d7cf8ff711798a9d456dd210ea3a2bf5bb379f1736a3d150c1281521c7c37435

Analysis

max time kernel
158s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
28/10/2023, 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.88caed916a4cfae448f9eb2bf37fe5e0.exe
Size

91KB
MD5

88caed916a4cfae448f9eb2bf37fe5e0
SHA1

81c97a35cdac8464bbe9e440a4fde23b62ba3a47
SHA256

d7cf8ff711798a9d456dd210ea3a2bf5bb379f1736a3d150c1281521c7c37435
SHA512

97804470115d25782d936771a1dc786a765808d923b14ebf36890c2cccf76b01f7e19fedfa062701555672536bbdc84c2894d2cce260160eb17269693c1eea1d
SSDEEP

1536:MxbLT/Ktz3HiF3jPRtl/8V92hwr4Uol5KusGBNTbt7Pu:4/Ktz3K3Lm2lUuMhCPu

Score

10^/10

persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gjgmpkfl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bohbhmfm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Fihnomjp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnmojj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Gllajf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dphipidf.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ckmehb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hmnmgnoh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pmaffnce.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cnkkjh32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cdhffg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fpoaom32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Agqhik32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmndpq32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hidpbf32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jaddpppa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mknjgajl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bbkeacqo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ocqncp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Diccgfpd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kdbjhbbd.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Didqkeeq.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nplkhf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jmqekg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Mkmkkjko.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ginenk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kaflio32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Pbahgbfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Nqaipgal.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cfbhhfbg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dfclmfhl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Jaimko32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mpmodg32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nlcalieg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Lcnkli32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Omgabj32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ljnlecmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hnpognhd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Gcceifof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Dokgdkeh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Eomfae32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Hjhfgi32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Okgfdm32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Oaejhh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Didnmp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ecpomiok.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Ffahnd32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nildajdg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kaihonhl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Kgcqlh32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Mmdlflki.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Cjnoggoh.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kkioojpp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ecfeldcj.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Fmjjqhpn.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Cnahdi32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Jljbeali.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ncchae32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Boohcpgm.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Kaihonhl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Aamipe32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Akenij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bqdlmo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Icdoolge.exe

Executes dropped EXE 64 IoCs

pid	Process
4156	Ccpdoqgd.exe
4040	Ckkiccep.exe
1252	Cfqmpl32.exe
1044	Ckmehb32.exe
1716	Cfcjfk32.exe
4612	Cmmbbejp.exe
2096	Ccgjopal.exe
5092	Diccgfpd.exe
4600	Dfgcakon.exe
5012	Dckdjomg.exe
772	Dmdhcddh.exe
4184	Dbqqkkbo.exe
4076	Dmfeidbe.exe
2336	Dbcmakpl.exe
1852	Dmhand32.exe
3820	Efafgifc.exe
3488	Emkndc32.exe
640	Ecefqnel.exe
3024	Ecgcfm32.exe
2244	Eidlnd32.exe
2036	Fpbmfn32.exe
4468	Fdqfll32.exe
4840	Fllkqn32.exe
1928	Fmndpq32.exe
3872	Fideeaco.exe
1568	Gdjibj32.exe
4324	Giinpa32.exe
4788	Gbabigfj.exe
4400	Gmggfp32.exe
2780	Gbdoof32.exe
3324	Gmiclo32.exe
4020	Ggahedjn.exe
2316	Hloqml32.exe
1552	Hmnmgnoh.exe
1328	Hckeoeno.exe
4320	Hlcjhkdp.exe
4128	Hcmbee32.exe
3420	Higjaoci.exe
4620	Hdmoohbo.exe
4224	Hlhccj32.exe
4680	Iljpij32.exe
2312	Igpdfb32.exe
1644	Jkgpbp32.exe
2732	Jkimho32.exe
3076	Jdaaaeqg.exe
4244	Jnjejjgh.exe
4768	Jcgnbaeo.exe
4932	Jlobkg32.exe
3772	Kmaopfjm.exe
1092	Knalji32.exe
1560	Kgipcogp.exe
4436	Kqbdldnq.exe
4164	Kjjiej32.exe
4684	Kqdaadln.exe
2724	Kjmfjj32.exe
3308	Kmkbfeab.exe
1624	Kdbjhbbd.exe
2080	Lnjnqh32.exe
4380	Lddgmbpb.exe
4192	Lmpkadnm.exe
3064	Lgepom32.exe
3920	Lmbhgd32.exe
4464	Lggldm32.exe
1812	Lmdemd32.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Lmdnbn32.exe	Lfjfecno.exe
File created	C:\Windows\SysWOW64\Dodebo32.dll	Ccppmc32.exe
File created	C:\Windows\SysWOW64\Egkddo32.exe	Dpalgenf.exe
File created	C:\Windows\SysWOW64\Ojonli32.dll	Eldbbjof.exe
File created	C:\Windows\SysWOW64\Emfgpo32.exe	Ejhkdc32.exe
File created	C:\Windows\SysWOW64\Ifbbld32.dll	Fmmmqnaf.exe
File created	C:\Windows\SysWOW64\Odnngclb.exe	Oboakhmo.exe
File created	C:\Windows\SysWOW64\Ipeeobbe.exe	Iepaaico.exe
File created	C:\Windows\SysWOW64\Ilnbicff.exe	Ipgbdbqb.exe
File created	C:\Windows\SysWOW64\Ncchae32.exe	Nmipdk32.exe
File opened for modification	C:\Windows\SysWOW64\Ngqagcag.exe	Nmkmjjaa.exe
File created	C:\Windows\SysWOW64\Cheegm32.dll	Jcpojk32.exe
File created	C:\Windows\SysWOW64\Pogcnafk.dll	Amdiei32.exe
File opened for modification	C:\Windows\SysWOW64\Dohmff32.exe	Djkdnool.exe
File created	C:\Windows\SysWOW64\Gengje32.dll	Pehngkcg.exe
File created	C:\Windows\SysWOW64\Lcdciiec.exe	Lljklo32.exe
File created	C:\Windows\SysWOW64\Eikpan32.exe	Epbkhhel.exe
File created	C:\Windows\SysWOW64\Iqfcbahb.exe	Ijlkfg32.exe
File created	C:\Windows\SysWOW64\Lpjelibg.exe	Lagepl32.exe
File created	C:\Windows\SysWOW64\Kaipdbpa.dll	Ohobebig.exe
File opened for modification	C:\Windows\SysWOW64\Lhdeinhb.exe	Kgeiokao.exe
File created	C:\Windows\SysWOW64\Eegiklal.dll	Mebcop32.exe
File opened for modification	C:\Windows\SysWOW64\Ndflak32.exe	Njmhhefi.exe
File opened for modification	C:\Windows\SysWOW64\Dkahilkl.exe	Dhclmp32.exe
File created	C:\Windows\SysWOW64\Kbjpeo32.dll	Mfhbga32.exe
File created	C:\Windows\SysWOW64\Mgpaqbcf.exe	Lpfidh32.exe
File opened for modification	C:\Windows\SysWOW64\Habeni32.exe	Hndibn32.exe
File created	C:\Windows\SysWOW64\Adfnofpd.exe	Aahbbkaq.exe
File opened for modification	C:\Windows\SysWOW64\Aekddhcb.exe	Albpkc32.exe
File opened for modification	C:\Windows\SysWOW64\Lqmmmmph.exe	Lfgipd32.exe
File opened for modification	C:\Windows\SysWOW64\Fbdnne32.exe	Fnhbmgmk.exe
File created	C:\Windows\SysWOW64\Nconfh32.exe	Nhjjip32.exe
File created	C:\Windows\SysWOW64\Jmopmalc.exe	Jjqdafmp.exe
File created	C:\Windows\SysWOW64\Gkmipnlq.dll	Cllkcbnl.exe
File opened for modification	C:\Windows\SysWOW64\Hpnhoqmi.exe	Hakhcd32.exe
File opened for modification	C:\Windows\SysWOW64\Iapjeq32.exe	Ijfbhflj.exe
File opened for modification	C:\Windows\SysWOW64\Jbhmnhcm.exe	Jpjqaldi.exe
File opened for modification	C:\Windows\SysWOW64\Libnapmg.exe	Kagimmol.exe
File opened for modification	C:\Windows\SysWOW64\Ecefqnel.exe	Emkndc32.exe
File created	C:\Windows\SysWOW64\Dgmchiim.dll	Gmojkj32.exe
File created	C:\Windows\SysWOW64\Ncbigo32.dll	Dpalgenf.exe
File created	C:\Windows\SysWOW64\Dlcaca32.exe	Djeegf32.exe
File created	C:\Windows\SysWOW64\Pknjieep.dll	Cmnnimak.exe
File created	C:\Windows\SysWOW64\Ickihp32.dll	Igkadlcd.exe
File created	C:\Windows\SysWOW64\Deenhilj.dll	Ejdonq32.exe
File created	C:\Windows\SysWOW64\Pehnboko.exe	Ommjnlnd.exe
File created	C:\Windows\SysWOW64\Nhfcjc32.dll	Qhofjbnl.exe
File opened for modification	C:\Windows\SysWOW64\Chphhn32.exe	Cafpkc32.exe
File created	C:\Windows\SysWOW64\Cllkcbnl.exe	Cjnoggoh.exe
File opened for modification	C:\Windows\SysWOW64\Hfonfp32.exe	Hdaajd32.exe
File created	C:\Windows\SysWOW64\Hmaihekc.exe	Hjcllilo.exe
File created	C:\Windows\SysWOW64\Oqgkadod.exe	Obdkfg32.exe
File created	C:\Windows\SysWOW64\Cjijid32.dll	Nmfcok32.exe
File opened for modification	C:\Windows\SysWOW64\Omgabj32.exe	Okiefn32.exe
File created	C:\Windows\SysWOW64\Idqogkic.dll	Ckoifgmb.exe
File created	C:\Windows\SysWOW64\Ejennd32.exe	Eggbbhkj.exe
File opened for modification	C:\Windows\SysWOW64\Lmdemd32.exe	Lggldm32.exe
File created	C:\Windows\SysWOW64\Bipcei32.exe	Bgafin32.exe
File created	C:\Windows\SysWOW64\Djeegf32.exe	Cfglahbj.exe
File created	C:\Windows\SysWOW64\Albikp32.exe	Aiapjecl.exe
File created	C:\Windows\SysWOW64\Pnmhqh32.exe	Pjalpida.exe
File opened for modification	C:\Windows\SysWOW64\Igdgglfl.exe	Ilnbicff.exe
File created	C:\Windows\SysWOW64\Njjnnm32.dll	Ainfpi32.exe
File opened for modification	C:\Windows\SysWOW64\Hjcllilo.exe	Hbldkllm.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
9860	9780	WerFault.exe	1019

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Qhbhapha.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Enomic32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hohgpbon.dll"	Ikgicmpe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ejnocehc.dll"	Lmgabcge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dndnpf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Emanjldl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bijncb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fgmlkg32.dll"	Ggafgo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jgpfbjlo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Mbfggf32.dll"	Calbnnkj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dohmff32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjbleonn.dll"	Pmpfcl32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Ggpdhj32.dll"	Gbchdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bgmnooom.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Oefaplcm.dll"	Fcodfa32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kljhfc32.dll"	Hfpenj32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ciefek32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fflohaij.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Gbchdp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Kmbfiokn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Fmjjqhpn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fflohaij.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pbahgbfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Aikijjon.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Begcjjql.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Giofggia.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Elfahb32.dll"	Egkddo32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Qdmdjkpo.dll"	Fdadpk32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Pjahchpb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fhgkhi32.dll"	Hhegjdag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nancfp32.dll"	Hnblmnfa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Onpjichj.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ebdcld32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nmkmjjaa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gaobmboi.dll"	Opjgidfa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Clbbjg32.dll"	Abflfc32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Pajeam32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Ahdged32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Dlicflic.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kopacfjh.dll"	Lcqgahoe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hmijkj32.dll"	Cgaqphgl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Nabfjpak.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bhnikc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Hpchib32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lpcncmnn.dll"	Ipgbdbqb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mqkiok32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Jdjfmjhm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Flbjeg32.dll"	Labkempb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hdglka32.dll"	Hclaeocp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjdejk32.dll"	Hcmbee32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lfgipd32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bgafin32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Gbkjcl32.dll"	Boohcpgm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amddeq32.dll"	Dfeibf32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mkjnfkma.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Chglab32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Dnmhpg32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Bpboakjk.dll"	Ommjnlnd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Mgpaqbcf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kmeikl32.dll"	Foplnb32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lgopog32.dll"	Ifhibhfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Fihnomjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Jjdiadlg.dll"	Lgjglg32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Lpjelibg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 4156	3572	NEAS.88caed916a4cfae448f9eb2bf37fe5e0.exe	86
PID 3572 wrote to memory of 4156	3572	NEAS.88caed916a4cfae448f9eb2bf37fe5e0.exe	86
PID 3572 wrote to memory of 4156	3572	NEAS.88caed916a4cfae448f9eb2bf37fe5e0.exe	86
PID 4156 wrote to memory of 4040	4156	Ccpdoqgd.exe	87
PID 4156 wrote to memory of 4040	4156	Ccpdoqgd.exe	87
PID 4156 wrote to memory of 4040	4156	Ccpdoqgd.exe	87
PID 4040 wrote to memory of 1252	4040	Ckkiccep.exe	88
PID 4040 wrote to memory of 1252	4040	Ckkiccep.exe	88
PID 4040 wrote to memory of 1252	4040	Ckkiccep.exe	88
PID 1252 wrote to memory of 1044	1252	Cfqmpl32.exe	89
PID 1252 wrote to memory of 1044	1252	Cfqmpl32.exe	89
PID 1252 wrote to memory of 1044	1252	Cfqmpl32.exe	89
PID 1044 wrote to memory of 1716	1044	Ckmehb32.exe	90
PID 1044 wrote to memory of 1716	1044	Ckmehb32.exe	90
PID 1044 wrote to memory of 1716	1044	Ckmehb32.exe	90
PID 1716 wrote to memory of 4612	1716	Cfcjfk32.exe	91
PID 1716 wrote to memory of 4612	1716	Cfcjfk32.exe	91
PID 1716 wrote to memory of 4612	1716	Cfcjfk32.exe	91
PID 4612 wrote to memory of 2096	4612	Cmmbbejp.exe	92
PID 4612 wrote to memory of 2096	4612	Cmmbbejp.exe	92
PID 4612 wrote to memory of 2096	4612	Cmmbbejp.exe	92
PID 2096 wrote to memory of 5092	2096	Ccgjopal.exe	93
PID 2096 wrote to memory of 5092	2096	Ccgjopal.exe	93
PID 2096 wrote to memory of 5092	2096	Ccgjopal.exe	93
PID 5092 wrote to memory of 4600	5092	Diccgfpd.exe	94
PID 5092 wrote to memory of 4600	5092	Diccgfpd.exe	94
PID 5092 wrote to memory of 4600	5092	Diccgfpd.exe	94
PID 4600 wrote to memory of 5012	4600	Dfgcakon.exe	95
PID 4600 wrote to memory of 5012	4600	Dfgcakon.exe	95
PID 4600 wrote to memory of 5012	4600	Dfgcakon.exe	95
PID 5012 wrote to memory of 772	5012	Dckdjomg.exe	96
PID 5012 wrote to memory of 772	5012	Dckdjomg.exe	96
PID 5012 wrote to memory of 772	5012	Dckdjomg.exe	96
PID 772 wrote to memory of 4184	772	Dmdhcddh.exe	97
PID 772 wrote to memory of 4184	772	Dmdhcddh.exe	97
PID 772 wrote to memory of 4184	772	Dmdhcddh.exe	97
PID 4184 wrote to memory of 4076	4184	Dbqqkkbo.exe	98
PID 4184 wrote to memory of 4076	4184	Dbqqkkbo.exe	98
PID 4184 wrote to memory of 4076	4184	Dbqqkkbo.exe	98
PID 4076 wrote to memory of 2336	4076	Dmfeidbe.exe	99
PID 4076 wrote to memory of 2336	4076	Dmfeidbe.exe	99
PID 4076 wrote to memory of 2336	4076	Dmfeidbe.exe	99
PID 2336 wrote to memory of 1852	2336	Dbcmakpl.exe	101
PID 2336 wrote to memory of 1852	2336	Dbcmakpl.exe	101
PID 2336 wrote to memory of 1852	2336	Dbcmakpl.exe	101
PID 1852 wrote to memory of 3820	1852	Dmhand32.exe	102
PID 1852 wrote to memory of 3820	1852	Dmhand32.exe	102
PID 1852 wrote to memory of 3820	1852	Dmhand32.exe	102
PID 3820 wrote to memory of 3488	3820	Efafgifc.exe	103
PID 3820 wrote to memory of 3488	3820	Efafgifc.exe	103
PID 3820 wrote to memory of 3488	3820	Efafgifc.exe	103
PID 3488 wrote to memory of 640	3488	Emkndc32.exe	104
PID 3488 wrote to memory of 640	3488	Emkndc32.exe	104
PID 3488 wrote to memory of 640	3488	Emkndc32.exe	104
PID 640 wrote to memory of 3024	640	Ecefqnel.exe	105
PID 640 wrote to memory of 3024	640	Ecefqnel.exe	105
PID 640 wrote to memory of 3024	640	Ecefqnel.exe	105
PID 3024 wrote to memory of 2244	3024	Ecgcfm32.exe	106
PID 3024 wrote to memory of 2244	3024	Ecgcfm32.exe	106
PID 3024 wrote to memory of 2244	3024	Ecgcfm32.exe	106
PID 2244 wrote to memory of 2036	2244	Eidlnd32.exe	109
PID 2244 wrote to memory of 2036	2244	Eidlnd32.exe	109
PID 2244 wrote to memory of 2036	2244	Eidlnd32.exe	109
PID 2036 wrote to memory of 4468	2036	Fpbmfn32.exe	110

C:\Users\Admin\AppData\Local\Temp\NEAS.88caed916a4cfae448f9eb2bf37fe5e0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.88caed916a4cfae448f9eb2bf37fe5e0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Windows\SysWOW64\Ccpdoqgd.exe
  C:\Windows\system32\Ccpdoqgd.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Windows\SysWOW64\Ckkiccep.exe
    C:\Windows\system32\Ckkiccep.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4040
  - - C:\Windows\SysWOW64\Cfqmpl32.exe
      C:\Windows\system32\Cfqmpl32.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1252
    - - C:\Windows\SysWOW64\Ckmehb32.exe
        
        C:\Windows\system32\Ckmehb32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1044
      - C:\Windows\SysWOW64\Cfcjfk32.exe
        
        C:\Windows\system32\Cfcjfk32.exe
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1716
        
        C:\Windows\SysWOW64\Cmmbbejp.exe
        
        C:\Windows\system32\Cmmbbejp.exe
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\Windows\SysWOW64\Ccgjopal.exe
        
        C:\Windows\system32\Ccgjopal.exe
        8⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2096
        
        C:\Windows\SysWOW64\Diccgfpd.exe
        
        C:\Windows\system32\Diccgfpd.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5092
        
        C:\Windows\SysWOW64\Dfgcakon.exe
        
        C:\Windows\system32\Dfgcakon.exe
        10⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4600
        
        C:\Windows\SysWOW64\Dckdjomg.exe
        
        C:\Windows\system32\Dckdjomg.exe
        11⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5012
        
        C:\Windows\SysWOW64\Dmdhcddh.exe
        
        C:\Windows\system32\Dmdhcddh.exe
        12⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:772
        
        C:\Windows\SysWOW64\Dbqqkkbo.exe
        
        C:\Windows\system32\Dbqqkkbo.exe
        13⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4184
        
        C:\Windows\SysWOW64\Dmfeidbe.exe
        
        C:\Windows\system32\Dmfeidbe.exe
        14⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4076
        
        C:\Windows\SysWOW64\Dbcmakpl.exe
        
        C:\Windows\system32\Dbcmakpl.exe
        15⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2336
        
        C:\Windows\SysWOW64\Dmhand32.exe
        
        C:\Windows\system32\Dmhand32.exe
        16⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1852
        
        C:\Windows\SysWOW64\Efafgifc.exe
        
        C:\Windows\system32\Efafgifc.exe
        17⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3820
        
        C:\Windows\SysWOW64\Emkndc32.exe
        
        C:\Windows\system32\Emkndc32.exe
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3488
        
        C:\Windows\SysWOW64\Ecefqnel.exe
        
        C:\Windows\system32\Ecefqnel.exe
        19⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:640
        
        C:\Windows\SysWOW64\Ecgcfm32.exe
        
        C:\Windows\system32\Ecgcfm32.exe
        20⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3024
        
        C:\Windows\SysWOW64\Eidlnd32.exe
        
        C:\Windows\system32\Eidlnd32.exe
        21⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2244
        
        C:\Windows\SysWOW64\Fpbmfn32.exe
        
        C:\Windows\system32\Fpbmfn32.exe
        22⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2036
        
        C:\Windows\SysWOW64\Fdqfll32.exe
        
        C:\Windows\system32\Fdqfll32.exe
        23⤵
        Executes dropped EXE
        
        PID:4468
        
        C:\Windows\SysWOW64\Fllkqn32.exe
        
        C:\Windows\system32\Fllkqn32.exe
        24⤵
        Executes dropped EXE
        
        PID:4840
        
        C:\Windows\SysWOW64\Fmndpq32.exe
        
        C:\Windows\system32\Fmndpq32.exe
        25⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1928
        
        C:\Windows\SysWOW64\Fideeaco.exe
        
        C:\Windows\system32\Fideeaco.exe
        26⤵
        Executes dropped EXE
        
        PID:3872
        
        C:\Windows\SysWOW64\Gdjibj32.exe
        
        C:\Windows\system32\Gdjibj32.exe
        27⤵
        Executes dropped EXE
        
        PID:1568
        
        C:\Windows\SysWOW64\Giinpa32.exe
        
        C:\Windows\system32\Giinpa32.exe
        28⤵
        Executes dropped EXE
        
        PID:4324
        
        C:\Windows\SysWOW64\Gbabigfj.exe
        
        C:\Windows\system32\Gbabigfj.exe
        29⤵
        Executes dropped EXE
        
        PID:4788
        
        C:\Windows\SysWOW64\Gmggfp32.exe
        
        C:\Windows\system32\Gmggfp32.exe
        30⤵
        Executes dropped EXE
        
        PID:4400
        
        C:\Windows\SysWOW64\Gbdoof32.exe
        
        C:\Windows\system32\Gbdoof32.exe
        31⤵
        Executes dropped EXE
        
        PID:2780
        
        C:\Windows\SysWOW64\Gmiclo32.exe
        
        C:\Windows\system32\Gmiclo32.exe
        32⤵
        Executes dropped EXE
        
        PID:3324
        
        C:\Windows\SysWOW64\Ggahedjn.exe
        
        C:\Windows\system32\Ggahedjn.exe
        33⤵
        Executes dropped EXE
        
        PID:4020
        
        C:\Windows\SysWOW64\Hloqml32.exe
        
        C:\Windows\system32\Hloqml32.exe
        34⤵
        Executes dropped EXE
        
        PID:2316
        
        C:\Windows\SysWOW64\Hmnmgnoh.exe
        
        C:\Windows\system32\Hmnmgnoh.exe
        35⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1552
        
        C:\Windows\SysWOW64\Hckeoeno.exe
        
        C:\Windows\system32\Hckeoeno.exe
        36⤵
        Executes dropped EXE
        
        PID:1328
        
        C:\Windows\SysWOW64\Hlcjhkdp.exe
        
        C:\Windows\system32\Hlcjhkdp.exe
        37⤵
        Executes dropped EXE
        
        PID:4320
        
        C:\Windows\SysWOW64\Hcmbee32.exe
        
        C:\Windows\system32\Hcmbee32.exe
        38⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:4128
        
        C:\Windows\SysWOW64\Higjaoci.exe
        
        C:\Windows\system32\Higjaoci.exe
        39⤵
        Executes dropped EXE
        
        PID:3420
        
        C:\Windows\SysWOW64\Hdmoohbo.exe
        
        C:\Windows\system32\Hdmoohbo.exe
        40⤵
        Executes dropped EXE
        
        PID:4620
        
        C:\Windows\SysWOW64\Hlhccj32.exe
        
        C:\Windows\system32\Hlhccj32.exe
        41⤵
        Executes dropped EXE
        
        PID:4224
        
        C:\Windows\SysWOW64\Iljpij32.exe
        
        C:\Windows\system32\Iljpij32.exe
        42⤵
        Executes dropped EXE
        
        PID:4680
        
        C:\Windows\SysWOW64\Igpdfb32.exe
        
        C:\Windows\system32\Igpdfb32.exe
        43⤵
        Executes dropped EXE
        
        PID:2312
        
        C:\Windows\SysWOW64\Jkgpbp32.exe
        
        C:\Windows\system32\Jkgpbp32.exe
        44⤵
        Executes dropped EXE
        
        PID:1644
        
        C:\Windows\SysWOW64\Jkimho32.exe
        
        C:\Windows\system32\Jkimho32.exe
        45⤵
        Executes dropped EXE
        
        PID:2732
        
        C:\Windows\SysWOW64\Jdaaaeqg.exe
        
        C:\Windows\system32\Jdaaaeqg.exe
        46⤵
        Executes dropped EXE
        
        PID:3076
        
        C:\Windows\SysWOW64\Jnjejjgh.exe
        
        C:\Windows\system32\Jnjejjgh.exe
        47⤵
        Executes dropped EXE
        
        PID:4244
        
        C:\Windows\SysWOW64\Jcgnbaeo.exe
        
        C:\Windows\system32\Jcgnbaeo.exe
        48⤵
        Executes dropped EXE
        
        PID:4768
        
        C:\Windows\SysWOW64\Jlobkg32.exe
        
        C:\Windows\system32\Jlobkg32.exe
        49⤵
        Executes dropped EXE
        
        PID:4932
        
        C:\Windows\SysWOW64\Kmaopfjm.exe
        
        C:\Windows\system32\Kmaopfjm.exe
        50⤵
        Executes dropped EXE
        
        PID:3772
        
        C:\Windows\SysWOW64\Knalji32.exe
        
        C:\Windows\system32\Knalji32.exe
        51⤵
        Executes dropped EXE
        
        PID:1092
        
        C:\Windows\SysWOW64\Kgipcogp.exe
        
        C:\Windows\system32\Kgipcogp.exe
        52⤵
        Executes dropped EXE
        
        PID:1560
        
        C:\Windows\SysWOW64\Kqbdldnq.exe
        
        C:\Windows\system32\Kqbdldnq.exe
        53⤵
        Executes dropped EXE
        
        PID:4436
        
        C:\Windows\SysWOW64\Kjjiej32.exe
        
        C:\Windows\system32\Kjjiej32.exe
        54⤵
        Executes dropped EXE
        
        PID:4164
        
        C:\Windows\SysWOW64\Kqdaadln.exe
        
        C:\Windows\system32\Kqdaadln.exe
        55⤵
        Executes dropped EXE
        
        PID:4684
        
        C:\Windows\SysWOW64\Kjmfjj32.exe
        
        C:\Windows\system32\Kjmfjj32.exe
        56⤵
        Executes dropped EXE
        
        PID:2724
        
        C:\Windows\SysWOW64\Kmkbfeab.exe
        
        C:\Windows\system32\Kmkbfeab.exe
        57⤵
        Executes dropped EXE
        
        PID:3308
        
        C:\Windows\SysWOW64\Kdbjhbbd.exe
        
        C:\Windows\system32\Kdbjhbbd.exe
        58⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        
        PID:1624
        
        C:\Windows\SysWOW64\Lnjnqh32.exe
        
        C:\Windows\system32\Lnjnqh32.exe
        59⤵
        Executes dropped EXE
        
        PID:2080
        
        C:\Windows\SysWOW64\Lddgmbpb.exe
        
        C:\Windows\system32\Lddgmbpb.exe
        60⤵
        Executes dropped EXE
        
        PID:4380
        
        C:\Windows\SysWOW64\Lmpkadnm.exe
        
        C:\Windows\system32\Lmpkadnm.exe
        61⤵
        Executes dropped EXE
        
        PID:4192
        
        C:\Windows\SysWOW64\Lgepom32.exe
        
        C:\Windows\system32\Lgepom32.exe
        62⤵
        Executes dropped EXE
        
        PID:3064
        
        C:\Windows\SysWOW64\Lmbhgd32.exe
        
        C:\Windows\system32\Lmbhgd32.exe
        63⤵
        Executes dropped EXE
        
        PID:3920
        
        C:\Windows\SysWOW64\Lggldm32.exe
        
        C:\Windows\system32\Lggldm32.exe
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:4464
        
        C:\Windows\SysWOW64\Lmdemd32.exe
        
        C:\Windows\system32\Lmdemd32.exe
        65⤵
        Executes dropped EXE
        
        PID:1812
        
        C:\Windows\SysWOW64\Lekmnajj.exe
        
        C:\Windows\system32\Lekmnajj.exe
        66⤵
        
        PID:4724
        
        C:\Windows\SysWOW64\Lkeekk32.exe
        
        C:\Windows\system32\Lkeekk32.exe
        67⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\Lmgabcge.exe
        
        C:\Windows\system32\Lmgabcge.exe
        68⤵
        Modifies registry class
        
        PID:4376
        
        C:\Windows\SysWOW64\Mkhapk32.exe
        
        C:\Windows\system32\Mkhapk32.exe
        69⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\Mnfnlf32.exe
        
        C:\Windows\system32\Mnfnlf32.exe
        70⤵
        
        PID:4596
        
        C:\Windows\SysWOW64\Mkjnfkma.exe
        
        C:\Windows\system32\Mkjnfkma.exe
        71⤵
        Modifies registry class
        
        PID:4252
        
        C:\Windows\SysWOW64\Mnhkbfme.exe
        
        C:\Windows\system32\Mnhkbfme.exe
        72⤵
        
        PID:2912
        
        C:\Windows\SysWOW64\Mebcop32.exe
        
        C:\Windows\system32\Mebcop32.exe
        73⤵
        Drops file in System32 directory
        
        PID:2292
        
        C:\Windows\SysWOW64\Mkmkkjko.exe
        
        C:\Windows\system32\Mkmkkjko.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2160
        
        C:\Windows\SysWOW64\Mnkggfkb.exe
        
        C:\Windows\system32\Mnkggfkb.exe
        75⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\Maiccajf.exe
        
        C:\Windows\system32\Maiccajf.exe
        76⤵
        
        PID:2924
        
        C:\Windows\SysWOW64\Mgclpkac.exe
        
        C:\Windows\system32\Mgclpkac.exe
        77⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\Mnmdme32.exe
        
        C:\Windows\system32\Mnmdme32.exe
        78⤵
        
        PID:5188
        
        C:\Windows\SysWOW64\Megljppl.exe
        
        C:\Windows\system32\Megljppl.exe
        79⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Mjdebfnd.exe
        
        C:\Windows\system32\Mjdebfnd.exe
        80⤵
        
        PID:5296
        
        C:\Windows\SysWOW64\Meiioonj.exe
        
        C:\Windows\system32\Meiioonj.exe
        81⤵
        
        PID:5340
        
        C:\Windows\SysWOW64\Nlcalieg.exe
        
        C:\Windows\system32\Nlcalieg.exe
        82⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5384
        
        C:\Windows\SysWOW64\Nmenca32.exe
        
        C:\Windows\system32\Nmenca32.exe
        83⤵
        
        PID:5428
        
        C:\Windows\SysWOW64\Nelfeo32.exe
        
        C:\Windows\system32\Nelfeo32.exe
        84⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\Ngjbaj32.exe
        
        C:\Windows\system32\Ngjbaj32.exe
        85⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\Njinmf32.exe
        
        C:\Windows\system32\Njinmf32.exe
        86⤵
        
        PID:5580
        
        C:\Windows\SysWOW64\Nabfjpak.exe
        
        C:\Windows\system32\Nabfjpak.exe
        87⤵
        Modifies registry class
        
        PID:5644
        
        C:\Windows\SysWOW64\Nhmofj32.exe
        
        C:\Windows\system32\Nhmofj32.exe
        88⤵
        
        PID:5704
        
        C:\Windows\SysWOW64\Njkkbehl.exe
        
        C:\Windows\system32\Njkkbehl.exe
        89⤵
        
        PID:5756
        
        C:\Windows\SysWOW64\Naecop32.exe
        
        C:\Windows\system32\Naecop32.exe
        90⤵
        
        PID:5804
        
        C:\Windows\SysWOW64\Nhokljge.exe
        
        C:\Windows\system32\Nhokljge.exe
        91⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Njmhhefi.exe
        
        C:\Windows\system32\Njmhhefi.exe
        92⤵
        Drops file in System32 directory
        
        PID:5892
        
        C:\Windows\SysWOW64\Ndflak32.exe
        
        C:\Windows\system32\Ndflak32.exe
        93⤵
        
        PID:5932
        
        C:\Windows\SysWOW64\Njpdnedf.exe
        
        C:\Windows\system32\Njpdnedf.exe
        94⤵
        
        PID:5984
        
        C:\Windows\SysWOW64\Nmnqjp32.exe
        
        C:\Windows\system32\Nmnqjp32.exe
        95⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\Odhifjkg.exe
        
        C:\Windows\system32\Odhifjkg.exe
        96⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Ojbacd32.exe
        
        C:\Windows\system32\Ojbacd32.exe
        97⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Omqmop32.exe
        
        C:\Windows\system32\Omqmop32.exe
        98⤵
        
        PID:5172
        
        C:\Windows\SysWOW64\Onpjichj.exe
        
        C:\Windows\system32\Onpjichj.exe
        99⤵
        Modifies registry class
        
        PID:5304
        
        C:\Windows\SysWOW64\Oejbfmpg.exe
        
        C:\Windows\system32\Oejbfmpg.exe
        100⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\Oldjcg32.exe
        
        C:\Windows\system32\Oldjcg32.exe
        101⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Omegjomb.exe
        
        C:\Windows\system32\Omegjomb.exe
        102⤵
        
        PID:5516
        
        C:\Windows\SysWOW64\Ohkkhhmh.exe
        
        C:\Windows\system32\Ohkkhhmh.exe
        103⤵
        
        PID:5568
        
        C:\Windows\SysWOW64\Pdfehh32.exe
        
        C:\Windows\system32\Pdfehh32.exe
        104⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Plmmif32.exe
        
        C:\Windows\system32\Plmmif32.exe
        105⤵
        
        PID:5732
        
        C:\Windows\SysWOW64\Pajeam32.exe
        
        C:\Windows\system32\Pajeam32.exe
        106⤵
        Modifies registry class
        
        PID:5812
        
        C:\Windows\SysWOW64\Phdnngdn.exe
        
        C:\Windows\system32\Phdnngdn.exe
        107⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Pmaffnce.exe
        
        C:\Windows\system32\Pmaffnce.exe
        108⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5948
        
        C:\Windows\SysWOW64\Pehngkcg.exe
        
        C:\Windows\system32\Pehngkcg.exe
        109⤵
        Drops file in System32 directory
        
        PID:6008
        
        C:\Windows\SysWOW64\Plbfdekd.exe
        
        C:\Windows\system32\Plbfdekd.exe
        110⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\Pmcclm32.exe
        
        C:\Windows\system32\Pmcclm32.exe
        111⤵
        
        PID:3248
        
        C:\Windows\SysWOW64\Pdmkhgho.exe
        
        C:\Windows\system32\Pdmkhgho.exe
        112⤵
        
        PID:5332
        
        C:\Windows\SysWOW64\Qaalblgi.exe
        
        C:\Windows\system32\Qaalblgi.exe
        113⤵
        
        PID:5448
        
        C:\Windows\SysWOW64\Qdphngfl.exe
        
        C:\Windows\system32\Qdphngfl.exe
        114⤵
        
        PID:5560
        
        C:\Windows\SysWOW64\Qkipkani.exe
        
        C:\Windows\system32\Qkipkani.exe
        115⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Qoelkp32.exe
        
        C:\Windows\system32\Qoelkp32.exe
        116⤵
        
        PID:5796
        
        C:\Windows\SysWOW64\Qeodhjmo.exe
        
        C:\Windows\system32\Qeodhjmo.exe
        117⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Qhmqdemc.exe
        
        C:\Windows\system32\Qhmqdemc.exe
        118⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Qklmpalf.exe
        
        C:\Windows\system32\Qklmpalf.exe
        119⤵
        
        PID:3984
        
        C:\Windows\SysWOW64\Amjillkj.exe
        
        C:\Windows\system32\Amjillkj.exe
        120⤵
        
        PID:5436
        
        C:\Windows\SysWOW64\Aeaanjkl.exe
        
        C:\Windows\system32\Aeaanjkl.exe
        121⤵
        
        PID:5632
        
        C:\Windows\SysWOW64\Ahpmjejp.exe
        
        C:\Windows\system32\Ahpmjejp.exe
        122⤵
        
        PID:5820
        
        C:\Windows\SysWOW64\Aahbbkaq.exe
        
        C:\Windows\system32\Aahbbkaq.exe
        123⤵
        Drops file in System32 directory
        
        PID:6012
        
        C:\Windows\SysWOW64\Adfnofpd.exe
        
        C:\Windows\system32\Adfnofpd.exe
        124⤵
        
        PID:2052
        
        C:\Windows\SysWOW64\Aajohjon.exe
        
        C:\Windows\system32\Aajohjon.exe
        125⤵
        
        PID:1980
        
        C:\Windows\SysWOW64\Ahdged32.exe
        
        C:\Windows\system32\Ahdged32.exe
        126⤵
        Modifies registry class
        
        PID:5688
        
        C:\Windows\SysWOW64\Aonoao32.exe
        
        C:\Windows\system32\Aonoao32.exe
        127⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\Adkgje32.exe
        
        C:\Windows\system32\Adkgje32.exe
        128⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\Albpkc32.exe
        
        C:\Windows\system32\Albpkc32.exe
        129⤵
        Drops file in System32 directory
        
        PID:412
        
        C:\Windows\SysWOW64\Aekddhcb.exe
        
        C:\Windows\system32\Aekddhcb.exe
        130⤵
        
        PID:5492
        
        C:\Windows\SysWOW64\Bochmn32.exe
        
        C:\Windows\system32\Bochmn32.exe
        131⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Bhkmec32.exe
        
        C:\Windows\system32\Bhkmec32.exe
        132⤵
        
        PID:6000
        
        C:\Windows\SysWOW64\Boeebnhp.exe
        
        C:\Windows\system32\Boeebnhp.exe
        133⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Badanigc.exe
        
        C:\Windows\system32\Badanigc.exe
        134⤵
        
        PID:6240
        
        C:\Windows\SysWOW64\Bhnikc32.exe
        
        C:\Windows\system32\Bhnikc32.exe
        135⤵
        Modifies registry class
        
        PID:6300
        
        C:\Windows\SysWOW64\Bohbhmfm.exe
        
        C:\Windows\system32\Bohbhmfm.exe
        136⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6364
        
        C:\Windows\SysWOW64\Bddjpd32.exe
        
        C:\Windows\system32\Bddjpd32.exe
        137⤵
        
        PID:6408
        
        C:\Windows\SysWOW64\Bllbaa32.exe
        
        C:\Windows\system32\Bllbaa32.exe
        138⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Bahkih32.exe
        
        C:\Windows\system32\Bahkih32.exe
        139⤵
        
        PID:6496
        
        C:\Windows\SysWOW64\Bhbcfbjk.exe
        
        C:\Windows\system32\Bhbcfbjk.exe
        140⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\Bakgoh32.exe
        
        C:\Windows\system32\Bakgoh32.exe
        141⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\Bheplb32.exe
        
        C:\Windows\system32\Bheplb32.exe
        142⤵
        
        PID:6632
        
        C:\Windows\SysWOW64\Cnahdi32.exe
        
        C:\Windows\system32\Cnahdi32.exe
        143⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6668
        
        C:\Windows\SysWOW64\Cfipef32.exe
        
        C:\Windows\system32\Cfipef32.exe
        144⤵
        
        PID:6712
        
        C:\Windows\SysWOW64\Chglab32.exe
        
        C:\Windows\system32\Chglab32.exe
        145⤵
        Modifies registry class
        
        PID:6764
        
        C:\Windows\SysWOW64\Coadnlnb.exe
        
        C:\Windows\system32\Coadnlnb.exe
        146⤵
        
        PID:6808
        
        C:\Windows\SysWOW64\Cbpajgmf.exe
        
        C:\Windows\system32\Cbpajgmf.exe
        147⤵
        
        PID:6856
        
        C:\Windows\SysWOW64\Cdnmfclj.exe
        
        C:\Windows\system32\Cdnmfclj.exe
        148⤵
        
        PID:6896
        
        C:\Windows\SysWOW64\Cleegp32.exe
        
        C:\Windows\system32\Cleegp32.exe
        149⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Cnfaohbj.exe
        
        C:\Windows\system32\Cnfaohbj.exe
        150⤵
        
        PID:6980
        
        C:\Windows\SysWOW64\Cbbnpg32.exe
        
        C:\Windows\system32\Cbbnpg32.exe
        151⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Cdpjlb32.exe
        
        C:\Windows\system32\Cdpjlb32.exe
        152⤵
        
        PID:7072
        
        C:\Windows\SysWOW64\Ckjbhmad.exe
        
        C:\Windows\system32\Ckjbhmad.exe
        153⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Cbdjeg32.exe
        
        C:\Windows\system32\Cbdjeg32.exe
        154⤵
        
        PID:5872
        
        C:\Windows\SysWOW64\Chnbbqpn.exe
        
        C:\Windows\system32\Chnbbqpn.exe
        155⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Cnkkjh32.exe
        
        C:\Windows\system32\Cnkkjh32.exe
        156⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6280
        
        C:\Windows\SysWOW64\Cdecgbfa.exe
        
        C:\Windows\system32\Cdecgbfa.exe
        157⤵
        
        PID:6388
        
        C:\Windows\SysWOW64\Dmlkhofd.exe
        
        C:\Windows\system32\Dmlkhofd.exe
        158⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\Dokgdkeh.exe
        
        C:\Windows\system32\Dokgdkeh.exe
        159⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6536
        
        C:\Windows\SysWOW64\Dnmhpg32.exe
        
        C:\Windows\system32\Dnmhpg32.exe
        160⤵
        Modifies registry class
        
        PID:6596
        
        C:\Windows\SysWOW64\Dfdpad32.exe
        
        C:\Windows\system32\Dfdpad32.exe
        161⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Dhclmp32.exe
        
        C:\Windows\system32\Dhclmp32.exe
        162⤵
        Drops file in System32 directory
        
        PID:6740
        
        C:\Windows\SysWOW64\Dkahilkl.exe
        
        C:\Windows\system32\Dkahilkl.exe
        163⤵
        
        PID:6804
        
        C:\Windows\SysWOW64\Dnpdegjp.exe
        
        C:\Windows\system32\Dnpdegjp.exe
        164⤵
        
        PID:6876
        
        C:\Windows\SysWOW64\Dbkqfe32.exe
        
        C:\Windows\system32\Dbkqfe32.exe
        165⤵
        
        PID:6940
        
        C:\Windows\SysWOW64\Ddjmba32.exe
        
        C:\Windows\system32\Ddjmba32.exe
        166⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Dooaoj32.exe
        
        C:\Windows\system32\Dooaoj32.exe
        167⤵
        
        PID:7120
        
        C:\Windows\SysWOW64\Dbnmke32.exe
        
        C:\Windows\system32\Dbnmke32.exe
        168⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Digehphc.exe
        
        C:\Windows\system32\Digehphc.exe
        169⤵
        
        PID:6172
        
        C:\Windows\SysWOW64\Dndnpf32.exe
        
        C:\Windows\system32\Dndnpf32.exe
        170⤵
        Modifies registry class
        
        PID:6340
        
        C:\Windows\SysWOW64\Dmennnni.exe
        
        C:\Windows\system32\Dmennnni.exe
        171⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Dngjff32.exe
        
        C:\Windows\system32\Dngjff32.exe
        172⤵
        
        PID:6524
        
        C:\Windows\SysWOW64\Dfnbgc32.exe
        
        C:\Windows\system32\Dfnbgc32.exe
        173⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\Eiloco32.exe
        
        C:\Windows\system32\Eiloco32.exe
        174⤵
        
        PID:6800
        
        C:\Windows\SysWOW64\Eofgpikj.exe
        
        C:\Windows\system32\Eofgpikj.exe
        175⤵
        
        PID:6880
        
        C:\Windows\SysWOW64\Ebdcld32.exe
        
        C:\Windows\system32\Ebdcld32.exe
        176⤵
        Modifies registry class
        
        PID:7020
        
        C:\Windows\SysWOW64\Ekmhejao.exe
        
        C:\Windows\system32\Ekmhejao.exe
        177⤵
        
        PID:7112
        
        C:\Windows\SysWOW64\Ebgpad32.exe
        
        C:\Windows\system32\Ebgpad32.exe
        178⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Eeelnp32.exe
        
        C:\Windows\system32\Eeelnp32.exe
        179⤵
        
        PID:6236
        
        C:\Windows\SysWOW64\Eokqkh32.exe
        
        C:\Windows\system32\Eokqkh32.exe
        180⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Efeihb32.exe
        
        C:\Windows\system32\Efeihb32.exe
        181⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Eicedn32.exe
        
        C:\Windows\system32\Eicedn32.exe
        182⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Efgemb32.exe
        
        C:\Windows\system32\Efgemb32.exe
        183⤵
        
        PID:7040
        
        C:\Windows\SysWOW64\Emanjldl.exe
        
        C:\Windows\system32\Emanjldl.exe
        184⤵
        Modifies registry class
        
        PID:6216
        
        C:\Windows\SysWOW64\Eppjfgcp.exe
        
        C:\Windows\system32\Eppjfgcp.exe
        185⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Fihnomjp.exe
        
        C:\Windows\system32\Fihnomjp.exe
        186⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:6888
        
        C:\Windows\SysWOW64\Fpbflg32.exe
        
        C:\Windows\system32\Fpbflg32.exe
        187⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\Fflohaij.exe
        
        C:\Windows\system32\Fflohaij.exe
        188⤵
        Modifies registry class
        
        PID:6464
        
        C:\Windows\SysWOW64\Fijkdmhn.exe
        
        C:\Windows\system32\Fijkdmhn.exe
        189⤵
        
        PID:6968
        
        C:\Windows\SysWOW64\Fngcmcfe.exe
        
        C:\Windows\system32\Fngcmcfe.exe
        190⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Ffqhcq32.exe
        
        C:\Windows\system32\Ffqhcq32.exe
        191⤵
        
        PID:4476
        
        C:\Windows\SysWOW64\Fbgihaji.exe
        
        C:\Windows\system32\Fbgihaji.exe
        192⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\Fmmmfj32.exe
        
        C:\Windows\system32\Fmmmfj32.exe
        193⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Fpkibf32.exe
        
        C:\Windows\system32\Fpkibf32.exe
        194⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Fnnjmbpm.exe
        
        C:\Windows\system32\Fnnjmbpm.exe
        195⤵
        
        PID:3144
        
        C:\Windows\SysWOW64\Gehbjm32.exe
        
        C:\Windows\system32\Gehbjm32.exe
        196⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Gmojkj32.exe
        
        C:\Windows\system32\Gmojkj32.exe
        197⤵
        Drops file in System32 directory
        
        PID:960
        
        C:\Windows\SysWOW64\Gejopl32.exe
        
        C:\Windows\system32\Gejopl32.exe
        198⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\Gmafajfi.exe
        
        C:\Windows\system32\Gmafajfi.exe
        199⤵
        
        PID:7220
        
        C:\Windows\SysWOW64\Gbnoiqdq.exe
        
        C:\Windows\system32\Gbnoiqdq.exe
        200⤵
        
        PID:7288
        
        C:\Windows\SysWOW64\Gmdcfidg.exe
        
        C:\Windows\system32\Gmdcfidg.exe
        201⤵
        
        PID:7340
        
        C:\Windows\SysWOW64\Glgcbf32.exe
        
        C:\Windows\system32\Glgcbf32.exe
        202⤵
        
        PID:7380
        
        C:\Windows\SysWOW64\Gbalopbn.exe
        
        C:\Windows\system32\Gbalopbn.exe
        203⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Gikdkj32.exe
        
        C:\Windows\system32\Gikdkj32.exe
        204⤵
        
        PID:7472
        
        C:\Windows\SysWOW64\Gmfplibd.exe
        
        C:\Windows\system32\Gmfplibd.exe
        205⤵
        
        PID:7512
        
        C:\Windows\SysWOW64\Gpelhd32.exe
        
        C:\Windows\system32\Gpelhd32.exe
        206⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Gbchdp32.exe
        
        C:\Windows\system32\Gbchdp32.exe
        207⤵
        Modifies registry class
        
        PID:7588
        
        C:\Windows\SysWOW64\Geaepk32.exe
        
        C:\Windows\system32\Geaepk32.exe
        208⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Glkmmefl.exe
        
        C:\Windows\system32\Glkmmefl.exe
        209⤵
        
        PID:7688
        
        C:\Windows\SysWOW64\Gbeejp32.exe
        
        C:\Windows\system32\Gbeejp32.exe
        210⤵
        
        PID:7736
        
        C:\Windows\SysWOW64\Hmkigh32.exe
        
        C:\Windows\system32\Hmkigh32.exe
        211⤵
        
        PID:7780
        
        C:\Windows\SysWOW64\Hfcnpn32.exe
        
        C:\Windows\system32\Hfcnpn32.exe
        212⤵
        
        PID:7824
        
        C:\Windows\SysWOW64\Hidgai32.exe
        
        C:\Windows\system32\Hidgai32.exe
        213⤵
        
        PID:7864
        
        C:\Windows\SysWOW64\Hoaojp32.exe
        
        C:\Windows\system32\Hoaojp32.exe
        214⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Hekgfj32.exe
        
        C:\Windows\system32\Hekgfj32.exe
        215⤵
        
        PID:7944
        
        C:\Windows\SysWOW64\Hlepcdoa.exe
        
        C:\Windows\system32\Hlepcdoa.exe
        216⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Hemdlj32.exe
        
        C:\Windows\system32\Hemdlj32.exe
        217⤵
        
        PID:8036
        
        C:\Windows\SysWOW64\Hmdlmg32.exe
        
        C:\Windows\system32\Hmdlmg32.exe
        218⤵
        
        PID:8080
        
        C:\Windows\SysWOW64\Hpchib32.exe
        
        C:\Windows\system32\Hpchib32.exe
        219⤵
        Modifies registry class
        
        PID:8120
        
        C:\Windows\SysWOW64\Ibaeen32.exe
        
        C:\Windows\system32\Ibaeen32.exe
        220⤵
        
        PID:8160
        
        C:\Windows\SysWOW64\Iepaaico.exe
        
        C:\Windows\system32\Iepaaico.exe
        221⤵
        Drops file in System32 directory
        
        PID:1168
        
        C:\Windows\SysWOW64\Ipeeobbe.exe
        
        C:\Windows\system32\Ipeeobbe.exe
        222⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Ipgbdbqb.exe
        
        C:\Windows\system32\Ipgbdbqb.exe
        223⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:7360
        
        C:\Windows\SysWOW64\Ilnbicff.exe
        
        C:\Windows\system32\Ilnbicff.exe
        224⤵
        Drops file in System32 directory
        
        PID:7416
        
        C:\Windows\SysWOW64\Igdgglfl.exe
        
        C:\Windows\system32\Igdgglfl.exe
        225⤵
        
        PID:7480
        
        C:\Windows\SysWOW64\Ilqoobdd.exe
        
        C:\Windows\system32\Ilqoobdd.exe
        226⤵
        
        PID:7564
        
        C:\Windows\SysWOW64\Ipoheakj.exe
        
        C:\Windows\system32\Ipoheakj.exe
        227⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Jgmjmjnb.exe
        
        C:\Windows\system32\Jgmjmjnb.exe
        228⤵
        
        PID:7712
        
        C:\Windows\SysWOW64\Jljbeali.exe
        
        C:\Windows\system32\Jljbeali.exe
        229⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7776
        
        C:\Windows\SysWOW64\Jgpfbjlo.exe
        
        C:\Windows\system32\Jgpfbjlo.exe
        230⤵
        Modifies registry class
        
        PID:7844
        
        C:\Windows\SysWOW64\Jllokajf.exe
        
        C:\Windows\system32\Jllokajf.exe
        231⤵
        
        PID:7884
        
        C:\Windows\SysWOW64\Jgbchj32.exe
        
        C:\Windows\system32\Jgbchj32.exe
        232⤵
        
        PID:7968
        
        C:\Windows\SysWOW64\Kpjgaoqm.exe
        
        C:\Windows\system32\Kpjgaoqm.exe
        233⤵
        
        PID:8024
        
        C:\Windows\SysWOW64\Koodbl32.exe
        
        C:\Windows\system32\Koodbl32.exe
        234⤵
        
        PID:8100
        
        C:\Windows\SysWOW64\Klcekpdo.exe
        
        C:\Windows\system32\Klcekpdo.exe
        235⤵
        
        PID:8156
        
        C:\Windows\SysWOW64\Koaagkcb.exe
        
        C:\Windows\system32\Koaagkcb.exe
        236⤵
        
        PID:5124
        
        C:\Windows\SysWOW64\Kjgeedch.exe
        
        C:\Windows\system32\Kjgeedch.exe
        237⤵
        
        PID:7236
        
        C:\Windows\SysWOW64\Kofkbk32.exe
        
        C:\Windows\system32\Kofkbk32.exe
        238⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Kjlopc32.exe
        
        C:\Windows\system32\Kjlopc32.exe
        239⤵
        
        PID:7492
        
        C:\Windows\SysWOW64\Lljklo32.exe
        
        C:\Windows\system32\Lljklo32.exe
        240⤵
        Drops file in System32 directory
        
        PID:7576
        
        C:\Windows\SysWOW64\Lcdciiec.exe
        
        C:\Windows\system32\Lcdciiec.exe
        241⤵
        
        PID:7656
        
        C:\Windows\SysWOW64\Ljnlecmp.exe
        
        C:\Windows\system32\Ljnlecmp.exe
        242⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7768
        
        C:\Windows\SysWOW64\Lokdnjkg.exe
        
        C:\Windows\system32\Lokdnjkg.exe
        243⤵
        
        PID:7892
        
        C:\Windows\SysWOW64\Ljqhkckn.exe
        
        C:\Windows\system32\Ljqhkckn.exe
        244⤵
        
        PID:8020
        
        C:\Windows\SysWOW64\Lomqcjie.exe
        
        C:\Windows\system32\Lomqcjie.exe
        245⤵
        
        PID:8112
        
        C:\Windows\SysWOW64\Lfgipd32.exe
        
        C:\Windows\system32\Lfgipd32.exe
        246⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5412
        
        C:\Windows\SysWOW64\Lqmmmmph.exe
        
        C:\Windows\system32\Lqmmmmph.exe
        247⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Lfjfecno.exe
        
        C:\Windows\system32\Lfjfecno.exe
        248⤵
        Drops file in System32 directory
        
        PID:7392
        
        C:\Windows\SysWOW64\Lmdnbn32.exe
        
        C:\Windows\system32\Lmdnbn32.exe
        249⤵
        
        PID:7532
        
        C:\Windows\SysWOW64\Lncjlq32.exe
        
        C:\Windows\system32\Lncjlq32.exe
        250⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Mcpcdg32.exe
        
        C:\Windows\system32\Mcpcdg32.exe
        251⤵
        
        PID:7992
        
        C:\Windows\SysWOW64\Mfnoqc32.exe
        
        C:\Windows\system32\Mfnoqc32.exe
        252⤵
        
        PID:8068
        
        C:\Windows\SysWOW64\Mjjkaabc.exe
        
        C:\Windows\system32\Mjjkaabc.exe
        253⤵
        
        PID:7192
        
        C:\Windows\SysWOW64\Mgnlkfal.exe
        
        C:\Windows\system32\Mgnlkfal.exe
        254⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\Mokmdh32.exe
        
        C:\Windows\system32\Mokmdh32.exe
        255⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\Mjaabq32.exe
        
        C:\Windows\system32\Mjaabq32.exe
        256⤵
        
        PID:7524
        
        C:\Windows\SysWOW64\Mqkiok32.exe
        
        C:\Windows\system32\Mqkiok32.exe
        257⤵
        Modifies registry class
        
        PID:7812
        
        C:\Windows\SysWOW64\Mcifkf32.exe
        
        C:\Windows\system32\Mcifkf32.exe
        258⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Mfhbga32.exe
        
        C:\Windows\system32\Mfhbga32.exe
        259⤵
        Drops file in System32 directory
        
        PID:7428
        
        C:\Windows\SysWOW64\Nclbpf32.exe
        
        C:\Windows\system32\Nclbpf32.exe
        260⤵
        
        PID:7672
        
        C:\Windows\SysWOW64\Nmfcok32.exe
        
        C:\Windows\system32\Nmfcok32.exe
        261⤵
        Drops file in System32 directory
        
        PID:7952
        
        C:\Windows\SysWOW64\Npepkf32.exe
        
        C:\Windows\system32\Npepkf32.exe
        262⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Nmipdk32.exe
        
        C:\Windows\system32\Nmipdk32.exe
        263⤵
        Drops file in System32 directory
        
        PID:7908
        
        C:\Windows\SysWOW64\Ncchae32.exe
        
        C:\Windows\system32\Ncchae32.exe
        264⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3588
        
        C:\Windows\SysWOW64\Nnhmnn32.exe
        
        C:\Windows\system32\Nnhmnn32.exe
        265⤵
        
        PID:7188
        
        C:\Windows\SysWOW64\Nmkmjjaa.exe
        
        C:\Windows\system32\Nmkmjjaa.exe
        266⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:8180
        
        C:\Windows\SysWOW64\Ngqagcag.exe
        
        C:\Windows\system32\Ngqagcag.exe
        267⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Ncpeaoih.exe
        
        C:\Windows\system32\Ncpeaoih.exe
        268⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Ofegni32.exe
        
        C:\Windows\system32\Ofegni32.exe
        269⤵
        
        PID:8456
        
        C:\Windows\SysWOW64\Oiccje32.exe
        
        C:\Windows\system32\Oiccje32.exe
        270⤵
        
        PID:8500
        
        C:\Windows\SysWOW64\Bdeiqgkj.exe
        
        C:\Windows\system32\Bdeiqgkj.exe
        271⤵
        
        PID:8548
        
        C:\Windows\SysWOW64\Ckpamabg.exe
        
        C:\Windows\system32\Ckpamabg.exe
        272⤵
        
        PID:8584
        
        C:\Windows\SysWOW64\Cmnnimak.exe
        
        C:\Windows\system32\Cmnnimak.exe
        273⤵
        Drops file in System32 directory
        
        PID:8632
        
        C:\Windows\SysWOW64\Cajjjk32.exe
        
        C:\Windows\system32\Cajjjk32.exe
        274⤵
        
        PID:8676
        
        C:\Windows\SysWOW64\Cdhffg32.exe
        
        C:\Windows\system32\Cdhffg32.exe
        275⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8712
        
        C:\Windows\SysWOW64\Cgfbbb32.exe
        
        C:\Windows\system32\Cgfbbb32.exe
        276⤵
        
        PID:8760
        
        C:\Windows\SysWOW64\Cienon32.exe
        
        C:\Windows\system32\Cienon32.exe
        277⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Cigkdmel.exe
        
        C:\Windows\system32\Cigkdmel.exe
        278⤵
        
        PID:8848
        
        C:\Windows\SysWOW64\Cancekeo.exe
        
        C:\Windows\system32\Cancekeo.exe
        279⤵
        
        PID:8892
        
        C:\Windows\SysWOW64\Ccppmc32.exe
        
        C:\Windows\system32\Ccppmc32.exe
        280⤵
        Drops file in System32 directory
        
        PID:8940
        
        C:\Windows\SysWOW64\Ckggnp32.exe
        
        C:\Windows\system32\Ckggnp32.exe
        281⤵
        
        PID:8988
        
        C:\Windows\SysWOW64\Cmedjl32.exe
        
        C:\Windows\system32\Cmedjl32.exe
        282⤵
        
        PID:9032
        
        C:\Windows\SysWOW64\Caqpkjcl.exe
        
        C:\Windows\system32\Caqpkjcl.exe
        283⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Cdolgfbp.exe
        
        C:\Windows\system32\Cdolgfbp.exe
        284⤵
        
        PID:9116
        
        C:\Windows\SysWOW64\Cdaile32.exe
        
        C:\Windows\system32\Cdaile32.exe
        285⤵
        
        PID:9196
        
        C:\Windows\SysWOW64\Djgdkk32.exe
        
        C:\Windows\system32\Djgdkk32.exe
        286⤵
        
        PID:8216
        
        C:\Windows\SysWOW64\Dpalgenf.exe
        
        C:\Windows\system32\Dpalgenf.exe
        287⤵
        Drops file in System32 directory
        
        PID:8252
        
        C:\Windows\SysWOW64\Egkddo32.exe
        
        C:\Windows\system32\Egkddo32.exe
        288⤵
        Modifies registry class
        
        PID:8300
        
        C:\Windows\SysWOW64\Ekgqennl.exe
        
        C:\Windows\system32\Ekgqennl.exe
        289⤵
        
        PID:8340
        
        C:\Windows\SysWOW64\Enemaimp.exe
        
        C:\Windows\system32\Enemaimp.exe
        290⤵
        
        PID:8196
        
        C:\Windows\SysWOW64\Ecbeip32.exe
        
        C:\Windows\system32\Ecbeip32.exe
        291⤵
        
        PID:8452
        
        C:\Windows\SysWOW64\Epffbd32.exe
        
        C:\Windows\system32\Epffbd32.exe
        292⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Edaaccbj.exe
        
        C:\Windows\system32\Edaaccbj.exe
        293⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Enjfli32.exe
        
        C:\Windows\system32\Enjfli32.exe
        294⤵
        
        PID:8684
        
        C:\Windows\SysWOW64\Fbaahf32.exe
        
        C:\Windows\system32\Fbaahf32.exe
        295⤵
        
        PID:8772
        
        C:\Windows\SysWOW64\Fdpnda32.exe
        
        C:\Windows\system32\Fdpnda32.exe
        296⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Fkjfakng.exe
        
        C:\Windows\system32\Fkjfakng.exe
        297⤵
        
        PID:8888
        
        C:\Windows\SysWOW64\Fnhbmgmk.exe
        
        C:\Windows\system32\Fnhbmgmk.exe
        298⤵
        Drops file in System32 directory
        
        PID:8952
        
        C:\Windows\SysWOW64\Fbdnne32.exe
        
        C:\Windows\system32\Fbdnne32.exe
        299⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Fcekfnkb.exe
        
        C:\Windows\system32\Fcekfnkb.exe
        300⤵
        
        PID:8744
        
        C:\Windows\SysWOW64\Mccokj32.exe
        
        C:\Windows\system32\Mccokj32.exe
        301⤵
        
        PID:8844
        
        C:\Windows\SysWOW64\Mddkbbfg.exe
        
        C:\Windows\system32\Mddkbbfg.exe
        302⤵
        
        PID:8932
        
        C:\Windows\SysWOW64\Mkocol32.exe
        
        C:\Windows\system32\Mkocol32.exe
        303⤵
        
        PID:8996
        
        C:\Windows\SysWOW64\Mahklf32.exe
        
        C:\Windows\system32\Mahklf32.exe
        304⤵
        
        PID:1240
        
        C:\Windows\SysWOW64\Nhbciqln.exe
        
        C:\Windows\system32\Nhbciqln.exe
        305⤵
        
        PID:992
        
        C:\Windows\SysWOW64\Nchhfild.exe
        
        C:\Windows\system32\Nchhfild.exe
        306⤵
        
        PID:4052
        
        C:\Windows\SysWOW64\Nhjjip32.exe
        
        C:\Windows\system32\Nhjjip32.exe
        307⤵
        Drops file in System32 directory
        
        PID:404
        
        C:\Windows\SysWOW64\Nconfh32.exe
        
        C:\Windows\system32\Nconfh32.exe
        308⤵
        
        PID:1716
        
        C:\Windows\SysWOW64\Ooalibaf.exe
        
        C:\Windows\system32\Ooalibaf.exe
        247⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Okhmnc32.exe
        
        C:\Windows\system32\Okhmnc32.exe
        248⤵
        
        PID:1944
        
        C:\Windows\SysWOW64\Onkbenbi.exe
        
        C:\Windows\system32\Onkbenbi.exe
        249⤵
        
        PID:4716
        
        C:\Windows\SysWOW64\Ppkopail.exe
        
        C:\Windows\system32\Ppkopail.exe
        250⤵
        
        PID:8464
        
        C:\Windows\SysWOW64\Pehghhgc.exe
        
        C:\Windows\system32\Pehghhgc.exe
        251⤵
        
        PID:960
        
        C:\Windows\SysWOW64\Paqebike.exe
        
        C:\Windows\system32\Paqebike.exe
        252⤵
        
        PID:772
        
        C:\Windows\SysWOW64\Jacnegep.exe
        
        C:\Windows\system32\Jacnegep.exe
        171⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\Jgpfmncg.exe
        
        C:\Windows\system32\Jgpfmncg.exe
        172⤵
        
        PID:6120
        
        C:\Windows\SysWOW64\Jddggb32.exe
        
        C:\Windows\system32\Jddggb32.exe
        173⤵
        
        PID:8940
        
        C:\Windows\SysWOW64\Joikdk32.exe
        
        C:\Windows\system32\Joikdk32.exe
        174⤵
        
        PID:6060
        
        C:\Windows\SysWOW64\Jahgpf32.exe
        
        C:\Windows\system32\Jahgpf32.exe
        175⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Jpmdabfb.exe
        
        C:\Windows\system32\Jpmdabfb.exe
        176⤵
        
        PID:1876
        
        C:\Windows\SysWOW64\Jmqekg32.exe
        
        C:\Windows\system32\Jmqekg32.exe
        177⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8580
        
        C:\Windows\SysWOW64\Jgiiclkl.exe
        
        C:\Windows\system32\Jgiiclkl.exe
        178⤵
        
        PID:7312
        
        C:\Windows\SysWOW64\Kgkfil32.exe
        
        C:\Windows\system32\Kgkfil32.exe
        179⤵
        
        PID:412
        
        C:\Windows\SysWOW64\Kaajfe32.exe
        
        C:\Windows\system32\Kaajfe32.exe
        180⤵
        
        PID:8204
        
        C:\Windows\SysWOW64\Khkbcopl.exe
        
        C:\Windows\system32\Khkbcopl.exe
        181⤵
        
        PID:8880
        
        C:\Windows\SysWOW64\Kkioojpp.exe
        
        C:\Windows\system32\Kkioojpp.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7064
        
        C:\Windows\SysWOW64\Knhkkfod.exe
        
        C:\Windows\system32\Knhkkfod.exe
        183⤵
        
        PID:8820
        
        C:\Windows\SysWOW64\Kpfggang.exe
        
        C:\Windows\system32\Kpfggang.exe
        184⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\Kklkej32.exe
        
        C:\Windows\system32\Kklkej32.exe
        185⤵
        
        PID:5856
        
        C:\Windows\SysWOW64\Kgeiokao.exe
        
        C:\Windows\system32\Kgeiokao.exe
        186⤵
        Drops file in System32 directory
        
        PID:8956
        
        C:\Windows\SysWOW64\Lhdeinhb.exe
        
        C:\Windows\system32\Lhdeinhb.exe
        187⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Lqbgcp32.exe
        
        C:\Windows\system32\Lqbgcp32.exe
        188⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\Lnfgmc32.exe
        
        C:\Windows\system32\Lnfgmc32.exe
        189⤵
        
        PID:460
        
        C:\Windows\SysWOW64\Pbpall32.exe
        
        C:\Windows\system32\Pbpall32.exe
        13⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Ppdbfpaa.exe
        
        C:\Windows\system32\Ppdbfpaa.exe
        14⤵
        
        PID:7104
        
        C:\Windows\SysWOW64\Qimfoe32.exe
        
        C:\Windows\system32\Qimfoe32.exe
        15⤵
        
        PID:7700
        
        C:\Windows\SysWOW64\Qhofjbnl.exe
        
        C:\Windows\system32\Qhofjbnl.exe
        16⤵
        Drops file in System32 directory
        
        PID:7660
        
        C:\Windows\SysWOW64\Qpfokpoo.exe
        
        C:\Windows\system32\Qpfokpoo.exe
        17⤵
        
        PID:4932
        
        C:\Windows\SysWOW64\Qahkch32.exe
        
        C:\Windows\system32\Qahkch32.exe
        18⤵
        
        PID:6492
        
        C:\Windows\SysWOW64\Qhbcpb32.exe
        
        C:\Windows\system32\Qhbcpb32.exe
        19⤵
        
        PID:6704
        
        C:\Windows\SysWOW64\Nofoki32.exe
        
        C:\Windows\system32\Nofoki32.exe
        7⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\Oljoen32.exe
        
        C:\Windows\system32\Oljoen32.exe
        8⤵
        
        PID:4072
        
        C:\Windows\SysWOW64\Bppcpc32.exe
        
        C:\Windows\system32\Bppcpc32.exe
        9⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\Dfonnk32.exe
        
        C:\Windows\system32\Dfonnk32.exe
        10⤵
        
        PID:8884
        
        C:\Windows\SysWOW64\Dedkogqm.exe
        
        C:\Windows\system32\Dedkogqm.exe
        11⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\Ddekmo32.exe
        
        C:\Windows\system32\Ddekmo32.exe
        12⤵
        
        PID:3500
        
        C:\Windows\SysWOW64\Dibdeegc.exe
        
        C:\Windows\system32\Dibdeegc.exe
        13⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Didqkeeq.exe
        
        C:\Windows\system32\Didqkeeq.exe
        14⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3892
        
        C:\Windows\SysWOW64\Ddjehneg.exe
        
        C:\Windows\system32\Ddjehneg.exe
        15⤵
        
        PID:4468
        
        C:\Windows\SysWOW64\Edlann32.exe
        
        C:\Windows\system32\Edlann32.exe
        16⤵
        
        PID:5960

C:\Windows\SysWOW64\Eepkkefp.exe
C:\Windows\system32\Eepkkefp.exe
1⤵
PID:5252
- C:\Windows\SysWOW64\Edakimoo.exe
  C:\Windows\system32\Edakimoo.exe
  2⤵
  PID:5188
- - C:\Windows\SysWOW64\Eebgqe32.exe
    C:\Windows\system32\Eebgqe32.exe
    3⤵
    PID:5340
  - - C:\Windows\SysWOW64\Ellpmolj.exe
      C:\Windows\system32\Ellpmolj.exe
      4⤵
      PID:5528
    - - C:\Windows\SysWOW64\Eeddfe32.exe
        
        C:\Windows\system32\Eeddfe32.exe
        5⤵
        
        PID:5888
      - C:\Windows\SysWOW64\Elolco32.exe
        
        C:\Windows\system32\Elolco32.exe
        6⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Flaiho32.exe
        
        C:\Windows\system32\Flaiho32.exe
        7⤵
        
        PID:3872
        
        C:\Windows\SysWOW64\Fnqebaog.exe
        
        C:\Windows\system32\Fnqebaog.exe
        8⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Fpoaom32.exe
        
        C:\Windows\system32\Fpoaom32.exe
        9⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4352
        
        C:\Windows\SysWOW64\Fgijkgeh.exe
        
        C:\Windows\system32\Fgijkgeh.exe
        10⤵
        
        PID:8228
        
        C:\Windows\SysWOW64\Fncbha32.exe
        
        C:\Windows\system32\Fncbha32.exe
        11⤵
        
        PID:5972
        
        C:\Windows\SysWOW64\Fcpkph32.exe
        
        C:\Windows\system32\Fcpkph32.exe
        12⤵
        
        PID:5308
        
        C:\Windows\SysWOW64\Fgkfqgce.exe
        
        C:\Windows\system32\Fgkfqgce.exe
        13⤵
        
        PID:2880
        
        C:\Windows\SysWOW64\Fdogjk32.exe
        
        C:\Windows\system32\Fdogjk32.exe
        14⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\Ffpcbchm.exe
        
        C:\Windows\system32\Ffpcbchm.exe
        15⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Dfeibf32.exe
        
        C:\Windows\system32\Dfeibf32.exe
        11⤵
        Modifies registry class
        
        PID:2172
        
        C:\Windows\SysWOW64\Emoaopnf.exe
        
        C:\Windows\system32\Emoaopnf.exe
        12⤵
        
        PID:5588
        
        C:\Windows\SysWOW64\Eqkmpo32.exe
        
        C:\Windows\system32\Eqkmpo32.exe
        13⤵
        
        PID:1448
        
        C:\Windows\SysWOW64\Eciilj32.exe
        
        C:\Windows\system32\Eciilj32.exe
        14⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\Efgehe32.exe
        
        C:\Windows\system32\Efgehe32.exe
        15⤵
        
        PID:2208
        
        C:\Windows\SysWOW64\Enomic32.exe
        
        C:\Windows\system32\Enomic32.exe
        16⤵
        Modifies registry class
        
        PID:5348
        
        C:\Windows\SysWOW64\Eopjakkg.exe
        
        C:\Windows\system32\Eopjakkg.exe
        17⤵
        
        PID:7856
        
        C:\Windows\SysWOW64\Eggbbhkj.exe
        
        C:\Windows\system32\Eggbbhkj.exe
        18⤵
        Drops file in System32 directory
        
        PID:4536
        
        C:\Windows\SysWOW64\Ejennd32.exe
        
        C:\Windows\system32\Ejennd32.exe
        19⤵
        
        PID:5924
        
        C:\Windows\SysWOW64\Emdjjo32.exe
        
        C:\Windows\system32\Emdjjo32.exe
        20⤵
        
        PID:2328
        
        C:\Windows\SysWOW64\Eobffk32.exe
        
        C:\Windows\system32\Eobffk32.exe
        21⤵
        
        PID:8648
        
        C:\Windows\SysWOW64\Egiohh32.exe
        
        C:\Windows\system32\Egiohh32.exe
        22⤵
        
        PID:6892
        
        C:\Windows\SysWOW64\Ejhkdc32.exe
        
        C:\Windows\system32\Ejhkdc32.exe
        23⤵
        Drops file in System32 directory
        
        PID:5860
        
        C:\Windows\SysWOW64\Emfgpo32.exe
        
        C:\Windows\system32\Emfgpo32.exe
        24⤵
        
        PID:9020
        
        C:\Windows\SysWOW64\Eodclj32.exe
        
        C:\Windows\system32\Eodclj32.exe
        25⤵
        
        PID:8516
        
        C:\Windows\SysWOW64\Ecpomiok.exe
        
        C:\Windows\system32\Ecpomiok.exe
        26⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5292
        
        C:\Windows\SysWOW64\Eqdpfm32.exe
        
        C:\Windows\system32\Eqdpfm32.exe
        27⤵
        
        PID:2288
        
        C:\Windows\SysWOW64\Ffahnd32.exe
        
        C:\Windows\system32\Ffahnd32.exe
        28⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7092
        
        C:\Windows\SysWOW64\Fqfmlm32.exe
        
        C:\Windows\system32\Fqfmlm32.exe
        29⤵
        
        PID:8392
        
        C:\Windows\SysWOW64\Fgqehgco.exe
        
        C:\Windows\system32\Fgqehgco.exe
        30⤵
        
        PID:6448
        
        C:\Windows\SysWOW64\Fmmmqnaf.exe
        
        C:\Windows\system32\Fmmmqnaf.exe
        31⤵
        Drops file in System32 directory
        
        PID:5776
        
        C:\Windows\SysWOW64\Fcgemhic.exe
        
        C:\Windows\system32\Fcgemhic.exe
        32⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\Fnofpqff.exe
        
        C:\Windows\system32\Fnofpqff.exe
        33⤵
        
        PID:6108
        
        C:\Windows\SysWOW64\Gmfpgmil.exe
        
        C:\Windows\system32\Gmfpgmil.exe
        34⤵
        
        PID:5848
        
        C:\Windows\SysWOW64\Gnfmapqo.exe
        
        C:\Windows\system32\Gnfmapqo.exe
        35⤵
        
        PID:6136
        
        C:\Windows\SysWOW64\Gcceifof.exe
        
        C:\Windows\system32\Gcceifof.exe
        36⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6316
        
        C:\Windows\SysWOW64\Gagebknp.exe
        
        C:\Windows\system32\Gagebknp.exe
        37⤵
        
        PID:8896
        
        C:\Windows\SysWOW64\Ghanoeel.exe
        
        C:\Windows\system32\Ghanoeel.exe
        38⤵
        
        PID:3592
        
        C:\Windows\SysWOW64\Gnmbao32.exe
        
        C:\Windows\system32\Gnmbao32.exe
        39⤵
        
        PID:8272
        
        C:\Windows\SysWOW64\Hhegjdag.exe
        
        C:\Windows\system32\Hhegjdag.exe
        40⤵
        Modifies registry class
        
        PID:7528
        
        C:\Windows\SysWOW64\Hnpognhd.exe
        
        C:\Windows\system32\Hnpognhd.exe
        41⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8132
        
        C:\Windows\SysWOW64\Hpqlof32.exe
        
        C:\Windows\system32\Hpqlof32.exe
        42⤵
        
        PID:6820
        
        C:\Windows\SysWOW64\Hhhdpd32.exe
        
        C:\Windows\system32\Hhhdpd32.exe
        43⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\Hnblmnfa.exe
        
        C:\Windows\system32\Hnblmnfa.exe
        44⤵
        Modifies registry class
        
        PID:6808
        
        C:\Windows\SysWOW64\Haphiiee.exe
        
        C:\Windows\system32\Haphiiee.exe
        45⤵
        
        PID:5640
        
        C:\Windows\SysWOW64\Hdodeedi.exe
        
        C:\Windows\system32\Hdodeedi.exe
        46⤵
        
        PID:8344
        
        C:\Windows\SysWOW64\Hfmqapcl.exe
        
        C:\Windows\system32\Hfmqapcl.exe
        47⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\Hndibn32.exe
        
        C:\Windows\system32\Hndibn32.exe
        48⤵
        Drops file in System32 directory
        
        PID:4052
        
        C:\Windows\SysWOW64\Habeni32.exe
        
        C:\Windows\system32\Habeni32.exe
        49⤵
        
        PID:6192
        
        C:\Windows\SysWOW64\Hdaajd32.exe
        
        C:\Windows\system32\Hdaajd32.exe
        50⤵
        Drops file in System32 directory
        
        PID:8780
        
        C:\Windows\SysWOW64\Hfonfp32.exe
        
        C:\Windows\system32\Hfonfp32.exe
        51⤵
        
        PID:9008
        
        C:\Windows\SysWOW64\Ihfpabbd.exe
        
        C:\Windows\system32\Ihfpabbd.exe
        52⤵
        
        PID:7048
        
        C:\Windows\SysWOW64\Ifipmo32.exe
        
        C:\Windows\system32\Ifipmo32.exe
        53⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Iophnl32.exe
        
        C:\Windows\system32\Iophnl32.exe
        54⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\Iandjg32.exe
        
        C:\Windows\system32\Iandjg32.exe
        55⤵
        
        PID:224
        
        C:\Windows\SysWOW64\Ihhmgaqb.exe
        
        C:\Windows\system32\Ihhmgaqb.exe
        56⤵
        
        PID:6864
        
        C:\Windows\SysWOW64\Ikgicmpe.exe
        
        C:\Windows\system32\Ikgicmpe.exe
        57⤵
        Modifies registry class
        
        PID:8348
        
        C:\Windows\SysWOW64\Imeeohoi.exe
        
        C:\Windows\system32\Imeeohoi.exe
        58⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\Ipcakd32.exe
        
        C:\Windows\system32\Ipcakd32.exe
        59⤵
        
        PID:8852
        
        C:\Windows\SysWOW64\Ikifhm32.exe
        
        C:\Windows\system32\Ikifhm32.exe
        60⤵
        
        PID:6340

C:\Windows\SysWOW64\Fdadpk32.exe
C:\Windows\system32\Fdadpk32.exe
1⤵
- Modifies registry class
PID:8316
- C:\Windows\SysWOW64\Gphddlfp.exe
  C:\Windows\system32\Gphddlfp.exe
  2⤵
  PID:8380
- - C:\Windows\SysWOW64\Ggbmafnm.exe
    C:\Windows\system32\Ggbmafnm.exe
    3⤵
    PID:4620
  - - C:\Windows\SysWOW64\Gfemmb32.exe
      C:\Windows\system32\Gfemmb32.exe
      4⤵
      PID:4224
    - - C:\Windows\SysWOW64\Gloejmld.exe
        
        C:\Windows\system32\Gloejmld.exe
        5⤵
        
        PID:3200
      - C:\Windows\SysWOW64\Gqkajk32.exe
        
        C:\Windows\system32\Gqkajk32.exe
        6⤵
        
        PID:5880
        
        C:\Windows\SysWOW64\Gcimfg32.exe
        
        C:\Windows\system32\Gcimfg32.exe
        7⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\Ggdigekj.exe
        
        C:\Windows\system32\Ggdigekj.exe
        8⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\Hqddqj32.exe
        
        C:\Windows\system32\Hqddqj32.exe
        9⤵
        
        PID:412
        
        C:\Windows\SysWOW64\Bnbmqjjo.exe
        
        C:\Windows\system32\Bnbmqjjo.exe
        10⤵
        
        PID:6188
        
        C:\Windows\SysWOW64\Bijncb32.exe
        
        C:\Windows\system32\Bijncb32.exe
        11⤵
        Modifies registry class
        
        PID:4364
        
        C:\Windows\SysWOW64\Bgmnooom.exe
        
        C:\Windows\system32\Bgmnooom.exe
        12⤵
        Modifies registry class
        
        PID:4148
        
        C:\Windows\SysWOW64\Bbeobhlp.exe
        
        C:\Windows\system32\Bbeobhlp.exe
        13⤵
        
        PID:7096
        
        C:\Windows\SysWOW64\Cgagjo32.exe
        
        C:\Windows\system32\Cgagjo32.exe
        14⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\Cbglgg32.exe
        
        C:\Windows\system32\Cbglgg32.exe
        15⤵
        
        PID:8644
        
        C:\Windows\SysWOW64\Cfbhhfbg.exe
        
        C:\Windows\system32\Cfbhhfbg.exe
        16⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6224
        
        C:\Windows\SysWOW64\Chddpn32.exe
        
        C:\Windows\system32\Chddpn32.exe
        17⤵
        
        PID:6672
        
        C:\Windows\SysWOW64\Cpklql32.exe
        
        C:\Windows\system32\Cpklql32.exe
        18⤵
        
        PID:9056
        
        C:\Windows\SysWOW64\Cnnllhpa.exe
        
        C:\Windows\system32\Cnnllhpa.exe
        19⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\Chfaenfb.exe
        
        C:\Windows\system32\Chfaenfb.exe
        20⤵
        
        PID:6812
        
        C:\Windows\SysWOW64\Cpmifkgd.exe
        
        C:\Windows\system32\Cpmifkgd.exe
        21⤵
        
        PID:6860
        
        C:\Windows\SysWOW64\Cblebgfh.exe
        
        C:\Windows\system32\Cblebgfh.exe
        22⤵
        
        PID:6944
        
        C:\Windows\SysWOW64\Cejaobel.exe
        
        C:\Windows\system32\Cejaobel.exe
        23⤵
        
        PID:6220
        
        C:\Windows\SysWOW64\Cfjnhe32.exe
        
        C:\Windows\system32\Cfjnhe32.exe
        24⤵
        
        PID:7128
        
        C:\Windows\SysWOW64\Cfljnejl.exe
        
        C:\Windows\system32\Cfljnejl.exe
        25⤵
        
        PID:6316
        
        C:\Windows\SysWOW64\Dlicflic.exe
        
        C:\Windows\system32\Dlicflic.exe
        26⤵
        Modifies registry class
        
        PID:4396
        
        C:\Windows\SysWOW64\Dfngcdhi.exe
        
        C:\Windows\system32\Dfngcdhi.exe
        27⤵
        
        PID:6788
        
        C:\Windows\SysWOW64\Dimcppgm.exe
        
        C:\Windows\system32\Dimcppgm.exe
        28⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\Eldbbjof.exe
        
        C:\Windows\system32\Eldbbjof.exe
        29⤵
        Drops file in System32 directory
        
        PID:6596
        
        C:\Windows\SysWOW64\Ebokodfc.exe
        
        C:\Windows\system32\Ebokodfc.exe
        30⤵
        
        PID:1292
        
        C:\Windows\SysWOW64\Eemgkpef.exe
        
        C:\Windows\system32\Eemgkpef.exe
        31⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\Epbkhhel.exe
        
        C:\Windows\system32\Epbkhhel.exe
        32⤵
        Drops file in System32 directory
        
        PID:3044
        
        C:\Windows\SysWOW64\Eikpan32.exe
        
        C:\Windows\system32\Eikpan32.exe
        33⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\Ehnpmkbg.exe
        
        C:\Windows\system32\Ehnpmkbg.exe
        34⤵
        
        PID:1796
        
        C:\Windows\SysWOW64\Epehnhbj.exe
        
        C:\Windows\system32\Epehnhbj.exe
        35⤵
        
        PID:7068
        
        C:\Windows\SysWOW64\Eedmlo32.exe
        
        C:\Windows\system32\Eedmlo32.exe
        36⤵
        
        PID:6664
        
        C:\Windows\SysWOW64\Ehbihj32.exe
        
        C:\Windows\system32\Ehbihj32.exe
        37⤵
        
        PID:6044
        
        C:\Windows\SysWOW64\Epiaig32.exe
        
        C:\Windows\system32\Epiaig32.exe
        38⤵
        
        PID:5988
        
        C:\Windows\SysWOW64\Fgcjea32.exe
        
        C:\Windows\system32\Fgcjea32.exe
        39⤵
        
        PID:6676
        
        C:\Windows\SysWOW64\Fefjanml.exe
        
        C:\Windows\system32\Fefjanml.exe
        40⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\Fplnogmb.exe
        
        C:\Windows\system32\Fplnogmb.exe
        41⤵
        
        PID:6516
        
        C:\Windows\SysWOW64\Fgffka32.exe
        
        C:\Windows\system32\Fgffka32.exe
        42⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\Fpnkdfko.exe
        
        C:\Windows\system32\Fpnkdfko.exe
        43⤵
        
        PID:6084
        
        C:\Windows\SysWOW64\Fekclnif.exe
        
        C:\Windows\system32\Fekclnif.exe
        44⤵
        
        PID:4348
        
        C:\Windows\SysWOW64\Fpqgjf32.exe
        
        C:\Windows\system32\Fpqgjf32.exe
        45⤵
        
        PID:6844
        
        C:\Windows\SysWOW64\Fcodfa32.exe
        
        C:\Windows\system32\Fcodfa32.exe
        46⤵
        Modifies registry class
        
        PID:2780
        
        C:\Windows\SysWOW64\Fiilblom.exe
        
        C:\Windows\system32\Fiilblom.exe
        47⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\Fgmllpng.exe
        
        C:\Windows\system32\Fgmllpng.exe
        48⤵
        
        PID:3840
        
        C:\Windows\SysWOW64\Fepmgm32.exe
        
        C:\Windows\system32\Fepmgm32.exe
        49⤵
        
        PID:5752
        
        C:\Windows\SysWOW64\Fljedg32.exe
        
        C:\Windows\system32\Fljedg32.exe
        50⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Gohapb32.exe
        
        C:\Windows\system32\Gohapb32.exe
        51⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\Ginenk32.exe
        
        C:\Windows\system32\Ginenk32.exe
        52⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5712
        
        C:\Windows\SysWOW64\Gllajf32.exe
        
        C:\Windows\system32\Gllajf32.exe
        53⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3148
        
        C:\Windows\SysWOW64\Ggafgo32.exe
        
        C:\Windows\system32\Ggafgo32.exe
        54⤵
        Modifies registry class
        
        PID:1104
        
        C:\Windows\SysWOW64\Hcommoin.exe
        
        C:\Windows\system32\Hcommoin.exe
        55⤵
        
        PID:5980
        
        C:\Windows\SysWOW64\Hjieii32.exe
        
        C:\Windows\system32\Hjieii32.exe
        56⤵
        
        PID:5964
        
        C:\Windows\SysWOW64\Hcaibo32.exe
        
        C:\Windows\system32\Hcaibo32.exe
        57⤵
        
        PID:6076
        
        C:\Windows\SysWOW64\Hfpenj32.exe
        
        C:\Windows\system32\Hfpenj32.exe
        58⤵
        Modifies registry class
        
        PID:6852
        
        C:\Windows\SysWOW64\Hljnkdnk.exe
        
        C:\Windows\system32\Hljnkdnk.exe
        59⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\Hgpbhmna.exe
        
        C:\Windows\system32\Hgpbhmna.exe
        60⤵
        
        PID:6352
        
        C:\Windows\SysWOW64\Hfbbdj32.exe
        
        C:\Windows\system32\Hfbbdj32.exe
        61⤵
        
        PID:7756
        
        C:\Windows\SysWOW64\Hhaope32.exe
        
        C:\Windows\system32\Hhaope32.exe
        62⤵
        
        PID:3056
        
        C:\Windows\SysWOW64\Hphfac32.exe
        
        C:\Windows\system32\Hphfac32.exe
        63⤵
        
        PID:6116
        
        C:\Windows\SysWOW64\Hokgmpkl.exe
        
        C:\Windows\system32\Hokgmpkl.exe
        64⤵
        
        PID:8008
        
        C:\Windows\SysWOW64\Imcqacfq.exe
        
        C:\Windows\system32\Imcqacfq.exe
        65⤵
        
        PID:7784
        
        C:\Windows\SysWOW64\Igieoleg.exe
        
        C:\Windows\system32\Igieoleg.exe
        66⤵
        
        PID:7680
        
        C:\Windows\SysWOW64\Ijgakgej.exe
        
        C:\Windows\system32\Ijgakgej.exe
        67⤵
        
        PID:5372
        
        C:\Windows\SysWOW64\Iqaiga32.exe
        
        C:\Windows\system32\Iqaiga32.exe
        68⤵
        
        PID:7504
        
        C:\Windows\SysWOW64\Igkadlcd.exe
        
        C:\Windows\system32\Igkadlcd.exe
        69⤵
        Drops file in System32 directory
        
        PID:7648
        
        C:\Windows\SysWOW64\Imhjlb32.exe
        
        C:\Windows\system32\Imhjlb32.exe
        70⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\Ioffhn32.exe
        
        C:\Windows\system32\Ioffhn32.exe
        71⤵
        
        PID:7276
        
        C:\Windows\SysWOW64\Ijlkfg32.exe
        
        C:\Windows\system32\Ijlkfg32.exe
        72⤵
        Drops file in System32 directory
        
        PID:7808
        
        C:\Windows\SysWOW64\Iqfcbahb.exe
        
        C:\Windows\system32\Iqfcbahb.exe
        73⤵
        
        PID:7404
        
        C:\Windows\SysWOW64\Icdoolge.exe
        
        C:\Windows\system32\Icdoolge.exe
        74⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6080
        
        C:\Windows\SysWOW64\Iiaggc32.exe
        
        C:\Windows\system32\Iiaggc32.exe
        75⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Jqhphq32.exe
        
        C:\Windows\system32\Jqhphq32.exe
        76⤵
        
        PID:7332
        
        C:\Windows\SysWOW64\Jgbhdkml.exe
        
        C:\Windows\system32\Jgbhdkml.exe
        77⤵
        
        PID:7984
        
        C:\Windows\SysWOW64\Jjqdafmp.exe
        
        C:\Windows\system32\Jjqdafmp.exe
        78⤵
        Drops file in System32 directory
        
        PID:7904
        
        C:\Windows\SysWOW64\Jmopmalc.exe
        
        C:\Windows\system32\Jmopmalc.exe
        79⤵
        
        PID:7436
        
        C:\Windows\SysWOW64\Jgedjjki.exe
        
        C:\Windows\system32\Jgedjjki.exe
        80⤵
        
        PID:7364
        
        C:\Windows\SysWOW64\Jfgefg32.exe
        
        C:\Windows\system32\Jfgefg32.exe
        81⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Jmamba32.exe
        
        C:\Windows\system32\Jmamba32.exe
        82⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Jcnbekok.exe
        
        C:\Windows\system32\Jcnbekok.exe
        83⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Jflnafno.exe
        
        C:\Windows\system32\Jflnafno.exe
        84⤵
        
        PID:7604
        
        C:\Windows\SysWOW64\Jjhjae32.exe
        
        C:\Windows\system32\Jjhjae32.exe
        85⤵
        
        PID:6384
        
        C:\Windows\SysWOW64\Jmffnq32.exe
        
        C:\Windows\system32\Jmffnq32.exe
        86⤵
        
        PID:7572
        
        C:\Windows\SysWOW64\Jqbbno32.exe
        
        C:\Windows\system32\Jqbbno32.exe
        87⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Nildajdg.exe
        
        C:\Windows\system32\Nildajdg.exe
        46⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7932

C:\Windows\SysWOW64\Jcpojk32.exe
C:\Windows\system32\Jcpojk32.exe
1⤵
- Drops file in System32 directory
PID:4932
- C:\Windows\SysWOW64\Jglkkiea.exe
  C:\Windows\system32\Jglkkiea.exe
  2⤵
  PID:6204
- - C:\Windows\SysWOW64\Kimgba32.exe
    C:\Windows\system32\Kimgba32.exe
    3⤵
    PID:4244
  - - C:\Windows\SysWOW64\Kpgoolbl.exe
      C:\Windows\system32\Kpgoolbl.exe
      4⤵
      PID:6328
    - - C:\Windows\SysWOW64\Kgngqico.exe
        
        C:\Windows\system32\Kgngqico.exe
        5⤵
        
        PID:3472
      - C:\Windows\SysWOW64\Kiodha32.exe
        
        C:\Windows\system32\Kiodha32.exe
        6⤵
        
        PID:6472
        
        C:\Windows\SysWOW64\Kaflio32.exe
        
        C:\Windows\system32\Kaflio32.exe
        7⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7408
        
        C:\Windows\SysWOW64\Kfcdaehf.exe
        
        C:\Windows\system32\Kfcdaehf.exe
        8⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Kjopbd32.exe
        
        C:\Windows\system32\Kjopbd32.exe
        9⤵
        
        PID:7936
        
        C:\Windows\SysWOW64\Kaihonhl.exe
        
        C:\Windows\system32\Kaihonhl.exe
        10⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4436
        
        C:\Windows\SysWOW64\Kplijk32.exe
        
        C:\Windows\system32\Kplijk32.exe
        11⤵
        
        PID:4984
        
        C:\Windows\SysWOW64\Kgcqlh32.exe
        
        C:\Windows\system32\Kgcqlh32.exe
        12⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6680
        
        C:\Windows\SysWOW64\Kfeagefd.exe
        
        C:\Windows\system32\Kfeagefd.exe
        13⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\Kidmcqeg.exe
        
        C:\Windows\system32\Kidmcqeg.exe
        14⤵
        
        PID:4240
        
        C:\Windows\SysWOW64\Kakednfj.exe
        
        C:\Windows\system32\Kakednfj.exe
        15⤵
        
        PID:6304
        
        C:\Windows\SysWOW64\Kciaqi32.exe
        
        C:\Windows\system32\Kciaqi32.exe
        16⤵
        
        PID:4048
        
        C:\Windows\SysWOW64\Kjcjmclj.exe
        
        C:\Windows\system32\Kjcjmclj.exe
        17⤵
        
        PID:416
        
        C:\Windows\SysWOW64\Kmbfiokn.exe
        
        C:\Windows\system32\Kmbfiokn.exe
        18⤵
        Modifies registry class
        
        PID:3488
        
        C:\Windows\SysWOW64\Kclnfi32.exe
        
        C:\Windows\system32\Kclnfi32.exe
        19⤵
        
        PID:8668
        
        C:\Windows\SysWOW64\Kfjjbd32.exe
        
        C:\Windows\system32\Kfjjbd32.exe
        20⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\Lmdbooik.exe
        
        C:\Windows\system32\Lmdbooik.exe
        21⤵
        
        PID:3124
        
        C:\Windows\SysWOW64\Lcnkli32.exe
        
        C:\Windows\system32\Lcnkli32.exe
        22⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8792
        
        C:\Windows\SysWOW64\Lgjglg32.exe
        
        C:\Windows\system32\Lgjglg32.exe
        23⤵
        Modifies registry class
        
        PID:6712
        
        C:\Windows\SysWOW64\Likcdpop.exe
        
        C:\Windows\system32\Likcdpop.exe
        24⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\Labkempb.exe
        
        C:\Windows\system32\Labkempb.exe
        25⤵
        Modifies registry class
        
        PID:4968
        
        C:\Windows\SysWOW64\Lcqgahoe.exe
        
        C:\Windows\system32\Lcqgahoe.exe
        26⤵
        Modifies registry class
        
        PID:8976
        
        C:\Windows\SysWOW64\Lmiljn32.exe
        
        C:\Windows\system32\Lmiljn32.exe
        27⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Lpghfi32.exe
        
        C:\Windows\system32\Lpghfi32.exe
        28⤵
        
        PID:9160
        
        C:\Windows\SysWOW64\Lfaqcclf.exe
        
        C:\Windows\system32\Lfaqcclf.exe
        29⤵
        
        PID:6200
        
        C:\Windows\SysWOW64\Ljmmcbdp.exe
        
        C:\Windows\system32\Ljmmcbdp.exe
        30⤵
        
        PID:5784
        
        C:\Windows\SysWOW64\Lagepl32.exe
        
        C:\Windows\system32\Lagepl32.exe
        31⤵
        Drops file in System32 directory
        
        PID:4736
        
        C:\Windows\SysWOW64\Lpjelibg.exe
        
        C:\Windows\system32\Lpjelibg.exe
        32⤵
        Modifies registry class
        
        PID:6268
        
        C:\Windows\SysWOW64\Lfcmhc32.exe
        
        C:\Windows\system32\Lfcmhc32.exe
        33⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\Ljoiibbm.exe
        
        C:\Windows\system32\Ljoiibbm.exe
        34⤵
        
        PID:3476
        
        C:\Windows\SysWOW64\Lmneemaq.exe
        
        C:\Windows\system32\Lmneemaq.exe
        35⤵
        
        PID:816
        
        C:\Windows\SysWOW64\Ldgnbg32.exe
        
        C:\Windows\system32\Ldgnbg32.exe
        36⤵
        
        PID:5472
        
        C:\Windows\SysWOW64\Lhcjbfag.exe
        
        C:\Windows\system32\Lhcjbfag.exe
        37⤵
        
        PID:6416
        
        C:\Windows\SysWOW64\Mjafoapj.exe
        
        C:\Windows\system32\Mjafoapj.exe
        38⤵
        
        PID:6252
        
        C:\Windows\SysWOW64\Malnklgg.exe
        
        C:\Windows\system32\Malnklgg.exe
        39⤵
        
        PID:1032
        
        C:\Windows\SysWOW64\Mdjjgggk.exe
        
        C:\Windows\system32\Mdjjgggk.exe
        40⤵
        
        PID:8212
        
        C:\Windows\SysWOW64\Mfhgcbfo.exe
        
        C:\Windows\system32\Mfhgcbfo.exe
        41⤵
        
        PID:6148
        
        C:\Windows\SysWOW64\Mmbopm32.exe
        
        C:\Windows\system32\Mmbopm32.exe
        42⤵
        
        PID:5228
        
        C:\Windows\SysWOW64\Mhhcne32.exe
        
        C:\Windows\system32\Mhhcne32.exe
        43⤵
        
        PID:8236
        
        C:\Windows\SysWOW64\Mjfoja32.exe
        
        C:\Windows\system32\Mjfoja32.exe
        44⤵
        
        PID:5280
        
        C:\Windows\SysWOW64\Mmdlflki.exe
        
        C:\Windows\system32\Mmdlflki.exe
        45⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3432
        
        C:\Windows\SysWOW64\Mdodbf32.exe
        
        C:\Windows\system32\Mdodbf32.exe
        46⤵
        
        PID:6612
        
        C:\Windows\SysWOW64\Mjiloqjb.exe
        
        C:\Windows\system32\Mjiloqjb.exe
        47⤵
        
        PID:8400
        
        C:\Windows\SysWOW64\Mmghklif.exe
        
        C:\Windows\system32\Mmghklif.exe
        48⤵
        
        PID:5916
        
        C:\Windows\SysWOW64\Mdaqhf32.exe
        
        C:\Windows\system32\Mdaqhf32.exe
        49⤵
        
        PID:1676
        
        C:\Windows\SysWOW64\Minipm32.exe
        
        C:\Windows\system32\Minipm32.exe
        50⤵
        
        PID:6624
        
        C:\Windows\SysWOW64\Nfaijand.exe
        
        C:\Windows\system32\Nfaijand.exe
        51⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\Nhafcd32.exe
        
        C:\Windows\system32\Nhafcd32.exe
        52⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Nkpbpp32.exe
        
        C:\Windows\system32\Nkpbpp32.exe
        53⤵
        
        PID:1244
        
        C:\Windows\SysWOW64\Nmnnlk32.exe
        
        C:\Windows\system32\Nmnnlk32.exe
        54⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\Nplkhf32.exe
        
        C:\Windows\system32\Nplkhf32.exe
        55⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8000
        
        C:\Windows\SysWOW64\Nhcbidcd.exe
        
        C:\Windows\system32\Nhcbidcd.exe
        56⤵
        
        PID:7500
        
        C:\Windows\SysWOW64\Nieoal32.exe
        
        C:\Windows\system32\Nieoal32.exe
        57⤵
        
        PID:836
        
        C:\Windows\SysWOW64\Npognfpo.exe
        
        C:\Windows\system32\Npognfpo.exe
        58⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Ngipjp32.exe
        
        C:\Windows\system32\Ngipjp32.exe
        59⤵
        
        PID:5396
        
        C:\Windows\SysWOW64\Niglfl32.exe
        
        C:\Windows\system32\Niglfl32.exe
        60⤵
        
        PID:8028
        
        C:\Windows\SysWOW64\Nandhi32.exe
        
        C:\Windows\system32\Nandhi32.exe
        61⤵
        
        PID:7244
        
        C:\Windows\SysWOW64\Ndmpddfe.exe
        
        C:\Windows\system32\Ndmpddfe.exe
        62⤵
        
        PID:8124
        
        C:\Windows\SysWOW64\Nkghqo32.exe
        
        C:\Windows\system32\Nkghqo32.exe
        63⤵
        
        PID:7552
        
        C:\Windows\SysWOW64\Nmedmj32.exe
        
        C:\Windows\system32\Nmedmj32.exe
        64⤵
        
        PID:4692
        
        C:\Windows\SysWOW64\Okiefn32.exe
        
        C:\Windows\system32\Okiefn32.exe
        65⤵
        Drops file in System32 directory
        
        PID:6336
        
        C:\Windows\SysWOW64\Omgabj32.exe
        
        C:\Windows\system32\Omgabj32.exe
        66⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7712
        
        C:\Windows\SysWOW64\Odaiodbp.exe
        
        C:\Windows\system32\Odaiodbp.exe
        67⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\Ogpfko32.exe
        
        C:\Windows\system32\Ogpfko32.exe
        68⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Oaejhh32.exe
        
        C:\Windows\system32\Oaejhh32.exe
        69⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5124
        
        C:\Windows\SysWOW64\Ohobebig.exe
        
        C:\Windows\system32\Ohobebig.exe
        70⤵
        Drops file in System32 directory
        
        PID:1536
        
        C:\Windows\SysWOW64\Omlkmign.exe
        
        C:\Windows\system32\Omlkmign.exe
        71⤵
        
        PID:3600
        
        C:\Windows\SysWOW64\Opjgidfa.exe
        
        C:\Windows\system32\Opjgidfa.exe
        72⤵
        Modifies registry class
        
        PID:8116
        
        C:\Windows\SysWOW64\Ohaokbfd.exe
        
        C:\Windows\system32\Ohaokbfd.exe
        73⤵
        
        PID:7264
        
        C:\Windows\SysWOW64\Okpkgm32.exe
        
        C:\Windows\system32\Okpkgm32.exe
        74⤵
        
        PID:1004
        
        C:\Windows\SysWOW64\Onngci32.exe
        
        C:\Windows\system32\Onngci32.exe
        75⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\Opmcod32.exe
        
        C:\Windows\system32\Opmcod32.exe
        76⤵
        
        PID:3568
        
        C:\Windows\SysWOW64\Odhppclh.exe
        
        C:\Windows\system32\Odhppclh.exe
        77⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Oggllnkl.exe
        
        C:\Windows\system32\Oggllnkl.exe
        78⤵
        
        PID:6368
        
        C:\Windows\SysWOW64\Oiehhjjp.exe
        
        C:\Windows\system32\Oiehhjjp.exe
        79⤵
        
        PID:6560
        
        C:\Windows\SysWOW64\Pjjaci32.exe
        
        C:\Windows\system32\Pjjaci32.exe
        80⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\Ppdjpcng.exe
        
        C:\Windows\system32\Ppdjpcng.exe
        81⤵
        
        PID:5144
        
        C:\Windows\SysWOW64\Phkaqqoi.exe
        
        C:\Windows\system32\Phkaqqoi.exe
        82⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\Pkinmlnm.exe
        
        C:\Windows\system32\Pkinmlnm.exe
        83⤵
        
        PID:5312
        
        C:\Windows\SysWOW64\Pnhjig32.exe
        
        C:\Windows\system32\Pnhjig32.exe
        84⤵
        
        PID:9016
        
        C:\Windows\SysWOW64\Ppffec32.exe
        
        C:\Windows\system32\Ppffec32.exe
        85⤵
        
        PID:5488
        
        C:\Windows\SysWOW64\Pjoknhbe.exe
        
        C:\Windows\system32\Pjoknhbe.exe
        86⤵
        
        PID:4608
        
        C:\Windows\SysWOW64\Pphckb32.exe
        
        C:\Windows\system32\Pphckb32.exe
        87⤵
        
        PID:9176
        
        C:\Windows\SysWOW64\Phpklp32.exe
        
        C:\Windows\system32\Phpklp32.exe
        88⤵
        
        PID:7024
        
        C:\Windows\SysWOW64\Pjahchpb.exe
        
        C:\Windows\system32\Pjahchpb.exe
        89⤵
        Modifies registry class
        
        PID:5236
        
        C:\Windows\SysWOW64\Pahpee32.exe
        
        C:\Windows\system32\Pahpee32.exe
        90⤵
        
        PID:5388
        
        C:\Windows\SysWOW64\Qhbhapha.exe
        
        C:\Windows\system32\Qhbhapha.exe
        91⤵
        Modifies registry class
        
        PID:5408
        
        C:\Windows\SysWOW64\Qjcdih32.exe
        
        C:\Windows\system32\Qjcdih32.exe
        92⤵
        
        PID:5600
        
        C:\Windows\SysWOW64\Qdihfq32.exe
        
        C:\Windows\system32\Qdihfq32.exe
        93⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Qkcackeb.exe
        
        C:\Windows\system32\Qkcackeb.exe
        94⤵
        
        PID:6532
        
        C:\Windows\SysWOW64\Aamipe32.exe
        
        C:\Windows\system32\Aamipe32.exe
        95⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:1056
        
        C:\Windows\SysWOW64\Akenij32.exe
        
        C:\Windows\system32\Akenij32.exe
        96⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:4748
        
        C:\Windows\SysWOW64\Aaofedkl.exe
        
        C:\Windows\system32\Aaofedkl.exe
        97⤵
        
        PID:7184
        
        C:\Windows\SysWOW64\Ahinbo32.exe
        
        C:\Windows\system32\Ahinbo32.exe
        98⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Ajjjjghg.exe
        
        C:\Windows\system32\Ajjjjghg.exe
        99⤵
        
        PID:7448
        
        C:\Windows\SysWOW64\Akjgdjoj.exe
        
        C:\Windows\system32\Akjgdjoj.exe
        100⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\Abdoqd32.exe
        
        C:\Windows\system32\Abdoqd32.exe
        101⤵
        
        PID:7796
        
        C:\Windows\SysWOW64\Adbkmo32.exe
        
        C:\Windows\system32\Adbkmo32.exe
        102⤵
        
        PID:7420
        
        C:\Windows\SysWOW64\Agqhik32.exe
        
        C:\Windows\system32\Agqhik32.exe
        103⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8184
        
        C:\Windows\SysWOW64\Abflfc32.exe
        
        C:\Windows\system32\Abflfc32.exe
        104⤵
        Modifies registry class
        
        PID:8140
        
        C:\Windows\SysWOW64\Ahpdcn32.exe
        
        C:\Windows\system32\Ahpdcn32.exe
        105⤵
        
        PID:6036
        
        C:\Windows\SysWOW64\Ajaqjfbp.exe
        
        C:\Windows\system32\Ajaqjfbp.exe
        106⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Bbhhlccb.exe
        
        C:\Windows\system32\Bbhhlccb.exe
        107⤵
        
        PID:7956
        
        C:\Windows\SysWOW64\Bdgehobe.exe
        
        C:\Windows\system32\Bdgehobe.exe
        108⤵
        
        PID:8308
        
        C:\Windows\SysWOW64\Bbkeacqo.exe
        
        C:\Windows\system32\Bbkeacqo.exe
        109⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8520
        
        C:\Windows\SysWOW64\Bhennm32.exe
        
        C:\Windows\system32\Bhennm32.exe
        110⤵
        
        PID:7360
        
        C:\Windows\SysWOW64\Bqdlmo32.exe
        
        C:\Windows\system32\Bqdlmo32.exe
        111⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:420
        
        C:\Windows\SysWOW64\Bgodjiio.exe
        
        C:\Windows\system32\Bgodjiio.exe
        112⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Bjmpfdhb.exe
        
        C:\Windows\system32\Bjmpfdhb.exe
        113⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\Cbdhgaid.exe
        
        C:\Windows\system32\Cbdhgaid.exe
        114⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\Cinpdl32.exe
        
        C:\Windows\system32\Cinpdl32.exe
        115⤵
        
        PID:7196
        
        C:\Windows\SysWOW64\Cgaqphgl.exe
        
        C:\Windows\system32\Cgaqphgl.exe
        116⤵
        Modifies registry class
        
        PID:2368
        
        C:\Windows\SysWOW64\Cnkilbni.exe
        
        C:\Windows\system32\Cnkilbni.exe
        117⤵
        
        PID:3848
        
        C:\Windows\SysWOW64\Cqiehnml.exe
        
        C:\Windows\system32\Cqiehnml.exe
        118⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Ciqmjkno.exe
        
        C:\Windows\system32\Ciqmjkno.exe
        119⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Ckoifgmb.exe
        
        C:\Windows\system32\Ckoifgmb.exe
        120⤵
        Drops file in System32 directory
        
        PID:8640
        
        C:\Windows\SysWOW64\Cnmebblf.exe
        
        C:\Windows\system32\Cnmebblf.exe
        121⤵
        
        PID:8696
        
        C:\Windows\SysWOW64\Calbnnkj.exe
        
        C:\Windows\system32\Calbnnkj.exe
        122⤵
        Modifies registry class
        
        PID:7116
        
        C:\Windows\SysWOW64\Cgejkh32.exe
        
        C:\Windows\system32\Cgejkh32.exe
        123⤵
        
        PID:5692
        
        C:\Windows\SysWOW64\Cjdfgc32.exe
        
        C:\Windows\system32\Cjdfgc32.exe
        124⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\Canocm32.exe
        
        C:\Windows\system32\Canocm32.exe
        125⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Ciefek32.exe
        
        C:\Windows\system32\Ciefek32.exe
        126⤵
        Modifies registry class
        
        PID:6504
        
        C:\Windows\SysWOW64\Dgmpkg32.exe
        
        C:\Windows\system32\Dgmpkg32.exe
        127⤵
        
        PID:5760
        
        C:\Windows\SysWOW64\Djmima32.exe
        
        C:\Windows\system32\Djmima32.exe
        128⤵
        
        PID:6184
        
        C:\Windows\SysWOW64\Dnkbcp32.exe
        
        C:\Windows\system32\Dnkbcp32.exe
        129⤵
        
        PID:3876
        
        C:\Windows\SysWOW64\Dajnol32.exe
        
        C:\Windows\system32\Dajnol32.exe
        130⤵
        
        PID:6016
        
        C:\Windows\SysWOW64\Diafqi32.exe
        
        C:\Windows\system32\Diafqi32.exe
        131⤵
        
        PID:768
        
        C:\Windows\SysWOW64\Dnnoip32.exe
        
        C:\Windows\system32\Dnnoip32.exe
        132⤵
        
        PID:7664
        
        C:\Windows\SysWOW64\Dalkek32.exe
        
        C:\Windows\system32\Dalkek32.exe
        133⤵
        
        PID:7400
        
        C:\Windows\SysWOW64\Dehgejep.exe
        
        C:\Windows\system32\Dehgejep.exe
        134⤵
        
        PID:7324
        
        C:\Windows\SysWOW64\Dhfcae32.exe
        
        C:\Windows\system32\Dhfcae32.exe
        135⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Ejdonq32.exe
        
        C:\Windows\system32\Ejdonq32.exe
        136⤵
        Drops file in System32 directory
        
        PID:228
        
        C:\Windows\SysWOW64\Eblgon32.exe
        
        C:\Windows\system32\Eblgon32.exe
        137⤵
        
        PID:3376
        
        C:\Windows\SysWOW64\Eghimo32.exe
        
        C:\Windows\system32\Eghimo32.exe
        138⤵
        
        PID:5128
        
        C:\Windows\SysWOW64\Jlnbhe32.exe
        
        C:\Windows\system32\Jlnbhe32.exe
        139⤵
        
        PID:3832
        
        C:\Windows\SysWOW64\Mbbcofpf.exe
        
        C:\Windows\system32\Mbbcofpf.exe
        140⤵
        
        PID:8292
        
        C:\Windows\SysWOW64\Opbcdieb.exe
        
        C:\Windows\system32\Opbcdieb.exe
        141⤵
        
        PID:7624
        
        C:\Windows\SysWOW64\Ommjnlnd.exe
        
        C:\Windows\system32\Ommjnlnd.exe
        142⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:3092
        
        C:\Windows\SysWOW64\Pehnboko.exe
        
        C:\Windows\system32\Pehnboko.exe
        143⤵
        
        PID:8556
        
        C:\Windows\SysWOW64\Pmpfcl32.exe
        
        C:\Windows\system32\Pmpfcl32.exe
        144⤵
        Modifies registry class
        
        PID:7892
        
        C:\Windows\SysWOW64\Pblolb32.exe
        
        C:\Windows\system32\Pblolb32.exe
        145⤵
        
        PID:9000
        
        C:\Windows\SysWOW64\Pemhmn32.exe
        
        C:\Windows\system32\Pemhmn32.exe
        146⤵
        
        PID:1708
        
        C:\Windows\SysWOW64\Plgpjhnf.exe
        
        C:\Windows\system32\Plgpjhnf.exe
        147⤵
        
        PID:1052
        
        C:\Windows\SysWOW64\Pbahgbfc.exe
        
        C:\Windows\system32\Pbahgbfc.exe
        148⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:2052
        
        C:\Windows\SysWOW64\Ppeipfdm.exe
        
        C:\Windows\system32\Ppeipfdm.exe
        149⤵
        
        PID:9108
        
        C:\Windows\SysWOW64\Pimmil32.exe
        
        C:\Windows\system32\Pimmil32.exe
        150⤵
        
        PID:9188
        
        C:\Windows\SysWOW64\Pllieg32.exe
        
        C:\Windows\system32\Pllieg32.exe
        151⤵
        
        PID:8544
        
        C:\Windows\SysWOW64\Qbeaba32.exe
        
        C:\Windows\system32\Qbeaba32.exe
        152⤵
        
        PID:404
        
        C:\Windows\SysWOW64\Qolbgbgb.exe
        
        C:\Windows\system32\Qolbgbgb.exe
        153⤵
        
        PID:9024
        
        C:\Windows\SysWOW64\Qfcjhphd.exe
        
        C:\Windows\system32\Qfcjhphd.exe
        154⤵
        
        PID:8732
        
        C:\Windows\SysWOW64\Qlpcpffl.exe
        
        C:\Windows\system32\Qlpcpffl.exe
        155⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\Aooolbep.exe
        
        C:\Windows\system32\Aooolbep.exe
        156⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\Aidcjk32.exe
        
        C:\Windows\system32\Aidcjk32.exe
        157⤵
        
        PID:8412
        
        C:\Windows\SysWOW64\Abmhbplf.exe
        
        C:\Windows\system32\Abmhbplf.exe
        158⤵
        
        PID:8372
        
        C:\Windows\SysWOW64\Aifpoj32.exe
        
        C:\Windows\system32\Aifpoj32.exe
        159⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\Amblpikl.exe
        
        C:\Windows\system32\Amblpikl.exe
        160⤵
        
        PID:6900
        
        C:\Windows\SysWOW64\Apqhldjp.exe
        
        C:\Windows\system32\Apqhldjp.exe
        161⤵
        
        PID:2348
        
        C:\Windows\SysWOW64\Aemqdk32.exe
        
        C:\Windows\system32\Aemqdk32.exe
        162⤵
        
        PID:8796
        
        C:\Windows\SysWOW64\Amdiei32.exe
        
        C:\Windows\system32\Amdiei32.exe
        163⤵
        Drops file in System32 directory
        
        PID:7928
        
        C:\Windows\SysWOW64\Apcead32.exe
        
        C:\Windows\system32\Apcead32.exe
        164⤵
        
        PID:8524
        
        C:\Windows\SysWOW64\Aikijjon.exe
        
        C:\Windows\system32\Aikijjon.exe
        165⤵
        Modifies registry class
        
        PID:8680
        
        C:\Windows\SysWOW64\Aljefena.exe
        
        C:\Windows\system32\Aljefena.exe
        166⤵
        
        PID:2380
        
        C:\Windows\SysWOW64\Apeagd32.exe
        
        C:\Windows\system32\Apeagd32.exe
        167⤵
        
        PID:3268
        
        C:\Windows\SysWOW64\Accnco32.exe
        
        C:\Windows\system32\Accnco32.exe
        168⤵
        
        PID:9172
        
        C:\Windows\SysWOW64\Aebjokda.exe
        
        C:\Windows\system32\Aebjokda.exe
        169⤵
        
        PID:8804
        
        C:\Windows\SysWOW64\Ainfpi32.exe
        
        C:\Windows\system32\Ainfpi32.exe
        170⤵
        Drops file in System32 directory
        
        PID:8848
        
        C:\Windows\SysWOW64\Bpgnmcdh.exe
        
        C:\Windows\system32\Bpgnmcdh.exe
        171⤵
        
        PID:5888
        
        C:\Windows\SysWOW64\Bojohp32.exe
        
        C:\Windows\system32\Bojohp32.exe
        172⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\Bgafin32.exe
        
        C:\Windows\system32\Bgafin32.exe
        173⤵
        Drops file in System32 directory
        Modifies registry class
        
        PID:5580
        
        C:\Windows\SysWOW64\Bipcei32.exe
        
        C:\Windows\system32\Bipcei32.exe
        174⤵
        
        PID:5884
        
        C:\Windows\SysWOW64\Bpjkbcbe.exe
        
        C:\Windows\system32\Bpjkbcbe.exe
        175⤵
        
        PID:5456
        
        C:\Windows\SysWOW64\Bchgnoai.exe
        
        C:\Windows\system32\Bchgnoai.exe
        176⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\Begcjjql.exe
        
        C:\Windows\system32\Begcjjql.exe
        177⤵
        Modifies registry class
        
        PID:5368
        
        C:\Windows\SysWOW64\Bnnklg32.exe
        
        C:\Windows\system32\Bnnklg32.exe
        178⤵
        
        PID:6840
        
        C:\Windows\SysWOW64\Blqlgdhi.exe
        
        C:\Windows\system32\Blqlgdhi.exe
        179⤵
        
        PID:6700
        
        C:\Windows\SysWOW64\Boohcpgm.exe
        
        C:\Windows\system32\Boohcpgm.exe
        180⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:1544
        
        C:\Windows\SysWOW64\Bgfpdmho.exe
        
        C:\Windows\system32\Bgfpdmho.exe
        181⤵
        
        PID:8384
        
        C:\Windows\SysWOW64\Bidlqhgc.exe
        
        C:\Windows\system32\Bidlqhgc.exe
        182⤵
        
        PID:5132
        
        C:\Windows\SysWOW64\Blchmdff.exe
        
        C:\Windows\system32\Blchmdff.exe
        183⤵
        
        PID:8176
        
        C:\Windows\SysWOW64\Cnealfkf.exe
        
        C:\Windows\system32\Cnealfkf.exe
        184⤵
        
        PID:6652
        
        C:\Windows\SysWOW64\Cofndo32.exe
        
        C:\Windows\system32\Cofndo32.exe
        185⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\Ccajdmin.exe
        
        C:\Windows\system32\Ccajdmin.exe
        186⤵
        
        PID:8432
        
        C:\Windows\SysWOW64\Cjlbag32.exe
        
        C:\Windows\system32\Cjlbag32.exe
        187⤵
        
        PID:8628
        
        C:\Windows\SysWOW64\Cngnbfid.exe
        
        C:\Windows\system32\Cngnbfid.exe
        188⤵
        
        PID:8800
        
        C:\Windows\SysWOW64\Cohkinob.exe
        
        C:\Windows\system32\Cohkinob.exe
        189⤵
        
        PID:2472
        
        C:\Windows\SysWOW64\Cjnoggoh.exe
        
        C:\Windows\system32\Cjnoggoh.exe
        190⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Drops file in System32 directory
        
        PID:9208
        
        C:\Windows\SysWOW64\Cllkcbnl.exe
        
        C:\Windows\system32\Cllkcbnl.exe
        191⤵
        Drops file in System32 directory
        
        PID:8728
        
        C:\Windows\SysWOW64\Ccfcpm32.exe
        
        C:\Windows\system32\Ccfcpm32.exe
        192⤵
        
        PID:9156
        
        C:\Windows\SysWOW64\Cfeplh32.exe
        
        C:\Windows\system32\Cfeplh32.exe
        193⤵
        
        PID:8840
        
        C:\Windows\SysWOW64\Cnlhme32.exe
        
        C:\Windows\system32\Cnlhme32.exe
        194⤵
        
        PID:9064
        
        C:\Windows\SysWOW64\Ccipelcf.exe
        
        C:\Windows\system32\Ccipelcf.exe
        195⤵
        
        PID:4288
        
        C:\Windows\SysWOW64\Cfglahbj.exe
        
        C:\Windows\system32\Cfglahbj.exe
        196⤵
        Drops file in System32 directory
        
        PID:6960
        
        C:\Windows\SysWOW64\Djeegf32.exe
        
        C:\Windows\system32\Djeegf32.exe
        197⤵
        Drops file in System32 directory
        
        PID:6856
        
        C:\Windows\SysWOW64\Dlcaca32.exe
        
        C:\Windows\system32\Dlcaca32.exe
        198⤵
        
        PID:4376
        
        C:\Windows\SysWOW64\Dodjemee.exe
        
        C:\Windows\system32\Dodjemee.exe
        199⤵
        
        PID:1444
        
        C:\Windows\SysWOW64\Dnekcd32.exe
        
        C:\Windows\system32\Dnekcd32.exe
        200⤵
        
        PID:9140
        
        C:\Windows\SysWOW64\Dqdgop32.exe
        
        C:\Windows\system32\Dqdgop32.exe
        201⤵
        
        PID:8716
        
        C:\Windows\SysWOW64\Dgnolj32.exe
        
        C:\Windows\system32\Dgnolj32.exe
        202⤵
        
        PID:4528
        
        C:\Windows\SysWOW64\Djlkhe32.exe
        
        C:\Windows\system32\Djlkhe32.exe
        203⤵
        
        PID:5328
        
        C:\Windows\SysWOW64\Dnhgidka.exe
        
        C:\Windows\system32\Dnhgidka.exe
        204⤵
        
        PID:6064
        
        C:\Windows\SysWOW64\Dfclmfhl.exe
        
        C:\Windows\system32\Dfclmfhl.exe
        205⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:8228
        
        C:\Windows\SysWOW64\Foifmcoa.exe
        
        C:\Windows\system32\Foifmcoa.exe
        72⤵
        
        PID:3896
        
        C:\Windows\SysWOW64\Fbgbione.exe
        
        C:\Windows\system32\Fbgbione.exe
        73⤵
        
        PID:6828
        
        C:\Windows\SysWOW64\Fjnjjlog.exe
        
        C:\Windows\system32\Fjnjjlog.exe
        74⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\Fiajfi32.exe
        
        C:\Windows\system32\Fiajfi32.exe
        75⤵
        
        PID:7568
        
        C:\Windows\SysWOW64\Fqhbgf32.exe
        
        C:\Windows\system32\Fqhbgf32.exe
        76⤵
        
        PID:8664
        
        C:\Windows\SysWOW64\Fbiooolb.exe
        
        C:\Windows\system32\Fbiooolb.exe
        77⤵
        
        PID:640
        
        C:\Windows\SysWOW64\Ffekom32.exe
        
        C:\Windows\system32\Ffekom32.exe
        78⤵
        
        PID:7108
        
        C:\Windows\SysWOW64\Ficgkico.exe
        
        C:\Windows\system32\Ficgkico.exe
        79⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\Fqjolfda.exe
        
        C:\Windows\system32\Fqjolfda.exe
        80⤵
        
        PID:236
        
        C:\Windows\SysWOW64\Fcikhace.exe
        
        C:\Windows\system32\Fcikhace.exe
        81⤵
        
        PID:5192
        
        C:\Windows\SysWOW64\Fblldn32.exe
        
        C:\Windows\system32\Fblldn32.exe
        82⤵
        
        PID:7268
        
        C:\Windows\SysWOW64\Fifdqhal.exe
        
        C:\Windows\system32\Fifdqhal.exe
        83⤵
        
        PID:1592
        
        C:\Windows\SysWOW64\Fqmlbfbo.exe
        
        C:\Windows\system32\Fqmlbfbo.exe
        84⤵
        
        PID:7748
        
        C:\Windows\SysWOW64\Foplnb32.exe
        
        C:\Windows\system32\Foplnb32.exe
        85⤵
        Modifies registry class
        
        PID:8072
        
        C:\Windows\SysWOW64\Ffjdjmpf.exe
        
        C:\Windows\system32\Ffjdjmpf.exe
        86⤵
        
        PID:8076
        
        C:\Windows\SysWOW64\Fihqfh32.exe
        
        C:\Windows\system32\Fihqfh32.exe
        87⤵
        
        PID:4928
        
        C:\Windows\SysWOW64\Gqohge32.exe
        
        C:\Windows\system32\Gqohge32.exe
        88⤵
        
        PID:6728
        
        C:\Windows\SysWOW64\Gobicbgf.exe
        
        C:\Windows\system32\Gobicbgf.exe
        89⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\Gbqeonfj.exe
        
        C:\Windows\system32\Gbqeonfj.exe
        90⤵
        
        PID:6428
        
        C:\Windows\SysWOW64\Gjgmpkfl.exe
        
        C:\Windows\system32\Gjgmpkfl.exe
        91⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7980
        
        C:\Windows\SysWOW64\Gijmlh32.exe
        
        C:\Windows\system32\Gijmlh32.exe
        92⤵
        
        PID:5900
        
        C:\Windows\SysWOW64\Gqaeme32.exe
        
        C:\Windows\system32\Gqaeme32.exe
        93⤵
        
        PID:7256
        
        C:\Windows\SysWOW64\Godehbed.exe
        
        C:\Windows\system32\Godehbed.exe
        94⤵
        
        PID:6748
        
        C:\Windows\SysWOW64\Gbcaemdg.exe
        
        C:\Windows\system32\Gbcaemdg.exe
        95⤵
        
        PID:8376
        
        C:\Windows\SysWOW64\Gjjjfkdj.exe
        
        C:\Windows\system32\Gjjjfkdj.exe
        96⤵
        
        PID:8532
        
        C:\Windows\SysWOW64\Gmhfbf32.exe
        
        C:\Windows\system32\Gmhfbf32.exe
        97⤵
        
        PID:9052
        
        C:\Windows\SysWOW64\Gpgbna32.exe
        
        C:\Windows\system32\Gpgbna32.exe
        98⤵
        
        PID:8468
        
        C:\Windows\SysWOW64\Gbenjm32.exe
        
        C:\Windows\system32\Gbenjm32.exe
        99⤵
        
        PID:232
        
        C:\Windows\SysWOW64\Gjlfkj32.exe
        
        C:\Windows\system32\Gjlfkj32.exe
        100⤵
        
        PID:4784
        
        C:\Windows\SysWOW64\Giofggia.exe
        
        C:\Windows\system32\Giofggia.exe
        101⤵
        Modifies registry class
        
        PID:5092
        
        C:\Windows\SysWOW64\Gpioca32.exe
        
        C:\Windows\system32\Gpioca32.exe
        102⤵
        
        PID:5612
        
        C:\Windows\SysWOW64\Gbgkpm32.exe
        
        C:\Windows\system32\Gbgkpm32.exe
        103⤵
        
        PID:8640
        
        C:\Windows\SysWOW64\Gcggjp32.exe
        
        C:\Windows\system32\Gcggjp32.exe
        104⤵
        
        PID:3476
        
        C:\Windows\SysWOW64\Gfedfk32.exe
        
        C:\Windows\system32\Gfedfk32.exe
        105⤵
        
        PID:5792
        
        C:\Windows\SysWOW64\Hidpbf32.exe
        
        C:\Windows\system32\Hidpbf32.exe
        106⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5692
        
        C:\Windows\SysWOW64\Hakhcd32.exe
        
        C:\Windows\system32\Hakhcd32.exe
        107⤵
        Drops file in System32 directory
        
        PID:5432
        
        C:\Windows\SysWOW64\Hpnhoqmi.exe
        
        C:\Windows\system32\Hpnhoqmi.exe
        108⤵
        
        PID:5816
        
        C:\Windows\SysWOW64\Hbldkllm.exe
        
        C:\Windows\system32\Hbldkllm.exe
        109⤵
        Drops file in System32 directory
        
        PID:7824
        
        C:\Windows\SysWOW64\Hjcllilo.exe
        
        C:\Windows\system32\Hjcllilo.exe
        110⤵
        Drops file in System32 directory
        
        PID:2640
        
        C:\Windows\SysWOW64\Hmaihekc.exe
        
        C:\Windows\system32\Hmaihekc.exe
        111⤵
        
        PID:5324
        
        C:\Windows\SysWOW64\Hclaeocp.exe
        
        C:\Windows\system32\Hclaeocp.exe
        112⤵
        Modifies registry class
        
        PID:836
        
        C:\Windows\SysWOW64\Hfjmajbc.exe
        
        C:\Windows\system32\Hfjmajbc.exe
        113⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\Hpbajp32.exe
        
        C:\Windows\system32\Hpbajp32.exe
        114⤵
        
        PID:2788
        
        C:\Windows\SysWOW64\Hbanfk32.exe
        
        C:\Windows\system32\Hbanfk32.exe
        115⤵
        
        PID:8044
        
        C:\Windows\SysWOW64\Hjhfgi32.exe
        
        C:\Windows\system32\Hjhfgi32.exe
        116⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7944
        
        C:\Windows\SysWOW64\Habndbpf.exe
        
        C:\Windows\system32\Habndbpf.exe
        117⤵
        
        PID:7556
        
        C:\Windows\SysWOW64\Hcpjpn32.exe
        
        C:\Windows\system32\Hcpjpn32.exe
        118⤵
        
        PID:7940
        
        C:\Windows\SysWOW64\Hfoflj32.exe
        
        C:\Windows\system32\Hfoflj32.exe
        119⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\Hmioicek.exe
        
        C:\Windows\system32\Hmioicek.exe
        120⤵
        
        PID:3548
        
        C:\Windows\SysWOW64\Hpgkeodo.exe
        
        C:\Windows\system32\Hpgkeodo.exe
        121⤵
        
        PID:2404
        
        C:\Windows\SysWOW64\Hbegakcb.exe
        
        C:\Windows\system32\Hbegakcb.exe
        122⤵
        
        PID:7900
        
        C:\Windows\SysWOW64\Ijmobhdd.exe
        
        C:\Windows\system32\Ijmobhdd.exe
        123⤵
        
        PID:7432
        
        C:\Windows\SysWOW64\Iafgob32.exe
        
        C:\Windows\system32\Iafgob32.exe
        124⤵
        
        PID:8704
        
        C:\Windows\SysWOW64\Icedkn32.exe
        
        C:\Windows\system32\Icedkn32.exe
        125⤵
        
        PID:8492
        
        C:\Windows\SysWOW64\Ijolhg32.exe
        
        C:\Windows\system32\Ijolhg32.exe
        126⤵
        
        PID:6764
        
        C:\Windows\SysWOW64\Immhdc32.exe
        
        C:\Windows\system32\Immhdc32.exe
        127⤵
        
        PID:6924
        
        C:\Windows\SysWOW64\Icgqqmib.exe
        
        C:\Windows\system32\Icgqqmib.exe
        128⤵
        
        PID:2832
        
        C:\Windows\SysWOW64\Iffmmihf.exe
        
        C:\Windows\system32\Iffmmihf.exe
        129⤵
        
        PID:8004
        
        C:\Windows\SysWOW64\Impeib32.exe
        
        C:\Windows\system32\Impeib32.exe
        130⤵
        
        PID:9164
        
        C:\Windows\SysWOW64\Iakajagl.exe
        
        C:\Windows\system32\Iakajagl.exe
        131⤵
        
        PID:5584
        
        C:\Windows\SysWOW64\Idjmfmgp.exe
        
        C:\Windows\system32\Idjmfmgp.exe
        132⤵
        
        PID:5768
        
        C:\Windows\SysWOW64\Ifhibhfc.exe
        
        C:\Windows\system32\Ifhibhfc.exe
        133⤵
        Modifies registry class
        
        PID:5744
        
        C:\Windows\SysWOW64\Iiffoc32.exe
        
        C:\Windows\system32\Iiffoc32.exe
        134⤵
        
        PID:7008
        
        C:\Windows\SysWOW64\Iannpa32.exe
        
        C:\Windows\system32\Iannpa32.exe
        135⤵
        
        PID:5620
        
        C:\Windows\SysWOW64\Ipqnknld.exe
        
        C:\Windows\system32\Ipqnknld.exe
        136⤵
        
        PID:8720
        
        C:\Windows\SysWOW64\Ibojgikg.exe
        
        C:\Windows\system32\Ibojgikg.exe
        137⤵
        
        PID:7428
        
        C:\Windows\SysWOW64\Ijfbhflj.exe
        
        C:\Windows\system32\Ijfbhflj.exe
        138⤵
        Drops file in System32 directory
        
        PID:8032
        
        C:\Windows\SysWOW64\Iapjeq32.exe
        
        C:\Windows\system32\Iapjeq32.exe
        139⤵
        
        PID:7476
        
        C:\Windows\SysWOW64\Ibagmiie.exe
        
        C:\Windows\system32\Ibagmiie.exe
        140⤵
        
        PID:2220
        
        C:\Windows\SysWOW64\Jikojcaa.exe
        
        C:\Windows\system32\Jikojcaa.exe
        141⤵
        
        PID:7028
        
        C:\Windows\SysWOW64\Jabgkpad.exe
        
        C:\Windows\system32\Jabgkpad.exe
        142⤵
        
        PID:7636
        
        C:\Windows\SysWOW64\Jbccbi32.exe
        
        C:\Windows\system32\Jbccbi32.exe
        143⤵
        
        PID:3448
        
        C:\Windows\SysWOW64\Jinloboo.exe
        
        C:\Windows\system32\Jinloboo.exe
        144⤵
        
        PID:4404
        
        C:\Windows\SysWOW64\Jaddpppa.exe
        
        C:\Windows\system32\Jaddpppa.exe
        145⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6720
        
        C:\Windows\SysWOW64\Jjmhie32.exe
        
        C:\Windows\system32\Jjmhie32.exe
        146⤵
        
        PID:5392
        
        C:\Windows\SysWOW64\Jmkdeaee.exe
        
        C:\Windows\system32\Jmkdeaee.exe
        147⤵
        
        PID:6568
        
        C:\Windows\SysWOW64\Jpjqaldi.exe
        
        C:\Windows\system32\Jpjqaldi.exe
        148⤵
        Drops file in System32 directory
        
        PID:6404
        
        C:\Windows\SysWOW64\Jbhmnhcm.exe
        
        C:\Windows\system32\Jbhmnhcm.exe
        149⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\Jjoeoedo.exe
        
        C:\Windows\system32\Jjoeoedo.exe
        150⤵
        
        PID:5444
        
        C:\Windows\SysWOW64\Jaimko32.exe
        
        C:\Windows\system32\Jaimko32.exe
        151⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:3876
        
        C:\Windows\SysWOW64\Jdhigk32.exe
        
        C:\Windows\system32\Jdhigk32.exe
        152⤵
        
        PID:5004
        
        C:\Windows\SysWOW64\Jkaadebl.exe
        
        C:\Windows\system32\Jkaadebl.exe
        153⤵
        
        PID:7828
        
        C:\Windows\SysWOW64\Jaljaoii.exe
        
        C:\Windows\system32\Jaljaoii.exe
        154⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\Jdjfmjhm.exe
        
        C:\Windows\system32\Jdjfmjhm.exe
        155⤵
        Modifies registry class
        
        PID:5332
        
        C:\Windows\SysWOW64\Kfhbifgq.exe
        
        C:\Windows\system32\Kfhbifgq.exe
        156⤵
        
        PID:7036
        
        C:\Windows\SysWOW64\Kigoeagd.exe
        
        C:\Windows\system32\Kigoeagd.exe
        157⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\Kdophj32.exe
        
        C:\Windows\system32\Kdophj32.exe
        158⤵
        
        PID:8616
        
        C:\Windows\SysWOW64\Kabpan32.exe
        
        C:\Windows\system32\Kabpan32.exe
        159⤵
        
        PID:4244
        
        C:\Windows\SysWOW64\Kdalni32.exe
        
        C:\Windows\system32\Kdalni32.exe
        160⤵
        
        PID:1620
        
        C:\Windows\SysWOW64\Kcdmifip.exe
        
        C:\Windows\system32\Kcdmifip.exe
        161⤵
        
        PID:3456
        
        C:\Windows\SysWOW64\Kinefp32.exe
        
        C:\Windows\system32\Kinefp32.exe
        162⤵
        
        PID:5236
        
        C:\Windows\SysWOW64\Kdcicipb.exe
        
        C:\Windows\system32\Kdcicipb.exe
        163⤵
        
        PID:2296
        
        C:\Windows\SysWOW64\Kipalpoj.exe
        
        C:\Windows\system32\Kipalpoj.exe
        164⤵
        
        PID:2720
        
        C:\Windows\SysWOW64\Kagimmol.exe
        
        C:\Windows\system32\Kagimmol.exe
        165⤵
        Drops file in System32 directory
        
        PID:6880
        
        C:\Windows\SysWOW64\Libnapmg.exe
        
        C:\Windows\system32\Libnapmg.exe
        166⤵
        
        PID:4152
        
        C:\Windows\SysWOW64\Lpmfnj32.exe
        
        C:\Windows\system32\Lpmfnj32.exe
        167⤵
        
        PID:5500
        
        C:\Windows\SysWOW64\Lckbje32.exe
        
        C:\Windows\system32\Lckbje32.exe
        168⤵
        
        PID:7136
        
        C:\Windows\SysWOW64\Liekgo32.exe
        
        C:\Windows\system32\Liekgo32.exe
        169⤵
        
        PID:4104
        
        C:\Windows\SysWOW64\Lpocciba.exe
        
        C:\Windows\system32\Lpocciba.exe
        170⤵
        
        PID:9180
        
        C:\Windows\SysWOW64\Lkdgqbag.exe
        
        C:\Windows\system32\Lkdgqbag.exe
        171⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\Lpapiipo.exe
        
        C:\Windows\system32\Lpapiipo.exe
        172⤵
        
        PID:4840
        
        C:\Windows\SysWOW64\Lcpledob.exe
        
        C:\Windows\system32\Lcpledob.exe
        173⤵
        
        PID:1624
        
        C:\Windows\SysWOW64\Ldohogfe.exe
        
        C:\Windows\system32\Ldohogfe.exe
        174⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\Lgnekcei.exe
        
        C:\Windows\system32\Lgnekcei.exe
        175⤵
        
        PID:9076
        
        C:\Windows\SysWOW64\Ljlagndl.exe
        
        C:\Windows\system32\Ljlagndl.exe
        176⤵
        
        PID:7620
        
        C:\Windows\SysWOW64\Lpfidh32.exe
        
        C:\Windows\system32\Lpfidh32.exe
        177⤵
        Drops file in System32 directory
        
        PID:2924
        
        C:\Windows\SysWOW64\Mgpaqbcf.exe
        
        C:\Windows\system32\Mgpaqbcf.exe
        178⤵
        Modifies registry class
        
        PID:7236
        
        C:\Windows\SysWOW64\Mnjjmmkc.exe
        
        C:\Windows\system32\Mnjjmmkc.exe
        179⤵
        
        PID:64
        
        C:\Windows\SysWOW64\Mphfjhjf.exe
        
        C:\Windows\system32\Mphfjhjf.exe
        180⤵
        
        PID:5140
        
        C:\Windows\SysWOW64\Mcgbfcij.exe
        
        C:\Windows\system32\Mcgbfcij.exe
        181⤵
        
        PID:5912
        
        C:\Windows\SysWOW64\Mknjgajl.exe
        
        C:\Windows\system32\Mknjgajl.exe
        182⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:6068
        
        C:\Windows\SysWOW64\Mnlfclip.exe
        
        C:\Windows\system32\Mnlfclip.exe
        183⤵
        
        PID:7628
        
        C:\Windows\SysWOW64\Mpkbohhd.exe
        
        C:\Windows\system32\Mpkbohhd.exe
        184⤵
        
        PID:6588
        
        C:\Windows\SysWOW64\Mciokcgg.exe
        
        C:\Windows\system32\Mciokcgg.exe
        185⤵
        
        PID:7548
        
        C:\Windows\SysWOW64\Mjcghm32.exe
        
        C:\Windows\system32\Mjcghm32.exe
        186⤵
        
        PID:864
        
        C:\Windows\SysWOW64\Mpmodg32.exe
        
        C:\Windows\system32\Mpmodg32.exe
        187⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2964
        
        C:\Windows\SysWOW64\Mgggaamn.exe
        
        C:\Windows\system32\Mgggaamn.exe
        188⤵
        
        PID:8164
        
        C:\Windows\SysWOW64\Mnapnl32.exe
        
        C:\Windows\system32\Mnapnl32.exe
        189⤵
        
        PID:8576
        
        C:\Windows\SysWOW64\Mdkhkflh.exe
        
        C:\Windows\system32\Mdkhkflh.exe
        190⤵
        
        PID:7776
        
        C:\Windows\SysWOW64\Mkepgp32.exe
        
        C:\Windows\system32\Mkepgp32.exe
        191⤵
        
        PID:6244
        
        C:\Windows\SysWOW64\Mncmck32.exe
        
        C:\Windows\system32\Mncmck32.exe
        192⤵
        
        PID:6452
        
        C:\Windows\SysWOW64\Nqaipgal.exe
        
        C:\Windows\system32\Nqaipgal.exe
        193⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:5496
        
        C:\Windows\SysWOW64\Nglala32.exe
        
        C:\Windows\system32\Nglala32.exe
        194⤵
        
        PID:6504
        
        C:\Windows\SysWOW64\Njjmil32.exe
        
        C:\Windows\system32\Njjmil32.exe
        195⤵
        
        PID:7216
        
        C:\Windows\SysWOW64\Naaejj32.exe
        
        C:\Windows\system32\Naaejj32.exe
        196⤵
        
        PID:4012
        
        C:\Windows\SysWOW64\Ndpafe32.exe
        
        C:\Windows\system32\Ndpafe32.exe
        197⤵
        
        PID:5616
        
        C:\Windows\SysWOW64\Nkijbooo.exe
        
        C:\Windows\system32\Nkijbooo.exe
        198⤵
        
        PID:9104
        
        C:\Windows\SysWOW64\Nnhfokoc.exe
        
        C:\Windows\system32\Nnhfokoc.exe
        199⤵
        
        PID:8656
        
        C:\Windows\SysWOW64\Nqfbkf32.exe
        
        C:\Windows\system32\Nqfbkf32.exe
        200⤵
        
        PID:2956
        
        C:\Windows\SysWOW64\Ncenga32.exe
        
        C:\Windows\system32\Ncenga32.exe
        201⤵
        
        PID:5364
        
        C:\Windows\SysWOW64\Njogdldg.exe
        
        C:\Windows\system32\Njogdldg.exe
        202⤵
        
        PID:5976
        
        C:\Windows\SysWOW64\Nbfoeiei.exe
        
        C:\Windows\system32\Nbfoeiei.exe
        203⤵
        
        PID:5828
        
        C:\Windows\SysWOW64\Ncgkma32.exe
        
        C:\Windows\system32\Ncgkma32.exe
        204⤵
        
        PID:4340
        
        C:\Windows\SysWOW64\Nkncno32.exe
        
        C:\Windows\system32\Nkncno32.exe
        205⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\Nnmojj32.exe
        
        C:\Windows\system32\Nnmojj32.exe
        206⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7412
        
        C:\Windows\SysWOW64\Nbhkjicf.exe
        
        C:\Windows\system32\Nbhkjicf.exe
        207⤵
        
        PID:7488
        
        C:\Windows\SysWOW64\Ndfgfd32.exe
        
        C:\Windows\system32\Ndfgfd32.exe
        208⤵
        
        PID:7228
        
        C:\Windows\SysWOW64\Ngedbp32.exe
        
        C:\Windows\system32\Ngedbp32.exe
        209⤵
        
        PID:7368
        
        C:\Windows\SysWOW64\Njcpok32.exe
        
        C:\Windows\system32\Njcpok32.exe
        210⤵
        
        PID:8328
        
        C:\Windows\SysWOW64\Nbjhph32.exe
        
        C:\Windows\system32\Nbjhph32.exe
        211⤵
        
        PID:6488
        
        C:\Windows\SysWOW64\Ocldhqgb.exe
        
        C:\Windows\system32\Ocldhqgb.exe
        212⤵
        
        PID:6868
        
        C:\Windows\SysWOW64\Okcmingd.exe
        
        C:\Windows\system32\Okcmingd.exe
        213⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\Obmeeh32.exe
        
        C:\Windows\system32\Obmeeh32.exe
        214⤵
        
        PID:6660
        
        C:\Windows\SysWOW64\Ocnampdp.exe
        
        C:\Windows\system32\Ocnampdp.exe
        215⤵
        
        PID:8040
        
        C:\Windows\SysWOW64\Okeinn32.exe
        
        C:\Windows\system32\Okeinn32.exe
        216⤵
        
        PID:6752
        
        C:\Windows\SysWOW64\Onceji32.exe
        
        C:\Windows\system32\Onceji32.exe
        217⤵
        
        PID:4708
        
        C:\Windows\SysWOW64\Oboakhmo.exe
        
        C:\Windows\system32\Oboakhmo.exe
        218⤵
        Drops file in System32 directory
        
        PID:5748
        
        C:\Windows\SysWOW64\Odnngclb.exe
        
        C:\Windows\system32\Odnngclb.exe
        219⤵
        
        PID:6912
        
        C:\Windows\SysWOW64\Ocqncp32.exe
        
        C:\Windows\system32\Ocqncp32.exe
        220⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2652
        
        C:\Windows\SysWOW64\Okgfdm32.exe
        
        C:\Windows\system32\Okgfdm32.exe
        221⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7456
        
        C:\Windows\SysWOW64\Ojjfpjjj.exe
        
        C:\Windows\system32\Ojjfpjjj.exe
        222⤵
        
        PID:6432
        
        C:\Windows\SysWOW64\Oqdnld32.exe
        
        C:\Windows\system32\Oqdnld32.exe
        223⤵
        
        PID:3904
        
        C:\Windows\SysWOW64\Ognginic.exe
        
        C:\Windows\system32\Ognginic.exe
        224⤵
        
        PID:9220
        
        C:\Windows\SysWOW64\Ojmcej32.exe
        
        C:\Windows\system32\Ojmcej32.exe
        225⤵
        
        PID:9280
        
        C:\Windows\SysWOW64\Obdkfg32.exe
        
        C:\Windows\system32\Obdkfg32.exe
        226⤵
        Drops file in System32 directory
        
        PID:9324
        
        C:\Windows\SysWOW64\Oqgkadod.exe
        
        C:\Windows\system32\Oqgkadod.exe
        227⤵
        
        PID:9368
        
        C:\Windows\SysWOW64\Ocegnoog.exe
        
        C:\Windows\system32\Ocegnoog.exe
        228⤵
        
        PID:9408
        
        C:\Windows\SysWOW64\Ogqcon32.exe
        
        C:\Windows\system32\Ogqcon32.exe
        229⤵
        
        PID:9448
        
        C:\Windows\SysWOW64\Ojopki32.exe
        
        C:\Windows\system32\Ojopki32.exe
        230⤵
        
        PID:9492
        
        C:\Windows\SysWOW64\Pbfglg32.exe
        
        C:\Windows\system32\Pbfglg32.exe
        231⤵
        
        PID:9528
        
        C:\Windows\SysWOW64\Pqihgcma.exe
        
        C:\Windows\system32\Pqihgcma.exe
        232⤵
        
        PID:9572
        
        C:\Windows\SysWOW64\Pcgdcome.exe
        
        C:\Windows\system32\Pcgdcome.exe
        233⤵
        
        PID:9612
        
        C:\Windows\SysWOW64\Pgcpdn32.exe
        
        C:\Windows\system32\Pgcpdn32.exe
        234⤵
        
        PID:9656
        
        C:\Windows\SysWOW64\Pjalpida.exe
        
        C:\Windows\system32\Pjalpida.exe
        235⤵
        Drops file in System32 directory
        
        PID:9704
        
        C:\Windows\SysWOW64\Pnmhqh32.exe
        
        C:\Windows\system32\Pnmhqh32.exe
        236⤵
        
        PID:9740
        
        C:\Windows\SysWOW64\Pqkdmc32.exe
        
        C:\Windows\system32\Pqkdmc32.exe
        237⤵
        
        PID:9780
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9780 -s 408
        238⤵
        Program crash
        
        PID:9860

C:\Windows\SysWOW64\Mbfmha32.exe
C:\Windows\system32\Mbfmha32.exe
1⤵
PID:5704
- C:\Windows\SysWOW64\Mgceqh32.exe
  C:\Windows\system32\Mgceqh32.exe
  2⤵
  PID:5540
- - C:\Windows\SysWOW64\Mggolhaj.exe
    C:\Windows\system32\Mggolhaj.exe
    3⤵
    PID:6580
  - - C:\Windows\SysWOW64\Moacbe32.exe
      C:\Windows\system32\Moacbe32.exe
      4⤵
      PID:7804
    - - C:\Windows\SysWOW64\Nkhdgfen.exe
        
        C:\Windows\system32\Nkhdgfen.exe
        5⤵
        
        PID:6844

C:\Windows\SysWOW64\Lqfpoope.exe
C:\Windows\system32\Lqfpoope.exe
1⤵
PID:5536

C:\Windows\SysWOW64\Nnimia32.exe
C:\Windows\system32\Nnimia32.exe
1⤵
PID:4816
- C:\Windows\SysWOW64\Nqifkl32.exe
  C:\Windows\system32\Nqifkl32.exe
  2⤵
  PID:7916
- - C:\Windows\SysWOW64\Nkojheoe.exe
    C:\Windows\system32\Nkojheoe.exe
    3⤵
    PID:8060
  - - C:\Windows\SysWOW64\Nqnofkkj.exe
      C:\Windows\system32\Nqnofkkj.exe
      4⤵
      PID:7372
    - - C:\Windows\SysWOW64\Oooodcci.exe
        
        C:\Windows\system32\Oooodcci.exe
        5⤵
        
        PID:5412

C:\Windows\SysWOW64\Aiapjecl.exe
C:\Windows\system32\Aiapjecl.exe
1⤵
- Drops file in System32 directory
PID:3472
- C:\Windows\SysWOW64\Albikp32.exe
  C:\Windows\system32\Albikp32.exe
  2⤵
  PID:6984
- - C:\Windows\SysWOW64\Aihfjd32.exe
    C:\Windows\system32\Aihfjd32.exe
    3⤵
    PID:5164
  - - C:\Windows\SysWOW64\Algbfo32.exe
      C:\Windows\system32\Algbfo32.exe
      4⤵
      PID:4684
    - - C:\Windows\SysWOW64\Bhppap32.exe
        
        C:\Windows\system32\Bhppap32.exe
        5⤵
        
        PID:3168
      - C:\Windows\SysWOW64\Bahdje32.exe
        
        C:\Windows\system32\Bahdje32.exe
        6⤵
        
        PID:6360
        
        C:\Windows\SysWOW64\Blbabnbk.exe
        
        C:\Windows\system32\Blbabnbk.exe
        7⤵
        
        PID:5824
        
        C:\Windows\SysWOW64\Baojkdqb.exe
        
        C:\Windows\system32\Baojkdqb.exe
        8⤵
        
        PID:5628
        
        C:\Windows\SysWOW64\Ceppfbef.exe
        
        C:\Windows\system32\Ceppfbef.exe
        9⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\Clihcm32.exe
        
        C:\Windows\system32\Clihcm32.exe
        10⤵
        
        PID:4464
        
        C:\Windows\SysWOW64\Cohdoh32.exe
        
        C:\Windows\system32\Cohdoh32.exe
        11⤵
        
        PID:7396
        
        C:\Windows\SysWOW64\Cafpkc32.exe
        
        C:\Windows\system32\Cafpkc32.exe
        12⤵
        Drops file in System32 directory
        
        PID:4476
        
        C:\Windows\SysWOW64\Chphhn32.exe
        
        C:\Windows\system32\Chphhn32.exe
        13⤵
        
        PID:8052
        
        C:\Windows\SysWOW64\Cojqdhid.exe
        
        C:\Windows\system32\Cojqdhid.exe
        14⤵
        
        PID:6020
        
        C:\Windows\SysWOW64\Didnmp32.exe
        
        C:\Windows\system32\Didnmp32.exe
        15⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7144

C:\Windows\SysWOW64\Djkdnool.exe
C:\Windows\system32\Djkdnool.exe
1⤵
- Drops file in System32 directory
PID:4920
- C:\Windows\SysWOW64\Dohmff32.exe
  C:\Windows\system32\Dohmff32.exe
  2⤵
  - Modifies registry class
  PID:3060
- - C:\Windows\SysWOW64\Djnaco32.exe
    C:\Windows\system32\Djnaco32.exe
    3⤵
    PID:3404
  - - C:\Windows\SysWOW64\Dphipidf.exe
      C:\Windows\system32\Dphipidf.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      PID:8424
    - - C:\Windows\SysWOW64\Ecfeldcj.exe
        
        C:\Windows\system32\Ecfeldcj.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:2312
      - C:\Windows\SysWOW64\Efdbhpbn.exe
        
        C:\Windows\system32\Efdbhpbn.exe
        6⤵
        
        PID:7260
        
        C:\Windows\SysWOW64\Elojej32.exe
        
        C:\Windows\system32\Elojej32.exe
        7⤵
        
        PID:2432
        
        C:\Windows\SysWOW64\Eomfae32.exe
        
        C:\Windows\system32\Eomfae32.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        
        PID:7464
        
        C:\Windows\SysWOW64\Ebkbmqhb.exe
        
        C:\Windows\system32\Ebkbmqhb.exe
        9⤵
        
        PID:6156
        
        C:\Windows\SysWOW64\Ejbknnid.exe
        
        C:\Windows\system32\Ejbknnid.exe
        10⤵
        
        PID:8000
        
        C:\Windows\SysWOW64\Eplckh32.exe
        
        C:\Windows\system32\Eplckh32.exe
        11⤵
        
        PID:5876
        
        C:\Windows\SysWOW64\Ecmlmcmb.exe
        
        C:\Windows\system32\Ecmlmcmb.exe
        12⤵
        
        PID:4292

C:\Windows\SysWOW64\Eodlad32.exe
C:\Windows\system32\Eodlad32.exe
1⤵
PID:7424
- C:\Windows\SysWOW64\Efnennjc.exe
  C:\Windows\system32\Efnennjc.exe
  2⤵
  PID:4692
- - C:\Windows\SysWOW64\Ehlakjig.exe
    C:\Windows\system32\Ehlakjig.exe
    3⤵
    PID:5012
  - - C:\Windows\SysWOW64\Fqcilgji.exe
      C:\Windows\system32\Fqcilgji.exe
      4⤵
      PID:7492
    - - C:\Windows\SysWOW64\Fofigd32.exe
        
        C:\Windows\system32\Fofigd32.exe
        5⤵
        
        PID:8872
      - C:\Windows\SysWOW64\Fbeeco32.exe
        
        C:\Windows\system32\Fbeeco32.exe
        6⤵
        
        PID:9100
        
        C:\Windows\SysWOW64\Fjlmdmqj.exe
        
        C:\Windows\system32\Fjlmdmqj.exe
        7⤵
        
        PID:6928
        
        C:\Windows\SysWOW64\Fmjjqhpn.exe
        
        C:\Windows\system32\Fmjjqhpn.exe
        8⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Modifies registry class
        
        PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 9780 -ip 9780
1⤵
PID:9808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Aamipe32.exe

Filesize
91KB

MD5
cdafd1ee66883d70b299d8712da7121d

SHA1
074d7ac21fa52ee57272d4e3428fb0b0fb32f9dc

SHA256
3f9b2a3afe58bd18447f4af58d05fd37e0f040026cf31939e73f7c2fc4c815a0

SHA512
fffe7f04faa7dcbaeb15ab2beacaea131b945ca4e11d5af914fe2d1d189bece6dd850e993bba2cf575d4c2c6aeb3ee22606bed7f3cb4ea5c36c516346d603928

Download Submit
C:\Windows\SysWOW64\Aekddhcb.exe

Filesize
91KB

MD5
5967d6094a5b1af1dd0552538861f8f4

SHA1
168e2a95c8bafda4502a43132375a8474cb88f09

SHA256
3b68b4816ad6a8160ec453ffca8aa84d48794c2788838a580c5338944655a951

SHA512
051874f61c9264410db406b8bbb09c7a04093c90d828a47ea4349f70cbae32448a9b07f482440708bfef6b3e5d26f3fda8588d2f34b3aac478a12d83fd1a3115

Download Submit
C:\Windows\SysWOW64\Aemqdk32.exe

Filesize
91KB

MD5
bdfad5fcae607abed8b89ae477c0e781

SHA1
a1148230e08352e3b0da28c9618ee5ba789af025

SHA256
f7fe9bdf7f1554d10a7e0c0d5893cc08115b1b05e757782d21962afb24ca90c1

SHA512
d67a36bc19de99bc0b32af1ffb6d682f22bd9fb1da57ad330e0407605409af4e9ebdf123af31921c1dd94318b4b33b1bab4211b66dfed708280ca226c68baa10

Download Submit
C:\Windows\SysWOW64\Ahpdcn32.exe

Filesize
91KB

MD5
51a43148e45e10578c32979a292a3e46

SHA1
efddd2ef0e04a9294539176ba50e58503f22cc3d

SHA256
1cf3d5802e06182202008094bd9bd18bc788c74a8d76e5bda2c7e0693e23f0a9

SHA512
64dffe4316e5cf40268c50ec85e65aaf53758698cfd648acf4214d2fad0e2fbc46a1aef95d17b72cca05d2f65a747c695628e7eb7403d17ff6cd41d1eb003c50

Download Submit
C:\Windows\SysWOW64\Aonoao32.exe

Filesize
91KB

MD5
7b27d320d44c2f9a3100232e9232bf21

SHA1
191b4e2fa1c2c581cfbf41ffc3a94262369473fb

SHA256
acc82737926eec3a93b519c670986692390a23ea0f4b33fc244395ac59e5915e

SHA512
3313f81d3a9d1b4a791a8b216e40e582bf8b30e4ea54c427fde79fc01bfd0e52ee7e03e0c8796bc0e4ae789c253a700c41653af302ca1c985cfb331dd2410135

Download Submit
C:\Windows\SysWOW64\Bllbaa32.exe

Filesize
64KB

MD5
0720c61f9d15b3e9223fd090ee75dbdc

SHA1
38751cefcd918b11ab6e675b0ba207010c9b7f0b

SHA256
fe1bd69cb4c2068dfc5ae38596c3a4274e224877f2955d13ffef1a5d3abdb04a

SHA512
049a2212cc9cf43466724228017a9aea9a1bec895e0f739cad7e732474d0b27ee06059adc4512520e00f98dde2c8122da0b3fde673cb63da75fcfd3879e2adb2

Download Submit
C:\Windows\SysWOW64\Cbpajgmf.exe

Filesize
91KB

MD5
ed937b79cb73a9a82ed366ce2f4b11f6

SHA1
184d6458d5d37854e6ddcf5da604720f88a2d96d

SHA256
c5624a18aec95c6d34c0a5678e031b682707a6d2ea1c9e220ee8acef38c2a8c3

SHA512
62e8debbc89e44ade126914d56982e058c1983285a70416f6b3df396364d9308cc9f285d34198e9c5c5c8162575fbf5d6ee99d5c0cbfdaed992ff164c527bea1

Download Submit
C:\Windows\SysWOW64\Ccgjopal.exe

Filesize
91KB

MD5
493f6d91e7bf046fbec20cf78a0183e9

SHA1
6fb79c1151c86bbc1bc59e9a88aaf2b967300069

SHA256
274c9ecfbd90bea0d92934da00d7ff90a0929b9332e0046617fb1c52f9d931b0

SHA512
7689fee336e454c9a3924c5b7a6c68c5396ccd61deb461f6e2601c2cab185ab18deb2be4c7ff2eca0c84abe1773ead0c6a03fb4745766c3bdedf2d2e47876fc1

Download Submit
C:\Windows\SysWOW64\Ccgjopal.exe

Filesize
91KB

MD5
493f6d91e7bf046fbec20cf78a0183e9

SHA1
6fb79c1151c86bbc1bc59e9a88aaf2b967300069

SHA256
274c9ecfbd90bea0d92934da00d7ff90a0929b9332e0046617fb1c52f9d931b0

SHA512
7689fee336e454c9a3924c5b7a6c68c5396ccd61deb461f6e2601c2cab185ab18deb2be4c7ff2eca0c84abe1773ead0c6a03fb4745766c3bdedf2d2e47876fc1

Download Submit
C:\Windows\SysWOW64\Ccpdoqgd.exe

Filesize
91KB

MD5
9caee63ed3de6c8162735d73c5b6eca5

SHA1
5ba5d00ec453549faa281e26666e2958d4cb260d

SHA256
735304c5abc13228a7982f00028d774724adc2a65496f988771452743f3c2910

SHA512
346da0895ca0d4582b7b1e6ab02bb3cd0ade3f4b16fc2a78c3388299766639f681f6336f1f288edcfe1cc3de9b46d0784736f819a13f6629060f1bef535943b1

Download Submit
C:\Windows\SysWOW64\Ccpdoqgd.exe

Filesize
91KB

MD5
9caee63ed3de6c8162735d73c5b6eca5

SHA1
5ba5d00ec453549faa281e26666e2958d4cb260d

SHA256
735304c5abc13228a7982f00028d774724adc2a65496f988771452743f3c2910

SHA512
346da0895ca0d4582b7b1e6ab02bb3cd0ade3f4b16fc2a78c3388299766639f681f6336f1f288edcfe1cc3de9b46d0784736f819a13f6629060f1bef535943b1

Download Submit
C:\Windows\SysWOW64\Cdolgfbp.exe

Filesize
91KB

MD5
09db0b2c383090ae6a42adc01ab1b753

SHA1
af7c933501c00f0e0de24035f925eebeca6b3186

SHA256
60e819473b5dbf3f49e23d45cd80276a3039128a4fc8e6b4596d6e3a3c3169d4

SHA512
011cec5756205be81a2054384f7d83e041de32f77db7994527c0aec6155be89c0a617a8edfa8f4f820cbaef15b52283ce174cac68e7038e013127c5d4a51702f

Download Submit
C:\Windows\SysWOW64\Cfcjfk32.exe

Filesize
91KB

MD5
4de437420c2b9f1b05efe536ba9fd1df

SHA1
2795cf9083bd8f34f9438f1bcae2eaa02eac1a5b

SHA256
ff74773e39182389c49159faa9ad5a32c223d46d3a8ce09692217adba8d40ffe

SHA512
a86ec9428223e181a0eaa9e179f979cf298f6a1abba02d20c7411ec2776c3b3cf910f4b67924d6d6ed8ad2b7537bf34f34b72161a95b8fca91cbb650bdbfa7c1

Download Submit
C:\Windows\SysWOW64\Cfcjfk32.exe

Filesize
91KB

MD5
4de437420c2b9f1b05efe536ba9fd1df

SHA1
2795cf9083bd8f34f9438f1bcae2eaa02eac1a5b

SHA256
ff74773e39182389c49159faa9ad5a32c223d46d3a8ce09692217adba8d40ffe

SHA512
a86ec9428223e181a0eaa9e179f979cf298f6a1abba02d20c7411ec2776c3b3cf910f4b67924d6d6ed8ad2b7537bf34f34b72161a95b8fca91cbb650bdbfa7c1

Download Submit
C:\Windows\SysWOW64\Cfqmpl32.exe

Filesize
91KB

MD5
0d4bacb163734fbbda8ecf3e174f72ad

SHA1
d7bc6eec05fac3df72e817ba61044d6d2c2aac05

SHA256
743023fa7e11606f79ad8e6c639322d38e9d122a415e740a59bd3a4e8f65519b

SHA512
2df6687b4aa38588065bf8d70b9925a593b22868186a427a5bcfbf9b629c6b541d891e7c74578fd3a853d93b8d631251db4b866b82f5313d2dcaeb5618c1d4d9

Download Submit
C:\Windows\SysWOW64\Cfqmpl32.exe

Filesize
91KB

MD5
0d4bacb163734fbbda8ecf3e174f72ad

SHA1
d7bc6eec05fac3df72e817ba61044d6d2c2aac05

SHA256
743023fa7e11606f79ad8e6c639322d38e9d122a415e740a59bd3a4e8f65519b

SHA512
2df6687b4aa38588065bf8d70b9925a593b22868186a427a5bcfbf9b629c6b541d891e7c74578fd3a853d93b8d631251db4b866b82f5313d2dcaeb5618c1d4d9

Download Submit
C:\Windows\SysWOW64\Ckkiccep.exe

Filesize
91KB

MD5
f4898f632ddce247fa6722d6af473e41

SHA1
4e9e12de6d53964a5c73296a98fbb9593360bf82

SHA256
5a4b45001645fd2ab6c48bd9649abdc65cfa4628586719ecdee19abd132aedc1

SHA512
2f4aedc0deea8cca1c255244e54d02f6b9571bd1f6d064a751a42cb3816b822332a3c2486a5b189410f4bbf8f95570cab19a6df165840d73ab2d3c21f43afce8

Download Submit
C:\Windows\SysWOW64\Ckkiccep.exe

Filesize
91KB

MD5
f4898f632ddce247fa6722d6af473e41

SHA1
4e9e12de6d53964a5c73296a98fbb9593360bf82

SHA256
5a4b45001645fd2ab6c48bd9649abdc65cfa4628586719ecdee19abd132aedc1

SHA512
2f4aedc0deea8cca1c255244e54d02f6b9571bd1f6d064a751a42cb3816b822332a3c2486a5b189410f4bbf8f95570cab19a6df165840d73ab2d3c21f43afce8

Download Submit
C:\Windows\SysWOW64\Ckmehb32.exe

Filesize
91KB

MD5
f0105fd2d8441da9495b71e3a4f4cb34

SHA1
37b2cad7e8a23811071ac47f940da362f6910373

SHA256
4f7afa21c952c4ddf6a2d7824d088d2265da60c7f1608d916e9b22da5e9b9d1b

SHA512
902bf2d3c5ce01bb276543dd0a55fb31d3fe2b82ee8a6c7e97680fb16d7ac764d6b1295cf77d8a09731acbd50706dc35d4ed94f19149df6d57bc16dd07d365b3

Download Submit
C:\Windows\SysWOW64\Ckmehb32.exe

Filesize
91KB

MD5
f0105fd2d8441da9495b71e3a4f4cb34

SHA1
37b2cad7e8a23811071ac47f940da362f6910373

SHA256
4f7afa21c952c4ddf6a2d7824d088d2265da60c7f1608d916e9b22da5e9b9d1b

SHA512
902bf2d3c5ce01bb276543dd0a55fb31d3fe2b82ee8a6c7e97680fb16d7ac764d6b1295cf77d8a09731acbd50706dc35d4ed94f19149df6d57bc16dd07d365b3

Download Submit
C:\Windows\SysWOW64\Cmmbbejp.exe

Filesize
91KB

MD5
dab5e08c28cf3811eb1db09b82aa41a9

SHA1
455a5c5488b62112845f42b1ae5d5da574963ba1

SHA256
d2bac22b16142af42cd4729343f85e6e59ead61b09cb8179c46fcce97e745de5

SHA512
27bd0e1ee599c274c94f228c63547a62cab278144b6ca4ffbd09865f7f289e2489b8ee27d19583d3d420b32a30477d2ff0aaff91957aed284fb2196c866b2b66

Download Submit
C:\Windows\SysWOW64\Cmmbbejp.exe

Filesize
91KB

MD5
dab5e08c28cf3811eb1db09b82aa41a9

SHA1
455a5c5488b62112845f42b1ae5d5da574963ba1

SHA256
d2bac22b16142af42cd4729343f85e6e59ead61b09cb8179c46fcce97e745de5

SHA512
27bd0e1ee599c274c94f228c63547a62cab278144b6ca4ffbd09865f7f289e2489b8ee27d19583d3d420b32a30477d2ff0aaff91957aed284fb2196c866b2b66

Download Submit
C:\Windows\SysWOW64\Dbcmakpl.exe

Filesize
91KB

MD5
97737eb29258704e46e1ba21b8b15586

SHA1
1a3621bb8779920cf056e53cb129816dea5e5e28

SHA256
e0720499978e552ff4736a3c51073eca4817cd0bcc670b70d2c6e88795698ded

SHA512
5b27a4c6b01e77368f963555ce8108b002598a0eeee720c3637b132aae0195a373571e862ad2bd595d92264817ec7bd8a39e5da587b4bfb2810f40517fa219a9

Download Submit
C:\Windows\SysWOW64\Dbcmakpl.exe

Filesize
91KB

MD5
97737eb29258704e46e1ba21b8b15586

SHA1
1a3621bb8779920cf056e53cb129816dea5e5e28

SHA256
e0720499978e552ff4736a3c51073eca4817cd0bcc670b70d2c6e88795698ded

SHA512
5b27a4c6b01e77368f963555ce8108b002598a0eeee720c3637b132aae0195a373571e862ad2bd595d92264817ec7bd8a39e5da587b4bfb2810f40517fa219a9

Download Submit
C:\Windows\SysWOW64\Dbqqkkbo.exe

Filesize
91KB

MD5
3c596d2b6f1d87c01a5d01dd70fd53f9

SHA1
85f851bae2a0b6921738faaa82d9f4d5085c37a9

SHA256
f7115d835f9515787b6539f22c83693ba95120a319dfa3320c023e8545308197

SHA512
e16b8f86a660166b21e0fcfcb529489f5e5ed2d6c5c3ee204b25075439c9e8a46bf3f07250cbcdc60b20aeadafcff1ea4bf69c97932ddbd7da17cede74778d29

Download Submit
C:\Windows\SysWOW64\Dbqqkkbo.exe

Filesize
91KB

MD5
3c596d2b6f1d87c01a5d01dd70fd53f9

SHA1
85f851bae2a0b6921738faaa82d9f4d5085c37a9

SHA256
f7115d835f9515787b6539f22c83693ba95120a319dfa3320c023e8545308197

SHA512
e16b8f86a660166b21e0fcfcb529489f5e5ed2d6c5c3ee204b25075439c9e8a46bf3f07250cbcdc60b20aeadafcff1ea4bf69c97932ddbd7da17cede74778d29

Download Submit
C:\Windows\SysWOW64\Dckdjomg.exe

Filesize
91KB

MD5
884783a80bd9b38f56764ca8a3a6e09a

SHA1
0c19588df337720af56f325e3556d8c36f3772c0

SHA256
199bf7d9767aae7ac092d024cc2a5bfdbbeba0139364790b011cc81bc6c56dfc

SHA512
a995e98c2419eb5139aa7417fb313b40634a1c93be8e8dcc9881e511a5a5b9a072ae11ca7df5e078ea32bf40f8bc51299a4df8e49fdb5a86e7078922637843f7

Download Submit
C:\Windows\SysWOW64\Dckdjomg.exe

Filesize
91KB

MD5
884783a80bd9b38f56764ca8a3a6e09a

SHA1
0c19588df337720af56f325e3556d8c36f3772c0

SHA256
199bf7d9767aae7ac092d024cc2a5bfdbbeba0139364790b011cc81bc6c56dfc

SHA512
a995e98c2419eb5139aa7417fb313b40634a1c93be8e8dcc9881e511a5a5b9a072ae11ca7df5e078ea32bf40f8bc51299a4df8e49fdb5a86e7078922637843f7

Download Submit
C:\Windows\SysWOW64\Dfgcakon.exe

Filesize
91KB

MD5
64683b14ae40a8956194fa42d17760b4

SHA1
f7ab57e3292087ab1f8974eaca77003767128c79

SHA256
a5ee7e9b2cf4f3bcac3660df23777b05f51082c4ba1816ffd7f43e86579c32ae

SHA512
b85330b57c7fe55ea0a34d81be0a2362017cee37d6590b6fea399631281bf1516ceed7d66df54c6e310dc683b93692a6e9a852ace5fbac6a79cb6a48ca5eaf00

Download Submit
C:\Windows\SysWOW64\Dfgcakon.exe

Filesize
91KB

MD5
64683b14ae40a8956194fa42d17760b4

SHA1
f7ab57e3292087ab1f8974eaca77003767128c79

SHA256
a5ee7e9b2cf4f3bcac3660df23777b05f51082c4ba1816ffd7f43e86579c32ae

SHA512
b85330b57c7fe55ea0a34d81be0a2362017cee37d6590b6fea399631281bf1516ceed7d66df54c6e310dc683b93692a6e9a852ace5fbac6a79cb6a48ca5eaf00

Download Submit
C:\Windows\SysWOW64\Diccgfpd.exe

Filesize
91KB

MD5
5998cdee3155422277cf018b55aee526

SHA1
48e4c5cef982da9f8c1e51ce672c20f2135d336f

SHA256
793c9e46b8c7fd0906e1ffd060d2b52d10b3eb3f28ee277168aaa5fce33e9cbc

SHA512
b8257e0aa6909b458969dce74fe110d27b0b77a54d376a8dc394797be7828c03a98ae225f2d4e8fed075a9c6bf1af18e0f0865a72dbdfd895237cc85181d42f3

Download Submit
C:\Windows\SysWOW64\Diccgfpd.exe

Filesize
91KB

MD5
5998cdee3155422277cf018b55aee526

SHA1
48e4c5cef982da9f8c1e51ce672c20f2135d336f

SHA256
793c9e46b8c7fd0906e1ffd060d2b52d10b3eb3f28ee277168aaa5fce33e9cbc

SHA512
b8257e0aa6909b458969dce74fe110d27b0b77a54d376a8dc394797be7828c03a98ae225f2d4e8fed075a9c6bf1af18e0f0865a72dbdfd895237cc85181d42f3

Download Submit
C:\Windows\SysWOW64\Dmdhcddh.exe

Filesize
91KB

MD5
6b24c1881f79e102a7d4f8099aa7ed53

SHA1
7dddaa3806e2220fc9c0836e6fceff1a300caf19

SHA256
4ed57f1013c67f6e1dffb266f9eb0a462bad51d0a4f3aece84a2999aae5274e4

SHA512
9dbfd1a0b09cdeea06e530330e71d04a5fc22ac86fdb923c4301e85969bd0a5d658ab49e45bdb8417c7c2d105271ea28539a2cfdaf17035363064c23b98f707a

Download Submit
C:\Windows\SysWOW64\Dmdhcddh.exe

Filesize
91KB

MD5
6b24c1881f79e102a7d4f8099aa7ed53

SHA1
7dddaa3806e2220fc9c0836e6fceff1a300caf19

SHA256
4ed57f1013c67f6e1dffb266f9eb0a462bad51d0a4f3aece84a2999aae5274e4

SHA512
9dbfd1a0b09cdeea06e530330e71d04a5fc22ac86fdb923c4301e85969bd0a5d658ab49e45bdb8417c7c2d105271ea28539a2cfdaf17035363064c23b98f707a

Download Submit
C:\Windows\SysWOW64\Dmfeidbe.exe

Filesize
91KB

MD5
3f58f6b1af44cdf452a82a31b78fb7f2

SHA1
f61d15ca9cfb94b7267b3886032b5c47311f71d2

SHA256
7bda7341a595ba9df5dcc751805eb46f3298f1b88d74d12336b24a4c2ea21c72

SHA512
4420a82febf7e7630146d0497f0fb1f03c63622411085608f2b5f6eb2197bd33d578636391cbd73b1cd4c31cc1a19a9104067e05b216767c34fd571fc5e5e030

Download Submit
C:\Windows\SysWOW64\Dmfeidbe.exe

Filesize
91KB

MD5
3f58f6b1af44cdf452a82a31b78fb7f2

SHA1
f61d15ca9cfb94b7267b3886032b5c47311f71d2

SHA256
7bda7341a595ba9df5dcc751805eb46f3298f1b88d74d12336b24a4c2ea21c72

SHA512
4420a82febf7e7630146d0497f0fb1f03c63622411085608f2b5f6eb2197bd33d578636391cbd73b1cd4c31cc1a19a9104067e05b216767c34fd571fc5e5e030

Download Submit
C:\Windows\SysWOW64\Dmhand32.exe

Filesize
91KB

MD5
5651593ca71b4079c3992dadd6beec87

SHA1
b9af8d324b01aa874d7be04b54b99966cb80efb8

SHA256
bc44ef5aa145883080d7ebe73a78165dca66d33c80928692500e8d65cb4dc0f6

SHA512
16ff8a8a97596cc0e6deb35054f09e6a4c6d33a437c567ec0f3ac2f0c36b0bdcc39a3270cf7fa7bf1174617b7e528565380affc5c59dda41f7edd52eca4f795f

Download Submit
C:\Windows\SysWOW64\Dmhand32.exe

Filesize
91KB

MD5
5651593ca71b4079c3992dadd6beec87

SHA1
b9af8d324b01aa874d7be04b54b99966cb80efb8

SHA256
bc44ef5aa145883080d7ebe73a78165dca66d33c80928692500e8d65cb4dc0f6

SHA512
16ff8a8a97596cc0e6deb35054f09e6a4c6d33a437c567ec0f3ac2f0c36b0bdcc39a3270cf7fa7bf1174617b7e528565380affc5c59dda41f7edd52eca4f795f

Download Submit
C:\Windows\SysWOW64\Dndnpf32.exe

Filesize
91KB

MD5
ae6dd10513ac290ac791c79260f0c750

SHA1
6e4da6cedb20f8dbc1f824a06245e5d02fb7021d

SHA256
ac6e16dcdacbeef5825700178d00f40770f7d20dc85460318d73c1dd0e5f357c

SHA512
d914401a61064ec3a8cf8c6fdd4eb5b604f36fb641c4ee12bc39866f04bb7d8462f4b9d98223dd290468b06485b420d01374ddde15f51ea71b5d11a8df640b27

Download Submit
C:\Windows\SysWOW64\Ecefqnel.exe

Filesize
91KB

MD5
7ce1809eaf2a6ba98dac24bfe67bda39

SHA1
d8ac1fad3c1e179f0cc64ac06ebffb96b831e237

SHA256
5e6e2535ab3b8fbac7337b2cbe1d68d275c26174a420594e177e44192e401f45

SHA512
c6763c31633af3322190ca83290d31f8e0f8d2fdcfbe311874ca81ab233f5a8dd5c93dfcbd04d37055ef68e97d8fe5281950f88f48ebcc9cc4cb176057f18949

Download Submit
C:\Windows\SysWOW64\Ecefqnel.exe

Filesize
91KB

MD5
7ce1809eaf2a6ba98dac24bfe67bda39

SHA1
d8ac1fad3c1e179f0cc64ac06ebffb96b831e237

SHA256
5e6e2535ab3b8fbac7337b2cbe1d68d275c26174a420594e177e44192e401f45

SHA512
c6763c31633af3322190ca83290d31f8e0f8d2fdcfbe311874ca81ab233f5a8dd5c93dfcbd04d37055ef68e97d8fe5281950f88f48ebcc9cc4cb176057f18949

Download Submit
C:\Windows\SysWOW64\Ecgcfm32.exe

Filesize
91KB

MD5
4f47c933987ad6d064631cbc92ca7a7b

SHA1
66c31c423fc8b7058d664143c49273526a567cef

SHA256
2a22527e05e5e739a57117b568a6766fcde2f8b43a50dabf3ceea4e07f1f11fd

SHA512
d3cc3792775b8f17d1e5f8fad5e5abc5797884e50b287859f31e51eed0a2088ca35e3ccb5ce35917cb3c6a0c0bf61efdff5b28e3736e3b45183aa561c3ba74b8

Download Submit
C:\Windows\SysWOW64\Ecgcfm32.exe

Filesize
91KB

MD5
4f47c933987ad6d064631cbc92ca7a7b

SHA1
66c31c423fc8b7058d664143c49273526a567cef

SHA256
2a22527e05e5e739a57117b568a6766fcde2f8b43a50dabf3ceea4e07f1f11fd

SHA512
d3cc3792775b8f17d1e5f8fad5e5abc5797884e50b287859f31e51eed0a2088ca35e3ccb5ce35917cb3c6a0c0bf61efdff5b28e3736e3b45183aa561c3ba74b8

Download Submit
C:\Windows\SysWOW64\Efafgifc.exe

Filesize
91KB

MD5
168682a71aa4b4b7d9d683304f871787

SHA1
c28a0c63ab0fce672f3912fcb370572217a9d27e

SHA256
acffcd093559d6bc84ef297b6d9c6f813cda451b4635e9fd6a1a5790a030ae90

SHA512
a7badff6b5c477271f2e158282b0d5d896da866b5b8948949e313ee64f27477d079252656b234f7092c55dc49c5293c02e8d57599247a3b8f8afadc57712d9d8

Download Submit
C:\Windows\SysWOW64\Efafgifc.exe

Filesize
91KB

MD5
168682a71aa4b4b7d9d683304f871787

SHA1
c28a0c63ab0fce672f3912fcb370572217a9d27e

SHA256
acffcd093559d6bc84ef297b6d9c6f813cda451b4635e9fd6a1a5790a030ae90

SHA512
a7badff6b5c477271f2e158282b0d5d896da866b5b8948949e313ee64f27477d079252656b234f7092c55dc49c5293c02e8d57599247a3b8f8afadc57712d9d8

Download Submit
C:\Windows\SysWOW64\Eidlnd32.exe

Filesize
91KB

MD5
424be39cd41777221869c66190f35d66

SHA1
a453c367417865a8f5741f69a2e9ba98ab2122f5

SHA256
dc522fd43b2f83efa9dde9cc9e475b0700c960d44f0939dd5e4e5c3cfd74b39c

SHA512
2efd8c03b933dcefd72c8e7410a939a1fa637c774fe9d800f68516c06c9862ab73b96c08d21f19bab49a4324bacf3fea0c9e3d45c74fa792963be43807893b6f

Download Submit
C:\Windows\SysWOW64\Eidlnd32.exe

Filesize
91KB

MD5
424be39cd41777221869c66190f35d66

SHA1
a453c367417865a8f5741f69a2e9ba98ab2122f5

SHA256
dc522fd43b2f83efa9dde9cc9e475b0700c960d44f0939dd5e4e5c3cfd74b39c

SHA512
2efd8c03b933dcefd72c8e7410a939a1fa637c774fe9d800f68516c06c9862ab73b96c08d21f19bab49a4324bacf3fea0c9e3d45c74fa792963be43807893b6f

Download Submit
C:\Windows\SysWOW64\Eikpan32.exe

Filesize
91KB

MD5
70a3f066114dd1115d6ef876c8bc3aaf

SHA1
cbfa2322129fdc9cf8d5c1ec61013688126c0786

SHA256
23393bfd3171a1f4a916e8f903fb9caafa9caac2af80ef391ddc48119625adb5

SHA512
337f7ca0c2493d3c18c001881be49395ca856332a3853e7bda5bf41afb447165853467296a972b157712621176fe71f18242389421a862ea4d6b06ada70efd85

Download Submit
C:\Windows\SysWOW64\Emkndc32.exe

Filesize
91KB

MD5
f26bbe38fa7152b4277819f11e6ee824

SHA1
de07c57889d5cb405abaabb3af6e9d435b6142fc

SHA256
562838535a2d34f2651f9246f885ccf9bdb2a43df61b7e6be5ed42419e669a89

SHA512
ab854f1f87c3626ce0cc7237562b15890378d315eac41eac024d17526dc49da0eb8d9ab4dfea5207872af730ac81b36983d7cb429d867f8738727edd8411d2b9

Download Submit
C:\Windows\SysWOW64\Emkndc32.exe

Filesize
91KB

MD5
f26bbe38fa7152b4277819f11e6ee824

SHA1
de07c57889d5cb405abaabb3af6e9d435b6142fc

SHA256
562838535a2d34f2651f9246f885ccf9bdb2a43df61b7e6be5ed42419e669a89

SHA512
ab854f1f87c3626ce0cc7237562b15890378d315eac41eac024d17526dc49da0eb8d9ab4dfea5207872af730ac81b36983d7cb429d867f8738727edd8411d2b9

Download Submit
C:\Windows\SysWOW64\Fdqfll32.exe

Filesize
91KB

MD5
34a61672ebd83c086e41d5919dc38a72

SHA1
28492e4e2921f89cbdec3fc36c79b02613a89f86

SHA256
b856e18a7a331719b15e2fab25b4411898deeea025e26952fa3cde4e993652d4

SHA512
17b88ddec0b5f552434cd813d5193814c0b02c15344ff395f45689cfab31bd4d679b73bddcb3e89cec6a805fb10523d6945f9303f3e52304b74760d04d6baa87

Download Submit
C:\Windows\SysWOW64\Fdqfll32.exe

Filesize
91KB

MD5
34a61672ebd83c086e41d5919dc38a72

SHA1
28492e4e2921f89cbdec3fc36c79b02613a89f86

SHA256
b856e18a7a331719b15e2fab25b4411898deeea025e26952fa3cde4e993652d4

SHA512
17b88ddec0b5f552434cd813d5193814c0b02c15344ff395f45689cfab31bd4d679b73bddcb3e89cec6a805fb10523d6945f9303f3e52304b74760d04d6baa87

Download Submit
C:\Windows\SysWOW64\Ffqhcq32.exe

Filesize
91KB

MD5
fa7d608236f32ce16b9b3b027c067162

SHA1
72c12288bf8e5a932697c1b3406ed9733e1c0196

SHA256
dc4f06b197a672439db856df3966c848557ef8d29b1cc4dda50efd40283b050b

SHA512
3fc7fa25e426fc3073120756a2c09e80808d5d6076f0f28ad846750b63c7f99635e23f0465e963d0a53e64b08f0a02aa10470292c12d4eaadb2a1d40573e9cf4

Download Submit
C:\Windows\SysWOW64\Fideeaco.exe

Filesize
91KB

MD5
8e21a1dd8038d74411f61981990e5c40

SHA1
1a0d51d997894e29f0a8468f8e9c19e403e5fcb4

SHA256
6304b0f8b3b128a9e63952f16d99be878afa67930ee1ec18366a35217f18d933

SHA512
cbaf6b4a8cf442c857e6559cc5d34903078714d7c3edd1ee87e7b11fe4e0765785b53725ffc843fe2db2b321174b599190631f22fed6f173dd1bea735d70a185

Download Submit
C:\Windows\SysWOW64\Fideeaco.exe

Filesize
91KB

MD5
8e21a1dd8038d74411f61981990e5c40

SHA1
1a0d51d997894e29f0a8468f8e9c19e403e5fcb4

SHA256
6304b0f8b3b128a9e63952f16d99be878afa67930ee1ec18366a35217f18d933

SHA512
cbaf6b4a8cf442c857e6559cc5d34903078714d7c3edd1ee87e7b11fe4e0765785b53725ffc843fe2db2b321174b599190631f22fed6f173dd1bea735d70a185

Download Submit
C:\Windows\SysWOW64\Fljedg32.exe

Filesize
91KB

MD5
3ae462a65d31f4cd40c9edb25b3ba6e8

SHA1
8fc9aeebd98766e162d3c727b10ed6d417bfe422

SHA256
100fffcbdf52fcadff5409544f94bf1bd649583eb5e9ce476a8f62fe679b7db9

SHA512
e28d76ac7203b53a22c23a385be533f4db080a1eea022154baae464d97a0cc574fdcd126990e14ef08acf527b998467f94149e8b679ef20f017794cfb5ddcced

Download Submit
C:\Windows\SysWOW64\Fllkqn32.exe

Filesize
91KB

MD5
34a61672ebd83c086e41d5919dc38a72

SHA1
28492e4e2921f89cbdec3fc36c79b02613a89f86

SHA256
b856e18a7a331719b15e2fab25b4411898deeea025e26952fa3cde4e993652d4

SHA512
17b88ddec0b5f552434cd813d5193814c0b02c15344ff395f45689cfab31bd4d679b73bddcb3e89cec6a805fb10523d6945f9303f3e52304b74760d04d6baa87

Download Submit
C:\Windows\SysWOW64\Fllkqn32.exe

Filesize
91KB

MD5
8489479be0e57f10238ecfdf3ff613c7

SHA1
2f8561491d5d255a6c96462ce24c81fb6b12f3c1

SHA256
db4871b06b4ef604caa76eb9062f9599b4c3285660e0e6581f3c0fa65e6c590a

SHA512
3d809179999db87345646c98a1645ccd8934344c81098b2f668245985ac335e9c4935eac9ab57937473f1d13e6b84dee09651beee8f73df6e270666158de9d6f

Download Submit
C:\Windows\SysWOW64\Fllkqn32.exe

Filesize
91KB

MD5
8489479be0e57f10238ecfdf3ff613c7

SHA1
2f8561491d5d255a6c96462ce24c81fb6b12f3c1

SHA256
db4871b06b4ef604caa76eb9062f9599b4c3285660e0e6581f3c0fa65e6c590a

SHA512
3d809179999db87345646c98a1645ccd8934344c81098b2f668245985ac335e9c4935eac9ab57937473f1d13e6b84dee09651beee8f73df6e270666158de9d6f

Download Submit
C:\Windows\SysWOW64\Fmndpq32.exe

Filesize
91KB

MD5
dbbd6af6dd4f6a8237b78048021bbe0a

SHA1
a46316e0d9359c6bdbbc0b1f8a4b12349fbd9650

SHA256
5ef01ef8d8174ba108497e7db13d45a3f7035a441de429e5d118fe488aec8062

SHA512
629ddca384666c412678840ef66fd8d2f32640fbfc5b42326288c287fc67cef945b9bce44f2f0adf11952ab1401c07f178d7daf4afe7e194e350210217443f4f

Download Submit
C:\Windows\SysWOW64\Fmndpq32.exe

Filesize
91KB

MD5
dbbd6af6dd4f6a8237b78048021bbe0a

SHA1
a46316e0d9359c6bdbbc0b1f8a4b12349fbd9650

SHA256
5ef01ef8d8174ba108497e7db13d45a3f7035a441de429e5d118fe488aec8062

SHA512
629ddca384666c412678840ef66fd8d2f32640fbfc5b42326288c287fc67cef945b9bce44f2f0adf11952ab1401c07f178d7daf4afe7e194e350210217443f4f

Download Submit
C:\Windows\SysWOW64\Fpbmfn32.exe

Filesize
91KB

MD5
b1cb6b335d87cccc8106b2c10a67dba4

SHA1
ad70285712b9bf823d7e83ee54b08595cdc0e3f3

SHA256
bfd326c71d5bd4f4fa6c026b2afff21b4d9096bb2e5160b8bd88330c88001858

SHA512
1161f88f66069a4f92c81cec27d666528c2c02ca26f0c549b2649f7ed7de06db667aa2a00f8dffa519dfbd7ee6168d86b1bd0954a05ff9bc9dbe3f2dcfca5a3d

Download Submit
C:\Windows\SysWOW64\Fpbmfn32.exe

Filesize
91KB

MD5
b1cb6b335d87cccc8106b2c10a67dba4

SHA1
ad70285712b9bf823d7e83ee54b08595cdc0e3f3

SHA256
bfd326c71d5bd4f4fa6c026b2afff21b4d9096bb2e5160b8bd88330c88001858

SHA512
1161f88f66069a4f92c81cec27d666528c2c02ca26f0c549b2649f7ed7de06db667aa2a00f8dffa519dfbd7ee6168d86b1bd0954a05ff9bc9dbe3f2dcfca5a3d

Download Submit
C:\Windows\SysWOW64\Gbabigfj.exe

Filesize
91KB

MD5
d6d4d9ddfa0df6606c440cc6ae41b7a0

SHA1
e442192ac081744d289b615a00fd2be9a77a6126

SHA256
6d3475b304d271c978f1c4c29a15a8f26b8df787522d1b0a17a50273548a845d

SHA512
ad89bbdfb29942c526486639eaf0229e6f02e77cf3f8c36c4871aa61032802ed7a28bd02eb03bfb32d1808d0269ce3542bf263fbc3d5abfb8cc17eb9ba52c69a

Download Submit
C:\Windows\SysWOW64\Gbabigfj.exe

Filesize
91KB

MD5
d6d4d9ddfa0df6606c440cc6ae41b7a0

SHA1
e442192ac081744d289b615a00fd2be9a77a6126

SHA256
6d3475b304d271c978f1c4c29a15a8f26b8df787522d1b0a17a50273548a845d

SHA512
ad89bbdfb29942c526486639eaf0229e6f02e77cf3f8c36c4871aa61032802ed7a28bd02eb03bfb32d1808d0269ce3542bf263fbc3d5abfb8cc17eb9ba52c69a

Download Submit
C:\Windows\SysWOW64\Gbdoof32.exe

Filesize
91KB

MD5
0cf6c0eeff20cd76ed25ec14cd399f89

SHA1
64aa0440146daa6faeb34b3b09d27dd82794d12d

SHA256
b20e9addc9cf7be625b5eb659def344df84db72429597f70815a284d2725c626

SHA512
af1e98c1f2d41bae36f8b802119e08e29c216846f3de410890b9560c46614498bf8d2cda87cccdbc11ae9816bcd096f9eed5916f2c485c82c8715426efad9bd5

Download Submit
C:\Windows\SysWOW64\Gbdoof32.exe

Filesize
91KB

MD5
0cf6c0eeff20cd76ed25ec14cd399f89

SHA1
64aa0440146daa6faeb34b3b09d27dd82794d12d

SHA256
b20e9addc9cf7be625b5eb659def344df84db72429597f70815a284d2725c626

SHA512
af1e98c1f2d41bae36f8b802119e08e29c216846f3de410890b9560c46614498bf8d2cda87cccdbc11ae9816bcd096f9eed5916f2c485c82c8715426efad9bd5

Download Submit
C:\Windows\SysWOW64\Gdjibj32.exe

Filesize
91KB

MD5
2918d2ec9c020315777feafe52c4c97f

SHA1
d2ed4b116e991a7b473003c22d91be53d936800f

SHA256
41c74018379cd80a3d23bc58dd2ab06ae55e1a28a7bf12022ae4d1dfd8ae6fba

SHA512
e53e49014bf92f164d880882524207776d2088dabec266babb7e065ab26d2029ffc08b1f0b63feaba9d94bce572f38feaee01a2dedfa4500582d464d94649a9d

Download Submit
C:\Windows\SysWOW64\Gdjibj32.exe

Filesize
91KB

MD5
2918d2ec9c020315777feafe52c4c97f

SHA1
d2ed4b116e991a7b473003c22d91be53d936800f

SHA256
41c74018379cd80a3d23bc58dd2ab06ae55e1a28a7bf12022ae4d1dfd8ae6fba

SHA512
e53e49014bf92f164d880882524207776d2088dabec266babb7e065ab26d2029ffc08b1f0b63feaba9d94bce572f38feaee01a2dedfa4500582d464d94649a9d

Download Submit
C:\Windows\SysWOW64\Ggahedjn.exe

Filesize
91KB

MD5
85f2784d01b33304aab04a2210082912

SHA1
82488656db3172bd20ad12d817db6ec55acad0f0

SHA256
6e824a03dddedfd093ec1baf58c356a43d9beb999ad556fdb11d47d6287a8819

SHA512
a91d0e9d7bc0e6bc52e4f0e1ddb4badef09be37f307bb975fb087cfadf3ceb831cd2fb8f4036109073760834b7d9efe871dd9e8a746dfd0e9f1be8660fa71ff4

Download Submit
C:\Windows\SysWOW64\Ggahedjn.exe

Filesize
91KB

MD5
85f2784d01b33304aab04a2210082912

SHA1
82488656db3172bd20ad12d817db6ec55acad0f0

SHA256
6e824a03dddedfd093ec1baf58c356a43d9beb999ad556fdb11d47d6287a8819

SHA512
a91d0e9d7bc0e6bc52e4f0e1ddb4badef09be37f307bb975fb087cfadf3ceb831cd2fb8f4036109073760834b7d9efe871dd9e8a746dfd0e9f1be8660fa71ff4

Download Submit
C:\Windows\SysWOW64\Giinpa32.exe

Filesize
91KB

MD5
37c54cd077c2282a564f7dd9b1fccc95

SHA1
1d64ae76e56dcca7ac43e08582439f6900d86374

SHA256
4e57c8daf9e1939e5ce0277ac6d6dd9beaa98a4b8c24f77dd7cc2767af2eff92

SHA512
67c1c0f0bf9d9abdc29b9c05596271b12746670c3908cf8e1e25fbf2dc47efee03ee4cd6bc5a55ecf7ac135110f9af62b8ca780861f2eaf6def0efaf845270de

Download Submit
C:\Windows\SysWOW64\Giinpa32.exe

Filesize
91KB

MD5
37c54cd077c2282a564f7dd9b1fccc95

SHA1
1d64ae76e56dcca7ac43e08582439f6900d86374

SHA256
4e57c8daf9e1939e5ce0277ac6d6dd9beaa98a4b8c24f77dd7cc2767af2eff92

SHA512
67c1c0f0bf9d9abdc29b9c05596271b12746670c3908cf8e1e25fbf2dc47efee03ee4cd6bc5a55ecf7ac135110f9af62b8ca780861f2eaf6def0efaf845270de

Download Submit
C:\Windows\SysWOW64\Gmggfp32.exe

Filesize
91KB

MD5
24e87582df40020001d730065bc1da71

SHA1
2c902d27420d8999a9b149552c57af6a2d24d8ed

SHA256
a2f4bfe02870de04aab406d6349efe5a8e80d1a60bfd419da7b825c1cdc41d80

SHA512
a0f5328f1c635a05643e40fa4552d2a9601fe096cbdbf9b7579ec5a4e76518043d906f68919cf7fad9ee76c35861251b42e50e27fee942e2e2468a28d9f25ebe

Download Submit
C:\Windows\SysWOW64\Gmggfp32.exe

Filesize
91KB

MD5
24e87582df40020001d730065bc1da71

SHA1
2c902d27420d8999a9b149552c57af6a2d24d8ed

SHA256
a2f4bfe02870de04aab406d6349efe5a8e80d1a60bfd419da7b825c1cdc41d80

SHA512
a0f5328f1c635a05643e40fa4552d2a9601fe096cbdbf9b7579ec5a4e76518043d906f68919cf7fad9ee76c35861251b42e50e27fee942e2e2468a28d9f25ebe

Download Submit
C:\Windows\SysWOW64\Gmiclo32.exe

Filesize
91KB

MD5
5c8d352f5cbe21b0313cbe7f70a78c9d

SHA1
1f15d7b1b23b6fc17f1f54dd7d7829c3a3755daf

SHA256
688f39506b8945f34f7240c4d44d869d8650527aebb92968561cfaa348056670

SHA512
6505395ff9643b2c3c0d879ff79ea7506556b1fabe5c3ed291d77a7fcfc0ea7790b54a1e1f1926b90b00afeffaaf0ec2bb2a0e5b1cef63062f61ec3bb71be1af

Download Submit
C:\Windows\SysWOW64\Gmiclo32.exe

Filesize
91KB

MD5
5c8d352f5cbe21b0313cbe7f70a78c9d

SHA1
1f15d7b1b23b6fc17f1f54dd7d7829c3a3755daf

SHA256
688f39506b8945f34f7240c4d44d869d8650527aebb92968561cfaa348056670

SHA512
6505395ff9643b2c3c0d879ff79ea7506556b1fabe5c3ed291d77a7fcfc0ea7790b54a1e1f1926b90b00afeffaaf0ec2bb2a0e5b1cef63062f61ec3bb71be1af

Download Submit
C:\Windows\SysWOW64\Hckeoeno.exe

Filesize
91KB

MD5
d9fff38d3b6d3a21eb4e7beb8ef2aaa5

SHA1
3886e47ea7081394e4d489768e82ee978d2dc525

SHA256
673dbdedeb9c561a65f4974c3d0bb05b7765fe780ce6129b8f4e9a6af5698a58

SHA512
1b9aa69e0cf56935154ce6cce023d7a5ce881677e1040f5f70dadb2cb85ea81bc64076e879470a5a4844da27a47cf08a5e37d9d0adb67816fef442deea56b9a6

Download Submit
C:\Windows\SysWOW64\Hljnkdnk.exe

Filesize
64KB

MD5
6549c58e26e62bf52f6b4db884d83da4

SHA1
2cf14495f78fe9ed9d4f14d078d1338df4cd3deb

SHA256
a285a1f186efeb551cbd2df48e2e17a52428cd28ddc1e44026c30f1cafff72f7

SHA512
b4bebcf90fb799042b78a97b00cabb59dec6b6be53b6ca63150104e3b159b16b3baf58c5ccd28c82f55691fd61cddcece2c01ec20153feb2843d1f2a34b39e43

Download Submit
C:\Windows\SysWOW64\Hmkigh32.exe

Filesize
91KB

MD5
92d4bc7448471d4de872c179808bc155

SHA1
fcd0d0f30a0db40ee9ecd2c2111e103e33667ea2

SHA256
e15ee47040ae0495033a4825fbe0b11eb173dc084ce4463a14cc5c8c1c1aacb5

SHA512
06449b84fd82c916b5b792dfec7527fc982cfe20098dca44e65dd7fae74a34d0b5c8e35312368f989bc3ddb36b57af294ff99905fdbfa93a13e85e9e9bc4eb58

Download Submit
C:\Windows\SysWOW64\Igdgglfl.exe

Filesize
91KB

MD5
64589887bc07669bc8b6c9602384020f

SHA1
020edf08cc259794c41f13486ad428933291ece3

SHA256
9c20add2fca0848955dca422efb821c4b3082b26f5e39f7d30dedd4738a1a6f5

SHA512
54155bfdeb7cd3e43962936e743bfd10fec178ee66891fec67b5a4424f539f6a4abeb84a26df1cc940eea56a828938765263dc6b99838049e0b38abbe4665e0c

Download Submit
C:\Windows\SysWOW64\Jgbchj32.exe

Filesize
91KB

MD5
a0ebe8db9d393f49aab3ba45a72b12c1

SHA1
9c04bdff54eae2ddc4537d01321ff0a8ee35ede2

SHA256
79a42de91c6d400d93f60015ff06d3c76d31abf9cab0ae76f96d1ed7da24ecc0

SHA512
6e6e9d20779302abd4ceb85e92200f8993f3dbb2f76205b507a3862f15c930622642c548ae7329b676e0bda0aafec52082a9fed148130d496eff3f4452c48989

Download Submit
C:\Windows\SysWOW64\Jgpfbjlo.exe

Filesize
91KB

MD5
7d9388f50870fc33543f3bb92830f989

SHA1
3f2390a86dd18637fa726e004ec658906342fc05

SHA256
ba49342af9b6a11db30dfee90e13682d2ded183f70edff10a7b372b48da94bc2

SHA512
dbce6dbf3191ac761ba8796fb7a938fc7b7e2f2f16745e20168a33164b5774450dd2a624418f03fc323c37b5a619559ddbecf37acfe85366ece945757a365784

Download Submit
C:\Windows\SysWOW64\Jmamba32.exe

Filesize
91KB

MD5
f5588afde8bbd8472caeb1c7ad28b25c

SHA1
4112f328f4ef844f8deae3e621bdc6c217f51724

SHA256
6d215c2fd550e8edd011e2a3ff2a15c5edb39afdaca57b5865006771fa863539

SHA512
077954390f2be92fb2003c253dbcf8000476c6a44ed70f76f45e1c7edff876ef9d193ffb8d51673f8b764a42b93fa8e389cd8c39fc17de4cc632bf128f8ba202

Download Submit
C:\Windows\SysWOW64\Kdophj32.exe

Filesize
91KB

MD5
e7ad150f003452e1ff6da5e9c5434da4

SHA1
c61180091dc587bf07367647d522e26c64020d64

SHA256
3c39d25ee7f3a909e3c1f9a117f7745e66fbc6c6f82e5c9f713ec24c5787d3e7

SHA512
cbda6ebd3aae5ab92ba2798880a39fa28d5a61196869eb3f2f26d1e23b0f7430085360e4af9a95743d36275a6ab91ae5e58775c5b57dfa8a3fb8653ee8bb0d81

Download Submit
C:\Windows\SysWOW64\Kjgeedch.exe

Filesize
91KB

MD5
16e012c4f5e40da1b4ac74d90671278e

SHA1
18a0cd47bb5aeb1ca011733513056ef7a3abcab1

SHA256
a34bf3cf9940f024fc2143eabf0faab6a1f5bbe750a9a8559836f3b486ad4819

SHA512
1a20a80ddcd438c2773fcfb6f544bdb888fbe43f09858c05fc7d4d1368e096abb14da7b2fc7bc11d23c05face4038a74b8c95dfb4ca66f534108094084a956e2

Download Submit
C:\Windows\SysWOW64\Kqbdldnq.exe

Filesize
91KB

MD5
f7f0c465ab68120fd756c374f84b5a12

SHA1
6031ed4750ad96a4c230d723939e9f73547fe9c9

SHA256
5ccb8cab7c6e9e623aa8e2a7477238224ce93a17869ff7d99639c502ccb4d50f

SHA512
e3c4d8f97db55d90f96dd6c780253533a09b6723118146c826af87d3f6a56756477383fa1161dbcbbde5be957a56459db7d4277c97d10b2ddb02ede1cef47a8f

Download Submit
C:\Windows\SysWOW64\Lmdbooik.exe

Filesize
91KB

MD5
dee2e3c78d24673713045b80db3f7876

SHA1
6e512671c037e30fb6ec761a4b91033792b8d9c9

SHA256
7b647c857d4a64add93de2677f3fafbc06373cfa263a918bb9114213f7ee69b8

SHA512
f2556b00714e477a60a075e0305cf2d04e87734fb280b5e8ba157963a2c02a65a62bff3f1e0f5f16684142967e7367028dbe6fea40faf97ab8824ed5a9edd96e

Download Submit
C:\Windows\SysWOW64\Lmdnbn32.exe

Filesize
91KB

MD5
697c80fb8b792d5bf299ef0ee7652298

SHA1
f65ad6f39a2ac71be136813e38bb023e4e1048e4

SHA256
2953724fb359433f68d26c08aeb61105ba1bb1ff1e2092b8d229571d8e82893f

SHA512
c6b4d88a8770485fa05ef3da0c80a13b0831859692d2cd8be6f690a16ef3c3731fd08e530106a48896aace7c6fe4290787b6b6861f179ecf7cfd8503362eac10

Download Submit
C:\Windows\SysWOW64\Mjiloqjb.exe

Filesize
64KB

MD5
d59fdeb1e1f051870b3c051436d9ea02

SHA1
96766c8c71545579b918984f0511c61c2aa5fab8

SHA256
9366a4055b9956fbe5545b5c30c493ff76d55c1873038f94dcd32a04302475bd

SHA512
ade6d58d0df23f143c3c550f1db70c5203722bf2badf0042a507388995bd40d935c803b7c71964fb55d0fffc5f41f2df1bf98b480a748c8f13214b904292c96d

Download Submit
C:\Windows\SysWOW64\Mmdlflki.exe

Filesize
91KB

MD5
842965aef8930e27bd3f377ea24fe869

SHA1
4f9bc61e8206635d0086b7f961e13f8a5fb39bd7

SHA256
cd61c82523b814d7491f947e6df50528c629536914c9dd51976e54af6c4c5352

SHA512
20a10a18f78d7cc722bcde3e6e89d95633295561d69a7d2e799677ec6aba66f59a55d2d0d310a4647323167e74f76fe5065f30b5fdcb45bfeffa6bc81f8eddf3

Download Submit
C:\Windows\SysWOW64\Ncpeaoih.exe

Filesize
91KB

MD5
32b3f80fd833f4c98b588820275a66fd

SHA1
a0f58939a68aa3fdce5993478728d26ed95b745d

SHA256
1568114e4449f4447e987eb7ba035cf366a48828475034c7483d20d960fd6080

SHA512
a8489aef0b896e1a0da61eec6b2a7368f6ef9bac9fcff609bdf61b545161eda1d8c615ac4796283f9f49e448014ecfacffbc0063ca3ac3bb06ac8e2fb37deb6f

Download Submit
C:\Windows\SysWOW64\Nmipdk32.exe

Filesize
91KB

MD5
5ce78120ed92a8743cd7e993bd28d6c2

SHA1
2f89a908acdbddd4130b4bb43300282fd5970c78

SHA256
69a741825276d4e8c1cf26d1003ddbf22183a6716a2fd3f7440fed86ab80b9be

SHA512
3db370cf496717ce5e421002d9b61124e0e524b8a9fd4e9a0206b3c7261b0af36974a073edef6d6145bce2e5b8840993935bd35a69d9e58115bdb82a59211903

Download Submit
C:\Windows\SysWOW64\Nmnnlk32.exe

Filesize
91KB

MD5
45e898dbc8646448876bb6f3abba26c4

SHA1
af50e645ae30379f266bfcb282b7a690230297b6

SHA256
a9d35ced0d890de227659e25a62a103cba548cf1b64ef78eb72d80647aa9a3a7

SHA512
b9cecbd2c958a66d35d169ff68eb052b162c715a32a1c2c7381358fb9c88cda933b256fa6e678bccce4d275409c6af75885aac2eff18e944d9ae4a35070410b7

Download Submit
C:\Windows\SysWOW64\Ojjfpjjj.exe

Filesize
91KB

MD5
acaa5cc67a5ff76af0e0303f232276c2

SHA1
54d6e8a06a39c6e6cc038e5d09cd3195879a29d5

SHA256
521a6b6532fccf45837f02c00f6571c01968c4faf09c00d89c77d72a71c0e4bc

SHA512
8602c1478ed74c9b9567f3265be2ad9d94af9abc3b4f64368d8ca745f5f1d0fe8fc7277c42684421c85ab3ae3a6b98ace3b6f5f415c5378f4a83c964e5fe92f6

Download Submit
C:\Windows\SysWOW64\Opbcdieb.exe

Filesize
91KB

MD5
bce7b963538ff8579fe9e43c4a299b13

SHA1
b3c39fea8d3b84f8802c58617622841ad2d4e1a9

SHA256
03c756fa3ea840c5469334b00b76120dae81a34f8654ab476f5c1ef0261f70e1

SHA512
b35489a321aef7d8b16c7f549b805ec4107681665f1238f6246e734212d5de4906e93d4a194c56f6fb6d2bb47007876488a0a70cc40844abaf4bb70d1a105ead

Download Submit
C:\Windows\SysWOW64\Pblolb32.exe

Filesize
91KB

MD5
2dbcfcf1e9798cb2a9eaadff14c5c245

SHA1
221762471db213041b7bcf2f10d60340e9988546

SHA256
66e312c900e4ae04f78beeb899a4752c5bcde2a20c82f20a94b48ee2dcd7281f

SHA512
3a6f3229d4704ce720a681a3cf37ac04c8df0de57f7e8a9799eba6c22d93bde715371976af688dba729500a7508bbb08f640309f3aa655c30f19e9b6829dfb75

Download Submit
C:\Windows\SysWOW64\Ppeipfdm.exe

Filesize
64KB

MD5
90441f5cb77660113f40004f8633e182

SHA1
b7cf9ad26a24122a4f1de0bd24184512b5a5603b

SHA256
03d89c81642048781c51c9f654737bc9a728aceba95e7ceea8665aac4f8f57df

SHA512
b29d8fbf2d1bb45291e9ddfaa85582328660a9b716b335244b2e9b41b35b68b084eed90073a232e566528a4673d6c56bd5ecf14de0e2726a91aef18c8d56b3fc

Download Submit
memory/640-143-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/772-88-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1044-31-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1092-364-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1252-23-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1328-274-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1552-268-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1560-370-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1568-207-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1624-406-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1644-322-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1716-39-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1852-119-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/1928-191-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2036-167-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2080-412-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2096-55-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2244-159-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2312-316-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2316-262-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2336-111-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2724-394-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2732-328-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/2780-240-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3024-151-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3064-430-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3076-334-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3308-400-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3324-247-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3420-292-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3488-139-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3572-0-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3772-358-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3820-127-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3872-199-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3920-436-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4020-255-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4040-15-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4076-104-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4128-286-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4156-7-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4164-382-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4184-96-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4192-424-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4224-304-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4244-340-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4320-280-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4324-216-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4380-418-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4400-232-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4436-376-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4464-442-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4468-175-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4600-71-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4612-47-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4620-298-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4680-310-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4684-388-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4768-346-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4788-224-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4840-183-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4932-352-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5012-79-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/5092-63-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads