⤵
        Modifies registry class
        
        PID:3672
        
        C:\Windows\SysWOW64\Jcmdkbok.exe
        
        C:\Windows\system32\Jcmdkbok.exe
        255⤵
        
        PID:3760
        
        C:\Windows\SysWOW64\Jcoapami.exe
        
        C:\Windows\system32\Jcoapami.exe
        256⤵
        Drops file in System32 directory
        
        PID:4304
        
        C:\Windows\SysWOW64\Jofaeb32.exe
        
        C:\Windows\system32\Jofaeb32.exe
        257⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Jngbcj32.exe
        
        C:\Windows\system32\Jngbcj32.exe
        258⤵
        
        PID:5304
        
        C:\Windows\SysWOW64\Jgoflpal.exe
        
        C:\Windows\system32\Jgoflpal.exe
        259⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Knioij32.exe
        
        C:\Windows\system32\Knioij32.exe
        260⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:1880
        
        C:\Windows\SysWOW64\Kcfgaq32.exe
        
        C:\Windows\system32\Kcfgaq32.exe
        261⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Kloljf32.exe
        
        C:\Windows\system32\Kloljf32.exe
        262⤵
        
        PID:400
        
        C:\Windows\SysWOW64\Knnhdied.exe
        
        C:\Windows\system32\Knnhdied.exe
        263⤵
        
        PID:3508
        
        C:\Windows\SysWOW64\Kckqlpck.exe
        
        C:\Windows\system32\Kckqlpck.exe
        264⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Klceeejl.exe
        
        C:\Windows\system32\Klceeejl.exe
        265⤵
        
        PID:2712
        
        C:\Windows\SysWOW64\Kcmmap32.exe
        
        C:\Windows\system32\Kcmmap32.exe
        266⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\Knbaoh32.exe
        
        C:\Windows\system32\Knbaoh32.exe
        267⤵
        
        PID:2204
        
        C:\Windows\SysWOW64\Ljloii32.exe
        
        C:\Windows\system32\Ljloii32.exe
        268⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\Lnnakg32.exe
        
        C:\Windows\system32\Lnnakg32.exe
        269⤵
        
        PID:1720
        
        C:\Windows\SysWOW64\Lopmbomp.exe
        
        C:\Windows\system32\Lopmbomp.exe
        270⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\Mfjfoidl.exe
        
        C:\Windows\system32\Mfjfoidl.exe
        271⤵
        Modifies registry class
        
        PID:2440
        
        C:\Windows\SysWOW64\Mncjffbl.exe
        
        C:\Windows\system32\Mncjffbl.exe
        272⤵
        
        PID:2700
        
        C:\Windows\SysWOW64\Mqdcga32.exe
        
        C:\Windows\system32\Mqdcga32.exe
        273⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\Moiphnde.exe
        
        C:\Windows\system32\Moiphnde.exe
        274⤵
        Modifies registry class
        
        PID:5704
        
        C:\Windows\SysWOW64\Mfchehla.exe
        
        C:\Windows\system32\Mfchehla.exe
        275⤵
        
        PID:4988
        
        C:\Windows\SysWOW64\Mqhmbqlh.exe
        
        C:\Windows\system32\Mqhmbqlh.exe
        276⤵
        
        PID:1212
        
        C:\Windows\SysWOW64\Ngbeok32.exe
        
        C:\Windows\system32\Ngbeok32.exe
        277⤵
        
        PID:3112
        
        C:\Windows\SysWOW64\Nnmmleja.exe
        
        C:\Windows\system32\Nnmmleja.exe
        278⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:4128
        
        C:\Windows\SysWOW64\Ncifdlii.exe
        
        C:\Windows\system32\Ncifdlii.exe
        279⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4968
        
        C:\Windows\SysWOW64\Nnojad32.exe
        
        C:\Windows\system32\Nnojad32.exe
        280⤵
        Modifies registry class
        
        PID:2536
        
        C:\Windows\SysWOW64\Nclbjk32.exe
        
        C:\Windows\system32\Nclbjk32.exe
        281⤵
        
        PID:4612
        
        C:\Windows\SysWOW64\Ngikpjml.exe
        
        C:\Windows\system32\Ngikpjml.exe
        282⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\Nmfchq32.exe
        
        C:\Windows\system32\Nmfchq32.exe
        283⤵
        
        PID:948
        
        C:\Windows\SysWOW64\Nglhei32.exe
        
        C:\Windows\system32\Nglhei32.exe
        284⤵
        
        PID:1616
        
        C:\Windows\SysWOW64\Nmipnp32.exe
        
        C:\Windows\system32\Nmipnp32.exe
        285⤵
        Drops file in System32 directory
        
        PID:1260
        
        C:\Windows\SysWOW64\Ogndki32.exe
        
        C:\Windows\system32\Ogndki32.exe
        286⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\Onhmhc32.exe
        
        C:\Windows\system32\Onhmhc32.exe
        287⤵
        
        PID:5744
        
        C:\Windows\SysWOW64\Ogqaqigd.exe
        
        C:\Windows\system32\Ogqaqigd.exe
        288⤵
        
        PID:4800
        
        C:\Windows\SysWOW64\Ommjipel.exe
        
        C:\Windows\system32\Ommjipel.exe
        289⤵
        
        PID:6204
        
        C:\Windows\SysWOW64\Onmfcb32.exe
        
        C:\Windows\system32\Onmfcb32.exe
        290⤵
        
        PID:5184
        
        C:\Windows\SysWOW64\Oanodnip.exe
        
        C:\Windows\system32\Oanodnip.exe
        291⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Ojfcmc32.exe
        
        C:\Windows\system32\Ojfcmc32.exe
        292⤵
        
        PID:6296
        
        C:\Windows\SysWOW64\Pcnhfi32.exe
        
        C:\Windows\system32\Pcnhfi32.exe
        293⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\Pndlca32.exe
        
        C:\Windows\system32\Pndlca32.exe
        294⤵
        
        PID:2076
        
        C:\Windows\SysWOW64\Pfanmcao.exe
        
        C:\Windows\system32\Pfanmcao.exe
        295⤵
        
        PID:1852
        
        C:\Windows\SysWOW64\Pagbklae.exe
        
        C:\Windows\system32\Pagbklae.exe
        296⤵
        
        PID:2636
        
        C:\Windows\SysWOW64\Pploli32.exe
        
        C:\Windows\system32\Pploli32.exe
        297⤵
        
        PID:6688
        
        C:\Windows\SysWOW64\Qpahghbg.exe
        
        C:\Windows\system32\Qpahghbg.exe
        298⤵
        
        PID:3644
        
        C:\Windows\SysWOW64\Aodejohd.exe
        
        C:\Windows\system32\Aodejohd.exe
        299⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Akkfop32.exe
        
        C:\Windows\system32\Akkfop32.exe
        300⤵
        
        PID:1768
        
        C:\Windows\SysWOW64\Aphngglp.exe
        
        C:\Windows\system32\Aphngglp.exe
        301⤵
        
        PID:6628
        
        C:\Windows\SysWOW64\Aoioeo32.exe
        
        C:\Windows\system32\Aoioeo32.exe
        302⤵
        
        PID:4212
        
        C:\Windows\SysWOW64\Aokkknbl.exe
        
        C:\Windows\system32\Aokkknbl.exe
        303⤵
        
        PID:6648
        
        C:\Windows\SysWOW64\Adhdcepc.exe
        
        C:\Windows\system32\Adhdcepc.exe
        304⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\Baldmiom.exe
        
        C:\Windows\system32\Baldmiom.exe
        305⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\Bopefnnf.exe
        
        C:\Windows\system32\Bopefnnf.exe
        306⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Bgkijp32.exe
        
        C:\Windows\system32\Bgkijp32.exe
        307⤵
        
        PID:3300
        
        C:\Windows\SysWOW64\Bkibqnah.exe
        
        C:\Windows\system32\Bkibqnah.exe
        308⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Baegchgb.exe
        
        C:\Windows\system32\Baegchgb.exe
        309⤵
        
        PID:6984
        
        C:\Windows\SysWOW64\Bgbpkoej.exe
        
        C:\Windows\system32\Bgbpkoej.exe
        310⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Cpkddd32.exe
        
        C:\Windows\system32\Cpkddd32.exe
        311⤵
        
        PID:396
        
        C:\Windows\SysWOW64\Cdhmjc32.exe
        
        C:\Windows\system32\Cdhmjc32.exe
        312⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Cgnogmkl.exe
        
        C:\Windows\system32\Cgnogmkl.exe
        313⤵
        
        PID:1884
        
        C:\Windows\SysWOW64\Daccdf32.exe
        
        C:\Windows\system32\Daccdf32.exe
        314⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Dgpllm32.exe
        
        C:\Windows\system32\Dgpllm32.exe
        315⤵
        
        PID:6956
        
        C:\Windows\SysWOW64\Dqipeboj.exe
        
        C:\Windows\system32\Dqipeboj.exe
        316⤵
        
        PID:3788
        
        C:\Windows\SysWOW64\Dkndbkop.exe
        
        C:\Windows\system32\Dkndbkop.exe
        317⤵
        
        PID:6340
        
        C:\Windows\SysWOW64\Ddfikaeq.exe
        
        C:\Windows\system32\Ddfikaeq.exe
        318⤵
        
        PID:3208
        
        C:\Windows\SysWOW64\Dolmijef.exe
        
        C:\Windows\system32\Dolmijef.exe
        319⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Dggbmlba.exe
        
        C:\Windows\system32\Dggbmlba.exe
        320⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Dhgogojd.exe
        
        C:\Windows\system32\Dhgogojd.exe
        321⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Ebocpd32.exe
        
        C:\Windows\system32\Ebocpd32.exe
        322⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\Enhpje32.exe
        
        C:\Windows\system32\Enhpje32.exe
        323⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Ekladi32.exe
        
        C:\Windows\system32\Ekladi32.exe
        324⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Eojijg32.exe
        
        C:\Windows\system32\Eojijg32.exe
        325⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\Fomfpg32.exe
        
        C:\Windows\system32\Fomfpg32.exe
        326⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Fnacqc32.exe
        
        C:\Windows\system32\Fnacqc32.exe
        327⤵
        
        PID:6520
        
        C:\Windows\SysWOW64\Figgnm32.exe
        
        C:\Windows\system32\Figgnm32.exe
        328⤵
        
        PID:6288
        
        C:\Windows\SysWOW64\Fndpfc32.exe
        
        C:\Windows\system32\Fndpfc32.exe
        329⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Fijdcljo.exe
        
        C:\Windows\system32\Fijdcljo.exe
        330⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Fnfmlchf.exe
        
        C:\Windows\system32\Fnfmlchf.exe
        331⤵
        
        PID:7064
        
        C:\Windows\SysWOW64\Faeihogj.exe
        
        C:\Windows\system32\Faeihogj.exe
        332⤵
        
        PID:3240
        
        C:\Windows\SysWOW64\Fniiabfd.exe
        
        C:\Windows\system32\Fniiabfd.exe
        333⤵
        
        PID:7100
        
        C:\Windows\SysWOW64\Gkmjkg32.exe
        
        C:\Windows\system32\Gkmjkg32.exe
        334⤵
        
        PID:4492
        
        C:\Windows\SysWOW64\Gbgbgalj.exe
        
        C:\Windows\system32\Gbgbgalj.exe
        335⤵
        
        PID:6260
        
        C:\Windows\SysWOW64\Gpkbaekd.exe
        
        C:\Windows\system32\Gpkbaekd.exe
        336⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Gegkilik.exe
        
        C:\Windows\system32\Gegkilik.exe
        337⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Gpmofe32.exe
        
        C:\Windows\system32\Gpmofe32.exe
        338⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Giecojpb.exe
        
        C:\Windows\system32\Giecojpb.exe
        339⤵
        
        PID:6308
        
        C:\Windows\SysWOW64\Gbnhhp32.exe
        
        C:\Windows\system32\Gbnhhp32.exe
        340⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Hiljpi32.exe
        
        C:\Windows\system32\Hiljpi32.exe
        341⤵
        
        PID:640
        
        C:\Windows\SysWOW64\Hbgkno32.exe
        
        C:\Windows\system32\Hbgkno32.exe
        342⤵
        
        PID:6420
        
        C:\Windows\SysWOW64\Halhpkbp.exe
        
        C:\Windows\system32\Halhpkbp.exe
        343⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\Hlblmd32.exe
        
        C:\Windows\system32\Hlblmd32.exe
        344⤵
        
        PID:6528
        
        C:\Windows\SysWOW64\Iejqeiif.exe
        
        C:\Windows\system32\Iejqeiif.exe
        345⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Iobeno32.exe
        
        C:\Windows\system32\Iobeno32.exe
        346⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\Ihkigd32.exe
        
        C:\Windows\system32\Ihkigd32.exe
        347⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Ibqndm32.exe
        
        C:\Windows\system32\Ibqndm32.exe
        348⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Ilibmcln.exe
        
        C:\Windows\system32\Ilibmcln.exe
        349⤵
        
        PID:6904
        
        C:\Windows\SysWOW64\Iimcgg32.exe
        
        C:\Windows\system32\Iimcgg32.exe
        350⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\Iecclhak.exe
        
        C:\Windows\system32\Iecclhak.exe
        351⤵
        
        PID:6216
        
        C:\Windows\SysWOW64\Jbgdelpe.exe
        
        C:\Windows\system32\Jbgdelpe.exe
        352⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Jialbf32.exe
        
        C:\Windows\system32\Jialbf32.exe
        353⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Jbjqkl32.exe
        
        C:\Windows\system32\Jbjqkl32.exe
        354⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\Jhficc32.exe
        
        C:\Windows\system32\Jhficc32.exe
        355⤵
        
        PID:6724
        
        C:\Windows\SysWOW64\Jblmpl32.exe
        
        C:\Windows\system32\Jblmpl32.exe
        356⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\Jhifib32.exe
        
        C:\Windows\system32\Jhifib32.exe
        357⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Jemfbgiq.exe
        
        C:\Windows\system32\Jemfbgiq.exe
        358⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Jpbjophf.exe
        
        C:\Windows\system32\Jpbjophf.exe
        359⤵
        
        PID:1288
        
        C:\Windows\SysWOW64\Jacggh32.exe
        
        C:\Windows\system32\Jacggh32.exe
        360⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Jhnocbfa.exe
        
        C:\Windows\system32\Jhnocbfa.exe
        361⤵
        
        PID:6480
        
        C:\Windows\SysWOW64\Kbccak32.exe
        
        C:\Windows\system32\Kbccak32.exe
        362⤵
        
        PID:6680
        
        C:\Windows\SysWOW64\Kahqbgjp.exe
        
        C:\Windows\system32\Kahqbgjp.exe
        363⤵
        
        PID:7056
        
        C:\Windows\SysWOW64\Kakmhg32.exe
        
        C:\Windows\system32\Kakmhg32.exe
        364⤵
        
        PID:7052
        
        C:\Windows\SysWOW64\Khgbjqng.exe
        
        C:\Windows\system32\Khgbjqng.exe
        365⤵
        
        PID:6336
        
        C:\Windows\SysWOW64\Khiopp32.exe
        
        C:\Windows\system32\Khiopp32.exe
        366⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Lcocmi32.exe
        
        C:\Windows\system32\Lcocmi32.exe
        367⤵
        
        PID:7284
        
        C:\Windows\SysWOW64\Gckckf32.exe
        
        C:\Windows\system32\Gckckf32.exe
        260⤵
        
        PID:1968
        
        C:\Windows\SysWOW64\Hfnibqno.exe
        
        C:\Windows\system32\Hfnibqno.exe
        261⤵
        
        PID:1160
        
        C:\Windows\SysWOW64\Lpeplmha.exe
        
        C:\Windows\system32\Lpeplmha.exe
        80⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Lhpepoel.exe
        
        C:\Windows\system32\Lhpepoel.exe
        81⤵
        
        PID:7424
        
        C:\Windows\SysWOW64\Ledeicdf.exe
        
        C:\Windows\system32\Ledeicdf.exe
        82⤵
        
        PID:6300
        
        C:\Windows\SysWOW64\Lfgboc32.exe
        
        C:\Windows\system32\Lfgboc32.exe
        83⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Mpocblpf.exe
        
        C:\Windows\system32\Mpocblpf.exe
        84⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Mjggka32.exe
        
        C:\Windows\system32\Mjggka32.exe
        85⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Mbbloc32.exe
        
        C:\Windows\system32\Mbbloc32.exe
        86⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Mcaiif32.exe
        
        C:\Windows\system32\Mcaiif32.exe
        87⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Mhnaam32.exe
        
        C:\Windows\system32\Mhnaam32.exe
        88⤵
        
        PID:492
        
        C:\Windows\SysWOW64\Nlljglpc.exe
        
        C:\Windows\system32\Nlljglpc.exe
        89⤵
        
        PID:7960
        
        C:\Windows\SysWOW64\Nbibpb32.exe
        
        C:\Windows\system32\Nbibpb32.exe
        90⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Nbkoeb32.exe
        
        C:\Windows\system32\Nbkoeb32.exe
        91⤵
        
        PID:8096
        
        C:\Windows\SysWOW64\Nqmocjdf.exe
        
        C:\Windows\system32\Nqmocjdf.exe
        92⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Nijqml32.exe
        
        C:\Windows\system32\Nijqml32.exe
        93⤵
        
        PID:7632
        
        C:\Windows\SysWOW64\Nbbefafp.exe
        
        C:\Windows\system32\Nbbefafp.exe
        94⤵
        
        PID:7768
        
        C:\Windows\SysWOW64\Omhicj32.exe
        
        C:\Windows\system32\Omhicj32.exe
        95⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\Obebla32.exe
        
        C:\Windows\system32\Obebla32.exe
        96⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\Omjfij32.exe
        
        C:\Windows\system32\Omjfij32.exe
        97⤵
        
        PID:7296
        
        C:\Windows\SysWOW64\Ocdnedkp.exe
        
        C:\Windows\system32\Ocdnedkp.exe
        98⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\Oqhooh32.exe
        
        C:\Windows\system32\Oqhooh32.exe
        99⤵
        
        PID:6716
        
        C:\Windows\SysWOW64\Oifpijea.exe
        
        C:\Windows\system32\Oifpijea.exe
        100⤵
        
        PID:3860
        
        C:\Windows\SysWOW64\Pihmojco.exe
        
        C:\Windows\system32\Pihmojco.exe
        101⤵
        
        PID:7612
        
        C:\Windows\SysWOW64\Pbqago32.exe
        
        C:\Windows\system32\Pbqago32.exe
        102⤵
        
        PID:7208
        
        C:\Windows\SysWOW64\Paaaeg32.exe
        
        C:\Windows\system32\Paaaeg32.exe
        103⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\Ppiklc32.exe
        
        C:\Windows\system32\Ppiklc32.exe
        104⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\Piapehkd.exe
        
        C:\Windows\system32\Piapehkd.exe
        105⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Qjalok32.exe
        
        C:\Windows\system32\Qjalok32.exe
        106⤵
        
        PID:7876
        
        C:\Windows\SysWOW64\Qciqga32.exe
        
        C:\Windows\system32\Qciqga32.exe
        107⤵
        
        PID:4520
        
        C:\Windows\SysWOW64\Qppambnl.exe
        
        C:\Windows\system32\Qppambnl.exe
        108⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\Afjjil32.exe
        
        C:\Windows\system32\Afjjil32.exe
        109⤵
        
        PID:8136
        
        C:\Windows\SysWOW64\Apbnbali.exe
        
        C:\Windows\system32\Apbnbali.exe
        110⤵
        
        PID:3756
        
        C:\Windows\SysWOW64\Aikbkgcj.exe
        
        C:\Windows\system32\Aikbkgcj.exe
        111⤵
        
        PID:7232
        
        C:\Windows\SysWOW64\Amikae32.exe
        
        C:\Windows\system32\Amikae32.exe
        112⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\Adccnpqm.exe
        
        C:\Windows\system32\Adccnpqm.exe
        113⤵
        
        PID:7408
        
        C:\Windows\SysWOW64\Aagdgd32.exe
        
        C:\Windows\system32\Aagdgd32.exe
        114⤵
        
        PID:4880
        
        C:\Windows\SysWOW64\Afclpk32.exe
        
        C:\Windows\system32\Afclpk32.exe
        115⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Aaiqmc32.exe
        
        C:\Windows\system32\Aaiqmc32.exe
        116⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Bbjmdlcb.exe
        
        C:\Windows\system32\Bbjmdlcb.exe
        117⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\Bmpaad32.exe
        
        C:\Windows\system32\Bmpaad32.exe
        118⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Bbmjjk32.exe
        
        C:\Windows\system32\Bbmjjk32.exe
        119⤵
        
        PID:348
        
        C:\Windows\SysWOW64\Bmbngd32.exe
        
        C:\Windows\system32\Bmbngd32.exe
        120⤵
        
        PID:7804
        
        C:\Windows\SysWOW64\Bdlfdnhb.exe
        
        C:\Windows\system32\Bdlfdnhb.exe
        121⤵
        
        PID:7352
        
        C:\Windows\SysWOW64\Bmggbcmp.exe
        
        C:\Windows\system32\Bmggbcmp.exe
        122⤵
        
        PID:7172
        
        C:\Windows\SysWOW64\Cbhifj32.exe
        
        C:\Windows\system32\Cbhifj32.exe
        123⤵
        
        PID:7356
        
        C:\Windows\SysWOW64\Cgfblh32.exe
        
        C:\Windows\system32\Cgfblh32.exe
        124⤵
        
        PID:6268
        
        C:\Windows\SysWOW64\Calfiq32.exe
        
        C:\Windows\system32\Calfiq32.exe
        125⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Cgioah32.exe
        
        C:\Windows\system32\Cgioah32.exe
        126⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Cmedca32.exe
        
        C:\Windows\system32\Cmedca32.exe
        127⤵
        
        PID:8152
        
        C:\Windows\SysWOW64\Dkidme32.exe
        
        C:\Windows\system32\Dkidme32.exe
        128⤵
        
        PID:4648
        
        C:\Windows\SysWOW64\Dcdiahme.exe
        
        C:\Windows\system32\Dcdiahme.exe
        129⤵
        
        PID:7308
        
        C:\Windows\SysWOW64\Dcffggkb.exe
        
        C:\Windows\system32\Dcffggkb.exe
        130⤵
        
        PID:8032
        
        C:\Windows\SysWOW64\Dnljdqkh.exe
        
        C:\Windows\system32\Dnljdqkh.exe
        131⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Dnnfjp32.exe
        
        C:\Windows\system32\Dnnfjp32.exe
        132⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Dnqcop32.exe
        
        C:\Windows\system32\Dnqcop32.exe
        133⤵
        
        PID:3720
        
        C:\Windows\SysWOW64\Edklljnp.exe
        
        C:\Windows\system32\Edklljnp.exe
        134⤵
        
        PID:8088
        
        C:\Windows\SysWOW64\Edmhai32.exe
        
        C:\Windows\system32\Edmhai32.exe
        135⤵
        
        PID:7416
        
        C:\Windows\SysWOW64\Epdigjaa.exe
        
        C:\Windows\system32\Epdigjaa.exe
        136⤵
        
        PID:220
        
        C:\Windows\SysWOW64\Ejlmppha.exe
        
        C:\Windows\system32\Ejlmppha.exe
        137⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Edaamihh.exe
        
        C:\Windows\system32\Edaamihh.exe
        138⤵
        
        PID:7848
        
        C:\Windows\SysWOW64\Ekljic32.exe
        
        C:\Windows\system32\Ekljic32.exe
        139⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Eqhbaj32.exe
        
        C:\Windows\system32\Eqhbaj32.exe
        140⤵
        
        PID:5352
        
        C:\Windows\SysWOW64\Fnlcknle.exe
        
        C:\Windows\system32\Fnlcknle.exe
        141⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\Fqkogiki.exe
        
        C:\Windows\system32\Fqkogiki.exe
        142⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Fjccpo32.exe
        
        C:\Windows\system32\Fjccpo32.exe
        143⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\Fdihmh32.exe
        
        C:\Windows\system32\Fdihmh32.exe
        144⤵
        
        PID:2028
        
        C:\Windows\SysWOW64\Fjepfo32.exe
        
        C:\Windows\system32\Fjepfo32.exe
        145⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Fjhmknnd.exe
        
        C:\Windows\system32\Fjhmknnd.exe
        146⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Fnffam32.exe
        
        C:\Windows\system32\Fnffam32.exe
        147⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Fdpnng32.exe
        
        C:\Windows\system32\Fdpnng32.exe
        148⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Fkjfkacd.exe
        
        C:\Windows\system32\Fkjfkacd.exe
        149⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\Gdbkcf32.exe
        
        C:\Windows\system32\Gdbkcf32.exe
        150⤵
        
        PID:7640
        
        C:\Windows\SysWOW64\Gjoclm32.exe
        
        C:\Windows\system32\Gjoclm32.exe
        151⤵
        
        PID:7660
        
        C:\Windows\SysWOW64\Gqikigoi.exe
        
        C:\Windows\system32\Gqikigoi.exe
        152⤵
        
        PID:8184
        
        C:\Windows\SysWOW64\Gknpfp32.exe
        
        C:\Windows\system32\Gknpfp32.exe
        153⤵
        
        PID:5368
        
        C:\Windows\SysWOW64\Ggepkadc.exe
        
        C:\Windows\system32\Ggepkadc.exe
        154⤵
        
        PID:1568
        
        C:\Windows\SysWOW64\Gqnedg32.exe
        
        C:\Windows\system32\Gqnedg32.exe
        155⤵
        
        PID:5636
        
        C:\Windows\SysWOW64\Gqpaifia.exe
        
        C:\Windows\system32\Gqpaifia.exe
        156⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\Hebcjdkb.exe
        
        C:\Windows\system32\Hebcjdkb.exe
        157⤵
        
        PID:7280
        
        C:\Windows\SysWOW64\Hnkhcjbc.exe
        
        C:\Windows\system32\Hnkhcjbc.exe
        158⤵
        
        PID:7304
        
        C:\Windows\SysWOW64\Hegmec32.exe
        
        C:\Windows\system32\Hegmec32.exe
        159⤵
        
        PID:2668
        
        C:\Windows\SysWOW64\Ighfgodn.exe
        
        C:\Windows\system32\Ighfgodn.exe
        160⤵
        
        PID:5460
        
        C:\Windows\SysWOW64\Iapjpd32.exe
        
        C:\Windows\system32\Iapjpd32.exe
        161⤵
        
        PID:5408
        
        C:\Windows\SysWOW64\Indkih32.exe
        
        C:\Windows\system32\Indkih32.exe
        162⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Infhohhe.exe
        
        C:\Windows\system32\Infhohhe.exe
        163⤵
        
        PID:7376
        
        C:\Windows\SysWOW64\Ibdpefnl.exe
        
        C:\Windows\system32\Ibdpefnl.exe
        164⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Jbgmkfli.exe
        
        C:\Windows\system32\Jbgmkfli.exe
        165⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Jhcecmjq.exe
        
        C:\Windows\system32\Jhcecmjq.exe
        166⤵
        
        PID:2100
        
        C:\Windows\SysWOW64\Jdjfhnpe.exe
        
        C:\Windows\system32\Jdjfhnpe.exe
        167⤵
        
        PID:2764
        
        C:\Windows\SysWOW64\Jangaboo.exe
        
        C:\Windows\system32\Jangaboo.exe
        168⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\Jobgkfnh.exe
        
        C:\Windows\system32\Jobgkfnh.exe
        169⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Kkpnqf32.exe
        
        C:\Windows\system32\Kkpnqf32.exe
        170⤵
        
        PID:6132
        
        C:\Windows\SysWOW64\Kdhbilde.exe
        
        C:\Windows\system32\Kdhbilde.exe
        171⤵
        
        PID:6128
        
        C:\Windows\SysWOW64\Kbibgcld.exe
        
        C:\Windows\system32\Kbibgcld.exe
        172⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Klbgpi32.exe
        
        C:\Windows\system32\Klbgpi32.exe
        173⤵
        
        PID:5208
        
        C:\Windows\SysWOW64\Lejlioie.exe
        
        C:\Windows\system32\Lejlioie.exe
        174⤵
        
        PID:7248
        
        C:\Windows\SysWOW64\Llddei32.exe
        
        C:\Windows\system32\Llddei32.exe
        175⤵
        
        PID:7728
        
        C:\Windows\SysWOW64\Laalnpoi.exe
        
        C:\Windows\system32\Laalnpoi.exe
        176⤵
        
        PID:5764
        
        C:\Windows\SysWOW64\Lkiage32.exe
        
        C:\Windows\system32\Lkiage32.exe
        177⤵
        
        PID:7496
        
        C:\Windows\SysWOW64\Lklnle32.exe
        
        C:\Windows\system32\Lklnle32.exe
        178⤵
        
        PID:4536
        
        C:\Windows\SysWOW64\Laffio32.exe
        
        C:\Windows\system32\Laffio32.exe
        179⤵
        
        PID:1736
        
        C:\Windows\SysWOW64\Llkjfh32.exe
        
        C:\Windows\system32\Llkjfh32.exe
        180⤵
        
        PID:472
        
        C:\Windows\SysWOW64\Lcebcbaf.exe
        
        C:\Windows\system32\Lcebcbaf.exe
        181⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\Lkqggdoa.exe
        
        C:\Windows\system32\Lkqggdoa.exe
        182⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\Lajodnfo.exe
        
        C:\Windows\system32\Lajodnfo.exe
        183⤵
        
        PID:5384
        
        C:\Windows\SysWOW64\Mcjlna32.exe
        
        C:\Windows\system32\Mcjlna32.exe
        184⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Mcoeiqil.exe
        
        C:\Windows\system32\Mcoeiqil.exe
        185⤵
        
        PID:2104
        
        C:\Windows\SysWOW64\Mhknaghc.exe
        
        C:\Windows\system32\Mhknaghc.exe
        186⤵
        
        PID:3588
        
        C:\Windows\SysWOW64\Mcabopgi.exe
        
        C:\Windows\system32\Mcabopgi.exe
        187⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Mhnjgg32.exe
        
        C:\Windows\system32\Mhnjgg32.exe
        188⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\Nhbcbfak.exe
        
        C:\Windows\system32\Nhbcbfak.exe
        189⤵
        
        PID:3360
        
        C:\Windows\SysWOW64\Nakhkl32.exe
        
        C:\Windows\system32\Nakhkl32.exe
        190⤵
        
        PID:5668
        
        C:\Windows\SysWOW64\Nhephfpi.exe
        
        C:\Windows\system32\Nhephfpi.exe
        191⤵
        
        PID:5660
        
        C:\Windows\SysWOW64\Nfiaajob.exe
        
        C:\Windows\system32\Nfiaajob.exe
        192⤵
        
        PID:8132
        
        C:\Windows\SysWOW64\Noaejpec.exe
        
        C:\Windows\system32\Noaejpec.exe
        193⤵
        
        PID:3404
        
        C:\Windows\SysWOW64\Nkhfoa32.exe
        
        C:\Windows\system32\Nkhfoa32.exe
        194⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\Ohlfhe32.exe
        
        C:\Windows\system32\Ohlfhe32.exe
        195⤵
        
        PID:1428
        
        C:\Windows\SysWOW64\Ofpgaihj.exe
        
        C:\Windows\system32\Ofpgaihj.exe
        196⤵
        
        PID:5936
        
        C:\Windows\SysWOW64\Obfhgj32.exe
        
        C:\Windows\system32\Obfhgj32.exe
        197⤵
        
        PID:5136
        
        C:\Windows\SysWOW64\Oojhpo32.exe
        
        C:\Windows\system32\Oojhpo32.exe
        198⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Okaiep32.exe
        
        C:\Windows\system32\Okaiep32.exe
        199⤵
        
        PID:7032
        
        C:\Windows\SysWOW64\Odjmneim.exe
        
        C:\Windows\system32\Odjmneim.exe
        200⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Pigfdcoc.exe
        
        C:\Windows\system32\Pigfdcoc.exe
        201⤵
        
        PID:4556
        
        C:\Windows\SysWOW64\Pfkfmhnm.exe
        
        C:\Windows\system32\Pfkfmhnm.exe
        202⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Pcogglmf.exe
        
        C:\Windows\system32\Pcogglmf.exe
        203⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Pcacll32.exe
        
        C:\Windows\system32\Pcacll32.exe
        204⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Pkmhan32.exe
        
        C:\Windows\system32\Pkmhan32.exe
        205⤵
        
        PID:5772
        
        C:\Windows\SysWOW64\Pbgqnhpl.exe
        
        C:\Windows\system32\Pbgqnhpl.exe
        206⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Qcfmgkgo.exe
        
        C:\Windows\system32\Qcfmgkgo.exe
        207⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Qmoapq32.exe
        
        C:\Windows\system32\Qmoapq32.exe
        208⤵
        
        PID:6100
        
        C:\Windows\SysWOW64\Aficoe32.exe
        
        C:\Windows\system32\Aficoe32.exe
        209⤵
        
        PID:5016
        
        C:\Windows\SysWOW64\Amckkpij.exe
        
        C:\Windows\system32\Amckkpij.exe
        210⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\Abpcdfha.exe
        
        C:\Windows\system32\Abpcdfha.exe
        211⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\Abbpif32.exe
        
        C:\Windows\system32\Abbpif32.exe
        212⤵
        
        PID:4912
        
        C:\Windows\SysWOW64\Afceed32.exe
        
        C:\Windows\system32\Afceed32.exe
        213⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\Blpnmk32.exe
        
        C:\Windows\system32\Blpnmk32.exe
        214⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Bicogo32.exe
        
        C:\Windows\system32\Bicogo32.exe
        215⤵
        
        PID:5216
        
        C:\Windows\SysWOW64\Bldghjdd.exe
        
        C:\Windows\system32\Bldghjdd.exe
        216⤵
        
        PID:5336
        
        C:\Windows\SysWOW64\Bemlap32.exe
        
        C:\Windows\system32\Bemlap32.exe
        217⤵
        
        PID:5996
        
        C:\Windows\SysWOW64\Blgdnjba.exe
        
        C:\Windows\system32\Blgdnjba.exe
        218⤵
        
        PID:4992
        
        C:\Windows\SysWOW64\Bflhkc32.exe
        
        C:\Windows\system32\Bflhkc32.exe
        219⤵
        
        PID:5348
        
        C:\Windows\SysWOW64\Bliacj32.exe
        
        C:\Windows\system32\Bliacj32.exe
        220⤵
        
        PID:6048
        
        C:\Windows\SysWOW64\Cmkjcl32.exe
        
        C:\Windows\system32\Cmkjcl32.exe
        221⤵
        
        PID:5992
        
        C:\Windows\SysWOW64\Cfcolblp.exe
        
        C:\Windows\system32\Cfcolblp.exe
        222⤵
        
        PID:3464
        
        C:\Windows\SysWOW64\Clpgdijg.exe
        
        C:\Windows\system32\Clpgdijg.exe
        223⤵
        
        PID:5808
        
        C:\Windows\SysWOW64\Cehkmn32.exe
        
        C:\Windows\system32\Cehkmn32.exe
        224⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Cfhhga32.exe
        
        C:\Windows\system32\Cfhhga32.exe
        225⤵
        
        PID:232
        
        C:\Windows\SysWOW64\Cpplpgnk.exe
        
        C:\Windows\system32\Cpplpgnk.exe
        226⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Demehnlb.exe
        
        C:\Windows\system32\Demehnlb.exe
        227⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Dpbief32.exe
        
        C:\Windows\system32\Dpbief32.exe
        228⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Dpefkf32.exe
        
        C:\Windows\system32\Dpefkf32.exe
        229⤵
        
        PID:5244
        
        C:\Windows\SysWOW64\Dmifdjio.exe
        
        C:\Windows\system32\Dmifdjio.exe
        230⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Dipgik32.exe
        
        C:\Windows\system32\Dipgik32.exe
        231⤵
        
        PID:6008
        
        C:\Windows\SysWOW64\Dgcgbp32.exe
        
        C:\Windows\system32\Dgcgbp32.exe
        232⤵
        
        PID:2092
        
        C:\Windows\SysWOW64\Dlqpkf32.exe
        
        C:\Windows\system32\Dlqpkf32.exe
        233⤵
        
        PID:5576
        
        C:\Windows\SysWOW64\Eidqdkkn.exe
        
        C:\Windows\system32\Eidqdkkn.exe
        234⤵
        
        PID:5832
        
        C:\Windows\SysWOW64\Embiji32.exe
        
        C:\Windows\system32\Embiji32.exe
        235⤵
        
        PID:4396
        
        C:\Windows\SysWOW64\Eennoknp.exe
        
        C:\Windows\system32\Eennoknp.exe
        236⤵
        Drops file in System32 directory
        
        PID:5164
        
        C:\Windows\SysWOW64\Epcbldne.exe
        
        C:\Windows\system32\Epcbldne.exe
        237⤵
        
        PID:5204
        
        C:\Windows\SysWOW64\Eikfej32.exe
        
        C:\Windows\system32\Eikfej32.exe
        238⤵
        
        PID:3696
        
        C:\Windows\SysWOW64\Ephlgc32.exe
        
        C:\Windows\system32\Ephlgc32.exe
        239⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\Feddpj32.exe
        
        C:\Windows\system32\Feddpj32.exe
        240⤵
        Drops file in System32 directory
        
        PID:5508
        
        C:\Windows\SysWOW64\Fplebcfk.exe
        
        C:\Windows\system32\Fplebcfk.exe
        241⤵
        
        PID:1788
        
        C:\Windows\SysWOW64\Fgfmom32.exe
        
        C:\Windows\system32\Fgfmom32.exe
        242⤵
        
        PID:5944
        
        C:\Windows\SysWOW64\Fpoahbdh.exe
        
        C:\Windows\system32\Fpoahbdh.exe
        243⤵
        
        PID:224
        
        C:\Windows\SysWOW64\Fjgfahji.exe
        
        C:\Windows\system32\Fjgfahji.exe
        244⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Fcpkjn32.exe
        
        C:\Windows\system32\Fcpkjn32.exe
        245⤵
        
        PID:8208
        
        C:\Windows\SysWOW64\Gcbgom32.exe
        
        C:\Windows\system32\Gcbgom32.exe
        246⤵
        
        PID:8260
        
        C:\Windows\SysWOW64\Gngllfol.exe
        
        C:\Windows\system32\Gngllfol.exe
        247⤵
        
        PID:8296
        
        C:\Windows\SysWOW64\Gcddemmd.exe
        
        C:\Windows\system32\Gcddemmd.exe
        248⤵
        
        PID:8348
        
        C:\Windows\SysWOW64\Gnjhbfmj.exe
        
        C:\Windows\system32\Gnjhbfmj.exe
        249⤵
        
        PID:8404
        
        C:\Windows\SysWOW64\Gcfqjmka.exe
        
        C:\Windows\system32\Gcfqjmka.exe
        250⤵
        
        PID:8448
        
        C:\Windows\SysWOW64\Gqjada32.exe
        
        C:\Windows\system32\Gqjada32.exe
        251⤵
        
        PID:8496
        
        C:\Windows\SysWOW64\Gnoame32.exe
        
        C:\Windows\system32\Gnoame32.exe
        252⤵
        
        PID:8540
        
        C:\Windows\SysWOW64\Gggffkoe.exe
        
        C:\Windows\system32\Gggffkoe.exe
        253⤵
        
        PID:8592
        
        C:\Windows\SysWOW64\Gmconaml.exe
        
        C:\Windows\system32\Gmconaml.exe
        254⤵
        
        PID:8636
        
        C:\Windows\SysWOW64\Hcngkldi.exe
        
        C:\Windows\system32\Hcngkldi.exe
        255⤵
        
        PID:8680
        
        C:\Windows\SysWOW64\Hnckhddo.exe
        
        C:\Windows\system32\Hnckhddo.exe
        256⤵
        
        PID:8728
        
        C:\Windows\SysWOW64\Hdmceo32.exe
        
        C:\Windows\system32\Hdmceo32.exe
        257⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Hmhhia32.exe
        
        C:\Windows\system32\Hmhhia32.exe
        258⤵
        
        PID:8816
        
        C:\Windows\SysWOW64\Hfqmbf32.exe
        
        C:\Windows\system32\Hfqmbf32.exe
        259⤵
        
        PID:8864
        
        C:\Windows\SysWOW64\Hnjaic32.exe
        
        C:\Windows\system32\Hnjaic32.exe
        260⤵
        
        PID:8920
        
        C:\Windows\SysWOW64\Hcgjajmo.exe
        
        C:\Windows\system32\Hcgjajmo.exe
        261⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\Hnmnocld.exe
        
        C:\Windows\system32\Hnmnocld.exe
        262⤵
        
        PID:9004
        
        C:\Windows\SysWOW64\Ifhbcejp.exe
        
        C:\Windows\system32\Ifhbcejp.exe
        263⤵
        
        PID:9060
        
        C:\Windows\SysWOW64\Ifjohe32.exe
        
        C:\Windows\system32\Ifjohe32.exe
        264⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Imdgeooj.exe
        
        C:\Windows\system32\Imdgeooj.exe
        265⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Incdob32.exe
        
        C:\Windows\system32\Incdob32.exe
        266⤵
        
        PID:9212
        
        C:\Windows\SysWOW64\Icpmgi32.exe
        
        C:\Windows\system32\Icpmgi32.exe
        267⤵
        
        PID:8240
        
        C:\Windows\SysWOW64\Iepial32.exe
        
        C:\Windows\system32\Iepial32.exe
        268⤵
        
        PID:8312
        
        C:\Windows\SysWOW64\Ijmajc32.exe
        
        C:\Windows\system32\Ijmajc32.exe
        269⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Jgqbcg32.exe
        
        C:\Windows\system32\Jgqbcg32.exe
        270⤵
        
        PID:8436
        
        C:\Windows\SysWOW64\Jnkjpa32.exe
        
        C:\Windows\system32\Jnkjpa32.exe
        271⤵
        
        PID:6104
        
        C:\Windows\SysWOW64\Jedblkga.exe
        
        C:\Windows\system32\Jedblkga.exe
        272⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Jnmgea32.exe
        
        C:\Windows\system32\Jnmgea32.exe
        273⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Jcjonh32.exe
        
        C:\Windows\system32\Jcjonh32.exe
        274⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Japmmlip.exe
        
        C:\Windows\system32\Japmmlip.exe
        275⤵
        
        PID:3504
        
        C:\Windows\SysWOW64\Kmgmam32.exe
        
        C:\Windows\system32\Kmgmam32.exe
        276⤵
        
        PID:8824
        
        C:\Windows\SysWOW64\Kmijglma.exe
        
        C:\Windows\system32\Kmijglma.exe
        277⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\Knifao32.exe
        
        C:\Windows\system32\Knifao32.exe
        278⤵
        
        PID:8444
        
        C:\Windows\SysWOW64\Ohicho32.exe
        
        C:\Windows\system32\Ohicho32.exe
        279⤵
        
        PID:8512
        
        C:\Windows\SysWOW64\Odpcmpnl.exe
        
        C:\Windows\system32\Odpcmpnl.exe
        280⤵
        
        PID:8580
        
        C:\Windows\SysWOW64\Onhhfe32.exe
        
        C:\Windows\system32\Onhhfe32.exe
        281⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Oogdph32.exe
        
        C:\Windows\system32\Oogdph32.exe
        282⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Ohpiinbp.exe
        
        C:\Windows\system32\Ohpiinbp.exe
        283⤵
        
        PID:8756
        
        C:\Windows\SysWOW64\Ogefjjfg.exe
        
        C:\Windows\system32\Ogefjjfg.exe
        284⤵
        
        PID:8768
        
        C:\Windows\SysWOW64\Offfhb32.exe
        
        C:\Windows\system32\Offfhb32.exe
        285⤵
        
        PID:4140
        
        C:\Windows\SysWOW64\Pdkcinco.exe
        
        C:\Windows\system32\Pdkcinco.exe
        286⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\Pnchbdjo.exe
        
        C:\Windows\system32\Pnchbdjo.exe
        287⤵
        
        PID:5952
        
        C:\Windows\SysWOW64\Pfmlhaho.exe
        
        C:\Windows\system32\Pfmlhaho.exe
        288⤵
        
        PID:8916

C:\Windows\SysWOW64\Pkjeahgf.exe
C:\Windows\system32\Pkjeahgf.exe
1⤵
PID:8964
- C:\Windows\SysWOW64\Pfpinq32.exe
  C:\Windows\system32\Pfpinq32.exe
  2⤵
  PID:440
- - C:\Windows\SysWOW64\Pfbfcp32.exe
    C:\Windows\system32\Pfbfcp32.exe
    3⤵
    PID:9024
  - - C:\Windows\SysWOW64\Qbifia32.exe
      C:\Windows\system32\Qbifia32.exe
      4⤵
      PID:9072
    - - C:\Windows\SysWOW64\Adiojl32.exe
        
        C:\Windows\system32\Adiojl32.exe
        5⤵
        
        PID:9100
      - C:\Windows\SysWOW64\Adllplel.exe
        
        C:\Windows\system32\Adllplel.exe
        6⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Andqia32.exe
        
        C:\Windows\system32\Andqia32.exe
        7⤵
        
        PID:9192
        
        C:\Windows\SysWOW64\Aijefj32.exe
        
        C:\Windows\system32\Aijefj32.exe
        8⤵
        
        PID:1144
        
        C:\Windows\SysWOW64\Anfmna32.exe
        
        C:\Windows\system32\Anfmna32.exe
        9⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\Aepekk32.exe
        
        C:\Windows\system32\Aepekk32.exe
        10⤵
        
        PID:8284
        
        C:\Windows\SysWOW64\Aofjhd32.exe
        
        C:\Windows\system32\Aofjhd32.exe
        11⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\Aebbqk32.exe
        
        C:\Windows\system32\Aebbqk32.exe
        12⤵
        
        PID:2188
        
        C:\Windows\SysWOW64\Aohfnd32.exe
        
        C:\Windows\system32\Aohfnd32.exe
        13⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\Bfbojnff.exe
        
        C:\Windows\system32\Bfbojnff.exe
        14⤵
        
        PID:4820
        
        C:\Windows\SysWOW64\Bokcccmg.exe
        
        C:\Windows\system32\Bokcccmg.exe
        15⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Bfdkpn32.exe
        
        C:\Windows\system32\Bfdkpn32.exe
        16⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\Bkadhd32.exe
        
        C:\Windows\system32\Bkadhd32.exe
        17⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Biedbi32.exe
        
        C:\Windows\system32\Biedbi32.exe
        18⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\Blfmcdnf.exe
        
        C:\Windows\system32\Blfmcdnf.exe
        19⤵
        
        PID:1208
        
        C:\Windows\SysWOW64\Bgmnhe32.exe
        
        C:\Windows\system32\Bgmnhe32.exe
        20⤵
        
        PID:2168
        
        C:\Windows\SysWOW64\Cpfcobbj.exe
        
        C:\Windows\system32\Cpfcobbj.exe
        21⤵
        
        PID:8780
        
        C:\Windows\SysWOW64\Clmcdc32.exe
        
        C:\Windows\system32\Clmcdc32.exe
        22⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\Ciadnggh.exe
        
        C:\Windows\system32\Ciadnggh.exe
        23⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Clppjbfk.exe
        
        C:\Windows\system32\Clppjbfk.exe
        24⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\Cfedgkfa.exe
        
        C:\Windows\system32\Cfedgkfa.exe
        25⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\Dbnbaljc.exe
        
        C:\Windows\system32\Dbnbaljc.exe
        26⤵
        
        PID:872
        
        C:\Windows\SysWOW64\Dlffja32.exe
        
        C:\Windows\system32\Dlffja32.exe
        27⤵
        
        PID:5344
        
        C:\Windows\SysWOW64\Dnebfm32.exe
        
        C:\Windows\system32\Dnebfm32.exe
        28⤵
        
        PID:4344
        
        C:\Windows\SysWOW64\Dijgdfom.exe
        
        C:\Windows\system32\Dijgdfom.exe
        29⤵
        
        PID:5812
        
        C:\Windows\SysWOW64\Dlicpanq.exe
        
        C:\Windows\system32\Dlicpanq.exe
        30⤵
        
        PID:1512
        
        C:\Windows\SysWOW64\Dfngmjnf.exe
        
        C:\Windows\system32\Dfngmjnf.exe
        31⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\Dhpceb32.exe
        
        C:\Windows\system32\Dhpceb32.exe
        32⤵
        
        PID:9128
        
        C:\Windows\SysWOW64\Dfqdbj32.exe
        
        C:\Windows\system32\Dfqdbj32.exe
        33⤵
        
        PID:9200
        
        C:\Windows\SysWOW64\Dlnlkq32.exe
        
        C:\Windows\system32\Dlnlkq32.exe
        34⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1720
        
        C:\Windows\SysWOW64\Diamde32.exe
        
        C:\Windows\system32\Diamde32.exe
        35⤵
        
        PID:2300
        
        C:\Windows\SysWOW64\Epnbgo32.exe
        
        C:\Windows\system32\Epnbgo32.exe
        36⤵
        
        PID:5836
        
        C:\Windows\SysWOW64\Efjgihdi.exe
        
        C:\Windows\system32\Efjgihdi.exe
        37⤵
        
        PID:3396
        
        C:\Windows\SysWOW64\Eeodjeha.exe
        
        C:\Windows\system32\Eeodjeha.exe
        38⤵
        
        PID:8460

C:\Windows\SysWOW64\Fpgdmm32.exe
C:\Windows\system32\Fpgdmm32.exe
1⤵
PID:3148
- C:\Windows\SysWOW64\Fpiabm32.exe
  C:\Windows\system32\Fpiabm32.exe
  2⤵
  PID:6628
- - C:\Windows\SysWOW64\Fibfkbkb.exe
    C:\Windows\system32\Fibfkbkb.exe
    3⤵
    PID:4212
  - - C:\Windows\SysWOW64\Fgffdg32.exe
      C:\Windows\system32\Fgffdg32.exe
      4⤵
      PID:4848
    - - C:\Windows\SysWOW64\Fempkc32.exe
        
        C:\Windows\system32\Fempkc32.exe
        5⤵
        
        PID:3792
      - C:\Windows\SysWOW64\Gpcdil32.exe
        
        C:\Windows\system32\Gpcdil32.exe
        6⤵
        
        PID:8788
        
        C:\Windows\SysWOW64\Ggmlefcd.exe
        
        C:\Windows\system32\Ggmlefcd.exe
        7⤵
        
        PID:5284
        
        C:\Windows\SysWOW64\Gpeank32.exe
        
        C:\Windows\system32\Gpeank32.exe
        8⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Gjbobpmp.exe
        
        C:\Windows\system32\Gjbobpmp.exe
        9⤵
        
        PID:5560

C:\Windows\SysWOW64\Hfpehpll.exe
C:\Windows\system32\Hfpehpll.exe
1⤵
PID:9140
- C:\Windows\SysWOW64\Hohjqfbl.exe
  C:\Windows\system32\Hohjqfbl.exe
  2⤵
  PID:6644
- - C:\Windows\SysWOW64\Hcfcgd32.exe
    C:\Windows\system32\Hcfcgd32.exe
    3⤵
    PID:1360
  - - C:\Windows\SysWOW64\Ijpkcnpp.exe
      C:\Windows\system32\Ijpkcnpp.exe
      4⤵
      PID:4028
    - - C:\Windows\SysWOW64\Iqjcphhl.exe
        
        C:\Windows\system32\Iqjcphhl.exe
        5⤵
        
        PID:6952
      - C:\Windows\SysWOW64\Icklbcen.exe
        
        C:\Windows\system32\Icklbcen.exe
        6⤵
        
        PID:8364
        
        C:\Windows\SysWOW64\Imcqki32.exe
        
        C:\Windows\system32\Imcqki32.exe
        7⤵
        
        PID:7160
        
        C:\Windows\SysWOW64\Ijjnjmhe.exe
        
        C:\Windows\system32\Ijjnjmhe.exe
        8⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\Icbbbboe.exe
        
        C:\Windows\system32\Icbbbboe.exe
        9⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Jmjgkh32.exe
        
        C:\Windows\system32\Jmjgkh32.exe
        10⤵
        
        PID:8488
        
        C:\Windows\SysWOW64\Jiagpikj.exe
        
        C:\Windows\system32\Jiagpikj.exe
        11⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Jicdfi32.exe
        
        C:\Windows\system32\Jicdfi32.exe
        12⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Jopihbna.exe
        
        C:\Windows\system32\Jopihbna.exe
        13⤵
        
        PID:6852
        
        C:\Windows\SysWOW64\Jpbfnb32.exe
        
        C:\Windows\system32\Jpbfnb32.exe
        14⤵
        
        PID:4248
        
        C:\Windows\SysWOW64\Kpdbcb32.exe
        
        C:\Windows\system32\Kpdbcb32.exe
        15⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\Kmmlhe32.exe
        
        C:\Windows\system32\Kmmlhe32.exe
        16⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\Kidmmfke.exe
        
        C:\Windows\system32\Kidmmfke.exe
        17⤵
        
        PID:2408
        
        C:\Windows\SysWOW64\Lifjbfib.exe
        
        C:\Windows\system32\Lifjbfib.exe
        18⤵
        
        PID:6072
        
        C:\Windows\SysWOW64\Lambcc32.exe
        
        C:\Windows\system32\Lambcc32.exe
        19⤵
        
        PID:4736
        
        C:\Windows\SysWOW64\Liifhe32.exe
        
        C:\Windows\system32\Liifhe32.exe
        20⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\Lcnken32.exe
        
        C:\Windows\system32\Lcnken32.exe
        21⤵
        
        PID:7060
        
        C:\Windows\SysWOW64\Ljhcbhnb.exe
        
        C:\Windows\system32\Ljhcbhnb.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3508
        
        C:\Windows\SysWOW64\Ljjpgh32.exe
        
        C:\Windows\system32\Ljjpgh32.exe
        23⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Lmilcc32.exe
        
        C:\Windows\system32\Lmilcc32.exe
        24⤵
        
        PID:6736
        
        C:\Windows\SysWOW64\Lfaqliad.exe
        
        C:\Windows\system32\Lfaqliad.exe
        25⤵
        
        PID:8724
        
        C:\Windows\SysWOW64\Mibind32.exe
        
        C:\Windows\system32\Mibind32.exe
        26⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\Mdgnkm32.exe
        
        C:\Windows\system32\Mdgnkm32.exe
        27⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\Mhhcgk32.exe
        
        C:\Windows\system32\Mhhcgk32.exe
        28⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\Mdodllhc.exe
        
        C:\Windows\system32\Mdodllhc.exe
        29⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\Mikldc32.exe
        
        C:\Windows\system32\Mikldc32.exe
        30⤵
        
        PID:6508
        
        C:\Windows\SysWOW64\Npedamng.exe
        
        C:\Windows\system32\Npedamng.exe
        31⤵
        
        PID:3068
        
        C:\Windows\SysWOW64\Nkkinfnm.exe
        
        C:\Windows\system32\Nkkinfnm.exe
        32⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Ngdfifao.exe
        
        C:\Windows\system32\Ngdfifao.exe
        33⤵
        
        PID:8
        
        C:\Windows\SysWOW64\Nalglo32.exe
        
        C:\Windows\system32\Nalglo32.exe
        34⤵
        
        PID:4332
        
        C:\Windows\SysWOW64\Ohhlnidl.exe
        
        C:\Windows\system32\Ohhlnidl.exe
        35⤵
        
        PID:1308
        
        C:\Windows\SysWOW64\Oaqqgnkl.exe
        
        C:\Windows\system32\Oaqqgnkl.exe
        36⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Oilekqhg.exe
        
        C:\Windows\system32\Oilekqhg.exe
        37⤵
        
        PID:6792
        
        C:\Windows\SysWOW64\Opfmhk32.exe
        
        C:\Windows\system32\Opfmhk32.exe
        38⤵
        
        PID:4632
        
        C:\Windows\SysWOW64\Oinbqpfe.exe
        
        C:\Windows\system32\Oinbqpfe.exe
        39⤵
        
        PID:8708
        
        C:\Windows\SysWOW64\Odcfni32.exe
        
        C:\Windows\system32\Odcfni32.exe
        40⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Phheeffi.exe
        
        C:\Windows\system32\Phheeffi.exe
        41⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Pjjalo32.exe
        
        C:\Windows\system32\Pjjalo32.exe
        42⤵
        
        PID:6596
        
        C:\Windows\SysWOW64\Pgnbfc32.exe
        
        C:\Windows\system32\Pgnbfc32.exe
        43⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Ahinld32.exe
        
        C:\Windows\system32\Ahinld32.exe
        44⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\Aqfoefco.exe
        
        C:\Windows\system32\Aqfoefco.exe
        45⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Bgeampff.exe
        
        C:\Windows\system32\Bgeampff.exe
        46⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Bggncodd.exe
        
        C:\Windows\system32\Bggncodd.exe
        47⤵
        
        PID:2584
        
        C:\Windows\SysWOW64\Cnfokihk.exe
        
        C:\Windows\system32\Cnfokihk.exe
        48⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Ckjpdm32.exe
        
        C:\Windows\system32\Ckjpdm32.exe
        49⤵
        
        PID:4684
        
        C:\Windows\SysWOW64\Cqghld32.exe
        
        C:\Windows\system32\Cqghld32.exe
        50⤵
        
        PID:1664
        
        C:\Windows\SysWOW64\Cinpna32.exe
        
        C:\Windows\system32\Cinpna32.exe
        51⤵
        
        PID:6424
        
        C:\Windows\SysWOW64\Caiebc32.exe
        
        C:\Windows\system32\Caiebc32.exe
        52⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\Dagacagj.exe
        
        C:\Windows\system32\Dagacagj.exe
        53⤵
        
        PID:4832
        
        C:\Windows\SysWOW64\Dlmeqjfp.exe
        
        C:\Windows\system32\Dlmeqjfp.exe
        54⤵
        
        PID:7320
        
        C:\Windows\SysWOW64\Eeejipmp.exe
        
        C:\Windows\system32\Eeejipmp.exe
        55⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Ebkghd32.exe
        
        C:\Windows\system32\Ebkghd32.exe
        56⤵
        
        PID:8084
        
        C:\Windows\SysWOW64\Ejglmf32.exe
        
        C:\Windows\system32\Ejglmf32.exe
        57⤵
        
        PID:6996
        
        C:\Windows\SysWOW64\Fjnbmeaj.exe
        
        C:\Windows\system32\Fjnbmeaj.exe
        58⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\Fecfkn32.exe
        
        C:\Windows\system32\Fecfkn32.exe
        59⤵
        
        PID:548
        
        C:\Windows\SysWOW64\Fbggdb32.exe
        
        C:\Windows\system32\Fbggdb32.exe
        60⤵
        
        PID:4920
        
        C:\Windows\SysWOW64\Fhdoli32.exe
        
        C:\Windows\system32\Fhdoli32.exe
        61⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Fehpfm32.exe
        
        C:\Windows\system32\Fehpfm32.exe
        62⤵
        
        PID:6920
        
        C:\Windows\SysWOW64\Fblpoald.exe
        
        C:\Windows\system32\Fblpoald.exe
        63⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\Fhiighjl.exe
        
        C:\Windows\system32\Fhiighjl.exe
        64⤵
        
        PID:3672
        
        C:\Windows\SysWOW64\Glfangpb.exe
        
        C:\Windows\system32\Glfangpb.exe
        65⤵
        
        PID:6332
        
        C:\Windows\SysWOW64\Gbqija32.exe
        
        C:\Windows\system32\Gbqija32.exe
        66⤵
        
        PID:7792
        
        C:\Windows\SysWOW64\Gknkdccg.exe
        
        C:\Windows\system32\Gknkdccg.exe
        67⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Hoqmeqei.exe
        
        C:\Windows\system32\Hoqmeqei.exe
        68⤵
        
        PID:3040
        
        C:\Windows\SysWOW64\Hldnoddb.exe
        
        C:\Windows\system32\Hldnoddb.exe
        69⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Haafgl32.exe
        
        C:\Windows\system32\Haafgl32.exe
        70⤵
        
        PID:6312
        
        C:\Windows\SysWOW64\Iooigo32.exe
        
        C:\Windows\system32\Iooigo32.exe
        71⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Ihgnpdpi.exe
        
        C:\Windows\system32\Ihgnpdpi.exe
        72⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Icmbmmoo.exe
        
        C:\Windows\system32\Icmbmmoo.exe
        73⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Ihijec32.exe
        
        C:\Windows\system32\Ihijec32.exe
        74⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Iabonidg.exe
        
        C:\Windows\system32\Iabonidg.exe
        75⤵
        
        PID:7972
        
        C:\Windows\SysWOW64\Jfphdg32.exe
        
        C:\Windows\system32\Jfphdg32.exe
        76⤵
        
        PID:6208
        
        C:\Windows\SysWOW64\Jcchnlig.exe
        
        C:\Windows\system32\Jcchnlig.exe
        77⤵
        
        PID:6908
        
        C:\Windows\SysWOW64\Jbieoh32.exe
        
        C:\Windows\system32\Jbieoh32.exe
        78⤵
        
        PID:7616
        
        C:\Windows\SysWOW64\Jchaik32.exe
        
        C:\Windows\system32\Jchaik32.exe
        79⤵
        
        PID:6780

C:\Windows\SysWOW64\Joobnlkf.exe
C:\Windows\system32\Joobnlkf.exe
1⤵
PID:1580
- C:\Windows\SysWOW64\Kijclaod.exe
  C:\Windows\system32\Kijclaod.exe
  2⤵
  PID:7596
- - C:\Windows\SysWOW64\Kmhlbp32.exe
    C:\Windows\system32\Kmhlbp32.exe
    3⤵
    PID:7172
  - - C:\Windows\SysWOW64\Kmjihoch.exe
      C:\Windows\system32\Kmjihoch.exe
      4⤵
      PID:4976
    - - C:\Windows\SysWOW64\Kbgapfao.exe
        
        C:\Windows\system32\Kbgapfao.exe
        5⤵
        
        PID:8012
      - C:\Windows\SysWOW64\Kmlemoae.exe
        
        C:\Windows\system32\Kmlemoae.exe
        6⤵
        
        PID:6364
        
        C:\Windows\SysWOW64\Kbinefpl.exe
        
        C:\Windows\system32\Kbinefpl.exe
        7⤵
        
        PID:7724
        
        C:\Windows\SysWOW64\Licfbpgi.exe
        
        C:\Windows\system32\Licfbpgi.exe
        8⤵
        
        PID:7812
        
        C:\Windows\SysWOW64\Lcijpigo.exe
        
        C:\Windows\system32\Lcijpigo.exe
        9⤵
        
        PID:7124
        
        C:\Windows\SysWOW64\Lkdodkdj.exe
        
        C:\Windows\system32\Lkdodkdj.exe
        10⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\Limihooo.exe
        
        C:\Windows\system32\Limihooo.exe
        11⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Mpinkh32.exe
        
        C:\Windows\system32\Mpinkh32.exe
        12⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\Miabcnki.exe
        
        C:\Windows\system32\Miabcnki.exe
        13⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Mjaonabl.exe
        
        C:\Windows\system32\Mjaonabl.exe
        14⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Mclplffj.exe
        
        C:\Windows\system32\Mclplffj.exe
        15⤵
        
        PID:3468
        
        C:\Windows\SysWOW64\Mlgephde.exe
        
        C:\Windows\system32\Mlgephde.exe
        16⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\Npdnfgjk.exe
        
        C:\Windows\system32\Npdnfgjk.exe
        17⤵
        
        PID:932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Admkgifd.exe

Filesize
75KB

MD5
29cfb83f5a8866ff1be8f3f38d006cd8

SHA1
3f5999bd4325e5c3c3f1475bf23893f4bf4b6ab9

SHA256
10a185ac06704a168c58ce1d3ff0db3a73b19eeace10ca74db310950ddfe32c4

SHA512
17fdba2935d81368a7d03242fd004a4d81b070dce6f3140869e716bcda89d9c94bc6fed1d52c429d71947ce363152761c83d9d8a90739854fbcfc7b46bfc0187

Download Submit
C:\Windows\SysWOW64\Admkgifd.exe

Filesize
75KB

MD5
29cfb83f5a8866ff1be8f3f38d006cd8

SHA1
3f5999bd4325e5c3c3f1475bf23893f4bf4b6ab9

SHA256
10a185ac06704a168c58ce1d3ff0db3a73b19eeace10ca74db310950ddfe32c4

SHA512
17fdba2935d81368a7d03242fd004a4d81b070dce6f3140869e716bcda89d9c94bc6fed1d52c429d71947ce363152761c83d9d8a90739854fbcfc7b46bfc0187

Download Submit
C:\Windows\SysWOW64\Aihaifam.exe

Filesize
75KB

MD5
1b7e60bea9d5ea14f6cdd4638c3ce12b

SHA1
836201d32fefa77962cfc5ec7f6423e10bb30383

SHA256
edbaa0199234a022f927e1a1ef0d7aef7cd96a40a28827b75bf839bb6a96e50a

SHA512
0c1a8d32e612b458122beb3781778fed0790d8220ba2495224ece3442f6404c1666f9493797a8ad7a50e8a60793b088e3ac7efb01093309b691160b12d94a282

Download Submit
C:\Windows\SysWOW64\Bcinie32.exe

Filesize
64KB

MD5
0040fbc504e2b7c8bdd0dfa4364a2459

SHA1
6ccaee64673a6ff1bf2c3feeb4e185455fd1ce21

SHA256
d723c68d654aa64b541fa764ca7ce007bc05236966084a84f5f11c32dcec51c0

SHA512
9c6450a466731b035f8d2930bcc333be9370ff4c47cf80539572562908977a2a71ee89027f3c0f51d129ab6e6f7508c6809462438da2102000519ce665e80081

Download Submit
C:\Windows\SysWOW64\Bcinie32.exe

Filesize
75KB

MD5
e9baae3314b86dca85719c788efc515c

SHA1
e2de5996a7b2af8af324b13304297507aa527076

SHA256
37063db03ca22d161542a81acccf0cfa31b167f9ec228b9b65ceed581064632a

SHA512
428f6729a798fa2ae12528bd3c39042bdae0bea6ea1c6a6f6793672a7375957541663061fd1f8fbccc7aa2d76ab52a838abacbee6f087ca6d54c16508ee90220

Download Submit
C:\Windows\SysWOW64\Bcinie32.exe

Filesize
75KB

MD5
e9baae3314b86dca85719c788efc515c

SHA1
e2de5996a7b2af8af324b13304297507aa527076

SHA256
37063db03ca22d161542a81acccf0cfa31b167f9ec228b9b65ceed581064632a

SHA512
428f6729a798fa2ae12528bd3c39042bdae0bea6ea1c6a6f6793672a7375957541663061fd1f8fbccc7aa2d76ab52a838abacbee6f087ca6d54c16508ee90220

Download Submit
C:\Windows\SysWOW64\Bdlncn32.exe

Filesize
75KB

MD5
257e7aad14de0cd1b39167aa22c581f1

SHA1
3349a6532ac36ce3ca5d63fe67ba5c2f2100248d

SHA256
9d0f729b5f77577f35db2420bfbc50bad1a80f07fccc8f483e86c5e8e7da9a2e

SHA512
160fd8214a022d19debbb29e594f4a17f8fa5a63526d72fa7446d627d4ff569dec2ed3ee132f841175d8047f68603f0cbce5c3d75a73a2fd620dd338067ae675

Download Submit
C:\Windows\SysWOW64\Bdlncn32.exe

Filesize
75KB

MD5
257e7aad14de0cd1b39167aa22c581f1

SHA1
3349a6532ac36ce3ca5d63fe67ba5c2f2100248d

SHA256
9d0f729b5f77577f35db2420bfbc50bad1a80f07fccc8f483e86c5e8e7da9a2e

SHA512
160fd8214a022d19debbb29e594f4a17f8fa5a63526d72fa7446d627d4ff569dec2ed3ee132f841175d8047f68603f0cbce5c3d75a73a2fd620dd338067ae675

Download Submit
C:\Windows\SysWOW64\Beqljn32.exe

Filesize
75KB

MD5
07a96173c132716b4f6031f03417bd4e

SHA1
2d802a6dfb1fb9fc540b0bc2fbc3a00f4804f1bb

SHA256
52424adf2f847b54eda583bd935e3028968651cdb7d8e266767782b50fba9e58

SHA512
22137d53b932ae01493600135f265aa7bacbea24df1eefbcb931d3dbe620be4cbc884fa569b3a374a62ada3e08187e3d2bdb790e3e99b6c01cce82fbe33ea19c

Download Submit
C:\Windows\SysWOW64\Bjeckojo.exe

Filesize
75KB

MD5
6b45017b80feffa9709b0a6d02244998

SHA1
f076ff43fe959ecec18aca8d74df852b387cbc5c

SHA256
5c850ff95c6574b0311ac6fe56c6878245a87195e8bd4ebb35871e10bf38847f

SHA512
c72cda054b18dd20963a5baa809bfacc54da9fa3c7a096814dafb85a363655266280d8e13f3585ff2ddc2585303173d09a3992cba1d74daf382163d1af7b9e9e

Download Submit
C:\Windows\SysWOW64\Bjeckojo.exe

Filesize
75KB

MD5
6b45017b80feffa9709b0a6d02244998

SHA1
f076ff43fe959ecec18aca8d74df852b387cbc5c

SHA256
5c850ff95c6574b0311ac6fe56c6878245a87195e8bd4ebb35871e10bf38847f

SHA512
c72cda054b18dd20963a5baa809bfacc54da9fa3c7a096814dafb85a363655266280d8e13f3585ff2ddc2585303173d09a3992cba1d74daf382163d1af7b9e9e

Download Submit
C:\Windows\SysWOW64\Blflmj32.exe

Filesize
75KB

MD5
e3f312f4517204e91ac0edecd8fa6d60

SHA1
35b64ab95844d5d783b08ed4fb6b8f48ab82044a

SHA256
df2fd4790f173b01171db8f97a98090587189a759df3a3edf20d3e609729a0fb

SHA512
e444c8d5639a08d545d06e5d17d10f7c9dd4162afa7f1a7899e6c3a13f90d57dde5dd58237979c836fca1ad5142f90a1d37fa580a7f0525ade3c9e6f5c71f60e

Download Submit
C:\Windows\SysWOW64\Blflmj32.exe

Filesize
75KB

MD5
e3f312f4517204e91ac0edecd8fa6d60

SHA1
35b64ab95844d5d783b08ed4fb6b8f48ab82044a

SHA256
df2fd4790f173b01171db8f97a98090587189a759df3a3edf20d3e609729a0fb

SHA512
e444c8d5639a08d545d06e5d17d10f7c9dd4162afa7f1a7899e6c3a13f90d57dde5dd58237979c836fca1ad5142f90a1d37fa580a7f0525ade3c9e6f5c71f60e

Download Submit
C:\Windows\SysWOW64\Cbnknpqj.exe

Filesize
75KB

MD5
abfb665401ff8c419e2b104068618b27

SHA1
0510e8e4db20d2303ab9ef720ec2d0ce91322ab4

SHA256
731720d47ac86d5f5d82d6ea952d56f3b6c9360a4d6df1ce457e9628d6b41168

SHA512
bcd036abf43f40f4f1d0c295c811cfae041b654f7643dd8945b19c2d6b1c44e9977ac4f2c7de0942f790c82d265ef206737dd17516c9ee46535949207c763bd3

Download Submit
C:\Windows\SysWOW64\Cbnknpqj.exe

Filesize
75KB

MD5
abfb665401ff8c419e2b104068618b27

SHA1
0510e8e4db20d2303ab9ef720ec2d0ce91322ab4

SHA256
731720d47ac86d5f5d82d6ea952d56f3b6c9360a4d6df1ce457e9628d6b41168

SHA512
bcd036abf43f40f4f1d0c295c811cfae041b654f7643dd8945b19c2d6b1c44e9977ac4f2c7de0942f790c82d265ef206737dd17516c9ee46535949207c763bd3

Download Submit
C:\Windows\SysWOW64\Cbnknpqj.exe

Filesize
75KB

MD5
abfb665401ff8c419e2b104068618b27

SHA1
0510e8e4db20d2303ab9ef720ec2d0ce91322ab4

SHA256
731720d47ac86d5f5d82d6ea952d56f3b6c9360a4d6df1ce457e9628d6b41168

SHA512
bcd036abf43f40f4f1d0c295c811cfae041b654f7643dd8945b19c2d6b1c44e9977ac4f2c7de0942f790c82d265ef206737dd17516c9ee46535949207c763bd3

Download Submit
C:\Windows\SysWOW64\Cecbgl32.exe

Filesize
75KB

MD5
8cbc7699ff1bfd8b183cb79a0906805c

SHA1
2ae8111592fd60a63e61cfbe0eb84649820415ff

SHA256
356d64fd8968f8bda8ae6f6328165df6b40215dec670ee0b50df17f282c47e90

SHA512
3bbe7314713316bfb350ff228029c3ca6ca4fecd2bd9d9d5482e397dcf838d81e4457ae3e62d228b24a23f0e8b2cdaf4921bcde9ac1fa30d3c46f14e2f5e3614

Download Submit
C:\Windows\SysWOW64\Cjofambd.exe

Filesize
75KB

MD5
e3f312f4517204e91ac0edecd8fa6d60

SHA1
35b64ab95844d5d783b08ed4fb6b8f48ab82044a

SHA256
df2fd4790f173b01171db8f97a98090587189a759df3a3edf20d3e609729a0fb

SHA512
e444c8d5639a08d545d06e5d17d10f7c9dd4162afa7f1a7899e6c3a13f90d57dde5dd58237979c836fca1ad5142f90a1d37fa580a7f0525ade3c9e6f5c71f60e

Download Submit
C:\Windows\SysWOW64\Cjofambd.exe

Filesize
75KB

MD5
65a282d9b53d61b7d5096ef969885b4a

SHA1
8a733fa7add5dd62db7e56352955e69ae60f100c

SHA256
a0268d5230c4f8fd9dabbd4714ed77fec6772ab9df794f7072d148338bf8d917

SHA512
7d0632b0329cb9964a6eca2255516a3f1bb077bad92fdeab5520126fb8df07b3820e3b6d912eea3e03a473b9123dd9827ac6caca3394f64e95c7927574aa9937

Download Submit
C:\Windows\SysWOW64\Cjofambd.exe

Filesize
75KB

MD5
65a282d9b53d61b7d5096ef969885b4a

SHA1
8a733fa7add5dd62db7e56352955e69ae60f100c

SHA256
a0268d5230c4f8fd9dabbd4714ed77fec6772ab9df794f7072d148338bf8d917

SHA512
7d0632b0329cb9964a6eca2255516a3f1bb077bad92fdeab5520126fb8df07b3820e3b6d912eea3e03a473b9123dd9827ac6caca3394f64e95c7927574aa9937

Download Submit
C:\Windows\SysWOW64\Ckcbaf32.exe

Filesize
75KB

MD5
25c6d990a319893d053216d05097c8e5

SHA1
dee0fbfa8b54c87031acc322c133a1b32da23d9f

SHA256
111769c6975ca60310d40e173f2be3f0014d35d85f69b229a6d02bbe6c497cb9

SHA512
be57990b6506a966566e5d9a0f0af785fdf82f219e0bde5db631b5c8fcd7db268bcdfe30929572fd58226d868cd6287243acb6a661c03bc504ac6f648b0170c4

Download Submit
C:\Windows\SysWOW64\Ckcbaf32.exe

Filesize
75KB

MD5
25c6d990a319893d053216d05097c8e5

SHA1
dee0fbfa8b54c87031acc322c133a1b32da23d9f

SHA256
111769c6975ca60310d40e173f2be3f0014d35d85f69b229a6d02bbe6c497cb9

SHA512
be57990b6506a966566e5d9a0f0af785fdf82f219e0bde5db631b5c8fcd7db268bcdfe30929572fd58226d868cd6287243acb6a661c03bc504ac6f648b0170c4

Download Submit
C:\Windows\SysWOW64\Dalkek32.exe

Filesize
75KB

MD5
4f71201bac19e157903ed835cb7ab4d4

SHA1
03703ee6a1dba991d5664829a68ef92d3cc1288b

SHA256
4085f4b936e4905a9c8b54190b796007cce0f858d1cc62138cb44ca04c5721a7

SHA512
785dd3658579d6f09c5101cd56bc40cfd82aa3b4c7df97285b36358ab40ca929497568711facc070979649c496a1d2c3bc530e0bb63d159bc7e1f35d742fac6a

Download Submit
C:\Windows\SysWOW64\Dalkek32.exe

Filesize
75KB

MD5
4f71201bac19e157903ed835cb7ab4d4

SHA1
03703ee6a1dba991d5664829a68ef92d3cc1288b

SHA256
4085f4b936e4905a9c8b54190b796007cce0f858d1cc62138cb44ca04c5721a7

SHA512
785dd3658579d6f09c5101cd56bc40cfd82aa3b4c7df97285b36358ab40ca929497568711facc070979649c496a1d2c3bc530e0bb63d159bc7e1f35d742fac6a

Download Submit
C:\Windows\SysWOW64\Ddnmeejo.exe

Filesize
75KB

MD5
8bae52c2a723e073048424682ee3fc48

SHA1
026ddbfc4632c52beefe883646bdda9cbdfd20e8

SHA256
33d59e2d3d62ba1906c5acee6c522ae717b47f83f0e1ffc46f1156b0536e906a

SHA512
17ed07714ea2e620164e8a6f4fd977db7251b1cf910f497e97f2340017940182192a40f917a83c6851c0465928328a3758b4e6d4abd323e9e0668403869a37ef

Download Submit
C:\Windows\SysWOW64\Ddnmeejo.exe

Filesize
75KB

MD5
8bae52c2a723e073048424682ee3fc48

SHA1
026ddbfc4632c52beefe883646bdda9cbdfd20e8

SHA256
33d59e2d3d62ba1906c5acee6c522ae717b47f83f0e1ffc46f1156b0536e906a

SHA512
17ed07714ea2e620164e8a6f4fd977db7251b1cf910f497e97f2340017940182192a40f917a83c6851c0465928328a3758b4e6d4abd323e9e0668403869a37ef

Download Submit
C:\Windows\SysWOW64\Dfqogfjo.exe

Filesize
75KB

MD5
0e8040ca4573014252d28a8545ddb117

SHA1
91d8176d9eb7efd9e51bcc84dd18c7bbce99389a

SHA256
2d6abb676089a0f9e6cab3201a4d667b1cc5d1f1a726bbdd835e6c87f51ad2fa

SHA512
9c02339393d3ffc909b373fdb562f121ad4f5d890a8577c610c23e2ddf98651b68d6237dc9c44aa3fb231f3275c1d0ee7b7e36ff35dc66d44b7c9529b34543fc

Download Submit
C:\Windows\SysWOW64\Dgplai32.exe

Filesize
75KB

MD5
be4662dfb63b632355535cd71bf9eaaf

SHA1
496f02cdee885c08cec17f005565bc87f0b3810f

SHA256
b247fcbf3e49f718ea3d430107a544091ff76d00f3da7e31f380354d50d5d340

SHA512
f0b3f453d04b82ec98d826414bb41e39c782fed4b53ee79f163e82b0665361b439006f956dd4ba34572e1d5ba75665857905d202c14b3e47637def9baea266da

Download Submit
C:\Windows\SysWOW64\Eaqdpjia.exe

Filesize
75KB

MD5
b41435fcdafd64aa0d3294f8718c4603

SHA1
ba97548f71c404ab3ddf9a9b7c6b2899a6d6bcd9

SHA256
7257c0baa8abc5f49398ef9e473f0df581522320e8cc9e8dc2240dc81f716f46

SHA512
acf1c2f88b3121161cce41d8a966b998e13f02a81f1aa7ce9497580d942e34e740ee92343c35108016f91d7fca7b97d7ce0fde7ed80188bd8036083903f6c8e0

Download Submit
C:\Windows\SysWOW64\Eaqdpjia.exe

Filesize
75KB

MD5
b41435fcdafd64aa0d3294f8718c4603

SHA1
ba97548f71c404ab3ddf9a9b7c6b2899a6d6bcd9

SHA256
7257c0baa8abc5f49398ef9e473f0df581522320e8cc9e8dc2240dc81f716f46

SHA512
acf1c2f88b3121161cce41d8a966b998e13f02a81f1aa7ce9497580d942e34e740ee92343c35108016f91d7fca7b97d7ce0fde7ed80188bd8036083903f6c8e0

Download Submit
C:\Windows\SysWOW64\Ecoiapdj.exe

Filesize
75KB

MD5
e95c2ca39dcb7195c5621394c15aac41

SHA1
17c1b7dcead9fd61064b5a08d4590a1e032063cb

SHA256
18ee5e06a365cc1405ad1c30f8f7b4e21ace85ad88112723b720316ef28bdc06

SHA512
ee1060aeea0b46cde3b65d2272732fef9116e056abd7f35bce1c4f99e11e4697d340004f650d2e4be3a293d2ed7b5a9b26ff6798fa5b3dcdb3f0ff18b018cf33

Download Submit
C:\Windows\SysWOW64\Ecoiapdj.exe

Filesize
75KB

MD5
e95c2ca39dcb7195c5621394c15aac41

SHA1
17c1b7dcead9fd61064b5a08d4590a1e032063cb

SHA256
18ee5e06a365cc1405ad1c30f8f7b4e21ace85ad88112723b720316ef28bdc06

SHA512
ee1060aeea0b46cde3b65d2272732fef9116e056abd7f35bce1c4f99e11e4697d340004f650d2e4be3a293d2ed7b5a9b26ff6798fa5b3dcdb3f0ff18b018cf33

Download Submit
C:\Windows\SysWOW64\Eegpkcbd.exe

Filesize
75KB

MD5
1d19cd1c72a6f7d6b1ef8407f22bf70d

SHA1
0bfad5b2f8c3ca9be5a2afe5c2fc9875c963baba

SHA256
e335865c3453932516cc0a4ff4cc99bf1f4545ead7bea363891fa79b94a47a01

SHA512
0d4e84b1e0b3c2ae6927409b0b2ca51ce72acc58066822790e39a00841da6c720801ef9b3a55781a7c7d882199346e6d018911a1faf6a56ae85b8f7577cb7f7c

Download Submit
C:\Windows\SysWOW64\Eegpkcbd.exe

Filesize
75KB

MD5
1d19cd1c72a6f7d6b1ef8407f22bf70d

SHA1
0bfad5b2f8c3ca9be5a2afe5c2fc9875c963baba

SHA256
e335865c3453932516cc0a4ff4cc99bf1f4545ead7bea363891fa79b94a47a01

SHA512
0d4e84b1e0b3c2ae6927409b0b2ca51ce72acc58066822790e39a00841da6c720801ef9b3a55781a7c7d882199346e6d018911a1faf6a56ae85b8f7577cb7f7c

Download Submit
C:\Windows\SysWOW64\Ehklmd32.exe

Filesize
75KB

MD5
c40725f694873360f5966190dc0e8943

SHA1
f3147dcdbdcb5452c8fc2a5699a0da4888f5648c

SHA256
41f0e3475ce75eceb6147c36ee9b041e7396f8576267f572546200673b088fe2

SHA512
840a3244963bda6471aae1650fc177a003987e791685476b985fbb0fdc88d5dc0a10e7bf79117b76489047b46d5e42fa15894c06cd00a849a6b0a1315bf95c7e

Download Submit
C:\Windows\SysWOW64\Ehklmd32.exe

Filesize
75KB

MD5
c40725f694873360f5966190dc0e8943

SHA1
f3147dcdbdcb5452c8fc2a5699a0da4888f5648c

SHA256
41f0e3475ce75eceb6147c36ee9b041e7396f8576267f572546200673b088fe2

SHA512
840a3244963bda6471aae1650fc177a003987e791685476b985fbb0fdc88d5dc0a10e7bf79117b76489047b46d5e42fa15894c06cd00a849a6b0a1315bf95c7e

Download Submit
C:\Windows\SysWOW64\Elhnhm32.exe

Filesize
75KB

MD5
37c5d672781302dcc7b9ecc68f356424

SHA1
099c1c6a751b88b1d67dad1d88fb4f2f1008e24d

SHA256
b45f6c83a51c5a44160f018cbc075e34129148f6460ce22caf0a62d112b14ffd

SHA512
a31c17cf557287370e367803b4a497b3605163209909b188603add12da583fe43e823fba492df002698b55f999be56b7ec6e9301d188432e03e7404a67c98e5e

Download Submit
C:\Windows\SysWOW64\Elhnhm32.exe

Filesize
75KB

MD5
37c5d672781302dcc7b9ecc68f356424

SHA1
099c1c6a751b88b1d67dad1d88fb4f2f1008e24d

SHA256
b45f6c83a51c5a44160f018cbc075e34129148f6460ce22caf0a62d112b14ffd

SHA512
a31c17cf557287370e367803b4a497b3605163209909b188603add12da583fe43e823fba492df002698b55f999be56b7ec6e9301d188432e03e7404a67c98e5e

Download Submit
C:\Windows\SysWOW64\Emgnje32.exe

Filesize
75KB

MD5
05d4c68799e73ad2a8da201a98285b23

SHA1
a02aa9c7785b2a92f38efaa987fa01d817d9a15b

SHA256
6c7f7241d91a6cedbf93b5557069a6f6f161208313b413d43b364717de6a2a47

SHA512
2d4621191985030e2400b014e223a7ca21c10531f0ec4e67dbb91a844e89392a13c619aa936a1c873a5a20c286ef4745350f83efe0ba2b7ecae55a92a249a86c

Download Submit
C:\Windows\SysWOW64\Emgnje32.exe

Filesize
75KB

MD5
05d4c68799e73ad2a8da201a98285b23

SHA1
a02aa9c7785b2a92f38efaa987fa01d817d9a15b

SHA256
6c7f7241d91a6cedbf93b5557069a6f6f161208313b413d43b364717de6a2a47

SHA512
2d4621191985030e2400b014e223a7ca21c10531f0ec4e67dbb91a844e89392a13c619aa936a1c873a5a20c286ef4745350f83efe0ba2b7ecae55a92a249a86c

Download Submit
C:\Windows\SysWOW64\Feella32.exe

Filesize
75KB

MD5
c30ea5f66f61edc61fcdc566ea2ee256

SHA1
66c7583f79d83da5e3da66406b774e8a35f5d949

SHA256
d72585374ba082467bd1ef610486adbd5c8a66a7d630348959b877de6f3a2958

SHA512
40e8a2ef58d82537f193a08fd9a73720f5b7e884eee00fc4528747a2028388a7a4f8a7d92fc4fa30f3fe97d5db7be527b4784337a5f49b11dc3cea9b9968e7e5

Download Submit
C:\Windows\SysWOW64\Feella32.exe

Filesize
75KB

MD5
c30ea5f66f61edc61fcdc566ea2ee256

SHA1
66c7583f79d83da5e3da66406b774e8a35f5d949

SHA256
d72585374ba082467bd1ef610486adbd5c8a66a7d630348959b877de6f3a2958

SHA512
40e8a2ef58d82537f193a08fd9a73720f5b7e884eee00fc4528747a2028388a7a4f8a7d92fc4fa30f3fe97d5db7be527b4784337a5f49b11dc3cea9b9968e7e5

Download Submit
C:\Windows\SysWOW64\Fjdajhbi.exe

Filesize
75KB

MD5
7ef6e925eccbc9981195610c789f6afd

SHA1
5298922d138976e103542c95ba4c6916ebd1f8ac

SHA256
9684d9a54d2ad91470718cdf00599c6d42cf4ac7ababecad8a2765a560882f97

SHA512
84d7b98ab1ebd711bd775acb4d1d3c9f0767e9431d49df3ebe082aedf6c50495cae8dc8ce51d1cd7a3be6ef12ba0de4639c14000078fbb4237615a97609a14bb

Download Submit
C:\Windows\SysWOW64\Fjdajhbi.exe

Filesize
75KB

MD5
7ef6e925eccbc9981195610c789f6afd

SHA1
5298922d138976e103542c95ba4c6916ebd1f8ac

SHA256
9684d9a54d2ad91470718cdf00599c6d42cf4ac7ababecad8a2765a560882f97

SHA512
84d7b98ab1ebd711bd775acb4d1d3c9f0767e9431d49df3ebe082aedf6c50495cae8dc8ce51d1cd7a3be6ef12ba0de4639c14000078fbb4237615a97609a14bb

Download Submit
C:\Windows\SysWOW64\Flbhia32.exe

Filesize
75KB

MD5
6025b6da89e4112f4da937a6af1701da

SHA1
eb2a1ea27f9f9c001c0654cfa872c30273914aa4

SHA256
d0d2731a0da3882b0796291afac1fc7cc18714a9c5ccf069dc0019c313f56aca

SHA512
a1efb3020594c1405d9ee4c75ff44008b0aae81f90aeef5d9c89c03528ae310a8262b36fd8998131b4274654be0ac3e877b87cf6d289ae8c83a75889ac3f4e45

Download Submit
C:\Windows\SysWOW64\Flbhia32.exe

Filesize
75KB

MD5
6025b6da89e4112f4da937a6af1701da

SHA1
eb2a1ea27f9f9c001c0654cfa872c30273914aa4

SHA256
d0d2731a0da3882b0796291afac1fc7cc18714a9c5ccf069dc0019c313f56aca

SHA512
a1efb3020594c1405d9ee4c75ff44008b0aae81f90aeef5d9c89c03528ae310a8262b36fd8998131b4274654be0ac3e877b87cf6d289ae8c83a75889ac3f4e45

Download Submit
C:\Windows\SysWOW64\Fmejlcoj.exe

Filesize
75KB

MD5
e5b28696e3ecbea3921202a62f32919c

SHA1
e0302ba3ff9ed0b70898ca6cee5f43fdc08f4f6a

SHA256
05486ef83deb3bd1b5c621761dec34331cc871f4e1c99e49e13a6e5f71e89b30

SHA512
322a178b3928741dd9f445753a7fe3f0a643397d015338631ffff66848b03cdaf9238397f5f05a057a9e514dd29c3e389dfbd092ea56d59e918e450c22203d21

Download Submit
C:\Windows\SysWOW64\Fmejlcoj.exe

Filesize
75KB

MD5
e5b28696e3ecbea3921202a62f32919c

SHA1
e0302ba3ff9ed0b70898ca6cee5f43fdc08f4f6a

SHA256
05486ef83deb3bd1b5c621761dec34331cc871f4e1c99e49e13a6e5f71e89b30

SHA512
322a178b3928741dd9f445753a7fe3f0a643397d015338631ffff66848b03cdaf9238397f5f05a057a9e514dd29c3e389dfbd092ea56d59e918e450c22203d21

Download Submit
C:\Windows\SysWOW64\Ghohdk32.exe

Filesize
75KB

MD5
9a843aa7487880fedea2042062cfe89e

SHA1
64aaabc01a4900d6b82295b351edb9cdc8674e87

SHA256
07922b5fd0a7f546b24074af0b8eef631cdba42c1bcbae89d0e403c597773c9a

SHA512
88227b8356caf2e064195c97200146a25763a0e5a58da4f559be87e1dd3d450b4bedb994563935dbe39fdee2f7ab82599572e04f48eaff4caeb02556bf394cc3

Download Submit
C:\Windows\SysWOW64\Ghohdk32.exe

Filesize
75KB

MD5
9a843aa7487880fedea2042062cfe89e

SHA1
64aaabc01a4900d6b82295b351edb9cdc8674e87

SHA256
07922b5fd0a7f546b24074af0b8eef631cdba42c1bcbae89d0e403c597773c9a

SHA512
88227b8356caf2e064195c97200146a25763a0e5a58da4f559be87e1dd3d450b4bedb994563935dbe39fdee2f7ab82599572e04f48eaff4caeb02556bf394cc3

Download Submit
C:\Windows\SysWOW64\Gklnem32.exe

Filesize
75KB

MD5
31d34fd369216d43d0d8e9e75f5b9e62

SHA1
a5ac42c83aacd1b74772dafc2a983121b497f691

SHA256
27c0dec0c8da7171e434f341b1e63869b24c4930508f9e980749ae00ed1959ca

SHA512
a08a36aa6c78f721a51978b633c7b2ffa88bcbe543275def620d2384d546fea35861936074b7a324d869ef5ae52773863731955d6658e8f02c6583e73d70d7f8

Download Submit
C:\Windows\SysWOW64\Gklnem32.exe

Filesize
75KB

MD5
31d34fd369216d43d0d8e9e75f5b9e62

SHA1
a5ac42c83aacd1b74772dafc2a983121b497f691

SHA256
27c0dec0c8da7171e434f341b1e63869b24c4930508f9e980749ae00ed1959ca

SHA512
a08a36aa6c78f721a51978b633c7b2ffa88bcbe543275def620d2384d546fea35861936074b7a324d869ef5ae52773863731955d6658e8f02c6583e73d70d7f8

Download Submit
C:\Windows\SysWOW64\Glpdjpbj.exe

Filesize
75KB

MD5
3b4872c7409c78fe8ca6c39e7991d593

SHA1
182995e6ad359c7a37834682c6db9be5a041cdcd

SHA256
cb1abe3d8e35948aa3bc4a07d6f56f63c7e5887aa8dea368e4cdacee59183c76

SHA512
36d5ae17d07000dc3f8aa4fd112cb0c4a30acb733247b1cbb7328b20493e336cf60f30cffad3a29d282b65a0f877e8b621d02e565f0acfb4f580a75a0922c240

Download Submit
C:\Windows\SysWOW64\Glpdjpbj.exe

Filesize
75KB

MD5
3b4872c7409c78fe8ca6c39e7991d593

SHA1
182995e6ad359c7a37834682c6db9be5a041cdcd

SHA256
cb1abe3d8e35948aa3bc4a07d6f56f63c7e5887aa8dea368e4cdacee59183c76

SHA512
36d5ae17d07000dc3f8aa4fd112cb0c4a30acb733247b1cbb7328b20493e336cf60f30cffad3a29d282b65a0f877e8b621d02e565f0acfb4f580a75a0922c240

Download Submit
C:\Windows\SysWOW64\Haeadi32.exe

Filesize
75KB

MD5
a6f3d948c4c125bee6337b93d051796b

SHA1
064d9cb071168b2a20edc6971912726d281facb1

SHA256
137ec2c11b1b86abda8ea0bbc2d1a7d34c9c5dce4e4b96492435cb7325016d05

SHA512
75d13799e261287ebbf2fd92be8fb2171c406065644f3bfbf026e8f903fa5fb1519a2b689d982a42c3f4e5857dd4306c2f5f1ecede14fca61993f9d79beba5ae

Download Submit
C:\Windows\SysWOW64\Hhnkppbf.exe

Filesize
75KB

MD5
9cfa27c848d5e178b47e4a3cf6406ece

SHA1
95955de66c2e0fe47fd61f8ce51237772a5d95c3

SHA256
6cd3dcd363636768b6247310ca02707c7d179fdf3775f97532f41c508c88c0dc

SHA512
c2a0f12b2b5a3cc563f6c2173a9439548e2e809cf6974f07e78cab3a72729809dacc9dde89bba8ba3f82135e754e84805b11297a6fcb0d852df318d40bde9e49

Download Submit
C:\Windows\SysWOW64\Hhnkppbf.exe

Filesize
75KB

MD5
9cfa27c848d5e178b47e4a3cf6406ece

SHA1
95955de66c2e0fe47fd61f8ce51237772a5d95c3

SHA256
6cd3dcd363636768b6247310ca02707c7d179fdf3775f97532f41c508c88c0dc

SHA512
c2a0f12b2b5a3cc563f6c2173a9439548e2e809cf6974f07e78cab3a72729809dacc9dde89bba8ba3f82135e754e84805b11297a6fcb0d852df318d40bde9e49

Download Submit
C:\Windows\SysWOW64\Hhnkppbf.exe

Filesize
75KB

MD5
9cfa27c848d5e178b47e4a3cf6406ece

SHA1
95955de66c2e0fe47fd61f8ce51237772a5d95c3

SHA256
6cd3dcd363636768b6247310ca02707c7d179fdf3775f97532f41c508c88c0dc

SHA512
c2a0f12b2b5a3cc563f6c2173a9439548e2e809cf6974f07e78cab3a72729809dacc9dde89bba8ba3f82135e754e84805b11297a6fcb0d852df318d40bde9e49

Download Submit
C:\Windows\SysWOW64\Icjengld.exe

Filesize
75KB

MD5
9cfa27c848d5e178b47e4a3cf6406ece

SHA1
95955de66c2e0fe47fd61f8ce51237772a5d95c3

SHA256
6cd3dcd363636768b6247310ca02707c7d179fdf3775f97532f41c508c88c0dc

SHA512
c2a0f12b2b5a3cc563f6c2173a9439548e2e809cf6974f07e78cab3a72729809dacc9dde89bba8ba3f82135e754e84805b11297a6fcb0d852df318d40bde9e49

Download Submit
C:\Windows\SysWOW64\Icjengld.exe

Filesize
75KB

MD5
363b86d39b496729bb87bf86bac9ee29

SHA1
07fcc4b20f1d1429321f7e448925067f725a885b

SHA256
3f4196dd2c4ad0d8474abd18ea0721374331bc8218916032e046a3f157127183

SHA512
d9058fe99e7941bb70a511d074e7a27a168cf4ee364f470a293c821a980472dabd0a9e11bb530b8ac592a7852ec34173c8ba7703e5ac28c6fcf2864d35e35fed

Download Submit
C:\Windows\SysWOW64\Icjengld.exe

Filesize
75KB

MD5
363b86d39b496729bb87bf86bac9ee29

SHA1
07fcc4b20f1d1429321f7e448925067f725a885b

SHA256
3f4196dd2c4ad0d8474abd18ea0721374331bc8218916032e046a3f157127183

SHA512
d9058fe99e7941bb70a511d074e7a27a168cf4ee364f470a293c821a980472dabd0a9e11bb530b8ac592a7852ec34173c8ba7703e5ac28c6fcf2864d35e35fed

Download Submit
C:\Windows\SysWOW64\Ikmpcicg.exe

Filesize
75KB

MD5
ccda5f2df235d5e960e000cb1a56c51f

SHA1
48e16ff8e62c1eb71c39587427d6549cb1485155

SHA256
6ffe34828f1c2643e0854643b42f67ebe27fb65202e867ef47d9e04f0b219efa

SHA512
ad59aa621b13a91167e1e6c4cb066dcc9851a80581b98de4ad183a7bb5679d8c6d3aec78ea1e167ea16d9624ce8de732887cddb38a57025eb84e5dd45af284fa

Download Submit
C:\Windows\SysWOW64\Ikmpcicg.exe

Filesize
75KB

MD5
ccda5f2df235d5e960e000cb1a56c51f

SHA1
48e16ff8e62c1eb71c39587427d6549cb1485155

SHA256
6ffe34828f1c2643e0854643b42f67ebe27fb65202e867ef47d9e04f0b219efa

SHA512
ad59aa621b13a91167e1e6c4cb066dcc9851a80581b98de4ad183a7bb5679d8c6d3aec78ea1e167ea16d9624ce8de732887cddb38a57025eb84e5dd45af284fa

Download Submit
C:\Windows\SysWOW64\Jfdafa32.exe

Filesize
75KB

MD5
596a797abf64fb88b3fbaba919ac0625

SHA1
8ddbceefaf6a00ffafc8f89682397abee8f48879

SHA256
4f39c45495c5f6d297a11181ca9899dd31a9d404bb9ab5b511188cf84b8bcc3d

SHA512
7d41990b052cd2bdf0a10ee6d6e9390f7e3768e51225392a0d55efad506774762ab2e3ac354639fa5f96b9149f3969815324dad5943689b7797158c5e753e7e7

Download Submit
C:\Windows\SysWOW64\Jfdafa32.exe

Filesize
75KB

MD5
596a797abf64fb88b3fbaba919ac0625

SHA1
8ddbceefaf6a00ffafc8f89682397abee8f48879

SHA256
4f39c45495c5f6d297a11181ca9899dd31a9d404bb9ab5b511188cf84b8bcc3d

SHA512
7d41990b052cd2bdf0a10ee6d6e9390f7e3768e51225392a0d55efad506774762ab2e3ac354639fa5f96b9149f3969815324dad5943689b7797158c5e753e7e7

Download Submit
C:\Windows\SysWOW64\Kobnji32.exe

Filesize
75KB

MD5
fff1eec1224b8b57c7038ae115768852

SHA1
0c62ab605c010ca404d83cf75150c3fc34d9e163

SHA256
4ac806eb08bde669247f67c1ed9c5f138e2288d8aeb5aaf755c5365dcae9f6e7

SHA512
8954b31751b2d66c0732ce94366d2ed336486948c2ffac1ba1e463a07ba49aa062a534d462cbe06a3652a5b09350e081c99d093d2912372e3722464ddd61f1ff

Download Submit
C:\Windows\SysWOW64\Koeajo32.exe

Filesize
75KB

MD5
b719a394f8861c0b899a1ad9cc49f29f

SHA1
f9e4fa3ceb4ee1aab8fa039d64861587e3fb0aae

SHA256
6bffdcdb03af4a36a1c0ab02da1821c7e27cc880abea2018d81f764bd9e27e16

SHA512
6951fa9c23879b9cf06f6db3ad4aff1d9e7d26422719bc40b830492f57b1d8ce5c52a3015d1e184b283b8fe1e3ce3e0cc8ed6e11ecf34311fa53e0b1d03b6513

Download Submit
C:\Windows\SysWOW64\Lbmheomi.exe

Filesize
75KB

MD5
97427d1bc246d5288d94e276fe41c00d

SHA1
aa0b3398394a745337ed2796d1170bf6d4e8bbe6

SHA256
32fbcc8fa2bffb34f54f747d995a1a5813f44daade4a1ceda9a33e56d67d76a0

SHA512
662e62a18f25ab23a442d4cfacfa221056b1b0adb89a95b58aeabf7bd443424ab7bc6b3d78a6dcffad3176c8e5183b2cad352cf263b236ccd91d19fa819c8590

Download Submit
C:\Windows\SysWOW64\Lcbikd32.exe

Filesize
75KB

MD5
450ecb64d5b08d7c768e432a321b9b3d

SHA1
a564b6c869dbf96e91492e2abcaf374c5fced259

SHA256
f4cbd5a308a4a7de78345b7cc453902a727562662c11be86a0728ab3793ae185

SHA512
42b415e2fd3ee248a22a2653dd78e4ea48d0dad64fb85d568ed91e0f556c537eef8fc8f120c57eee622f12600b6d292d4e31aba96f83f68584bb717d9f3ea1c3

Download Submit
C:\Windows\SysWOW64\Mfofjk32.exe

Filesize
75KB

MD5
f2e79aa43c27324dbe74a2f7a576c121

SHA1
f49f791833f7d2bab1b1664d1520411274292c67

SHA256
cda984e041dcc96198373d9adbcbd2b7ca6554ae6bbf61fea0a8a76c21ef7b9e

SHA512
25f10a5ce87880406ced2405200fbbcdcaad6bb3538afb6a13c260cd69d75620a497e10f867538a82b990afca0d28a5ffbfa9f422d55b610d8fb10a994bb0b72

Download Submit
C:\Windows\SysWOW64\Mfofjk32.exe

Filesize
75KB

MD5
f2e79aa43c27324dbe74a2f7a576c121

SHA1
f49f791833f7d2bab1b1664d1520411274292c67

SHA256
cda984e041dcc96198373d9adbcbd2b7ca6554ae6bbf61fea0a8a76c21ef7b9e

SHA512
25f10a5ce87880406ced2405200fbbcdcaad6bb3538afb6a13c260cd69d75620a497e10f867538a82b990afca0d28a5ffbfa9f422d55b610d8fb10a994bb0b72

Download Submit
C:\Windows\SysWOW64\Mfofjk32.exe

Filesize
75KB

MD5
f2e79aa43c27324dbe74a2f7a576c121

SHA1
f49f791833f7d2bab1b1664d1520411274292c67

SHA256
cda984e041dcc96198373d9adbcbd2b7ca6554ae6bbf61fea0a8a76c21ef7b9e

SHA512
25f10a5ce87880406ced2405200fbbcdcaad6bb3538afb6a13c260cd69d75620a497e10f867538a82b990afca0d28a5ffbfa9f422d55b610d8fb10a994bb0b72

Download Submit
C:\Windows\SysWOW64\Mhpeelnd.exe

Filesize
75KB

MD5
f402295fe3040979ae76d0d26e72d5df

SHA1
9176a191bda6784a889fa84b916582c7e8404c09

SHA256
730d0f5d10f8565afde9c4151b0217521af837a8da38ac1f5573e8d70201be2c

SHA512
0de9521093a0644b321f82574ec239fa33e6882c5dbecef9bd38c814af2210210b16ccbcf30414ba8ff6b0e848f6cf9f81b4cee98232e1d698b36d2cf27ebac0

Download Submit
C:\Windows\SysWOW64\Ncecioib.exe

Filesize
75KB

MD5
65b591e2a324f2531f138c20cafb3071

SHA1
df845a31772b28145c2db49b40fc2a636e847ed4

SHA256
051512459c1b78081c7e19c52b31f95efc3ee3c5110f9d00c6e072df9e525bc4

SHA512
dfa0fe821a7e75f335ffaba56c77150053e366bdf53c46730a72df39c0809265637b50e43a1516c1b796e9695824a07992b90b871c7a7f2a0b35fd11225c2d56

Download Submit
C:\Windows\SysWOW64\Ncecioib.exe

Filesize
75KB

MD5
65b591e2a324f2531f138c20cafb3071

SHA1
df845a31772b28145c2db49b40fc2a636e847ed4

SHA256
051512459c1b78081c7e19c52b31f95efc3ee3c5110f9d00c6e072df9e525bc4

SHA512
dfa0fe821a7e75f335ffaba56c77150053e366bdf53c46730a72df39c0809265637b50e43a1516c1b796e9695824a07992b90b871c7a7f2a0b35fd11225c2d56

Download Submit
C:\Windows\SysWOW64\Obfpejcl.exe

Filesize
75KB

MD5
283e4de1d9577e7e0db3759ff2eb5a50

SHA1
90b2a234da174993baa7e10f419687109db0bf9f

SHA256
07035a1f8ccb00cbd4445cf5ab0dc5866ea0ca3f61ff8eb6e0b22bcd333f8442

SHA512
470257adf7d5acaf09d82fb98cff3e5afdb60c251ff0faf0c8422393f0748dc7663cca62dcd86137404b1dbf4be6577aca7ab3bce928262155071c6cb354ef32

Download Submit
C:\Windows\SysWOW64\Obfpejcl.exe

Filesize
75KB

MD5
283e4de1d9577e7e0db3759ff2eb5a50

SHA1
90b2a234da174993baa7e10f419687109db0bf9f

SHA256
07035a1f8ccb00cbd4445cf5ab0dc5866ea0ca3f61ff8eb6e0b22bcd333f8442

SHA512
470257adf7d5acaf09d82fb98cff3e5afdb60c251ff0faf0c8422393f0748dc7663cca62dcd86137404b1dbf4be6577aca7ab3bce928262155071c6cb354ef32

Download Submit
C:\Windows\SysWOW64\Obgeqcnn.exe

Filesize
75KB

MD5
88e81377ef8b2fba90cda878ae368226

SHA1
2c734978e2e48eb021d7f11273ca922210c8fb3e

SHA256
71520d74b45aa497ed0ecb77adc106661f0f9a0039f080b24223e29a55568ac4

SHA512
a78d61cb4cf662779f8fe10e5429541688aee9b84204ea588aa0fd9bdcfcb743b54c9925d1e3b889a9b374c46ce845f4706c4983f5f33f5d408f9ef895382111

Download Submit
C:\Windows\SysWOW64\Odelpm32.exe

Filesize
75KB

MD5
e9eff7aae303966fb84ca67a854c4b57

SHA1
346e093e0bc2b18761de19d81886d93df711c824

SHA256
76f932b966ca68351e0ae185e88f26211860c371bde06e86e67d799776ce8814

SHA512
21984b61217e968d20c29e5372342df6f0f396889c41118ff0e41f6e036426deeadffc7d24259a766ca04d2504b1d7e7684ffb492712fff9309b7b6e24d535fd

Download Submit
C:\Windows\SysWOW64\Odelpm32.exe

Filesize
75KB

MD5
e9eff7aae303966fb84ca67a854c4b57

SHA1
346e093e0bc2b18761de19d81886d93df711c824

SHA256
76f932b966ca68351e0ae185e88f26211860c371bde06e86e67d799776ce8814

SHA512
21984b61217e968d20c29e5372342df6f0f396889c41118ff0e41f6e036426deeadffc7d24259a766ca04d2504b1d7e7684ffb492712fff9309b7b6e24d535fd

Download Submit
C:\Windows\SysWOW64\Pmbjcb32.exe

Filesize
75KB

MD5
e9eff7aae303966fb84ca67a854c4b57

SHA1
346e093e0bc2b18761de19d81886d93df711c824

SHA256
76f932b966ca68351e0ae185e88f26211860c371bde06e86e67d799776ce8814

SHA512
21984b61217e968d20c29e5372342df6f0f396889c41118ff0e41f6e036426deeadffc7d24259a766ca04d2504b1d7e7684ffb492712fff9309b7b6e24d535fd

Download Submit
C:\Windows\SysWOW64\Pmbjcb32.exe

Filesize
75KB

MD5
413e157a2421ab0e71171d312d191ca3

SHA1
0b67323625683fc6a854c86febf0800b5b250593

SHA256
4a85a503f149979eed0431bb738c06b8cf991019b679b9d1e43d2012ff624cdb

SHA512
64f197f44cbbbf1bd252d0240377521e67e996de83b79c36585af69ac8c1ee3ae976580f5f3c7bb71c4e075324c1299d3f1e36a73f07c1c1ca4975cf0a1c9609

Download Submit
C:\Windows\SysWOW64\Pmbjcb32.exe

Filesize
75KB

MD5
413e157a2421ab0e71171d312d191ca3

SHA1
0b67323625683fc6a854c86febf0800b5b250593

SHA256
4a85a503f149979eed0431bb738c06b8cf991019b679b9d1e43d2012ff624cdb

SHA512
64f197f44cbbbf1bd252d0240377521e67e996de83b79c36585af69ac8c1ee3ae976580f5f3c7bb71c4e075324c1299d3f1e36a73f07c1c1ca4975cf0a1c9609

Download Submit
C:\Windows\SysWOW64\Ppeipfdm.exe

Filesize
75KB

MD5
a82cbca4b0f28fe743ebc62da1bf4ec5

SHA1
d3c2c6477a8f2396710f954ff05b47426ae9aebe

SHA256
40f7951ed2ec19a4da4b5de1178d24ea8d2a21211c824b3eb0cb9585ae7e7ade

SHA512
f16db27a78618a6e489eae8a3cc74d84b679282f9634cda19b9a3f8af7ab3a2f540cec0405a68597677e7c48f597bf675742d94f8fb1644ba73624b47f8f835c

Download Submit
memory/336-361-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/372-194-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/400-276-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/408-349-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/472-208-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/472-42-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/624-50-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/624-240-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1012-436-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1036-217-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1036-451-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1040-329-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1196-106-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1196-314-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1200-355-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1212-479-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1232-214-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1312-224-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1312-452-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1340-367-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1456-335-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1456-130-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1508-193-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1508-18-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1536-1-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1536-25-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1536-2-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1536-0-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1720-341-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1724-427-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/1968-373-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2100-293-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2100-98-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2116-420-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2116-178-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2188-428-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2204-406-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2224-58-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2224-257-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2284-387-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2336-275-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2336-82-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2472-386-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2472-154-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2492-282-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2628-453-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2636-188-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2636-9-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2708-308-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2724-294-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2744-74-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2744-271-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2936-288-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/2936-90-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3284-342-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3320-273-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3380-66-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3380-266-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3384-462-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3492-242-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3492-457-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3504-302-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3580-328-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3580-122-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3724-419-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3724-170-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3760-393-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3784-484-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3832-206-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3832-34-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3992-197-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/3992-27-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4072-400-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4084-322-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4296-471-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4324-315-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4324-114-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4340-249-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4340-463-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4372-203-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4396-399-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4396-162-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4544-146-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4544-379-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4788-380-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4816-456-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4816-232-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4824-430-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/4912-263-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5004-296-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5036-138-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5036-348-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download
memory/5056-320-0x0000000000400000-0x0000000000433000-memory.dmp

Filesize
204KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads